fe5bcb9f0906fd3fdc6eb4fe4647e4b174f2805c46b02ac0fce8c844f6b15b59

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe
Size

344KB
MD5

29e20b8b542e72ea5a61707def858260
SHA1

4d8aac46263a84d8899b79e459e460431c2391f9
SHA256

fe5bcb9f0906fd3fdc6eb4fe4647e4b174f2805c46b02ac0fce8c844f6b15b59
SHA512

f97f8d9ee6184bcdd250ccdc80d1092fb19befb2129ea5ef34087b81560913c986376ee6489eef5dadf934a727f831fb90c5029a707947360840fcdcca597dfe
SSDEEP

3072:mEGh0oklEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGulqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012248-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000013143-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012248-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015ca5-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012248-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012248-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0011000000012248-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}\stubpath = "C:\\Windows\\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe"	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}\stubpath = "C:\\Windows\\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe"	{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}\stubpath = "C:\\Windows\\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe"	{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}	{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}\stubpath = "C:\\Windows\\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe"	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9F085190-90CD-4262-953D-C38D28044345}	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9F085190-90CD-4262-953D-C38D28044345}\stubpath = "C:\\Windows\\{9F085190-90CD-4262-953D-C38D28044345}.exe"	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}\stubpath = "C:\\Windows\\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe"	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}\stubpath = "C:\\Windows\\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe"	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}	{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D65059ED-36CC-4e23-AF99-79457CF81385}	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D65059ED-36CC-4e23-AF99-79457CF81385}\stubpath = "C:\\Windows\\{D65059ED-36CC-4e23-AF99-79457CF81385}.exe"	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}	{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}\stubpath = "C:\\Windows\\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}.exe"	{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E69D098-8C31-49b2-B151-0E41B656ED2B}	{9F085190-90CD-4262-953D-C38D28044345}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E69D098-8C31-49b2-B151-0E41B656ED2B}\stubpath = "C:\\Windows\\{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe"	{9F085190-90CD-4262-953D-C38D28044345}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}\stubpath = "C:\\Windows\\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe"	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe

Deletes itself 1 IoCs

pid	Process
1984	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
2648	{9F085190-90CD-4262-953D-C38D28044345}.exe
1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe
2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
1816	{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
1224	{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe
2844	{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe
1064	{D6BBBFB0-991C-4b80-BB55-407CD340E13D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe
File created	C:\Windows\{9F085190-90CD-4262-953D-C38D28044345}.exe	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
File created	C:\Windows\{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
File created	C:\Windows\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
File created	C:\Windows\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe	{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
File created	C:\Windows\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}.exe	{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe
File created	C:\Windows\{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	{9F085190-90CD-4262-953D-C38D28044345}.exe
File created	C:\Windows\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe
File created	C:\Windows\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
File created	C:\Windows\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
File created	C:\Windows\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe	{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
Token: SeIncBasePriorityPrivilege	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe
Token: SeIncBasePriorityPrivilege	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe
Token: SeIncBasePriorityPrivilege	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
Token: SeIncBasePriorityPrivilege	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
Token: SeIncBasePriorityPrivilege	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
Token: SeIncBasePriorityPrivilege	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
Token: SeIncBasePriorityPrivilege	1816	{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
Token: SeIncBasePriorityPrivilege	1224	{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe
Token: SeIncBasePriorityPrivilege	2844	{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2940	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	28
PID 2868 wrote to memory of 2940	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	28
PID 2868 wrote to memory of 2940	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	28
PID 2868 wrote to memory of 2940	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	28
PID 2868 wrote to memory of 1984	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	29
PID 2868 wrote to memory of 1984	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	29
PID 2868 wrote to memory of 1984	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	29
PID 2868 wrote to memory of 1984	2868	2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe	29
PID 2940 wrote to memory of 2648	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	30
PID 2940 wrote to memory of 2648	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	30
PID 2940 wrote to memory of 2648	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	30
PID 2940 wrote to memory of 2648	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	30
PID 2940 wrote to memory of 2732	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	31
PID 2940 wrote to memory of 2732	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	31
PID 2940 wrote to memory of 2732	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	31
PID 2940 wrote to memory of 2732	2940	{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe	31
PID 2648 wrote to memory of 1744	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	32
PID 2648 wrote to memory of 1744	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	32
PID 2648 wrote to memory of 1744	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	32
PID 2648 wrote to memory of 1744	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	32
PID 2648 wrote to memory of 2348	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	33
PID 2648 wrote to memory of 2348	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	33
PID 2648 wrote to memory of 2348	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	33
PID 2648 wrote to memory of 2348	2648	{9F085190-90CD-4262-953D-C38D28044345}.exe	33
PID 1744 wrote to memory of 2904	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	36
PID 1744 wrote to memory of 2904	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	36
PID 1744 wrote to memory of 2904	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	36
PID 1744 wrote to memory of 2904	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	36
PID 1744 wrote to memory of 1952	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	37
PID 1744 wrote to memory of 1952	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	37
PID 1744 wrote to memory of 1952	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	37
PID 1744 wrote to memory of 1952	1744	{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe	37
PID 2904 wrote to memory of 2624	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	38
PID 2904 wrote to memory of 2624	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	38
PID 2904 wrote to memory of 2624	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	38
PID 2904 wrote to memory of 2624	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	38
PID 2904 wrote to memory of 3040	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	39
PID 2904 wrote to memory of 3040	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	39
PID 2904 wrote to memory of 3040	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	39
PID 2904 wrote to memory of 3040	2904	{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe	39
PID 2624 wrote to memory of 1932	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	40
PID 2624 wrote to memory of 1932	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	40
PID 2624 wrote to memory of 1932	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	40
PID 2624 wrote to memory of 1932	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	40
PID 2624 wrote to memory of 2336	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	41
PID 2624 wrote to memory of 2336	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	41
PID 2624 wrote to memory of 2336	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	41
PID 2624 wrote to memory of 2336	2624	{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe	41
PID 1932 wrote to memory of 1540	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	42
PID 1932 wrote to memory of 1540	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	42
PID 1932 wrote to memory of 1540	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	42
PID 1932 wrote to memory of 1540	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	42
PID 1932 wrote to memory of 472	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	43
PID 1932 wrote to memory of 472	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	43
PID 1932 wrote to memory of 472	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	43
PID 1932 wrote to memory of 472	1932	{D65059ED-36CC-4e23-AF99-79457CF81385}.exe	43
PID 1540 wrote to memory of 1816	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	44
PID 1540 wrote to memory of 1816	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	44
PID 1540 wrote to memory of 1816	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	44
PID 1540 wrote to memory of 1816	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	44
PID 1540 wrote to memory of 1412	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	45
PID 1540 wrote to memory of 1412	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	45
PID 1540 wrote to memory of 1412	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	45
PID 1540 wrote to memory of 1412	1540	{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_29e20b8b542e72ea5a61707def858260_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
  C:\Windows\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\{9F085190-90CD-4262-953D-C38D28044345}.exe
    C:\Windows\{9F085190-90CD-4262-953D-C38D28044345}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe
      C:\Windows\{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Windows\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
        
        C:\Windows\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Windows\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
        
        C:\Windows\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
        
        C:\Windows\{D65059ED-36CC-4e23-AF99-79457CF81385}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
        
        C:\Windows\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
        
        C:\Windows\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe
        
        C:\Windows\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
        
        C:\Windows\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe
        
        C:\Windows\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}.exe
        
        C:\Windows\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}.exe
        12⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5140F~1.EXE > nul
        12⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D689~1.EXE > nul
        11⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C1DB8~1.EXE > nul
        10⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59F25~1.EXE > nul
        9⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6505~1.EXE > nul
        8⤵
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6858E~1.EXE > nul
        7⤵
        
        PID:2336
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6353~1.EXE > nul
        6⤵
        
        PID:3040
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E69D~1.EXE > nul
        5⤵
        
        PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{9F085~1.EXE > nul
      4⤵
      PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{83855~1.EXE > nul
    3⤵
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1D6897A2-FCF4-4c7f-B1F5-94FF6794B64B}.exe

Filesize
344KB

MD5
31d04d7fb75aa9e57a0b0cb03a178a13

SHA1
f982bb496f3152eb7add99611f288810cc6a1bcd

SHA256
803bcb166997dec776440570fda350e9e981b5f29ea051ce75d6abafab84372b

SHA512
a049c8eff9c3b5c0e1adb43dbd23300910d7e0c57365531b1c6a2e601ff974d9b85a767d73ca857ee87a9882e8dd6c55cb964c25ee8a778343abd27ce2281e67

Download Submit
C:\Windows\{4E69D098-8C31-49b2-B151-0E41B656ED2B}.exe

Filesize
344KB

MD5
a15ecaab1d54a2aead20d34b362fb0ac

SHA1
39ff74539b61cda1e7d45ee0c2db8add439ec00e

SHA256
8a1661ba138e3e27b9b4e5d5cbd03ee18f86b985f02bf02fed874ee0c349be33

SHA512
6bf894124e51cbc36fc5dce2b2866baf9e8742f6ff138eb144c21887574cd4f0d5974dd171fca078131e65b7395a6bf262affcb9e7e4f33739f64e8d87c92775

Download Submit
C:\Windows\{5140FFB6-6BFD-4132-8907-3B241B8A2B82}.exe

Filesize
344KB

MD5
9e52f4d90e76256659da2ce7deb3e186

SHA1
ef8e8e93bad6d96f605dbb4ff4370427d692bc2c

SHA256
47fb04334308b3fb00af3febdd47b68b8762e6ce6b9e451ba2a8037c6a89e41e

SHA512
829625524d3757336f862cf49f0a6074b73eccba59e943eff3f8fd6230b0e48c1d929880c5d61d40a10f955ea27e6eaf2ccca84ce17d2623161bb8e62f345f58

Download Submit
C:\Windows\{59F250B3-9610-4f84-AAFB-4E81F9C21C28}.exe

Filesize
344KB

MD5
3150e41ddc7b4e9fff5336430a23d3f4

SHA1
1619a3ada8ad576714215a84d41f64d61f5f917c

SHA256
544ab4608d68b0e62b1373adaf374de04d8ff0fbee3317011b53592d9456a2c1

SHA512
046be4f65b3e2cbc3473504fcd175c82682ae02cd74901d4debcefb20a0e380b095821060b1a8c4e0d8506216dc68e8a5313c2390aba29cbd4bfceb89a7c1eb0

Download Submit
C:\Windows\{6858E426-88E7-4a3c-B1B6-51FFE0FB6B93}.exe

Filesize
344KB

MD5
c0a4702aa462947f4846ee6990ea2c58

SHA1
5781ffc9efe9ebe8444e4e6fa10824684e15f69f

SHA256
4b9592af1d5f652b96334cd2bbab2e381538deab8b0b7f05669cef9d33b2f1a4

SHA512
0ac4e01605d605b952a5439cd6d1cd288f66389d49cfb9fbe45338829a6e035d362e0498690b5184925113f7ce34045886d383ee0b4ea1634bfc828029ee83d6

Download Submit
C:\Windows\{83855AA7-BD1E-4322-83BF-7DBD3D74C752}.exe

Filesize
344KB

MD5
ae140fce5a58664ed677082a09717ba2

SHA1
1ec8b769cc6fb03e01de335ca78e5121d4eadb77

SHA256
53df26e3c55e8dfd29d24fbcff8f58668c98daa6f6b47e480404db5c5ac8f65f

SHA512
8439931bccf51833119354f9f17205d4f94e7823d88a12357bbe6283038993598a1b2b37d9974d93683d187dbfa4ccd7fb706bcc91919e94a2c8e00c68a94a29

Download Submit
C:\Windows\{9F085190-90CD-4262-953D-C38D28044345}.exe

Filesize
344KB

MD5
dc6528d56fd524632fc52339e488ea7f

SHA1
2cf1cf951fb527493f7e6d3beb97ee31a59e2c30

SHA256
92f7eb8a3a80615cc91fb4adce623d85a2b24e15755bb0ac77a1d384cf162300

SHA512
5dbdd4fe0e3b1b367c6072cdb8eaaa1adf21aacadb5636b8e528b2a39c93d535a84761cf2c2cb684f00f28264b2fac1bf1a7fdfab0c6fc92e83213c302b9c75a

Download Submit
C:\Windows\{C1DB8ACF-07BB-4a55-8F69-4B6CB805D020}.exe

Filesize
344KB

MD5
9914f411c463d740eab1b17729a65d90

SHA1
27cc3eb7fc67bb37f27c78c3d80277c1255bdb45

SHA256
9c6b94f552d81a49152a522a5a21abc67adc82aa7f22a9ad3f5b9fe97832db0b

SHA512
491f3d6b72ba3b3def3752cfc4156f399327a79917f82981ddefebba19e50f32fb4c5fb4b3491b5420b236fa9985ae0af6788de200e81c56f626118a3b14ad76

Download Submit
C:\Windows\{C6353DEA-89C6-4fa8-8BD7-825BE45B9094}.exe

Filesize
344KB

MD5
37400e0a4ab235d7ae42f22bd2a1bbad

SHA1
bb2ad9f599ac3fb6c6be86d6e49ebed5aee50128

SHA256
3dc463f947d5a598f3942645e133e3f21800a494d17b450c182d4eeccb2e8685

SHA512
03732dbfb790c6797e3155773f4fa4c2c3326e2759d6a824823c64de232fabc99c75f8f1e14848a812407f5298ae9c9c15a7e79fea1b4f0632b9dbed8f70e6c2

Download Submit
C:\Windows\{D65059ED-36CC-4e23-AF99-79457CF81385}.exe

Filesize
344KB

MD5
0a1c6f8b817ae9cb064b0ebab2fea4f9

SHA1
5d636ef97c01255ee0236d7923f0be27a78f81e8

SHA256
cc85a6a3104189dc140265d30c4c3b6c00529faedf4f1a1e795fc35cf6c2446d

SHA512
b6f0dd11c2bbfa5b43d31a0b9517596940fb1481ffc3ae2b8397b867177bf8259648ce6a39f5b8ae43c5080dcb4d1b3aad5fde469d837d9b18b70da63b5b3560

Download Submit
C:\Windows\{D6BBBFB0-991C-4b80-BB55-407CD340E13D}.exe

Filesize
344KB

MD5
8476d474535ff152e1773d474618e78c

SHA1
d280c1a22c75878d305e935f7084fe173466a8db

SHA256
a25f53b0eff2e93a43e886883b1b8c34351db1cad1fac2fd908d6ab9de6377d9

SHA512
ccec844c54d654279aecf9268522b0080db8ba0c0e78e1e836d444eb1268c91dc87d61ad727c250ece29217e5b7397cb3efa222cba0546f891cdcd5b703c89e0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads