d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe
Size

408KB
MD5

a26f0a1827be1ecbd0cd62e8c3b6b07a
SHA1

ecf6efb8a8282fcc4546501470188ba803cdb23d
SHA256

d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50
SHA512

60a105dc5b52ce4940a945a34068cb9a66b5af3c16f36277ecfc4789062db9514c85da677f4d69650de366d8c442611c322f2c807701685438e0bff85efe9640
SSDEEP

3072:CEGh0o/l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGhldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023419-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002341a-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e743-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001200000002341a-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001e743-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002296d-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001e743-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023430-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e743-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023386-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001e743-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00060000000229c3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}	{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}\stubpath = "C:\\Windows\\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}.exe"	{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59FB7195-8D95-4ff4-B252-A891FA945AB3}	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}\stubpath = "C:\\Windows\\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe"	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44B288B9-FE6B-4654-8B6E-65609BBD4147}	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D977860-0464-47ad-BA5E-7FA8B6531D57}	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}\stubpath = "C:\\Windows\\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe"	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}\stubpath = "C:\\Windows\\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe"	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87EBE736-FC35-49b8-BBB2-2D51164BA511}	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{383D6EB8-F596-4742-A196-D2672E8A70DC}\stubpath = "C:\\Windows\\{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe"	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59FB7195-8D95-4ff4-B252-A891FA945AB3}\stubpath = "C:\\Windows\\{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe"	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}\stubpath = "C:\\Windows\\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe"	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{383D6EB8-F596-4742-A196-D2672E8A70DC}	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8269899E-691A-41ff-9AA3-90F584CF0DA2}	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8269899E-691A-41ff-9AA3-90F584CF0DA2}\stubpath = "C:\\Windows\\{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe"	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D977860-0464-47ad-BA5E-7FA8B6531D57}\stubpath = "C:\\Windows\\{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe"	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87EBE736-FC35-49b8-BBB2-2D51164BA511}\stubpath = "C:\\Windows\\{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe"	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}\stubpath = "C:\\Windows\\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe"	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44B288B9-FE6B-4654-8B6E-65609BBD4147}\stubpath = "C:\\Windows\\{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe"	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe

Executes dropped EXE 12 IoCs

pid	Process
4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
2204	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe
3808	{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe
5028	{B9F0CD23-E67A-4b10-97F6-9EC56758C607}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe
File created	C:\Windows\{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
File created	C:\Windows\{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
File created	C:\Windows\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
File created	C:\Windows\{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
File created	C:\Windows\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
File created	C:\Windows\{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
File created	C:\Windows\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
File created	C:\Windows\{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
File created	C:\Windows\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
File created	C:\Windows\{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe
File created	C:\Windows\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}.exe	{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe
Token: SeIncBasePriorityPrivilege	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
Token: SeIncBasePriorityPrivilege	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
Token: SeIncBasePriorityPrivilege	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
Token: SeIncBasePriorityPrivilege	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
Token: SeIncBasePriorityPrivilege	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
Token: SeIncBasePriorityPrivilege	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
Token: SeIncBasePriorityPrivilege	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
Token: SeIncBasePriorityPrivilege	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
Token: SeIncBasePriorityPrivilege	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
Token: SeIncBasePriorityPrivilege	2204	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe
Token: SeIncBasePriorityPrivilege	3808	{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4928	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe	97
PID 2352 wrote to memory of 4928	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe	97
PID 2352 wrote to memory of 4928	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe	97
PID 2352 wrote to memory of 3584	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe	98
PID 2352 wrote to memory of 3584	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe	98
PID 2352 wrote to memory of 3584	2352	d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe	98
PID 4928 wrote to memory of 2344	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	99
PID 4928 wrote to memory of 2344	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	99
PID 4928 wrote to memory of 2344	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	99
PID 4928 wrote to memory of 3696	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	100
PID 4928 wrote to memory of 3696	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	100
PID 4928 wrote to memory of 3696	4928	{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe	100
PID 2344 wrote to memory of 1968	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	103
PID 2344 wrote to memory of 1968	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	103
PID 2344 wrote to memory of 1968	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	103
PID 2344 wrote to memory of 4588	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	104
PID 2344 wrote to memory of 4588	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	104
PID 2344 wrote to memory of 4588	2344	{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe	104
PID 1968 wrote to memory of 1856	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	105
PID 1968 wrote to memory of 1856	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	105
PID 1968 wrote to memory of 1856	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	105
PID 1968 wrote to memory of 2428	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	106
PID 1968 wrote to memory of 2428	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	106
PID 1968 wrote to memory of 2428	1968	{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe	106
PID 1856 wrote to memory of 4280	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	107
PID 1856 wrote to memory of 4280	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	107
PID 1856 wrote to memory of 4280	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	107
PID 1856 wrote to memory of 1564	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	108
PID 1856 wrote to memory of 1564	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	108
PID 1856 wrote to memory of 1564	1856	{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe	108
PID 4280 wrote to memory of 384	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	114
PID 4280 wrote to memory of 384	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	114
PID 4280 wrote to memory of 384	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	114
PID 4280 wrote to memory of 1036	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	115
PID 4280 wrote to memory of 1036	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	115
PID 4280 wrote to memory of 1036	4280	{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe	115
PID 384 wrote to memory of 916	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	116
PID 384 wrote to memory of 916	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	116
PID 384 wrote to memory of 916	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	116
PID 384 wrote to memory of 4672	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	117
PID 384 wrote to memory of 4672	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	117
PID 384 wrote to memory of 4672	384	{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe	117
PID 916 wrote to memory of 4804	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	121
PID 916 wrote to memory of 4804	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	121
PID 916 wrote to memory of 4804	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	121
PID 916 wrote to memory of 1312	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	122
PID 916 wrote to memory of 1312	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	122
PID 916 wrote to memory of 1312	916	{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe	122
PID 4804 wrote to memory of 568	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	126
PID 4804 wrote to memory of 568	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	126
PID 4804 wrote to memory of 568	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	126
PID 4804 wrote to memory of 1280	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	127
PID 4804 wrote to memory of 1280	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	127
PID 4804 wrote to memory of 1280	4804	{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe	127
PID 568 wrote to memory of 2204	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	128
PID 568 wrote to memory of 2204	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	128
PID 568 wrote to memory of 2204	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	128
PID 568 wrote to memory of 396	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	129
PID 568 wrote to memory of 396	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	129
PID 568 wrote to memory of 396	568	{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe	129
PID 2204 wrote to memory of 3808	2204	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe	130
PID 2204 wrote to memory of 3808	2204	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe	130
PID 2204 wrote to memory of 3808	2204	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe	130
PID 2204 wrote to memory of 2020	2204	{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe	131

C:\Users\Admin\AppData\Local\Temp\d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe
"C:\Users\Admin\AppData\Local\Temp\d496819c36d895045dc62bacc4be623d9f84a9bfa8889f9bad978905c2ca7f50.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
  C:\Windows\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
    C:\Windows\{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
      C:\Windows\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
        
        C:\Windows\{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1856
      - C:\Windows\{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
        
        C:\Windows\{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
        
        C:\Windows\{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
        
        C:\Windows\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
        
        C:\Windows\{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
        
        C:\Windows\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe
        
        C:\Windows\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe
        
        C:\Windows\{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
        
        C:\Windows\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}.exe
        
        C:\Windows\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}.exe
        13⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44B28~1.EXE > nul
        13⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36F6B~1.EXE > nul
        12⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DD35B~1.EXE > nul
        11⤵
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9D977~1.EXE > nul
        10⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21B7C~1.EXE > nul
        9⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{82698~1.EXE > nul
        8⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{383D6~1.EXE > nul
        7⤵
        
        PID:1036
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87EBE~1.EXE > nul
        6⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{74A22~1.EXE > nul
        5⤵
        
        PID:2428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{59FB7~1.EXE > nul
      4⤵
      PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8D75F~1.EXE > nul
    3⤵
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D49681~1.EXE > nul
  2⤵
  PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{21B7C9EB-1828-49c1-9C59-70646C5A9CAF}.exe

Filesize
408KB

MD5
ff1b0b904f41f9f8e167f6c02ac4ad2a

SHA1
98cad6d16b27aedff81acc59093af47d1d2b6654

SHA256
4519ea3532a76e0478c3f888546fa0b27fa9cfeef903a76b2eacac8a9e5b924c

SHA512
733e6e952d02287ace1287a6df3524c5e78aeb8d003fd54700a4f8bb804557e2d946f8b7424d6012c77adde9402593f52f63735b6b3eb83061c7970ca0362939

Download Submit
C:\Windows\{36F6BA7A-AB60-4f43-8866-4500743AAFC4}.exe

Filesize
408KB

MD5
4c054c0555661ef655aa2f81e8bd11fe

SHA1
b2921a03bb6f8c70841669646f2b8b51310b1052

SHA256
12a164c99caf5bad56232dfafa35bbf4feee276f86bcada90475c4aa0c12974f

SHA512
537deda8ff4de465f4ad8f31d038b94ad147cb646b9fb7080cc4d65b1cd2e87f4bfe698b9df86b911c478a7f919f0ad99830002207f85a9d2ef184dda2902353

Download Submit
C:\Windows\{383D6EB8-F596-4742-A196-D2672E8A70DC}.exe

Filesize
408KB

MD5
5ccc2ad3b9fccd43d57e2c2f4f7f396c

SHA1
196017183a621fd5acd277d6feed082746e73b88

SHA256
b21d4185fcca8b34062e67e597d32e58be8a147a8681d445cea38c95630e89ef

SHA512
54495c52500732a1abfe14d139f1d9c3573ea4fb575f55a5ea224e87fba6ad2884a5895aa46625e7d068518d3a5bf18fcda67043df794ed842fa10a3a3362ef9

Download Submit
C:\Windows\{44B288B9-FE6B-4654-8B6E-65609BBD4147}.exe

Filesize
408KB

MD5
1b9d2d72481f9b19eb99fab95aaf69cf

SHA1
90ee34430771022ffbf497ad87c271e5098d8622

SHA256
f77e5ce4c1e6bf0b8448e26f5b0c36f4432db86cb7c5a180a2f2ca161edb17da

SHA512
4bc0505d7d34575801497ebfc0ba837f07fb066c6599a0a0ed3fa119c30fdd21bb7eb9046b15bab852415b1e22bf5648a8ed3d41d2441ae2306ea72b21145394

Download Submit
C:\Windows\{59FB7195-8D95-4ff4-B252-A891FA945AB3}.exe

Filesize
408KB

MD5
3e7dc7d0842a1da5b634f01da0e10006

SHA1
98ac21fbd642fdcc3656a26849aae5db049358f4

SHA256
c7e127dfd75b7db4b34d50a549a171ac8665c8eff4d4ad6e0d1509cfb5c9e315

SHA512
994fbbb6e83cf1d1ff8e065103c767745b6175b952bd1e3b6965c870780760042fd88a7ab62d47ef1f82f21ead0fde5124a1092fc3103018739d24b0fda2f6fa

Download Submit
C:\Windows\{74A2271E-C3C9-4a1c-A1EF-A68172A20945}.exe

Filesize
408KB

MD5
b53267b1cb0b2eed1fb529cdf7277dd4

SHA1
3262cd52d559cbf5b7144f10a88b95d16c273153

SHA256
025d8fddc9833676c61934df1a9a0671e9f1040465134f1ff46ac43a6d1c47a1

SHA512
23e07d960b788c1706ed1052f6fa55fd298a33765f574522fb6ef1c0696b993626ac9b4c121a78ecc7032c104bf00510d3b321d33c8c70791eafb2151ae5a440

Download Submit
C:\Windows\{8269899E-691A-41ff-9AA3-90F584CF0DA2}.exe

Filesize
408KB

MD5
af8d4c4cfd3e6ec0603790eedab7825f

SHA1
c23037a4318884816c3ffc8754f1528b9f6d6d5d

SHA256
aa99ffc7253bda7c5a8fecf2a9224adda155b0ffffe7de51bb96d652b3472301

SHA512
481a41bc90b057315de76ed2f9304ff600462d24d97c8eecde0fb0e5444c231beb079e3d46e40393bbbbe6becb42a824114d8ed4c93db6fd72d586fa60754230

Download Submit
C:\Windows\{87EBE736-FC35-49b8-BBB2-2D51164BA511}.exe

Filesize
408KB

MD5
2647baac7cd1d7c886f629ca57b47e1c

SHA1
f2b8d8001b2d890d63abc2b40b4c9aa29debb612

SHA256
460f9e550f196dc500b17231620ce94d2429c3dfac29422e23fb30e63356d508

SHA512
704e030bb4b55c671e2dc4de98d71f68f5a4724d67b2c23277e09d828936ed03e3a954e03817c73d3c9ef0e5838a15444b66568ae29e7c67ec746754af5530ec

Download Submit
C:\Windows\{8D75FC72-089E-4b93-91A3-0C6F1F273B38}.exe

Filesize
408KB

MD5
77ce08ec27919d717e940a03356b4299

SHA1
6bc792d477d48c7ccf4738b0562761f241fc6570

SHA256
ec2ff3a8d4a93738a3b0d26f58fffe1e71e3cc12eedd359a35a9e3f297bafc80

SHA512
7bc54e213e210376dfb9b11b0833bb4e6621eed8fdc0300b611170fe735156095ced69b7c364edba01e252b53f6ee1a30462e63ef9555b5df4d896d4d20c2ad4

Download Submit
C:\Windows\{9D977860-0464-47ad-BA5E-7FA8B6531D57}.exe

Filesize
408KB

MD5
594b55522c33f2ab5c0e142d022ddc33

SHA1
f77bdbcfce3850a3f8a223ab1cd052d02904777a

SHA256
eb8605f76dfb4f7e72e1fe16acd87d091e2c8a7ccd1a51bdfeb562b950b61886

SHA512
1ff8b999d1d1fac6ab98b54fcc85fd47160751729b5dd34263be7013093c56b7c974a3891d6aaadf2aca52fff335909ca9efc36fc51a5bdd31eaa1e9cbc6f7f9

Download Submit
C:\Windows\{B9F0CD23-E67A-4b10-97F6-9EC56758C607}.exe

Filesize
408KB

MD5
720793081e02e94784d6efb83dc9b180

SHA1
7738f08ac0a8896e761e86df11c991636891e645

SHA256
f8566b2930221e72760cf7e1167f32d352933f1b55e13e090643a72d6f4ef71f

SHA512
46b81b82a99f6ad1bffeabf75e4aa269e5601199e614b0713868a7c2ca39458aa89df09a6839d5bcaf05d165f5d63278e92b20f9c48abc5a9526020595b9a548

Download Submit
C:\Windows\{DD35B066-4B38-4c0c-B6C4-5CBE752C53C9}.exe

Filesize
408KB

MD5
d23ba055df5e5f8ff42ff66e948e5df6

SHA1
601044fe32f826a36685facd058cc13c3ba39842

SHA256
b2e862a71c389a3365c474807e6c8db2f941f2b2372212f63d75ce4fcb17b64c

SHA512
6a164329d2d9403f26f332b21fbf27d90a1348e8f0d5efb194caf65292f980f9662e9b01673c1be51a72d6fe3d23aa5de0dba62116267263cfe012a32a376631

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads