eb6f85d55873e3f527dbd010af1d360092bf5b0d42a7c3f671beea885ebcf165

Analysis

max time kernel
144s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe
Size

168KB
MD5

4dd4f56c6d0ab4e3d921dc1ac2574a2c
SHA1

3dc3f40fa408263f173da969b7812ff1b41fe2df
SHA256

eb6f85d55873e3f527dbd010af1d360092bf5b0d42a7c3f671beea885ebcf165
SHA512

6e261e3b90b34461d7610c809466b534259b51afbbf8d01abd23686640628f41334c1dfa35743002f26095451780a578c60fcb5e472844bfbf05f60ba2b515e0
SSDEEP

1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001223a-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012309-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f2-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012309-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0027000000015cb3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0028000000015cb3-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0029000000015cb3-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28724953-5318-40d1-8FE3-9732369F2C77}\stubpath = "C:\\Windows\\{28724953-5318-40d1-8FE3-9732369F2C77}.exe"	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90E4027E-3020-445e-B71F-A08BD3C0E457}	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{070D78F1-2765-4635-95BF-7860B9555B95}\stubpath = "C:\\Windows\\{070D78F1-2765-4635-95BF-7860B9555B95}.exe"	{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8391E354-151A-4ded-921D-73B21027346B}	{070D78F1-2765-4635-95BF-7860B9555B95}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}\stubpath = "C:\\Windows\\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe"	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{341A5655-9051-4e64-9C08-1622734F61AC}	{28724953-5318-40d1-8FE3-9732369F2C77}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{812A6754-B05D-479b-B572-94BE1DD2B77C}\stubpath = "C:\\Windows\\{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe"	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90E4027E-3020-445e-B71F-A08BD3C0E457}\stubpath = "C:\\Windows\\{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe"	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8391E354-151A-4ded-921D-73B21027346B}\stubpath = "C:\\Windows\\{8391E354-151A-4ded-921D-73B21027346B}.exe"	{070D78F1-2765-4635-95BF-7860B9555B95}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}	{341A5655-9051-4e64-9C08-1622734F61AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}\stubpath = "C:\\Windows\\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe"	{341A5655-9051-4e64-9C08-1622734F61AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{812A6754-B05D-479b-B572-94BE1DD2B77C}	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}\stubpath = "C:\\Windows\\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe"	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}\stubpath = "C:\\Windows\\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe"	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{070D78F1-2765-4635-95BF-7860B9555B95}	{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}	{8391E354-151A-4ded-921D-73B21027346B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}\stubpath = "C:\\Windows\\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}.exe"	{8391E354-151A-4ded-921D-73B21027346B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28724953-5318-40d1-8FE3-9732369F2C77}	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{341A5655-9051-4e64-9C08-1622734F61AC}\stubpath = "C:\\Windows\\{341A5655-9051-4e64-9C08-1622734F61AC}.exe"	{28724953-5318-40d1-8FE3-9732369F2C77}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe

Deletes itself 1 IoCs

pid	Process
2500	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe
2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe
2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe
1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
2584	{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
1520	{070D78F1-2765-4635-95BF-7860B9555B95}.exe
2432	{8391E354-151A-4ded-921D-73B21027346B}.exe
2960	{43E5107F-A1A8-429c-9D9D-B2AD450B5562}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe
File created	C:\Windows\{28724953-5318-40d1-8FE3-9732369F2C77}.exe	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
File created	C:\Windows\{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
File created	C:\Windows\{070D78F1-2765-4635-95BF-7860B9555B95}.exe	{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
File created	C:\Windows\{8391E354-151A-4ded-921D-73B21027346B}.exe	{070D78F1-2765-4635-95BF-7860B9555B95}.exe
File created	C:\Windows\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}.exe	{8391E354-151A-4ded-921D-73B21027346B}.exe
File created	C:\Windows\{341A5655-9051-4e64-9C08-1622734F61AC}.exe	{28724953-5318-40d1-8FE3-9732369F2C77}.exe
File created	C:\Windows\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	{341A5655-9051-4e64-9C08-1622734F61AC}.exe
File created	C:\Windows\{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
File created	C:\Windows\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
File created	C:\Windows\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
Token: SeIncBasePriorityPrivilege	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe
Token: SeIncBasePriorityPrivilege	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe
Token: SeIncBasePriorityPrivilege	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
Token: SeIncBasePriorityPrivilege	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
Token: SeIncBasePriorityPrivilege	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe
Token: SeIncBasePriorityPrivilege	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
Token: SeIncBasePriorityPrivilege	2584	{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
Token: SeIncBasePriorityPrivilege	1520	{070D78F1-2765-4635-95BF-7860B9555B95}.exe
Token: SeIncBasePriorityPrivilege	2432	{8391E354-151A-4ded-921D-73B21027346B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2484	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	28
PID 2092 wrote to memory of 2484	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	28
PID 2092 wrote to memory of 2484	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	28
PID 2092 wrote to memory of 2484	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	28
PID 2092 wrote to memory of 2500	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	29
PID 2092 wrote to memory of 2500	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	29
PID 2092 wrote to memory of 2500	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	29
PID 2092 wrote to memory of 2500	2092	2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe	29
PID 2484 wrote to memory of 2612	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	30
PID 2484 wrote to memory of 2612	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	30
PID 2484 wrote to memory of 2612	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	30
PID 2484 wrote to memory of 2612	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	30
PID 2484 wrote to memory of 2780	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	31
PID 2484 wrote to memory of 2780	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	31
PID 2484 wrote to memory of 2780	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	31
PID 2484 wrote to memory of 2780	2484	{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe	31
PID 2612 wrote to memory of 2444	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	34
PID 2612 wrote to memory of 2444	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	34
PID 2612 wrote to memory of 2444	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	34
PID 2612 wrote to memory of 2444	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	34
PID 2612 wrote to memory of 2352	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	35
PID 2612 wrote to memory of 2352	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	35
PID 2612 wrote to memory of 2352	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	35
PID 2612 wrote to memory of 2352	2612	{28724953-5318-40d1-8FE3-9732369F2C77}.exe	35
PID 2444 wrote to memory of 2020	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	36
PID 2444 wrote to memory of 2020	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	36
PID 2444 wrote to memory of 2020	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	36
PID 2444 wrote to memory of 2020	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	36
PID 2444 wrote to memory of 592	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	37
PID 2444 wrote to memory of 592	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	37
PID 2444 wrote to memory of 592	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	37
PID 2444 wrote to memory of 592	2444	{341A5655-9051-4e64-9C08-1622734F61AC}.exe	37
PID 2020 wrote to memory of 1112	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	38
PID 2020 wrote to memory of 1112	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	38
PID 2020 wrote to memory of 1112	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	38
PID 2020 wrote to memory of 1112	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	38
PID 2020 wrote to memory of 1704	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	39
PID 2020 wrote to memory of 1704	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	39
PID 2020 wrote to memory of 1704	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	39
PID 2020 wrote to memory of 1704	2020	{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe	39
PID 1112 wrote to memory of 2600	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	40
PID 1112 wrote to memory of 2600	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	40
PID 1112 wrote to memory of 2600	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	40
PID 1112 wrote to memory of 2600	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	40
PID 1112 wrote to memory of 2320	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	41
PID 1112 wrote to memory of 2320	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	41
PID 1112 wrote to memory of 2320	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	41
PID 1112 wrote to memory of 2320	1112	{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe	41
PID 2600 wrote to memory of 1808	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	42
PID 2600 wrote to memory of 1808	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	42
PID 2600 wrote to memory of 1808	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	42
PID 2600 wrote to memory of 1808	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	42
PID 2600 wrote to memory of 2332	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	43
PID 2600 wrote to memory of 2332	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	43
PID 2600 wrote to memory of 2332	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	43
PID 2600 wrote to memory of 2332	2600	{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe	43
PID 1808 wrote to memory of 2584	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	44
PID 1808 wrote to memory of 2584	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	44
PID 1808 wrote to memory of 2584	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	44
PID 1808 wrote to memory of 2584	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	44
PID 1808 wrote to memory of 768	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	45
PID 1808 wrote to memory of 768	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	45
PID 1808 wrote to memory of 768	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	45
PID 1808 wrote to memory of 768	1808	{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_4dd4f56c6d0ab4e3d921dc1ac2574a2c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
  C:\Windows\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\{28724953-5318-40d1-8FE3-9732369F2C77}.exe
    C:\Windows\{28724953-5318-40d1-8FE3-9732369F2C77}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\{341A5655-9051-4e64-9C08-1622734F61AC}.exe
      C:\Windows\{341A5655-9051-4e64-9C08-1622734F61AC}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
        
        C:\Windows\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Windows\{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
        
        C:\Windows\{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe
        
        C:\Windows\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
        
        C:\Windows\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
        
        C:\Windows\{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Windows\{070D78F1-2765-4635-95BF-7860B9555B95}.exe
        
        C:\Windows\{070D78F1-2765-4635-95BF-7860B9555B95}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Windows\{8391E354-151A-4ded-921D-73B21027346B}.exe
        
        C:\Windows\{8391E354-151A-4ded-921D-73B21027346B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}.exe
        
        C:\Windows\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}.exe
        12⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8391E~1.EXE > nul
        12⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{070D7~1.EXE > nul
        11⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{90E40~1.EXE > nul
        10⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D573~1.EXE > nul
        9⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9192C~1.EXE > nul
        8⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{812A6~1.EXE > nul
        7⤵
        
        PID:2320
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94E1C~1.EXE > nul
        6⤵
        
        PID:1704
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{341A5~1.EXE > nul
        5⤵
        
        PID:592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{28724~1.EXE > nul
      4⤵
      PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{06E83~1.EXE > nul
    3⤵
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{06E8300A-346B-4286-A6A6-F4F4F19D19E1}.exe

Filesize
168KB

MD5
f1fa4d2ca54371e58b3107a4c1db2845

SHA1
ddb4e6e090632db322c8b839b529d6380b9ba49c

SHA256
5d7b6d6f5abcc9ae83454c21fe4b5da16b7d19c19f1dd7228b45f85658105ea4

SHA512
8d792aacd65ad1e60fc55cee64066c8fc55bb0aa7145f71f79fe49c909d47e898b525696c06f1b9dc4920c812b4c302cf3777e23c0f987c9f5cc9099aa3ad48c

Download Submit
C:\Windows\{070D78F1-2765-4635-95BF-7860B9555B95}.exe

Filesize
168KB

MD5
38fc1fec6515d881aeb164716483939f

SHA1
24a636e801156e99f55a8541affa0794a263bd2f

SHA256
263678c9abbf795304af1b7d10e53ee4ae224907a2684d70216e7636ba4de4dc

SHA512
c0d2970ee5572eb2032359e8be43d68fbf49682b5c7dd6028f76d17b6ff0c12c42afe9afa85865302384a1ed8238e63aef70988c67fb614c885e8f8032c81f08

Download Submit
C:\Windows\{28724953-5318-40d1-8FE3-9732369F2C77}.exe

Filesize
168KB

MD5
b5f642f28e2173e0918aa92dc33e9752

SHA1
8a55060625a6d262f9d66f79725108d642b6a3b4

SHA256
df98b1ce7e46f5f8caaeb26ef50954b1c8131261ee35a83798ae01f5dc1cf189

SHA512
ac1f49c9ed167852cd3fd25e38f04fe948fea273271b5a934e096b7a8b8a9e3b083cd17c040d9b36144c8e734a3c945e20cb04ad04bd4e3d953b58afbb2181ce

Download Submit
C:\Windows\{341A5655-9051-4e64-9C08-1622734F61AC}.exe

Filesize
168KB

MD5
049afa96595eafb4ea1153a16a4533cf

SHA1
0dcbe4fb03262288fa72c10605f0ec68d1f741bd

SHA256
a8ba058ef7d63af5a58befbca1b155a86146b9c4d6381f5581b5d940878f899f

SHA512
f9b3102627f40b0216db20c590487812136d600fe913be82cfd281f598302001ca1c66a61d9e44c79487a789846eef01ec8fc78891ffc5955f9926b3584a9160

Download Submit
C:\Windows\{3D5733B9-7AAF-4f80-A1ED-186A2E67621B}.exe

Filesize
168KB

MD5
009457aba8e8d70ce5d6ba6aa3b1a705

SHA1
0eba08170018b81570e48a803cd04afc420b1aed

SHA256
36c9141537b299ea28135cec1a5d3351a92ca898ad9c4ebb13f21659c565729c

SHA512
79e62b6cafb6301c541655d078b99d8b91c7d807a7e26484ca8fb051d3f4cd12fb02125c9afe7416d5bb353f4d5a031d14cfb6e1f0c4ad8c42dbda6052cd2baf

Download Submit
C:\Windows\{43E5107F-A1A8-429c-9D9D-B2AD450B5562}.exe

Filesize
168KB

MD5
1d41750be399beb7dbbdb3f3b26020e9

SHA1
5ac654a3a786985d044abc7ae6733ff13419bfda

SHA256
497989b10637ce87cb7bdefd85892bd036a3632eee2a5cb22b32733a9840ae47

SHA512
15d4f788cd361d23290de1f043fc1ed4a18e4cb74d78e2af751a0d4226c1a5ef4ddc5cbf46dde133d880d4c8b2547648034411a22a485cb2dacee98bf67b9eb1

Download Submit
C:\Windows\{812A6754-B05D-479b-B572-94BE1DD2B77C}.exe

Filesize
168KB

MD5
afea95c9c741e600ed73ae71b4336760

SHA1
a583ce0ead548957e13bcdb8f2f281d2a53f678b

SHA256
87c49783764d646eb80301fc0a44f9df7d3cc0ee7ec10f4b3fc4d706f74f103e

SHA512
8dfd189ef366e8fb701d22a7cff8e7de475427b37bae030821abfc0a574c9cc3a33761d8fcc813ecbc31f5010d937676cc79c7a8a0c6c227470a9341c3d103c5

Download Submit
C:\Windows\{8391E354-151A-4ded-921D-73B21027346B}.exe

Filesize
168KB

MD5
a3cdfbca2e1d140ed7e6b7b14c5eca47

SHA1
97628603ffc1b37772af4ae28c2e5f537d5f757a

SHA256
bc1ce605535a02e882ba9a13ad14e277466006b922898b25fba6f28897670ca5

SHA512
78a16fc7519123805bd1774b1b2444caf74d6a189907f7c3963e2c046ca8677e36b56c3c0594f36ec852cbf9ec7985ca7df90e5cd1b8352533dd2c04069eb640

Download Submit
C:\Windows\{90E4027E-3020-445e-B71F-A08BD3C0E457}.exe

Filesize
168KB

MD5
905731a4d51275ef2d945d6de343f9d4

SHA1
1ca2eb2248334701acc19b8f3929441fe94b49b5

SHA256
bb8df1fc527730cf877f5682ea64804bb593b7be041f545a1cacf650ab7510a7

SHA512
c122fc83a9e80a8b3111f86c21024b941496c8742c2c28c8499f7813fd02ae7cfa5f0d730c047276b700648c3283465b038ea6920ccb0998311f1bd4dac36fdc

Download Submit
C:\Windows\{9192C750-59A1-4e61-BDF5-FF0AF9ED9F8B}.exe

Filesize
168KB

MD5
80d4cc8f55735f84b274bb0d51e23c4b

SHA1
24b1e68f91817513386edb45646227a9a4dbf318

SHA256
87eb82121d2e17f1639d834713068503d6000a5e03fd7fe662d5584ea3e9d37b

SHA512
ca21b5c836f1095ec0f9fc58851f7caba9c871391787244491f1f2c6ff23ecf3836217d7ecc32c32c8272b0504e462e005ad798d8e71fdb64fb44f79f5e1b2a3

Download Submit
C:\Windows\{94E1CF8E-B12F-4401-B3B9-BE2B027EAC63}.exe

Filesize
168KB

MD5
c90aae21bb44c3fc92b746f9ed45dc6d

SHA1
55648ce49bb8a6d8ea01d172df6cf55d0a623033

SHA256
89a9bb0897513faa6e80bd6a4dd32d94864b1d2600ea2be78569db1b841b3420

SHA512
95095f4e4fb991998a3cf37f36ac2f91a11ad04b28dbddd53c26b41ff5f4ee200a376d1f7c59354e5d9e2e2a39397ad3aecf8fe5c9417a6b1c4f73a97694c3f9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads