a49ed79fc4e17fba40c27b5b540dc87fa4f63cab8590672e9ffabb659582dfda

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe
Size

372KB
MD5

b2f403a833bdb8af1d60927780b0430a
SHA1

5a054ffd18ffaf70691783baab645a443091ad1a
SHA256

a49ed79fc4e17fba40c27b5b540dc87fa4f63cab8590672e9ffabb659582dfda
SHA512

fc919fad06a7fda906b45921dd3142ceacd4eed0a5ef0b436e9702d4c0a391394bdec370a2ef76302574c7786a0aa44fde3638699079b92dec20820d8f8472f1
SSDEEP

3072:CEGh0oNlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGzlkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012267-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014221-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f3-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f3-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f3-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f3-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F95C5737-0AD5-4d90-8096-5285B531E7AC}	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}\stubpath = "C:\\Windows\\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe"	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}\stubpath = "C:\\Windows\\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe"	{46114661-5787-44cd-BB89-1B776E978B83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F06B043-F839-4004-BE73-4BE9037CA358}\stubpath = "C:\\Windows\\{5F06B043-F839-4004-BE73-4BE9037CA358}.exe"	{797733DD-A002-405b-980B-0F71A7F6B022}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{797733DD-A002-405b-980B-0F71A7F6B022}	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{797733DD-A002-405b-980B-0F71A7F6B022}\stubpath = "C:\\Windows\\{797733DD-A002-405b-980B-0F71A7F6B022}.exe"	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}	{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}\stubpath = "C:\\Windows\\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe"	{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}	{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F90154F9-BECE-4175-A70F-D708BAD82F26}	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}	{46114661-5787-44cd-BB89-1B776E978B83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46114661-5787-44cd-BB89-1B776E978B83}\stubpath = "C:\\Windows\\{46114661-5787-44cd-BB89-1B776E978B83}.exe"	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F06B043-F839-4004-BE73-4BE9037CA358}	{797733DD-A002-405b-980B-0F71A7F6B022}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88F75A2D-E62B-4bc0-9753-1E435AB49064}	{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88F75A2D-E62B-4bc0-9753-1E435AB49064}\stubpath = "C:\\Windows\\{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe"	{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F90154F9-BECE-4175-A70F-D708BAD82F26}\stubpath = "C:\\Windows\\{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe"	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46114661-5787-44cd-BB89-1B776E978B83}	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}\stubpath = "C:\\Windows\\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe"	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F95C5737-0AD5-4d90-8096-5285B531E7AC}\stubpath = "C:\\Windows\\{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe"	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}\stubpath = "C:\\Windows\\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}.exe"	{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe

Deletes itself 1 IoCs

pid	Process
2588	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe
576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe
1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
1948	{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe
112	{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
2068	{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe
2336	{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}.exe	{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe
File created	C:\Windows\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe
File created	C:\Windows\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
File created	C:\Windows\{46114661-5787-44cd-BB89-1B776E978B83}.exe	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
File created	C:\Windows\{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
File created	C:\Windows\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe	{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
File created	C:\Windows\{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
File created	C:\Windows\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	{46114661-5787-44cd-BB89-1B776E978B83}.exe
File created	C:\Windows\{797733DD-A002-405b-980B-0F71A7F6B022}.exe	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
File created	C:\Windows\{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	{797733DD-A002-405b-980B-0F71A7F6B022}.exe
File created	C:\Windows\{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe	{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
Token: SeIncBasePriorityPrivilege	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
Token: SeIncBasePriorityPrivilege	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
Token: SeIncBasePriorityPrivilege	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe
Token: SeIncBasePriorityPrivilege	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
Token: SeIncBasePriorityPrivilege	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe
Token: SeIncBasePriorityPrivilege	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
Token: SeIncBasePriorityPrivilege	1948	{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe
Token: SeIncBasePriorityPrivilege	112	{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
Token: SeIncBasePriorityPrivilege	2068	{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2992	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	28
PID 3024 wrote to memory of 2992	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	28
PID 3024 wrote to memory of 2992	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	28
PID 3024 wrote to memory of 2992	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	28
PID 3024 wrote to memory of 2588	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	29
PID 3024 wrote to memory of 2588	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	29
PID 3024 wrote to memory of 2588	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	29
PID 3024 wrote to memory of 2588	3024	2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe	29
PID 2992 wrote to memory of 2708	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	30
PID 2992 wrote to memory of 2708	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	30
PID 2992 wrote to memory of 2708	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	30
PID 2992 wrote to memory of 2708	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	30
PID 2992 wrote to memory of 3000	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	31
PID 2992 wrote to memory of 3000	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	31
PID 2992 wrote to memory of 3000	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	31
PID 2992 wrote to memory of 3000	2992	{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe	31
PID 2708 wrote to memory of 2464	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	34
PID 2708 wrote to memory of 2464	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	34
PID 2708 wrote to memory of 2464	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	34
PID 2708 wrote to memory of 2464	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	34
PID 2708 wrote to memory of 2900	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	35
PID 2708 wrote to memory of 2900	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	35
PID 2708 wrote to memory of 2900	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	35
PID 2708 wrote to memory of 2900	2708	{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe	35
PID 2464 wrote to memory of 1896	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	36
PID 2464 wrote to memory of 1896	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	36
PID 2464 wrote to memory of 1896	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	36
PID 2464 wrote to memory of 1896	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	36
PID 2464 wrote to memory of 676	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	37
PID 2464 wrote to memory of 676	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	37
PID 2464 wrote to memory of 676	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	37
PID 2464 wrote to memory of 676	2464	{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe	37
PID 1896 wrote to memory of 576	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	38
PID 1896 wrote to memory of 576	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	38
PID 1896 wrote to memory of 576	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	38
PID 1896 wrote to memory of 576	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	38
PID 1896 wrote to memory of 2644	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	39
PID 1896 wrote to memory of 2644	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	39
PID 1896 wrote to memory of 2644	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	39
PID 1896 wrote to memory of 2644	1896	{46114661-5787-44cd-BB89-1B776E978B83}.exe	39
PID 576 wrote to memory of 2872	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	40
PID 576 wrote to memory of 2872	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	40
PID 576 wrote to memory of 2872	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	40
PID 576 wrote to memory of 2872	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	40
PID 576 wrote to memory of 2896	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	41
PID 576 wrote to memory of 2896	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	41
PID 576 wrote to memory of 2896	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	41
PID 576 wrote to memory of 2896	576	{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe	41
PID 2872 wrote to memory of 1988	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	42
PID 2872 wrote to memory of 1988	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	42
PID 2872 wrote to memory of 1988	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	42
PID 2872 wrote to memory of 1988	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	42
PID 2872 wrote to memory of 844	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	43
PID 2872 wrote to memory of 844	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	43
PID 2872 wrote to memory of 844	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	43
PID 2872 wrote to memory of 844	2872	{797733DD-A002-405b-980B-0F71A7F6B022}.exe	43
PID 1988 wrote to memory of 1948	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	44
PID 1988 wrote to memory of 1948	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	44
PID 1988 wrote to memory of 1948	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	44
PID 1988 wrote to memory of 1948	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	44
PID 1988 wrote to memory of 2192	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	45
PID 1988 wrote to memory of 2192	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	45
PID 1988 wrote to memory of 2192	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	45
PID 1988 wrote to memory of 2192	1988	{5F06B043-F839-4004-BE73-4BE9037CA358}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_b2f403a833bdb8af1d60927780b0430a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
  C:\Windows\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
    C:\Windows\{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
      C:\Windows\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\Windows\{46114661-5787-44cd-BB89-1B776E978B83}.exe
        
        C:\Windows\{46114661-5787-44cd-BB89-1B776E978B83}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1896
      - C:\Windows\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
        
        C:\Windows\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:576
        
        C:\Windows\{797733DD-A002-405b-980B-0F71A7F6B022}.exe
        
        C:\Windows\{797733DD-A002-405b-980B-0F71A7F6B022}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
        
        C:\Windows\{5F06B043-F839-4004-BE73-4BE9037CA358}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe
        
        C:\Windows\{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
        
        C:\Windows\{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:112
        
        C:\Windows\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe
        
        C:\Windows\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
        
        C:\Windows\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}.exe
        
        C:\Windows\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}.exe
        12⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD542~1.EXE > nul
        12⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88F75~1.EXE > nul
        11⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F95C5~1.EXE > nul
        10⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5F06B~1.EXE > nul
        9⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79773~1.EXE > nul
        8⤵
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A2A5F~1.EXE > nul
        7⤵
        
        PID:2896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46114~1.EXE > nul
        6⤵
        
        PID:2644
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{247DE~1.EXE > nul
        5⤵
        
        PID:676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F9015~1.EXE > nul
      4⤵
      PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E0A0B~1.EXE > nul
    3⤵
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{247DED71-AF95-43f9-A667-DE78A5EA9E3C}.exe

Filesize
372KB

MD5
6c2fe94765f90b3f8af24affd86715a5

SHA1
b1352c535c570a953ccbcc9f37153dd2713ef877

SHA256
25bba1ea6ff6ec3990158d18dafd8b86e573ef673343471638bd219d95483c32

SHA512
22be2b6365b46922118458cf4ed98315f6c5f9514922bf43dfa0e030cf4d09b4a0bb080617aed191bc939135d213c6d067bf2eb810b94399cb9f1808c7341f03

Download Submit
C:\Windows\{46114661-5787-44cd-BB89-1B776E978B83}.exe

Filesize
372KB

MD5
d4ff028693378a9f376f15c4e8d1b4bb

SHA1
d49e79902c4608b116aeb745f99e0a26f7b84937

SHA256
fa7b72c87e79470d8a70c18c2413a2a56bb790d7ec3a4def51d2b776fae6fce2

SHA512
86a691b71ce4ec007979a8841f4ae784e705a3a83f6f7ff36e7fd51806f6e0aa16baa3362707509c4fcf167ba8909cd1cdff7f019d29b6cdb2eace59a339a990

Download Submit
C:\Windows\{5F06B043-F839-4004-BE73-4BE9037CA358}.exe

Filesize
372KB

MD5
671baae3ec9cfd7126ff34286c8fec23

SHA1
aaa3770620b5238f2e7fedff664002f5a6e88c06

SHA256
3ce3c44bb939eadc9b8b01521585f0859b50e6f4499b0114bfc950884d872faa

SHA512
b37e73cda17a3a837ac0e26530935d34c977cda181a6a8eedf6bc7cad98746e5bf65c0c0ca759d1e564e71aa179dac7eb5c8f3d16a9c77c91c26ac386a178127

Download Submit
C:\Windows\{797733DD-A002-405b-980B-0F71A7F6B022}.exe

Filesize
372KB

MD5
5e9c302d7eb8ae741858c04792e8df4d

SHA1
cc4415c33de9abe702fe93d1c8b83be4e5b346f2

SHA256
aee37893009583f442364facf13208288ef6c551605c8f3a3588a4caa0fb138e

SHA512
d3deb33fe39d95ee655036ef0a55b1fca7bd6e9e4f8df6803974a9a41e7adeca393d0c2b42dab7c76b895a032be8889f0c5f2547ccc2a504131837a44a96bb6c

Download Submit
C:\Windows\{88F75A2D-E62B-4bc0-9753-1E435AB49064}.exe

Filesize
372KB

MD5
4ef51212f4c81fb9c64cad99af0eada7

SHA1
063b4415ac4d0447f736ec65cc5716a80c7aee8e

SHA256
c26cfc788b2a23807463cc9a892396063f50783be690ecefa4f2ccb6a149b830

SHA512
a095d14d5c3e2eaef004030b599bbfae1cd2868346051cacedcddd716279733aa998dafe9556d4fa845a4d5772aedf1e6682886d18ff36727de101c13c76b29f

Download Submit
C:\Windows\{A2A5F2FA-D635-4376-B268-A7D4743C9A2A}.exe

Filesize
372KB

MD5
b9d3d93ca81924bdec1a40727f4563b5

SHA1
2d71effae8f3e1d92a09cfe6555cfb33a8cba804

SHA256
9ea437394d47c9d068f4a6f8e0531264f8a712f22b605a203530c06f583d57cc

SHA512
b76d0a1082594f6c0f56169babd1870ae0a6be6260049e5266de18bbb6b23c47dddee3d59bd6fc0774c66a1bd75706e7df935bfa273a6fc8292b5954c1964c54

Download Submit
C:\Windows\{CD5425A3-EF34-4f96-B235-703D9B2DB1AB}.exe

Filesize
372KB

MD5
daa905fa40407c372fe3098935e1b1a7

SHA1
de5c5945be84e13f7e1788cf836438ae8596c8aa

SHA256
1ed2c76488db9d51018679446b3cb01fa83a1e5389d94e7419aa55f1830d1a5d

SHA512
d3139d3000420447f7e2de8fdc7feea501018c6a881123ccd82e807588733f03679f9e32b7bdfecd91392d32969ab15c32c149adb77019c14468176a9ead64fa

Download Submit
C:\Windows\{E0A0BE9D-D2A0-4ded-95E2-094658E6BE0E}.exe

Filesize
372KB

MD5
3e7a65c82f185876fd750aa2fbedf0ab

SHA1
6565a9c16fed1f6439062911941ef549da7931b1

SHA256
819978e5a9ab140d97e73d78e5d885ae91ef0e679385cee85a1459621c21fb4e

SHA512
9fba7545aa6159cfcae078788ca54b23c03f28151ff08d3b3a1e0a58949c48c76b0a4669649ac306cbfbde5084d376396959a9ab03d08e90a6e7d997fdfeeceb

Download Submit
C:\Windows\{F90154F9-BECE-4175-A70F-D708BAD82F26}.exe

Filesize
372KB

MD5
5f3dbec17ca1847ebab28f7c3ab06bac

SHA1
7c59ce4ad903b544e0ca2c4c253d2cf941a34691

SHA256
661fc18e9af93b032d2eae9bcaf2f74263b519f37d369c6e33e6232826da4e9c

SHA512
c42a145ade42280ccba18c1ca196f942dfeef6ea130cacc27da069ec587015ed1d128fcec3c0240c612b07b90e945b8088cbf0a5a4383d2e3431e903c67167f0

Download Submit
C:\Windows\{F95C5737-0AD5-4d90-8096-5285B531E7AC}.exe

Filesize
372KB

MD5
bc0be84a60c07f1f01d5fdc62f4c9807

SHA1
6a77dee7d7c770df12ebfd4e451c91f57f6d51d0

SHA256
21152e684185c34b001ab4499e443f07b9de0399cad766639f3fd4ad1fbaa633

SHA512
c1ef6a26a472ecb3f03aeb6b5eb1b7da7e23a6763f6685cfa0a2cc87bf06f0ff009700931e9f6496cac93a0c32560eb9d50d0e7e5f175d3684463930e8b0dc75

Download Submit
C:\Windows\{FD8F3DC8-EF67-4082-8BC1-0C8A5B73B8DF}.exe

Filesize
372KB

MD5
27c16284368c2910cdfed2f6b7a35dc5

SHA1
fc3fc79aa7371d401e986e81d4bd39439350a6d7

SHA256
95e7853c3d712fc1eba1c5006740429df335a716f64b17d780980ba6f1ff1636

SHA512
6dde23f8e6a29519bc756369b80c98fec8270e3be26aa4727a09c24a9c7f0c8162658939ad4ab061d982f157ea2e737ec2215536a1974cbab8765b272acdfe6d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads