9b32b9837b2db2fe31a3906979999d7663c41227e104c868c7d6e510a7ec97fb

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe
Size

372KB
MD5

3e8daeffa4ab772c76221d28415f2809
SHA1

e25f64deca938bd799deccd01a9c065d7726efbc
SHA256

9b32b9837b2db2fe31a3906979999d7663c41227e104c868c7d6e510a7ec97fb
SHA512

abad844504e40ff18f8d76aa7df0ea477d118ffc8046e6cbd344c3c3cf96ae2310ca8ce65e32bac4a9c66743323a0608efc97903ba027cdb0bb6fdf0ba02e0e6
SSDEEP

3072:CEGh0oWlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGolkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000015cb1-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015d21-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015cb1-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000015d39-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015cb1-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000015cb1-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000015cb1-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22796916-FAB6-4505-BAF4-D836044EBEE0}\stubpath = "C:\\Windows\\{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe"	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}\stubpath = "C:\\Windows\\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe"	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB3D5334-80EB-43bc-93E8-954D9E616A20}	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C91081F8-32C4-488b-987C-E5ED75CFEC21}	{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0240DB31-0198-406d-B26D-AD869554C66A}\stubpath = "C:\\Windows\\{0240DB31-0198-406d-B26D-AD869554C66A}.exe"	{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}\stubpath = "C:\\Windows\\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe"	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}	{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}\stubpath = "C:\\Windows\\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe"	{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C91081F8-32C4-488b-987C-E5ED75CFEC21}\stubpath = "C:\\Windows\\{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe"	{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22796916-FAB6-4505-BAF4-D836044EBEE0}	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05D7549B-CF1F-4bec-841A-810A21768D59}	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05D7549B-CF1F-4bec-841A-810A21768D59}\stubpath = "C:\\Windows\\{05D7549B-CF1F-4bec-841A-810A21768D59}.exe"	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}\stubpath = "C:\\Windows\\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe"	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB3D5334-80EB-43bc-93E8-954D9E616A20}\stubpath = "C:\\Windows\\{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe"	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0240DB31-0198-406d-B26D-AD869554C66A}	{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}\stubpath = "C:\\Windows\\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe"	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}\stubpath = "C:\\Windows\\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe"	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe

Executes dropped EXE 11 IoCs

pid	Process
2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe
356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
2296	{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
2872	{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
2120	{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe
1292	{0240DB31-0198-406d-B26D-AD869554C66A}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe
File created	C:\Windows\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
File created	C:\Windows\{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
File created	C:\Windows\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe
File created	C:\Windows\{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe	{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
File created	C:\Windows\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
File created	C:\Windows\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
File created	C:\Windows\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
File created	C:\Windows\{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
File created	C:\Windows\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe	{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
File created	C:\Windows\{0240DB31-0198-406d-B26D-AD869554C66A}.exe	{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
Token: SeIncBasePriorityPrivilege	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
Token: SeIncBasePriorityPrivilege	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
Token: SeIncBasePriorityPrivilege	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
Token: SeIncBasePriorityPrivilege	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
Token: SeIncBasePriorityPrivilege	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe
Token: SeIncBasePriorityPrivilege	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
Token: SeIncBasePriorityPrivilege	2296	{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
Token: SeIncBasePriorityPrivilege	2872	{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
Token: SeIncBasePriorityPrivilege	2120	{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2888	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	28
PID 2768 wrote to memory of 2888	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	28
PID 2768 wrote to memory of 2888	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	28
PID 2768 wrote to memory of 2888	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	28
PID 2768 wrote to memory of 3048	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	29
PID 2768 wrote to memory of 3048	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	29
PID 2768 wrote to memory of 3048	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	29
PID 2768 wrote to memory of 3048	2768	2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe	29
PID 2888 wrote to memory of 2792	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	30
PID 2888 wrote to memory of 2792	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	30
PID 2888 wrote to memory of 2792	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	30
PID 2888 wrote to memory of 2792	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	30
PID 2888 wrote to memory of 2396	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	31
PID 2888 wrote to memory of 2396	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	31
PID 2888 wrote to memory of 2396	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	31
PID 2888 wrote to memory of 2396	2888	{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe	31
PID 2792 wrote to memory of 2416	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	32
PID 2792 wrote to memory of 2416	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	32
PID 2792 wrote to memory of 2416	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	32
PID 2792 wrote to memory of 2416	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	32
PID 2792 wrote to memory of 2528	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	33
PID 2792 wrote to memory of 2528	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	33
PID 2792 wrote to memory of 2528	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	33
PID 2792 wrote to memory of 2528	2792	{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe	33
PID 2416 wrote to memory of 2876	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	36
PID 2416 wrote to memory of 2876	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	36
PID 2416 wrote to memory of 2876	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	36
PID 2416 wrote to memory of 2876	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	36
PID 2416 wrote to memory of 328	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	37
PID 2416 wrote to memory of 328	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	37
PID 2416 wrote to memory of 328	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	37
PID 2416 wrote to memory of 328	2416	{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe	37
PID 2876 wrote to memory of 840	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	38
PID 2876 wrote to memory of 840	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	38
PID 2876 wrote to memory of 840	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	38
PID 2876 wrote to memory of 840	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	38
PID 2876 wrote to memory of 2668	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	39
PID 2876 wrote to memory of 2668	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	39
PID 2876 wrote to memory of 2668	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	39
PID 2876 wrote to memory of 2668	2876	{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe	39
PID 840 wrote to memory of 2316	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	40
PID 840 wrote to memory of 2316	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	40
PID 840 wrote to memory of 2316	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	40
PID 840 wrote to memory of 2316	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	40
PID 840 wrote to memory of 2168	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	41
PID 840 wrote to memory of 2168	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	41
PID 840 wrote to memory of 2168	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	41
PID 840 wrote to memory of 2168	840	{05D7549B-CF1F-4bec-841A-810A21768D59}.exe	41
PID 2316 wrote to memory of 356	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	42
PID 2316 wrote to memory of 356	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	42
PID 2316 wrote to memory of 356	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	42
PID 2316 wrote to memory of 356	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	42
PID 2316 wrote to memory of 1600	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	43
PID 2316 wrote to memory of 1600	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	43
PID 2316 wrote to memory of 1600	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	43
PID 2316 wrote to memory of 1600	2316	{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe	43
PID 356 wrote to memory of 2296	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	44
PID 356 wrote to memory of 2296	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	44
PID 356 wrote to memory of 2296	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	44
PID 356 wrote to memory of 2296	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	44
PID 356 wrote to memory of 1056	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	45
PID 356 wrote to memory of 1056	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	45
PID 356 wrote to memory of 1056	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	45
PID 356 wrote to memory of 1056	356	{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_3e8daeffa4ab772c76221d28415f2809_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
  C:\Windows\{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
    C:\Windows\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
      C:\Windows\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Windows\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
        
        C:\Windows\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
        
        C:\Windows\{05D7549B-CF1F-4bec-841A-810A21768D59}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe
        
        C:\Windows\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
        
        C:\Windows\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:356
        
        C:\Windows\{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
        
        C:\Windows\{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
        
        C:\Windows\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
        
        C:\Windows\{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe
        
        C:\Windows\{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\{0240DB31-0198-406d-B26D-AD869554C66A}.exe
        
        C:\Windows\{0240DB31-0198-406d-B26D-AD869554C66A}.exe
        12⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9108~1.EXE > nul
        12⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1C2DE~1.EXE > nul
        11⤵
        
        PID:488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CB3D5~1.EXE > nul
        10⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6BBCF~1.EXE > nul
        9⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0A0D~1.EXE > nul
        8⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05D75~1.EXE > nul
        7⤵
        
        PID:2168
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{33EE2~1.EXE > nul
        6⤵
        
        PID:2668
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA427~1.EXE > nul
        5⤵
        
        PID:328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{34CC4~1.EXE > nul
      4⤵
      PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{22796~1.EXE > nul
    3⤵
    PID:2396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0240DB31-0198-406d-B26D-AD869554C66A}.exe

Filesize
372KB

MD5
11697067d8396cd13f1b70614244b982

SHA1
f39ee45dcb4322366d799ca6e266cbeba22f9102

SHA256
bd019446eae8db6cc027ddec335e5f652c6666fba294307be252b6bf766cf3ef

SHA512
cd4d60edb1e6b1711933b418882aee97cb79104160077b051b889ca1a0e491c7f1551d583aaefc381ca9737da12c7bd2a9cdda37809c00185bdb65d34c8f2402

Download Submit
C:\Windows\{05D7549B-CF1F-4bec-841A-810A21768D59}.exe

Filesize
372KB

MD5
4473d4c04e987779ad129fb9d584c79e

SHA1
9c62b7fd77446c4ca76dda671b081d3a0f0e4fef

SHA256
127caccf48b0c5c18542ce7c3fa4889716b71b238aeae222d4544500f7db7345

SHA512
0ac751de7a3954cc1d08176a584d34901c1927acd089d127fe2803a3d684ed75d992189cb2ad7e43aa0cfb7c60d19ec6603e44ab2932dcb96f14dc946193b8b4

Download Submit
C:\Windows\{1C2DE375-07E0-479e-A9E6-8DE1F934D8E4}.exe

Filesize
372KB

MD5
d88db6cae790a362431bba202310a08b

SHA1
01eb22731ae876e1327890608c4a749a63054605

SHA256
0aa738057494481cf72dcc58ada8aa9ebd9715a10cc1e76f8b30e6db5a38c57a

SHA512
048fd946810326283d5d9272b37bb70c938c163cd94afeb09155bb416c79536993fd0d6ad763262c386d9ca0ee574eb40d12babc6652b03c06b316461cd63e1a

Download Submit
C:\Windows\{22796916-FAB6-4505-BAF4-D836044EBEE0}.exe

Filesize
372KB

MD5
167c4aa433f86210cec957dde2f6debb

SHA1
8dc73c5cc5717fb369a97867b4541fca66b9423d

SHA256
42587768425559907f697c6e8d140cb7e365b734cad84bf070ebd0af2c8f19e8

SHA512
106a87e02fbc0c5b961c649d4485c4fc36280353cd87582e2e7e14259570f9481149c30eac0f2dc3b534c1a5da06883a6568c8caa9bfd3f6a2f7854982c1e8cb

Download Submit
C:\Windows\{33EE2F5E-730D-42eb-B5DF-48EB9FAB5155}.exe

Filesize
372KB

MD5
4d82190e44750dedd149a49b8c233f59

SHA1
357ac5038b008d167586354545e6afd689dbf242

SHA256
36e9b5cd4d9f3b6975fbda62e23d22dcaa14da95009279b24856d7b0eee5f683

SHA512
03522d88042fe604620d9682c85944cb48d05bbdf29dbf3fdc989b8e45efc4ae76376dfa88151907f9727600a06905ce6b4a3a455b653618f9e1b7dd3410b944

Download Submit
C:\Windows\{34CC497E-D2A3-4e0e-9A24-BB6C4A7355AE}.exe

Filesize
372KB

MD5
943deb8995322473be094d7cf1fcc1e7

SHA1
74112d1e45398c2fe96b4f98fc2ef3e5fd70fe0e

SHA256
93c1ce500dffacdbb3908f49884b6d920d6d0bf95701cf086ef95d0911d1137d

SHA512
8f3b05a3ab8b84cf58f830ec046f8f2a35516db5115b3a217e6a2caeecfd7c432f985a3e7e39b672b914b2770dcdb8126cb7c48447e32d14c9c3cd8884cbe255

Download Submit
C:\Windows\{6BBCF635-78DF-49c2-9B1F-16DB5D64ED3F}.exe

Filesize
372KB

MD5
ee6c00fb7f84eaaac6c1d40448d83771

SHA1
393cf312d7798d4730fb1566ce49cdd02b2f7727

SHA256
3d23b50e0c1078c8fcabc7677a36a320fc2056a169f468ae436091955fdf4840

SHA512
ec3dfc13ee8e4349744f12bacb66c3ec1eea691c44abe0d9b9697946113b0c2e963b214d189986673fd15b845cc9b5e3d66b8d474d8f3b27b4fac82628c1856f

Download Submit
C:\Windows\{A0A0D463-AF81-48a8-96A6-A3F7244E7402}.exe

Filesize
372KB

MD5
f12c868951d342a9ad7e334146fec52a

SHA1
bd2f3b87fc78c467e7f72ebef0bf8c143fad1f39

SHA256
ce37f4b4209ce4970ac668c8f1d002a1baf4ef677c5721661411bd3e7377bd4e

SHA512
dbf03a37296edd7aa5b5d49d730d629a3b59d6a04a101646d3b2c33e315122a4fccaa9478fbae4d5321051e47e3b1e9b85ff7f1dae3f99f85ebf365428766c94

Download Submit
C:\Windows\{C91081F8-32C4-488b-987C-E5ED75CFEC21}.exe

Filesize
372KB

MD5
33f31fbea05af8bcd277423ae5b555aa

SHA1
53af20757a50cc148ab0ab3f4b8547b9de0ff1e6

SHA256
7b22f19f9f491fe2f89ede61c97bf69c426156779d8f7ae806bee4f2e352ad91

SHA512
76d9550fd322492f354db4cfa19b93747d798f74fb7a605a1896ac38f16f712195b58c7ddcf0c898cae59fad101f174ae5b2c4e251a7ad2b7e41a5e8e5b9ca19

Download Submit
C:\Windows\{CB3D5334-80EB-43bc-93E8-954D9E616A20}.exe

Filesize
372KB

MD5
b3fe95987fe6e598123dd692002243e4

SHA1
0c2c90c65944e70d6c4e08d3e771aa31d9194fa4

SHA256
e9b48dc47a1fce1ac33b4f7978d881e38a1b26f7c7c210588ca1941cd9f01873

SHA512
ca06bb1ab9c52ba4fd2caa5dcf885d7adecd41a23f11032455ff470e22bb3cffe60a0623c4c4b4867701cd0f2b423ddf33d5bfb0e9da0b6c0b7c75f5096df9eb

Download Submit
C:\Windows\{DA4270DC-57D0-4014-B591-D445DAE8B6D2}.exe

Filesize
372KB

MD5
7269e97912758dcb196bf6c396d0f266

SHA1
3300d6c0af06ddb8fd8ada2c4be9415efe231596

SHA256
243d0bce5763867c9606c394e3131b8a0bf0dd548d9c4364b27635cda368eba5

SHA512
fd2029dd83a966bb07092151dcee8b7c93a036c51c6718f4eb64d5457f8a93224c31d6c7ee26e4e69494ce058b667c49030fca57be20405bd44c65f8f7cc794e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads