db91628f2e212116cf5d67f72eb988cf9e9226face956f670daa8ac86a6f46f1

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
Size

216KB
MD5

a55b3fbaab5a66224abffa43a0d38ea6
SHA1

5571d0bd22526062f73b7ac2d3aac012461663d6
SHA256

db91628f2e212116cf5d67f72eb988cf9e9226face956f670daa8ac86a6f46f1
SHA512

033ebb2bbf15d06819a1a7a5bbce244432b6ffa30b46b6eac96fc97d877bc3207bba6280edf4ec47e87b29a9037c5b390115b51632f20f112d300a6fbc559f05
SSDEEP

3072:jEGh0oll+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGLlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014228-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012251-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003600000001443b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012251-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012251-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012251-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}\stubpath = "C:\\Windows\\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe"	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C05B314-2671-4dec-9F55-BFD868DF9E70}	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7ED95881-8B6B-451a-A946-4C854609336D}	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7ED95881-8B6B-451a-A946-4C854609336D}\stubpath = "C:\\Windows\\{7ED95881-8B6B-451a-A946-4C854609336D}.exe"	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A05E7274-29ED-45bf-B5C3-68327BE389F9}	{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A05E7274-29ED-45bf-B5C3-68327BE389F9}\stubpath = "C:\\Windows\\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe"	{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}	{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1F59D33D-9AAE-4895-862A-FBE507FD489E}	{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59278C6D-C34A-4710-950C-5EDD9A9DA654}	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B195893-D49D-4516-9E75-2B69EC20368E}\stubpath = "C:\\Windows\\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe"	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C05B314-2671-4dec-9F55-BFD868DF9E70}\stubpath = "C:\\Windows\\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe"	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6563C690-5EE5-4848-B23A-42D42752B3A6}\stubpath = "C:\\Windows\\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe"	{003D5929-ED58-4082-8735-A917B5DF0365}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB477A14-F45A-4aa4-B1EC-5061586F755F}\stubpath = "C:\\Windows\\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe"	{7ED95881-8B6B-451a-A946-4C854609336D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}\stubpath = "C:\\Windows\\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe"	{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59278C6D-C34A-4710-950C-5EDD9A9DA654}\stubpath = "C:\\Windows\\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe"	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{003D5929-ED58-4082-8735-A917B5DF0365}	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6563C690-5EE5-4848-B23A-42D42752B3A6}	{003D5929-ED58-4082-8735-A917B5DF0365}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB477A14-F45A-4aa4-B1EC-5061586F755F}	{7ED95881-8B6B-451a-A946-4C854609336D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1F59D33D-9AAE-4895-862A-FBE507FD489E}\stubpath = "C:\\Windows\\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe"	{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B195893-D49D-4516-9E75-2B69EC20368E}	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{003D5929-ED58-4082-8735-A917B5DF0365}\stubpath = "C:\\Windows\\{003D5929-ED58-4082-8735-A917B5DF0365}.exe"	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe

Deletes itself 1 IoCs

pid	Process
2024	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe
2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe
2956	{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
1308	{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
1864	{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
532	{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
File created	C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
File created	C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe	{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
File created	C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	{003D5929-ED58-4082-8735-A917B5DF0365}.exe
File created	C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe	{7ED95881-8B6B-451a-A946-4C854609336D}.exe
File created	C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe	{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
File created	C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe	{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
File created	C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
File created	C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
File created	C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
File created	C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
Token: SeIncBasePriorityPrivilege	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
Token: SeIncBasePriorityPrivilege	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
Token: SeIncBasePriorityPrivilege	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
Token: SeIncBasePriorityPrivilege	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe
Token: SeIncBasePriorityPrivilege	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
Token: SeIncBasePriorityPrivilege	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe
Token: SeIncBasePriorityPrivilege	2956	{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
Token: SeIncBasePriorityPrivilege	1308	{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
Token: SeIncBasePriorityPrivilege	1864	{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2620	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	28
PID 2364 wrote to memory of 2620	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	28
PID 2364 wrote to memory of 2620	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	28
PID 2364 wrote to memory of 2620	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	28
PID 2364 wrote to memory of 2024	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	29
PID 2364 wrote to memory of 2024	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	29
PID 2364 wrote to memory of 2024	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	29
PID 2364 wrote to memory of 2024	2364	2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe	29
PID 2620 wrote to memory of 2652	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	30
PID 2620 wrote to memory of 2652	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	30
PID 2620 wrote to memory of 2652	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	30
PID 2620 wrote to memory of 2652	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	30
PID 2620 wrote to memory of 2640	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	31
PID 2620 wrote to memory of 2640	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	31
PID 2620 wrote to memory of 2640	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	31
PID 2620 wrote to memory of 2640	2620	{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe	31
PID 2652 wrote to memory of 2660	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	32
PID 2652 wrote to memory of 2660	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	32
PID 2652 wrote to memory of 2660	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	32
PID 2652 wrote to memory of 2660	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	32
PID 2652 wrote to memory of 2692	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	33
PID 2652 wrote to memory of 2692	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	33
PID 2652 wrote to memory of 2692	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	33
PID 2652 wrote to memory of 2692	2652	{6B195893-D49D-4516-9E75-2B69EC20368E}.exe	33
PID 2660 wrote to memory of 1872	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	36
PID 2660 wrote to memory of 1872	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	36
PID 2660 wrote to memory of 1872	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	36
PID 2660 wrote to memory of 1872	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	36
PID 2660 wrote to memory of 2708	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	37
PID 2660 wrote to memory of 2708	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	37
PID 2660 wrote to memory of 2708	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	37
PID 2660 wrote to memory of 2708	2660	{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe	37
PID 1872 wrote to memory of 2988	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	38
PID 1872 wrote to memory of 2988	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	38
PID 1872 wrote to memory of 2988	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	38
PID 1872 wrote to memory of 2988	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	38
PID 1872 wrote to memory of 2832	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	39
PID 1872 wrote to memory of 2832	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	39
PID 1872 wrote to memory of 2832	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	39
PID 1872 wrote to memory of 2832	1872	{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe	39
PID 2988 wrote to memory of 2776	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	40
PID 2988 wrote to memory of 2776	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	40
PID 2988 wrote to memory of 2776	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	40
PID 2988 wrote to memory of 2776	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	40
PID 2988 wrote to memory of 2032	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	41
PID 2988 wrote to memory of 2032	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	41
PID 2988 wrote to memory of 2032	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	41
PID 2988 wrote to memory of 2032	2988	{003D5929-ED58-4082-8735-A917B5DF0365}.exe	41
PID 2776 wrote to memory of 2632	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	42
PID 2776 wrote to memory of 2632	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	42
PID 2776 wrote to memory of 2632	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	42
PID 2776 wrote to memory of 2632	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	42
PID 2776 wrote to memory of 2744	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	43
PID 2776 wrote to memory of 2744	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	43
PID 2776 wrote to memory of 2744	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	43
PID 2776 wrote to memory of 2744	2776	{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe	43
PID 2632 wrote to memory of 2956	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	44
PID 2632 wrote to memory of 2956	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	44
PID 2632 wrote to memory of 2956	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	44
PID 2632 wrote to memory of 2956	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	44
PID 2632 wrote to memory of 2328	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	45
PID 2632 wrote to memory of 2328	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	45
PID 2632 wrote to memory of 2328	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	45
PID 2632 wrote to memory of 2328	2632	{7ED95881-8B6B-451a-A946-4C854609336D}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
  C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
    C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
      C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
        
        C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe
        
        C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
        
        C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe
        
        C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
        
        C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
        
        C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
        
        C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
        
        C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
        
        C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe
        
        C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe
        12⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA9B1~1.EXE > nul
        12⤵
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A05E7~1.EXE > nul
        11⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB477~1.EXE > nul
        10⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7ED95~1.EXE > nul
        9⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6563C~1.EXE > nul
        8⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{003D5~1.EXE > nul
        7⤵
        
        PID:2032
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C05B~1.EXE > nul
        6⤵
        
        PID:2832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12369~1.EXE > nul
        5⤵
        
        PID:2708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6B195~1.EXE > nul
      4⤵
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{59278~1.EXE > nul
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe

Filesize
216KB

MD5
5b058638a3124b8503c869495a5a6e63

SHA1
17eaca6db07c3d7db67f78617acdf6e7481eac3e

SHA256
a3fd39284534b4c8dd025174ae9261fb47bac81ecd302d8405252e99a5ece09f

SHA512
0aaebc224fde8be797dd49f3ea9cffa34881fb93eb8d340582dfb5c88d5b05c9cbfc09867c8903b76ed98858590feef58bcc46d32325c8f69168864aa3306d29

Download Submit
C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe

Filesize
216KB

MD5
1d473076b43c78d70eeab9dc11b33cf4

SHA1
f9a3b895a67acaf2c0551a945506f395c3f5524e

SHA256
110bcfab5b2a32459e209081fe9243d89d9fa0ad766f5246084898d15f5f0d9a

SHA512
93a5b9d29e2e8e8ca552c76ad4fcecdde246e67081243b8c0c67735f8dc751f8f644f5548a2640c61e53c3149fc94848cf105fdb1329139bb785fa1f60eea8b7

Download Submit
C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe

Filesize
216KB

MD5
5e1df17301e9874ee73875c825cbbfb5

SHA1
2528961df2a15775bad8f76d459d9224ac9eabca

SHA256
087de790177307a2b9bb4feeeabb62dbcef97baa4c1eeba1b30f1f6767a2764e

SHA512
cc314e3a4ddedefba4d4942683c926987c58bab8372cd2c5cc0269b91b61f7c50cb706b26fe672eece541ea1b8af934d0fa9fef947cef3e65b3d8e85d3a019db

Download Submit
C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe

Filesize
216KB

MD5
f88adca653d2beef480f27a941a7ff49

SHA1
de0f8ed0ca4e0e6d2df73fb4213df2082d7a8edb

SHA256
9e1d33df3a6a4134d7cd09938d46a1356955a23a2f21c99acdf18116a1428145

SHA512
299f6ae00ef61b09b5368c98c8b21cf144d90f01669dca287d31a725e04cc9c118181fc64295023d0daed0dac5f4af2ef7f845be910b6f15cc75217052baf1a6

Download Submit
C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe

Filesize
216KB

MD5
dc81f5419687e8e2a85a47034e239b74

SHA1
5a6de506c5db02494d2ce3cba818076becb03304

SHA256
3e74ae7fda6ea8476397567cfd74ab445b519c8ac29234f8a17ba916eecb51e9

SHA512
04fdec002382d055c0968d1eca7621939f7e665f5ab930d80b6a02a73b358065f4ec9e8dbdec7752f9696b52266fb4f3db22dd28f30a18bf5636543a4e408ccb

Download Submit
C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe

Filesize
216KB

MD5
615e368ee28e60cd95bc76ee26eeb680

SHA1
d477c9e2bb9b97a0fc4e91e41502499502c61478

SHA256
7979454486bb05209a6d933419d91e1ad609750d2d1c1e2df7660ac02dfc6e14

SHA512
0da67568e72ce07ac228ef86ade36f48d9eba62e07bf60dcc3dbaa86589ac0324b988d60ad4c2f84178ef853219b1d6fd73a0bc32b9260d9fdc3ac4c082aae75

Download Submit
C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe

Filesize
216KB

MD5
d41dcedb52e5d60b15ac9b017bbb5015

SHA1
0fdc97b0e0e4bbbfe628115fb60c4345eb9f56a6

SHA256
a585db4a1bf92129d238c0daa5360e674d3c76c4636ce9488f1859498867e5a1

SHA512
c92be9ba4594a52a11da5140a1c6662d34e570510c0e2d97262dbf38433fe5cb62cadc8c6cb571f7862911186f601226104b6ab95ee4e869d24b0a4a70bfec70

Download Submit
C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe

Filesize
216KB

MD5
d9d7b7107bb58925b86abd385a5b8b14

SHA1
8ccf7d6fb4e65c3eaad0c1439c89d23e0650b3e6

SHA256
d07f5760c0b109ad0035da514a813a07815616a2a94b879203ec32b8a998fb45

SHA512
24aca3af25744963ba7ed98fecd92c9a79583d53272dc9afa6d9e4f7a21b537a2db24ca997e859e252dc2690a91e521054a1cb447d6e289efea54b2ea9e9cbc7

Download Submit
C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe

Filesize
216KB

MD5
433db0b21e8fdc0a9d5da9516da550bb

SHA1
fef7d9d50ad25ff0f29358fe8da74e2a1077e487

SHA256
ab1774aeb4613100b67d17f3b1aaa87a00a0885cc4e6b01d7df368b315b66529

SHA512
b689feec514c04b8bba4cc8dc442f69b02763c9ec4b1b83c677132f8b5e0921a1cdfcf710e4b8a5efe598eb921ea618ce9a910f94362580226b62312de6272d0

Download Submit
C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe

Filesize
216KB

MD5
0a37b1f0817900a94f86608bf48a8954

SHA1
7c0ea1cef96f3b60760b783667f0db450d5999f4

SHA256
95e342dfd839da75219dd59e40fbabd3303f5616fc8b2d721eda14f261c89c8b

SHA512
3a9173cb451fd55401ebe8f212acc41b53ff37680a498a64b3b08ff9c1b25b5caa5f86200f78e4b8a846dabbd3bac5e7ee7c9a5d84429a5d7d8f0362d4981f5a

Download Submit
C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe

Filesize
216KB

MD5
a204a1e9992ca4b30c76c2a3537fd072

SHA1
2434c2598d92ac3f8a1b4a8082609731b5a0ee5f

SHA256
d8a6865cd30f9cefbb3fec8c4e84706b48dfb80488c34f8149807c07581e4c76

SHA512
b1e4d929ed73c8bc82733ebeb09ef5a281cf95d548127b469051b29466dbaaf490c29718c9970b0bceac6a1a9678abc6dfcf0a9bf13d16bf86b4bce3e0b9ebd2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads