605e762fd6fd732bf7d34ea46f2d923748cc205f3574e4e518add14b8d75d7e6

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
Size

216KB
MD5

77c616e1c8e25a4c9234a851fabd7fb6
SHA1

ae77da10ad413d5a568e7410675b7ba9592a6e2e
SHA256

605e762fd6fd732bf7d34ea46f2d923748cc205f3574e4e518add14b8d75d7e6
SHA512

22c1e4872785982a70d539401ab057539a6be3f8054185c19dc85ef085583f60b48ab8e0a67d26990c7ad526295b9ec07f202fcea12be273cefcc7b2e76f1022
SSDEEP

3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGWlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001342e-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0038000000013adc-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001342e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000013f2c-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001342e-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001342e-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001342e-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{105461A8-4B97-43f3-AC67-54D427EE152B}\stubpath = "C:\\Windows\\{105461A8-4B97-43f3-AC67-54D427EE152B}.exe"	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}\stubpath = "C:\\Windows\\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe"	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}\stubpath = "C:\\Windows\\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe"	{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24046C74-2C6A-4011-9256-6E2E087515F2}	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24046C74-2C6A-4011-9256-6E2E087515F2}\stubpath = "C:\\Windows\\{24046C74-2C6A-4011-9256-6E2E087515F2}.exe"	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{105461A8-4B97-43f3-AC67-54D427EE152B}	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}\stubpath = "C:\\Windows\\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe"	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}\stubpath = "C:\\Windows\\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe"	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{253652F9-AC3A-4bbe-8559-4F6191712437}	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{253652F9-AC3A-4bbe-8559-4F6191712437}\stubpath = "C:\\Windows\\{253652F9-AC3A-4bbe-8559-4F6191712437}.exe"	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C971752-7C4F-4332-8765-86494CE45744}\stubpath = "C:\\Windows\\{3C971752-7C4F-4332-8765-86494CE45744}.exe"	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15582532-6964-42e1-A4A8-BDC5073E5B56}	{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4246B4-BEA4-426d-A252-C871E210AC62}	{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}	{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}	{3C971752-7C4F-4332-8765-86494CE45744}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}\stubpath = "C:\\Windows\\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe"	{3C971752-7C4F-4332-8765-86494CE45744}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15582532-6964-42e1-A4A8-BDC5073E5B56}\stubpath = "C:\\Windows\\{15582532-6964-42e1-A4A8-BDC5073E5B56}.exe"	{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C971752-7C4F-4332-8765-86494CE45744}	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4246B4-BEA4-426d-A252-C871E210AC62}\stubpath = "C:\\Windows\\{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe"	{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe

Executes dropped EXE 11 IoCs

pid	Process
2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe
1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
2864	{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe
908	{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
2404	{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe
708	{15582532-6964-42e1-A4A8-BDC5073E5B56}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
File created	C:\Windows\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
File created	C:\Windows\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
File created	C:\Windows\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
File created	C:\Windows\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe	{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
File created	C:\Windows\{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
File created	C:\Windows\{3C971752-7C4F-4332-8765-86494CE45744}.exe	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
File created	C:\Windows\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	{3C971752-7C4F-4332-8765-86494CE45744}.exe
File created	C:\Windows\{15582532-6964-42e1-A4A8-BDC5073E5B56}.exe	{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe
File created	C:\Windows\{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
File created	C:\Windows\{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe	{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
Token: SeIncBasePriorityPrivilege	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe
Token: SeIncBasePriorityPrivilege	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
Token: SeIncBasePriorityPrivilege	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
Token: SeIncBasePriorityPrivilege	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
Token: SeIncBasePriorityPrivilege	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
Token: SeIncBasePriorityPrivilege	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
Token: SeIncBasePriorityPrivilege	2864	{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe
Token: SeIncBasePriorityPrivilege	908	{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
Token: SeIncBasePriorityPrivilege	2404	{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2540	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	28
PID 2292 wrote to memory of 2540	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	28
PID 2292 wrote to memory of 2540	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	28
PID 2292 wrote to memory of 2540	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	28
PID 2292 wrote to memory of 2640	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	29
PID 2292 wrote to memory of 2640	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	29
PID 2292 wrote to memory of 2640	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	29
PID 2292 wrote to memory of 2640	2292	2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe	29
PID 2540 wrote to memory of 2680	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	30
PID 2540 wrote to memory of 2680	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	30
PID 2540 wrote to memory of 2680	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	30
PID 2540 wrote to memory of 2680	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	30
PID 2540 wrote to memory of 2612	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	31
PID 2540 wrote to memory of 2612	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	31
PID 2540 wrote to memory of 2612	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	31
PID 2540 wrote to memory of 2612	2540	{253652F9-AC3A-4bbe-8559-4F6191712437}.exe	31
PID 2680 wrote to memory of 1728	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	32
PID 2680 wrote to memory of 1728	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	32
PID 2680 wrote to memory of 1728	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	32
PID 2680 wrote to memory of 1728	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	32
PID 2680 wrote to memory of 2948	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	33
PID 2680 wrote to memory of 2948	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	33
PID 2680 wrote to memory of 2948	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	33
PID 2680 wrote to memory of 2948	2680	{3C971752-7C4F-4332-8765-86494CE45744}.exe	33
PID 1728 wrote to memory of 2964	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	36
PID 1728 wrote to memory of 2964	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	36
PID 1728 wrote to memory of 2964	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	36
PID 1728 wrote to memory of 2964	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	36
PID 1728 wrote to memory of 2256	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	37
PID 1728 wrote to memory of 2256	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	37
PID 1728 wrote to memory of 2256	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	37
PID 1728 wrote to memory of 2256	1728	{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe	37
PID 2964 wrote to memory of 3048	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	38
PID 2964 wrote to memory of 3048	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	38
PID 2964 wrote to memory of 3048	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	38
PID 2964 wrote to memory of 3048	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	38
PID 2964 wrote to memory of 1744	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	39
PID 2964 wrote to memory of 1744	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	39
PID 2964 wrote to memory of 1744	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	39
PID 2964 wrote to memory of 1744	2964	{24046C74-2C6A-4011-9256-6E2E087515F2}.exe	39
PID 3048 wrote to memory of 2336	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	40
PID 3048 wrote to memory of 2336	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	40
PID 3048 wrote to memory of 2336	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	40
PID 3048 wrote to memory of 2336	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	40
PID 3048 wrote to memory of 2448	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	41
PID 3048 wrote to memory of 2448	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	41
PID 3048 wrote to memory of 2448	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	41
PID 3048 wrote to memory of 2448	3048	{105461A8-4B97-43f3-AC67-54D427EE152B}.exe	41
PID 2336 wrote to memory of 2852	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	42
PID 2336 wrote to memory of 2852	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	42
PID 2336 wrote to memory of 2852	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	42
PID 2336 wrote to memory of 2852	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	42
PID 2336 wrote to memory of 1420	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	43
PID 2336 wrote to memory of 1420	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	43
PID 2336 wrote to memory of 1420	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	43
PID 2336 wrote to memory of 1420	2336	{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe	43
PID 2852 wrote to memory of 2864	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	44
PID 2852 wrote to memory of 2864	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	44
PID 2852 wrote to memory of 2864	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	44
PID 2852 wrote to memory of 2864	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	44
PID 2852 wrote to memory of 1812	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	45
PID 2852 wrote to memory of 1812	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	45
PID 2852 wrote to memory of 1812	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	45
PID 2852 wrote to memory of 1812	2852	{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
  C:\Windows\{253652F9-AC3A-4bbe-8559-4F6191712437}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\{3C971752-7C4F-4332-8765-86494CE45744}.exe
    C:\Windows\{3C971752-7C4F-4332-8765-86494CE45744}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
      C:\Windows\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Windows\{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
        
        C:\Windows\{24046C74-2C6A-4011-9256-6E2E087515F2}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Windows\{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
        
        C:\Windows\{105461A8-4B97-43f3-AC67-54D427EE152B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
        
        C:\Windows\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
        
        C:\Windows\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe
        
        C:\Windows\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
        
        C:\Windows\{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Windows\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe
        
        C:\Windows\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\{15582532-6964-42e1-A4A8-BDC5073E5B56}.exe
        
        C:\Windows\{15582532-6964-42e1-A4A8-BDC5073E5B56}.exe
        12⤵
        Executes dropped EXE
        
        PID:708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD6B4~1.EXE > nul
        12⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EB424~1.EXE > nul
        11⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94BB6~1.EXE > nul
        10⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2EA14~1.EXE > nul
        9⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9C5DB~1.EXE > nul
        8⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10546~1.EXE > nul
        7⤵
        
        PID:2448
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24046~1.EXE > nul
        6⤵
        
        PID:1744
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DD11C~1.EXE > nul
        5⤵
        
        PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3C971~1.EXE > nul
      4⤵
      PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{25365~1.EXE > nul
    3⤵
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{105461A8-4B97-43f3-AC67-54D427EE152B}.exe

Filesize
216KB

MD5
cf5a8a12977fe341b1be06b2c8853a1c

SHA1
19ccdd783c2a53b96480ad9fd90983718e28f40b

SHA256
0fe66aa5f60e8f8ab9b121eb0eea6a82ca01b449ca1e892b4d89d08ab206fbb6

SHA512
6c2c4b8e87bd4bfc07b9a487d2a3fc3f81f583e629d8e661d1ec712872a99264ec8803cdfb3ae8e204a862837b22829abe94f5a9af860ca0a18dfa0564b9c3a2

Download Submit
C:\Windows\{15582532-6964-42e1-A4A8-BDC5073E5B56}.exe

Filesize
216KB

MD5
ad6069d8e704c5a9cdfde5bb039bc78e

SHA1
4229c734d49d1a1387d51559fc973c1754a7bf76

SHA256
ab7ae18ec8925d6811305b45ee576d8b739bf450c2c710bbdfaad4fa380c9bb9

SHA512
d043724575b0c0fae5d03e695bf567777f883cce794a123f684c9061a6b2804415e6e71d3dde00c92026d93d39b03335e0fbc199f5dc85131feacf28b0a4c529

Download Submit
C:\Windows\{24046C74-2C6A-4011-9256-6E2E087515F2}.exe

Filesize
216KB

MD5
214c3328dbe6bfa2da2456322b773d5e

SHA1
b3b7ee71a9472a3666d089b2e5469c892feef698

SHA256
d3b55f51f82575760492c98f1b941d9a7917c0f38edebd9a5e54093b0d42088c

SHA512
522295f31bcfebdee3824c403db1fbe9c31833187ed7eb3c8547719f61aa9597cd1ddb45d000a7cbfecae12a09873e3bca2eefde30b223866ff49e77c800431d

Download Submit
C:\Windows\{253652F9-AC3A-4bbe-8559-4F6191712437}.exe

Filesize
216KB

MD5
6d2f715710401ce813e61786f1ef8c50

SHA1
d9d5e3dd5de0a3708c95d10793b7c3463fe284ae

SHA256
9bac6d84be727f9883334a20e73966233e406cccc440e36c94bc35224a4ead18

SHA512
aade2240dee3c1f122c631beafcc9bdb53f3222d77c982bb2c8be63e278533492dfbf15d73b1dcf62ad98a8e4190f06bd5a2f3a18e06d5ab479774a094deef2a

Download Submit
C:\Windows\{2EA1494D-0A84-4ad7-9980-A581F7A4FE82}.exe

Filesize
216KB

MD5
d26951fe470b4309f45a05dda73b97a2

SHA1
c890d4a11fc03f0814593eb2c304431bf960d681

SHA256
3a73275ab25a9a420b0d95f6260a37e32d5433c71ea72a8d1fd5cd8d79d3ad9e

SHA512
630385cef8346ae0d330579ca136852f41ff9d0fa3f01a91704aa00e40589af7d088ca9347ed945d14a11775a8b70428c65ba71d64cc43d0f86670c74020ff03

Download Submit
C:\Windows\{3C971752-7C4F-4332-8765-86494CE45744}.exe

Filesize
216KB

MD5
5f230a629415f72e00c728db6ef6dc9e

SHA1
3d060b2ff6fd3e27df5bbfec81592c33ce353862

SHA256
ad191ab1ffe88ffe078c6a1ed4cc7ab0c26cf4302c9ee17a48fcdd3679ce2924

SHA512
d135d5987bd12cac0ba8eb0d45926b342d3ebf577c62704b00601d455c1f67f03be06396d356988fad9573e0d156a95451b80557ef2f7cd6656f950570ea76bc

Download Submit
C:\Windows\{94BB6E7D-5F0A-4120-A9D8-7CB271C0E64B}.exe

Filesize
216KB

MD5
27c126dbcc8dacf2e8d211d2a0810d6f

SHA1
904f08aaf23c18adcf3b7297153700a76a03cdf9

SHA256
98e66839588eefe15a41ef92f99d304493e723ca9a0d58064acc9314a06fd1b0

SHA512
8db334ad5a1d349870581e0085202f14ece0a1b2a8f83958e6bea9e752558b682c8560beb74b7832785859ee5348d36d57ebf2b34568ccb09abd4cf681317e1b

Download Submit
C:\Windows\{9C5DB01B-F33A-4d55-931E-BCF4233084C4}.exe

Filesize
216KB

MD5
46b860fa64ef09c810f53dff4eaf3f8f

SHA1
e105e4d0d69c555f5e874d31b72bf24e678288e6

SHA256
5eb1e340fb9da3621f985616c8c4a8434fd3e6ed39a57af404e75fded78070c8

SHA512
e15e586dacc19b90a2935154a7cf326373cb1779a72f81766198a00294c745bbae5031c8b6ec3365450ceb204b05da04a7e8efb886d063c62bfd37847ea07581

Download Submit
C:\Windows\{DD11C70F-34BB-4b4a-B214-C8F1EB4A9788}.exe

Filesize
216KB

MD5
5efc8302381220e2996b0057476bd5d2

SHA1
1a4f0196783c29bc46a7627aaa41ed2fa8ffe9f9

SHA256
fa2f7ce60370c0d8264212254273575dc28f8567a8fc5eedd01b960230e3942d

SHA512
67a8a9b9739c7ff5cadb3bc5734ae6665aac712862c4e6b4925d75480918dc30791a4df6a79e5778abf599e2ff2bafe197f7f4fdf60f7e7275f4e05c7f048688

Download Submit
C:\Windows\{EB4246B4-BEA4-426d-A252-C871E210AC62}.exe

Filesize
216KB

MD5
986db39526f7dd1d30c0bc78e28d75c1

SHA1
1f0fca6b6dfcf999f17ee73ff2a7c0ae573104b7

SHA256
fc6b6cab10394f4ef2b62a7545e4b86644cb47cb4396207bd1443fa86196e6ae

SHA512
5d732af264c18a6be267c0880aaf3af4a4df90a34817d65800cd4fefe61803ccaca7b2da028c3b601ccd56119bc816c942e9017d7e973a4bb75db996efdca45a

Download Submit
C:\Windows\{FD6B4A03-06DA-4db4-9D02-23AA7B30A704}.exe

Filesize
216KB

MD5
cd4b6c36f34037963f5fed9bf5c90ee8

SHA1
840347e24b8a330958f3c8f3a4534638fe5f354b

SHA256
388b3f22b08a9edbbc13b88be661e1a565d88f8b74a00c18edcbb7bf1a53b987

SHA512
bc07bf43766678d3f3b2d9adf35ce92e57fd05e05ff6b12f264cf05d30f2901ca5cfd8611725e44b90e898f6b433dee36c2933a836a32f5b53c0970af5ccd60e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads