03a2a0051147cf96b113a0f1bd31e60b2889552059d108b93ad604136a1c753a

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
Size

197KB
MD5

47db9e651bb826b9bd3956272695f716
SHA1

93903c448da057c528c5abbd8cd87061d160fc1e
SHA256

03a2a0051147cf96b113a0f1bd31e60b2889552059d108b93ad604136a1c753a
SHA512

720c4286e8a7fb5849347e4724380ec94b1f14f70e25daa6b4c8f6e8617ea21ef58ebe5896d11493349837202f23e4bf6abeed12c084ca94451a6aabcd0a7344
SSDEEP

3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGMlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014825-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014abe-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014825-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015018-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014825-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014825-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000014825-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{678D156A-CC7A-4a17-AF8E-46341293FFF6}	{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}	{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{336E61BE-1ED3-47b6-9CC2-5863F179860D}	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{336E61BE-1ED3-47b6-9CC2-5863F179860D}\stubpath = "C:\\Windows\\{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe"	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}\stubpath = "C:\\Windows\\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe"	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}\stubpath = "C:\\Windows\\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe"	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}\stubpath = "C:\\Windows\\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe"	{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}\stubpath = "C:\\Windows\\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe"	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{678D156A-CC7A-4a17-AF8E-46341293FFF6}\stubpath = "C:\\Windows\\{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe"	{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}\stubpath = "C:\\Windows\\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe"	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}\stubpath = "C:\\Windows\\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}.exe"	{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}\stubpath = "C:\\Windows\\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe"	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}\stubpath = "C:\\Windows\\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe"	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}\stubpath = "C:\\Windows\\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe"	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}	{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe

Executes dropped EXE 11 IoCs

pid	Process
1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe
2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
2500	{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe
2668	{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
1296	{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe
2052	{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe	{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe
File created	C:\Windows\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}.exe	{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe
File created	C:\Windows\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
File created	C:\Windows\{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
File created	C:\Windows\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
File created	C:\Windows\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
File created	C:\Windows\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
File created	C:\Windows\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
File created	C:\Windows\{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe	{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
File created	C:\Windows\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
File created	C:\Windows\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
Token: SeIncBasePriorityPrivilege	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe
Token: SeIncBasePriorityPrivilege	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
Token: SeIncBasePriorityPrivilege	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
Token: SeIncBasePriorityPrivilege	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
Token: SeIncBasePriorityPrivilege	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
Token: SeIncBasePriorityPrivilege	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
Token: SeIncBasePriorityPrivilege	2500	{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe
Token: SeIncBasePriorityPrivilege	2668	{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
Token: SeIncBasePriorityPrivilege	1296	{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1196	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	28
PID 3024 wrote to memory of 1196	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	28
PID 3024 wrote to memory of 1196	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	28
PID 3024 wrote to memory of 1196	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	28
PID 3024 wrote to memory of 3000	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	29
PID 3024 wrote to memory of 3000	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	29
PID 3024 wrote to memory of 3000	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	29
PID 3024 wrote to memory of 3000	3024	2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe	29
PID 1196 wrote to memory of 2572	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	30
PID 1196 wrote to memory of 2572	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	30
PID 1196 wrote to memory of 2572	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	30
PID 1196 wrote to memory of 2572	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	30
PID 1196 wrote to memory of 2632	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	31
PID 1196 wrote to memory of 2632	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	31
PID 1196 wrote to memory of 2632	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	31
PID 1196 wrote to memory of 2632	1196	{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe	31
PID 2572 wrote to memory of 2660	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	32
PID 2572 wrote to memory of 2660	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	32
PID 2572 wrote to memory of 2660	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	32
PID 2572 wrote to memory of 2660	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	32
PID 2572 wrote to memory of 2672	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	33
PID 2572 wrote to memory of 2672	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	33
PID 2572 wrote to memory of 2672	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	33
PID 2572 wrote to memory of 2672	2572	{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe	33
PID 2660 wrote to memory of 2496	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	36
PID 2660 wrote to memory of 2496	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	36
PID 2660 wrote to memory of 2496	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	36
PID 2660 wrote to memory of 2496	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	36
PID 2660 wrote to memory of 2480	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	37
PID 2660 wrote to memory of 2480	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	37
PID 2660 wrote to memory of 2480	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	37
PID 2660 wrote to memory of 2480	2660	{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe	37
PID 2496 wrote to memory of 2388	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	38
PID 2496 wrote to memory of 2388	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	38
PID 2496 wrote to memory of 2388	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	38
PID 2496 wrote to memory of 2388	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	38
PID 2496 wrote to memory of 1652	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	39
PID 2496 wrote to memory of 1652	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	39
PID 2496 wrote to memory of 1652	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	39
PID 2496 wrote to memory of 1652	2496	{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe	39
PID 2388 wrote to memory of 1724	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	40
PID 2388 wrote to memory of 1724	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	40
PID 2388 wrote to memory of 1724	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	40
PID 2388 wrote to memory of 1724	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	40
PID 2388 wrote to memory of 1824	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	41
PID 2388 wrote to memory of 1824	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	41
PID 2388 wrote to memory of 1824	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	41
PID 2388 wrote to memory of 1824	2388	{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe	41
PID 1724 wrote to memory of 1880	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	42
PID 1724 wrote to memory of 1880	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	42
PID 1724 wrote to memory of 1880	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	42
PID 1724 wrote to memory of 1880	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	42
PID 1724 wrote to memory of 2308	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	43
PID 1724 wrote to memory of 2308	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	43
PID 1724 wrote to memory of 2308	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	43
PID 1724 wrote to memory of 2308	1724	{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe	43
PID 1880 wrote to memory of 2500	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	44
PID 1880 wrote to memory of 2500	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	44
PID 1880 wrote to memory of 2500	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	44
PID 1880 wrote to memory of 2500	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	44
PID 1880 wrote to memory of 2420	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	45
PID 1880 wrote to memory of 2420	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	45
PID 1880 wrote to memory of 2420	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	45
PID 1880 wrote to memory of 2420	1880	{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
  C:\Windows\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe
    C:\Windows\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
      C:\Windows\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
        
        C:\Windows\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
      - C:\Windows\{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
        
        C:\Windows\{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
        
        C:\Windows\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
        
        C:\Windows\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe
        
        C:\Windows\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
        
        C:\Windows\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
        
        C:\Windows\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Windows\{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe
        
        C:\Windows\{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
        
        C:\Windows\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}.exe
        
        C:\Windows\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}.exe
        12⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{678D1~1.EXE > nul
        12⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8E4DC~1.EXE > nul
        11⤵
        
        PID:536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{66E05~1.EXE > nul
        10⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{78F0A~1.EXE > nul
        9⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{47F31~1.EXE > nul
        8⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{336E6~1.EXE > nul
        7⤵
        
        PID:1824
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F52BD~1.EXE > nul
        6⤵
        
        PID:1652
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5C09~1.EXE > nul
        5⤵
        
        PID:2480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1C503~1.EXE > nul
      4⤵
      PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D1845~1.EXE > nul
    3⤵
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1C503A1F-CD8B-43ef-84F0-90EB5F481688}.exe

Filesize
197KB

MD5
d303bffb6240d4d07c22131ee29f4534

SHA1
2aa5a7438db604dfc0941c239435d37794f4380c

SHA256
7569dcc3d3a240cf18a772d7d1c4fb2c5ee6c921fef175f1fdebb59fcc5e94cd

SHA512
f7f05f7134a9e4f4faa204359958a0c8a51bf2bb7c50a1dc8e448f8d0b569cbe545ae9e435cba5160e396837ac0bfc8d726c818a5118c0ef8aaefebebeedcbda

Download Submit
C:\Windows\{336E61BE-1ED3-47b6-9CC2-5863F179860D}.exe

Filesize
197KB

MD5
02ffdd7fcd68842abef788ddc56a2107

SHA1
7b4c2e472cce9891a615afd0677d4b30f2289cf6

SHA256
c233ece59d228f5bfd76f44c31427cab44e85d187ac13398312bfde9b50050a1

SHA512
60129f2751d9cdb97dd7f34e5130baf9313ac597d1baf8df553bbf2b46bf31dafacc6bfcb062fd1e7866e7578d65c7c37c5babccc2a5857f9e3428857c3c1435

Download Submit
C:\Windows\{47F31AC5-3524-464f-8BC9-CC0E2512F49A}.exe

Filesize
197KB

MD5
b563bd9acade7751651b18e66fb10abd

SHA1
7b4fb908d01ffa4ddf9c564ae120f39583ca5a0c

SHA256
2cda6b77f64dfb53065b04bd9439d47d0549e34c5b2aecd477fa4ca2d3a867f6

SHA512
b9bbf3d2d469b12730de09c3a4884167dc751675ffc0709b159acefd70c0d6801fefc38fcb2fe505194bee8ebe386e32090b2b481bacd4c5404b01fda2394b11

Download Submit
C:\Windows\{5BD41A00-35B3-40ff-AE4E-E299A49F8FC0}.exe

Filesize
197KB

MD5
eaa31f6b5e8ea0d0c04992e82984a97a

SHA1
7e7e8a078cddacc8334c31c7b8262c35a969502b

SHA256
90ae59026b00b09f993c5ae2b24ada08bd7b3ede0bbe2ae703c1634ff1f4f449

SHA512
7069163443034c2bdd5700dfc50cc1fc1457be5f262a60836b22c9d8726b9528539a4953ce7eed4443073795061944e14eff64383fa700ee6e9f83aae3fdec15

Download Submit
C:\Windows\{66E05A5C-AB68-477a-ACD4-3F79220D4FF6}.exe

Filesize
197KB

MD5
96eb13f8e778bfddec2de321153b323e

SHA1
2685211d62bedc26c95f15552d4a39312d5ae13e

SHA256
5519ead129895f953565caaf631a786f9b4185703376d1cf075c81b32098441f

SHA512
af50d2fc23be61025ec4a5682958b899b679c12a8901ddf85ebfb76b7f1354cd8ebf4a94d512f7e4563b3460471459bc42ec5957dcce8c3b58288f938d6cacd9

Download Submit
C:\Windows\{678D156A-CC7A-4a17-AF8E-46341293FFF6}.exe

Filesize
197KB

MD5
4d3f66ea3c828549bd1f912236fdc47d

SHA1
c82758ea66fbf9675d4465128c3057bd1f5760f6

SHA256
91394ba1948b808c7309fd760750d9bc6b53e1c7f75e93acdbdf0f28a59a1a7b

SHA512
c1c3aea0da97407da4c1ed10e3fb744a9c3d2dcbdcda250a52c0f0d48a041d5c764550f7fd717de3b0d18be89d522b369b9ff5d302d0daad0e088f620b44ea67

Download Submit
C:\Windows\{78F0A802-8A07-4f6b-BE27-11E3FF0469C5}.exe

Filesize
197KB

MD5
44ace4c0b1439cc49f29fbe5ff2981d8

SHA1
ce33b5497e024d3872a42e58cb2956e40b6d991d

SHA256
8242332309471dc97cafc0a7b84df18630d3f0f5f24042442a80dde8fb17ae82

SHA512
eeaec0e199fb13ec117ae70e1ff8f11a2308c7dc82dd58fbb1cf43abe53b06239f35527c967face6fed0e68dea0cc146cf3d63261271cc7c4a7ac8b71e14fd21

Download Submit
C:\Windows\{8E4DC026-3D15-4d59-8E5B-B09E104C4207}.exe

Filesize
197KB

MD5
47a1b9598f18d73829f4241def2295b3

SHA1
117085bb3cb134c424e031661093a7ba2331aaca

SHA256
0df5e924524c71c47dc7ac161d3f2dd096836c4623ccb738b14afc8c9ad94fd9

SHA512
121fa524f10e277dedf5d20188dd79d2081ae5680d9bd0269d5ec76e09b70bc380c1254f8d03a4cd015fe51ef77f4ae0fcfde0bd6f62f0625bb159dec6c4a047

Download Submit
C:\Windows\{A5C09C4C-3A17-4ec6-AEEF-3045E06FE126}.exe

Filesize
197KB

MD5
c9fa398f8eb049cbf6bf0d9a49c15674

SHA1
0c2d64bdf47d96ede2986062f4f05080d432e829

SHA256
6ffade60525a65c893f04a27069aea1af8efaad17c9ff62a07eb208918f17832

SHA512
3d37409c93bb5c0d7946c11da5b78c3a6be2b1c48daa5144d187366b9d2193f544f37583fb788bae64f074adb48228fd72e88dd8d77b12f103688833b48c2014

Download Submit
C:\Windows\{D1845D3F-A31C-4543-A997-EA60ABE7DF93}.exe

Filesize
197KB

MD5
b9a0aefb2acf659cc985481c686537ac

SHA1
a3ed80ba67c2caf52db571be563037d075c6a1a9

SHA256
1f56f47d52aab90db5279ed6d1db2bcc38f9033801dd903f3937536ba1cf5a2c

SHA512
f5d2dbe3a8a6c3a3eafa417d44b585573288223a69911001a9980a423a680d91914385b00adfd0a7cbdea10794334f117432ed8f77d5cfb27633b5f8683f7db7

Download Submit
C:\Windows\{F52BDA7D-4E58-418d-ADFC-7B03B2431654}.exe

Filesize
197KB

MD5
9716654056e35bd9ec426acf02df866d

SHA1
8d94208ae7816ebf0bdb27fb03daa6829891190e

SHA256
b4b1bd31e0c6bc0a6d7f599a2fb8ca7bea8999c5f84b6148a8325b541edc603d

SHA512
1e323492e01a07f29238f08c0ed7fcc84b85c5324c7586e19ad8d723e5f9b503d24e5b3b31f7addbb71b96dcd439d43bff305c141eb3b1801b810c1a197fb9f5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads