c027eb3e7ec5478f30739f44e3b9dafc0d7390018aff3ea19da8b02d17fdfd23

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe
Size

180KB
MD5

0c2919966419f6e5ee6ff492a18f931f
SHA1

ac2babbb07b320b546caeb103c0d8042140f30f0
SHA256

c027eb3e7ec5478f30739f44e3b9dafc0d7390018aff3ea19da8b02d17fdfd23
SHA512

1c376cfa1e82924a2322d9ab6a7a3b211b28d63a90559ea23f6b1cc3fd1d2723d1ebb45150663cbaf549c9a66e5000f27425d0f12a3433dd5b6225171d92af69
SSDEEP

3072:jEGh0otlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGDl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000121c5-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000121e6-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000121c5-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000121c5-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000121c5-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000121c5-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00100000000121c5-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EDC2670F-55F5-485c-9989-5375A2A530F0}	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51F9ED4B-564B-494a-8C19-14856DD190A1}	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{353F211C-45C1-43f0-AC19-8567FEB9FE22}	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD7FEB27-1996-4050-B63D-398BE5400EF5}	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2364209C-863C-421a-97FF-7C2D89499571}	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}\stubpath = "C:\\Windows\\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe"	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{118E6474-DD78-4d28-8497-7461E6A69C2E}\stubpath = "C:\\Windows\\{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe"	{2364209C-863C-421a-97FF-7C2D89499571}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}	{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}\stubpath = "C:\\Windows\\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}.exe"	{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E630C082-8BC4-4a99-8BB0-63E4025556B6}\stubpath = "C:\\Windows\\{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe"	{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D292669C-7311-4e66-85F1-C6DF617F4A22}	{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EDC2670F-55F5-485c-9989-5375A2A530F0}\stubpath = "C:\\Windows\\{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe"	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD586648-34D9-4d51-9ECD-6163A5F85A25}	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{353F211C-45C1-43f0-AC19-8567FEB9FE22}\stubpath = "C:\\Windows\\{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe"	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD7FEB27-1996-4050-B63D-398BE5400EF5}\stubpath = "C:\\Windows\\{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe"	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2364209C-863C-421a-97FF-7C2D89499571}\stubpath = "C:\\Windows\\{2364209C-863C-421a-97FF-7C2D89499571}.exe"	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{118E6474-DD78-4d28-8497-7461E6A69C2E}	{2364209C-863C-421a-97FF-7C2D89499571}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D292669C-7311-4e66-85F1-C6DF617F4A22}\stubpath = "C:\\Windows\\{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe"	{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD586648-34D9-4d51-9ECD-6163A5F85A25}\stubpath = "C:\\Windows\\{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe"	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51F9ED4B-564B-494a-8C19-14856DD190A1}\stubpath = "C:\\Windows\\{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe"	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E630C082-8BC4-4a99-8BB0-63E4025556B6}	{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe

Executes dropped EXE 11 IoCs

pid	Process
2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe
684	{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe
888	{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
644	{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe
1160	{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
File created	C:\Windows\{2364209C-863C-421a-97FF-7C2D89499571}.exe	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
File created	C:\Windows\{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe	{2364209C-863C-421a-97FF-7C2D89499571}.exe
File created	C:\Windows\{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe
File created	C:\Windows\{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
File created	C:\Windows\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
File created	C:\Windows\{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
File created	C:\Windows\{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
File created	C:\Windows\{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe	{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe
File created	C:\Windows\{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe	{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
File created	C:\Windows\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}.exe	{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
Token: SeIncBasePriorityPrivilege	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
Token: SeIncBasePriorityPrivilege	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
Token: SeIncBasePriorityPrivilege	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
Token: SeIncBasePriorityPrivilege	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
Token: SeIncBasePriorityPrivilege	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
Token: SeIncBasePriorityPrivilege	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe
Token: SeIncBasePriorityPrivilege	684	{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe
Token: SeIncBasePriorityPrivilege	888	{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
Token: SeIncBasePriorityPrivilege	644	{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2732	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	28
PID 2968 wrote to memory of 2732	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	28
PID 2968 wrote to memory of 2732	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	28
PID 2968 wrote to memory of 2732	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	28
PID 2968 wrote to memory of 2508	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	29
PID 2968 wrote to memory of 2508	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	29
PID 2968 wrote to memory of 2508	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	29
PID 2968 wrote to memory of 2508	2968	2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe	29
PID 2732 wrote to memory of 2652	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	30
PID 2732 wrote to memory of 2652	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	30
PID 2732 wrote to memory of 2652	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	30
PID 2732 wrote to memory of 2652	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	30
PID 2732 wrote to memory of 2856	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	31
PID 2732 wrote to memory of 2856	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	31
PID 2732 wrote to memory of 2856	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	31
PID 2732 wrote to memory of 2856	2732	{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe	31
PID 2652 wrote to memory of 2720	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	32
PID 2652 wrote to memory of 2720	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	32
PID 2652 wrote to memory of 2720	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	32
PID 2652 wrote to memory of 2720	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	32
PID 2652 wrote to memory of 2436	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	33
PID 2652 wrote to memory of 2436	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	33
PID 2652 wrote to memory of 2436	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	33
PID 2652 wrote to memory of 2436	2652	{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe	33
PID 2720 wrote to memory of 2952	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	36
PID 2720 wrote to memory of 2952	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	36
PID 2720 wrote to memory of 2952	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	36
PID 2720 wrote to memory of 2952	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	36
PID 2720 wrote to memory of 2392	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	37
PID 2720 wrote to memory of 2392	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	37
PID 2720 wrote to memory of 2392	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	37
PID 2720 wrote to memory of 2392	2720	{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe	37
PID 2952 wrote to memory of 2772	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	38
PID 2952 wrote to memory of 2772	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	38
PID 2952 wrote to memory of 2772	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	38
PID 2952 wrote to memory of 2772	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	38
PID 2952 wrote to memory of 2816	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	39
PID 2952 wrote to memory of 2816	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	39
PID 2952 wrote to memory of 2816	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	39
PID 2952 wrote to memory of 2816	2952	{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe	39
PID 2772 wrote to memory of 1660	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	40
PID 2772 wrote to memory of 1660	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	40
PID 2772 wrote to memory of 1660	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	40
PID 2772 wrote to memory of 1660	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	40
PID 2772 wrote to memory of 1072	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	41
PID 2772 wrote to memory of 1072	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	41
PID 2772 wrote to memory of 1072	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	41
PID 2772 wrote to memory of 1072	2772	{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe	41
PID 1660 wrote to memory of 1928	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	42
PID 1660 wrote to memory of 1928	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	42
PID 1660 wrote to memory of 1928	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	42
PID 1660 wrote to memory of 1928	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	42
PID 1660 wrote to memory of 1940	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	43
PID 1660 wrote to memory of 1940	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	43
PID 1660 wrote to memory of 1940	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	43
PID 1660 wrote to memory of 1940	1660	{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe	43
PID 1928 wrote to memory of 684	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	44
PID 1928 wrote to memory of 684	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	44
PID 1928 wrote to memory of 684	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	44
PID 1928 wrote to memory of 684	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	44
PID 1928 wrote to memory of 588	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	45
PID 1928 wrote to memory of 588	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	45
PID 1928 wrote to memory of 588	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	45
PID 1928 wrote to memory of 588	1928	{2364209C-863C-421a-97FF-7C2D89499571}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_0c2919966419f6e5ee6ff492a18f931f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
  C:\Windows\{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
    C:\Windows\{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
      C:\Windows\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
        
        C:\Windows\{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - C:\Windows\{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
        
        C:\Windows\{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
        
        C:\Windows\{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\{2364209C-863C-421a-97FF-7C2D89499571}.exe
        
        C:\Windows\{2364209C-863C-421a-97FF-7C2D89499571}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe
        
        C:\Windows\{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
        
        C:\Windows\{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
        
        C:\Windows\{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
        
        C:\Windows\{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe
        
        C:\Windows\{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:644
        
        C:\Windows\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}.exe
        
        C:\Windows\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}.exe
        12⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D2926~1.EXE > nul
        12⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E630C~1.EXE > nul
        11⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{118E6~1.EXE > nul
        10⤵
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{23642~1.EXE > nul
        9⤵
        
        PID:588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD7FE~1.EXE > nul
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{353F2~1.EXE > nul
        7⤵
        
        PID:1072
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{51F9E~1.EXE > nul
        6⤵
        
        PID:2816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45785~1.EXE > nul
        5⤵
        
        PID:2392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CD586~1.EXE > nul
      4⤵
      PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EDC26~1.EXE > nul
    3⤵
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{118E6474-DD78-4d28-8497-7461E6A69C2E}.exe

Filesize
180KB

MD5
0caac60e44773a4ae7d37aa12800eb9e

SHA1
f15e6fc0d16656887a168e59133fe7f1051d42b9

SHA256
b1f01cebe4861fa6ca86ad4915eff362fed051c54e50477e071f4026bda7dfd7

SHA512
2da0ad69ccc961610526a2b9d080163130c56c66049de9f31c868f24c855d44ac53d6159860e27ab1285702a339627f439a98585f18b3ad8d411af582c922d8d

Download Submit
C:\Windows\{2364209C-863C-421a-97FF-7C2D89499571}.exe

Filesize
180KB

MD5
f29d8e489ce3097732fccff806767acf

SHA1
be2cd381efe3500ea24a213f4db1a6f206aee0e3

SHA256
542ee36007330401c98827ae791882e94f65f315784a1addb2911c7b3e311590

SHA512
767e908661b4fd79e0a9ecff5fa82a013976fa9232ba42f87a7a0292d727dceaf1d0defa085592a7088c53892341ae8c6fdd88c2fd5259a9b5fa0beeda85188f

Download Submit
C:\Windows\{353F211C-45C1-43f0-AC19-8567FEB9FE22}.exe

Filesize
180KB

MD5
6b9b6250322f29e3aa917da26d0b0d8f

SHA1
d9de50053c7ef7612bbbfe3402942acfb04d7248

SHA256
945ee9c35ed1dc2de3bb5c991202b9b1a0e3618a92309901a12a0a37b8f88dee

SHA512
e0f315fc8835ac8a6441efa27352fb0be4077cca8c072903e2bfa26b1070d1d0de7b24a9240a360d0e8c70493dd600a161f84aa5bf92f570e96a31d51ce7eaf5

Download Submit
C:\Windows\{45785BC5-CB3B-43e5-B0C8-69E32C633B10}.exe

Filesize
180KB

MD5
29f6659e8d18fbbc0f3d6c47ba1db99f

SHA1
4db54c72fe8c8a20973372715c4f3b675c4814f3

SHA256
3f60f7356b1854dc2b6b8dfb1b7f37e81ee35976c561331b99eebb852c40d309

SHA512
e1411436fd5eda9846b51583350c726ade8d0678bd3dd8bd096f5a0d82e476c4838b838607cc6170acdd8191aab686df0b44253fe10c0fe97ce7cc224d44b631

Download Submit
C:\Windows\{51F9ED4B-564B-494a-8C19-14856DD190A1}.exe

Filesize
180KB

MD5
3056c7d864f321085121017c868ded3c

SHA1
46d36fe3ce0728aa79d8107923150a2cae066b00

SHA256
d348052c25003515427929bc2cb7880651824c926de2786de6cb4173413289cc

SHA512
052a7c777bc2dc1b3f7792a4cc729999aca1fc4b838285d0a717f217e9772e2d8dbefbd10b8559991a50509826cf5e508b7615099e29c1f5c7239aa7bed3b657

Download Submit
C:\Windows\{CD586648-34D9-4d51-9ECD-6163A5F85A25}.exe

Filesize
180KB

MD5
3f70ac3434e567157b42e93c0f191591

SHA1
95b0e1b8db656710c19abdb7e9d40e45b068583a

SHA256
3e37968f11802ca5646d3304e90cf3e84936cfb2556643c97b6846adae68ba20

SHA512
de3062923851e644b79c29cfcbad17729dcb01ece46717e0cdbf359b33666f9092627d07c67f98bb52dd6a474435f8c1deb709450a59a82171c2de791105e400

Download Submit
C:\Windows\{CD7FEB27-1996-4050-B63D-398BE5400EF5}.exe

Filesize
180KB

MD5
d6cdb4f5890c4dad91e5bd5f6f5ca173

SHA1
a2312d4b25219a9e4d48d46d9dc1e7c61a08cb7f

SHA256
dfd2ac3b362a08b8b309b2ba2b366213699a2d59c370d78f9fb72da5321f1acd

SHA512
ad7db614ca98c0f47799b26fd06041afd2234ac4f74f63c9fab0ed97f35ce82cba4837a0424a609b7e0d181fc11efa7350c76b91f8c60b3b9eeed5f2e53bcc9d

Download Submit
C:\Windows\{D292669C-7311-4e66-85F1-C6DF617F4A22}.exe

Filesize
180KB

MD5
ac0bb6ae810cb38c16fdeff23c81d38c

SHA1
9845f0266e8551eea42fce98a4f440e1cab27a75

SHA256
e1a99925ac5013678d4ef79dccc08880ef39b43b67e0a5097ba7e35115fd6be3

SHA512
c7b2c0eb0a766385360373ae2856836c9427bc615a0fb877bf6b5340284d740f31a8be7cf9da06949b4958f05f01a2b9da9c2122bc9487b1431069d6306d9105

Download Submit
C:\Windows\{E630C082-8BC4-4a99-8BB0-63E4025556B6}.exe

Filesize
180KB

MD5
cfd36a209cc52c45d73f070b65f38cce

SHA1
6fc9c4afe0841d8b9866da95b849b1772f612451

SHA256
b754c66b3f0927c88e1dab9a6df7801fd9b92809da3bc525f5a156e72627f16c

SHA512
9c4a62f449e6b87e4c1ba1782093758f585733bcb589239eb60fed541c17a8ba3658ded68f1294d260209f8bd4537f92a1ac4b90569cf4e74981cc5a4e999b9b

Download Submit
C:\Windows\{EDC2670F-55F5-485c-9989-5375A2A530F0}.exe

Filesize
180KB

MD5
6b91de354aecf397fdf5046e890a7ee7

SHA1
d1e04200ee3c239ec0ec723c573d09d40445781a

SHA256
1561ee08cb2693f1c1c3cdaa1eabcadc281f11f3f75f64f7b0cc5f4d25e69ba9

SHA512
9ba68ce795e005fe1032257ec958d289c896a7966c4e6b60f89f15d201d6ffd22663bb86d8bbe9e1b4463fa944b807e4b0fc7b3afa36c18299290c6ed50bde73

Download Submit
C:\Windows\{F1A55D47-1165-4f07-A0DB-2085C1F3D1F5}.exe

Filesize
180KB

MD5
49c5a10e3e8ca70ec146549b32ec0c1c

SHA1
ecd6e008aec40701f3a6ef13c4a1d6d17745193a

SHA256
50b743275dbb433e63204d8d016e21e4e0efe9d1f63370ed90f982349288ea68

SHA512
f82364c026ee6542084888ee2c3656c5ffba59fa49632a4708dd8518eba86aff5ef49f972a108b63ff499b6dffb7d1baf71ed1b5fdc16d10fee1cee773ee1231

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads