36da128880df1c37181a530540ac4581d91f36b098a2b3acea35379fde97a2b6

Analysis

max time kernel
113s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe
Size

180KB
MD5

e0d185765837693bdf413b5fbbe57e34
SHA1

5062ff44580e08c15d52a895ade64f9a3def743f
SHA256

36da128880df1c37181a530540ac4581d91f36b098a2b3acea35379fde97a2b6
SHA512

73163ee14c95c677594cb58161191114baf18b5012f4c0d7ab8f57af1de088d0472a8129b220ddb619b1624f1952bbc14efcc54c0062321327bebfac6e50516a
SSDEEP

3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGhl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 10 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012241-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015a2d-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015a2d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0011000000015c52-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015c69-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0012000000015c52-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015c69-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0013000000015c52-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015c69-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}\stubpath = "C:\\Windows\\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe"	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5804C7A7-3CC4-4478-A547-C16FD558590F}\stubpath = "C:\\Windows\\{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe"	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}\stubpath = "C:\\Windows\\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe"	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}\stubpath = "C:\\Windows\\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe"	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}\stubpath = "C:\\Windows\\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe"	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}	{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}\stubpath = "C:\\Windows\\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}.exe"	{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}\stubpath = "C:\\Windows\\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe"	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}\stubpath = "C:\\Windows\\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe"	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5804C7A7-3CC4-4478-A547-C16FD558590F}	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}\stubpath = "C:\\Windows\\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe"	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe

Deletes itself 1 IoCs

pid	Process
2968	cmd.exe

Executes dropped EXE 9 IoCs

pid	Process
2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe
2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
1420	{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe
2976	{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}.exe	{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe
File created	C:\Windows\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
File created	C:\Windows\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
File created	C:\Windows\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
File created	C:\Windows\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
File created	C:\Windows\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
File created	C:\Windows\{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe
File created	C:\Windows\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
File created	C:\Windows\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
Token: SeIncBasePriorityPrivilege	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe
Token: SeIncBasePriorityPrivilege	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
Token: SeIncBasePriorityPrivilege	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
Token: SeIncBasePriorityPrivilege	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
Token: SeIncBasePriorityPrivilege	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
Token: SeIncBasePriorityPrivilege	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
Token: SeIncBasePriorityPrivilege	1420	{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2056	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	28
PID 1280 wrote to memory of 2056	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	28
PID 1280 wrote to memory of 2056	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	28
PID 1280 wrote to memory of 2056	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	28
PID 1280 wrote to memory of 2968	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	29
PID 1280 wrote to memory of 2968	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	29
PID 1280 wrote to memory of 2968	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	29
PID 1280 wrote to memory of 2968	1280	2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe	29
PID 2056 wrote to memory of 2796	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	30
PID 2056 wrote to memory of 2796	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	30
PID 2056 wrote to memory of 2796	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	30
PID 2056 wrote to memory of 2796	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	30
PID 2056 wrote to memory of 2516	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	31
PID 2056 wrote to memory of 2516	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	31
PID 2056 wrote to memory of 2516	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	31
PID 2056 wrote to memory of 2516	2056	{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe	31
PID 2796 wrote to memory of 2432	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	34
PID 2796 wrote to memory of 2432	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	34
PID 2796 wrote to memory of 2432	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	34
PID 2796 wrote to memory of 2432	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	34
PID 2796 wrote to memory of 2336	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	35
PID 2796 wrote to memory of 2336	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	35
PID 2796 wrote to memory of 2336	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	35
PID 2796 wrote to memory of 2336	2796	{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe	35
PID 2432 wrote to memory of 2036	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	36
PID 2432 wrote to memory of 2036	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	36
PID 2432 wrote to memory of 2036	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	36
PID 2432 wrote to memory of 2036	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	36
PID 2432 wrote to memory of 268	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	37
PID 2432 wrote to memory of 268	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	37
PID 2432 wrote to memory of 268	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	37
PID 2432 wrote to memory of 268	2432	{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe	37
PID 2036 wrote to memory of 888	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	38
PID 2036 wrote to memory of 888	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	38
PID 2036 wrote to memory of 888	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	38
PID 2036 wrote to memory of 888	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	38
PID 2036 wrote to memory of 2688	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	39
PID 2036 wrote to memory of 2688	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	39
PID 2036 wrote to memory of 2688	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	39
PID 2036 wrote to memory of 2688	2036	{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe	39
PID 888 wrote to memory of 2776	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	40
PID 888 wrote to memory of 2776	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	40
PID 888 wrote to memory of 2776	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	40
PID 888 wrote to memory of 2776	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	40
PID 888 wrote to memory of 528	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	41
PID 888 wrote to memory of 528	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	41
PID 888 wrote to memory of 528	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	41
PID 888 wrote to memory of 528	888	{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe	41
PID 2776 wrote to memory of 1644	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	42
PID 2776 wrote to memory of 1644	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	42
PID 2776 wrote to memory of 1644	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	42
PID 2776 wrote to memory of 1644	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	42
PID 2776 wrote to memory of 1100	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	43
PID 2776 wrote to memory of 1100	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	43
PID 2776 wrote to memory of 1100	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	43
PID 2776 wrote to memory of 1100	2776	{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe	43
PID 1644 wrote to memory of 1420	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	44
PID 1644 wrote to memory of 1420	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	44
PID 1644 wrote to memory of 1420	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	44
PID 1644 wrote to memory of 1420	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	44
PID 1644 wrote to memory of 2676	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	45
PID 1644 wrote to memory of 2676	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	45
PID 1644 wrote to memory of 2676	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	45
PID 1644 wrote to memory of 2676	1644	{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_e0d185765837693bdf413b5fbbe57e34_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
  C:\Windows\{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe
    C:\Windows\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
      C:\Windows\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
        
        C:\Windows\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Windows\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
        
        C:\Windows\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
        
        C:\Windows\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
        
        C:\Windows\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe
        
        C:\Windows\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
        
        C:\Windows\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}.exe
        
        C:\Windows\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}.exe
        10⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\{4602D2D3-3890-4b53-B244-A96505C14B58}.exe
        
        C:\Windows\{4602D2D3-3890-4b53-B244-A96505C14B58}.exe
        11⤵
        
        PID:2096
        
        C:\Windows\{5B3E2414-977C-471f-90DF-7A6A96260C22}.exe
        
        C:\Windows\{5B3E2414-977C-471f-90DF-7A6A96260C22}.exe
        12⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4602D~1.EXE > nul
        12⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{63059~1.EXE > nul
        11⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F1AF~1.EXE > nul
        10⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AA968~1.EXE > nul
        9⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB744~1.EXE > nul
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1EB16~1.EXE > nul
        7⤵
        
        PID:528
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2E9C3~1.EXE > nul
        6⤵
        
        PID:2688
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CA24~1.EXE > nul
        5⤵
        
        PID:268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{86B78~1.EXE > nul
      4⤵
      PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5804C~1.EXE > nul
    3⤵
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1EB169CE-7829-44f4-BDFD-BFBE0B9AA28F}.exe

Filesize
180KB

MD5
67ba411e20ffda4b86d4e2859f2582c1

SHA1
ed19315018dd3211d56355e2f131bfbe6c138616

SHA256
f7e8b7f918195e29ac54bdc6f4aae606062dbb63d25502181362166a75094884

SHA512
dfe11e813002eb49ed8034dcc5ef00ab0e01803228196cac34aecee35178f98522bdbd0660b5a9bd1303467c7b5ccd52d7c3010d0429c31dceecdbcb9c7a2418

Download Submit
C:\Windows\{2E9C3F8A-D169-465c-8E3B-D748E7B85649}.exe

Filesize
180KB

MD5
a7ebe8fc9d20080106ab58cda1c140d7

SHA1
df42c48818c484e92b5807207b791d72915210cb

SHA256
65c30d1959de371ab4511e576c425dafc1726153443f601a54ee0cc7628b0675

SHA512
557b5778ebdff4f3be2805b23ebdbae880330fc917e673c88ae72b3e25189c47e2127f3cfdc769543a323dff5ac4a9aff66dcf18dc391d8d128b1d0b6a4c59ec

Download Submit
C:\Windows\{4602D2D3-3890-4b53-B244-A96505C14B58}.exe

Filesize
180KB

MD5
c282d0fa888b4bf19d0f84b4c94fc240

SHA1
a76b36b84aa8d77a09e7703210f79f16d13036de

SHA256
565c5cf6978e93b115896311fd1d09bf295ea941cee8bf0ff0ba3994a0132a92

SHA512
8a4fb91d3775be7888623c0aab46e7b222b162fc50bb67e73d27dfcaa744544a648bc3de69761dbb04245fe220d7784cf4ab8ff0ae407e6c8d928bb7d7530cd3

Download Submit
C:\Windows\{5804C7A7-3CC4-4478-A547-C16FD558590F}.exe

Filesize
180KB

MD5
ce50516fcf3571b46e607df4090dcc19

SHA1
591e55573d740d0e30ad42dbb2a2791dc119383f

SHA256
1aad606732c184029e138d6b95e8e47c9001eb7091752164ab81737e86ab71c6

SHA512
0b7ef6518af909206b890fa88c655fa964b0bc485caa7700aebc1ee077569fbc83ff8266e6194df4fcaf656f5165a9772d5fcf0be0a65c393eaf34ec12c87575

Download Submit
C:\Windows\{5B3E2414-977C-471f-90DF-7A6A96260C22}.exe

Filesize
49KB

MD5
da5a7cb5f32d28ef021a051b8f8fc35c

SHA1
d127c2e428a7494e9ff52af264ad6021e3351ff7

SHA256
2ec3f36f6a4f15c0445c9c4bb7268ff6a6c029c23b0f6ccd0a75288fc4e8b63e

SHA512
bc5c1dd38b9454feb0666794e5b5ec26e0bfce20bf9f678f6c6de837ac468999b8033173ed1ce4b8f4b2af4de958e1cb5595a929e7564c2f3bb9b1e27074a6c6

Download Submit
C:\Windows\{63059E0E-D3ED-4d23-A64D-6AAD3AD9DE2B}.exe

Filesize
180KB

MD5
fba03c8628a6b4c19ddd9c68f687b064

SHA1
2f00f30ec0820eb757e3ed9d927baa55d37ebec8

SHA256
491a75daaaf857d6aed323b24d27890c3a256f72c4422f6323a710057c368f7d

SHA512
b9f80fa4b16fc49583e5ac4987a23a0a3ae69709ba0e64df6ab0dd8229d8c42d77928b42c499cd6dfce4949fc4ce2a4296c9c4bb959acbf332cc35daa4ea55a0

Download Submit
C:\Windows\{6CA2456D-1F1D-4e1c-9643-11C5280ABD60}.exe

Filesize
180KB

MD5
118e82b94b50b4cef71f0a9e6a17e04d

SHA1
a10a38d4599fa902b835889b8b951f836aca248b

SHA256
9cf24f79d5aec7d5048e18142166ba93c5fab420b69d4002a57b80ec94c27176

SHA512
7983c08abd8feb60405700dffb0afb57ba8ad781ea884f6c6c38853d395ad6e0c164f1d4d3a4d5dded50051199f97899dcf59dbe7be7b7d25f06107c4488e544

Download Submit
C:\Windows\{6F1AF9C5-8FB3-43dc-9EF8-52E40C14E77C}.exe

Filesize
180KB

MD5
24ac176921b858d606e529d4d1b2c09e

SHA1
d20ebb877094b1b42b2786e2fc91aeeead341cba

SHA256
e0e2142625a4f3eea26a3e28c23da8e08842da6c1c3a3fcf03d18bedef44b5fe

SHA512
d5e278f90a50bdf450327c392b710121ed60f49b33d7ba3fd286608a56d0c21b43a7b400c709cef2f9ab2565a4ca5d9ba20a41a79e5f6bf7efea54cdb9ed9e2a

Download Submit
C:\Windows\{86B78F01-2427-49f3-83EB-12C8C88AF1AA}.exe

Filesize
180KB

MD5
9de13a6684470118f2b82aa907cf2d57

SHA1
5b6c99b8914d5391ae8e702144b7edf2186d8b16

SHA256
4511be61a3106616fbd3484cbb79bf200ba5392948ec2df88bdd06178d89c7d4

SHA512
ac36f5c366c13f1032979dfb7c993947e2b24f8ac05687598fd9b5f2875b1e435e16c06f20b96fcf416850353fc3be1502bae1d2185ba68920fd68285ca93919

Download Submit
C:\Windows\{AA9681B5-2069-4133-84A5-D0ECE97BE2D3}.exe

Filesize
180KB

MD5
b9bc8a3034827a806b9b4e1df3442219

SHA1
6043561d0bb8669d31b53caa610673f1affb48fc

SHA256
81e42056bdaa5f5dee48226678353d5826ed4ce5d0fd2c1fd5807da44a072ae5

SHA512
671b5d0b1d19ccadb26d52aa952de1c73759b4e8f912eec1a604901503782e37548284c16b41323268a3ef513eb2dcac12fbaa8987e5d19c772368213e4441d1

Download Submit
C:\Windows\{FB7442C1-C0FA-431a-B5B4-6DAE959ECA1E}.exe

Filesize
180KB

MD5
a681591c38fd9826a1a4698c62b7d236

SHA1
4639b9193daace3aa75195ba978e5a7a902fe58d

SHA256
f9d837b1f5a9c77dc42d6845f7903317815ee0a963f708192d56d88499470cce

SHA512
12ba8b7e09a13a119f233556b808ba8b634d669e80a006206e207cba6ff055789f8467ba71cec99c29177e2616eaa964e5bd0baeb2a59b8622df5425fe47ee99

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads