4b78051774b5c521e900ca48e31670d15c06f571c98ebd87000b1ca7acdc13fa

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe
Size

408KB
MD5

fb2d55ad242c2b7414390b13743ad292
SHA1

832b2459312e787b7bf40b6ac64b742d9b059dce
SHA256

4b78051774b5c521e900ca48e31670d15c06f571c98ebd87000b1ca7acdc13fa
SHA512

f85b85cb4489e39703adb7e2214a7d108e2fa1606f51367ca0d08c69708f65426a26d9d8fe8c40b57c2c384843951461e0df0d8e52b3c4d69ce6406409262b52
SSDEEP

3072:CEGh0oXl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGRldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a71-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000141a2-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000013a71-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000143ec-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000013a71-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000013a71-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000013a71-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AD30B425-D95D-439e-9741-BAE9A0367AED}\stubpath = "C:\\Windows\\{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe"	{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E8BE2323-511F-4426-B11B-139469686128}	{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}\stubpath = "C:\\Windows\\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe"	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52BF92D2-C8FE-485a-864D-1C1D2C901466}\stubpath = "C:\\Windows\\{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe"	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29E04428-9E88-4bd7-9442-2DD30C7552F8}\stubpath = "C:\\Windows\\{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe"	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E8BE2323-511F-4426-B11B-139469686128}\stubpath = "C:\\Windows\\{E8BE2323-511F-4426-B11B-139469686128}.exe"	{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}\stubpath = "C:\\Windows\\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe"	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{84179DB3-7969-4768-B675-F00EE1B1837A}	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29E04428-9E88-4bd7-9442-2DD30C7552F8}	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}	{E8BE2323-511F-4426-B11B-139469686128}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}\stubpath = "C:\\Windows\\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}.exe"	{E8BE2323-511F-4426-B11B-139469686128}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52BF92D2-C8FE-485a-864D-1C1D2C901466}	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AB299C7-1433-4d75-92A1-40C4D3F69646}	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}\stubpath = "C:\\Windows\\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe"	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AB299C7-1433-4d75-92A1-40C4D3F69646}\stubpath = "C:\\Windows\\{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe"	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}\stubpath = "C:\\Windows\\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe"	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{84179DB3-7969-4768-B675-F00EE1B1837A}\stubpath = "C:\\Windows\\{84179DB3-7969-4768-B675-F00EE1B1837A}.exe"	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AD30B425-D95D-439e-9741-BAE9A0367AED}	{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe

Deletes itself 1 IoCs

pid	Process
3064	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe
2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
1176	{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe
2120	{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
1752	{E8BE2323-511F-4426-B11B-139469686128}.exe
112	{63AD0A90-21F7-4d40-B4D2-02F21E656B29}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
File created	C:\Windows\{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
File created	C:\Windows\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}.exe	{E8BE2323-511F-4426-B11B-139469686128}.exe
File created	C:\Windows\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
File created	C:\Windows\{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe	{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe
File created	C:\Windows\{E8BE2323-511F-4426-B11B-139469686128}.exe	{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
File created	C:\Windows\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe
File created	C:\Windows\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
File created	C:\Windows\{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
File created	C:\Windows\{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
File created	C:\Windows\{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
Token: SeIncBasePriorityPrivilege	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
Token: SeIncBasePriorityPrivilege	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
Token: SeIncBasePriorityPrivilege	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
Token: SeIncBasePriorityPrivilege	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe
Token: SeIncBasePriorityPrivilege	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
Token: SeIncBasePriorityPrivilege	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
Token: SeIncBasePriorityPrivilege	1176	{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe
Token: SeIncBasePriorityPrivilege	2120	{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
Token: SeIncBasePriorityPrivilege	1752	{E8BE2323-511F-4426-B11B-139469686128}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3008	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	28
PID 2392 wrote to memory of 3008	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	28
PID 2392 wrote to memory of 3008	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	28
PID 2392 wrote to memory of 3008	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	28
PID 2392 wrote to memory of 3064	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	29
PID 2392 wrote to memory of 3064	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	29
PID 2392 wrote to memory of 3064	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	29
PID 2392 wrote to memory of 3064	2392	2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe	29
PID 3008 wrote to memory of 2896	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	30
PID 3008 wrote to memory of 2896	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	30
PID 3008 wrote to memory of 2896	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	30
PID 3008 wrote to memory of 2896	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	30
PID 3008 wrote to memory of 2644	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	31
PID 3008 wrote to memory of 2644	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	31
PID 3008 wrote to memory of 2644	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	31
PID 3008 wrote to memory of 2644	3008	{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe	31
PID 2896 wrote to memory of 2952	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	32
PID 2896 wrote to memory of 2952	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	32
PID 2896 wrote to memory of 2952	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	32
PID 2896 wrote to memory of 2952	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	32
PID 2896 wrote to memory of 2572	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	33
PID 2896 wrote to memory of 2572	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	33
PID 2896 wrote to memory of 2572	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	33
PID 2896 wrote to memory of 2572	2896	{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe	33
PID 2952 wrote to memory of 2508	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	36
PID 2952 wrote to memory of 2508	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	36
PID 2952 wrote to memory of 2508	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	36
PID 2952 wrote to memory of 2508	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	36
PID 2952 wrote to memory of 1984	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	37
PID 2952 wrote to memory of 1984	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	37
PID 2952 wrote to memory of 1984	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	37
PID 2952 wrote to memory of 1984	2952	{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe	37
PID 2508 wrote to memory of 3036	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	38
PID 2508 wrote to memory of 3036	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	38
PID 2508 wrote to memory of 3036	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	38
PID 2508 wrote to memory of 3036	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	38
PID 2508 wrote to memory of 2860	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	39
PID 2508 wrote to memory of 2860	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	39
PID 2508 wrote to memory of 2860	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	39
PID 2508 wrote to memory of 2860	2508	{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe	39
PID 3036 wrote to memory of 2640	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	40
PID 3036 wrote to memory of 2640	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	40
PID 3036 wrote to memory of 2640	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	40
PID 3036 wrote to memory of 2640	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	40
PID 3036 wrote to memory of 2772	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	41
PID 3036 wrote to memory of 2772	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	41
PID 3036 wrote to memory of 2772	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	41
PID 3036 wrote to memory of 2772	3036	{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe	41
PID 2640 wrote to memory of 1464	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	42
PID 2640 wrote to memory of 1464	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	42
PID 2640 wrote to memory of 1464	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	42
PID 2640 wrote to memory of 1464	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	42
PID 2640 wrote to memory of 2676	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	43
PID 2640 wrote to memory of 2676	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	43
PID 2640 wrote to memory of 2676	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	43
PID 2640 wrote to memory of 2676	2640	{84179DB3-7969-4768-B675-F00EE1B1837A}.exe	43
PID 1464 wrote to memory of 1176	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	44
PID 1464 wrote to memory of 1176	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	44
PID 1464 wrote to memory of 1176	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	44
PID 1464 wrote to memory of 1176	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	44
PID 1464 wrote to memory of 1560	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	45
PID 1464 wrote to memory of 1560	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	45
PID 1464 wrote to memory of 1560	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	45
PID 1464 wrote to memory of 1560	1464	{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_fb2d55ad242c2b7414390b13743ad292_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
  C:\Windows\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
    C:\Windows\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
      C:\Windows\{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Windows\{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
        
        C:\Windows\{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2508
      - C:\Windows\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe
        
        C:\Windows\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
        
        C:\Windows\{84179DB3-7969-4768-B675-F00EE1B1837A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
        
        C:\Windows\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe
        
        C:\Windows\{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
        
        C:\Windows\{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
        
        C:\Windows\{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\{E8BE2323-511F-4426-B11B-139469686128}.exe
        
        C:\Windows\{E8BE2323-511F-4426-B11B-139469686128}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Windows\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}.exe
        
        C:\Windows\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}.exe
        12⤵
        Executes dropped EXE
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E8BE2~1.EXE > nul
        12⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AD30B~1.EXE > nul
        11⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{29E04~1.EXE > nul
        10⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D515~1.EXE > nul
        9⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{84179~1.EXE > nul
        8⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7AAEB~1.EXE > nul
        7⤵
        
        PID:2772
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3AB29~1.EXE > nul
        6⤵
        
        PID:2860
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{52BF9~1.EXE > nul
        5⤵
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FDE5F~1.EXE > nul
      4⤵
      PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C9722~1.EXE > nul
    3⤵
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{29E04428-9E88-4bd7-9442-2DD30C7552F8}.exe

Filesize
408KB

MD5
89ae19ce1b9926f6d2b3ed63e8d36a8d

SHA1
f1ec52afd12d8ccdc5dd063de93d2aee1425cbb2

SHA256
82273971908658a1d2a789b8fd85a205e4b1d47867162d91eec4e225732ed56d

SHA512
7def3f8bf62d75b8dda4639151b0288d780e8adea1e7be3f9cbad2e874ac9a9632dbd981fb193d4a1b3da83806885b2ea2f5e5691680260af59ff6f17c5f9fca

Download Submit
C:\Windows\{2D515DCE-AE1F-4d3c-8FB1-1E310E766D21}.exe

Filesize
408KB

MD5
6e92197d9c6878776e84beb39cad0587

SHA1
4bcbcfa5ab984bf1a1da18b456de389982d8fae2

SHA256
cac87bd5098e1064e2f688127d75918826bcc675e6a53d36ccde30b174c65acf

SHA512
50c5282bcedd55bdbb4896f394196426dcdc6c42092d7100e2feaa3b388c26e85eb300b9ab050e64ea60068ca88c4b40e12b4f8b495fdcae5427b01428130844

Download Submit
C:\Windows\{3AB299C7-1433-4d75-92A1-40C4D3F69646}.exe

Filesize
408KB

MD5
9ae4cb47bbfc478d2842c67bf35392a8

SHA1
2b819b68fc90d706f888365d77c4f233878ca13f

SHA256
16c4433d7802c8d7f0fbb791ff75a1a1e859e643de8357dc7c01b1c789528a0e

SHA512
c7ad19b3402aa9a0c59aa21a3d754d860243c3beb22c2945b9990ca2efe863c9c1b97419f99631b5b4bbb855a02d437dd9687eb20f0cf735a9ad31e103074191

Download Submit
C:\Windows\{52BF92D2-C8FE-485a-864D-1C1D2C901466}.exe

Filesize
408KB

MD5
5eb6f3b6c6bfa625344ffb795437c81a

SHA1
a1997c5c534c98f586b40851913b0e51077efa1a

SHA256
b121dbb35d2832df551643c33859527c48d57b455e983dd736ce7f1efd2329f2

SHA512
6f6c0415052f93fef75429f9ae17142456581860c4f78412eee4e60e3f299f1632764bcd3b8e72577832b3645eb83013749570f73b6b9628e0dd68b093ec2666

Download Submit
C:\Windows\{63AD0A90-21F7-4d40-B4D2-02F21E656B29}.exe

Filesize
408KB

MD5
081ee7d93829d3ef0448bb25ccf1cb65

SHA1
5d1e590363e7196c635b2884a831db4bc85244b5

SHA256
c407b47a7fa76b6682b269a2a4287b14832c19c4aadb46dc36eb521ad923132c

SHA512
cb6fdcbb0d52e184a4105bac578ae934ee3ac5612f8e14753bf52b14b9f9ce40612b7e682d8bba8e154b86dc1d45767710fe2c7fbabae9ed72619e2a8839263b

Download Submit
C:\Windows\{7AAEB8CA-CB11-48a2-B855-8D26407B6CCF}.exe

Filesize
408KB

MD5
0abdedd8ede4084d3b18dbae04bb4c06

SHA1
4ff58ea0ed1a2e4f0dd6b170f83268535375dd32

SHA256
8a245e74ed963f2773c86c3a86db13bddcfc931e9f0c5bff0a1dbeb152e6f4ea

SHA512
1950350ba8046c849449d11b76aeeee72d605479e13b3dbaf179118fc0f29dbf2182175996b5c9a81ede8c5a23b8183a767c8b4dbb26679411b392fbd21444d0

Download Submit
C:\Windows\{84179DB3-7969-4768-B675-F00EE1B1837A}.exe

Filesize
408KB

MD5
fccbf3d4254ae39b9f83d57af88e4a81

SHA1
85fb1d03c8af619cd232e831d4344575d58283b4

SHA256
5421fad12cc0e56d15d51e44d9d198e1f0b7bc2ce4b42b9da6299807ff99460f

SHA512
993d7a493aeb47d5a3c4e5ce20f43ad372914fb2fd26acbc5b63e43a11abc24702d3789bb36079d3d0f6fd530d1607ba42c251ff35998223c0cb3a261448f26a

Download Submit
C:\Windows\{AD30B425-D95D-439e-9741-BAE9A0367AED}.exe

Filesize
408KB

MD5
5d9ce3cc65875d33a0befdf096797228

SHA1
539d768e7e0f0812b711be73d9a2f36a430cf4f0

SHA256
c1d1d78836c4b900514a47316eacab5a6f441533966b0b8976171b34aae6f843

SHA512
ea8ce7c4ca8bf2d6839d52bc4deae760d82028505c33cf465f951162637ca86be227877a1b04577542daa9d16c666c4565318d4152d9bcf381be336e312161e1

Download Submit
C:\Windows\{C9722CD7-D4EB-4fdc-8CB8-6973A11670BB}.exe

Filesize
408KB

MD5
3404e6d0d29871ea191927865cdf6959

SHA1
5c4efe54c08ca4808123d6d8f8a57a27a0d31430

SHA256
3ef470afb91fe16bb73a6b73293cbf216a299201e47c2bdab0b146317c651a66

SHA512
d76908b8f27879f8349fab75ef61538d4482116a5a54390de136e789a030975f583da9c66d4f1010b12a0a740f58089985ba43d9fa77d55f9e9ce2f560b2b316

Download Submit
C:\Windows\{E8BE2323-511F-4426-B11B-139469686128}.exe

Filesize
408KB

MD5
9819d69e33b94c1b50cbc4ff49875ba1

SHA1
5bbc33593db04a2177a3a7252ae46a451bbbbeef

SHA256
bf68f398e6c2a96d95bcf21408ed21293416702c2fad5761fd277767cacd5bac

SHA512
63098f94a7229871e63ae3baf7c1cbd47bb35f047673394e35497b23616abb75168f2b969beadc21d1b6375ad338961a31f0c51bd41a55ef9d4ec1b76a468d63

Download Submit
C:\Windows\{FDE5FC8F-DEED-49a8-A039-DB70C458ABB6}.exe

Filesize
408KB

MD5
86687c6f94c8b36f5626a120e7aba616

SHA1
f87ef461f3c7eed028d868094a723d18d2d88173

SHA256
fff4fdd0289bd9b767200bd5e0acdab29ee8ac83b33fdaafffb5702f1de08df8

SHA512
e8b9059d704dcb6b07b67610063445fc93e6bbffc1a6fa090ff08b6d8870f757572665259a9be6e526396b35954d67fe76559764d6380ed42d48d76f9d818418

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads