e2114f8c89797588def452c718ca697e3b20e0940c8f9b1ff37eb365d1854be8

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
Size

216KB
MD5

ab7979e053e0ede9be79b519d214bf3f
SHA1

639e81bc22dd049fd5381c53d88b7c54fb84c40b
SHA256

e2114f8c89797588def452c718ca697e3b20e0940c8f9b1ff37eb365d1854be8
SHA512

be06265ec58caf1ab602ee45ad6ad7b1c62264f45aefed5ad87c577aabcb7b0397a1428f07600bb743de0a3caf8c8dbf38addd052c1376de4a617885def69d64
SSDEEP

3072:jEGh0oEl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG6lEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002335b-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233f2-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233fc-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002335c-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233fc-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000002335c-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000233fc-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000002335c-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000233fc-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001000000002335c-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000233fc-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D862842-BD3D-433b-B076-9C1E7608DEEF}	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA4BAF81-77EE-4915-A748-4D87434D53B9}\stubpath = "C:\\Windows\\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe"	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44D68A13-8C7C-4319-8114-389D641E6E2F}\stubpath = "C:\\Windows\\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe"	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}\stubpath = "C:\\Windows\\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe"	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44D68A13-8C7C-4319-8114-389D641E6E2F}	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}\stubpath = "C:\\Windows\\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe"	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DED3417F-24BB-41bd-B167-B027CCFC35EB}	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA4BAF81-77EE-4915-A748-4D87434D53B9}	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DED3417F-24BB-41bd-B167-B027CCFC35EB}\stubpath = "C:\\Windows\\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe"	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}\stubpath = "C:\\Windows\\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe"	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}\stubpath = "C:\\Windows\\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe"	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27D83BF0-D299-4cad-B646-59F03E24B238}	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}\stubpath = "C:\\Windows\\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe"	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}\stubpath = "C:\\Windows\\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe"	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D862842-BD3D-433b-B076-9C1E7608DEEF}\stubpath = "C:\\Windows\\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe"	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27D83BF0-D299-4cad-B646-59F03E24B238}\stubpath = "C:\\Windows\\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe"	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe

Executes dropped EXE 11 IoCs

pid	Process
2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
2976	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
4204	{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
File created	C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
File created	C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
File created	C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
File created	C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
File created	C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
File created	C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
File created	C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
File created	C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
File created	C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
File created	C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
Token: SeIncBasePriorityPrivilege	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
Token: SeIncBasePriorityPrivilege	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
Token: SeIncBasePriorityPrivilege	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
Token: SeIncBasePriorityPrivilege	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
Token: SeIncBasePriorityPrivilege	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
Token: SeIncBasePriorityPrivilege	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
Token: SeIncBasePriorityPrivilege	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
Token: SeIncBasePriorityPrivilege	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
Token: SeIncBasePriorityPrivilege	2976	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2800	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe	84
PID 3592 wrote to memory of 2800	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe	84
PID 3592 wrote to memory of 2800	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe	84
PID 3592 wrote to memory of 3832	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe	85
PID 3592 wrote to memory of 3832	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe	85
PID 3592 wrote to memory of 3832	3592	2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe	85
PID 2800 wrote to memory of 2220	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	86
PID 2800 wrote to memory of 2220	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	86
PID 2800 wrote to memory of 2220	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	86
PID 2800 wrote to memory of 4540	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	87
PID 2800 wrote to memory of 4540	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	87
PID 2800 wrote to memory of 4540	2800	{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe	87
PID 2220 wrote to memory of 2972	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	90
PID 2220 wrote to memory of 2972	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	90
PID 2220 wrote to memory of 2972	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	90
PID 2220 wrote to memory of 2740	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	91
PID 2220 wrote to memory of 2740	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	91
PID 2220 wrote to memory of 2740	2220	{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe	91
PID 2972 wrote to memory of 4176	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	93
PID 2972 wrote to memory of 4176	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	93
PID 2972 wrote to memory of 4176	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	93
PID 2972 wrote to memory of 2824	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	94
PID 2972 wrote to memory of 2824	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	94
PID 2972 wrote to memory of 2824	2972	{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe	94
PID 4176 wrote to memory of 3376	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	95
PID 4176 wrote to memory of 3376	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	95
PID 4176 wrote to memory of 3376	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	95
PID 4176 wrote to memory of 5072	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	96
PID 4176 wrote to memory of 5072	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	96
PID 4176 wrote to memory of 5072	4176	{27D83BF0-D299-4cad-B646-59F03E24B238}.exe	96
PID 3376 wrote to memory of 4656	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	97
PID 3376 wrote to memory of 4656	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	97
PID 3376 wrote to memory of 4656	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	97
PID 3376 wrote to memory of 3456	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	98
PID 3376 wrote to memory of 3456	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	98
PID 3376 wrote to memory of 3456	3376	{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe	98
PID 4656 wrote to memory of 4976	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	99
PID 4656 wrote to memory of 4976	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	99
PID 4656 wrote to memory of 4976	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	99
PID 4656 wrote to memory of 3672	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	100
PID 4656 wrote to memory of 3672	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	100
PID 4656 wrote to memory of 3672	4656	{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe	100
PID 4976 wrote to memory of 3128	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	101
PID 4976 wrote to memory of 3128	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	101
PID 4976 wrote to memory of 3128	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	101
PID 4976 wrote to memory of 3240	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	102
PID 4976 wrote to memory of 3240	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	102
PID 4976 wrote to memory of 3240	4976	{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe	102
PID 3128 wrote to memory of 4088	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	103
PID 3128 wrote to memory of 4088	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	103
PID 3128 wrote to memory of 4088	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	103
PID 3128 wrote to memory of 1600	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	104
PID 3128 wrote to memory of 1600	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	104
PID 3128 wrote to memory of 1600	3128	{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe	104
PID 4088 wrote to memory of 2976	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	105
PID 4088 wrote to memory of 2976	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	105
PID 4088 wrote to memory of 2976	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	105
PID 4088 wrote to memory of 2532	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	106
PID 4088 wrote to memory of 2532	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	106
PID 4088 wrote to memory of 2532	4088	{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe	106
PID 2976 wrote to memory of 4204	2976	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe	107
PID 2976 wrote to memory of 4204	2976	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe	107
PID 2976 wrote to memory of 4204	2976	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe	107
PID 2976 wrote to memory of 4108	2976	{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
  C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
    C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
      C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
        
        C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4176
      - C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
        
        C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
        
        C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
        
        C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
        
        C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
        
        C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
        
        C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe
        
        C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe
        12⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8BFC4~1.EXE > nul
        12⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44D68~1.EXE > nul
        11⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CA15~1.EXE > nul
        10⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA4BA~1.EXE > nul
        9⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DED34~1.EXE > nul
        8⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6FE9F~1.EXE > nul
        7⤵
        
        PID:3456
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{27D83~1.EXE > nul
        6⤵
        
        PID:5072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D1830~1.EXE > nul
        5⤵
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1D862~1.EXE > nul
      4⤵
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7A5CF~1.EXE > nul
    3⤵
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe

Filesize
216KB

MD5
c3655887d476261b12941b4656bdc8a4

SHA1
43b2444a799d9e7b81b04b27ac8b384d436ec197

SHA256
363464c8be56c53207091628357f00dec3805e75f85b48c459ae34519cf71b89

SHA512
dd5c79b534d1f797557b440ee0fba55d5254cc2766e93c029d9f43f437fe13d8d10238247d063ce443915e08aad9c8d00cc42b09ec36444dc79c59f9e2f07330

Download Submit
C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe

Filesize
216KB

MD5
12205b946b72b9c3746cc7d11ca7e1c5

SHA1
8565febcf66e449f77ff3ea781ac14f6b70e8469

SHA256
e9ebedb686c60f33b240d3a0943c25c9fb68ad4aed2057a23a6b0c56390162d8

SHA512
712dfdcf35409c73fe91fdb4fda7e7225a0227671e782d584e9f07c06cabd84772c8c0d42d3a3fb1c4be121091dbdcbb36463d533da2d1aa7bea0810240d7afc

Download Submit
C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe

Filesize
216KB

MD5
ab85c5bfbb0d0bb9414316012647271b

SHA1
da2192e550fc1c3f5c5d6798f3d9dab2e3f1b199

SHA256
78bf3486a89ba07239bfc95dc83a59a6f9fb2c9768d83b08718f7b51fcfca487

SHA512
15d4d6756c05067895e914b1712a0553d1f1ba8fbedc8dd1ee98dffffccdea5c33ba2d8fea29be6b78cd6fb4e0883830336100b3c2277af04619a9ac57cfe214

Download Submit
C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe

Filesize
216KB

MD5
2c77d67a8401b226991c34a0380c0184

SHA1
d4ccadf6e3496335c5c4ec65fe094b9e0e51192c

SHA256
63d6a7082f7c454f1a4e1fe60a0607f6e7d373eae654d8383224fd771e38d632

SHA512
87a00fa8325adaa63368098d8ede82567eaaed604606a77d45c7e6bef75cd070f22ce7a8e59e98dc54059981b4bfb8bfc2c9a32270fc774ca00ea8e00a6b72d2

Download Submit
C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe

Filesize
216KB

MD5
b2d973ffd33ceb990bd135db35ecfac3

SHA1
98ed17542f6960e61d69a295b3d3b16af08c3b7d

SHA256
0c1299145b308970271a0558942978ee3c1210ec8f2a1b11a87248e0620c2b52

SHA512
7a76c0d6666e43869e17f21df698b5a3418288939b5c26f8540d4b7d54fcb163b9be09430ba48a592e4e6f664624a56cd90f5b39c963127038c5ddb128f546f2

Download Submit
C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe

Filesize
216KB

MD5
8bebb33b99d0c86ccbe6543ed80ba4c4

SHA1
d4cbc73a665d3c15ca8a46dd7228048d7ee57f7f

SHA256
60ab97591aa344c48f1145c66cc8119ac39fac828e8d0e4167789c17352b5167

SHA512
5e747237de024dafa1c92321aef48ef916fae7e142104e1eaefc601d23f2394838a429fd02c6e11c7fc5eb5971b58078d229065d19beb4b9ec2ed78824516256

Download Submit
C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe

Filesize
216KB

MD5
2b3db6ecf13037301804b382f2f8848b

SHA1
37755416a35537e7d33c1678ad757affcac11b71

SHA256
bcaa74a575ba48dccc76b1e0850ddc753c3eb47cd9ecd0aad381f1628bd5c4a1

SHA512
c189d2d71d6b6eed1675d2b2208ad99b51ac5725f39c5b057f260bd033fcd304827efe8ff2182e137788c304feb950b03eaf51aea1280737f71c73e1b0bc680a

Download Submit
C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe

Filesize
216KB

MD5
9b3284015d0091f806708a68ac828076

SHA1
a5063f1ffead6f77b4c4cde1a1b135f36726a7fc

SHA256
5f9d9de224f86015795897dff545c1d1159d9d6eea9005c637d73c657e5027d1

SHA512
a297325d7c279aaa8109a6df7cf029bc64b12a5c8631ea4928f5f018665c7a351f3a22f702360c4976b5f5cdb80f07ddfbeb0312d92c0bada6ccb16c56629d64

Download Submit
C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe

Filesize
216KB

MD5
52efa711c6f6e9b979f54f4b913548e2

SHA1
5314af5093a7b0517ed32d5d0acc60852516ae25

SHA256
299268bdd8558e34c38c8556e25ca6a439e7f6b9b2e5d6eba38d0c8ddf7ebc97

SHA512
8424651e52ddf4c36120387ad7d41ca77371fb4cab6de7bd1b370b1fb514fa8d470d5390a434f804a38221f9de6d68e005eff96fb8665ba2180a927b0fbf3f03

Download Submit
C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe

Filesize
216KB

MD5
03ff14f268bed3de3d1835c29525dec4

SHA1
5a5d38770b91ab44f7a230e11bf6c8d7a2ac2985

SHA256
a40efab0966d48bdb4c124e2548f9647c1b7f143b9ed337b7ce9e712a981b105

SHA512
5adfee9a8bdb0b2343e2ceee39df3a49b156acdfb5a41617e0ba4749f3e3eb69a7edd4f6181c860efa8d6cfbe3f2d6caf79db5e6d80adc7903a2c0fecc7befc4

Download Submit
C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe

Filesize
216KB

MD5
fb2606b3c999d1ae7ce5dd4f3c3d5e70

SHA1
f9ee813a8a8a006c5a53960424e890a2aa56e726

SHA256
bdd530bebe899e4b5cd56c7cff853217b6bd14a69cff3de502c279e7c636b3ee

SHA512
3d53d2c2f6f33e7ecbb51e0ad0e70b5f1248ed45902da131453d1617d379564cc9b0854a82030fb6622c29148e6f65163ebe1bf12c5268c86e2b7d3a87b678fb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads