03bd98861a08d2c47895820ef4d57c37ca6843e9c8c4fa97fc83f2e50100d462

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe
Size

180KB
MD5

5c1a9cabc7ac73a303d8470a6bb3cfbe
SHA1

9197edd080a4b164632161e4f56a7cea2750376a
SHA256

03bd98861a08d2c47895820ef4d57c37ca6843e9c8c4fa97fc83f2e50100d462
SHA512

7ff23f89abd904ce3df519b085617ff6b13c3811b4f63b39f7c32209788f0745eb481f80b83def096f53e92c05948751929b9e916a6b4ef7b47d2ab0549eec5f
SSDEEP

3072:jEGh0oNlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG/l5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00080000000122cd-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001224f-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001224f-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001224f-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001224f-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001224f-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F364F1FC-1D17-4040-A907-3610ED3C8B05}	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8022809F-7385-4bf8-861E-0E41FA5F41B5}	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8057C344-558B-4c13-BEF1-00EC63A01A7F}	{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}\stubpath = "C:\\Windows\\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe"	{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D57FCBF9-6A65-4a50-825D-25DE80519B45}	{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F427225C-E87E-46a4-A9A8-06986DD19295}\stubpath = "C:\\Windows\\{F427225C-E87E-46a4-A9A8-06986DD19295}.exe"	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}\stubpath = "C:\\Windows\\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe"	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8057C344-558B-4c13-BEF1-00EC63A01A7F}\stubpath = "C:\\Windows\\{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe"	{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F364F1FC-1D17-4040-A907-3610ED3C8B05}\stubpath = "C:\\Windows\\{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe"	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}\stubpath = "C:\\Windows\\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe"	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}\stubpath = "C:\\Windows\\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe"	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}\stubpath = "C:\\Windows\\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe"	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}	{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D57FCBF9-6A65-4a50-825D-25DE80519B45}\stubpath = "C:\\Windows\\{D57FCBF9-6A65-4a50-825D-25DE80519B45}.exe"	{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F427225C-E87E-46a4-A9A8-06986DD19295}	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AE19932-87BA-4c94-97C1-0668BD0CD596}	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AE19932-87BA-4c94-97C1-0668BD0CD596}\stubpath = "C:\\Windows\\{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe"	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8022809F-7385-4bf8-861E-0E41FA5F41B5}\stubpath = "C:\\Windows\\{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe"	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe

Deletes itself 1 IoCs

pid	Process
3064	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe
2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
2776	{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe
2056	{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
2064	{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe
2684	{D57FCBF9-6A65-4a50-825D-25DE80519B45}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
File created	C:\Windows\{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
File created	C:\Windows\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
File created	C:\Windows\{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe
File created	C:\Windows\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
File created	C:\Windows\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe	{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
File created	C:\Windows\{D57FCBF9-6A65-4a50-825D-25DE80519B45}.exe	{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe
File created	C:\Windows\{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe
File created	C:\Windows\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
File created	C:\Windows\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
File created	C:\Windows\{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe	{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
Token: SeIncBasePriorityPrivilege	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
Token: SeIncBasePriorityPrivilege	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
Token: SeIncBasePriorityPrivilege	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe
Token: SeIncBasePriorityPrivilege	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
Token: SeIncBasePriorityPrivilege	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
Token: SeIncBasePriorityPrivilege	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
Token: SeIncBasePriorityPrivilege	2776	{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe
Token: SeIncBasePriorityPrivilege	2056	{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
Token: SeIncBasePriorityPrivilege	2064	{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2984	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	28
PID 2192 wrote to memory of 2984	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	28
PID 2192 wrote to memory of 2984	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	28
PID 2192 wrote to memory of 2984	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	28
PID 2192 wrote to memory of 3064	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	29
PID 2192 wrote to memory of 3064	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	29
PID 2192 wrote to memory of 3064	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	29
PID 2192 wrote to memory of 3064	2192	2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe	29
PID 2984 wrote to memory of 2524	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	30
PID 2984 wrote to memory of 2524	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	30
PID 2984 wrote to memory of 2524	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	30
PID 2984 wrote to memory of 2524	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	30
PID 2984 wrote to memory of 2228	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	31
PID 2984 wrote to memory of 2228	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	31
PID 2984 wrote to memory of 2228	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	31
PID 2984 wrote to memory of 2228	2984	{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe	31
PID 2524 wrote to memory of 2800	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	32
PID 2524 wrote to memory of 2800	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	32
PID 2524 wrote to memory of 2800	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	32
PID 2524 wrote to memory of 2800	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	32
PID 2524 wrote to memory of 2536	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	33
PID 2524 wrote to memory of 2536	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	33
PID 2524 wrote to memory of 2536	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	33
PID 2524 wrote to memory of 2536	2524	{F427225C-E87E-46a4-A9A8-06986DD19295}.exe	33
PID 2800 wrote to memory of 2944	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	36
PID 2800 wrote to memory of 2944	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	36
PID 2800 wrote to memory of 2944	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	36
PID 2800 wrote to memory of 2944	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	36
PID 2800 wrote to memory of 1372	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	37
PID 2800 wrote to memory of 1372	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	37
PID 2800 wrote to memory of 1372	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	37
PID 2800 wrote to memory of 1372	2800	{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe	37
PID 2944 wrote to memory of 2896	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	38
PID 2944 wrote to memory of 2896	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	38
PID 2944 wrote to memory of 2896	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	38
PID 2944 wrote to memory of 2896	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	38
PID 2944 wrote to memory of 2964	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	39
PID 2944 wrote to memory of 2964	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	39
PID 2944 wrote to memory of 2964	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	39
PID 2944 wrote to memory of 2964	2944	{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe	39
PID 2896 wrote to memory of 564	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	40
PID 2896 wrote to memory of 564	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	40
PID 2896 wrote to memory of 564	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	40
PID 2896 wrote to memory of 564	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	40
PID 2896 wrote to memory of 276	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	41
PID 2896 wrote to memory of 276	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	41
PID 2896 wrote to memory of 276	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	41
PID 2896 wrote to memory of 276	2896	{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe	41
PID 564 wrote to memory of 1796	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	42
PID 564 wrote to memory of 1796	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	42
PID 564 wrote to memory of 1796	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	42
PID 564 wrote to memory of 1796	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	42
PID 564 wrote to memory of 1640	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	43
PID 564 wrote to memory of 1640	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	43
PID 564 wrote to memory of 1640	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	43
PID 564 wrote to memory of 1640	564	{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe	43
PID 1796 wrote to memory of 2776	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	44
PID 1796 wrote to memory of 2776	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	44
PID 1796 wrote to memory of 2776	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	44
PID 1796 wrote to memory of 2776	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	44
PID 1796 wrote to memory of 2744	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	45
PID 1796 wrote to memory of 2744	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	45
PID 1796 wrote to memory of 2744	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	45
PID 1796 wrote to memory of 2744	1796	{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-20_5c1a9cabc7ac73a303d8470a6bb3cfbe_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
  C:\Windows\{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
    C:\Windows\{F427225C-E87E-46a4-A9A8-06986DD19295}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
      C:\Windows\{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe
        
        C:\Windows\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Windows\{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
        
        C:\Windows\{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
        
        C:\Windows\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
        
        C:\Windows\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe
        
        C:\Windows\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
        
        C:\Windows\{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe
        
        C:\Windows\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\{D57FCBF9-6A65-4a50-825D-25DE80519B45}.exe
        
        C:\Windows\{D57FCBF9-6A65-4a50-825D-25DE80519B45}.exe
        12⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8BD3B~1.EXE > nul
        12⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8057C~1.EXE > nul
        11⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32084~1.EXE > nul
        10⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD94C~1.EXE > nul
        9⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{272F8~1.EXE > nul
        8⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80228~1.EXE > nul
        7⤵
        
        PID:276
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94AF5~1.EXE > nul
        6⤵
        
        PID:2964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9AE19~1.EXE > nul
        5⤵
        
        PID:1372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F4272~1.EXE > nul
      4⤵
      PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F364F~1.EXE > nul
    3⤵
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{272F887B-AA63-4f86-A3F6-50A171BBD9D8}.exe

Filesize
180KB

MD5
9d6259324b462f878d8edd82b35faee1

SHA1
02d0afb93ffd990c8c16e597405dd486b278a12a

SHA256
cc3b0ad23113a190f5a31e482f728dd23ae552eb2a286525ecb31da8948ae335

SHA512
d96daab59e14b4f7d35be7cf36dfc1ca9962f7d15758d4336b07a9e30eed5bc796625c4157964aed1c5ccfa42ac373c235c79013395407484f7a15da11547da2

Download Submit
C:\Windows\{3208489C-A828-4ddb-8E48-FA0EC7F852D2}.exe

Filesize
180KB

MD5
6a45a877fa11adeb6d752fe095769a4d

SHA1
7194c190b5aa7eea4ff9cd226d06eedf79983910

SHA256
02e2f7aba3ca92ba16049ca727de29cd7d024ea7e17487247c76ab937eb1d4b0

SHA512
b932426e0b0a78fa166f331073121d61b430254d1ba7289c10ac67f01fc42e5ec269f2b694e285f54e1ddf983e8b8245b31d6ec4ada8c6e84b406330a9935715

Download Submit
C:\Windows\{8022809F-7385-4bf8-861E-0E41FA5F41B5}.exe

Filesize
180KB

MD5
3ca6d7568d96500d794c5b2b60628626

SHA1
ac5641fdb57eedffffed2e70d121fcfa676990f6

SHA256
0fa60a2a10edd5a23ae64427a214bb45bc01648b4862298e034c886a5d9f8d3c

SHA512
e7f5b98862f87e6a16e0e08f9953602756282a53c97a94944c946b496148b8e2680d92c50cce2005c5c8dd228217cfdf36151366ae8b9c31eeeae4c459d2c4a4

Download Submit
C:\Windows\{8057C344-558B-4c13-BEF1-00EC63A01A7F}.exe

Filesize
180KB

MD5
aefd2a07cbfd1c830ed0f5e83686d755

SHA1
74338bbbab52bcb7c6d0f2a26ef92caa7bd7e19d

SHA256
8d8ef1df3e7fab7ccc3a5703022f410d92c6cb59530e610c2a41326601bf0228

SHA512
5b223c5d3dc8bdd66585218ac09da137fda891d6f9350b8e6b4e506640e31a15e7e32fb522079cb7971a26641db7f954c1ceddd55c1ed70f357df7587d713e51

Download Submit
C:\Windows\{8BD3BC3F-8F1E-4afc-9B89-A370490A05EE}.exe

Filesize
180KB

MD5
78e45a35001b5b1456a1c0b1f7acd404

SHA1
f711a7ed632f1d8e0e9d84d0a5a296e34b099a0d

SHA256
5a0b4bb74f5bdfa5efe2def86707f6592153d517678554689869aa58ee16f247

SHA512
a8f00e674ccd56c234db1ede9900442cd6af31a00b7eb22f9f2d09c9f07f7fe9f347ce268572e229bcdaa7c3a3cebb6b43353d02df41c3ec11802496dd465a23

Download Submit
C:\Windows\{94AF53A2-6EF2-40c2-8E6B-52C9D9D96EC6}.exe

Filesize
180KB

MD5
a21862628227989a3a341fa6c666e771

SHA1
6f3359a9278efd7f7b21019e65e73c03866eac97

SHA256
f8d2ce835871445ad8cb57ddf49acc9d6a74cf032927fc25190c5d6e91013c93

SHA512
2b3e948965e5a4e34ebbceba23056536a71ba8ed2a82322d9a85a1921b2542464141cb87b0bafb9bfc76e3004ae9e50478048c76b3a9cf958fd4b48db5942c4c

Download Submit
C:\Windows\{9AE19932-87BA-4c94-97C1-0668BD0CD596}.exe

Filesize
180KB

MD5
495a06d639a1462d4900baf1b010b275

SHA1
0881d884a89ae074051ed710c970d2034361ac7b

SHA256
25d7d30443e3029bce9148d11dd2b7b5cc1825f5f10997ccd5894f97d52c2534

SHA512
e1f2659aa1f73629fa88ebdb59050367541353048bf2ebe3ae664cee7b3d8b2c785e16e6c197a52fc79a387b5d172e121000a8dc1351278b57b8d5eaab284de6

Download Submit
C:\Windows\{D57FCBF9-6A65-4a50-825D-25DE80519B45}.exe

Filesize
180KB

MD5
05a37dc584e97738e7a6e90f4fd7c11c

SHA1
15f04ba5c39eeb81620a805be2d2297fc99253c0

SHA256
960dfc90c9f2719bc3ba671eb925bb619f0d90de906a0cfe0e5bec2df551aada

SHA512
4992ec2e1ad698648196757c6edf7b7c2e5bc4b5b7f5c8ed420246bdb31ca7dc7b121bed93366ec6be21252567917e9f82f85c3fc0dfa84562bcb6407192d34e

Download Submit
C:\Windows\{F364F1FC-1D17-4040-A907-3610ED3C8B05}.exe

Filesize
180KB

MD5
4601d9ce699838f5fb9cb68be85237b1

SHA1
34ade78385f48ffae22bf7d10db6f83c8dae7722

SHA256
5753e09027705c275f1b6a9437ba1485515e00b2e9f0dbbb1ddd0279b36b36fe

SHA512
47207bf5603d65ec74963ba1d6d6c5e26a6eb97abb672a0c1cc954ed9d668fdf3eef2c18e3abb8ad9dd7d26fb7c868c21b59b35fe1f237c80ec39d7ae5fd3f23

Download Submit
C:\Windows\{F427225C-E87E-46a4-A9A8-06986DD19295}.exe

Filesize
180KB

MD5
aca4b9177ca881d2462ea62f98511b98

SHA1
fa975593bf05029563a82818476837cc28cdec4c

SHA256
747c1d87d677c56a708f4c124805ac6e712b0cd6e6a3b7b5e74dd24598ed272a

SHA512
aff864a9686a5573f385f4b92e5ae8afb4e72a536a5b5a3afa1afdb4e68e8dcdecded0f0578e40bd45eef28f968c30fb4cd9bda0a34ee4bbe2f1dd3f4c4c2c8d

Download Submit
C:\Windows\{FD94C7CD-52CB-4314-8EB9-AC5F7EEC7159}.exe

Filesize
180KB

MD5
44292737afe3ca246131d3c05e4a30ba

SHA1
0fac925caca626416a379d29733114d5cd7fe883

SHA256
873ef842c4d404274696311e577afe6143bcbf3b6510d6b9746ddeb05027b76b

SHA512
52ca6d93582bfd76ed5448a0a6a30a2704adf4efd339294898d57ec1ac604c14dc9034be927c89082c3c7a0d38d8ce070ddaa793ef51e79c43426756548c879d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads