c98ac18bb2d4f638ebc2bf4bd3409294a3169d87050fc38a70a126451422dc46

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe
Size

344KB
MD5

34b2bb095275220b2aa79c0b5d9a5018
SHA1

cce663ac649d7787d19196e64f241617d64f0fdd
SHA256

c98ac18bb2d4f638ebc2bf4bd3409294a3169d87050fc38a70a126451422dc46
SHA512

799735cf88ec649b26417c474e2574e98068248ca29461d0922aab00b18b02ecf7dce7138ae603aaa6403ad5231fc5eb0c91ac08030552357812dba4d763fef3
SSDEEP

3072:mEGh0oolEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGKlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x00090000000122be-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015c4c-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000015cb0-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000015cbd-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0034000000015cbd-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000015cce-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000015cbd-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000015d0c-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015cbd-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015d0c-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}\stubpath = "C:\\Windows\\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe"	{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}\stubpath = "C:\\Windows\\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe"	{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}\stubpath = "C:\\Windows\\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe"	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A0AF291-336E-4c46-8374-DB53E43629F8}\stubpath = "C:\\Windows\\{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe"	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEBC3603-955C-4bed-80D0-C342CAA540E2}\stubpath = "C:\\Windows\\{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe"	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}\stubpath = "C:\\Windows\\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe"	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9765ACBB-975B-400f-8BD2-E57706FA0589}	{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}\stubpath = "C:\\Windows\\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe"	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A0AF291-336E-4c46-8374-DB53E43629F8}	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}\stubpath = "C:\\Windows\\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe"	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}\stubpath = "C:\\Windows\\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe"	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}	{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}	{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9765ACBB-975B-400f-8BD2-E57706FA0589}\stubpath = "C:\\Windows\\{9765ACBB-975B-400f-8BD2-E57706FA0589}.exe"	{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}\stubpath = "C:\\Windows\\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe"	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEBC3603-955C-4bed-80D0-C342CAA540E2}	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe

Deletes itself 1 IoCs

pid	Process
2956	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe
2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
2876	{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
2008	{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
536	{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe
1404	{9765ACBB-975B-400f-8BD2-E57706FA0589}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe	{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
File created	C:\Windows\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe	{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
File created	C:\Windows\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe
File created	C:\Windows\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
File created	C:\Windows\{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe
File created	C:\Windows\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
File created	C:\Windows\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
File created	C:\Windows\{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
File created	C:\Windows\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
File created	C:\Windows\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
File created	C:\Windows\{9765ACBB-975B-400f-8BD2-E57706FA0589}.exe	{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
Token: SeIncBasePriorityPrivilege	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe
Token: SeIncBasePriorityPrivilege	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
Token: SeIncBasePriorityPrivilege	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
Token: SeIncBasePriorityPrivilege	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
Token: SeIncBasePriorityPrivilege	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
Token: SeIncBasePriorityPrivilege	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
Token: SeIncBasePriorityPrivilege	2876	{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
Token: SeIncBasePriorityPrivilege	2008	{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
Token: SeIncBasePriorityPrivilege	536	{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1564	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	28
PID 2896 wrote to memory of 1564	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	28
PID 2896 wrote to memory of 1564	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	28
PID 2896 wrote to memory of 1564	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	28
PID 2896 wrote to memory of 2956	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	29
PID 2896 wrote to memory of 2956	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	29
PID 2896 wrote to memory of 2956	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	29
PID 2896 wrote to memory of 2956	2896	2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe	29
PID 1564 wrote to memory of 2588	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	30
PID 1564 wrote to memory of 2588	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	30
PID 1564 wrote to memory of 2588	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	30
PID 1564 wrote to memory of 2588	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	30
PID 1564 wrote to memory of 872	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	31
PID 1564 wrote to memory of 872	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	31
PID 1564 wrote to memory of 872	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	31
PID 1564 wrote to memory of 872	1564	{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe	31
PID 2588 wrote to memory of 2116	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	32
PID 2588 wrote to memory of 2116	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	32
PID 2588 wrote to memory of 2116	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	32
PID 2588 wrote to memory of 2116	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	32
PID 2588 wrote to memory of 2372	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	33
PID 2588 wrote to memory of 2372	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	33
PID 2588 wrote to memory of 2372	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	33
PID 2588 wrote to memory of 2372	2588	{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe	33
PID 2116 wrote to memory of 332	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	36
PID 2116 wrote to memory of 332	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	36
PID 2116 wrote to memory of 332	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	36
PID 2116 wrote to memory of 332	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	36
PID 2116 wrote to memory of 2652	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	37
PID 2116 wrote to memory of 2652	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	37
PID 2116 wrote to memory of 2652	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	37
PID 2116 wrote to memory of 2652	2116	{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe	37
PID 332 wrote to memory of 2744	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	38
PID 332 wrote to memory of 2744	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	38
PID 332 wrote to memory of 2744	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	38
PID 332 wrote to memory of 2744	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	38
PID 332 wrote to memory of 1604	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	39
PID 332 wrote to memory of 1604	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	39
PID 332 wrote to memory of 1604	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	39
PID 332 wrote to memory of 1604	332	{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe	39
PID 2744 wrote to memory of 1624	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	40
PID 2744 wrote to memory of 1624	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	40
PID 2744 wrote to memory of 1624	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	40
PID 2744 wrote to memory of 1624	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	40
PID 2744 wrote to memory of 2148	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	41
PID 2744 wrote to memory of 2148	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	41
PID 2744 wrote to memory of 2148	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	41
PID 2744 wrote to memory of 2148	2744	{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe	41
PID 1624 wrote to memory of 2388	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	42
PID 1624 wrote to memory of 2388	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	42
PID 1624 wrote to memory of 2388	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	42
PID 1624 wrote to memory of 2388	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	42
PID 1624 wrote to memory of 2504	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	43
PID 1624 wrote to memory of 2504	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	43
PID 1624 wrote to memory of 2504	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	43
PID 1624 wrote to memory of 2504	1624	{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe	43
PID 2388 wrote to memory of 2876	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	44
PID 2388 wrote to memory of 2876	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	44
PID 2388 wrote to memory of 2876	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	44
PID 2388 wrote to memory of 2876	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	44
PID 2388 wrote to memory of 1356	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	45
PID 2388 wrote to memory of 1356	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	45
PID 2388 wrote to memory of 1356	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	45
PID 2388 wrote to memory of 1356	2388	{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_34b2bb095275220b2aa79c0b5d9a5018_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
  C:\Windows\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe
    C:\Windows\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
      C:\Windows\{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
        
        C:\Windows\{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:332
      - C:\Windows\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
        
        C:\Windows\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
        
        C:\Windows\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
        
        C:\Windows\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
        
        C:\Windows\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
        
        C:\Windows\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe
        
        C:\Windows\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
        
        C:\Windows\{9765ACBB-975B-400f-8BD2-E57706FA0589}.exe
        
        C:\Windows\{9765ACBB-975B-400f-8BD2-E57706FA0589}.exe
        12⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7EBE9~1.EXE > nul
        12⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{434BB~1.EXE > nul
        11⤵
        
        PID:540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DAF60~1.EXE > nul
        10⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A042~1.EXE > nul
        9⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{970E2~1.EXE > nul
        8⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A772~1.EXE > nul
        7⤵
        
        PID:2148
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A0AF~1.EXE > nul
        6⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FEBC3~1.EXE > nul
        5⤵
        
        PID:2652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{EFA38~1.EXE > nul
      4⤵
      PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{49DDA~1.EXE > nul
    3⤵
    PID:872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2A042B59-39D9-4f23-A32F-AA4A830BBAB1}.exe

Filesize
344KB

MD5
f88e73ec1ccddd42aaebe65f74b8b54f

SHA1
3c6a1f61be3b1a565ddfeee872239488259b935e

SHA256
50ee43ad25c5f9d5b0187ac9430aae388bd82d9540b69a7db904dc61c2fd07ae

SHA512
345b971a94791409f68c9415b9836af466dd2ddb66021c88ce378fbed94544dd6d03b08b9576a38acc196e59c0d724da04efc947267661430d585099e477b577

Download Submit
C:\Windows\{2A0AF291-336E-4c46-8374-DB53E43629F8}.exe

Filesize
344KB

MD5
926e375dd053334aeb14ee948c4d2fd3

SHA1
a69e00cb01b871e4a46eea748a44398132566e0a

SHA256
ed41b10b95f723eff4bb2347100dcded2442f286141d3a8146fc8009653ff1d0

SHA512
cd9b63f809fbcb57be475f577064d66effed20e1a95f6a2a98f33ba81d3d16ff92568fc04a69938dbd7010df541453fcee29aca0dbc03e31d538eb2b72c23e0f

Download Submit
C:\Windows\{434BB81D-6DC1-4dac-836D-0A3A07B1BBB0}.exe

Filesize
344KB

MD5
b7bae647882a6d1105f8267e2102c1c1

SHA1
512fc2f04ff6872c985ac349cb9d5edde0fba4f9

SHA256
9c4ff457a9219da8ebb7606513725f73d605173575232fe36f42e9d7b4a22e1c

SHA512
fd32f9a3021021b401e1d264c514c38219f93b72f5e97fe34967642a05810a1d3453032a9878566666faee7fd0571a50015aa740cf5d7456d4bc771379f54b8a

Download Submit
C:\Windows\{49DDA70C-4332-41ec-8F4F-BB9BE34778E6}.exe

Filesize
344KB

MD5
a2333944b19c6ed378eeb95c3f1a3501

SHA1
8e239bf1d314b82a4c5bf47c3c9345ee1765271a

SHA256
3aec302a8bcc568c1e116676f96f01a8c5e2ee3701007e689db0266c06d3da62

SHA512
cafe7b301007a1425780416ab8b61007723232850157c3581b2196814bd401193c6e41cc1132696d4065c5922937a115bd535bf58791935153f070941fd331f6

Download Submit
C:\Windows\{6A7728BA-85BE-42d1-91E6-BBF6C370637F}.exe

Filesize
344KB

MD5
0d6d37811c20abd1166c3d350734c99d

SHA1
f9a95e800f8dca6e5200ca2921e3733e34900724

SHA256
2de0d047ea5ab089a02373ba4733a72f8c25c17bc47793e839a52555fe211743

SHA512
6703fd40a99911af981f9845ff0c2f5e8d4e338afe43009b044261250fe691d2e865bb4a33549b8fdf4c9a9adc5aa251ffdee0613e5676401f021a8bdd960dbb

Download Submit
C:\Windows\{7EBE90BB-FEF1-42b7-81D0-679D9CE99A2A}.exe

Filesize
344KB

MD5
ab20e549ac59a7f2a80a57ffb8858ff9

SHA1
4748f1993ae8f9dff43be0a5e671d83ed748c86b

SHA256
53226ce80f70f4af189c2836a63a748159b91ca7aabf55e41e605841edc568de

SHA512
404ce1ece5105a2fffe5a3c2c12745aac4ddd535cccfb5e01cae3139836ea928c10b5fa6e7a038f2ae08bf6cdaf110f1b24ba813e1af5d3d0cbb65f75a3aecc3

Download Submit
C:\Windows\{970E203F-8DBD-4ac8-923D-AB14C748B4CA}.exe

Filesize
344KB

MD5
07ea1ceac26b4747e69253d45f313905

SHA1
7df00f15a508830bb49fc0555e6a9f6c098de687

SHA256
d0c033a9bad526beb3cf91df881df80505c26d3aea4f2c2cc17b6a16ef4f7788

SHA512
a7fad87e5f1b87f7e4ab509e5cfe355581f128d164f6460d52328254484733f306e6997029409ca7853b84017d345c500012083889bb020d42d7c7aa0a0bcaa4

Download Submit
C:\Windows\{9765ACBB-975B-400f-8BD2-E57706FA0589}.exe

Filesize
344KB

MD5
819d5b5fc10287490edcbb8a203510c4

SHA1
071d4f4d60491336ffe2f529b1b1ba5bd1353c95

SHA256
82d4e2c1216da51f4fbab3a422c089f477cf984fbecc33f45cb7223541494b3a

SHA512
a1f35b1035fc365b94c02888f71fd4e0a8e73140ed76e2473ebd5133f1dc175d8e2dfdef888e4bd1069b3dfbc6d439d0b70895f6755a8389f5dc8ba7879f6680

Download Submit
C:\Windows\{DAF60087-486E-40e7-A9D0-DDB32954E1FC}.exe

Filesize
344KB

MD5
2adb2f93a7354887dd099fa41556d7ae

SHA1
e44cbafefc60a4ccce7c923aed590ee12314a117

SHA256
5c2126b5ce6807c6318dbb4b3fe38f7e05920f1d6a418b365a3c0beee2fe21c6

SHA512
fd71cc404220efad1a9bc3f2ac01b6ccf08d0aca6b5be787e5fe8292cba1e112ccf8e841aeef6b42ce2447e171bcec0d78fa860ad4b7a61e3e9766d4424369bd

Download Submit
C:\Windows\{EFA38540-6DA8-48f5-B350-F9E91FE7D505}.exe

Filesize
344KB

MD5
2988272fd6c074da98e7a6341884b5db

SHA1
c7743bcb21270b54da71d651ad1857d959d50223

SHA256
666222fa6a0b920bf5d7a912d220343173927529f03499b272bf3bfb7e9418df

SHA512
95835504e116c4f6ba52599cda5b558f54fe1ae56e35e2564bee206bb249c9a7badd513a6357da12689b183167a468a61cafb42ee1cf4bbddc5073be8616a037

Download Submit
C:\Windows\{FEBC3603-955C-4bed-80D0-C342CAA540E2}.exe

Filesize
344KB

MD5
d1429739982de1ee0e05e9a11e8bf869

SHA1
897b317cf41953d17ca442f273bdc95ed45ed40e

SHA256
aff2498fcbfab8d06b5f9aada0b4db5f41374557c10088957ee497a7546a88f7

SHA512
8dc05b7e4c3c1e1b5c836ccb93e4212d8241aa4db1827d2e089be6e2958d5b814dc560f906167089d4eaa4bce49fa1240f5f92d784faa036a28daa849e040cde

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads