5076b367bf13da552a2d606a2bd7834d267b41846df50af5a2764353d7cf8afc

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe
Size

197KB
MD5

5d807631eacfd2ed38a4c99cb5d179c8
SHA1

855da6dbe400379f4a85fa7e223443003675fb7f
SHA256

5076b367bf13da552a2d606a2bd7834d267b41846df50af5a2764353d7cf8afc
SHA512

20680f35c5e26a03d30acc0c7e7660785df184811c2fe045710364212e4b73b3244f2ce213c10f2d97a728fcc6ed4a16f4217594c2737a75258e6bd39442b94e
SSDEEP

3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG8lEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015cb6-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012251-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000015d42-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012251-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012251-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012251-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}	{4967FF4B-5209-47ee-B486-729757F7044B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5149D96-8272-463b-97C6-B74DAF2F058A}	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE17AC88-726C-47ca-AD4A-33A6096E808F}	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4967FF4B-5209-47ee-B486-729757F7044B}	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4967FF4B-5209-47ee-B486-729757F7044B}\stubpath = "C:\\Windows\\{4967FF4B-5209-47ee-B486-729757F7044B}.exe"	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37FDECC2-72D4-485c-8192-7E272720967C}\stubpath = "C:\\Windows\\{37FDECC2-72D4-485c-8192-7E272720967C}.exe"	{745BECEC-050A-413c-A273-B8774945040F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C323B2C-76CD-4803-B79C-539D7109C89A}	{37FDECC2-72D4-485c-8192-7E272720967C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}\stubpath = "C:\\Windows\\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}.exe"	{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5149D96-8272-463b-97C6-B74DAF2F058A}\stubpath = "C:\\Windows\\{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe"	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37FDECC2-72D4-485c-8192-7E272720967C}	{745BECEC-050A-413c-A273-B8774945040F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}\stubpath = "C:\\Windows\\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe"	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE17AC88-726C-47ca-AD4A-33A6096E808F}\stubpath = "C:\\Windows\\{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe"	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}\stubpath = "C:\\Windows\\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe"	{4967FF4B-5209-47ee-B486-729757F7044B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{745BECEC-050A-413c-A273-B8774945040F}\stubpath = "C:\\Windows\\{745BECEC-050A-413c-A273-B8774945040F}.exe"	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C323B2C-76CD-4803-B79C-539D7109C89A}\stubpath = "C:\\Windows\\{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe"	{37FDECC2-72D4-485c-8192-7E272720967C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}	{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75A7FC28-2095-443c-9E7C-0322771EEF86}	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75A7FC28-2095-443c-9E7C-0322771EEF86}\stubpath = "C:\\Windows\\{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe"	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}\stubpath = "C:\\Windows\\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe"	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{745BECEC-050A-413c-A273-B8774945040F}	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe

Deletes itself 1 IoCs

pid	Process
2156	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe
2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe
1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe
1520	{745BECEC-050A-413c-A273-B8774945040F}.exe
2928	{37FDECC2-72D4-485c-8192-7E272720967C}.exe
2400	{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe
1480	{40EE4C89-7D65-4b59-AE06-D96B62CF189E}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{37FDECC2-72D4-485c-8192-7E272720967C}.exe	{745BECEC-050A-413c-A273-B8774945040F}.exe
File created	C:\Windows\{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe
File created	C:\Windows\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	{4967FF4B-5209-47ee-B486-729757F7044B}.exe
File created	C:\Windows\{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
File created	C:\Windows\{4967FF4B-5209-47ee-B486-729757F7044B}.exe	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
File created	C:\Windows\{745BECEC-050A-413c-A273-B8774945040F}.exe	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe
File created	C:\Windows\{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe	{37FDECC2-72D4-485c-8192-7E272720967C}.exe
File created	C:\Windows\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}.exe	{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe
File created	C:\Windows\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
File created	C:\Windows\{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
File created	C:\Windows\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
Token: SeIncBasePriorityPrivilege	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
Token: SeIncBasePriorityPrivilege	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe
Token: SeIncBasePriorityPrivilege	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
Token: SeIncBasePriorityPrivilege	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe
Token: SeIncBasePriorityPrivilege	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
Token: SeIncBasePriorityPrivilege	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe
Token: SeIncBasePriorityPrivilege	1520	{745BECEC-050A-413c-A273-B8774945040F}.exe
Token: SeIncBasePriorityPrivilege	2928	{37FDECC2-72D4-485c-8192-7E272720967C}.exe
Token: SeIncBasePriorityPrivilege	2400	{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2124	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	28
PID 2956 wrote to memory of 2124	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	28
PID 2956 wrote to memory of 2124	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	28
PID 2956 wrote to memory of 2124	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	28
PID 2956 wrote to memory of 2156	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	29
PID 2956 wrote to memory of 2156	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	29
PID 2956 wrote to memory of 2156	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	29
PID 2956 wrote to memory of 2156	2956	2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe	29
PID 2124 wrote to memory of 2548	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	30
PID 2124 wrote to memory of 2548	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	30
PID 2124 wrote to memory of 2548	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	30
PID 2124 wrote to memory of 2548	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	30
PID 2124 wrote to memory of 2676	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	31
PID 2124 wrote to memory of 2676	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	31
PID 2124 wrote to memory of 2676	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	31
PID 2124 wrote to memory of 2676	2124	{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe	31
PID 2548 wrote to memory of 2428	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	32
PID 2548 wrote to memory of 2428	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	32
PID 2548 wrote to memory of 2428	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	32
PID 2548 wrote to memory of 2428	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	32
PID 2548 wrote to memory of 2620	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	33
PID 2548 wrote to memory of 2620	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	33
PID 2548 wrote to memory of 2620	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	33
PID 2548 wrote to memory of 2620	2548	{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe	33
PID 2428 wrote to memory of 2492	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	36
PID 2428 wrote to memory of 2492	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	36
PID 2428 wrote to memory of 2492	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	36
PID 2428 wrote to memory of 2492	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	36
PID 2428 wrote to memory of 2464	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	37
PID 2428 wrote to memory of 2464	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	37
PID 2428 wrote to memory of 2464	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	37
PID 2428 wrote to memory of 2464	2428	{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe	37
PID 2492 wrote to memory of 1420	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	38
PID 2492 wrote to memory of 1420	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	38
PID 2492 wrote to memory of 1420	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	38
PID 2492 wrote to memory of 1420	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	38
PID 2492 wrote to memory of 2612	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	39
PID 2492 wrote to memory of 2612	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	39
PID 2492 wrote to memory of 2612	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	39
PID 2492 wrote to memory of 2612	2492	{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe	39
PID 1420 wrote to memory of 1772	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	40
PID 1420 wrote to memory of 1772	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	40
PID 1420 wrote to memory of 1772	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	40
PID 1420 wrote to memory of 1772	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	40
PID 1420 wrote to memory of 608	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	41
PID 1420 wrote to memory of 608	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	41
PID 1420 wrote to memory of 608	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	41
PID 1420 wrote to memory of 608	1420	{4967FF4B-5209-47ee-B486-729757F7044B}.exe	41
PID 1772 wrote to memory of 1672	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	42
PID 1772 wrote to memory of 1672	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	42
PID 1772 wrote to memory of 1672	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	42
PID 1772 wrote to memory of 1672	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	42
PID 1772 wrote to memory of 1956	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	43
PID 1772 wrote to memory of 1956	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	43
PID 1772 wrote to memory of 1956	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	43
PID 1772 wrote to memory of 1956	1772	{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe	43
PID 1672 wrote to memory of 1520	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	44
PID 1672 wrote to memory of 1520	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	44
PID 1672 wrote to memory of 1520	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	44
PID 1672 wrote to memory of 1520	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	44
PID 1672 wrote to memory of 2344	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	45
PID 1672 wrote to memory of 2344	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	45
PID 1672 wrote to memory of 2344	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	45
PID 1672 wrote to memory of 2344	1672	{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_5d807631eacfd2ed38a4c99cb5d179c8_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
  C:\Windows\{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
    C:\Windows\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe
      C:\Windows\{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
        
        C:\Windows\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\{4967FF4B-5209-47ee-B486-729757F7044B}.exe
        
        C:\Windows\{4967FF4B-5209-47ee-B486-729757F7044B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
        
        C:\Windows\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe
        
        C:\Windows\{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\{745BECEC-050A-413c-A273-B8774945040F}.exe
        
        C:\Windows\{745BECEC-050A-413c-A273-B8774945040F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Windows\{37FDECC2-72D4-485c-8192-7E272720967C}.exe
        
        C:\Windows\{37FDECC2-72D4-485c-8192-7E272720967C}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe
        
        C:\Windows\{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
        
        C:\Windows\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}.exe
        
        C:\Windows\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}.exe
        12⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2C323~1.EXE > nul
        12⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{37FDE~1.EXE > nul
        11⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{745BE~1.EXE > nul
        10⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E5149~1.EXE > nul
        9⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{485B6~1.EXE > nul
        8⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4967F~1.EXE > nul
        7⤵
        
        PID:608
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9FF18~1.EXE > nul
        6⤵
        
        PID:2612
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE17A~1.EXE > nul
        5⤵
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DB859~1.EXE > nul
      4⤵
      PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{75A7F~1.EXE > nul
    3⤵
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2C323B2C-76CD-4803-B79C-539D7109C89A}.exe

Filesize
197KB

MD5
1f92a3eb904acd73c6777e1121b38659

SHA1
d2d93a487a9909dad23be1345155f86a72e61441

SHA256
296ec741fc391553e437d3947622773cdbab75014013c488ad099b84eefecddd

SHA512
262f554f2d6f7b6a022be803e8b3e4bee2f488944701ec5cd8a2dd713e9c8dc712e58a8bc330146bacfeccae471fc1be7f1790bb09306714e2016a30ad832d56

Download Submit
C:\Windows\{37FDECC2-72D4-485c-8192-7E272720967C}.exe

Filesize
197KB

MD5
a1f76b6b48caed348cb130fea83d3265

SHA1
f08a3ef0ba54484f3325e7fe34d00ae98a9fd1af

SHA256
1cc24dc569145bbb18183ef40ee9230bb92cdec237161601aafb3e6c0513c357

SHA512
6c079086666cfd28e404f5e7ae62786761a0d9f6d7b9ea1f6a1c14fe65cda5d489ddadafa79e6880d234084da6bbfc64ff962a85d99b684061454fb86c83b963

Download Submit
C:\Windows\{40EE4C89-7D65-4b59-AE06-D96B62CF189E}.exe

Filesize
197KB

MD5
cfb75aa40e16e992f2f940b433163e57

SHA1
ebd9e311a97ba107ea91f39bda8723a3f5ad2ccf

SHA256
da03abca0cab57c413f37273d925e086160143ec7c01b5da556dcb96f68f3374

SHA512
76c891945303a70f46a0fe16b4a9fa18073ba8c14c405aec2f57dcb6d894d82dde36ca5fbff7b46716d603126906b678e6338a7c101b376c822511fe7622cdc1

Download Submit
C:\Windows\{485B6FD2-DF64-4e6b-976E-4198751FC8A8}.exe

Filesize
197KB

MD5
113e29a1cecc2dc2db3699255db7df3b

SHA1
b29676809bac1ba621b927c25cf519ca727a9304

SHA256
ebb7a052920b3e226cd61d3fb22c430d2c2986916ed75df388a62cb42a9260a9

SHA512
e2b07eca02c9c365d98d80b900e97c303745027330b0a1b90f6e29a0ec5c34992a25226542368d069ffde86c2cac50f42dacee32286655deaacd921b93ffcfc6

Download Submit
C:\Windows\{4967FF4B-5209-47ee-B486-729757F7044B}.exe

Filesize
197KB

MD5
d52917a9f2435459ae362bb409e07204

SHA1
dcb5651ab914790ff4800259815d09fb0afeecf0

SHA256
30f5c010f84bd2c6512317083a86e5fe851bb14b74b249f293861a63d7dca94a

SHA512
1dde88006e053beaba8ff0c0b86ff1a293677b8a0ecab35ae3e965d4974503b6fe0e45513436a0de2f90ed06b8b12bfc8b2e4c4d1bba7737e06f6ed62b096307

Download Submit
C:\Windows\{745BECEC-050A-413c-A273-B8774945040F}.exe

Filesize
197KB

MD5
33c871c5fbb3ac662bd3b935ee211d9a

SHA1
b841c9a4cde18f5b91b7dce4da88b384a6d2e302

SHA256
b79d064c10a74af446ed7fedda22556910166aa43f269b7dec1f6b9e9da2b245

SHA512
48b0e29fd4a36a0f5994272d1a073c810d9c5d89d1a469bf292bed8dad88bef9d1a730a6c23bc6c8566c6dc6af66084a40f6ab0fc978d557d10afe3e773bed94

Download Submit
C:\Windows\{75A7FC28-2095-443c-9E7C-0322771EEF86}.exe

Filesize
197KB

MD5
579f7fa79c72b1610326733ec18a9948

SHA1
6d3cdceecc7bc1e51a584e539fa4026037038cc5

SHA256
f5247126fcd1d3ec4848282236631e4597107d8f798ae101146fb85631440759

SHA512
d9e5151ef8e2da66e6aabff99897830f52ccf979be1e37b7579ec2ae40586241ff51d89b41e5af24fef59dffa17eafa0317f23e2339497511089f2af4f4289ea

Download Submit
C:\Windows\{9FF18B2B-D857-4c4b-9AD0-89EAFF7BFB95}.exe

Filesize
197KB

MD5
7ae3a60140bd3014d9ada9315c477cb2

SHA1
0f05831c2acb225b22e6f9002e7310601264f2ae

SHA256
7bb3ccd2765f9feb2aa53f52c267cc82038b1601ab9daa0f053b28a2946b1d42

SHA512
ed9a6a622459da6ad81e90735c6dbae41ac0f1093d1efa1614f1d0a4e56fb949371b2187f06c5e5a8e1d7a0e8c97568639c3b57c4b7991c5348b0c166f9c55e7

Download Submit
C:\Windows\{CE17AC88-726C-47ca-AD4A-33A6096E808F}.exe

Filesize
197KB

MD5
8b86a40f46d461637b68b5c44ff94a0d

SHA1
c964d61690d9d81ffa4e56b64757543aad31ef34

SHA256
1c668fb5c804c0623b4871695b886b49dd464b57037ee969cb7e908c3060c911

SHA512
d54ed335ea80fdf65a0bed48a454c99103ee8a17bd15d7d4aebbe5b9bd7ce189cb7d85d196b45a7e9f1da69cf994a0abbe5d4768039bbc27a24292f34541b41d

Download Submit
C:\Windows\{DB85986F-C5F2-4c83-A2AD-B747642B14F0}.exe

Filesize
197KB

MD5
46a5e8341319b59369d2e418e2c842a1

SHA1
47ff8401b4a46d8780ffa726532e9c878218f551

SHA256
e7cdb0431a4c147f8f7bc6bba32944c36c7b06d9d6e5e81bbc9826e0916e20f4

SHA512
9fa2a1c50436e53df4ba3a325964aa2a160c5ac51e4385f86545b54eceb24db9b65b480cacb3663f5c6c012ee96b9fe0bf98db354f5b9f40fed902d8e6c8f499

Download Submit
C:\Windows\{E5149D96-8272-463b-97C6-B74DAF2F058A}.exe

Filesize
197KB

MD5
b27235f3841bb497fa99334b23812173

SHA1
bdfd6693793e62972c0b9220dc9bc203f83e54d3

SHA256
c0012f5fbb8386f86bb356acd7feb62aa94d65cc66fcedf28e5874693badf922

SHA512
f5445517cc1673f0e1e1b5a62d3f9914d0c9068990e469cb71ff04fd037aad0104b161c26b0433dd97822011736b364e495bed6789b41f7aa51ee67710563883

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads