b6f749be6e9a3bda78b895ee4e452c62d4c18920c85c542e78a9ab4ace03e67d

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe
Size

380KB
MD5

eaacac06ee7a8234e6a590e715542ecb
SHA1

c9b4229db944d1bf21ef5496b75409265d7cfe30
SHA256

b6f749be6e9a3bda78b895ee4e452c62d4c18920c85c542e78a9ab4ace03e67d
SHA512

bf4f47c5b300506937e8d89a1e89bd89588aeb7a6f1a2c6d794a905d5be6a25c3278c94d582ba5ce785746ffff73f536a73a4224ff1ace74e9fdfc0db67aacc7
SSDEEP

3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG/l7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012328-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000013413-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012328-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000013a3a-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012328-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012328-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012328-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22E1CED3-7F26-4542-BD3B-66B371A440FF}	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}\stubpath = "C:\\Windows\\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe"	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BBE39B50-1254-4c07-A04F-D98E63300F16}	{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4EF8320A-4122-48ca-ABDC-E3203D84673B}	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4EF8320A-4122-48ca-ABDC-E3203D84673B}\stubpath = "C:\\Windows\\{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe"	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}	{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}\stubpath = "C:\\Windows\\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}.exe"	{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}\stubpath = "C:\\Windows\\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe"	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}\stubpath = "C:\\Windows\\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe"	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22E1CED3-7F26-4542-BD3B-66B371A440FF}\stubpath = "C:\\Windows\\{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe"	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C880836-E467-44b2-BBD1-353867334068}	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C880836-E467-44b2-BBD1-353867334068}\stubpath = "C:\\Windows\\{8C880836-E467-44b2-BBD1-353867334068}.exe"	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}\stubpath = "C:\\Windows\\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe"	{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}	{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BBE39B50-1254-4c07-A04F-D98E63300F16}\stubpath = "C:\\Windows\\{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe"	{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51044CCE-C5B3-4be2-A005-90CE1514944A}	{8C880836-E467-44b2-BBD1-353867334068}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51044CCE-C5B3-4be2-A005-90CE1514944A}\stubpath = "C:\\Windows\\{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe"	{8C880836-E467-44b2-BBD1-353867334068}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}\stubpath = "C:\\Windows\\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe"	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe

Deletes itself 1 IoCs

pid	Process
2836	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2960	{8C880836-E467-44b2-BBD1-353867334068}.exe
2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe
2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
2508	{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
2076	{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
2864	{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe
1168	{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{8C880836-E467-44b2-BBD1-353867334068}.exe	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe
File created	C:\Windows\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe
File created	C:\Windows\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
File created	C:\Windows\{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
File created	C:\Windows\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe	{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
File created	C:\Windows\{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe	{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
File created	C:\Windows\{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	{8C880836-E467-44b2-BBD1-353867334068}.exe
File created	C:\Windows\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
File created	C:\Windows\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
File created	C:\Windows\{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
File created	C:\Windows\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}.exe	{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe
Token: SeIncBasePriorityPrivilege	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
Token: SeIncBasePriorityPrivilege	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe
Token: SeIncBasePriorityPrivilege	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
Token: SeIncBasePriorityPrivilege	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
Token: SeIncBasePriorityPrivilege	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
Token: SeIncBasePriorityPrivilege	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
Token: SeIncBasePriorityPrivilege	2508	{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
Token: SeIncBasePriorityPrivilege	2076	{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
Token: SeIncBasePriorityPrivilege	2864	{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2960	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	28
PID 2100 wrote to memory of 2960	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	28
PID 2100 wrote to memory of 2960	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	28
PID 2100 wrote to memory of 2960	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	28
PID 2100 wrote to memory of 2836	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	29
PID 2100 wrote to memory of 2836	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	29
PID 2100 wrote to memory of 2836	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	29
PID 2100 wrote to memory of 2836	2100	2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe	29
PID 2960 wrote to memory of 2660	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	30
PID 2960 wrote to memory of 2660	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	30
PID 2960 wrote to memory of 2660	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	30
PID 2960 wrote to memory of 2660	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	30
PID 2960 wrote to memory of 2600	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	31
PID 2960 wrote to memory of 2600	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	31
PID 2960 wrote to memory of 2600	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	31
PID 2960 wrote to memory of 2600	2960	{8C880836-E467-44b2-BBD1-353867334068}.exe	31
PID 2660 wrote to memory of 2480	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	32
PID 2660 wrote to memory of 2480	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	32
PID 2660 wrote to memory of 2480	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	32
PID 2660 wrote to memory of 2480	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	32
PID 2660 wrote to memory of 2656	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	33
PID 2660 wrote to memory of 2656	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	33
PID 2660 wrote to memory of 2656	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	33
PID 2660 wrote to memory of 2656	2660	{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe	33
PID 2480 wrote to memory of 2932	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	36
PID 2480 wrote to memory of 2932	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	36
PID 2480 wrote to memory of 2932	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	36
PID 2480 wrote to memory of 2932	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	36
PID 2480 wrote to memory of 2460	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	37
PID 2480 wrote to memory of 2460	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	37
PID 2480 wrote to memory of 2460	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	37
PID 2480 wrote to memory of 2460	2480	{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe	37
PID 2932 wrote to memory of 2692	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	38
PID 2932 wrote to memory of 2692	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	38
PID 2932 wrote to memory of 2692	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	38
PID 2932 wrote to memory of 2692	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	38
PID 2932 wrote to memory of 2780	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	39
PID 2932 wrote to memory of 2780	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	39
PID 2932 wrote to memory of 2780	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	39
PID 2932 wrote to memory of 2780	2932	{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe	39
PID 2692 wrote to memory of 2824	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	40
PID 2692 wrote to memory of 2824	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	40
PID 2692 wrote to memory of 2824	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	40
PID 2692 wrote to memory of 2824	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	40
PID 2692 wrote to memory of 1324	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	41
PID 2692 wrote to memory of 1324	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	41
PID 2692 wrote to memory of 1324	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	41
PID 2692 wrote to memory of 1324	2692	{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe	41
PID 2824 wrote to memory of 2216	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	42
PID 2824 wrote to memory of 2216	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	42
PID 2824 wrote to memory of 2216	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	42
PID 2824 wrote to memory of 2216	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	42
PID 2824 wrote to memory of 1968	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	43
PID 2824 wrote to memory of 1968	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	43
PID 2824 wrote to memory of 1968	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	43
PID 2824 wrote to memory of 1968	2824	{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe	43
PID 2216 wrote to memory of 2508	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	44
PID 2216 wrote to memory of 2508	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	44
PID 2216 wrote to memory of 2508	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	44
PID 2216 wrote to memory of 2508	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	44
PID 2216 wrote to memory of 2196	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	45
PID 2216 wrote to memory of 2196	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	45
PID 2216 wrote to memory of 2196	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	45
PID 2216 wrote to memory of 2196	2216	{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-19_eaacac06ee7a8234e6a590e715542ecb_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\{8C880836-E467-44b2-BBD1-353867334068}.exe
  C:\Windows\{8C880836-E467-44b2-BBD1-353867334068}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
    C:\Windows\{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe
      C:\Windows\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
        
        C:\Windows\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Windows\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
        
        C:\Windows\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
        
        C:\Windows\{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
        
        C:\Windows\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
        
        C:\Windows\{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
        
        C:\Windows\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe
        
        C:\Windows\{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}.exe
        
        C:\Windows\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}.exe
        12⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BBE39~1.EXE > nul
        12⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F5B3D~1.EXE > nul
        11⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4EF83~1.EXE > nul
        10⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E76BA~1.EXE > nul
        9⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{22E1C~1.EXE > nul
        8⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CFF37~1.EXE > nul
        7⤵
        
        PID:1324
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD432~1.EXE > nul
        6⤵
        
        PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5AE9~1.EXE > nul
        5⤵
        
        PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{51044~1.EXE > nul
      4⤵
      PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8C880~1.EXE > nul
    3⤵
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{226ABFA9-CBCB-4a46-AA4A-5B55D464E48F}.exe

Filesize
380KB

MD5
bfbf697e648ff3cc811ed70a0cfe950b

SHA1
d42b63179cb8a3d07f9d8081667ab6bc4736db18

SHA256
b5890e06544b6b67ed99a135069ca1413b7167e60667be16bbfaa62310f0acb4

SHA512
9076f906353f45664ed3ac7e4beeff6e83a018c24d5b8a48e5cc5d8b7da1c8c018833c14ed48dbe5c56e1f9127588866bf4d4f7be8de2ed1e197bd8a2e9aece4

Download Submit
C:\Windows\{22E1CED3-7F26-4542-BD3B-66B371A440FF}.exe

Filesize
380KB

MD5
9de7d1e273df2a53d36a05c6008ab12a

SHA1
a1a7795c2ed3598fec716e609a66c74c4312f36e

SHA256
abad7a09818c04e8e50e976044e500614419eea5210bbf7e83c27eb9c9aca4d3

SHA512
34dbd52ee76b8010466660326b65e250f39f27e06dfa1cbff9965831ac8965be49fa8eca4ab63e85d95276ea59ca903e18f952ebf81be4c4cc7f5ca65ffc9473

Download Submit
C:\Windows\{4EF8320A-4122-48ca-ABDC-E3203D84673B}.exe

Filesize
380KB

MD5
eae1fa39d0dd990153ebf90dcb453474

SHA1
22e073c3ccfd32b733558697ae5706093cba43d7

SHA256
85c3564162f98aee3367794ecac3f44759e9b45531f14d2c4f20f18cd717ce21

SHA512
4f851cfe4294dcaf13bbf7983ed43457840de7b27362ba93ad5ad729fe6f0576072ed151308075f02dc75fa45a5c588f9f9020954974bb9d1c3b514afb4f207f

Download Submit
C:\Windows\{51044CCE-C5B3-4be2-A005-90CE1514944A}.exe

Filesize
380KB

MD5
22d8061af6f6c06bc7ac41fbd580b78b

SHA1
bd2ce8d2457437988e9d1158879ac0ab2fffa632

SHA256
61944a1d8b9e7ef831e5b30b526640ac1c63ceb19ac06cd52897938df04578df

SHA512
b238b498bf879da0c9049ea6042c97789352238dfe88db128073e1c368f03cba84cf9ec3e4b2b2a20cbcc0f9d3118849e681b34b204544c284ace1dffb0e239c

Download Submit
C:\Windows\{8C880836-E467-44b2-BBD1-353867334068}.exe

Filesize
380KB

MD5
bc06ccee4ec2f323b9576b5bf9dd2777

SHA1
497fd1bbb403ecb37018ea43b36ba415c8da1612

SHA256
753bdff4acbc24c3417f9fd72f7973f7512b64fc03dfadc41fe9dcc1dcbe7b58

SHA512
c51feee094d78db34f060007c560d2dcc864b7cc4733b3997198a27e21fccfe635c10412480a5a289b0e6042b71026e7ec7c10489f587a072c56ed27d0038bbc

Download Submit
C:\Windows\{A5AE92D7-D4CD-4015-A3F1-ED65FBB60F31}.exe

Filesize
380KB

MD5
fb0d10749858eda3e6042c57e9861ab2

SHA1
08c0769ad0777f17d706cb19067bb2257b9fc1a8

SHA256
cc7432cfe4271848f8220bf955732b342b66a45bb9743fab6a1ab8c82207ce6e

SHA512
47626b4ba480a125c898d79e17172387f06d5d6f43ff5380ef6b58a5d4acd98b2ee75a1dd4b64238955e511bda5843005134e67b9e8f851ca736a7551b84247a

Download Submit
C:\Windows\{BBE39B50-1254-4c07-A04F-D98E63300F16}.exe

Filesize
380KB

MD5
cf03c77f8d296d8fe2004e465ff1af7e

SHA1
09ae58b518b0ea5c0341d421f5f632e88ee5a1a7

SHA256
9fa15ff7c030efe85fab79c98902d3f763d829bcd12411e3fe93143f3a6103fe

SHA512
ddcf04b6e86ed3e5fa541ef1fad4c4942780343655bcae7a7edeeff8c434887366e9dbdb1cc867c5506901efee456a4ded9fd3899e8876a1215f7452270a738b

Download Submit
C:\Windows\{CFF37BEB-D504-4a4c-B2A9-CF279D75B984}.exe

Filesize
380KB

MD5
3c38a3200d773299a280620c2b0d6624

SHA1
3d948dd1a6ce729987322efacb6bfd5eba0a91d3

SHA256
c245290c0c0027cec08df26946e97007c1870832db3fcafb3b7463027ce7a1ae

SHA512
effb89a16ea8c29b1124d3c4baa3f69fa2ccbd42f82694666ff4566af70ec4cf5b4d4a173facc0e90fbc0ca111750f5d45f9d2f1be3291f18df2af892ddd1f91

Download Submit
C:\Windows\{E76BAA90-3D55-48e5-B457-69890A4F4AAA}.exe

Filesize
380KB

MD5
be8d5ae18382c2da92b0b9e65460a9c6

SHA1
54ce1bdd49da7f04913d21911a5966cfe9cf7737

SHA256
f64b90d810ba4b066abbd059dec989260d4d2a4cc0dc843908bbfe869ed0e688

SHA512
75740d53014c70da8a6521a1481451d62b736a59706d22918b643e9c2f36b0a3762872e1611e0f1c0a21ad57cf70760501c7db52063754407f63564fb8d46726

Download Submit
C:\Windows\{F5B3D8F0-8DF2-474f-B240-E59BF6D90727}.exe

Filesize
380KB

MD5
3a12f6dc79e3590a41eecf98f5fc3cc0

SHA1
8ebd13871c9cb359099012de0675b2846fc5bf0a

SHA256
0ca386930d10441f62e3a1fb2c763840cef2d1ed3a093feeda7422486309a1eb

SHA512
4330ef8c6ddf87571adea9e7e0a9869a2a4eaa648466978135ef68d540673325d543316df78f8016f24cd6db9c6b36e83cad709b64b9b43802c22f0555380864

Download Submit
C:\Windows\{FD432CB1-50F0-4143-8880-9A9DBBB5597D}.exe

Filesize
380KB

MD5
846f7f7e3fd0bf7769c10083b7f3ed60

SHA1
bc67026c8a3711fcbe57f71ac10d8f9ca54d2470

SHA256
2da5189dd19fc0776d84fa6e538aa629a8f6bd0bee6d536f3df2cad3cd5cbfaa

SHA512
12c8703a24c18e3ad4f3f829951d45efa7640c952b595b08c4048d570f1838ba9f6bcb342a6fe62e8ac2f767d700937b6c34966b4d19446ec1a9918f4e9a80f2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads