0b8eb6cd16405193c25dc34aff9c86465c034d46c757a786b64b7f9401106622

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe
Size

168KB
MD5

a9aa00ae5e998d65b57bcb80ca6353d2
SHA1

e7a63445efeebaf4979130e03bc3c54d6456911b
SHA256

0b8eb6cd16405193c25dc34aff9c86465c034d46c757a786b64b7f9401106622
SHA512

21ad924fc980a1a28a9e9d529da16623fea57e09374887c16a34fa4a46ff56abdd0fbbbe2e185e9034d98aa0b73cd95d70afea2277682c920a7604b89561a9da
SSDEEP

1536:1EGh0osli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0osliOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224e-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00080000000122cd-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001224e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001224e-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001224e-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001224e-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001224e-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}\stubpath = "C:\\Windows\\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe"	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}	{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}\stubpath = "C:\\Windows\\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}.exe"	{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}\stubpath = "C:\\Windows\\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe"	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{925296B4-50D9-46d3-9392-BDC49CECD1F8}	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{925296B4-50D9-46d3-9392-BDC49CECD1F8}\stubpath = "C:\\Windows\\{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe"	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}\stubpath = "C:\\Windows\\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe"	{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C2859DE-5F10-4e34-A07F-882F759A09E5}	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}\stubpath = "C:\\Windows\\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe"	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}\stubpath = "C:\\Windows\\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe"	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}\stubpath = "C:\\Windows\\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe"	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}\stubpath = "C:\\Windows\\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe"	{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}	{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}	{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}\stubpath = "C:\\Windows\\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe"	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C2859DE-5F10-4e34-A07F-882F759A09E5}\stubpath = "C:\\Windows\\{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe"	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe

Deletes itself 1 IoCs

pid	Process
2600	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe
2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe
2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
1060	{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
1260	{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
1264	{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe
588	{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
File created	C:\Windows\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe
File created	C:\Windows\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
File created	C:\Windows\{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
File created	C:\Windows\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
File created	C:\Windows\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe	{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
File created	C:\Windows\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe	{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
File created	C:\Windows\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe
File created	C:\Windows\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}.exe	{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe
File created	C:\Windows\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
File created	C:\Windows\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe
Token: SeIncBasePriorityPrivilege	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
Token: SeIncBasePriorityPrivilege	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
Token: SeIncBasePriorityPrivilege	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe
Token: SeIncBasePriorityPrivilege	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
Token: SeIncBasePriorityPrivilege	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
Token: SeIncBasePriorityPrivilege	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
Token: SeIncBasePriorityPrivilege	1060	{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
Token: SeIncBasePriorityPrivilege	1260	{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
Token: SeIncBasePriorityPrivilege	1264	{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2236	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	28
PID 2172 wrote to memory of 2236	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	28
PID 2172 wrote to memory of 2236	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	28
PID 2172 wrote to memory of 2236	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	28
PID 2172 wrote to memory of 2600	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	29
PID 2172 wrote to memory of 2600	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	29
PID 2172 wrote to memory of 2600	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	29
PID 2172 wrote to memory of 2600	2172	2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe	29
PID 2236 wrote to memory of 2628	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	30
PID 2236 wrote to memory of 2628	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	30
PID 2236 wrote to memory of 2628	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	30
PID 2236 wrote to memory of 2628	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	30
PID 2236 wrote to memory of 2552	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	31
PID 2236 wrote to memory of 2552	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	31
PID 2236 wrote to memory of 2552	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	31
PID 2236 wrote to memory of 2552	2236	{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe	31
PID 2628 wrote to memory of 2556	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	32
PID 2628 wrote to memory of 2556	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	32
PID 2628 wrote to memory of 2556	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	32
PID 2628 wrote to memory of 2556	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	32
PID 2628 wrote to memory of 304	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	33
PID 2628 wrote to memory of 304	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	33
PID 2628 wrote to memory of 304	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	33
PID 2628 wrote to memory of 304	2628	{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe	33
PID 2556 wrote to memory of 2756	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	36
PID 2556 wrote to memory of 2756	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	36
PID 2556 wrote to memory of 2756	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	36
PID 2556 wrote to memory of 2756	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	36
PID 2556 wrote to memory of 2792	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	37
PID 2556 wrote to memory of 2792	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	37
PID 2556 wrote to memory of 2792	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	37
PID 2556 wrote to memory of 2792	2556	{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe	37
PID 2756 wrote to memory of 2452	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	38
PID 2756 wrote to memory of 2452	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	38
PID 2756 wrote to memory of 2452	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	38
PID 2756 wrote to memory of 2452	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	38
PID 2756 wrote to memory of 1476	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	39
PID 2756 wrote to memory of 1476	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	39
PID 2756 wrote to memory of 1476	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	39
PID 2756 wrote to memory of 1476	2756	{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe	39
PID 2452 wrote to memory of 556	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	40
PID 2452 wrote to memory of 556	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	40
PID 2452 wrote to memory of 556	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	40
PID 2452 wrote to memory of 556	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	40
PID 2452 wrote to memory of 2680	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	41
PID 2452 wrote to memory of 2680	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	41
PID 2452 wrote to memory of 2680	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	41
PID 2452 wrote to memory of 2680	2452	{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe	41
PID 556 wrote to memory of 2672	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	42
PID 556 wrote to memory of 2672	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	42
PID 556 wrote to memory of 2672	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	42
PID 556 wrote to memory of 2672	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	42
PID 556 wrote to memory of 2664	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	43
PID 556 wrote to memory of 2664	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	43
PID 556 wrote to memory of 2664	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	43
PID 556 wrote to memory of 2664	556	{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe	43
PID 2672 wrote to memory of 1060	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	44
PID 2672 wrote to memory of 1060	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	44
PID 2672 wrote to memory of 1060	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	44
PID 2672 wrote to memory of 1060	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	44
PID 2672 wrote to memory of 1428	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	45
PID 2672 wrote to memory of 1428	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	45
PID 2672 wrote to memory of 1428	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	45
PID 2672 wrote to memory of 1428	2672	{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_a9aa00ae5e998d65b57bcb80ca6353d2_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe
  C:\Windows\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
    C:\Windows\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
      C:\Windows\{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe
        
        C:\Windows\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2756
      - C:\Windows\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
        
        C:\Windows\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
        
        C:\Windows\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
        
        C:\Windows\{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
        
        C:\Windows\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
        
        C:\Windows\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
        
        C:\Windows\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe
        
        C:\Windows\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}.exe
        
        C:\Windows\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}.exe
        12⤵
        Executes dropped EXE
        
        PID:588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{156D1~1.EXE > nul
        12⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8FEC4~1.EXE > nul
        11⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7EC93~1.EXE > nul
        10⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92529~1.EXE > nul
        9⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A467D~1.EXE > nul
        8⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EBA19~1.EXE > nul
        7⤵
        
        PID:2680
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E10A~1.EXE > nul
        6⤵
        
        PID:1476
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C285~1.EXE > nul
        5⤵
        
        PID:2792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{82872~1.EXE > nul
      4⤵
      PID:304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7FF6E~1.EXE > nul
    3⤵
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{156D1818-E7B5-422f-80CF-B2A0A8FE6441}.exe

Filesize
168KB

MD5
261c8b3923f64f8590b0d0b4403bf5e1

SHA1
14f26aec42a453e9ab6aabc42f10752373abe733

SHA256
6adb3c28caf5e0203e81c1a01955c4a64bf4e4f19870940294e26c48f9f7f361

SHA512
d230639f1825e40562229024e847430c9bf49866d5acc96816e765268192a18bfc3a9093e4e8cc3b143d9f20d61419717519a71390fe191119f28dc069dde707

Download Submit
C:\Windows\{37877B32-4DEA-4d5b-8DBC-1923BFA014CF}.exe

Filesize
168KB

MD5
724b99edf9be88a53e9a283b058e7365

SHA1
59cb8bb24e27c9f277988ca31b4a8e4651d25693

SHA256
2bb6013bf73f92630f8dd09d74a4e48e09bee6862a688befda1d6bf2aa84567c

SHA512
e1e7cd00fe9a67348cf948f0fc8d7781dfe706fd51d875655cee03bb97a15b8297778eea4f3508a751a7f0524a731d123c5eea791c4a47c4892a42af1339ea8b

Download Submit
C:\Windows\{4E10AB2D-48A2-4e05-ADA0-B5ED6EA17818}.exe

Filesize
168KB

MD5
319cafef5460eea8cd843a2b3dbdfcff

SHA1
23c3437dfde2cb130c684fbb4464c98c384ea9c2

SHA256
1e21babd58f8a184887a107075c45061fcc150c357d4fac388713ef15c87940d

SHA512
1fe853a785018f576a94aa14301e1a19a2fa671dc9f86d213580347b528bc22ef1f8c147afef39d919afb416409a4c5507316e7219ca126ab9955528cadd2d0c

Download Submit
C:\Windows\{7C2859DE-5F10-4e34-A07F-882F759A09E5}.exe

Filesize
168KB

MD5
7555c0f277e672a6c4c26d3daaea9596

SHA1
a892e0ae5e66e2289a5f7ce020d0b451a535a8ee

SHA256
935c6b5cf91c4d1442c2484274883aa161e00694e84dd85e25caedfba49bf46a

SHA512
e15d908585248511d6f6751043810177135566cbb95ed1367096f7fe2c9b45e82c91868ec4010ca722f9b10674962f7ab544716785dd996be5d1d6a6780f9bf3

Download Submit
C:\Windows\{7EC93992-7D55-4f5c-A4F7-AF4B58CD8D66}.exe

Filesize
168KB

MD5
3b5aad29d98fcd19da89fe11c7bbaa9b

SHA1
ae5cb1053e38ce18c2017dbb6985e89e65c73cac

SHA256
5386efdfe23e490929708ed487aea049b7062c0f709dd3efbafc6bad010ccbeb

SHA512
2ab7806b212638ba9fc33c761044fba52eb786c791c031f4bb5c056e769507e4c7c2e74ec963a4706e7204c642ed4dd01b056da2b6360c2c2ca94753cd631593

Download Submit
C:\Windows\{7FF6E652-A2A5-46d0-AE9B-E195CF3CEB89}.exe

Filesize
168KB

MD5
220f2890688a8ae6d518a48319970fe6

SHA1
338d7bd834b58fb61ed3255b5f17da04f8e489d1

SHA256
8e56f58101a961102ead1221966fad98af0bf56e8d84c20760334d595e332e28

SHA512
665f8aa8a04bbb80bb399060e0e337f649743062828da4e8177d7bc1f5986db47643509489f0b7570d32b5829a4918d88d07f3f44aeda05be260274b9a69fcff

Download Submit
C:\Windows\{82872B5E-FB3D-4166-ADE8-1169AD71CF0E}.exe

Filesize
168KB

MD5
621869c6b923366cbf5e4507e3850153

SHA1
4c73a3fbe261c8f1fe8d04ff66f8080857445b56

SHA256
8fb7944ef0356d58da568acfc9a192a77c86920618c41ab031065a27726c23b5

SHA512
104bd77061df6518ce16cc2a82c51e62844794859537ca341c2e709db14c1b1bf646bb3cd4287aa72d8283cf88b1460d15b1c3982f18a50e5da4eb8d391ddbeb

Download Submit
C:\Windows\{8FEC4658-5547-41b4-9A37-C5F98DBBF2CD}.exe

Filesize
168KB

MD5
7bb9ffe9273d6eda6c5fd916b8b8d291

SHA1
6e546801338bde6c42bdb11763e5576e099a8e37

SHA256
0bc374e1e8463860182715df46998ff88afce7578a4771a6eb0f5209cd62ffec

SHA512
25296cf7f452d9ebd862b001555df9acbe68de5309cdc2b67a2737e051fe57cbe18dc6bae8cebcb06b25d61ae3f04619068273730343d91d69b30f8c467f26bb

Download Submit
C:\Windows\{925296B4-50D9-46d3-9392-BDC49CECD1F8}.exe

Filesize
168KB

MD5
c7cea15efa3439d2942427bd15eb8715

SHA1
3faec8497bfb8f80eb167adab1ed67e4a331c350

SHA256
aa675d169a05fc433457d4270a8e819ef47ad517bfdb6d161e94ea63a799bf33

SHA512
4e67fd104e68b6cc6d7452a16383848c2f7409a1254db8f10df92b247031bdd6b1002397050afdb1107fdc1396ca549cc1fee1bbecb3d7967b1dc1c32981f248

Download Submit
C:\Windows\{A467D1AE-0E99-4ab8-86D7-1235AFB73CF6}.exe

Filesize
168KB

MD5
136d627c084571433b859fbb18c6545e

SHA1
2073537910b5541e53ca3e19c562ac0afb9a8b50

SHA256
cde523b3cb9a9cd83bdf4cf0cc71425431acdc940f52dc38ea529ea7b5f15f8a

SHA512
7386881af78b48c18e80102c0d298a6df2a6481b816d191f18558ae2c2526330acadfc9b18b2bd6107a4bd0b7070e37c431e9e702404236d9d3b465f01ac334c

Download Submit
C:\Windows\{EBA19A0E-B4DC-4d1b-8BF6-247482B3151E}.exe

Filesize
168KB

MD5
9c634aedc93bd9f1e077f789286f3997

SHA1
3b13fa1597577701aed566161a588eb2b11e81f6

SHA256
de1465fcdd9e876d288b054c67a4aa8a8ebaca2f940ac88835d0b0c1b364a781

SHA512
00f8afb7dd333d15897654a0fa5debf6467e64ee81c88b1e81fc28bfd04552ff2a98489e82336d2bfee9e8feab2d64bd60688ef45936d54056de744137dc8331

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads