3162bc7836ff74163f393a0850aa2d901967b36c3d1b162eea03a6c89c2c75e4

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe
Size

380KB
MD5

bf04d94f9185e2a7f7f35d651d6f9bce
SHA1

2f121e0d4a6c5e6e047acbaea26fd2be1202ec8a
SHA256

3162bc7836ff74163f393a0850aa2d901967b36c3d1b162eea03a6c89c2c75e4
SHA512

6c57f3f1781373472355533fef70777ff9a5c722cdbc56d88ca486d26c3211ccf1ba3ffb7c959742aec65e3b0d00856127368835b868d716e753c5bfbe307221
SSDEEP

3072:mEGh0o7lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGll7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001220d-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014120-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000001220d-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000143ec-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001220d-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001220d-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001220d-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28F377E3-49CD-4e89-95EE-3364FBBE965A}	{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}\stubpath = "C:\\Windows\\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe"	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{787A7988-C8DE-4286-8808-7F19092075DF}	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}\stubpath = "C:\\Windows\\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe"	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0AA2E78-D384-4940-9944-6F62EF46737C}\stubpath = "C:\\Windows\\{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe"	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}\stubpath = "C:\\Windows\\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe"	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28F377E3-49CD-4e89-95EE-3364FBBE965A}\stubpath = "C:\\Windows\\{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe"	{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A99EC938-4131-4743-900A-80FE1E18DF9B}\stubpath = "C:\\Windows\\{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe"	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}\stubpath = "C:\\Windows\\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe"	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0AA2E78-D384-4940-9944-6F62EF46737C}	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{787A7988-C8DE-4286-8808-7F19092075DF}\stubpath = "C:\\Windows\\{787A7988-C8DE-4286-8808-7F19092075DF}.exe"	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{912F48F6-CA39-442c-8E2E-BBD531FABB61}	{787A7988-C8DE-4286-8808-7F19092075DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{912F48F6-CA39-442c-8E2E-BBD531FABB61}\stubpath = "C:\\Windows\\{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe"	{787A7988-C8DE-4286-8808-7F19092075DF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A99EC938-4131-4743-900A-80FE1E18DF9B}	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{306EFDF0-B903-4161-A9B3-124B5D4A5917}	{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{306EFDF0-B903-4161-A9B3-124B5D4A5917}\stubpath = "C:\\Windows\\{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe"	{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}	{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}\stubpath = "C:\\Windows\\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}.exe"	{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe

Deletes itself 1 IoCs

pid	Process
1876	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe
2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
1540	{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
2264	{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe
592	{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe
1496	{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
File created	C:\Windows\{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
File created	C:\Windows\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
File created	C:\Windows\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
File created	C:\Windows\{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
File created	C:\Windows\{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe	{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
File created	C:\Windows\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe
File created	C:\Windows\{787A7988-C8DE-4286-8808-7F19092075DF}.exe	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
File created	C:\Windows\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}.exe	{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe
File created	C:\Windows\{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	{787A7988-C8DE-4286-8808-7F19092075DF}.exe
File created	C:\Windows\{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe	{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
Token: SeIncBasePriorityPrivilege	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe
Token: SeIncBasePriorityPrivilege	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
Token: SeIncBasePriorityPrivilege	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
Token: SeIncBasePriorityPrivilege	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
Token: SeIncBasePriorityPrivilege	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
Token: SeIncBasePriorityPrivilege	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
Token: SeIncBasePriorityPrivilege	1540	{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
Token: SeIncBasePriorityPrivilege	2264	{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe
Token: SeIncBasePriorityPrivilege	592	{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3036	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	28
PID 2848 wrote to memory of 3036	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	28
PID 2848 wrote to memory of 3036	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	28
PID 2848 wrote to memory of 3036	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	28
PID 2848 wrote to memory of 1876	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	29
PID 2848 wrote to memory of 1876	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	29
PID 2848 wrote to memory of 1876	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	29
PID 2848 wrote to memory of 1876	2848	2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe	29
PID 3036 wrote to memory of 2896	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	30
PID 3036 wrote to memory of 2896	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	30
PID 3036 wrote to memory of 2896	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	30
PID 3036 wrote to memory of 2896	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	30
PID 3036 wrote to memory of 2604	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	31
PID 3036 wrote to memory of 2604	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	31
PID 3036 wrote to memory of 2604	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	31
PID 3036 wrote to memory of 2604	3036	{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe	31
PID 2896 wrote to memory of 2504	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	32
PID 2896 wrote to memory of 2504	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	32
PID 2896 wrote to memory of 2504	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	32
PID 2896 wrote to memory of 2504	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	32
PID 2896 wrote to memory of 2760	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	33
PID 2896 wrote to memory of 2760	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	33
PID 2896 wrote to memory of 2760	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	33
PID 2896 wrote to memory of 2760	2896	{787A7988-C8DE-4286-8808-7F19092075DF}.exe	33
PID 2504 wrote to memory of 2968	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	36
PID 2504 wrote to memory of 2968	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	36
PID 2504 wrote to memory of 2968	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	36
PID 2504 wrote to memory of 2968	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	36
PID 2504 wrote to memory of 2104	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	37
PID 2504 wrote to memory of 2104	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	37
PID 2504 wrote to memory of 2104	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	37
PID 2504 wrote to memory of 2104	2504	{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe	37
PID 2968 wrote to memory of 2796	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	38
PID 2968 wrote to memory of 2796	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	38
PID 2968 wrote to memory of 2796	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	38
PID 2968 wrote to memory of 2796	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	38
PID 2968 wrote to memory of 1848	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	39
PID 2968 wrote to memory of 1848	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	39
PID 2968 wrote to memory of 1848	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	39
PID 2968 wrote to memory of 1848	2968	{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe	39
PID 2796 wrote to memory of 1744	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	40
PID 2796 wrote to memory of 1744	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	40
PID 2796 wrote to memory of 1744	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	40
PID 2796 wrote to memory of 1744	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	40
PID 2796 wrote to memory of 2560	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	41
PID 2796 wrote to memory of 2560	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	41
PID 2796 wrote to memory of 2560	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	41
PID 2796 wrote to memory of 2560	2796	{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe	41
PID 1744 wrote to memory of 2936	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	42
PID 1744 wrote to memory of 2936	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	42
PID 1744 wrote to memory of 2936	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	42
PID 1744 wrote to memory of 2936	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	42
PID 1744 wrote to memory of 2724	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	43
PID 1744 wrote to memory of 2724	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	43
PID 1744 wrote to memory of 2724	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	43
PID 1744 wrote to memory of 2724	1744	{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe	43
PID 2936 wrote to memory of 1540	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	44
PID 2936 wrote to memory of 1540	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	44
PID 2936 wrote to memory of 1540	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	44
PID 2936 wrote to memory of 1540	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	44
PID 2936 wrote to memory of 1140	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	45
PID 2936 wrote to memory of 1140	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	45
PID 2936 wrote to memory of 1140	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	45
PID 2936 wrote to memory of 1140	2936	{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_bf04d94f9185e2a7f7f35d651d6f9bce_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
  C:\Windows\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\{787A7988-C8DE-4286-8808-7F19092075DF}.exe
    C:\Windows\{787A7988-C8DE-4286-8808-7F19092075DF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
      C:\Windows\{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Windows\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
        
        C:\Windows\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Windows\{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
        
        C:\Windows\{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
        
        C:\Windows\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
        
        C:\Windows\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
        
        C:\Windows\{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
        
        C:\Windows\{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe
        
        C:\Windows\{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe
        
        C:\Windows\{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}.exe
        
        C:\Windows\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}.exe
        12⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{306EF~1.EXE > nul
        12⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28F37~1.EXE > nul
        11⤵
        
        PID:784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0AA2~1.EXE > nul
        10⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A53DD~1.EXE > nul
        9⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9A58~1.EXE > nul
        8⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A99EC~1.EXE > nul
        7⤵
        
        PID:2560
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{809DD~1.EXE > nul
        6⤵
        
        PID:1848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{912F4~1.EXE > nul
        5⤵
        
        PID:2104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{787A7~1.EXE > nul
      4⤵
      PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B4A50~1.EXE > nul
    3⤵
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{28F377E3-49CD-4e89-95EE-3364FBBE965A}.exe

Filesize
380KB

MD5
8c80cccb1957854c30af5070e522427f

SHA1
532b92b21a4145b3e0d0c8f219992ca536bb0311

SHA256
dc6731e39daae506af9791c58c3507646603d7cc3140bdb234a57fd8f1a55922

SHA512
4bfb67e7dc1b861556533808a3423453d5818e38b6a287a428d2aff8a9ddda39381fa81a6847fb7c5ece92bb7c27cdfecd5e371888eed0db1717c28719d14cfa

Download Submit
C:\Windows\{306EFDF0-B903-4161-A9B3-124B5D4A5917}.exe

Filesize
380KB

MD5
0ac867e8cc32e93c1359e4e08c0cd2e9

SHA1
f4bc52e06cef5e516f048e874fc040908c927d2e

SHA256
4d483319fb6c97c741d7984dd53652ae99a2af81466fab429efad419fbd33093

SHA512
a0535c54e8f1d5613519eb3306631b74f6818ff3ae70019fb9357d224f525e00d48ee757d2889a478577b0771ea58792fdf0415c7d20caf7b9c1eb174ad0e62c

Download Submit
C:\Windows\{787A7988-C8DE-4286-8808-7F19092075DF}.exe

Filesize
380KB

MD5
2dd18b21a11fcf2565b51a7a6f0889f6

SHA1
f26200bd5c79090ccad5d041b8f93e183e91f348

SHA256
233bb2c95e65d77d3f9c6ebb4eb3e9ce3506fa8bc3cfdfa05a4f14a2995601a0

SHA512
d4dcd9297828375c398f8b596db3df72a154faaf0be84ccf8a7f9b73ebba1ac5574e35ff2e05f163e3c3d3fac6bd924fa656271807f6cdcd7409249dafd767af

Download Submit
C:\Windows\{809DDA71-0F2D-43e9-A3F5-5924117B2BBC}.exe

Filesize
380KB

MD5
81a367e0c9a6fb500b21b364718fa281

SHA1
eceb6471435e46991e5d0eef0d67856903ce3551

SHA256
cd14b00f751d26c9d0e6f1bb7575d46ae29d828390cc563803448c0882697454

SHA512
ba5557568b060467848056aad77deaddcdd8e475a1743bd90b98e43d1b6acb4d52f5e234cf1f7facfe17263873105db4d960a0e95da876a1ae733ae68ad8087c

Download Submit
C:\Windows\{912F48F6-CA39-442c-8E2E-BBD531FABB61}.exe

Filesize
380KB

MD5
ce05c918e19c38fbfdd3d91c6ed7f83e

SHA1
c909a010768f263b2ad7a89be91a40fca38876ce

SHA256
a0c02c108602645166c1f760a87b350d200b66eccfb77c7225633bba0f5110e8

SHA512
7573dd0189ec53d9a8c247322428dd379ec344ad63ddfb6ecb4e68dab8b66a9b4b3ead5d38d87d04a53d4fba2ce17b13e39b72c0f5b24ef7d8f22513d3c66a51

Download Submit
C:\Windows\{A53DD2AE-ADF9-4c7d-B121-F454F4AE83DF}.exe

Filesize
380KB

MD5
24851fe369c6a3d0c3ae6f3a0edbf7f7

SHA1
260c61a84df4bedbe6d51b541524aad511413c9b

SHA256
c4dc77f8a22051c7254f165ee66355209105fdfec81b5247f8e06cb3b7876acd

SHA512
19628c92c7a42d7d69bb6230ebb82c93d7603705e3201f0045f12cbc0d029ed8f7dc462f29b86b1df1cc37740f01ce51a9088ba3b68cca079df38ac67ffdb057

Download Submit
C:\Windows\{A99EC938-4131-4743-900A-80FE1E18DF9B}.exe

Filesize
380KB

MD5
3c6fd781b03701787ae5183a71e61680

SHA1
f86bcb52f7a9ff144ae7338801e4ebcaa18e3eb0

SHA256
6ce02dc680e2d189cdf8e4d52ad401d0ed3ed8d2fc7e94328f873c8fbf9c64ad

SHA512
1130a24996eec4e67f3d7e66b9403ad3695194a91d87115189d4b6c90d1b118bdd41e181367322f14c5b805622446e1b927dfd107c258f32b0ab07ecc58d9ba4

Download Submit
C:\Windows\{AC09E2CF-0BE7-42d6-B421-EFA3EB6687D1}.exe

Filesize
380KB

MD5
259dc5a75a9d98565e238daad3a082e0

SHA1
d6a6dc4aba1dd1a9d5f7a6c5a36164ec7ed7275d

SHA256
0f8dcdef00a166e9919d6daf742bc43f2d6bad8b470319dae76139ef88339d6a

SHA512
8e8062abb19d0b00771bdf0ab62734d036811b9ad603ed29f9d5ac795c903136ba13a272b52c8195cb5d24bb15f647b0b4ec663f88e7b82e033f680a7afa3d06

Download Submit
C:\Windows\{B4A50219-9F1C-44e7-AE86-4FBACEE8C358}.exe

Filesize
380KB

MD5
7d2a35eb3f63eb1b2e49e8f0179accd7

SHA1
71de75c9777788c2f9f01d2830849323be243e36

SHA256
dbb78a43fa5e11c648a7b912e934df3e44762ca95f5fe5d2383d37fb8d234ae4

SHA512
972a0d9f28cef4e038a2cd8b978746ad0ebdf19acde8be61a55e385a76b9f4ed9d88948fc76d8ac3438d7205d5ca1ea14113b65a0604e8b15205e2d472212701

Download Submit
C:\Windows\{E0AA2E78-D384-4940-9944-6F62EF46737C}.exe

Filesize
380KB

MD5
2fa6b1147ff5933d1575d7a91d2263d4

SHA1
f2f5efd51718a4e2cbfc5ffb36a25e8a711aafa2

SHA256
0e5c10b69dd64bad93700fa1a5d156cea9bba16079e54e9dee43c6425981f9e5

SHA512
3707acb971c28915169d02cf264a8b95be2a1335d11747e69017f605cb9c13015f189db5a5cbf71c2da57d6407fdebeba70f9b8a9cc1e840f86e153dddd45cbc

Download Submit
C:\Windows\{F9A588D6-DE20-4ecb-9010-DCD3F4DA6601}.exe

Filesize
380KB

MD5
d54d84177267e73417d1207d4fcff2ba

SHA1
9a1f0932c1e6d2c44aaca943afebb334ac0c298d

SHA256
e4d7472c9413ad58241aa5ff71aa6dd5e37dbae95e46f485240504a7a8aaa403

SHA512
b39ae227f6b4c28497d2c8dec0220c03f8c4ae5d8308859606dd7d8f163f81338795baa19033390649af18ee5be889b947ed084326cee3fa6a3e69d45fc44594

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads