d81aa78eeb970189a331c64539a9fd4db9629410b740ac08220d9bca90f82d49

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe
Size

380KB
MD5

44815dc40cb5e0269edf8bc867a4e564
SHA1

dcee6330630664fc18f2b77a0db08fd71ccd5dae
SHA256

d81aa78eeb970189a331c64539a9fd4db9629410b740ac08220d9bca90f82d49
SHA512

e0ce354fcf833d024402618c4a1ac76720533ee41f3289e4cfec0cb573a96cc72dad30a2cba504ed4c00d69776c8c519c7a1d18f650d05cdc70a3dccf86967b1
SSDEEP

3072:mEGh0oYlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG2l7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012331-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001450b-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012331-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000014983-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012331-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012331-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012331-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{789D6A1E-EA9E-4325-BE63-BF318C81C841}\stubpath = "C:\\Windows\\{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe"	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82F91546-BE26-44d2-BC55-DB7E3346968B}\stubpath = "C:\\Windows\\{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe"	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}\stubpath = "C:\\Windows\\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe"	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}\stubpath = "C:\\Windows\\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe"	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{347A2709-EEC3-4193-9AE1-612E0FF0B993}	{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}	{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{348F4D8C-F821-4e9d-BC93-2E16059661CD}	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}\stubpath = "C:\\Windows\\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe"	{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAA9676E-9574-4f31-A99B-E97EBA601C03}\stubpath = "C:\\Windows\\{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe"	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{347A2709-EEC3-4193-9AE1-612E0FF0B993}\stubpath = "C:\\Windows\\{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe"	{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AAF4058-E022-4a03-ABF9-BA04280CA227}\stubpath = "C:\\Windows\\{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe"	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAA9676E-9574-4f31-A99B-E97EBA601C03}	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}\stubpath = "C:\\Windows\\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe"	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}	{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{348F4D8C-F821-4e9d-BC93-2E16059661CD}\stubpath = "C:\\Windows\\{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe"	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AAF4058-E022-4a03-ABF9-BA04280CA227}	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82F91546-BE26-44d2-BC55-DB7E3346968B}	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}\stubpath = "C:\\Windows\\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}.exe"	{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{789D6A1E-EA9E-4325-BE63-BF318C81C841}	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe

Executes dropped EXE 11 IoCs

pid	Process
2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe
2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
1928	{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
2136	{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
2860	{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe
2720	{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
File created	C:\Windows\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}.exe	{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe
File created	C:\Windows\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
File created	C:\Windows\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
File created	C:\Windows\{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
File created	C:\Windows\{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
File created	C:\Windows\{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
File created	C:\Windows\{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe	{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
File created	C:\Windows\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe	{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
File created	C:\Windows\{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe
File created	C:\Windows\{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe
Token: SeIncBasePriorityPrivilege	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
Token: SeIncBasePriorityPrivilege	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
Token: SeIncBasePriorityPrivilege	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
Token: SeIncBasePriorityPrivilege	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
Token: SeIncBasePriorityPrivilege	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
Token: SeIncBasePriorityPrivilege	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
Token: SeIncBasePriorityPrivilege	1928	{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
Token: SeIncBasePriorityPrivilege	2136	{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
Token: SeIncBasePriorityPrivilege	2860	{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2156	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	28
PID 2936 wrote to memory of 2156	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	28
PID 2936 wrote to memory of 2156	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	28
PID 2936 wrote to memory of 2156	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	28
PID 2936 wrote to memory of 2816	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	29
PID 2936 wrote to memory of 2816	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	29
PID 2936 wrote to memory of 2816	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	29
PID 2936 wrote to memory of 2816	2936	2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe	29
PID 2156 wrote to memory of 2644	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	30
PID 2156 wrote to memory of 2644	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	30
PID 2156 wrote to memory of 2644	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	30
PID 2156 wrote to memory of 2644	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	30
PID 2156 wrote to memory of 2840	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	31
PID 2156 wrote to memory of 2840	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	31
PID 2156 wrote to memory of 2840	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	31
PID 2156 wrote to memory of 2840	2156	{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe	31
PID 2644 wrote to memory of 2828	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	32
PID 2644 wrote to memory of 2828	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	32
PID 2644 wrote to memory of 2828	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	32
PID 2644 wrote to memory of 2828	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	32
PID 2644 wrote to memory of 2732	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	33
PID 2644 wrote to memory of 2732	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	33
PID 2644 wrote to memory of 2732	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	33
PID 2644 wrote to memory of 2732	2644	{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe	33
PID 2828 wrote to memory of 2952	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	36
PID 2828 wrote to memory of 2952	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	36
PID 2828 wrote to memory of 2952	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	36
PID 2828 wrote to memory of 2952	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	36
PID 2828 wrote to memory of 2108	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	37
PID 2828 wrote to memory of 2108	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	37
PID 2828 wrote to memory of 2108	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	37
PID 2828 wrote to memory of 2108	2828	{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe	37
PID 2952 wrote to memory of 2696	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	38
PID 2952 wrote to memory of 2696	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	38
PID 2952 wrote to memory of 2696	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	38
PID 2952 wrote to memory of 2696	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	38
PID 2952 wrote to memory of 2756	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	39
PID 2952 wrote to memory of 2756	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	39
PID 2952 wrote to memory of 2756	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	39
PID 2952 wrote to memory of 2756	2952	{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe	39
PID 2696 wrote to memory of 2360	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	40
PID 2696 wrote to memory of 2360	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	40
PID 2696 wrote to memory of 2360	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	40
PID 2696 wrote to memory of 2360	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	40
PID 2696 wrote to memory of 2036	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	41
PID 2696 wrote to memory of 2036	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	41
PID 2696 wrote to memory of 2036	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	41
PID 2696 wrote to memory of 2036	2696	{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe	41
PID 2360 wrote to memory of 1452	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	42
PID 2360 wrote to memory of 1452	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	42
PID 2360 wrote to memory of 1452	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	42
PID 2360 wrote to memory of 1452	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	42
PID 2360 wrote to memory of 276	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	43
PID 2360 wrote to memory of 276	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	43
PID 2360 wrote to memory of 276	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	43
PID 2360 wrote to memory of 276	2360	{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe	43
PID 1452 wrote to memory of 1928	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	44
PID 1452 wrote to memory of 1928	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	44
PID 1452 wrote to memory of 1928	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	44
PID 1452 wrote to memory of 1928	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	44
PID 1452 wrote to memory of 2220	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	45
PID 1452 wrote to memory of 2220	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	45
PID 1452 wrote to memory of 2220	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	45
PID 1452 wrote to memory of 2220	1452	{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_44815dc40cb5e0269edf8bc867a4e564_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe
  C:\Windows\{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
    C:\Windows\{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
      C:\Windows\{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
        
        C:\Windows\{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - C:\Windows\{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
        
        C:\Windows\{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
        
        C:\Windows\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
        
        C:\Windows\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
        
        C:\Windows\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
        
        C:\Windows\{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
        
        C:\Windows\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe
        
        C:\Windows\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Windows\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}.exe
        
        C:\Windows\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}.exe
        12⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBD3E~1.EXE > nul
        12⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{347A2~1.EXE > nul
        11⤵
        
        PID:628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4D14~1.EXE > nul
        10⤵
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6960F~1.EXE > nul
        9⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5E00~1.EXE > nul
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BAA96~1.EXE > nul
        7⤵
        
        PID:2036
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{82F91~1.EXE > nul
        6⤵
        
        PID:2756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3AAF4~1.EXE > nul
        5⤵
        
        PID:2108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{789D6~1.EXE > nul
      4⤵
      PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{348F4~1.EXE > nul
    3⤵
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{347A2709-EEC3-4193-9AE1-612E0FF0B993}.exe

Filesize
380KB

MD5
9439974df4139b6559786764d49127a3

SHA1
ac9c85e15490138066fe3b5a08673df9e9e079ba

SHA256
83369d80475cb59216dbc2c69d6bdcb7140345975243e3e57e094cae599665cc

SHA512
e93a63d6d6e77c92da3873d705d84c6866d162724599c7f616ef0895217a85648224c931306dde9622a5206d1a0909049e2cbf7b09c3eba60678a49a51e7581c

Download Submit
C:\Windows\{348F4D8C-F821-4e9d-BC93-2E16059661CD}.exe

Filesize
380KB

MD5
782b8ad637d201e7c2430aa19c07c517

SHA1
de547c7d133b750532d8075bddc65e9ba34e3f36

SHA256
0a6c40f5f3bc8b6914f12535a8e07bc8e73c75c09d96c23c04684dd3b74c47b7

SHA512
a5d839031adac1cb7b385b80d010069a2fa281306a3591c5db05026185aa2571ebdfbce156bd12fd4a722908c98bb1583dbeebe1c2d87776a3c6d754bab13962

Download Submit
C:\Windows\{3AAF4058-E022-4a03-ABF9-BA04280CA227}.exe

Filesize
380KB

MD5
4305f04b1be094f54f4b830bf0f6a879

SHA1
fd2ae89cd8bce7703f924bbe539dbf38b98facda

SHA256
ece54900c52f0a6e7ba4bc4e270f5287827bcbeca93f539865e19ba9952aaa00

SHA512
4f8ec31b32c6ee77e1faedaaa82b1e8bf9a299cc1668e80da349124f1846ee3e3c34c611a189c84c57e2219955ee660bbdbfa0d06bc31fefcfa2311c0d468427

Download Submit
C:\Windows\{6960FF58-751D-4b50-AFDF-C43BD7B6002B}.exe

Filesize
380KB

MD5
5d81099f926331a193066854abcbb191

SHA1
8782201ac9bd5535e7eb24c3fa10e7ad02e19943

SHA256
f6a17178532acde194808a75976b42bd5ae1dd5de7c4178141a8d060d22d9839

SHA512
43b9990bb7d06e6e103f804ea49fc2c21fc436dd85a330e6d7110951c8805af0293f97d83c9ed85e002a14d69fe3acbcae2af2f8ad0a586541666c81ed1ba725

Download Submit
C:\Windows\{789D6A1E-EA9E-4325-BE63-BF318C81C841}.exe

Filesize
380KB

MD5
e8281c3b1c0ee3d68865e92ac104b15d

SHA1
0377af25d434f6b8d2b49834ef688720ad536739

SHA256
24e915da81c5f2619739cfc99ad3faf263e4bdfaf57c8d81fa362a27a5beee15

SHA512
6c01b308a62d259a0b12ebde66c57a2652db000e30f2d189900c3bd3891966c4de641a89eb6204e8f662d228501b2e0382b54655a3e06d1cb4fbacb8b884e20c

Download Submit
C:\Windows\{7D06F8FD-9DFC-42f1-89BB-EA9E99B1FF7F}.exe

Filesize
380KB

MD5
f6631f07ab4790e01555050be14c0503

SHA1
dea9456c265184785298c430739334ff8e4ab6a4

SHA256
81e2850e6e0956a619a53507c7c8ce5be884eea05cb65ae22891e7f0fd235123

SHA512
c4298ec545354b4a45df577659486f9fefd7edc530a29d768f149a5d4f0142435651059281ea6e32650a16409ac5c66a9db99fcfa411cd7096968cabcb25b643

Download Submit
C:\Windows\{82F91546-BE26-44d2-BC55-DB7E3346968B}.exe

Filesize
380KB

MD5
cba96efc5f0c4fcb4d94c1fcc489e826

SHA1
3f9995e0d8107062d9ecf52222143e33a315b037

SHA256
d5e48135ea4144b7f9c16fa25b07fb57db714a38dc692645b0e95a7440315bba

SHA512
325d734f1e8fd6992b08c50c1568e6bbc455dd56c163e155ee46191fd91d2bcf565b671ca8b43ae2f34284e11847f9935b0e8927c69ceab49a0a39389fc07a73

Download Submit
C:\Windows\{A5E00DF8-1B89-4ed6-ACBA-924F29E441BF}.exe

Filesize
380KB

MD5
70c99ea14b0ccc35c3ea51fdb3e74a93

SHA1
ef52e3145677115a7c95b852ebb9a418fbc933af

SHA256
8c69444940afc4074d4057873c2f043a5198486e31c6d310eb5b75188b414277

SHA512
0e0d75305156241a50866f5cbbb5c293b5aa3b9181b094e775a553c8db644d07fb33e05bc495b7dcb88c333ccd7080f030ba15aa29bb1eaa2c537de76c0ebf06

Download Submit
C:\Windows\{BAA9676E-9574-4f31-A99B-E97EBA601C03}.exe

Filesize
380KB

MD5
ac8e9ff04574a5ec3e185bd21cf4a8fa

SHA1
5c7c39d95a213c41d45ad2cdd8e05ca2efbb50b5

SHA256
a125ba5b4b951dbbbed17a667dda31e0bc93acd358b64398c82167171a78e488

SHA512
0d596c51d8112da792aba5af9169c8a9924e8a97f23470d2524c5fb3de49541e295e4da22bf9953c844100f5e7cc85d71bb2e44eacfa909fbb0cd9dc2a646556

Download Submit
C:\Windows\{E4D14AFF-87A9-499e-B5A4-11FCE80305EE}.exe

Filesize
380KB

MD5
6a2013d6077a78b2730393601cfe7eeb

SHA1
852ac16540661d547e777e4911e8f06649102868

SHA256
f08bc49c52067a590e9e28445f39d314c28e5c752769b7303ac56dd5533fc65c

SHA512
79e0967f9a323c4ebcc248e7dabbb024474c09ac4b3191d52a2771ef3152c7805ed072dad46278bcbb90cf7df1d735efe4da66c8a6430e3ba0eb37450e633a91

Download Submit
C:\Windows\{FBD3EC16-9E02-4743-89A8-5D39EB3B7445}.exe

Filesize
380KB

MD5
3c75430f47a7c5516a9875c799dee989

SHA1
75cb71ff75245677e25190219c30ba63aae5e9c4

SHA256
3fc013b748d9bf434b2adbf78d0a54a877b69dfbd8cef549e2036d34fb6112e7

SHA512
11d5f786ba3dfa1a63996efea911ff1d2152121545057e1feda9a9837afcee5b8b29cb62ba40b2127335f5b89bc82b0778e2ce36e0855caa882db2da6b2b8400

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads