b2dd5d6f21b74e2086a67341b11bf6c6b12e7e5b32727ba1f6e28cc9dae536ed

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe
Size

408KB
MD5

70b675a73947d231543c0c872fdf1d41
SHA1

c5f3b3d868c91d519af8fddf3f25d2a11f9e2a3f
SHA256

b2dd5d6f21b74e2086a67341b11bf6c6b12e7e5b32727ba1f6e28cc9dae536ed
SHA512

63afc55ce42202d4c3713139d9d4c889737ed19040dd331c109585d7675c479372eeb262791062921db5b3f96b6b2e75d5585ece79e18c957bca05ff7a53a28e
SSDEEP

3072:CEGh0ogl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGmldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d000000013a06-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003500000001415f-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000013a06-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000014175-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000013a06-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000013a06-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0011000000013a06-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}\stubpath = "C:\\Windows\\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}.exe"	{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}\stubpath = "C:\\Windows\\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe"	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{884A11AB-B9B4-4452-839D-381E38C688FF}\stubpath = "C:\\Windows\\{884A11AB-B9B4-4452-839D-381E38C688FF}.exe"	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}\stubpath = "C:\\Windows\\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe"	{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}\stubpath = "C:\\Windows\\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe"	{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}	{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{884A11AB-B9B4-4452-839D-381E38C688FF}	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{865406C4-AF29-4c4a-9582-B1031A94DAA9}	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}\stubpath = "C:\\Windows\\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe"	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94A689B1-8A02-4403-8CC7-D18424422E80}	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ABE638B3-650B-477f-80CE-2C66D35337F2}	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ABE638B3-650B-477f-80CE-2C66D35337F2}\stubpath = "C:\\Windows\\{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe"	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}\stubpath = "C:\\Windows\\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe"	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}	{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}	{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94A689B1-8A02-4403-8CC7-D18424422E80}\stubpath = "C:\\Windows\\{94A689B1-8A02-4403-8CC7-D18424422E80}.exe"	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}\stubpath = "C:\\Windows\\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe"	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{865406C4-AF29-4c4a-9582-B1031A94DAA9}\stubpath = "C:\\Windows\\{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe"	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe

Deletes itself 1 IoCs

pid	Process
1624	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe
1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
1196	{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
2872	{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe
2120	{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe
1572	{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe
File created	C:\Windows\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
File created	C:\Windows\{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
File created	C:\Windows\{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe
File created	C:\Windows\{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
File created	C:\Windows\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
File created	C:\Windows\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}.exe	{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe
File created	C:\Windows\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
File created	C:\Windows\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
File created	C:\Windows\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe	{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
File created	C:\Windows\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe	{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
Token: SeIncBasePriorityPrivilege	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
Token: SeIncBasePriorityPrivilege	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
Token: SeIncBasePriorityPrivilege	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe
Token: SeIncBasePriorityPrivilege	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
Token: SeIncBasePriorityPrivilege	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
Token: SeIncBasePriorityPrivilege	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
Token: SeIncBasePriorityPrivilege	1196	{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
Token: SeIncBasePriorityPrivilege	2872	{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe
Token: SeIncBasePriorityPrivilege	2120	{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1880	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	28
PID 2224 wrote to memory of 1880	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	28
PID 2224 wrote to memory of 1880	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	28
PID 2224 wrote to memory of 1880	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	28
PID 2224 wrote to memory of 1624	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	29
PID 2224 wrote to memory of 1624	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	29
PID 2224 wrote to memory of 1624	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	29
PID 2224 wrote to memory of 1624	2224	2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe	29
PID 1880 wrote to memory of 2540	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	30
PID 1880 wrote to memory of 2540	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	30
PID 1880 wrote to memory of 2540	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	30
PID 1880 wrote to memory of 2540	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	30
PID 1880 wrote to memory of 2516	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	31
PID 1880 wrote to memory of 2516	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	31
PID 1880 wrote to memory of 2516	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	31
PID 1880 wrote to memory of 2516	1880	{94A689B1-8A02-4403-8CC7-D18424422E80}.exe	31
PID 2540 wrote to memory of 2560	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	32
PID 2540 wrote to memory of 2560	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	32
PID 2540 wrote to memory of 2560	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	32
PID 2540 wrote to memory of 2560	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	32
PID 2540 wrote to memory of 2648	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	33
PID 2540 wrote to memory of 2648	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	33
PID 2540 wrote to memory of 2648	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	33
PID 2540 wrote to memory of 2648	2540	{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe	33
PID 2560 wrote to memory of 2144	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	36
PID 2560 wrote to memory of 2144	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	36
PID 2560 wrote to memory of 2144	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	36
PID 2560 wrote to memory of 2144	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	36
PID 2560 wrote to memory of 1604	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	37
PID 2560 wrote to memory of 1604	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	37
PID 2560 wrote to memory of 1604	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	37
PID 2560 wrote to memory of 1604	2560	{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe	37
PID 2144 wrote to memory of 1324	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	38
PID 2144 wrote to memory of 1324	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	38
PID 2144 wrote to memory of 1324	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	38
PID 2144 wrote to memory of 1324	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	38
PID 2144 wrote to memory of 2456	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	39
PID 2144 wrote to memory of 2456	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	39
PID 2144 wrote to memory of 2456	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	39
PID 2144 wrote to memory of 2456	2144	{884A11AB-B9B4-4452-839D-381E38C688FF}.exe	39
PID 1324 wrote to memory of 1452	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	40
PID 1324 wrote to memory of 1452	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	40
PID 1324 wrote to memory of 1452	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	40
PID 1324 wrote to memory of 1452	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	40
PID 1324 wrote to memory of 1516	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	41
PID 1324 wrote to memory of 1516	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	41
PID 1324 wrote to memory of 1516	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	41
PID 1324 wrote to memory of 1516	1324	{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe	41
PID 1452 wrote to memory of 2308	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	42
PID 1452 wrote to memory of 2308	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	42
PID 1452 wrote to memory of 2308	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	42
PID 1452 wrote to memory of 2308	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	42
PID 1452 wrote to memory of 2140	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	43
PID 1452 wrote to memory of 2140	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	43
PID 1452 wrote to memory of 2140	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	43
PID 1452 wrote to memory of 2140	1452	{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe	43
PID 2308 wrote to memory of 1196	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	44
PID 2308 wrote to memory of 1196	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	44
PID 2308 wrote to memory of 1196	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	44
PID 2308 wrote to memory of 1196	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	44
PID 2308 wrote to memory of 2040	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	45
PID 2308 wrote to memory of 2040	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	45
PID 2308 wrote to memory of 2040	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	45
PID 2308 wrote to memory of 2040	2308	{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_70b675a73947d231543c0c872fdf1d41_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
  C:\Windows\{94A689B1-8A02-4403-8CC7-D18424422E80}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
    C:\Windows\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
      C:\Windows\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\{884A11AB-B9B4-4452-839D-381E38C688FF}.exe
        
        C:\Windows\{884A11AB-B9B4-4452-839D-381E38C688FF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Windows\{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
        
        C:\Windows\{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
        
        C:\Windows\{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
        
        C:\Windows\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
        
        C:\Windows\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
        
        C:\Windows\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe
        
        C:\Windows\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
        
        C:\Windows\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe
        
        C:\Windows\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}.exe
        
        C:\Windows\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}.exe
        12⤵
        Executes dropped EXE
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{212D1~1.EXE > nul
        12⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C8D1A~1.EXE > nul
        11⤵
        
        PID:484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D9FD5~1.EXE > nul
        10⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E9ADD~1.EXE > nul
        9⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ABE63~1.EXE > nul
        8⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{86540~1.EXE > nul
        7⤵
        
        PID:1516
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{884A1~1.EXE > nul
        6⤵
        
        PID:2456
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2B3D4~1.EXE > nul
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E27E0~1.EXE > nul
      4⤵
      PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{94A68~1.EXE > nul
    3⤵
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{212D1457-F864-4ea4-B81F-A6CB0451E0E9}.exe

Filesize
408KB

MD5
9c7fc03140854798130f39e6edbd3e9c

SHA1
2ab2314b9ff7740eb42776e27319bed58457df4f

SHA256
cdda03d9d2e7c8679bb30a41ca7bab4dfb41b17a9062b44c02dda76e6f58781d

SHA512
d3f8efdaf4326c10cb0b00cca34bb35f5b02f06e6ee4d79317b14edaf3b1dff9f56e2495a805cbaf6b7bfec95060d96a6a87864ceed60d5f66819d80022b28db

Download Submit
C:\Windows\{2B3D4AA5-FFC2-4a84-A068-8DB162A8019F}.exe

Filesize
408KB

MD5
6c9be40eaf2a4229d93d64a781350463

SHA1
36602f5db4bfafe19af41f79037b66860fa6bb78

SHA256
b02a00e14c6449eb90444532f9198ce72b8f08ac5ec65a0476f837e3e27fab2f

SHA512
0b18e8306328286e96db5f8c910e95295bf23f29658bf2b7dab8e2c4106aba3f47005488183e118a38a060f03a544892bb0a875295515830963966358c3888c8

Download Submit
C:\Windows\{865406C4-AF29-4c4a-9582-B1031A94DAA9}.exe

Filesize
408KB

MD5
821f60a56d49ada470c625de61cc0913

SHA1
79748dc7f3afe664288c9d9355734f663d0434cd

SHA256
52968c4a608b23a91765738db77f196745f75fa85451918d7bf9585bd784abff

SHA512
49c848b5c43a746223f93e2a139b1e884d5d932929009bee97af3850b6ce765c2a26a6c770960249914162b397da20de42e325a5931efba3f9cae4b01fe64493

Download Submit
C:\Windows\{884A11AB-B9B4-4452-839D-381E38C688FF}.exe

Filesize
408KB

MD5
31c58cdc5882f46eadc6d576545203d0

SHA1
a5522cd444808e8a5767950ac2bf43233505c5d7

SHA256
0451b4e172b519d34f1b13e8bfff57b454f6f7010a2560c6faab2f382c94fe09

SHA512
08c878cd1f0a51cdd9e7be1df7091983a654a0f021bf2d39cda26a9af862b8bbe24a5a557b9bc2d704e4795446f1e9b5fcd355baa4b6df14948f5215dd2598a6

Download Submit
C:\Windows\{94A689B1-8A02-4403-8CC7-D18424422E80}.exe

Filesize
408KB

MD5
0e5ad4eacf5df609b9cba8df4c539585

SHA1
eb052793c9b6680240e2b799d8ed920b0adf904b

SHA256
1353dd54c38d6912bd899c25e1e58ce2e92090f743c7596fdb878d4a91b67876

SHA512
4cf27c196842182b99852d7630c5e7d0ce3c17f6c6c816cf7861a0fb81605405d4369e65981a172a6ab0f9e085da61de6cddfa94166802b9d92125010e0c1071

Download Submit
C:\Windows\{A8A6DA94-87F0-4abc-9F4D-006CF6D5AFBD}.exe

Filesize
408KB

MD5
3856dd57ffd92b1b2bc8466e28657897

SHA1
592ec39031d0673bec4146f354ccbacef2db6d64

SHA256
0b4bc6e2307a388214703845853867744ba6b7f0fbb66bd6ca2a47aef3c5e4a1

SHA512
9a322420a1a5600b37c33dcbfbed24e94a5bf2b65bae0127ce52bcbbff13d17d2ea060db9709e161f3de064568c25a2e7d74b0e28af7d4996668417a77635261

Download Submit
C:\Windows\{ABE638B3-650B-477f-80CE-2C66D35337F2}.exe

Filesize
408KB

MD5
32bebc20d874c8acb9fac08e3c6a5ab1

SHA1
8008b27da6fcfafc00c897a1612e562298b08cbb

SHA256
26c716b8f5195f76268c2dccdfaaad277669e02a763074388e3327acb60c5fbf

SHA512
ebd4f306726a9e64ff8784b08a6f0d20a53a74b5ea44b2e83c5c1fa662a77e7f8ff0ce867c5db0ee0bb83abb0e0c65ba8b94cbe70115b8f53f7c6328bbf98aaf

Download Submit
C:\Windows\{C8D1AD9E-C08D-4a07-B575-4F5D1EFF4A5A}.exe

Filesize
408KB

MD5
ed7196b942d75d736462293e11a21592

SHA1
35c717e39b3e17ea9d79a18779f8e6e8cd4bba41

SHA256
c3fb9b82438fb4bddefce0675ee955710685a390812d2fdd9764c209c0a7edc9

SHA512
d0dfed5ac17be608fb8c82a374bbc1ba587f6abd22930e5d5c263c70174d29aa56fad1fcce4c4d4770e0237531142cc66d2f5ee726b8e4477d289cdab571e423

Download Submit
C:\Windows\{D9FD5BF5-E6BA-48d6-A0EF-32DFB854A2AD}.exe

Filesize
408KB

MD5
a8efde0403b462750e336b29c14d6578

SHA1
49154d6995266a93f024b00cc507216c771f6bb8

SHA256
24dcd3ce1d0fb882278a045608bcf2ecd0a1b8e2458d2d247de1170f8a7b58ed

SHA512
f75f4f42cda4972845c37da84ebb57acdb46a9710455ce3109c5d4382c26a1a3394a00305d21b8039364d05711ef9388a9a155d97b90564162130b0fd92516ef

Download Submit
C:\Windows\{E27E0BB4-7AC1-42ae-BFEE-74EBE26DF3ED}.exe

Filesize
408KB

MD5
1664d9eb9ed86b9dd0633c56a2199655

SHA1
4a838f15114511d3fa98251bde005850a2b99093

SHA256
d7b8cd1b4c0bef35c8530dc28697004f8320275644ee7841d945cc6207dfc144

SHA512
052cec64643f491a7df2da98d7b5cdd3317718a097f90ae8860453790e1b03a7ccd6e85f83f897bffc0f1af1420e65c9a0640090d592f1738f178b6800956427

Download Submit
C:\Windows\{E9ADDDCD-A8DF-4931-9B85-AF9099E3844D}.exe

Filesize
408KB

MD5
ab0a6479a73060de339f4840d0133d4d

SHA1
6c74f356b1c9e99dd261880c85ea37e3609401d5

SHA256
193e67695522b12a0a2b2ab19cc09d1277df09d0c92cb20a866671d3e747e4d2

SHA512
0ab4c52c9ad5604aa27dfc1339020c220285027a15eb4850491fbe72d3d6a615462fc5d82cee6437c2894644c6bd12da6e7776ec67263fb2ca9676b3e1309ad6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads