18f523602db666ede2e1768671f7d4642ded25691a9472d195da953fe89ca296

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe
Size

204KB
MD5

eeaa516f9071acd5506e713620920fb2
SHA1

5196011ebd137e449b2283419baf13dc0f9d1b77
SHA256

18f523602db666ede2e1768671f7d4642ded25691a9472d195da953fe89ca296
SHA512

7516d831a2d6fbe1fb140f7661856aa1bbceb8bbbfef3d28807fcf085f0ea489e43ad21aaf2d13201fb762a876eb6ed22379642d8d81f39fd9795fb426e8a901
SSDEEP

1536:1EGh0o+l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o+l1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015d0f-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000016176-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015d0f-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000016287-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015d0f-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015d0f-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000015d0f-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}\stubpath = "C:\\Windows\\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe"	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}\stubpath = "C:\\Windows\\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe"	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}\stubpath = "C:\\Windows\\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe"	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE9B714A-B80E-4af8-9255-45117A5B8337}	{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6DB7736E-A207-4e37-B648-3D30743C5174}	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6DB7736E-A207-4e37-B648-3D30743C5174}\stubpath = "C:\\Windows\\{6DB7736E-A207-4e37-B648-3D30743C5174}.exe"	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE167F79-B755-450e-AE78-9098B490D310}\stubpath = "C:\\Windows\\{EE167F79-B755-450e-AE78-9098B490D310}.exe"	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B5189626-0244-4c95-AB0D-DC34F25B79EB}\stubpath = "C:\\Windows\\{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe"	{EE167F79-B755-450e-AE78-9098B490D310}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}	{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}\stubpath = "C:\\Windows\\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}.exe"	{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F60638DB-95C6-4201-B5A9-6AA433F48164}\stubpath = "C:\\Windows\\{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe"	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE167F79-B755-450e-AE78-9098B490D310}	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B5189626-0244-4c95-AB0D-DC34F25B79EB}	{EE167F79-B755-450e-AE78-9098B490D310}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C50F869-3AED-49a6-A124-BBBF372D7A89}\stubpath = "C:\\Windows\\{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe"	{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F60638DB-95C6-4201-B5A9-6AA433F48164}	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C50F869-3AED-49a6-A124-BBBF372D7A89}	{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE9B714A-B80E-4af8-9255-45117A5B8337}\stubpath = "C:\\Windows\\{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe"	{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}\stubpath = "C:\\Windows\\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe"	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe

Executes dropped EXE 11 IoCs

pid	Process
1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe
2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe
2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe
768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
1272	{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
2280	{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
384	{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe
580	{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{EE167F79-B755-450e-AE78-9098B490D310}.exe	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
File created	C:\Windows\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
File created	C:\Windows\{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe	{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
File created	C:\Windows\{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe	{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
File created	C:\Windows\{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	{EE167F79-B755-450e-AE78-9098B490D310}.exe
File created	C:\Windows\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe
File created	C:\Windows\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}.exe	{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe
File created	C:\Windows\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe
File created	C:\Windows\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
File created	C:\Windows\{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
File created	C:\Windows\{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
Token: SeIncBasePriorityPrivilege	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
Token: SeIncBasePriorityPrivilege	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe
Token: SeIncBasePriorityPrivilege	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
Token: SeIncBasePriorityPrivilege	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe
Token: SeIncBasePriorityPrivilege	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe
Token: SeIncBasePriorityPrivilege	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
Token: SeIncBasePriorityPrivilege	1272	{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
Token: SeIncBasePriorityPrivilege	2280	{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
Token: SeIncBasePriorityPrivilege	384	{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1988	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	28
PID 1724 wrote to memory of 1988	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	28
PID 1724 wrote to memory of 1988	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	28
PID 1724 wrote to memory of 1988	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	28
PID 1724 wrote to memory of 1056	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	29
PID 1724 wrote to memory of 1056	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	29
PID 1724 wrote to memory of 1056	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	29
PID 1724 wrote to memory of 1056	1724	2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe	29
PID 1988 wrote to memory of 2592	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	30
PID 1988 wrote to memory of 2592	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	30
PID 1988 wrote to memory of 2592	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	30
PID 1988 wrote to memory of 2592	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	30
PID 1988 wrote to memory of 2708	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	31
PID 1988 wrote to memory of 2708	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	31
PID 1988 wrote to memory of 2708	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	31
PID 1988 wrote to memory of 2708	1988	{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe	31
PID 2592 wrote to memory of 2640	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	32
PID 2592 wrote to memory of 2640	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	32
PID 2592 wrote to memory of 2640	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	32
PID 2592 wrote to memory of 2640	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	32
PID 2592 wrote to memory of 2560	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	33
PID 2592 wrote to memory of 2560	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	33
PID 2592 wrote to memory of 2560	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	33
PID 2592 wrote to memory of 2560	2592	{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe	33
PID 2640 wrote to memory of 2564	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	36
PID 2640 wrote to memory of 2564	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	36
PID 2640 wrote to memory of 2564	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	36
PID 2640 wrote to memory of 2564	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	36
PID 2640 wrote to memory of 2920	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	37
PID 2640 wrote to memory of 2920	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	37
PID 2640 wrote to memory of 2920	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	37
PID 2640 wrote to memory of 2920	2640	{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe	37
PID 2564 wrote to memory of 2544	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	38
PID 2564 wrote to memory of 2544	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	38
PID 2564 wrote to memory of 2544	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	38
PID 2564 wrote to memory of 2544	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	38
PID 2564 wrote to memory of 1356	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	39
PID 2564 wrote to memory of 1356	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	39
PID 2564 wrote to memory of 1356	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	39
PID 2564 wrote to memory of 1356	2564	{6DB7736E-A207-4e37-B648-3D30743C5174}.exe	39
PID 2544 wrote to memory of 2180	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	40
PID 2544 wrote to memory of 2180	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	40
PID 2544 wrote to memory of 2180	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	40
PID 2544 wrote to memory of 2180	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	40
PID 2544 wrote to memory of 1836	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	41
PID 2544 wrote to memory of 1836	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	41
PID 2544 wrote to memory of 1836	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	41
PID 2544 wrote to memory of 1836	2544	{EE167F79-B755-450e-AE78-9098B490D310}.exe	41
PID 2180 wrote to memory of 768	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	42
PID 2180 wrote to memory of 768	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	42
PID 2180 wrote to memory of 768	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	42
PID 2180 wrote to memory of 768	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	42
PID 2180 wrote to memory of 2488	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	43
PID 2180 wrote to memory of 2488	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	43
PID 2180 wrote to memory of 2488	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	43
PID 2180 wrote to memory of 2488	2180	{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe	43
PID 768 wrote to memory of 1272	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	44
PID 768 wrote to memory of 1272	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	44
PID 768 wrote to memory of 1272	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	44
PID 768 wrote to memory of 1272	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	44
PID 768 wrote to memory of 1236	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	45
PID 768 wrote to memory of 1236	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	45
PID 768 wrote to memory of 1236	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	45
PID 768 wrote to memory of 1236	768	{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_eeaa516f9071acd5506e713620920fb2_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
  C:\Windows\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
    C:\Windows\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe
      C:\Windows\{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
        
        C:\Windows\{6DB7736E-A207-4e37-B648-3D30743C5174}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\Windows\{EE167F79-B755-450e-AE78-9098B490D310}.exe
        
        C:\Windows\{EE167F79-B755-450e-AE78-9098B490D310}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe
        
        C:\Windows\{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
        
        C:\Windows\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
        
        C:\Windows\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
        
        C:\Windows\{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
        
        C:\Windows\{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
        
        C:\Windows\{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe
        
        C:\Windows\{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
        
        C:\Windows\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}.exe
        
        C:\Windows\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}.exe
        12⤵
        Executes dropped EXE
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AE9B7~1.EXE > nul
        12⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C50F~1.EXE > nul
        11⤵
        
        PID:684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FFA6E~1.EXE > nul
        10⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C448~1.EXE > nul
        9⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B5189~1.EXE > nul
        8⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE167~1.EXE > nul
        7⤵
        
        PID:1836
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6DB77~1.EXE > nul
        6⤵
        
        PID:1356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F6063~1.EXE > nul
        5⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1774A~1.EXE > nul
      4⤵
      PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D0F0A~1.EXE > nul
    3⤵
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1774A9CC-F64C-4cff-A852-2AC33C32F35F}.exe

Filesize
204KB

MD5
90953545011be68ab48750381ba5e09e

SHA1
10a418179763053dfd8bd7d03e1d0c7bcd05a32b

SHA256
d1c3b2f6d6f9accb37f03e05df357249e700b7e98b8632306152cf93d976962f

SHA512
765117608e925a823d5e78f767f3ec66077b161efb370d617475cba28760b497a65f06cf461fc2a3211526f593f5151c7aba71caf6a2f38cef8a608430af0c4a

Download Submit
C:\Windows\{5AF28394-BE4C-4e61-A5DE-F5D7F35123E1}.exe

Filesize
204KB

MD5
e3801ef6ce4283618836a25a4c3d451f

SHA1
54f928decb807dfa3f006de80aeb3acb027529cb

SHA256
8e7d2ea7b7967111bb97b4c21bebb6bf62bd3faf0f97320b3cfd97d6886049a0

SHA512
b32c00977ed584ea21fbe0b9eb367e14e2c738f6ac82433400b6f62582107a2d619ad089150d184074c68c23ed9fa7c6bc9860b532cd2c81621d14bde2bd829f

Download Submit
C:\Windows\{6C4480B2-621F-475e-B65F-D7BD4A39A42F}.exe

Filesize
204KB

MD5
09fa9e3d8e82899ce828f038c2132410

SHA1
7dad76135ea18348f827f75804773c09fb05af02

SHA256
5ad5de86ed7ec9304a10489f098ab233550b146455b3a3c1fa6dd050a8630d32

SHA512
f990f9e9e1ff6b5c347a3be067321515db9d458057f578e89f78ca6cff90b4682fa125e4a563f03e09c45a3ae3e03315c2e94689920fa552c88117863f89042f

Download Submit
C:\Windows\{6DB7736E-A207-4e37-B648-3D30743C5174}.exe

Filesize
204KB

MD5
1a7851d5374fd19ab5913d657135f7f7

SHA1
6c17a342fc4021bcd5a785f793f2ec67bf7c206b

SHA256
068471c00a142689cee0dbccdf13326d8ab4f9683dc9dd132e06b9038176b1dc

SHA512
320688499d59650811ac540d555cc01d5b0d4f759fd6d756079688de6ca00d21a1b3a488575e7dc70366fdbfecc7add77e2258a134dcc76e155b320b08b80238

Download Submit
C:\Windows\{7C50F869-3AED-49a6-A124-BBBF372D7A89}.exe

Filesize
204KB

MD5
1148bf04cb342411f40e8b198f3eb9ff

SHA1
21f13e346ae933165f99866c5822e73e5c34ccf8

SHA256
fe3bc1ed754cbe889c0cbd5849fac4347730aa1921b0e629d494e9ec92f307c1

SHA512
bc7621f9ed2fd6377ed493138d4c07b3c2113f1e6c61fa9a3e96d388ecf241e88d28834d3ea5dc4d82745a2de906ff96c530225a809cbed7ed3ef7f694dd672e

Download Submit
C:\Windows\{AE9B714A-B80E-4af8-9255-45117A5B8337}.exe

Filesize
204KB

MD5
3eb60f316a0c5c0096394e07d9ba8e1e

SHA1
8284fdd9224cc3fbc541066704f5d27816f7d63d

SHA256
05aadaa1cf69e2f7c0a1307aa2b776b7831bee4823902e9210220344a4978688

SHA512
914ff835f1e3d52cdd1e9364b0125f6d12c90817c7d2615bec3437553a31c2c07992ac1edcc8f17dc5228f1bfb4573c7f1b3aaf81d97d379e9bf9d61323411b7

Download Submit
C:\Windows\{B5189626-0244-4c95-AB0D-DC34F25B79EB}.exe

Filesize
204KB

MD5
a5cfc422bfbf07e9baec423f9bb35f18

SHA1
da855a82289a2ff45c2be6d8594dc0e33471f4d9

SHA256
a7bdeadfe01b53ecde7fd2ce7c1a393db5e944dd24296b9795d43c4046409eae

SHA512
b288f7b3bdcb1d33443afbea6bcf1f1625e314be1e3cea6b19d3869b760aeaeebb6fb0e7cc1862258d841c23c1859580cb3984dd20cc3b42ca911a86e97c0cd2

Download Submit
C:\Windows\{D0F0A9F6-41D8-4400-9E08-F7F4CDA9110A}.exe

Filesize
204KB

MD5
e4cabad7bd5804774b177df6ec03c20d

SHA1
5a4d05a180c5d1ce05667914f5c710d43acd6b28

SHA256
15962bd15c00e598033254fc2a5443e3f296fce36a476e6435799dd978cf3f7b

SHA512
080f82613933fbbb01cb80094559da6fa1baba7376fa358c01a3de9571c5846f8b3ddad2dcb0c0b580868ef38f41d1aff8fb3a0fa501c0d974d32828d47cf746

Download Submit
C:\Windows\{EE167F79-B755-450e-AE78-9098B490D310}.exe

Filesize
204KB

MD5
62f93cbec069a6b729e7214882615ea0

SHA1
2705aaf926d4a222b403809415bca6e0eeaefe7e

SHA256
633ef0fffd779ef2679f978034721e3943d5bf3c580307a222c11fb7dc4506ba

SHA512
450163ea563822a990b0ba7c3af97ed40de63412c6f4c65c4323ca7662a7dd3859912ca645945c8ccfb9cdebbef1bfb76639c0baf48159d3310ec42af4615d83

Download Submit
C:\Windows\{F60638DB-95C6-4201-B5A9-6AA433F48164}.exe

Filesize
204KB

MD5
f8afae30cf8d874f8c880f5fdfbddc55

SHA1
fa429892a9cae06cb62d96ebcbc4298ed423d642

SHA256
1badeebb1400cde850aacbbbde25cab9db507ce1ff2bd0700f63ca3f44904897

SHA512
6f9c9cbcfc42542de11b44152ec0426b8efa6ac3e06235fdb15015e3838c3aae885532fecdfaddf56398d535514aa77e76f6430c92a10fcb3cd942b24e5d4c49

Download Submit
C:\Windows\{FFA6E86A-F760-4e22-8975-1FA94EA9613C}.exe

Filesize
204KB

MD5
9fc92c6818b7ae72297bce7be10d98cf

SHA1
091db648933982d394d0a2cd23d18349b38da58b

SHA256
3ddf86f5a38070bb29c8ab471245539b19207b8d241eff744dff78927ba5406e

SHA512
7f13607b20baf7e33d21e3bb8f92d2e8b7d636d596f64f9789baefda539ea9ae9a908ae7136a5ffd686d084e46f86636ef2ed0e49c7cbfc0a6db4aa1f167fb9b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads