c171573c9603124924e6fbf9dde6c0d634a2dbd9f30c88bb2fd0fd942298477a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe
Size

408KB
MD5

d2257723b6d00864e5c6d2eed6058edd
SHA1

be3eb3063be252417d52517e991bc416f3ea4013
SHA256

c171573c9603124924e6fbf9dde6c0d634a2dbd9f30c88bb2fd0fd942298477a
SHA512

dc3a26374f76958dbdf1336261bb20b86331dd416f8e6a9837d27337300160dde3580fd139f30a3debeaf5ac9465af3c92fbc103f43104194fcff62269a62482
SSDEEP

3072:CEGh0okl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGWldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000800000002337f-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002340d-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023367-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000229b4-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023367-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001db1f-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001e4e7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db1f-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000016956-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001db1f-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000016956-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001db1f-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}	{514C49DA-98D4-4090-BF91-159692370787}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}\stubpath = "C:\\Windows\\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe"	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AF15254-D1E8-437e-B6FC-9336F9304722}	{3253BD52-459C-4ebb-9064-069760B92619}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25B1A293-AA26-4e53-89DC-8845EE2AB792}\stubpath = "C:\\Windows\\{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe"	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98FAF726-0BA1-476e-97A6-92F00E420621}\stubpath = "C:\\Windows\\{98FAF726-0BA1-476e-97A6-92F00E420621}.exe"	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}\stubpath = "C:\\Windows\\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe"	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25B1A293-AA26-4e53-89DC-8845EE2AB792}	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}\stubpath = "C:\\Windows\\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe"	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{606BAC98-D3A0-405e-A07B-402021661D36}\stubpath = "C:\\Windows\\{606BAC98-D3A0-405e-A07B-402021661D36}.exe"	{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3253BD52-459C-4ebb-9064-069760B92619}\stubpath = "C:\\Windows\\{3253BD52-459C-4ebb-9064-069760B92619}.exe"	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}\stubpath = "C:\\Windows\\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe"	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3253BD52-459C-4ebb-9064-069760B92619}	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{606BAC98-D3A0-405e-A07B-402021661D36}	{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}\stubpath = "C:\\Windows\\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe"	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514C49DA-98D4-4090-BF91-159692370787}\stubpath = "C:\\Windows\\{514C49DA-98D4-4090-BF91-159692370787}.exe"	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}\stubpath = "C:\\Windows\\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe"	{514C49DA-98D4-4090-BF91-159692370787}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AF15254-D1E8-437e-B6FC-9336F9304722}\stubpath = "C:\\Windows\\{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe"	{3253BD52-459C-4ebb-9064-069760B92619}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98FAF726-0BA1-476e-97A6-92F00E420621}	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514C49DA-98D4-4090-BF91-159692370787}	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe

Executes dropped EXE 12 IoCs

pid	Process
4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe
3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe
4712	{514C49DA-98D4-4090-BF91-159692370787}.exe
1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
908	{3253BD52-459C-4ebb-9064-069760B92619}.exe
4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
4376	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
1260	{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe
4948	{606BAC98-D3A0-405e-A07B-402021661D36}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{514C49DA-98D4-4090-BF91-159692370787}.exe	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe
File created	C:\Windows\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
File created	C:\Windows\{3253BD52-459C-4ebb-9064-069760B92619}.exe	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
File created	C:\Windows\{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	{3253BD52-459C-4ebb-9064-069760B92619}.exe
File created	C:\Windows\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
File created	C:\Windows\{606BAC98-D3A0-405e-A07B-402021661D36}.exe	{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe
File created	C:\Windows\{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe
File created	C:\Windows\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
File created	C:\Windows\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	{514C49DA-98D4-4090-BF91-159692370787}.exe
File created	C:\Windows\{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
File created	C:\Windows\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
File created	C:\Windows\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
Token: SeIncBasePriorityPrivilege	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
Token: SeIncBasePriorityPrivilege	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe
Token: SeIncBasePriorityPrivilege	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe
Token: SeIncBasePriorityPrivilege	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe
Token: SeIncBasePriorityPrivilege	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
Token: SeIncBasePriorityPrivilege	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
Token: SeIncBasePriorityPrivilege	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe
Token: SeIncBasePriorityPrivilege	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
Token: SeIncBasePriorityPrivilege	4376	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
Token: SeIncBasePriorityPrivilege	1260	{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4296	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe	98
PID 1272 wrote to memory of 4296	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe	98
PID 1272 wrote to memory of 4296	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe	98
PID 1272 wrote to memory of 5096	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe	99
PID 1272 wrote to memory of 5096	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe	99
PID 1272 wrote to memory of 5096	1272	2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe	99
PID 4296 wrote to memory of 3644	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	102
PID 4296 wrote to memory of 3644	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	102
PID 4296 wrote to memory of 3644	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	102
PID 4296 wrote to memory of 4888	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	103
PID 4296 wrote to memory of 4888	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	103
PID 4296 wrote to memory of 4888	4296	{98FAF726-0BA1-476e-97A6-92F00E420621}.exe	103
PID 3644 wrote to memory of 1660	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	107
PID 3644 wrote to memory of 1660	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	107
PID 3644 wrote to memory of 1660	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	107
PID 3644 wrote to memory of 4524	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	108
PID 3644 wrote to memory of 4524	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	108
PID 3644 wrote to memory of 4524	3644	{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe	108
PID 1660 wrote to memory of 3592	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	109
PID 1660 wrote to memory of 3592	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	109
PID 1660 wrote to memory of 3592	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	109
PID 1660 wrote to memory of 3384	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	110
PID 1660 wrote to memory of 3384	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	110
PID 1660 wrote to memory of 3384	1660	{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe	110
PID 3592 wrote to memory of 4712	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	111
PID 3592 wrote to memory of 4712	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	111
PID 3592 wrote to memory of 4712	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	111
PID 3592 wrote to memory of 3864	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	112
PID 3592 wrote to memory of 3864	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	112
PID 3592 wrote to memory of 3864	3592	{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe	112
PID 4712 wrote to memory of 1972	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe	118
PID 4712 wrote to memory of 1972	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe	118
PID 4712 wrote to memory of 1972	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe	118
PID 4712 wrote to memory of 1856	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe	119
PID 4712 wrote to memory of 1856	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe	119
PID 4712 wrote to memory of 1856	4712	{514C49DA-98D4-4090-BF91-159692370787}.exe	119
PID 1972 wrote to memory of 560	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	120
PID 1972 wrote to memory of 560	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	120
PID 1972 wrote to memory of 560	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	120
PID 1972 wrote to memory of 4888	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	121
PID 1972 wrote to memory of 4888	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	121
PID 1972 wrote to memory of 4888	1972	{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe	121
PID 560 wrote to memory of 908	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	122
PID 560 wrote to memory of 908	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	122
PID 560 wrote to memory of 908	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	122
PID 560 wrote to memory of 3080	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	123
PID 560 wrote to memory of 3080	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	123
PID 560 wrote to memory of 3080	560	{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe	123
PID 908 wrote to memory of 4768	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe	131
PID 908 wrote to memory of 4768	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe	131
PID 908 wrote to memory of 4768	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe	131
PID 908 wrote to memory of 2744	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe	132
PID 908 wrote to memory of 2744	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe	132
PID 908 wrote to memory of 2744	908	{3253BD52-459C-4ebb-9064-069760B92619}.exe	132
PID 4768 wrote to memory of 4376	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	133
PID 4768 wrote to memory of 4376	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	133
PID 4768 wrote to memory of 4376	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	133
PID 4768 wrote to memory of 3632	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	134
PID 4768 wrote to memory of 3632	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	134
PID 4768 wrote to memory of 3632	4768	{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe	134
PID 4376 wrote to memory of 1260	4376	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe	135
PID 4376 wrote to memory of 1260	4376	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe	135
PID 4376 wrote to memory of 1260	4376	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe	135
PID 4376 wrote to memory of 876	4376	{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe	136

C:\Users\Admin\AppData\Local\Temp\2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_d2257723b6d00864e5c6d2eed6058edd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
  C:\Windows\{98FAF726-0BA1-476e-97A6-92F00E420621}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
    C:\Windows\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe
      C:\Windows\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1660
    - - C:\Windows\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe
        
        C:\Windows\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3592
      - C:\Windows\{514C49DA-98D4-4090-BF91-159692370787}.exe
        
        C:\Windows\{514C49DA-98D4-4090-BF91-159692370787}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
        
        C:\Windows\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
        
        C:\Windows\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\{3253BD52-459C-4ebb-9064-069760B92619}.exe
        
        C:\Windows\{3253BD52-459C-4ebb-9064-069760B92619}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
        
        C:\Windows\{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
        
        C:\Windows\{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe
        
        C:\Windows\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\{606BAC98-D3A0-405e-A07B-402021661D36}.exe
        
        C:\Windows\{606BAC98-D3A0-405e-A07B-402021661D36}.exe
        13⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D5D5E~1.EXE > nul
        13⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25B1A~1.EXE > nul
        12⤵
        
        PID:876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7AF15~1.EXE > nul
        11⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3253B~1.EXE > nul
        10⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE23B~1.EXE > nul
        9⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76BEC~1.EXE > nul
        8⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{514C4~1.EXE > nul
        7⤵
        
        PID:1856
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CFF2F~1.EXE > nul
        6⤵
        
        PID:3864
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0F6FD~1.EXE > nul
        5⤵
        
        PID:3384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{519B9~1.EXE > nul
      4⤵
      PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{98FAF~1.EXE > nul
    3⤵
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0F6FDB80-E32B-4106-B3D8-460994EB50DF}.exe

Filesize
408KB

MD5
aa96862d024b1a8a14eb9e30f42d6c89

SHA1
c7dfa822002f04e17fa8ded901f24c6aa74fd219

SHA256
1f61c1f73ed2998599ddbbce7b486bd8d987674b2be51433cc3e6c5f2e554343

SHA512
d8322ae211ac08bf8e7543cd20c243b902fc751bf46771c23c0e309d23f53318ecb7f01e7665e16333937d86bc4ab3d68747ebf9b2fda3a6eae2e558e58b16b3

Download Submit
C:\Windows\{25B1A293-AA26-4e53-89DC-8845EE2AB792}.exe

Filesize
408KB

MD5
859ad3f05fc1caaf046b5a9a2b762c04

SHA1
6f0c39d98cd433c09ae62370e466a17dd3f3f6bd

SHA256
8716884a0bbc5cf7968d932504b4267b7bd6f6337309d7fcc874c938c0665721

SHA512
6f8d7789bcd5148019b53a047444441fccf950727b969515d59d4a85fb22b76c59a0afa08d2d069ed9033363ef5677b6aa9afa04c7444d2064997dda4e8d1507

Download Submit
C:\Windows\{3253BD52-459C-4ebb-9064-069760B92619}.exe

Filesize
408KB

MD5
898db6bfd81b7e2e7e48e134b780beca

SHA1
aad440bba782771031afaf0423f71a03d7d49402

SHA256
8a479f2f2befadbbb71eaaf701bea9998571bb28e9c40b5c3905d246bd40be38

SHA512
7e008db9965a62fee7dd2353be118b91333ae05b8cf068494f8ac6e6fac7a7fc2fcedb08d764d6f0f56f5b77ed0e79581b850e61278f70e5e4c85bad4cb02005

Download Submit
C:\Windows\{514C49DA-98D4-4090-BF91-159692370787}.exe

Filesize
408KB

MD5
5252d1b92c273dd031173e942e6ea48c

SHA1
ca29656837b7358e62595ca3305e66a07484a6c6

SHA256
2a462713a86bef7c2d30b1490fffe6966f0d3c747122e65daf5361116cd76ba1

SHA512
d76611f11f3bec697413149508b641f2728e498a1556fb1413676539222ab17daa0222c7ce933e364e389cd6dbbea7e02b5d65dabd06c36c96edce8ad56bb7b9

Download Submit
C:\Windows\{519B9A4F-61CC-41f3-BD8B-339D618CABFB}.exe

Filesize
408KB

MD5
e0bab4a681cf80515ba1bfbea403f118

SHA1
4997a48f495806611da9a962231ca53e6f2b20a5

SHA256
d9030d35ee87365783c04b0148e799d47fc06506c9f0497d1a08fd7dd322fd73

SHA512
7670cb83891904c6e92a2a9f7f75a2bdf547a32236b44f325343b0038792e7a687c1b2eaea6c5bb9f16ee463cc3bb7541d435fffc944cb9c122df3cc63d70702

Download Submit
C:\Windows\{606BAC98-D3A0-405e-A07B-402021661D36}.exe

Filesize
408KB

MD5
be570b40a74dcf4079724d5f5f489392

SHA1
0f4067ded6ca9fcf262d1437157652047d702b42

SHA256
af18083cd72b3cbe3a2918fbdf6e2cb04aa20aa9d8e5704fbed9b83a1ed34093

SHA512
47d0a39878d1629bb06f9e93f6054d9efb82d0c2ee1457c95ee4a32b0db4306b79cfc84168853f5893d947d533cb5acb0a5ede0ffb60c39e2fe4ed34c329e611

Download Submit
C:\Windows\{76BECA9B-FFCC-47d5-A9AD-C56EF5498F26}.exe

Filesize
408KB

MD5
a34cab8187a3470bf5101501b5082790

SHA1
2f9e49847583319dc180e0cba99f2748709350ab

SHA256
b704f331e12a1046011f45111a28afc5651b10c6223185b24f04422266f1d648

SHA512
23c36d1c9803eb15f7f3f0c23c1b3a43c74a76bf0b268cffee6e0109f4dbe399efbfe2db0b0a0157ddf399f7cbcf7182a8f9bf24e484547c3fe44f721dabf986

Download Submit
C:\Windows\{7AF15254-D1E8-437e-B6FC-9336F9304722}.exe

Filesize
408KB

MD5
27f69c7ca1e4ed14d115ce9b88662e21

SHA1
76550453cb5bb44bc67936ed380d39c4b470e228

SHA256
477fa6aa2607358c8c6108a7dd53f37a9c5a2230d397b45eee49fb729793c74b

SHA512
8f3e957051d33200284079d458f394f195c6349cf9bc04a848832c02eb748ffe679dec43d67952d3a911d920a38b4e7423eabe2dcffa5c7ccd821fdc880bf613

Download Submit
C:\Windows\{98FAF726-0BA1-476e-97A6-92F00E420621}.exe

Filesize
408KB

MD5
3c28ae853e91668b2699d4d1a3a2bbd8

SHA1
d323f4b9daa86fcc849d2b53c22cf748e8e7ea11

SHA256
24fa87cd4e9d5c758b29ac5aa7d076f71a116fb2827338e2ea39d4cb4dde7396

SHA512
6790d15bc2bd36c02685a00c7a20e03f62122c05b74909f7fb5cc0589ee7579ec7d5afefa0f11ef30aa284d1846c76db5179b68c85fe6bb77b27560bc1ac3ba4

Download Submit
C:\Windows\{BE23B0E1-B0C5-49f4-9CE9-B4B8420BFD96}.exe

Filesize
408KB

MD5
84d41dfd695f4895a42ed7759a675541

SHA1
d34f7d9d10fa6242f34158f4ee1a5216780167d5

SHA256
7a995b72eff625f5d2a4e641c3a89a296fb551f87b9a9754d6a7821ef19ebaaa

SHA512
1df0fa71275412df34f3d33649850b8457996f4170bbd37c069cca23e662ac3b583749093e4fd473bd8d30495efe4f83044d2c5935463ebb73d7e811199ae09b

Download Submit
C:\Windows\{CFF2F549-901E-4e61-875F-AFF8E8F6984E}.exe

Filesize
408KB

MD5
a60f7a60fb36e1ea84da561ec356e283

SHA1
64d63e8c00843382042025aa9ff67b78145a4cd5

SHA256
d3ade27c0908064645088bd4b9cb20386796125f101b88db19d55a07833dd4ab

SHA512
db230800128efcbe5e1b122aa54448fb2389aba0eeb09c25288acb8af313ad7117aa86db4a91e9b9c54901556bff57478acb6fdd8848f35666f5c9bbacae681f

Download Submit
C:\Windows\{D5D5EBCD-760A-4951-A5E1-3F041DB6349D}.exe

Filesize
408KB

MD5
e84ff3a9ddc7daccf52943c62ef047f2

SHA1
278aed93e5cad4e92212e73973e3d32bc02bf063

SHA256
8fccebd5ad36864d4050b203319a5697587fdf3001c413cb0d03c2b92c0e0982

SHA512
728192edf674719c28be392eb6fc445352371e9366cf476d6897bcbc4cc0442898defdc2a028941bacbb35946170f61e966e2c93dc700e7fde0489fb0c7b1756

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads