4c00122619923c9063862cdf89e238f9cfa8d931224fc687b0069a780a84ca40

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Size

197KB
MD5

857d91c625b67d4a6f3e670e8932b4a8
SHA1

218ab8bee6ee1e4499aa701fc3a0b4c52e7096a2
SHA256

4c00122619923c9063862cdf89e238f9cfa8d931224fc687b0069a780a84ca40
SHA512

19c80f633fdbfd13c8e198e5c881b63c530c04cc7867f8ffbf31bb3bdbe67952603fa1c732c5624b3afe2f577bc8ea99117e751817b166a4361858a6c0dca61c
SSDEEP

3072:jEGh0ogl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000144e0-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003200000001480e-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000144e0-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00320000000149e1-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000144e0-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000144e0-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00100000000144e0-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}\stubpath = "C:\\Windows\\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe"	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{419DF520-6D26-4f85-9B7F-6B656280A064}\stubpath = "C:\\Windows\\{419DF520-6D26-4f85-9B7F-6B656280A064}.exe"	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73EFADB4-058C-4819-9DDC-3113D06E593F}\stubpath = "C:\\Windows\\{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe"	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58AC873B-BBD4-48ec-9CE0-2F646993D602}	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70699718-2DAB-4ece-9960-89CB57408770}	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6402DC49-D2F1-4be7-9780-9B515345F769}	{70699718-2DAB-4ece-9960-89CB57408770}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6402DC49-D2F1-4be7-9780-9B515345F769}\stubpath = "C:\\Windows\\{6402DC49-D2F1-4be7-9780-9B515345F769}.exe"	{70699718-2DAB-4ece-9960-89CB57408770}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{757584B8-00EB-4a63-80FD-17D7788306A3}	{13946497-1A47-4959-A4B0-D107588A60BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{757584B8-00EB-4a63-80FD-17D7788306A3}\stubpath = "C:\\Windows\\{757584B8-00EB-4a63-80FD-17D7788306A3}.exe"	{13946497-1A47-4959-A4B0-D107588A60BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A56944B-1433-445f-B747-1EB37B670D03}\stubpath = "C:\\Windows\\{9A56944B-1433-445f-B747-1EB37B670D03}.exe"	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98C9A429-857E-4cbb-B905-8058CEB4E701}	{9A56944B-1433-445f-B747-1EB37B670D03}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70699718-2DAB-4ece-9960-89CB57408770}\stubpath = "C:\\Windows\\{70699718-2DAB-4ece-9960-89CB57408770}.exe"	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{419DF520-6D26-4f85-9B7F-6B656280A064}	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6D2A342-B93D-43ab-83E6-765BA9C30244}	{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13946497-1A47-4959-A4B0-D107588A60BC}\stubpath = "C:\\Windows\\{13946497-1A47-4959-A4B0-D107588A60BC}.exe"	{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A56944B-1433-445f-B747-1EB37B670D03}	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98C9A429-857E-4cbb-B905-8058CEB4E701}\stubpath = "C:\\Windows\\{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe"	{9A56944B-1433-445f-B747-1EB37B670D03}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58AC873B-BBD4-48ec-9CE0-2F646993D602}\stubpath = "C:\\Windows\\{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe"	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6D2A342-B93D-43ab-83E6-765BA9C30244}\stubpath = "C:\\Windows\\{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe"	{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13946497-1A47-4959-A4B0-D107588A60BC}	{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73EFADB4-058C-4819-9DDC-3113D06E593F}	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe
2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe
1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
2192	{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
1876	{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
2268	{13946497-1A47-4959-A4B0-D107588A60BC}.exe
1496	{757584B8-00EB-4a63-80FD-17D7788306A3}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
File created	C:\Windows\{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
File created	C:\Windows\{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	{9A56944B-1433-445f-B747-1EB37B670D03}.exe
File created	C:\Windows\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
File created	C:\Windows\{419DF520-6D26-4f85-9B7F-6B656280A064}.exe	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
File created	C:\Windows\{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe	{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
File created	C:\Windows\{13946497-1A47-4959-A4B0-D107588A60BC}.exe	{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
File created	C:\Windows\{757584B8-00EB-4a63-80FD-17D7788306A3}.exe	{13946497-1A47-4959-A4B0-D107588A60BC}.exe
File created	C:\Windows\{9A56944B-1433-445f-B747-1EB37B670D03}.exe	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
File created	C:\Windows\{70699718-2DAB-4ece-9960-89CB57408770}.exe	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
File created	C:\Windows\{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	{70699718-2DAB-4ece-9960-89CB57408770}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
Token: SeIncBasePriorityPrivilege	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe
Token: SeIncBasePriorityPrivilege	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
Token: SeIncBasePriorityPrivilege	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
Token: SeIncBasePriorityPrivilege	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
Token: SeIncBasePriorityPrivilege	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe
Token: SeIncBasePriorityPrivilege	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
Token: SeIncBasePriorityPrivilege	2192	{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
Token: SeIncBasePriorityPrivilege	1876	{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
Token: SeIncBasePriorityPrivilege	2268	{13946497-1A47-4959-A4B0-D107588A60BC}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2524	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	28
PID 2040 wrote to memory of 2524	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	28
PID 2040 wrote to memory of 2524	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	28
PID 2040 wrote to memory of 2524	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	28
PID 2040 wrote to memory of 2724	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	29
PID 2040 wrote to memory of 2724	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	29
PID 2040 wrote to memory of 2724	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	29
PID 2040 wrote to memory of 2724	2040	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	29
PID 2524 wrote to memory of 2552	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	30
PID 2524 wrote to memory of 2552	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	30
PID 2524 wrote to memory of 2552	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	30
PID 2524 wrote to memory of 2552	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	30
PID 2524 wrote to memory of 2548	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	31
PID 2524 wrote to memory of 2548	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	31
PID 2524 wrote to memory of 2548	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	31
PID 2524 wrote to memory of 2548	2524	{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe	31
PID 2552 wrote to memory of 2696	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	32
PID 2552 wrote to memory of 2696	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	32
PID 2552 wrote to memory of 2696	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	32
PID 2552 wrote to memory of 2696	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	32
PID 2552 wrote to memory of 2468	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	33
PID 2552 wrote to memory of 2468	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	33
PID 2552 wrote to memory of 2468	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	33
PID 2552 wrote to memory of 2468	2552	{9A56944B-1433-445f-B747-1EB37B670D03}.exe	33
PID 2696 wrote to memory of 2032	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	36
PID 2696 wrote to memory of 2032	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	36
PID 2696 wrote to memory of 2032	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	36
PID 2696 wrote to memory of 2032	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	36
PID 2696 wrote to memory of 768	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	37
PID 2696 wrote to memory of 768	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	37
PID 2696 wrote to memory of 768	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	37
PID 2696 wrote to memory of 768	2696	{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe	37
PID 2032 wrote to memory of 2748	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	38
PID 2032 wrote to memory of 2748	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	38
PID 2032 wrote to memory of 2748	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	38
PID 2032 wrote to memory of 2748	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	38
PID 2032 wrote to memory of 2752	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	39
PID 2032 wrote to memory of 2752	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	39
PID 2032 wrote to memory of 2752	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	39
PID 2032 wrote to memory of 2752	2032	{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe	39
PID 2748 wrote to memory of 2200	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	40
PID 2748 wrote to memory of 2200	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	40
PID 2748 wrote to memory of 2200	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	40
PID 2748 wrote to memory of 2200	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	40
PID 2748 wrote to memory of 1676	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	41
PID 2748 wrote to memory of 1676	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	41
PID 2748 wrote to memory of 1676	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	41
PID 2748 wrote to memory of 1676	2748	{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe	41
PID 2200 wrote to memory of 1984	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	42
PID 2200 wrote to memory of 1984	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	42
PID 2200 wrote to memory of 1984	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	42
PID 2200 wrote to memory of 1984	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	42
PID 2200 wrote to memory of 2328	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	43
PID 2200 wrote to memory of 2328	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	43
PID 2200 wrote to memory of 2328	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	43
PID 2200 wrote to memory of 2328	2200	{70699718-2DAB-4ece-9960-89CB57408770}.exe	43
PID 1984 wrote to memory of 2192	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	44
PID 1984 wrote to memory of 2192	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	44
PID 1984 wrote to memory of 2192	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	44
PID 1984 wrote to memory of 2192	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	44
PID 1984 wrote to memory of 1532	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	45
PID 1984 wrote to memory of 1532	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	45
PID 1984 wrote to memory of 1532	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	45
PID 1984 wrote to memory of 1532	1984	{6402DC49-D2F1-4be7-9780-9B515345F769}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
  C:\Windows\{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\{9A56944B-1433-445f-B747-1EB37B670D03}.exe
    C:\Windows\{9A56944B-1433-445f-B747-1EB37B670D03}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
      C:\Windows\{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
        
        C:\Windows\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2032
      - C:\Windows\{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
        
        C:\Windows\{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\{70699718-2DAB-4ece-9960-89CB57408770}.exe
        
        C:\Windows\{70699718-2DAB-4ece-9960-89CB57408770}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
        
        C:\Windows\{6402DC49-D2F1-4be7-9780-9B515345F769}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
        
        C:\Windows\{419DF520-6D26-4f85-9B7F-6B656280A064}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
        
        C:\Windows\{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
        
        C:\Windows\{13946497-1A47-4959-A4B0-D107588A60BC}.exe
        
        C:\Windows\{13946497-1A47-4959-A4B0-D107588A60BC}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Windows\{757584B8-00EB-4a63-80FD-17D7788306A3}.exe
        
        C:\Windows\{757584B8-00EB-4a63-80FD-17D7788306A3}.exe
        12⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13946~1.EXE > nul
        12⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6D2A~1.EXE > nul
        11⤵
        
        PID:324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{419DF~1.EXE > nul
        10⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6402D~1.EXE > nul
        9⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70699~1.EXE > nul
        8⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58AC8~1.EXE > nul
        7⤵
        
        PID:1676
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DDACA~1.EXE > nul
        6⤵
        
        PID:2752
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98C9A~1.EXE > nul
        5⤵
        
        PID:768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{9A569~1.EXE > nul
      4⤵
      PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{73EFA~1.EXE > nul
    3⤵
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{13946497-1A47-4959-A4B0-D107588A60BC}.exe

Filesize
197KB

MD5
9e2bd3c8c2bfe404a51a7619c2c3b140

SHA1
00d1a379e070e6d2cb2ee92fb8f9e10edf4ce6a1

SHA256
1d44136b48dbe3f2ec4834280c5430c2e2d31f64bedf6db6e38e5ec2a5f62813

SHA512
113dd7347b625b75553abe43ae44bce7653196d678c63adc8b2a7169ab4613fe20776f29e714c3a20dfb185d0b7d048d87c937bf1def0bbe3f52230da0b19e1d

Download Submit
C:\Windows\{419DF520-6D26-4f85-9B7F-6B656280A064}.exe

Filesize
197KB

MD5
19d088eee2cfc69cc9c2ef0b792907d3

SHA1
e42b31a5601390f239d71fae4f1a5b320be30d6c

SHA256
2cfd66abb08e443c507a43084c8a9b7ad42569709bbbba7dabb350a6757c6ff2

SHA512
1a7a9a69a348ffd7abe5f74c5baabb5e1a0b857189c8ec2ff652edfb6460966b284256a6b7078b251e3f15599a707344c55e79977f5f008f0514bba9509142a8

Download Submit
C:\Windows\{58AC873B-BBD4-48ec-9CE0-2F646993D602}.exe

Filesize
197KB

MD5
d7cf87208d1d55c67ea33a03317609ef

SHA1
dbe0a43c9b92015d591339fc91189ab3e3a0cbfc

SHA256
3e9adb306fad9765668576c5c6e63fbcfe62387c6d693e4cbcf7f043c665b98b

SHA512
fa6cf0ffe6954846e835adf423101d269f27eccd78ec89ea45af96337ff7b8271ca7ae4dbbc1b9b0c431800675864dc70159278fb8c49496a78edbab409bcc95

Download Submit
C:\Windows\{6402DC49-D2F1-4be7-9780-9B515345F769}.exe

Filesize
197KB

MD5
4fe23cb89ecbd2a136e96b155da6092d

SHA1
5d6c91c7f6155009f89511cd95c99c0b2f05ddf2

SHA256
b843caa52ab877e508d0ea17ae89dcf4c5f4bd128f4f68ae1b1c5dee917a9a48

SHA512
47f25cdeee9610aff58843ddc11a3bac268b478b0402edf54b27f6ea43657c1d3ac13ceb68b42cc085bdb9ce3cc88af72adbb6348da6330051c250199fcfeb9f

Download Submit
C:\Windows\{70699718-2DAB-4ece-9960-89CB57408770}.exe

Filesize
197KB

MD5
ed5df6c63251030e85620ea7d3329da4

SHA1
7060e1e01785edc83633e0b08246ffa9640e510a

SHA256
be8eea009bef439c05b4bc85099d4be70f4333077673d9e9f7207d2f18f03747

SHA512
a08183ea1fc56fd74c27d181041c268f9f63c848262bf5ea3e9ff493004d93915228c22ac910b73e7066da1989f84b799b3ee9461c6e32c489fb6eec80583155

Download Submit
C:\Windows\{73EFADB4-058C-4819-9DDC-3113D06E593F}.exe

Filesize
197KB

MD5
3d615f3acae94ffb6553e912d13c3213

SHA1
24ab7a4a3431f4f8cfb3dadd22fbbf57e8cf34c6

SHA256
b786427c41156d4393a467b7aeabc22c1e8ce9880c3c1661eab5ab14795f7d43

SHA512
916b0df4a4a020078199996acc538b3f05174a91e9b492263ef7130a18b34fae0d3ae7f82e6d735885f44af97e4986f4f30c41d06c758c83b4b6f3df559445f6

Download Submit
C:\Windows\{757584B8-00EB-4a63-80FD-17D7788306A3}.exe

Filesize
197KB

MD5
f4aaf05db8c87601c322eee75da51892

SHA1
7ba150c256262f787d981c2a7ab48463e213d9c5

SHA256
67990b3e4330a03c2c5e4bcb3ca0d6223a760eafa08172c5d00cb474df1c08e3

SHA512
a24381c82ca5ee024564fef31d5dea09ac26fe968250dac1e992e45b4ab535c18ef4f357574f3e7dc2adb017af5411893e8b630236d4015f7b16126ed0957eec

Download Submit
C:\Windows\{98C9A429-857E-4cbb-B905-8058CEB4E701}.exe

Filesize
197KB

MD5
bfc9d058d1da65abd3bd0fb2cd5fbd13

SHA1
4a71baa41fa573c5226f9d965fac8a8464ca6aa3

SHA256
bd447dded066d003b0e6628569093a68022167450b9aa129937c98885331cab6

SHA512
01cdc89196a6169fb59cff8e4785e6c84b70eb8b7b65340cbd7ca1e77a191033f1e194ee0107021276a2d9530146688f5fe5d571c1907d58fff84a9585995239

Download Submit
C:\Windows\{9A56944B-1433-445f-B747-1EB37B670D03}.exe

Filesize
197KB

MD5
7742a03173bc1aa26e35845e4b753983

SHA1
3090998ead9e72d4dd976a8385d0e2ebb98ea900

SHA256
10bd93a4feecc743c540a862e7c2ebaf493f41ef1232a2e5469c1cc0bcc7a5c7

SHA512
b9e01225a06d752e7ff86c293e4620485ab1b60fc2f1fdb224cf286f7a973ff00e651c7f8c0cdbcb176b5097b1be12bbfeb9ff7356f1c7a030fdfa3cfaff87d6

Download Submit
C:\Windows\{C6D2A342-B93D-43ab-83E6-765BA9C30244}.exe

Filesize
197KB

MD5
2a561a907e181ff44f8157ecc7327cab

SHA1
2db80c785e45da986eef702eaf2e4e29f32c2f3f

SHA256
40e763ce91caef388bcdbe21847f72f3200c68c776467f7ff91eb7614bce723c

SHA512
d63916f45a5ec7f48e06ef29f97bcdeb23117ecb2fb94832e0de290a06ff131bfff5a1a008e531abf9e88e9f574bd1a3dd8e9636496b5279aff5018cc3560b09

Download Submit
C:\Windows\{DDACA0F1-92EE-42a4-9969-5ECBA84831B6}.exe

Filesize
197KB

MD5
ec19649e46cbb2d7213d883a4ed8d43a

SHA1
03d942b8050bdf87fd936d91ab1c54193af26499

SHA256
717282eb2531d9a0dd2de0bcf4ba9b4e2ef26c66f77249b0e0093b1526cdfcd4

SHA512
2b5a4f4cc60cb703238eff01e368c97cf10232ebf4ccab27221bba044b81fe472c0482f2eb50f1bd9e1b71bc739c07fd0bb6c4f47f9abf9212ae4aaf7368b8aa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads