b61b64190517ae8492e87e191f76cf8fccc2770a6cda0266071f0cae2cdecd3d

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe
Size

344KB
MD5

54be686c600b9abace98e9850f72fa24
SHA1

8b2e3e0f0a8cca58ce7046d0018731ad1c028d83
SHA256

b61b64190517ae8492e87e191f76cf8fccc2770a6cda0266071f0cae2cdecd3d
SHA512

996b8ab55e29a3366ad9d9ecfda4cb0a123015ea4df1c968725abd3a16e127b5d3441e973da425183c81ab5aa5ed59f9533b094596f055051c9f42b9808bd8c3
SSDEEP

3072:mEGh0o7lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGRlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000015cd2-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0031000000015d39-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015cd2-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0031000000015d59-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015cd2-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000015cd2-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000015cd2-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00953721-60A3-49f2-9746-B65CB1B8E2FF}\stubpath = "C:\\Windows\\{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe"	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46423FCF-E791-490e-B577-A93035827A03}\stubpath = "C:\\Windows\\{46423FCF-E791-490e-B577-A93035827A03}.exe"	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}	{46423FCF-E791-490e-B577-A93035827A03}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{409CE841-BD91-4219-8C5F-41D9CE618541}	{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{130820D8-83B7-4199-AFEB-8E439FF725DD}\stubpath = "C:\\Windows\\{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe"	{409CE841-BD91-4219-8C5F-41D9CE618541}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C121393-4E79-4a9a-BA51-334383148ADC}	{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C121393-4E79-4a9a-BA51-334383148ADC}\stubpath = "C:\\Windows\\{8C121393-4E79-4a9a-BA51-334383148ADC}.exe"	{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}\stubpath = "C:\\Windows\\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe"	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46423FCF-E791-490e-B577-A93035827A03}	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}\stubpath = "C:\\Windows\\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe"	{46423FCF-E791-490e-B577-A93035827A03}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{130820D8-83B7-4199-AFEB-8E439FF725DD}	{409CE841-BD91-4219-8C5F-41D9CE618541}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}\stubpath = "C:\\Windows\\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe"	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}\stubpath = "C:\\Windows\\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe"	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}\stubpath = "C:\\Windows\\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe"	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}\stubpath = "C:\\Windows\\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe"	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00953721-60A3-49f2-9746-B65CB1B8E2FF}	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{409CE841-BD91-4219-8C5F-41D9CE618541}\stubpath = "C:\\Windows\\{409CE841-BD91-4219-8C5F-41D9CE618541}.exe"	{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe

Deletes itself 1 IoCs

pid	Process
3020	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe
2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
1356	{46423FCF-E791-490e-B577-A93035827A03}.exe
2016	{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
1952	{409CE841-BD91-4219-8C5F-41D9CE618541}.exe
1744	{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe
2712	{8C121393-4E79-4a9a-BA51-334383148ADC}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
File created	C:\Windows\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
File created	C:\Windows\{46423FCF-E791-490e-B577-A93035827A03}.exe	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
File created	C:\Windows\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe	{46423FCF-E791-490e-B577-A93035827A03}.exe
File created	C:\Windows\{409CE841-BD91-4219-8C5F-41D9CE618541}.exe	{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
File created	C:\Windows\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe
File created	C:\Windows\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe
File created	C:\Windows\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
File created	C:\Windows\{8C121393-4E79-4a9a-BA51-334383148ADC}.exe	{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe
File created	C:\Windows\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
File created	C:\Windows\{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe	{409CE841-BD91-4219-8C5F-41D9CE618541}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe
Token: SeIncBasePriorityPrivilege	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
Token: SeIncBasePriorityPrivilege	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
Token: SeIncBasePriorityPrivilege	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
Token: SeIncBasePriorityPrivilege	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
Token: SeIncBasePriorityPrivilege	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
Token: SeIncBasePriorityPrivilege	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe
Token: SeIncBasePriorityPrivilege	2016	{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
Token: SeIncBasePriorityPrivilege	1952	{409CE841-BD91-4219-8C5F-41D9CE618541}.exe
Token: SeIncBasePriorityPrivilege	1744	{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2572	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	29
PID 2340 wrote to memory of 2572	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	29
PID 2340 wrote to memory of 2572	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	29
PID 2340 wrote to memory of 2572	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	29
PID 2340 wrote to memory of 3020	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	30
PID 2340 wrote to memory of 3020	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	30
PID 2340 wrote to memory of 3020	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	30
PID 2340 wrote to memory of 3020	2340	2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe	30
PID 2572 wrote to memory of 2536	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	31
PID 2572 wrote to memory of 2536	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	31
PID 2572 wrote to memory of 2536	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	31
PID 2572 wrote to memory of 2536	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	31
PID 2572 wrote to memory of 1040	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	32
PID 2572 wrote to memory of 1040	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	32
PID 2572 wrote to memory of 1040	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	32
PID 2572 wrote to memory of 1040	2572	{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe	32
PID 2536 wrote to memory of 2408	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	33
PID 2536 wrote to memory of 2408	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	33
PID 2536 wrote to memory of 2408	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	33
PID 2536 wrote to memory of 2408	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	33
PID 2536 wrote to memory of 2440	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	34
PID 2536 wrote to memory of 2440	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	34
PID 2536 wrote to memory of 2440	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	34
PID 2536 wrote to memory of 2440	2536	{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe	34
PID 2408 wrote to memory of 1516	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	37
PID 2408 wrote to memory of 1516	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	37
PID 2408 wrote to memory of 1516	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	37
PID 2408 wrote to memory of 1516	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	37
PID 2408 wrote to memory of 1512	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	38
PID 2408 wrote to memory of 1512	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	38
PID 2408 wrote to memory of 1512	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	38
PID 2408 wrote to memory of 1512	2408	{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe	38
PID 1516 wrote to memory of 2472	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	39
PID 1516 wrote to memory of 2472	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	39
PID 1516 wrote to memory of 2472	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	39
PID 1516 wrote to memory of 2472	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	39
PID 1516 wrote to memory of 2828	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	40
PID 1516 wrote to memory of 2828	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	40
PID 1516 wrote to memory of 2828	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	40
PID 1516 wrote to memory of 2828	1516	{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe	40
PID 2472 wrote to memory of 1448	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	41
PID 2472 wrote to memory of 1448	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	41
PID 2472 wrote to memory of 1448	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	41
PID 2472 wrote to memory of 1448	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	41
PID 2472 wrote to memory of 1572	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	42
PID 2472 wrote to memory of 1572	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	42
PID 2472 wrote to memory of 1572	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	42
PID 2472 wrote to memory of 1572	2472	{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe	42
PID 1448 wrote to memory of 1356	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	43
PID 1448 wrote to memory of 1356	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	43
PID 1448 wrote to memory of 1356	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	43
PID 1448 wrote to memory of 1356	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	43
PID 1448 wrote to memory of 1316	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	44
PID 1448 wrote to memory of 1316	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	44
PID 1448 wrote to memory of 1316	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	44
PID 1448 wrote to memory of 1316	1448	{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe	44
PID 1356 wrote to memory of 2016	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	45
PID 1356 wrote to memory of 2016	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	45
PID 1356 wrote to memory of 2016	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	45
PID 1356 wrote to memory of 2016	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	45
PID 1356 wrote to memory of 2024	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	46
PID 1356 wrote to memory of 2024	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	46
PID 1356 wrote to memory of 2024	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	46
PID 1356 wrote to memory of 2024	1356	{46423FCF-E791-490e-B577-A93035827A03}.exe	46

C:\Users\Admin\AppData\Local\Temp\2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_54be686c600b9abace98e9850f72fa24_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe
  C:\Windows\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
    C:\Windows\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
      C:\Windows\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
        
        C:\Windows\{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1516
      - C:\Windows\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
        
        C:\Windows\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
        
        C:\Windows\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\{46423FCF-E791-490e-B577-A93035827A03}.exe
        
        C:\Windows\{46423FCF-E791-490e-B577-A93035827A03}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
        
        C:\Windows\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\{409CE841-BD91-4219-8C5F-41D9CE618541}.exe
        
        C:\Windows\{409CE841-BD91-4219-8C5F-41D9CE618541}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe
        
        C:\Windows\{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\{8C121393-4E79-4a9a-BA51-334383148ADC}.exe
        
        C:\Windows\{8C121393-4E79-4a9a-BA51-334383148ADC}.exe
        12⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13082~1.EXE > nul
        12⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{409CE~1.EXE > nul
        11⤵
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B3C02~1.EXE > nul
        10⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46423~1.EXE > nul
        9⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D8AF~1.EXE > nul
        8⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A3E8~1.EXE > nul
        7⤵
        
        PID:1572
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00953~1.EXE > nul
        6⤵
        
        PID:2828
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6AA2C~1.EXE > nul
        5⤵
        
        PID:1512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CC5A4~1.EXE > nul
      4⤵
      PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{AAF72~1.EXE > nul
    3⤵
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00953721-60A3-49f2-9746-B65CB1B8E2FF}.exe

Filesize
344KB

MD5
c1eaf13ed10b2cf4e8eed848584f0903

SHA1
462bdfe1f196a721145c152cd0408413fd71ab63

SHA256
a59f9cc6ed4bd8f035564913d1ae3fede7e6570c9702b4fcf841ee73112aa89e

SHA512
a9ee18c995997e41c575e61d434911c4cb2ffb2fab0dbade2453b0dbd9c87ad0403c3186f14c35310963c33acb9f87632fa3f57c798b5ebf420c91b2db174a91

Download Submit
C:\Windows\{130820D8-83B7-4199-AFEB-8E439FF725DD}.exe

Filesize
344KB

MD5
26f26179ea5330da937173b7adec35be

SHA1
a420fdf291656fdd789e6a24d34e70049231f988

SHA256
43ad0a059ab235389edc8b3b4dd2d6bc48f85cd3dbd9b606d098f6770ba3d499

SHA512
4f19647d1c4e4887e0eebc35f865e22156caff798d55e015bb9a5085868b604174ce9bbfed23ef78c9d00ee1131c065adc41430917ed4f6a2e89828f2415b9d6

Download Submit
C:\Windows\{2D8AFCD1-1DB2-443f-ACBC-BF263D7D3660}.exe

Filesize
344KB

MD5
9d047c72a467d7ae916d996583de9a0b

SHA1
e71dc8d2b3fe528f244b7b0a24b158e06525f2e3

SHA256
7df3ee9c43f90ec01724756b1451ff4f7ee53bd2471a1007a42b3397eb0af64b

SHA512
bf1ddb964490a0f305fc03bfc3edec9113885ee5fadc4e02051ed91118491dbd810df5c094ce21fdaea2c22b89a8d31c87fbae283501f9bca037b5271b4d10ac

Download Submit
C:\Windows\{409CE841-BD91-4219-8C5F-41D9CE618541}.exe

Filesize
344KB

MD5
48925654011b064a1cb9b0dae9668301

SHA1
dab31b8aa360d6bbab546d1c275fe130d26ce07f

SHA256
8d0527a8acbbe30fb4b224c80d9c47318d71ebb5fe8f030992840eb4f7505803

SHA512
44f469e2dcdf8b270cceacf6bdceb6d616e8913b227977204d20b3c37c61fe59cb0b6699eac1a6248b1e10fc3fda9baae526aee8fd221681fc6330841cd8351d

Download Submit
C:\Windows\{46423FCF-E791-490e-B577-A93035827A03}.exe

Filesize
344KB

MD5
9a2ad5c0c716e02f28ba9fd4f43eab49

SHA1
240a62b28837f69a43b93f84b94924b7a674771e

SHA256
22256d0b41c20715a0761d81d9e2e6a973328f07e8d90f0dcadb18d3c4053aab

SHA512
2a53092bf06fd7b921e137e047842cb9e73264e8d702368f0066d42ec157c7aca9aa5ae4998b45b0c275b5651b423a283a4e93e96d2b505eda64a3f174b99087

Download Submit
C:\Windows\{6AA2C6CE-2365-4954-8E45-F2CD3A964FCC}.exe

Filesize
344KB

MD5
002cddeaa648aa31215dec02667cf2b0

SHA1
45079003c63505128338f49e188ef7b02e8eed81

SHA256
82c51a5687e9db397727f95ff53591f073bff3723ce2c7c96036ca9877ff36e8

SHA512
20a0eeca1492faca4832e4c8d6a39c0dd8efa7832d9397b407eeb2cfa62d6fbfb6183f21b9371a02b9e81cdd302fd6e1a903a2e29b4f0eae5c2d7413dcd24306

Download Submit
C:\Windows\{7A3E863B-0F96-465e-945C-4CCF2B1FE436}.exe

Filesize
344KB

MD5
1d0e25ca2b009af1bbe99bd393d6dd6d

SHA1
45197c4f11177b393d8db3618505ab3f61f06213

SHA256
75dd6e6ef9e2ea1829be87328c2358c6fdb6e228aabe8d86d8feea6835e8b4d5

SHA512
48e411646ba144f370e8d0a95b7b8155b6ab12382a48d48f3f0125e7336fb2d6e88563cedc1200081d1496c168b1ce61d3450eafafeebe73c150d44f3105e396

Download Submit
C:\Windows\{8C121393-4E79-4a9a-BA51-334383148ADC}.exe

Filesize
344KB

MD5
6cd51b7b6177736da19941cbc8bc365f

SHA1
f66ef67fcd2c42738072620e2425e3efdc39787c

SHA256
81e1759ba2a0d4356d7922176e886b34848c48174a5b802d58d19e2dd07a071d

SHA512
bf291944a481a92eef7e438ff890484070487a0bed43186875ceaf8e33ddf0cfbf6b9762bafb0393164ef3e38f08a90b2bf290965f4b5929acc87b8088afab45

Download Submit
C:\Windows\{AAF72FA3-4760-4a1e-9BA2-7269CF390037}.exe

Filesize
344KB

MD5
f652c9796a49715b3db9d3c1160f4798

SHA1
54780e9ca7a0605b6b7a5d545dac5e4186ef6d26

SHA256
e6b79a009c7d6d0f085a1eb966bc3681cf2371b0c6433ae87dfd7774feb3e66b

SHA512
64547dcf8161258049fdf58b2b41717535be89046bfd3a8f8ba6a26a643b4f964fb679646d04aa9baaa52170e1110a9e79084e1db8e614bac6d42249c58bd04f

Download Submit
C:\Windows\{B3C028A1-788C-4cb8-9A58-16D4AD171FA5}.exe

Filesize
344KB

MD5
644f75882eb370d399c5b647184e3aa6

SHA1
f1f33f43b1ef4f5bffe7df1c4e9768fbf292bb04

SHA256
33d014886a4d1e9a92fcc25cdf4e66ef1d67cb9c8fc991341390f8e86f552f8c

SHA512
ee31b14f57fe407ebf01b9326792dbdd6f64ea276f41e20e9da91da65fec153eb029428e95859020c5b49fdf22c9d7ae0641d0abee819bcee2d2c10dfc50554d

Download Submit
C:\Windows\{CC5A4F20-5FAB-4e8e-8F20-3C0700DECDD5}.exe

Filesize
344KB

MD5
9a94d9949ed5c9cbf57fe3aa29865515

SHA1
8c3a4e14a6d0108e1d02c9c847b6b8a51109d522

SHA256
9edc4369beda366c249cf331d179a93e2df8b10e87ec2043cd58743afbafed0e

SHA512
f5e4686d71379509522981c56db2be85f2661c8c612eeaf5a36fac6c503f3ad76e43a98b3e337cb332410ca766e079c276d9046dabc888cf2638d01811d066fa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads