66ecce6430c8fd9f7508764e7cf0a563dd90f16196b87d0b82c58d8437d2154c

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe
Size

168KB
MD5

56102798356784bd395cfec9fec86a57
SHA1

ad67dd0f6520b3a746f69735f95063c1269aa355
SHA256

66ecce6430c8fd9f7508764e7cf0a563dd90f16196b87d0b82c58d8437d2154c
SHA512

23d6f559e8b86dcf4bf08bb3d36cbc77cc253c3a10e420dfd37743fbcc84e20d007df1be30ed8980bf8b2ed31962a6f1431e79cd0e6cc3fc929e6b7c14fada52
SSDEEP

1536:1EGh0oglq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oglqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233e3-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023400-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00120000000234fb-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000016928-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000200000001e316-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db59-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000016928-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023508-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002350b-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000016928-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001dadb-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}\stubpath = "C:\\Windows\\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe"	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90A6F864-0CE6-4798-912B-56DBE0795604}	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4967CD56-1478-4c20-8A1B-90EC72F91E1C}\stubpath = "C:\\Windows\\{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe"	{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCF22384-C1D0-4283-8ADA-C178A756A72A}	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A092117-B468-463b-BA02-03A6D62A0AEF}	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}\stubpath = "C:\\Windows\\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe"	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBAD039E-9369-427c-B92F-0E76EBB7C328}\stubpath = "C:\\Windows\\{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe"	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFF56C79-667B-4163-8816-2C48AC65A0BC}\stubpath = "C:\\Windows\\{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe"	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0380099-AF87-46e2-8EB2-C6505B8927FB}\stubpath = "C:\\Windows\\{A0380099-AF87-46e2-8EB2-C6505B8927FB}.exe"	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A092117-B468-463b-BA02-03A6D62A0AEF}\stubpath = "C:\\Windows\\{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe"	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4967CD56-1478-4c20-8A1B-90EC72F91E1C}	{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCF22384-C1D0-4283-8ADA-C178A756A72A}\stubpath = "C:\\Windows\\{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe"	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}\stubpath = "C:\\Windows\\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe"	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90A6F864-0CE6-4798-912B-56DBE0795604}\stubpath = "C:\\Windows\\{90A6F864-0CE6-4798-912B-56DBE0795604}.exe"	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBAD039E-9369-427c-B92F-0E76EBB7C328}	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7143EEA-2752-41b7-8146-7AA913731122}	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7143EEA-2752-41b7-8146-7AA913731122}\stubpath = "C:\\Windows\\{A7143EEA-2752-41b7-8146-7AA913731122}.exe"	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33547DFD-8284-4087-8D69-8424754E1B0F}	{A7143EEA-2752-41b7-8146-7AA913731122}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33547DFD-8284-4087-8D69-8424754E1B0F}\stubpath = "C:\\Windows\\{33547DFD-8284-4087-8D69-8424754E1B0F}.exe"	{A7143EEA-2752-41b7-8146-7AA913731122}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFF56C79-667B-4163-8816-2C48AC65A0BC}	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0380099-AF87-46e2-8EB2-C6505B8927FB}	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe

Executes dropped EXE 11 IoCs

pid	Process
4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe
2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
3240	{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe
2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe
2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
828	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe
1852	{A0380099-AF87-46e2-8EB2-C6505B8927FB}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
File created	C:\Windows\{A7143EEA-2752-41b7-8146-7AA913731122}.exe	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe
File created	C:\Windows\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe
File created	C:\Windows\{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
File created	C:\Windows\{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
File created	C:\Windows\{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	{A7143EEA-2752-41b7-8146-7AA913731122}.exe
File created	C:\Windows\{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
File created	C:\Windows\{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
File created	C:\Windows\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
File created	C:\Windows\{A0380099-AF87-46e2-8EB2-C6505B8927FB}.exe	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe
File created	C:\Windows\{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe
Token: SeIncBasePriorityPrivilege	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
Token: SeIncBasePriorityPrivilege	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
Token: SeIncBasePriorityPrivilege	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
Token: SeIncBasePriorityPrivilege	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe
Token: SeIncBasePriorityPrivilege	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe
Token: SeIncBasePriorityPrivilege	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
Token: SeIncBasePriorityPrivilege	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
Token: SeIncBasePriorityPrivilege	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
Token: SeIncBasePriorityPrivilege	828	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4344	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe	91
PID 1852 wrote to memory of 4344	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe	91
PID 1852 wrote to memory of 4344	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe	91
PID 1852 wrote to memory of 1512	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe	92
PID 1852 wrote to memory of 1512	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe	92
PID 1852 wrote to memory of 1512	1852	2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe	92
PID 4344 wrote to memory of 2676	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	97
PID 4344 wrote to memory of 2676	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	97
PID 4344 wrote to memory of 2676	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	97
PID 4344 wrote to memory of 3640	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	98
PID 4344 wrote to memory of 3640	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	98
PID 4344 wrote to memory of 3640	4344	{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe	98
PID 2676 wrote to memory of 3320	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	101
PID 2676 wrote to memory of 3320	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	101
PID 2676 wrote to memory of 3320	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	101
PID 2676 wrote to memory of 1648	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	102
PID 2676 wrote to memory of 1648	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	102
PID 2676 wrote to memory of 1648	2676	{90A6F864-0CE6-4798-912B-56DBE0795604}.exe	102
PID 3320 wrote to memory of 1696	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	105
PID 3320 wrote to memory of 1696	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	105
PID 3320 wrote to memory of 1696	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	105
PID 3320 wrote to memory of 764	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	106
PID 3320 wrote to memory of 764	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	106
PID 3320 wrote to memory of 764	3320	{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe	106
PID 1696 wrote to memory of 3240	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	107
PID 1696 wrote to memory of 3240	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	107
PID 1696 wrote to memory of 3240	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	107
PID 1696 wrote to memory of 4320	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	108
PID 1696 wrote to memory of 4320	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	108
PID 1696 wrote to memory of 4320	1696	{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe	108
PID 1264 wrote to memory of 2580	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe	115
PID 1264 wrote to memory of 2580	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe	115
PID 1264 wrote to memory of 2580	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe	115
PID 1264 wrote to memory of 3856	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe	116
PID 1264 wrote to memory of 3856	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe	116
PID 1264 wrote to memory of 3856	1264	{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe	116
PID 2580 wrote to memory of 2708	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe	117
PID 2580 wrote to memory of 2708	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe	117
PID 2580 wrote to memory of 2708	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe	117
PID 2580 wrote to memory of 2396	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe	118
PID 2580 wrote to memory of 2396	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe	118
PID 2580 wrote to memory of 2396	2580	{A7143EEA-2752-41b7-8146-7AA913731122}.exe	118
PID 2708 wrote to memory of 3640	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	123
PID 2708 wrote to memory of 3640	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	123
PID 2708 wrote to memory of 3640	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	123
PID 2708 wrote to memory of 3580	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	124
PID 2708 wrote to memory of 3580	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	124
PID 2708 wrote to memory of 3580	2708	{33547DFD-8284-4087-8D69-8424754E1B0F}.exe	124
PID 3640 wrote to memory of 3588	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	125
PID 3640 wrote to memory of 3588	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	125
PID 3640 wrote to memory of 3588	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	125
PID 3640 wrote to memory of 1608	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	126
PID 3640 wrote to memory of 1608	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	126
PID 3640 wrote to memory of 1608	3640	{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe	126
PID 3588 wrote to memory of 828	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	132
PID 3588 wrote to memory of 828	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	132
PID 3588 wrote to memory of 828	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	132
PID 3588 wrote to memory of 3384	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	133
PID 3588 wrote to memory of 3384	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	133
PID 3588 wrote to memory of 3384	3588	{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe	133
PID 828 wrote to memory of 1852	828	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe	134
PID 828 wrote to memory of 1852	828	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe	134
PID 828 wrote to memory of 1852	828	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe	134
PID 828 wrote to memory of 2568	828	{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe	135

C:\Users\Admin\AppData\Local\Temp\2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_56102798356784bd395cfec9fec86a57_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe
  C:\Windows\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
    C:\Windows\{90A6F864-0CE6-4798-912B-56DBE0795604}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
      C:\Windows\{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
        
        C:\Windows\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1696
      - C:\Windows\{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe
        
        C:\Windows\{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe
        
        C:\Windows\{4967CD56-1478-4c20-8A1B-90EC72F91E1C}.exe
        7⤵
        Modifies Installed Components in the registry
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\{A7143EEA-2752-41b7-8146-7AA913731122}.exe
        
        C:\Windows\{A7143EEA-2752-41b7-8146-7AA913731122}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
        
        C:\Windows\{33547DFD-8284-4087-8D69-8424754E1B0F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
        
        C:\Windows\{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
        
        C:\Windows\{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe
        
        C:\Windows\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\{A0380099-AF87-46e2-8EB2-C6505B8927FB}.exe
        
        C:\Windows\{A0380099-AF87-46e2-8EB2-C6505B8927FB}.exe
        13⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE5F2~1.EXE > nul
        13⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EFF56~1.EXE > nul
        12⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DCF22~1.EXE > nul
        11⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{33547~1.EXE > nul
        10⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A7143~1.EXE > nul
        9⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4967C~1.EXE > nul
        8⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BBAD0~1.EXE > nul
        7⤵
        
        PID:4128
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DAEDE~1.EXE > nul
        6⤵
        
        PID:4320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8A092~1.EXE > nul
        5⤵
        
        PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{90A6F~1.EXE > nul
      4⤵
      PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0D3FF~1.EXE > nul
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0D3FFD1F-65DC-4b69-A70C-04E1B0EAAF80}.exe

Filesize
168KB

MD5
725815f9b9ee80533b3a781095826aba

SHA1
96b14f03f6072291b16f244f80a109f195e9d053

SHA256
8c5eba5a58ac05bd92d71e193f64a28652c12cf8fdcdf8d3e4da681c7a72fc02

SHA512
414e0b3e730f9ede40992dc93d1a5b5d60936e44e9356cde2ea96a0a2368e1cd42eb60b2e19f307b0e999f587d677f246501b190872e27083207c18a1090a82c

Download Submit
C:\Windows\{33547DFD-8284-4087-8D69-8424754E1B0F}.exe

Filesize
168KB

MD5
d48219e59d30cbdb1150d369e9468e0d

SHA1
2915ceb8cb0b15970a76802325ee57f613e1c00a

SHA256
6adc155bf72c0985af7aa0a4ac3d33e23c89aaa187235d353ca8a64a4a3c976a

SHA512
147914f58c43288d390329b95a59091f7b5f9301040d0d74b3342181980763204432672088192125820edec18b32a41b9dab90da2226f83edd11496e53b4c294

Download Submit
C:\Windows\{8A092117-B468-463b-BA02-03A6D62A0AEF}.exe

Filesize
168KB

MD5
451dbe3985ce9ede813a402952a152e9

SHA1
d80f27e1e4d0c52edf4d0cf290af9f726ed9416c

SHA256
20effa8bcd154eb1673328a3fc56da457c019ef74105eeb346af73c9c74279d9

SHA512
936f149bad4db3f9a5b346312d44cfdcba7dca0f890fd55f9fb1804fd1262bfa69fe63bfc7ced0ea2debf15c3173a08af20485029a8d5dec69af7943564eb3f6

Download Submit
C:\Windows\{90A6F864-0CE6-4798-912B-56DBE0795604}.exe

Filesize
168KB

MD5
60f7b1c7fce3fa2128c5302a3edd8b59

SHA1
27005e14146e6e485e4d2611f6ab9e90e0f1f6d0

SHA256
ba636e05a1ca78cbc44cafdef48ac2126d4aad0ca96fe60c285d93d397426484

SHA512
9941235ea0c6b3428fc0617ef20f543294fff8a279a7d8ef2d75cf6c4c7bcf5d0e400b7f46cc50d3c3f4d79e27b53e7ea56b389c94da21d8c02a622b83f25225

Download Submit
C:\Windows\{A0380099-AF87-46e2-8EB2-C6505B8927FB}.exe

Filesize
168KB

MD5
2b0524547db1de039eed54d85358a2f0

SHA1
f0c7e5522e52c91a7fd1f1b949147fc408114908

SHA256
da36619f0fa719ae0575bd54d9fc70937d253e599eb5649d646e4c478bc8fa21

SHA512
49ab65915feb2b4ceb804cada80f6c70f8aa79baba4ab23f5593d94fe856c3477669f4cf2d22348291fccaf196976c582abeb7ddcc884529e4a32b108585a5bc

Download Submit
C:\Windows\{A7143EEA-2752-41b7-8146-7AA913731122}.exe

Filesize
168KB

MD5
9abb72d97da8fc4e3c7b1d92548076ba

SHA1
a28868b82230fe3efd514be07cafa8adfdc7d0ab

SHA256
26542f9c254748a0bce2c8d2e51edff9bace62bc86632102357840e8c94edcbb

SHA512
439d275ed6161cc16afd8bdae3d165538c6f4b59b089c687df041bcab0c513e0aa40c1917f648a8e9c2e4895841bc87a14fbb95e67f9087d3f49fa53a94032a0

Download Submit
C:\Windows\{BBAD039E-9369-427c-B92F-0E76EBB7C328}.exe

Filesize
168KB

MD5
a2c5f9426f75b6f9e380b4fe7d65e67d

SHA1
d09901a14b6a5aa6e0798de007df945d46fab851

SHA256
659d7b378b1fbe7788cc57056917c61ece69baeaf763b564af60a97165a0ae02

SHA512
40a383407726f96f5272e0a0e7c90950859b66d5e1741c57b0aa850ebeb1b38c279e8517e8bf339ef3537ef0a32a664c31916f1491964e093cbe2867842bd33b

Download Submit
C:\Windows\{BE5F216C-C9E7-43c6-A646-CAB388ACEE73}.exe

Filesize
168KB

MD5
811ecf6cc9a3ad1bc41ea5dea5f90971

SHA1
941e93eadebcdeea4523868a57cdb676d2408e66

SHA256
8a3e16d2e7065258b53d093b9b8daf7e0137fa706b9858b3c36f131acddcbbf2

SHA512
54a02057b867371c49343a73a3e175fdf019539a864e73669e5a025aba34a6d4fbd13ee4575e8a22c07b985604f61483344aa4893b9a55e0732e386e5f80a604

Download Submit
C:\Windows\{DAEDEF42-3C75-4064-BA0F-D6C286D17D83}.exe

Filesize
168KB

MD5
1deb0681b7ecab2f378970a6fbe4273e

SHA1
44380f2c0afbe83ca69b8ab278e4b7070ae02e29

SHA256
1ba11b1d9570f8b43ef8fe353d287950f233ab75a5d18024e5594067796bc85a

SHA512
171afbb3602bea584d9cff268cd4b6b9487b33f3a1cf2a7de1705faeabd889c384fcff0c1c74e92159080ce4dce04e87692d4b8462acfa736bbb3f42a5cf81a3

Download Submit
C:\Windows\{DCF22384-C1D0-4283-8ADA-C178A756A72A}.exe

Filesize
168KB

MD5
d409484321de573a9a8487ba943f440e

SHA1
0f3771ed5a2b7687ba082aa5492df0a9535ad4ac

SHA256
1634f6ef98641cc7f25d951be83c86c75fc53a738ec42e4e94da6d245016144a

SHA512
f63857e839c0617a8867bf03383f4ea58dffdbe322638ea6a2790238602facc138ffc763722b810ebc1c65630bba6e5822134e578bec998d22dc235837ede9e8

Download Submit
C:\Windows\{EFF56C79-667B-4163-8816-2C48AC65A0BC}.exe

Filesize
168KB

MD5
37bd3a607e83e30458558bf54cfa9c61

SHA1
dc75fad38466e9852abb18dc8fd92e43093f1391

SHA256
3fa2ee4b7ab36935b3b18affa3b020a8e45a9b83f5b44b8fd4b134cd4f85e050

SHA512
a115ed1935af2ec31174b6539399741305ca47cb8e07dabf815823abb9568a535d9d84779a0ad071da742d3eeaa3bfa9b2e1ffca89099a7c8d0e8b86482b9661

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads