ff61ca5fe75ef4a28044cb1f7a68f36d2d8472866d35f01fe1fb7db67c02e33b

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
Size

380KB
MD5

d5cce7bfe07889865487b2d81b886485
SHA1

22f06018275b07eddcaa4b297aa06f42edbfcb79
SHA256

ff61ca5fe75ef4a28044cb1f7a68f36d2d8472866d35f01fe1fb7db67c02e33b
SHA512

895b6821aa17d896d90c4087d821983e811b31a8f0f17e69c3fde83c39701ac196d5b39905d3380bd895c7c2f516029e5533f415ea92a6ff02bc0dd0f6cbd461
SSDEEP

3072:mEGh0odZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEct:mEG1l7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000013a88-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0032000000014251-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000013a88-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003200000001431b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000013a88-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000013a88-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000013a88-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{42E46981-C267-40ac-8D9B-3F550104C53B}	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{42E46981-C267-40ac-8D9B-3F550104C53B}\stubpath = "C:\\Windows\\{42E46981-C267-40ac-8D9B-3F550104C53B}.exe"	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}\stubpath = "C:\\Windows\\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe"	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B958869-D395-48e4-9B43-297E0B790F9E}	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{509E91F3-A038-4574-924C-980BA83C1927}\stubpath = "C:\\Windows\\{509E91F3-A038-4574-924C-980BA83C1927}.exe"	{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C9571A1-43CF-4850-B8BB-3633337828CD}	{90A19A30-AE95-48c4-9667-7E07681536FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{509E91F3-A038-4574-924C-980BA83C1927}	{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90A19A30-AE95-48c4-9667-7E07681536FB}	{509E91F3-A038-4574-924C-980BA83C1927}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90A19A30-AE95-48c4-9667-7E07681536FB}\stubpath = "C:\\Windows\\{90A19A30-AE95-48c4-9667-7E07681536FB}.exe"	{509E91F3-A038-4574-924C-980BA83C1927}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA986745-15AB-4a5c-9CB8-A688F9940400}	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B95E401-C2A5-4051-947D-6B591CF397B0}\stubpath = "C:\\Windows\\{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe"	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B958869-D395-48e4-9B43-297E0B790F9E}\stubpath = "C:\\Windows\\{1B958869-D395-48e4-9B43-297E0B790F9E}.exe"	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}\stubpath = "C:\\Windows\\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe"	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C9571A1-43CF-4850-B8BB-3633337828CD}\stubpath = "C:\\Windows\\{8C9571A1-43CF-4850-B8BB-3633337828CD}.exe"	{90A19A30-AE95-48c4-9667-7E07681536FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA986745-15AB-4a5c-9CB8-A688F9940400}\stubpath = "C:\\Windows\\{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe"	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}\stubpath = "C:\\Windows\\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe"	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B95E401-C2A5-4051-947D-6B591CF397B0}	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}\stubpath = "C:\\Windows\\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe"	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe

Deletes itself 1 IoCs

pid	Process
1712	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe
2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe
1684	{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
1444	{509E91F3-A038-4574-924C-980BA83C1927}.exe
2076	{90A19A30-AE95-48c4-9667-7E07681536FB}.exe
332	{8C9571A1-43CF-4850-B8BB-3633337828CD}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{509E91F3-A038-4574-924C-980BA83C1927}.exe	{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
File created	C:\Windows\{8C9571A1-43CF-4850-B8BB-3633337828CD}.exe	{90A19A30-AE95-48c4-9667-7E07681536FB}.exe
File created	C:\Windows\{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
File created	C:\Windows\{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
File created	C:\Windows\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
File created	C:\Windows\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
File created	C:\Windows\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe
File created	C:\Windows\{90A19A30-AE95-48c4-9667-7E07681536FB}.exe	{509E91F3-A038-4574-924C-980BA83C1927}.exe
File created	C:\Windows\{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
File created	C:\Windows\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
File created	C:\Windows\{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
Token: SeIncBasePriorityPrivilege	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe
Token: SeIncBasePriorityPrivilege	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
Token: SeIncBasePriorityPrivilege	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
Token: SeIncBasePriorityPrivilege	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
Token: SeIncBasePriorityPrivilege	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
Token: SeIncBasePriorityPrivilege	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe
Token: SeIncBasePriorityPrivilege	1684	{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
Token: SeIncBasePriorityPrivilege	1444	{509E91F3-A038-4574-924C-980BA83C1927}.exe
Token: SeIncBasePriorityPrivilege	2076	{90A19A30-AE95-48c4-9667-7E07681536FB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1964	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	28
PID 2060 wrote to memory of 1964	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	28
PID 2060 wrote to memory of 1964	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	28
PID 2060 wrote to memory of 1964	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	28
PID 2060 wrote to memory of 1712	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	29
PID 2060 wrote to memory of 1712	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	29
PID 2060 wrote to memory of 1712	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	29
PID 2060 wrote to memory of 1712	2060	2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe	29
PID 1964 wrote to memory of 2660	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	30
PID 1964 wrote to memory of 2660	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	30
PID 1964 wrote to memory of 2660	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	30
PID 1964 wrote to memory of 2660	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	30
PID 1964 wrote to memory of 2596	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	31
PID 1964 wrote to memory of 2596	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	31
PID 1964 wrote to memory of 2596	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	31
PID 1964 wrote to memory of 2596	1964	{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe	31
PID 2660 wrote to memory of 2808	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	32
PID 2660 wrote to memory of 2808	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	32
PID 2660 wrote to memory of 2808	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	32
PID 2660 wrote to memory of 2808	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	32
PID 2660 wrote to memory of 2476	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	33
PID 2660 wrote to memory of 2476	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	33
PID 2660 wrote to memory of 2476	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	33
PID 2660 wrote to memory of 2476	2660	{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe	33
PID 2808 wrote to memory of 2492	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	36
PID 2808 wrote to memory of 2492	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	36
PID 2808 wrote to memory of 2492	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	36
PID 2808 wrote to memory of 2492	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	36
PID 2808 wrote to memory of 2352	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	37
PID 2808 wrote to memory of 2352	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	37
PID 2808 wrote to memory of 2352	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	37
PID 2808 wrote to memory of 2352	2808	{42E46981-C267-40ac-8D9B-3F550104C53B}.exe	37
PID 2492 wrote to memory of 2720	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	38
PID 2492 wrote to memory of 2720	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	38
PID 2492 wrote to memory of 2720	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	38
PID 2492 wrote to memory of 2720	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	38
PID 2492 wrote to memory of 2760	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	39
PID 2492 wrote to memory of 2760	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	39
PID 2492 wrote to memory of 2760	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	39
PID 2492 wrote to memory of 2760	2492	{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe	39
PID 2720 wrote to memory of 1700	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	40
PID 2720 wrote to memory of 1700	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	40
PID 2720 wrote to memory of 1700	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	40
PID 2720 wrote to memory of 1700	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	40
PID 2720 wrote to memory of 1612	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	41
PID 2720 wrote to memory of 1612	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	41
PID 2720 wrote to memory of 1612	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	41
PID 2720 wrote to memory of 1612	2720	{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe	41
PID 1700 wrote to memory of 2332	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	42
PID 1700 wrote to memory of 2332	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	42
PID 1700 wrote to memory of 2332	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	42
PID 1700 wrote to memory of 2332	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	42
PID 1700 wrote to memory of 472	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	43
PID 1700 wrote to memory of 472	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	43
PID 1700 wrote to memory of 472	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	43
PID 1700 wrote to memory of 472	1700	{1B958869-D395-48e4-9B43-297E0B790F9E}.exe	43
PID 2332 wrote to memory of 1684	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	44
PID 2332 wrote to memory of 1684	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	44
PID 2332 wrote to memory of 1684	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	44
PID 2332 wrote to memory of 1684	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	44
PID 2332 wrote to memory of 1652	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	45
PID 2332 wrote to memory of 1652	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	45
PID 2332 wrote to memory of 1652	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	45
PID 2332 wrote to memory of 1652	2332	{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
  C:\Windows\{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe
    C:\Windows\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
      C:\Windows\{42E46981-C267-40ac-8D9B-3F550104C53B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
        
        C:\Windows\{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
        
        C:\Windows\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
        
        C:\Windows\{1B958869-D395-48e4-9B43-297E0B790F9E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe
        
        C:\Windows\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
        
        C:\Windows\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
        
        C:\Windows\{509E91F3-A038-4574-924C-980BA83C1927}.exe
        
        C:\Windows\{509E91F3-A038-4574-924C-980BA83C1927}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
        
        C:\Windows\{90A19A30-AE95-48c4-9667-7E07681536FB}.exe
        
        C:\Windows\{90A19A30-AE95-48c4-9667-7E07681536FB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\{8C9571A1-43CF-4850-B8BB-3633337828CD}.exe
        
        C:\Windows\{8C9571A1-43CF-4850-B8BB-3633337828CD}.exe
        12⤵
        Executes dropped EXE
        
        PID:332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{90A19~1.EXE > nul
        12⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{509E9~1.EXE > nul
        11⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7E74~1.EXE > nul
        10⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD74D~1.EXE > nul
        9⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B958~1.EXE > nul
        8⤵
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6FCB9~1.EXE > nul
        7⤵
        
        PID:1612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6B95E~1.EXE > nul
        6⤵
        
        PID:2760
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42E46~1.EXE > nul
        5⤵
        
        PID:2352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{4D1E8~1.EXE > nul
      4⤵
      PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CA986~1.EXE > nul
    3⤵
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1B958869-D395-48e4-9B43-297E0B790F9E}.exe

Filesize
380KB

MD5
ff6f0e953cfe2eb7d284486fe834f515

SHA1
9d6a317d6adcd9e16ec80fbadc57eb08be96e3fc

SHA256
9d6e3a25457fc62b8d300826cf03618a972a5685ad8f23854ec4f8320860528e

SHA512
b009a57dcefe56b1a17b2a3ee2800b4cfa5a490a4718514c111561f78aaeeeeadf2c3a4db25d623e638cab79f42e772dfdde4c66578398708d78aeb3519000da

Download Submit
C:\Windows\{42E46981-C267-40ac-8D9B-3F550104C53B}.exe

Filesize
380KB

MD5
9e4062a3bd1142dc223f9e813a9f9f08

SHA1
fee8b89e5724b3e9ed1d2f888fa4f961c8b06ea3

SHA256
7a98b2faed32364d742f1b3e42c42773548e16ba8a4e60559b3c017d1187d767

SHA512
564cfae30efb9de79db88616f3d7b37c274bb348bb5cb935833e7813f8a32c5980dfaf87659ba20d56003fca3205853d16f9ab146912ea0a793594e2e6d9adc2

Download Submit
C:\Windows\{4D1E87B6-C973-4cba-A53E-75CF1B7BC8F6}.exe

Filesize
380KB

MD5
2478e33b0e3a48ff73cf7a75640948cc

SHA1
f4a055f80844c57f70ee64e26c58dea83dc70a6a

SHA256
61f011ab78b9f37192f2f56c922e7b8eed84741e1a7820cca39c027292efc586

SHA512
efea65a7fc95e695899fdb5b02a4a31b73c2455fe8b27d247b10f67c92f6e1eb10ac1a824f90daa84d6830cc799aeae7daa442a9d7ed04884147d5de17dc001c

Download Submit
C:\Windows\{509E91F3-A038-4574-924C-980BA83C1927}.exe

Filesize
380KB

MD5
5da215c6e4331f867384caeec35b7137

SHA1
ad97a3c7413d98e7beec3dbba8ace0d8071ace06

SHA256
628ec584856643c45f652a0a999a8e7f0329a3af2ff68ea05ddafe1f7dc3fb84

SHA512
0d2a40cb26ca63a68d758a4c3c05947b0e5cda3f6f43414ba64174cfa14214b6d4fa78fec679b836c73a043c63abe946eef8ec45ee05c0ad3e7362a638dbcc68

Download Submit
C:\Windows\{6B95E401-C2A5-4051-947D-6B591CF397B0}.exe

Filesize
380KB

MD5
b004dc835edb002058db4ff517c459b6

SHA1
b34d04f8ed14d9dc42e17410d071aabedcd94142

SHA256
fad2f5e15d827ee5fd5c37929384d204c34297a1f206efccdcc09480b235ef5c

SHA512
e405dc1fbcb3ad044ef6fe1f8888bdc7fdb3e649cd4951b044938269dc95085238306ea813e4ebac22aef7d786333208794854f659caee9dc4e1f9da87dda760

Download Submit
C:\Windows\{6FCB9770-BE4E-4a74-8B0F-BA377BE53B35}.exe

Filesize
380KB

MD5
365958a83039b08441e7538bbd15021e

SHA1
4415771edb3d43c4828149d462717e771690d7b0

SHA256
e18a1f21dffa56b2708b0145f01d44b455cf546d172056e93459ee58788dbd3a

SHA512
2de424792d6a7a54eda3f16b4f06270e051fc5020b4da286c5dd3a452cba9b674e633f12bba0b75bcdceea39296a5d8c1a983b20dd9e5c3ee00c6d20ddda50a8

Download Submit
C:\Windows\{8C9571A1-43CF-4850-B8BB-3633337828CD}.exe

Filesize
380KB

MD5
3b26479b7d215b8386efe23ea9499a00

SHA1
a2768512ae29babd705a3563457e40e17a693c98

SHA256
beb17adc5f5dae63f54b99507cc8ef07b78191d520fd5176bae6596fce25919b

SHA512
5e5191601be4e0c369e49bfa24ae7da584b31c7aa779f854079e190fbee4867d981ec689b7bf012909fdcf6efc09e48b07ee37144ebd852da0558141e2d14265

Download Submit
C:\Windows\{90A19A30-AE95-48c4-9667-7E07681536FB}.exe

Filesize
380KB

MD5
f8b1c7c882030c0438f8838afa88065a

SHA1
a93c3e643fff88076d3c6a563fe04f19c5192147

SHA256
7bbb2dd12b3c27158014818e4a3aad41412365d7ccb2944041ffef6474b5670e

SHA512
1743b137c07d4b7dd9147d31219661b35127ba83c1f18e2e9bdaf99b9e07315a611bbfc465728d0bbb75dfcce077f3082c0e9479ebf7f7731e3555daa243160f

Download Submit
C:\Windows\{B7E747DE-BAA0-4fd1-82C3-5292AA2ACBE7}.exe

Filesize
380KB

MD5
4eeed77825a20cb7a2675775d9abdae5

SHA1
f15c1ea45a9dac41f8b6540b0e432910089486ca

SHA256
77889bbdd9e5b6b6711e540120d4fc8ac1e2763c18c2521cc1ac8fae25cdf739

SHA512
837b972cbe313b41ec2068364e8baa3ade48c97a6b693043f041641e00d8eacc6f36163eb06dea4d5c0ac2bcbaed7463ff515b8c7aafca0ab9961a5ae09509ae

Download Submit
C:\Windows\{CA986745-15AB-4a5c-9CB8-A688F9940400}.exe

Filesize
380KB

MD5
84c3234c9261ba4a47f1269f7e819b4c

SHA1
8d459e4bf95fb7e09ebb69c265235c299b2aba73

SHA256
b8ba58b4f8e05864df6b53ed680bd45815f8007c18337b7d4fc1c52f972d52bb

SHA512
28a4d407cc88f839d8db831831ec582dd16395299b7e7c34b1297fda789f9047d403506ed4c43d4218063fce6df3dfe9a0980d29426aaa5691ec3d17b98cd4d3

Download Submit
C:\Windows\{FD74DC6C-224C-48f9-88FF-26B0C86E78DC}.exe

Filesize
380KB

MD5
901332e35f991facab971af2a00f9cf8

SHA1
1d3d64f66fa6d4df8abbfa0db5277314107ca9fa

SHA256
1787b9acc31ba4e49fb4258082e66692ccac24e4700a0e3e07cc4a22a5d27600

SHA512
4350c4b7d2732d54e64669025d5122bc107af4837c440247067d708bf564238de9ad1c8fe6d38ffac0ac6ca2046e543143677b786c637d2ab2903c93bd47d9fb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads