3cc38d338d425649ebe82030f4587a33473938199cebfdb7b7a9856cb01e6a41

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe
Size

197KB
MD5

eb713f1aa3be8b1683cee7da058978f9
SHA1

cd44abe8321f884db8482c424e86f3bdca015836
SHA256

3cc38d338d425649ebe82030f4587a33473938199cebfdb7b7a9856cb01e6a41
SHA512

bb79ec2006b5053f797583c36730fbe53cf3d7b454c23c52d3ba259e2e9cfa1dcff120ca7fca5866c3b937349d8f6c6ba12ee4cc1790ab907cec214cb01c19b7
SSDEEP

3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001560a-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015c5d-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001560a-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001560a-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015c5d-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001560a-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015c5d-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001560a-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015c5d-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEA38A17-C57A-4710-89FF-18F01D2391D2}	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}	{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D337EC8C-4A9C-488b-AF66-E6011EF79045}	{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D337EC8C-4A9C-488b-AF66-E6011EF79045}\stubpath = "C:\\Windows\\{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe"	{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D99E538A-6E66-41b0-9426-E2142876548A}\stubpath = "C:\\Windows\\{D99E538A-6E66-41b0-9426-E2142876548A}.exe"	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}\stubpath = "C:\\Windows\\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe"	{D99E538A-6E66-41b0-9426-E2142876548A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}\stubpath = "C:\\Windows\\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe"	{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}\stubpath = "C:\\Windows\\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe"	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B684D795-8633-469f-B122-05B1D82A248D}	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}\stubpath = "C:\\Windows\\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe"	{B684D795-8633-469f-B122-05B1D82A248D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D99E538A-6E66-41b0-9426-E2142876548A}	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}	{D99E538A-6E66-41b0-9426-E2142876548A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}\stubpath = "C:\\Windows\\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}.exe"	{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B42DDEA2-C934-4176-9299-A1E92038B47E}	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B42DDEA2-C934-4176-9299-A1E92038B47E}\stubpath = "C:\\Windows\\{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe"	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}	{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B684D795-8633-469f-B122-05B1D82A248D}\stubpath = "C:\\Windows\\{B684D795-8633-469f-B122-05B1D82A248D}.exe"	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}	{B684D795-8633-469f-B122-05B1D82A248D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEA38A17-C57A-4710-89FF-18F01D2391D2}\stubpath = "C:\\Windows\\{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe"	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A659FFF-FE69-4922-B62F-64CAD5C64684}	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A659FFF-FE69-4922-B62F-64CAD5C64684}\stubpath = "C:\\Windows\\{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe"	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe

Deletes itself 1 IoCs

pid	Process
2424	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe
2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe
2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe
372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe
1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
2400	{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
1192	{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
324	{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe
1568	{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	{D99E538A-6E66-41b0-9426-E2142876548A}.exe
File created	C:\Windows\{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
File created	C:\Windows\{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
File created	C:\Windows\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe	{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
File created	C:\Windows\{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe	{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
File created	C:\Windows\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}.exe	{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe
File created	C:\Windows\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe
File created	C:\Windows\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	{B684D795-8633-469f-B122-05B1D82A248D}.exe
File created	C:\Windows\{D99E538A-6E66-41b0-9426-E2142876548A}.exe	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
File created	C:\Windows\{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe
File created	C:\Windows\{B684D795-8633-469f-B122-05B1D82A248D}.exe	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe
Token: SeIncBasePriorityPrivilege	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe
Token: SeIncBasePriorityPrivilege	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
Token: SeIncBasePriorityPrivilege	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe
Token: SeIncBasePriorityPrivilege	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
Token: SeIncBasePriorityPrivilege	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe
Token: SeIncBasePriorityPrivilege	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
Token: SeIncBasePriorityPrivilege	2400	{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
Token: SeIncBasePriorityPrivilege	1192	{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
Token: SeIncBasePriorityPrivilege	324	{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2688	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	28
PID 1400 wrote to memory of 2688	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	28
PID 1400 wrote to memory of 2688	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	28
PID 1400 wrote to memory of 2688	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	28
PID 1400 wrote to memory of 2424	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	29
PID 1400 wrote to memory of 2424	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	29
PID 1400 wrote to memory of 2424	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	29
PID 1400 wrote to memory of 2424	1400	2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe	29
PID 2688 wrote to memory of 2712	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	32
PID 2688 wrote to memory of 2712	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	32
PID 2688 wrote to memory of 2712	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	32
PID 2688 wrote to memory of 2712	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	32
PID 2688 wrote to memory of 2596	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	33
PID 2688 wrote to memory of 2596	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	33
PID 2688 wrote to memory of 2596	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	33
PID 2688 wrote to memory of 2596	2688	{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe	33
PID 2712 wrote to memory of 2344	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	34
PID 2712 wrote to memory of 2344	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	34
PID 2712 wrote to memory of 2344	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	34
PID 2712 wrote to memory of 2344	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	34
PID 2712 wrote to memory of 2404	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	35
PID 2712 wrote to memory of 2404	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	35
PID 2712 wrote to memory of 2404	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	35
PID 2712 wrote to memory of 2404	2712	{B684D795-8633-469f-B122-05B1D82A248D}.exe	35
PID 2344 wrote to memory of 2848	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	36
PID 2344 wrote to memory of 2848	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	36
PID 2344 wrote to memory of 2848	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	36
PID 2344 wrote to memory of 2848	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	36
PID 2344 wrote to memory of 1300	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	37
PID 2344 wrote to memory of 1300	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	37
PID 2344 wrote to memory of 1300	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	37
PID 2344 wrote to memory of 1300	2344	{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe	37
PID 2848 wrote to memory of 372	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	38
PID 2848 wrote to memory of 372	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	38
PID 2848 wrote to memory of 372	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	38
PID 2848 wrote to memory of 372	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	38
PID 2848 wrote to memory of 840	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	39
PID 2848 wrote to memory of 840	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	39
PID 2848 wrote to memory of 840	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	39
PID 2848 wrote to memory of 840	2848	{D99E538A-6E66-41b0-9426-E2142876548A}.exe	39
PID 372 wrote to memory of 2816	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	40
PID 372 wrote to memory of 2816	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	40
PID 372 wrote to memory of 2816	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	40
PID 372 wrote to memory of 2816	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	40
PID 372 wrote to memory of 2372	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	41
PID 372 wrote to memory of 2372	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	41
PID 372 wrote to memory of 2372	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	41
PID 372 wrote to memory of 2372	372	{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe	41
PID 2816 wrote to memory of 1340	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	42
PID 2816 wrote to memory of 1340	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	42
PID 2816 wrote to memory of 1340	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	42
PID 2816 wrote to memory of 1340	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	42
PID 2816 wrote to memory of 2028	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	43
PID 2816 wrote to memory of 2028	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	43
PID 2816 wrote to memory of 2028	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	43
PID 2816 wrote to memory of 2028	2816	{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe	43
PID 1340 wrote to memory of 2400	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	44
PID 1340 wrote to memory of 2400	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	44
PID 1340 wrote to memory of 2400	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	44
PID 1340 wrote to memory of 2400	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	44
PID 1340 wrote to memory of 2592	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	45
PID 1340 wrote to memory of 2592	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	45
PID 1340 wrote to memory of 2592	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	45
PID 1340 wrote to memory of 2592	1340	{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_eb713f1aa3be8b1683cee7da058978f9_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe
  C:\Windows\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\{B684D795-8633-469f-B122-05B1D82A248D}.exe
    C:\Windows\{B684D795-8633-469f-B122-05B1D82A248D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
      C:\Windows\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Windows\{D99E538A-6E66-41b0-9426-E2142876548A}.exe
        
        C:\Windows\{D99E538A-6E66-41b0-9426-E2142876548A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
        
        C:\Windows\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe
        
        C:\Windows\{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
        
        C:\Windows\{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
        
        C:\Windows\{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
        
        C:\Windows\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
        
        C:\Windows\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe
        
        C:\Windows\{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
        
        C:\Windows\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}.exe
        
        C:\Windows\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}.exe
        12⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D337E~1.EXE > nul
        12⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B589~1.EXE > nul
        11⤵
        
        PID:592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B42DD~1.EXE > nul
        10⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A659~1.EXE > nul
        9⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CEA38~1.EXE > nul
        8⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B3CF6~1.EXE > nul
        7⤵
        
        PID:2372
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D99E5~1.EXE > nul
        6⤵
        
        PID:840
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EDA4E~1.EXE > nul
        5⤵
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B684D~1.EXE > nul
      4⤵
      PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F9969~1.EXE > nul
    3⤵
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1A659FFF-FE69-4922-B62F-64CAD5C64684}.exe

Filesize
197KB

MD5
0099ea893754f12b7e9864459cab3384

SHA1
4d418398b25ddaf98c27a9f96fbcce8e32740ac9

SHA256
5ebc4d5a33e6360a5152eb00732103daaf1105728622bb9609dc88903ac39f85

SHA512
57fb10f3a8a16b23a19b6d97acb35991a51c57652c0441ade56fc3d5f54014785f4b7cf43ef7ae3adc9fdf10f928a1410f9b355e995f29114b41ef0d1a044635

Download Submit
C:\Windows\{1B5896B1-D605-463f-8A9D-CBF55EE58DDC}.exe

Filesize
197KB

MD5
f8ac857e5c087a0d0ed7359eb305cb54

SHA1
b69e6ac801e7e5c645ac4b1cb6f784a36effad49

SHA256
66c405e370b187683c82f98dc3eca6c9898c07f95f68054cbbee71a4144d68cd

SHA512
d6eebb25fd490d02026340b2d7d28b5da587a455c597419d4ab505c92bb75c774c91ccddd6a711ea3be0d07f6aafcb729c41a23e6ae45da525c9ef48787945b1

Download Submit
C:\Windows\{5E16AFF5-4E84-4ef3-A5BB-8B81ABD2F61A}.exe

Filesize
197KB

MD5
104361ef8d30bd162329dc1c345368cb

SHA1
51d7e61406b2003fcf420ec79a1eb2150bc928ab

SHA256
fd06d372a4cee9ebed6090625238c537e2f4f654800c0f3df2822c52f9963e37

SHA512
142715faeedb9b9371851ae54bec9aa18f20b3ec2d2b56fc82744d81b0f7eeb09b8efc4578ead4b28d5c1c4d5f0f696ac66eda551da0a8df9267540c76d3bf74

Download Submit
C:\Windows\{B3CF6EC3-98F2-4592-BE99-0351B64F3AC2}.exe

Filesize
197KB

MD5
3bdea080af5ff7126fdc2ca3a035ca4b

SHA1
201925a8767ab25781bed0157966a0123593631c

SHA256
7174da13bfb1dedb6fcf7a306d72f4f17c374a5133a3bdb9d7ef96e93714ff16

SHA512
21d8140b2389687d47249010f47847d0904bf6c37f183a6ce2f25a57bfd4a6a83eb9d0f2eddda92746e871c2983210498393254d3ecff5ff1a210b03914b7082

Download Submit
C:\Windows\{B42DDEA2-C934-4176-9299-A1E92038B47E}.exe

Filesize
197KB

MD5
0483476e73b11cdec55a9f185ee3e465

SHA1
a8f67fbd4c1a2f845b7498c24f5ef960f67a3362

SHA256
2c95684f63658012145f0c2713dc36faa1b7f35010146980088909b5f862174d

SHA512
93037de0941bbb9dad21cb15f97933c74f79d008f3cbec89c1ee7cf26f71ef6578f657042de029bff330394b7a869be238b7ebe15ac8b7e27a0e4c0dd600d18e

Download Submit
C:\Windows\{B684D795-8633-469f-B122-05B1D82A248D}.exe

Filesize
197KB

MD5
4d73e4e02fd87d5d09fac80bb569659d

SHA1
85a4497040aa599ab57fdf3821a85481b3800ec5

SHA256
c2184eca2777e1546299a262ec119fca0ebe5b12fdcca1721e564d9201edc2f3

SHA512
056384d1d9754ecbeff2b89fcb7dd94c1548eccae9a30b72d242f92b6b4e84b8de69347afe1d4a3fb64319a407e13c17a4ca3c2e13d7754519d6d5458ec157e8

Download Submit
C:\Windows\{CEA38A17-C57A-4710-89FF-18F01D2391D2}.exe

Filesize
197KB

MD5
dd5abeff96c1b7d2f49d2610387f2257

SHA1
5c9e9623d4785094b5250a7bd352b315b74e35e6

SHA256
f7d76845c360926fe149d26a7714f97e4f915538111794e702fd48a7d7035b01

SHA512
48e5618507c3550b00d03d22d5669834e704069adde8d5a24714de9ae2e4901e09ec1d5876e9f007bf14cee63897d104a5c7e67f9460c18fcfc3413614be033e

Download Submit
C:\Windows\{D337EC8C-4A9C-488b-AF66-E6011EF79045}.exe

Filesize
197KB

MD5
0a4ae7a28da0230df3d6caedc9df483b

SHA1
c3b7842025966002d1655e7c5dd69a208a9ce814

SHA256
531dac128227134c0daca8ca6535d71317202dac036463b0f17a4d6b702317c6

SHA512
622ae8db8ded02d1609a98b2b53e489ebd7607187885fe2ba2caf827a02f0eb346845bbbab104ada74ed8b7922baddaea7c6bdfa31475fe43ab3f0fb1e07b836

Download Submit
C:\Windows\{D99E538A-6E66-41b0-9426-E2142876548A}.exe

Filesize
197KB

MD5
1316d7910018d8f51365e62349c92c7e

SHA1
020800981c171d16143c07f955b14d1441f67c21

SHA256
e323ec1397940860eb07fd00c6785ea8f0a2ffc64e747b3f511e841d1cbb74f2

SHA512
3661c7ef936f201357cbb8905291a9f5ec90f2893a3de6812b528c7cc56fe949586b69a8374ed08d682f9cc2733f3af15ea1acd557c7070ab3da4e8b0915586e

Download Submit
C:\Windows\{EDA4E507-1FAB-47ea-9432-A54C8A50F473}.exe

Filesize
197KB

MD5
ccfa57134aea9ce77b9bd86095ac596f

SHA1
03ddc11f52d36aa283c5692176a33e2b545e55f5

SHA256
ba02fc1ad370586b20dac9eff622a59986589f521278cbea49e1ac4c16b4230f

SHA512
bae97a2a94796cbab8e2badf6a7778392dda436e1c7540676feca18281ec294a0077f67e4458b429e8bbc1589ecbb51da1b80ac7a354b389d2a120233ad42cc5

Download Submit
C:\Windows\{F99698B9-57EE-4891-9F70-2E3F1B8E7AD6}.exe

Filesize
197KB

MD5
662d332fed889729be762ffde64e557a

SHA1
c4bc44f535fff7e88813fc4a887c29763b3597e2

SHA256
ef6b0a8f5b53e396adfa6226024c0ac428e8d8cd30b1d4c4ef70337794827a25

SHA512
394b92abdb463a96b1ec3d40886190a335ad039c6a75c927305e9b44fa9bab49acf0db91c6751a7baa66cf28cb4a178c7aa75855183631976d798706ec67f238

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads