2051bf44b77acc743fd6fc549f1b0f6f2952c9e3a360c80da69d0b18783d6941

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe
Size

204KB
MD5

7a70b99fe20d130f1ccc62feaaa5974d
SHA1

069553aeabc474e1023ecb214f9d4a6c4403710c
SHA256

2051bf44b77acc743fd6fc549f1b0f6f2952c9e3a360c80da69d0b18783d6941
SHA512

bf31847c9114ce130af1530b50bd4758ab4aad371f29572a0522203fbe7d55f32822e63880efb463fe155d3273c4ffedfe00cb844bb020c3cfb45717efd186bd
SSDEEP

1536:1EGh0oll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oll1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012254-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014b27-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012254-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002e00000001508a-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012254-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012254-53.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012254-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C79C5665-4BD7-415a-9033-31D51C65AAB8}\stubpath = "C:\\Windows\\{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe"	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BE8913A-9823-4760-95DB-E6D30785F058}\stubpath = "C:\\Windows\\{9BE8913A-9823-4760-95DB-E6D30785F058}.exe"	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEF25473-5F06-4528-8801-35AFF019267B}	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{742809BA-37BE-4192-A5EA-D28963A65E82}\stubpath = "C:\\Windows\\{742809BA-37BE-4192-A5EA-D28963A65E82}.exe"	{7591082D-221D-4147-95F1-4761692BE8E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}\stubpath = "C:\\Windows\\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe"	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}\stubpath = "C:\\Windows\\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe"	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}\stubpath = "C:\\Windows\\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe"	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7591082D-221D-4147-95F1-4761692BE8E1}	{DEF25473-5F06-4528-8801-35AFF019267B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A625561-3BEC-4926-851D-D8EFFDD41841}	{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C79C5665-4BD7-415a-9033-31D51C65AAB8}	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEF25473-5F06-4528-8801-35AFF019267B}\stubpath = "C:\\Windows\\{DEF25473-5F06-4528-8801-35AFF019267B}.exe"	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{742809BA-37BE-4192-A5EA-D28963A65E82}	{7591082D-221D-4147-95F1-4761692BE8E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}	{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}\stubpath = "C:\\Windows\\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe"	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BE8913A-9823-4760-95DB-E6D30785F058}	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7591082D-221D-4147-95F1-4761692BE8E1}\stubpath = "C:\\Windows\\{7591082D-221D-4147-95F1-4761692BE8E1}.exe"	{DEF25473-5F06-4528-8801-35AFF019267B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}\stubpath = "C:\\Windows\\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe"	{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A625561-3BEC-4926-851D-D8EFFDD41841}\stubpath = "C:\\Windows\\{6A625561-3BEC-4926-851D-D8EFFDD41841}.exe"	{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe

Deletes itself 1 IoCs

pid	Process
2588	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe
1172	{7591082D-221D-4147-95F1-4761692BE8E1}.exe
2104	{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
2124	{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe
1504	{6A625561-3BEC-4926-851D-D8EFFDD41841}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe
File created	C:\Windows\{DEF25473-5F06-4528-8801-35AFF019267B}.exe	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
File created	C:\Windows\{7591082D-221D-4147-95F1-4761692BE8E1}.exe	{DEF25473-5F06-4528-8801-35AFF019267B}.exe
File created	C:\Windows\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe	{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
File created	C:\Windows\{6A625561-3BEC-4926-851D-D8EFFDD41841}.exe	{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe
File created	C:\Windows\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
File created	C:\Windows\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
File created	C:\Windows\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
File created	C:\Windows\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
File created	C:\Windows\{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
File created	C:\Windows\{742809BA-37BE-4192-A5EA-D28963A65E82}.exe	{7591082D-221D-4147-95F1-4761692BE8E1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
Token: SeIncBasePriorityPrivilege	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
Token: SeIncBasePriorityPrivilege	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
Token: SeIncBasePriorityPrivilege	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
Token: SeIncBasePriorityPrivilege	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
Token: SeIncBasePriorityPrivilege	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
Token: SeIncBasePriorityPrivilege	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe
Token: SeIncBasePriorityPrivilege	1172	{7591082D-221D-4147-95F1-4761692BE8E1}.exe
Token: SeIncBasePriorityPrivilege	2104	{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
Token: SeIncBasePriorityPrivilege	2124	{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2632	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	28
PID 1976 wrote to memory of 2632	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	28
PID 1976 wrote to memory of 2632	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	28
PID 1976 wrote to memory of 2632	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	28
PID 1976 wrote to memory of 2588	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	29
PID 1976 wrote to memory of 2588	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	29
PID 1976 wrote to memory of 2588	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	29
PID 1976 wrote to memory of 2588	1976	2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe	29
PID 2632 wrote to memory of 2108	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	30
PID 2632 wrote to memory of 2108	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	30
PID 2632 wrote to memory of 2108	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	30
PID 2632 wrote to memory of 2108	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	30
PID 2632 wrote to memory of 2452	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	31
PID 2632 wrote to memory of 2452	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	31
PID 2632 wrote to memory of 2452	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	31
PID 2632 wrote to memory of 2452	2632	{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe	31
PID 2108 wrote to memory of 2472	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	32
PID 2108 wrote to memory of 2472	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	32
PID 2108 wrote to memory of 2472	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	32
PID 2108 wrote to memory of 2472	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	32
PID 2108 wrote to memory of 2580	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	33
PID 2108 wrote to memory of 2580	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	33
PID 2108 wrote to memory of 2580	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	33
PID 2108 wrote to memory of 2580	2108	{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe	33
PID 2472 wrote to memory of 1716	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	36
PID 2472 wrote to memory of 1716	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	36
PID 2472 wrote to memory of 1716	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	36
PID 2472 wrote to memory of 1716	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	36
PID 2472 wrote to memory of 1640	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	37
PID 2472 wrote to memory of 1640	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	37
PID 2472 wrote to memory of 1640	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	37
PID 2472 wrote to memory of 1640	2472	{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe	37
PID 1716 wrote to memory of 2912	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	38
PID 1716 wrote to memory of 2912	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	38
PID 1716 wrote to memory of 2912	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	38
PID 1716 wrote to memory of 2912	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	38
PID 1716 wrote to memory of 3040	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	39
PID 1716 wrote to memory of 3040	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	39
PID 1716 wrote to memory of 3040	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	39
PID 1716 wrote to memory of 3040	1716	{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe	39
PID 2912 wrote to memory of 1676	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	40
PID 2912 wrote to memory of 1676	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	40
PID 2912 wrote to memory of 1676	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	40
PID 2912 wrote to memory of 1676	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	40
PID 2912 wrote to memory of 2684	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	41
PID 2912 wrote to memory of 2684	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	41
PID 2912 wrote to memory of 2684	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	41
PID 2912 wrote to memory of 2684	2912	{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe	41
PID 1676 wrote to memory of 612	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	42
PID 1676 wrote to memory of 612	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	42
PID 1676 wrote to memory of 612	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	42
PID 1676 wrote to memory of 612	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	42
PID 1676 wrote to memory of 2688	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	43
PID 1676 wrote to memory of 2688	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	43
PID 1676 wrote to memory of 2688	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	43
PID 1676 wrote to memory of 2688	1676	{9BE8913A-9823-4760-95DB-E6D30785F058}.exe	43
PID 612 wrote to memory of 1172	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	44
PID 612 wrote to memory of 1172	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	44
PID 612 wrote to memory of 1172	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	44
PID 612 wrote to memory of 1172	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	44
PID 612 wrote to memory of 2064	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	45
PID 612 wrote to memory of 2064	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	45
PID 612 wrote to memory of 2064	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	45
PID 612 wrote to memory of 2064	612	{DEF25473-5F06-4528-8801-35AFF019267B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_7a70b99fe20d130f1ccc62feaaa5974d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
  C:\Windows\{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
    C:\Windows\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
      C:\Windows\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Windows\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
        
        C:\Windows\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1716
      - C:\Windows\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
        
        C:\Windows\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
        
        C:\Windows\{9BE8913A-9823-4760-95DB-E6D30785F058}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\{DEF25473-5F06-4528-8801-35AFF019267B}.exe
        
        C:\Windows\{DEF25473-5F06-4528-8801-35AFF019267B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\{7591082D-221D-4147-95F1-4761692BE8E1}.exe
        
        C:\Windows\{7591082D-221D-4147-95F1-4761692BE8E1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
        
        C:\Windows\{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
        
        C:\Windows\{742809BA-37BE-4192-A5EA-D28963A65E82}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe
        
        C:\Windows\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
        
        C:\Windows\{6A625561-3BEC-4926-851D-D8EFFDD41841}.exe
        
        C:\Windows\{6A625561-3BEC-4926-851D-D8EFFDD41841}.exe
        12⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9CA0D~1.EXE > nul
        12⤵
        
        PID:712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{74280~1.EXE > nul
        11⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75910~1.EXE > nul
        10⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DEF25~1.EXE > nul
        9⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9BE89~1.EXE > nul
        8⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9AA9D~1.EXE > nul
        7⤵
        
        PID:2684
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{866F8~1.EXE > nul
        6⤵
        
        PID:3040
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9961~1.EXE > nul
        5⤵
        
        PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0BC97~1.EXE > nul
      4⤵
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C79C5~1.EXE > nul
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0BC9720E-4504-472b-AF9F-2D27A5F275ED}.exe

Filesize
204KB

MD5
219afe2a6eb11c9a264edc6b65f04b65

SHA1
c4b815c11e6ded3e8207cafb34eaa14138f55bbc

SHA256
8d85b45153579837136ad893e2776b635b07d371cb0a54ad2aba239d8728ea66

SHA512
18522b1e6104f91ac262b825535a7177b9fdc7a82b2be009337496dbb580bb6eaeaa4d50417cdec0604da9ac0595cc971ec65a84638d01546d248bfe1fe27ba6

Download Submit
C:\Windows\{6A625561-3BEC-4926-851D-D8EFFDD41841}.exe

Filesize
204KB

MD5
ba7503e1eb0aaf5672755e7c51a5b82e

SHA1
fd7bc5669f9e71054c62791a3c6ca98be7f795ca

SHA256
baa103d7809d181b8fdf6d2ff41a06420ca386ae3bb9da40708252e04ee543d3

SHA512
68b50ffa7a07ff5409027007f63fb22ab5a1914fb47bd3b1597800267925b849f833da3e0831d85fbe5f37cae9ed2edc0b37e73ab3d9c12fe778b27c33d3129a

Download Submit
C:\Windows\{742809BA-37BE-4192-A5EA-D28963A65E82}.exe

Filesize
204KB

MD5
4b539d750f7441b5a26d08424aae777d

SHA1
aa07677ec95b842d63effc07cae27dd8c2d78a9f

SHA256
9eabdbd929c27023e3ca9c6db59a35780d8e55e86a82d2022a9b779a1951e43d

SHA512
61fc0b797ac2ef03cc47528307f4beea703fd144947daa3cf1290a57c5281a220ce55cc99aa358fbac728515f877c6056e9f50720c593ab92b1f8774f1cd0d4b

Download Submit
C:\Windows\{7591082D-221D-4147-95F1-4761692BE8E1}.exe

Filesize
204KB

MD5
0af420fba86d2577f1330b7b851e5c71

SHA1
095fe7d019834f747f72d8eeae5174aba3351271

SHA256
8bdb0dddd96bf4f18002ce4cb3c40aa25cc07809559ccdb4efc8058188742cee

SHA512
16e97a8d111805afc65ba4661fe66aec0caa3f2e468099cfd9d8963e38cdcbffa71064165541716e1339513a1c0035a8751eb80deaf8971429cdfa708cf73878

Download Submit
C:\Windows\{866F8DC7-FCC4-44b4-9982-3B71CDED14D7}.exe

Filesize
204KB

MD5
425b50af0803a5b315ce60785417e68d

SHA1
e15ce1040d17772940b1fe1e03f371a437eb4f22

SHA256
cdb91b008224a1e003866fa974cc6ea9455dc4045e90306cb64b40f4f4a6927a

SHA512
792fcd0c3a7ba344d3196ab81b7294a002cc26b967a63955bd2e443d6134ca1381bf6a8db583e6f498b66b5bda66e7a7a9ef8798d8aeefc8e14fba3c57c60f59

Download Submit
C:\Windows\{9AA9D3DD-4AA1-4c64-AC4B-B2FEC50DAF36}.exe

Filesize
204KB

MD5
95062fb20ca3ce2f75191dde1b6cba32

SHA1
41a566efb21cb03f7209faf08d3ac29a69e66962

SHA256
9b7752e21a299d8306f1d2b633e2fda26eb63525357f8021ce264d3410ed64e8

SHA512
95ff3802924c40606914150f522a5b627fcd38d6ac6caa19dbe161864cc1dee5e0264fec651b17e6d0b9de2a59f5ace5f1bf29382330a69e7206abe5b8164607

Download Submit
C:\Windows\{9BE8913A-9823-4760-95DB-E6D30785F058}.exe

Filesize
204KB

MD5
2032eb4fb40b77285db6133a61a45155

SHA1
80f170b74746cad922cd6c9af274c7717c87302d

SHA256
8e478e6a2e1fa075bf0b3d4862af8fadef13060afbfd99ad28c486343a4b00e1

SHA512
abd21074fe3809c0fb9211c81333964d07860f13d321c9668e3dfff998ba0d31848e417b8c5624d3237c4d3185d9a03308226a69752c24ec4a4d93028f34066d

Download Submit
C:\Windows\{9CA0D8E4-B882-47f0-BC6F-F2196A114606}.exe

Filesize
204KB

MD5
cacc0d61379a1d7351f069a43429d836

SHA1
8bc107a7c051a88687e9a5688b64fefdc1c3a075

SHA256
6f16c9d3041421048c8a911abd960cc33df32c3f7f13189182fcde97342e3055

SHA512
72366d5b70c10699dfb37e295e015eef9c215e19b757c81576e7a33d48348bc308a1ac04bdc369c5c5482bcb1fbc4970f19418aff0c9290f21f223c46333b7bd

Download Submit
C:\Windows\{C79C5665-4BD7-415a-9033-31D51C65AAB8}.exe

Filesize
204KB

MD5
b88604d4949b2833db8c5b9caf603bcb

SHA1
d80c565b621bd78a90dd0ee95f3e4660f2ff0df7

SHA256
c61ba03c13c0c6b39049d20b9132515143e637d22b34678894dd6d1bda993af0

SHA512
103cf9d8e2677a0de59c4d89601d8b4c8c675e21909ed8a9c01d0c69a37f5c1b25bbf25c1c2cc55efcc9feb253d17c361808ec7c9d98cb9befcee8e3e8afbdfa

Download Submit
C:\Windows\{C9961B4F-A0B2-4859-A152-5A58ED6CC995}.exe

Filesize
204KB

MD5
4616f237d5cedaa64054a8b2ceb0646c

SHA1
f2b4a21d78543235beec719a77540c8e9f4df6cc

SHA256
9b9fffb9b7d52348879367ebcc2842fe17c3708885dc006869c8d3b0f655d9d1

SHA512
1b3fe8307feb13091248308256ece36155b48cf2ba2cab7c0a5b85f09c2ee1afcf590d122a6282db8c52b001e78e5c88cb1b11d8b62ba1c03c3240992f8401e1

Download Submit
C:\Windows\{DEF25473-5F06-4528-8801-35AFF019267B}.exe

Filesize
204KB

MD5
dfa0a96a981b9795ec990e47bfd2da8e

SHA1
e486d37c70c989e6b4c3cd99e6ccd8fdcfe88647

SHA256
794ace9a6037c3a199bc7c7c2c8ecc29be3b09f8337a80c4c28648f1e6768458

SHA512
b23b7848e8406dcec8634f2a184cd42e17bbec4f941a4d81e9f62298c2ac5e139d3dd7109376a425f25ac2c1a984eb3cfd2fdffd4f38e5bfe7e55cf112733a29

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads