b579b81025a40428815fca1987fc1c53d8fbb8f0052d2b5dd83d02d30cf9ff61

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe
Size

180KB
MD5

b8bdf4becbd92fe41587d3969de18149
SHA1

cea2012236030470179edf933df9bb1f73c3785f
SHA256

b579b81025a40428815fca1987fc1c53d8fbb8f0052d2b5dd83d02d30cf9ff61
SHA512

105304719130ccebc85e8715fafb377181d6f65dc3924cee453a3c375c1468e46a707093617fd5e921113119af7a33c22f1dbfb4ac5dae741cca42ecc7685a0e
SSDEEP

3072:jEGh0oulfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGkl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a21-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000141a2-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000013a21-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000143ec-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000013a21-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000013a21-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000013a21-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}\stubpath = "C:\\Windows\\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe"	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}\stubpath = "C:\\Windows\\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe"	{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24762929-691C-4e32-A220-2A2EF3BF4A34}	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A64C5735-C566-446c-A6C8-83F3D153062B}	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}\stubpath = "C:\\Windows\\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe"	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED4D6510-15D6-4643-B905-977E10424DA9}	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}	{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7299A6B1-5048-45e2-883A-780E3318C84C}	{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7299A6B1-5048-45e2-883A-780E3318C84C}\stubpath = "C:\\Windows\\{7299A6B1-5048-45e2-883A-780E3318C84C}.exe"	{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}	{7299A6B1-5048-45e2-883A-780E3318C84C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}\stubpath = "C:\\Windows\\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe"	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24762929-691C-4e32-A220-2A2EF3BF4A34}\stubpath = "C:\\Windows\\{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe"	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}\stubpath = "C:\\Windows\\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}.exe"	{7299A6B1-5048-45e2-883A-780E3318C84C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A64C5735-C566-446c-A6C8-83F3D153062B}\stubpath = "C:\\Windows\\{A64C5735-C566-446c-A6C8-83F3D153062B}.exe"	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}\stubpath = "C:\\Windows\\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe"	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}\stubpath = "C:\\Windows\\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe"	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED4D6510-15D6-4643-B905-977E10424DA9}\stubpath = "C:\\Windows\\{ED4D6510-15D6-4643-B905-977E10424DA9}.exe"	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe

Deletes itself 1 IoCs

pid	Process
2996	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe
1984	{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
2244	{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
1884	{7299A6B1-5048-45e2-883A-780E3318C84C}.exe
108	{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
File created	C:\Windows\{ED4D6510-15D6-4643-B905-977E10424DA9}.exe	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe
File created	C:\Windows\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe	{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
File created	C:\Windows\{7299A6B1-5048-45e2-883A-780E3318C84C}.exe	{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
File created	C:\Windows\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe
File created	C:\Windows\{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
File created	C:\Windows\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
File created	C:\Windows\{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
File created	C:\Windows\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
File created	C:\Windows\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
File created	C:\Windows\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}.exe	{7299A6B1-5048-45e2-883A-780E3318C84C}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
Token: SeIncBasePriorityPrivilege	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
Token: SeIncBasePriorityPrivilege	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
Token: SeIncBasePriorityPrivilege	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
Token: SeIncBasePriorityPrivilege	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
Token: SeIncBasePriorityPrivilege	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
Token: SeIncBasePriorityPrivilege	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe
Token: SeIncBasePriorityPrivilege	1984	{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
Token: SeIncBasePriorityPrivilege	2244	{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
Token: SeIncBasePriorityPrivilege	1884	{7299A6B1-5048-45e2-883A-780E3318C84C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2204	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	28
PID 2172 wrote to memory of 2204	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	28
PID 2172 wrote to memory of 2204	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	28
PID 2172 wrote to memory of 2204	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	28
PID 2172 wrote to memory of 2996	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	29
PID 2172 wrote to memory of 2996	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	29
PID 2172 wrote to memory of 2996	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	29
PID 2172 wrote to memory of 2996	2172	2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe	29
PID 2204 wrote to memory of 2724	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	30
PID 2204 wrote to memory of 2724	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	30
PID 2204 wrote to memory of 2724	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	30
PID 2204 wrote to memory of 2724	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	30
PID 2204 wrote to memory of 2640	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	31
PID 2204 wrote to memory of 2640	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	31
PID 2204 wrote to memory of 2640	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	31
PID 2204 wrote to memory of 2640	2204	{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe	31
PID 2724 wrote to memory of 2716	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	32
PID 2724 wrote to memory of 2716	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	32
PID 2724 wrote to memory of 2716	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	32
PID 2724 wrote to memory of 2716	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	32
PID 2724 wrote to memory of 2980	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	33
PID 2724 wrote to memory of 2980	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	33
PID 2724 wrote to memory of 2980	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	33
PID 2724 wrote to memory of 2980	2724	{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe	33
PID 2716 wrote to memory of 2520	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	36
PID 2716 wrote to memory of 2520	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	36
PID 2716 wrote to memory of 2520	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	36
PID 2716 wrote to memory of 2520	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	36
PID 2716 wrote to memory of 2504	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	37
PID 2716 wrote to memory of 2504	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	37
PID 2716 wrote to memory of 2504	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	37
PID 2716 wrote to memory of 2504	2716	{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe	37
PID 2520 wrote to memory of 2044	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	38
PID 2520 wrote to memory of 2044	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	38
PID 2520 wrote to memory of 2044	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	38
PID 2520 wrote to memory of 2044	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	38
PID 2520 wrote to memory of 952	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	39
PID 2520 wrote to memory of 952	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	39
PID 2520 wrote to memory of 952	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	39
PID 2520 wrote to memory of 952	2520	{A64C5735-C566-446c-A6C8-83F3D153062B}.exe	39
PID 2044 wrote to memory of 1096	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	40
PID 2044 wrote to memory of 1096	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	40
PID 2044 wrote to memory of 1096	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	40
PID 2044 wrote to memory of 1096	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	40
PID 2044 wrote to memory of 2028	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	41
PID 2044 wrote to memory of 2028	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	41
PID 2044 wrote to memory of 2028	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	41
PID 2044 wrote to memory of 2028	2044	{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe	41
PID 1096 wrote to memory of 1176	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	42
PID 1096 wrote to memory of 1176	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	42
PID 1096 wrote to memory of 1176	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	42
PID 1096 wrote to memory of 1176	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	42
PID 1096 wrote to memory of 812	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	43
PID 1096 wrote to memory of 812	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	43
PID 1096 wrote to memory of 812	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	43
PID 1096 wrote to memory of 812	1096	{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe	43
PID 1176 wrote to memory of 1984	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	44
PID 1176 wrote to memory of 1984	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	44
PID 1176 wrote to memory of 1984	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	44
PID 1176 wrote to memory of 1984	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	44
PID 1176 wrote to memory of 1680	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	45
PID 1176 wrote to memory of 1680	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	45
PID 1176 wrote to memory of 1680	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	45
PID 1176 wrote to memory of 1680	1176	{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-19_b8bdf4becbd92fe41587d3969de18149_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
  C:\Windows\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
    C:\Windows\{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
      C:\Windows\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
        
        C:\Windows\{A64C5735-C566-446c-A6C8-83F3D153062B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2520
      - C:\Windows\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
        
        C:\Windows\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
        
        C:\Windows\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe
        
        C:\Windows\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
        
        C:\Windows\{ED4D6510-15D6-4643-B905-977E10424DA9}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
        
        C:\Windows\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\{7299A6B1-5048-45e2-883A-780E3318C84C}.exe
        
        C:\Windows\{7299A6B1-5048-45e2-883A-780E3318C84C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
        
        C:\Windows\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}.exe
        
        C:\Windows\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}.exe
        12⤵
        Executes dropped EXE
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7299A~1.EXE > nul
        12⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADA46~1.EXE > nul
        11⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED4D6~1.EXE > nul
        10⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D197~1.EXE > nul
        9⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8015C~1.EXE > nul
        8⤵
        
        PID:812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0B3EB~1.EXE > nul
        7⤵
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A64C5~1.EXE > nul
        6⤵
        
        PID:952
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5F643~1.EXE > nul
        5⤵
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{24762~1.EXE > nul
      4⤵
      PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{31482~1.EXE > nul
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0B3EBEA1-D2D5-412e-A429-15B4F322E767}.exe

Filesize
180KB

MD5
57e736a9ed15e46af278c57b81a70852

SHA1
574122d6999f6af7a6b2f4f77e622aea949cfa3b

SHA256
a11c9cef093e79fa9571b12962a82090e7ae761258c3f8dd914a62cb96da8fb8

SHA512
a249d88443d93296cc364dc686df79e231546a895d5056d77c1248649607b9f6556f18ec309c69db470c0707338a7910ccbb4ddfc98e745f38ce4bb341a26323

Download Submit
C:\Windows\{1D197320-5F95-4ad0-A9F6-16290BEBB35F}.exe

Filesize
180KB

MD5
7bc568588f05ceed4d3737ff97ec12c3

SHA1
5eeabc7630e6d2964494b313117daa47080e6fed

SHA256
99c9471f3be25c7426bf4dfbebab4dad2e2c3fbfb726b7375cc717a521e0f0e6

SHA512
330225ce744c2c29d7109825d5e92e2a03ff4a6410fcb52067a8b73069de2ed76da6c0e49f55a686b8adef9f6dee2b4eef51df659e3cc7fbbed2f7ac4edc8542

Download Submit
C:\Windows\{24762929-691C-4e32-A220-2A2EF3BF4A34}.exe

Filesize
180KB

MD5
eac824ea4c8800010620a8afc752e814

SHA1
deaca98960a3539303c0fbd679744578f74ba38c

SHA256
a697cc501517ca1105b35aa495f98e15bc816ef3dd6218d39f492f934aabd282

SHA512
96fb7c6a214ec5ce0c628c268d63755a7db505c8905d70c6313b0c8ac5467e3b7235ac993d586e240e9c36296701d1645bfe2ace5b724da5f1f8ef966c0c40be

Download Submit
C:\Windows\{2CC85606-4E1F-4b12-AFAC-6EB7F4552363}.exe

Filesize
180KB

MD5
6752b78d89e631353c89e1b5f1def495

SHA1
6e5cd91786eaf4819d6f3a84cf4e9b4e87b38175

SHA256
69c62bd97b4e82805efd742de20bfd1a39b87242ffa4c7ea43f1d102052bc446

SHA512
29665d794bb5227915d8edd93d48644d37c06499c4bae3c4303242b32469f3887046ee281443c9f8bd0215e2521048e6bf4e7f2b27f3fe1502b2e754848c0eba

Download Submit
C:\Windows\{31482B43-EF49-4212-8DEE-F3FB12AC26AC}.exe

Filesize
180KB

MD5
de4627b593ca33cc685e0063ffd7bc2d

SHA1
8a948c3464a51e393dda538131485f8ede63525f

SHA256
8b7ee64fbc9cb05125aeabb04c8dfaf91a3e374b8f388845fd06d5bca2c26052

SHA512
a6171ce5df042ac35aba04988e722185199cf9692d39e57485f01b39c591dd025f792321b558ebd644aaa57e24cbb8b97a96615b0a2eaec93fdb2d14ca081a62

Download Submit
C:\Windows\{5F643E40-88E9-42a9-8CE1-FBAF83CCD443}.exe

Filesize
180KB

MD5
7bf7643dfca8bacb167807220d4197a8

SHA1
8b106a78bac9f695bc543b271803120c7f758db7

SHA256
3b0c427501ce08dc2035048e0a63121bafb3398732577efb6b578122dec90a62

SHA512
93e64bf4a24c7709de83eefc6a53f3ebefb61afea6dd62aef5877457dd63f66250f97e8cd9c0956503ff5b6199f7b9dd1823b72f14855b54c018af238373b198

Download Submit
C:\Windows\{7299A6B1-5048-45e2-883A-780E3318C84C}.exe

Filesize
180KB

MD5
e503592471c38699728533dea12a176c

SHA1
f757b051c8ebf2b0b6cacb93ccbd657b23ee8d1b

SHA256
e200a44c16e419a1e6871a548c228be92fc383eb0b2421047e8e49d3a4a4b3ce

SHA512
f4c689901d99984dce8c9af2b76123e8c27b1744ba37c267c40c7c656f61db3365a616d665ecd856a6ec956148a371994563c040978ec5733414a82b2934f3c2

Download Submit
C:\Windows\{8015CECC-0BF4-4b3c-956D-89C7BED220BB}.exe

Filesize
180KB

MD5
23604d4cfbb0555f63ce47b7468a4a30

SHA1
b766d46cb1ca53c255553072fc353b3f704c603a

SHA256
ea4e43c86844a81e2723da55b454efbe6b7c12418dd9056fdf9dc32957dd720b

SHA512
47c7661eadb96d21614d2b7308c519baad7cbc3df810d49d38959e8dcf316469d6151ad0be907d0ba693329cf312877d162c840fc7c6987b44f34add41e0057a

Download Submit
C:\Windows\{A64C5735-C566-446c-A6C8-83F3D153062B}.exe

Filesize
180KB

MD5
ffb925633bbaa0e5e02dd22ace741f4e

SHA1
c1396150f6b849ed41a6f97f2c5d89dce1e23fe0

SHA256
91f1bb2b7ce808d7d18f14e13eb2c82ad66717b2ea788bb9d1324dcc5ce49c99

SHA512
1707f6f62c5ce1baacb736558ea9d9f4be94e3b8f30b7ada662697b6c0c84994eeaf8185769e7647b62c25c262a11a4194439d3775caa03515717cd77d81899c

Download Submit
C:\Windows\{ADA466DF-1BDB-431d-A15E-7F6936FB630B}.exe

Filesize
180KB

MD5
853cdba4f89328aee41598aa80a4047b

SHA1
0fb16a5813a8435085ab71449fcc424e33dcbe30

SHA256
ebdb68a1bd565385e1dfcfd587dae9c5d58fdf16d56eebea77ba3602bd8534ef

SHA512
3b36306f05f1c8641de484c216bdf8a147c8d9e5195aaf7be44ada50be3dbf89de0adf5af97be5ca591ed19584f0a38313c75355dbc9c40ef7344228b67e47d1

Download Submit
C:\Windows\{ED4D6510-15D6-4643-B905-977E10424DA9}.exe

Filesize
180KB

MD5
747c0a5d435fb638e44b111fa8141d8a

SHA1
f9dd3476603933f72851cdc4e34eb3e41dc3d03e

SHA256
8f6669c15eb3a2e36bad9159dee676553389ac682580f26e99f95a8cf7eda6c4

SHA512
0674fc3844ebefd45d7824c8b6dc6098aeb517b6b78ac383c0743844ef0e777ddfbbaa4f3fde3343a6390306e2016252e86e67891129a75e14f0b17d9cc4d2f7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads