9b51f4d68fbd1578e08837cdcf4bf84b1c61fdb75fad82ba1e1ebf6df905742d

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Size

180KB
MD5

9d48b85ba24e21c2043b38a2c8e6b03c
SHA1

f746d7414adc3189cb7415e9c4b246e34ca022e4
SHA256

9b51f4d68fbd1578e08837cdcf4bf84b1c61fdb75fad82ba1e1ebf6df905742d
SHA512

9b485ace8c7937747a25a695c74cd1e78dead2de57e603c431538be8ac9bb0adab27e20e40df2422bd96c246531117c0f87436c6096da311f1ef9c96fbf663ee
SSDEEP

3072:jEGh0o5lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGnl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015f7a-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000167d5-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015f7a-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000016a29-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015f7a-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015f7a-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015f7a-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C490406-1795-4c40-B434-48A6057599B8}\stubpath = "C:\\Windows\\{8C490406-1795-4c40-B434-48A6057599B8}.exe"	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E601C6B6-247B-4e14-AE51-D61797AFA502}	{8C490406-1795-4c40-B434-48A6057599B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E601C6B6-247B-4e14-AE51-D61797AFA502}\stubpath = "C:\\Windows\\{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe"	{8C490406-1795-4c40-B434-48A6057599B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC2EF85E-608E-4eed-8812-782CCED52101}\stubpath = "C:\\Windows\\{AC2EF85E-608E-4eed-8812-782CCED52101}.exe"	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A015DE8A-809B-4ff2-91B2-4A199B63E630}\stubpath = "C:\\Windows\\{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe"	{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B6D5B45-F555-4311-9EA8-B90497577B3B}\stubpath = "C:\\Windows\\{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe"	{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{03A7B779-B6A3-4f7c-A305-0B45FB551915}	{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{03A7B779-B6A3-4f7c-A305-0B45FB551915}\stubpath = "C:\\Windows\\{03A7B779-B6A3-4f7c-A305-0B45FB551915}.exe"	{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C490406-1795-4c40-B434-48A6057599B8}	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6D5582D5-E32E-4413-BFF9-15417D9085DA}	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6D5582D5-E32E-4413-BFF9-15417D9085DA}\stubpath = "C:\\Windows\\{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe"	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0DB7A949-8F7E-433a-B74B-01047D16553F}	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC2EF85E-608E-4eed-8812-782CCED52101}	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A015DE8A-809B-4ff2-91B2-4A199B63E630}	{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B6D5B45-F555-4311-9EA8-B90497577B3B}	{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0DB7A949-8F7E-433a-B74B-01047D16553F}\stubpath = "C:\\Windows\\{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe"	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}\stubpath = "C:\\Windows\\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe"	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}\stubpath = "C:\\Windows\\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe"	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}\stubpath = "C:\\Windows\\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe"	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe

Deletes itself 1 IoCs

pid	Process
2848	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe
1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe
2696	{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
2776	{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe
2052	{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe
1304	{03A7B779-B6A3-4f7c-A305-0B45FB551915}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
File created	C:\Windows\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
File created	C:\Windows\{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
File created	C:\Windows\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe
File created	C:\Windows\{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe	{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
File created	C:\Windows\{03A7B779-B6A3-4f7c-A305-0B45FB551915}.exe	{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe
File created	C:\Windows\{8C490406-1795-4c40-B434-48A6057599B8}.exe	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
File created	C:\Windows\{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	{8C490406-1795-4c40-B434-48A6057599B8}.exe
File created	C:\Windows\{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
File created	C:\Windows\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
File created	C:\Windows\{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe	{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe
Token: SeIncBasePriorityPrivilege	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
Token: SeIncBasePriorityPrivilege	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
Token: SeIncBasePriorityPrivilege	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
Token: SeIncBasePriorityPrivilege	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
Token: SeIncBasePriorityPrivilege	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
Token: SeIncBasePriorityPrivilege	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe
Token: SeIncBasePriorityPrivilege	2696	{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
Token: SeIncBasePriorityPrivilege	2776	{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe
Token: SeIncBasePriorityPrivilege	2052	{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2520	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	28
PID 1712 wrote to memory of 2520	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	28
PID 1712 wrote to memory of 2520	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	28
PID 1712 wrote to memory of 2520	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	28
PID 1712 wrote to memory of 2848	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	29
PID 1712 wrote to memory of 2848	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	29
PID 1712 wrote to memory of 2848	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	29
PID 1712 wrote to memory of 2848	1712	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	29
PID 2520 wrote to memory of 1324	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	30
PID 2520 wrote to memory of 1324	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	30
PID 2520 wrote to memory of 1324	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	30
PID 2520 wrote to memory of 1324	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	30
PID 2520 wrote to memory of 2996	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	31
PID 2520 wrote to memory of 2996	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	31
PID 2520 wrote to memory of 2996	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	31
PID 2520 wrote to memory of 2996	2520	{8C490406-1795-4c40-B434-48A6057599B8}.exe	31
PID 1324 wrote to memory of 2712	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	32
PID 1324 wrote to memory of 2712	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	32
PID 1324 wrote to memory of 2712	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	32
PID 1324 wrote to memory of 2712	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	32
PID 1324 wrote to memory of 2864	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	33
PID 1324 wrote to memory of 2864	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	33
PID 1324 wrote to memory of 2864	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	33
PID 1324 wrote to memory of 2864	1324	{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe	33
PID 2712 wrote to memory of 2440	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	36
PID 2712 wrote to memory of 2440	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	36
PID 2712 wrote to memory of 2440	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	36
PID 2712 wrote to memory of 2440	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	36
PID 2712 wrote to memory of 2472	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	37
PID 2712 wrote to memory of 2472	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	37
PID 2712 wrote to memory of 2472	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	37
PID 2712 wrote to memory of 2472	2712	{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe	37
PID 2440 wrote to memory of 2156	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	38
PID 2440 wrote to memory of 2156	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	38
PID 2440 wrote to memory of 2156	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	38
PID 2440 wrote to memory of 2156	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	38
PID 2440 wrote to memory of 2964	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	39
PID 2440 wrote to memory of 2964	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	39
PID 2440 wrote to memory of 2964	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	39
PID 2440 wrote to memory of 2964	2440	{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe	39
PID 2156 wrote to memory of 1212	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	40
PID 2156 wrote to memory of 1212	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	40
PID 2156 wrote to memory of 1212	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	40
PID 2156 wrote to memory of 1212	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	40
PID 2156 wrote to memory of 1976	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	41
PID 2156 wrote to memory of 1976	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	41
PID 2156 wrote to memory of 1976	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	41
PID 2156 wrote to memory of 1976	2156	{AC2EF85E-608E-4eed-8812-782CCED52101}.exe	41
PID 1212 wrote to memory of 2040	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	42
PID 1212 wrote to memory of 2040	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	42
PID 1212 wrote to memory of 2040	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	42
PID 1212 wrote to memory of 2040	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	42
PID 1212 wrote to memory of 1912	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	43
PID 1212 wrote to memory of 1912	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	43
PID 1212 wrote to memory of 1912	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	43
PID 1212 wrote to memory of 1912	1212	{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe	43
PID 2040 wrote to memory of 2696	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	44
PID 2040 wrote to memory of 2696	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	44
PID 2040 wrote to memory of 2696	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	44
PID 2040 wrote to memory of 2696	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	44
PID 2040 wrote to memory of 1932	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	45
PID 2040 wrote to memory of 1932	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	45
PID 2040 wrote to memory of 1932	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	45
PID 2040 wrote to memory of 1932	2040	{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\{8C490406-1795-4c40-B434-48A6057599B8}.exe
  C:\Windows\{8C490406-1795-4c40-B434-48A6057599B8}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
    C:\Windows\{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
      C:\Windows\{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
        
        C:\Windows\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Windows\{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
        
        C:\Windows\{AC2EF85E-608E-4eed-8812-782CCED52101}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
        
        C:\Windows\{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe
        
        C:\Windows\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
        
        C:\Windows\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Windows\{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe
        
        C:\Windows\{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe
        
        C:\Windows\{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Windows\{03A7B779-B6A3-4f7c-A305-0B45FB551915}.exe
        
        C:\Windows\{03A7B779-B6A3-4f7c-A305-0B45FB551915}.exe
        12⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6B6D5~1.EXE > nul
        12⤵
        
        PID:956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A015D~1.EXE > nul
        11⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0DFA~1.EXE > nul
        10⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CC82B~1.EXE > nul
        9⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D558~1.EXE > nul
        8⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AC2EF~1.EXE > nul
        7⤵
        
        PID:1976
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C31E0~1.EXE > nul
        6⤵
        
        PID:2964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0DB7A~1.EXE > nul
        5⤵
        
        PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E601C~1.EXE > nul
      4⤵
      PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8C490~1.EXE > nul
    3⤵
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{03A7B779-B6A3-4f7c-A305-0B45FB551915}.exe

Filesize
180KB

MD5
5eaffb42cd10f5f588ecf7d22b0f59d5

SHA1
8c23407a4b3273c53f71d45a255870b5164a03bc

SHA256
f0ef05766a5f3ac391cc4ec027df80c2061ad2bbe7b471fa4da30a1c6033443d

SHA512
5f56371ed3e973004a8dae40205033ab795237f2179a7b34e90dfd680f9f95105b971116bb6b6251424472381b7bcaf7958d950e922e051a4c4b772c98445a2d

Download Submit
C:\Windows\{0DB7A949-8F7E-433a-B74B-01047D16553F}.exe

Filesize
180KB

MD5
1c35bac7e6288746ac77482850b7c68e

SHA1
44c7d11063e37e1e79ae415761bd1857214a23f1

SHA256
0742558517a4e948d122abc0b471a37638b90979e378877c7bdd6f7d5b50360d

SHA512
d5d2a510ba3717ff8781335b01063c7e50610b5d7de74156230bf0cb8d3246dc6c9adf1e1b36cbfcff1782067f09cefb4578703c32abadf903a760366753b70a

Download Submit
C:\Windows\{6B6D5B45-F555-4311-9EA8-B90497577B3B}.exe

Filesize
180KB

MD5
f1b61c0419fc3ad8c1b28eb9017c27a2

SHA1
87538a731a48c685e1f0ae757d8d5e3ce4e1ea65

SHA256
95b5b68304202ff863550233d6412f679c661d819191f2f956e96bca8ec93ce1

SHA512
8edfef19f30a2e8f8c216d94950f299317b4a6d81ecbd9a3a22d52ae83d64d47a3e2bfce04b43209628c17a877ac2895d6a4c044451abf64a9624ceb31832c56

Download Submit
C:\Windows\{6D5582D5-E32E-4413-BFF9-15417D9085DA}.exe

Filesize
180KB

MD5
db0c9fd24e125831aa119c11f645192c

SHA1
f52d60ae9f53e039e3985524a851950bd806ffbb

SHA256
0d4afe47dcc7aee03dc5e55778116726f29998c092411dd014635683fb043cbd

SHA512
1328931abad4560cb37a8b8252b301c5fc3077be949595fd9f19b3b08f6f818d5e295521572d0f499a1a071aaf16da870f45020892a47e6ec1b5776705e4f75c

Download Submit
C:\Windows\{8C490406-1795-4c40-B434-48A6057599B8}.exe

Filesize
180KB

MD5
56b655bbc800997adee1aa9cf190bb91

SHA1
05fa4d887e15f792106ab17b97c9cb33939fbd78

SHA256
eb400562b3c10136b3b98802c56de0e0fd340a694ce39f4234e8395a4a5fab49

SHA512
a67c77c6b9c5f7934c450f2557269de46869c341bcb33b26aa1881e99a3eab0ffe49bcc7a766bbf8c22e94979da411b96beb933f5c210240d5be8fff42d9457f

Download Submit
C:\Windows\{A015DE8A-809B-4ff2-91B2-4A199B63E630}.exe

Filesize
180KB

MD5
06003c176c62716b2d015db7803d220c

SHA1
2b3cb4d20512374b2cf94f915db1ae918db27ea7

SHA256
e4ea758c8d389d4bad350f340a64b22cdfc17ad2169e1975f4a218d76f6bdc7c

SHA512
3dce5e6813848c37afaabfe47214a6c11a9bc177ae780d8a82ebb381434937c2c7431d6ab46576601c24f56eaee730a373ce791e29ccd763340eee528f3855bf

Download Submit
C:\Windows\{A0DFA86E-16C2-4a6f-83C3-B0F4E4339F52}.exe

Filesize
180KB

MD5
d769cd0c68db281759ab19e4103fcda7

SHA1
cd9513e1d1118b9e514632ba6a839ec6b7f630a7

SHA256
07139e7aadb2ff2e7b285ac1a8c3cb190f0ea487a05a48e18ce214fb6ddf9515

SHA512
e2b6361a14a05b067afdc7f1e9bbf5979b93ed0b42e9925ce49d1d6e732e3e583b80db18afe25faedd5ed4fdac4b3fcbb1c33f2fb13aaf3232b50a3569fa3641

Download Submit
C:\Windows\{AC2EF85E-608E-4eed-8812-782CCED52101}.exe

Filesize
180KB

MD5
1e1e49e32826097b38911a8daa583d1c

SHA1
0dd27fb83b1c54b20e24386b18bd5fa70014637c

SHA256
ab9c9647c1ca5f02e3d1cb0d599d0c6dceaf603664456bcf65a40df17eb31aad

SHA512
c6bb9d1c4c07b0bf7972041876e14eba456641a665b0423bfa966f97669b990fecb547149a18c551312ae75f7029b22a417d291cf4be41ae3d2aa4a3691bc02b

Download Submit
C:\Windows\{C31E04E6-3C85-4269-9590-F93D5CF8DEB2}.exe

Filesize
180KB

MD5
1de2784fba7bd8467d9db5e5114d0ac9

SHA1
adc1675215bd98be60384855be0fb06866799f94

SHA256
2784ad29ae57bbe403c11fba25c69d4c3ff75f7ca3cbd3964654580985754789

SHA512
eb06c06a595ebbf49632e8b45d0f7be1c3c5c734288eb4e77a6e6aa1033c45b20d24ae1fcc18a730e2d519ac89062377527bacf39fcff39cba9eb4e6502a1f89

Download Submit
C:\Windows\{CC82B69D-6DBA-48e0-923E-02BAD3E0A66E}.exe

Filesize
180KB

MD5
298002b1c07b5c9b47b839e3a945dd30

SHA1
73509ba3695ed83863417fc4b2cb45d2ba6fb7a0

SHA256
4ad384383e11eaae55cdc12b204e3dbfa87d1659be86145432a9e720a38693d6

SHA512
ad44654a8a09a4e1bd087abb746fe9267eeb88986bab383f2782c8ddaf5c3f22a8884bf051d3e84f61b33916711000e3085ed4eeb6a7ce176b9b0a44f165111c

Download Submit
C:\Windows\{E601C6B6-247B-4e14-AE51-D61797AFA502}.exe

Filesize
180KB

MD5
90b047794cd66edca77ed236ca6083e5

SHA1
1824958440ebd2d0da86d629cdcd60d48af9e97d

SHA256
52dadf8a5afe0b911716fc8d4c767b502915053de8ece622453d496f7151d951

SHA512
b66248eb9a527e86ae7ee764ed975a092982e0531adac99ee121771e81891402d27da888594081e39f561806c74282dc8d20c064e1eae2fa986b9b705873239b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads