683f242b916e993663df32eb6c0dd5d850c7c11285d64641cb3742d26a17c639

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe
Size

408KB
MD5

37b2d54bcb4bdb258a2625134838c375
SHA1

2fddbde4245f85b1e85a50e2323fc06a701b8e84
SHA256

683f242b916e993663df32eb6c0dd5d850c7c11285d64641cb3742d26a17c639
SHA512

95f9def1097f96b5754f5cf1aa567222abedb4db189789ae4245e60efae77c286409a6e668f19a059952f55698cf95ace1c6266b18c9e138ebf52390f49084a9
SSDEEP

3072:CEGh0opl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGnldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000013420-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015ccd-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000013420-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000013420-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000013420-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000013420-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000013420-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E29CF507-0E4B-4496-B026-FD4C2E65D268}	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E29CF507-0E4B-4496-B026-FD4C2E65D268}\stubpath = "C:\\Windows\\{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe"	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}\stubpath = "C:\\Windows\\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe"	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6492D5C-513E-4d2e-B511-D17A44430ADA}\stubpath = "C:\\Windows\\{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe"	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31E18334-CE4D-48dc-AED8-307866883BA2}	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{282DBA66-4110-45ca-A682-7EFE0C10F69A}	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A16081F-A290-47f5-9C0D-1C053323D5A0}\stubpath = "C:\\Windows\\{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe"	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}\stubpath = "C:\\Windows\\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe"	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}\stubpath = "C:\\Windows\\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe"	{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4F78506-53FB-4661-955C-2B17F27CAAEA}\stubpath = "C:\\Windows\\{C4F78506-53FB-4661-955C-2B17F27CAAEA}.exe"	{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}	{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A16081F-A290-47f5-9C0D-1C053323D5A0}	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}\stubpath = "C:\\Windows\\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe"	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31E18334-CE4D-48dc-AED8-307866883BA2}\stubpath = "C:\\Windows\\{31E18334-CE4D-48dc-AED8-307866883BA2}.exe"	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}	{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{282DBA66-4110-45ca-A682-7EFE0C10F69A}\stubpath = "C:\\Windows\\{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe"	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6492D5C-513E-4d2e-B511-D17A44430ADA}	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}\stubpath = "C:\\Windows\\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe"	{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4F78506-53FB-4661-955C-2B17F27CAAEA}	{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe

Deletes itself 1 IoCs

pid	Process
1048	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
2624	{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
1332	{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe
2244	{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe
2020	{C4F78506-53FB-4661-955C-2B17F27CAAEA}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
File created	C:\Windows\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
File created	C:\Windows\{31E18334-CE4D-48dc-AED8-307866883BA2}.exe	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
File created	C:\Windows\{C4F78506-53FB-4661-955C-2B17F27CAAEA}.exe	{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe
File created	C:\Windows\{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe
File created	C:\Windows\{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
File created	C:\Windows\{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
File created	C:\Windows\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
File created	C:\Windows\{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
File created	C:\Windows\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe	{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
File created	C:\Windows\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe	{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
Token: SeIncBasePriorityPrivilege	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
Token: SeIncBasePriorityPrivilege	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
Token: SeIncBasePriorityPrivilege	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
Token: SeIncBasePriorityPrivilege	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
Token: SeIncBasePriorityPrivilege	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
Token: SeIncBasePriorityPrivilege	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
Token: SeIncBasePriorityPrivilege	2624	{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
Token: SeIncBasePriorityPrivilege	1332	{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe
Token: SeIncBasePriorityPrivilege	2244	{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2172	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	28
PID 2320 wrote to memory of 2172	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	28
PID 2320 wrote to memory of 2172	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	28
PID 2320 wrote to memory of 2172	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	28
PID 2320 wrote to memory of 1048	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	29
PID 2320 wrote to memory of 1048	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	29
PID 2320 wrote to memory of 1048	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	29
PID 2320 wrote to memory of 1048	2320	2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe	29
PID 2172 wrote to memory of 2600	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	30
PID 2172 wrote to memory of 2600	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	30
PID 2172 wrote to memory of 2600	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	30
PID 2172 wrote to memory of 2600	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	30
PID 2172 wrote to memory of 2696	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	31
PID 2172 wrote to memory of 2696	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	31
PID 2172 wrote to memory of 2696	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	31
PID 2172 wrote to memory of 2696	2172	{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe	31
PID 2600 wrote to memory of 2684	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	32
PID 2600 wrote to memory of 2684	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	32
PID 2600 wrote to memory of 2684	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	32
PID 2600 wrote to memory of 2684	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	32
PID 2600 wrote to memory of 2800	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	33
PID 2600 wrote to memory of 2800	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	33
PID 2600 wrote to memory of 2800	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	33
PID 2600 wrote to memory of 2800	2600	{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe	33
PID 2684 wrote to memory of 2472	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	36
PID 2684 wrote to memory of 2472	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	36
PID 2684 wrote to memory of 2472	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	36
PID 2684 wrote to memory of 2472	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	36
PID 2684 wrote to memory of 3008	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	37
PID 2684 wrote to memory of 3008	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	37
PID 2684 wrote to memory of 3008	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	37
PID 2684 wrote to memory of 3008	2684	{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe	37
PID 2472 wrote to memory of 2712	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	38
PID 2472 wrote to memory of 2712	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	38
PID 2472 wrote to memory of 2712	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	38
PID 2472 wrote to memory of 2712	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	38
PID 2472 wrote to memory of 2744	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	39
PID 2472 wrote to memory of 2744	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	39
PID 2472 wrote to memory of 2744	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	39
PID 2472 wrote to memory of 2744	2472	{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe	39
PID 2712 wrote to memory of 1744	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	40
PID 2712 wrote to memory of 1744	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	40
PID 2712 wrote to memory of 1744	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	40
PID 2712 wrote to memory of 1744	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	40
PID 2712 wrote to memory of 2620	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	41
PID 2712 wrote to memory of 2620	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	41
PID 2712 wrote to memory of 2620	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	41
PID 2712 wrote to memory of 2620	2712	{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe	41
PID 1744 wrote to memory of 1180	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	42
PID 1744 wrote to memory of 1180	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	42
PID 1744 wrote to memory of 1180	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	42
PID 1744 wrote to memory of 1180	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	42
PID 1744 wrote to memory of 860	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	43
PID 1744 wrote to memory of 860	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	43
PID 1744 wrote to memory of 860	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	43
PID 1744 wrote to memory of 860	1744	{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe	43
PID 1180 wrote to memory of 2624	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	44
PID 1180 wrote to memory of 2624	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	44
PID 1180 wrote to memory of 2624	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	44
PID 1180 wrote to memory of 2624	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	44
PID 1180 wrote to memory of 2648	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	45
PID 1180 wrote to memory of 2648	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	45
PID 1180 wrote to memory of 2648	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	45
PID 1180 wrote to memory of 2648	1180	{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_37b2d54bcb4bdb258a2625134838c375_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
  C:\Windows\{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
    C:\Windows\{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
      C:\Windows\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
        
        C:\Windows\{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2472
      - C:\Windows\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
        
        C:\Windows\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
        
        C:\Windows\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
        
        C:\Windows\{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
        
        C:\Windows\{31E18334-CE4D-48dc-AED8-307866883BA2}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
        
        C:\Windows\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe
        
        C:\Windows\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
        
        C:\Windows\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe
        
        C:\Windows\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\{C4F78506-53FB-4661-955C-2B17F27CAAEA}.exe
        
        C:\Windows\{C4F78506-53FB-4661-955C-2B17F27CAAEA}.exe
        12⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C2C69~1.EXE > nul
        12⤵
        
        PID:296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{728FD~1.EXE > nul
        11⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31E18~1.EXE > nul
        10⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6492~1.EXE > nul
        9⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87DD3~1.EXE > nul
        8⤵
        
        PID:860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2FDC4~1.EXE > nul
        7⤵
        
        PID:2620
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E29CF~1.EXE > nul
        6⤵
        
        PID:2744
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CDD9A~1.EXE > nul
        5⤵
        
        PID:3008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0A160~1.EXE > nul
      4⤵
      PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{282DB~1.EXE > nul
    3⤵
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A16081F-A290-47f5-9C0D-1C053323D5A0}.exe

Filesize
408KB

MD5
f057e3b359507a2e20167f2ad8813b9b

SHA1
4190846816f231f50af87dd7a0180249769d818d

SHA256
d1f9bf8596df4c7eaa03f411b05141f135be8d58783f27879c4b38d0c7c2c075

SHA512
0ceb9b547bc39623d8396a0aa960c113f8026c55819b1a5d4c6fbffba5c3c34e6f3f096ec144da055704aadfe88f21db884aa9626fe8f7aee76b704f7a977f13

Download Submit
C:\Windows\{282DBA66-4110-45ca-A682-7EFE0C10F69A}.exe

Filesize
408KB

MD5
c82dcf52b6b47696cac701f23ee43420

SHA1
210060ec31a47ea347e6629019d1ed4f59c8d47f

SHA256
decdcccd3b92efaea1bde60b6c89b55e300cd8c482ef058d76ae32460bbbfe0b

SHA512
54ce31a0a721d8f4b41f09bb69d99a0f3c08aac610cc62521f6e059197109061f669c517b23be03c178d46ec5d886ca80024dfc24a41585059665eff3041c044

Download Submit
C:\Windows\{2FDC4A90-971C-4f9e-8CED-3F2F2A7BC0EF}.exe

Filesize
408KB

MD5
5cae466ab3c1c09b3a32cd16f95de108

SHA1
00120558a666c888390b7725c35bc6a44b69b6db

SHA256
1007b7b7e6c8fc82f4e40d2f45d2dfd39e958e7e883a6c5509e69031979d69b9

SHA512
7fa74843898668a59c96a20e5a286a05b5020abaa00949198a9dfa83650f09a574865b611aacc8c6867ab8b7de1ac521b9122c7f6e5a2ea6880d2596da6dfbf1

Download Submit
C:\Windows\{31E18334-CE4D-48dc-AED8-307866883BA2}.exe

Filesize
408KB

MD5
7f33ac82c6658c4ddad2a57e9132a49b

SHA1
39b9877b9ee32fc653d2afd48bc09fdccd2a85dc

SHA256
be904b88ce645b74223c5b7b916a90edf7a88c313dfe047698f04b222f5bf47d

SHA512
19b294a31d4c779859bce6b29f57383079f9cd25b99cd25d73d747dbd5d61b3c24021cb184f564f97b1c4d93ddbfe6248c136cf9a6f394efc09ddc45ee47b94f

Download Submit
C:\Windows\{728FD29E-0000-4d81-BBC5-9506A9EB0C9C}.exe

Filesize
408KB

MD5
f8067f2507c97fa9670a738d9f6f72a3

SHA1
82df2d2476f6a93603ec082163346f920d99fef6

SHA256
a04484f13c4b31ce10d84d88d38764124e5238c07ba9ea0ca68c8870bbcec5ec

SHA512
c8802e0f38a216d589e3a08785f7c58fa13120aaccf84f5a525e6b6324215ccb142f4df2de542ba51471850ea7580550a52cefff7606f2b1f3d76ce354646a5f

Download Submit
C:\Windows\{87DD3D4B-7F54-43b8-BDE4-7438C2D592F2}.exe

Filesize
408KB

MD5
98f3d30c45fdad58207b71ef25961b19

SHA1
38ecc4b8c31b16411517da8e21c70ea363a19577

SHA256
0d6d68b4430e3f4e4d26447cc123a1145dfce623806b60654c2d4bc5d39e0f00

SHA512
62159b7d9b023d9bf8bb23d7210210c6e19b6a7bc8c0b2102ff1adb286e40169e055f6940d9d2fa05566949d48a84317dc85edd8b0ec76f1cad7caca638ea510

Download Submit
C:\Windows\{C2C69E01-3A00-42d5-8C41-E4363BE80CD2}.exe

Filesize
408KB

MD5
12986c4d0988ca2b87944301e1758306

SHA1
8e3e0b8ea3180224845bae70de8400e036808e14

SHA256
d127d0906deb911f57686eaca9db93999cbfbd1afdccbb7fcac83e0358ee3291

SHA512
ab9085202da0e49398f39f57bf61fa4df827e915f068279c287a69bac93497f9c8174e7066fef3ea9d6a0e68639d91d253cb17396d931c3e9612610bb441e093

Download Submit
C:\Windows\{C4F78506-53FB-4661-955C-2B17F27CAAEA}.exe

Filesize
408KB

MD5
2c4e2b2ba7865a3ea0da9ab24c56d8f2

SHA1
440314014606645c1f7c3149e32359c050b43604

SHA256
6c0911327d85dfbf862558c95efc6bffe47dd25e7378ac5aea6595dd34dec10c

SHA512
6b3ed70d2aea514ccf1029891120aaa5b45c78bdf0e6247352231b8ccb777114f633992c8d49a1eff35f2b1c4bb5e5666d0eae3a2f9c5d6adfe3e606758c5c74

Download Submit
C:\Windows\{CDD9A246-35D0-42a5-90D9-7FD80EF2B6E8}.exe

Filesize
408KB

MD5
d2c9ad83160c277c5c6ecf3fa3e3a535

SHA1
6da12e83ea568b61b6eb7d94fe00220a96044b77

SHA256
75122e8be3b1437682709ce0eaea78e14a3323233928a272e1046734c6d2ab54

SHA512
2da69317d87149de85f6b0ac384cbf61bc1c497147fccd6bb18eb3536d1610cf134cf10116adbc56a41ba38ed68dd91e870bb77330336ebc04d4a08f94cad217

Download Submit
C:\Windows\{D6492D5C-513E-4d2e-B511-D17A44430ADA}.exe

Filesize
408KB

MD5
2059a927aa11956eb5a6b59297c4a689

SHA1
2934cb871b1dcc497ea0daf9b4a986e1c621fefe

SHA256
3453325638c021c7ead955f5972ff3290cd6d8cc50dbeaba8202e65a0960e94a

SHA512
c1c0ff79692d073d14bca06565dfbba352432f6f0bb76b365b44c64ecab8d5157cf663d5613dd7fd633d64e270f857b26aeea42f42cf48765ba58343b6ec5f5c

Download Submit
C:\Windows\{E29CF507-0E4B-4496-B026-FD4C2E65D268}.exe

Filesize
408KB

MD5
fa84a41a0d3e265e429be10aafa7372b

SHA1
42eba9250ddc42a0e80d108d563f94459fdc0a7b

SHA256
777f2bf6363e47e2558e5196dc3c1a2ad46469b15445e8ed2f6f135ae9885474

SHA512
067febea68af38fcc535764a8f61f4cdf166ac9cdcb4ba278a8f46fecaf27cc8bd2ee3dbca2f906167f19e412990fd328b3f66b19e8afedf17acdf005199e609

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads