214650f284173ce5f7520fd8bd229771e11af6f7f955738279ee30a96a5de15b

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe
Size

344KB
MD5

3ecf06040e090df8f50709fb0bbb8e76
SHA1

d3a16a547a6ae28cbe1548a7f4f3727efbb6076a
SHA256

214650f284173ce5f7520fd8bd229771e11af6f7f955738279ee30a96a5de15b
SHA512

29d3d521c27d15c752ebb6b81e49496ac45297441aa82a310c987d90c882c857db63a2f48c328f201863408d678cb228c704f5fa9ad42314a0bffd0309e3f412
SSDEEP

3072:mEGh0oplEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x003a000000013362-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003900000001340e-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003b000000013362-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000001344f-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003c000000013362-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003d000000013362-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003e000000013362-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}\stubpath = "C:\\Windows\\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe"	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05C05B07-957F-4184-8415-CFAA646E0313}	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05C05B07-957F-4184-8415-CFAA646E0313}\stubpath = "C:\\Windows\\{05C05B07-957F-4184-8415-CFAA646E0313}.exe"	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}	{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{382ED6AF-0030-4da2-830C-748C48113707}	{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}\stubpath = "C:\\Windows\\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe"	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}\stubpath = "C:\\Windows\\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe"	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B1CF996B-BF14-40e3-B40A-857F486EF256}	{05C05B07-957F-4184-8415-CFAA646E0313}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B1CF996B-BF14-40e3-B40A-857F486EF256}\stubpath = "C:\\Windows\\{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe"	{05C05B07-957F-4184-8415-CFAA646E0313}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}\stubpath = "C:\\Windows\\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe"	{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}\stubpath = "C:\\Windows\\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe"	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{382ED6AF-0030-4da2-830C-748C48113707}\stubpath = "C:\\Windows\\{382ED6AF-0030-4da2-830C-748C48113707}.exe"	{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A5B0088-490E-4030-8D67-C0EBBA08218A}\stubpath = "C:\\Windows\\{6A5B0088-490E-4030-8D67-C0EBBA08218A}.exe"	{382ED6AF-0030-4da2-830C-748C48113707}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}\stubpath = "C:\\Windows\\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe"	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}\stubpath = "C:\\Windows\\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe"	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A5B0088-490E-4030-8D67-C0EBBA08218A}	{382ED6AF-0030-4da2-830C-748C48113707}.exe

Deletes itself 1 IoCs

pid	Process
2080	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe
2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe
1544	{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
2340	{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
2856	{382ED6AF-0030-4da2-830C-748C48113707}.exe
320	{6A5B0088-490E-4030-8D67-C0EBBA08218A}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe	{05C05B07-957F-4184-8415-CFAA646E0313}.exe
File created	C:\Windows\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe	{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
File created	C:\Windows\{6A5B0088-490E-4030-8D67-C0EBBA08218A}.exe	{382ED6AF-0030-4da2-830C-748C48113707}.exe
File created	C:\Windows\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
File created	C:\Windows\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
File created	C:\Windows\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
File created	C:\Windows\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
File created	C:\Windows\{05C05B07-957F-4184-8415-CFAA646E0313}.exe	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
File created	C:\Windows\{382ED6AF-0030-4da2-830C-748C48113707}.exe	{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
File created	C:\Windows\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe
File created	C:\Windows\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
Token: SeIncBasePriorityPrivilege	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe
Token: SeIncBasePriorityPrivilege	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
Token: SeIncBasePriorityPrivilege	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
Token: SeIncBasePriorityPrivilege	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
Token: SeIncBasePriorityPrivilege	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
Token: SeIncBasePriorityPrivilege	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe
Token: SeIncBasePriorityPrivilege	1544	{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
Token: SeIncBasePriorityPrivilege	2340	{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
Token: SeIncBasePriorityPrivilege	2856	{382ED6AF-0030-4da2-830C-748C48113707}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3012	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	28
PID 1600 wrote to memory of 3012	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	28
PID 1600 wrote to memory of 3012	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	28
PID 1600 wrote to memory of 3012	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	28
PID 1600 wrote to memory of 2080	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	29
PID 1600 wrote to memory of 2080	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	29
PID 1600 wrote to memory of 2080	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	29
PID 1600 wrote to memory of 2080	1600	2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe	29
PID 3012 wrote to memory of 2684	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	30
PID 3012 wrote to memory of 2684	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	30
PID 3012 wrote to memory of 2684	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	30
PID 3012 wrote to memory of 2684	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	30
PID 3012 wrote to memory of 2840	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	31
PID 3012 wrote to memory of 2840	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	31
PID 3012 wrote to memory of 2840	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	31
PID 3012 wrote to memory of 2840	3012	{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe	31
PID 2684 wrote to memory of 2744	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	32
PID 2684 wrote to memory of 2744	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	32
PID 2684 wrote to memory of 2744	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	32
PID 2684 wrote to memory of 2744	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	32
PID 2684 wrote to memory of 2736	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	33
PID 2684 wrote to memory of 2736	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	33
PID 2684 wrote to memory of 2736	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	33
PID 2684 wrote to memory of 2736	2684	{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe	33
PID 2744 wrote to memory of 2908	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	36
PID 2744 wrote to memory of 2908	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	36
PID 2744 wrote to memory of 2908	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	36
PID 2744 wrote to memory of 2908	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	36
PID 2744 wrote to memory of 2928	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	37
PID 2744 wrote to memory of 2928	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	37
PID 2744 wrote to memory of 2928	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	37
PID 2744 wrote to memory of 2928	2744	{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe	37
PID 2908 wrote to memory of 1412	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	38
PID 2908 wrote to memory of 1412	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	38
PID 2908 wrote to memory of 1412	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	38
PID 2908 wrote to memory of 1412	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	38
PID 2908 wrote to memory of 2712	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	39
PID 2908 wrote to memory of 2712	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	39
PID 2908 wrote to memory of 2712	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	39
PID 2908 wrote to memory of 2712	2908	{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe	39
PID 1412 wrote to memory of 1220	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	40
PID 1412 wrote to memory of 1220	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	40
PID 1412 wrote to memory of 1220	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	40
PID 1412 wrote to memory of 1220	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	40
PID 1412 wrote to memory of 2404	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	41
PID 1412 wrote to memory of 2404	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	41
PID 1412 wrote to memory of 2404	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	41
PID 1412 wrote to memory of 2404	1412	{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe	41
PID 1220 wrote to memory of 2112	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	42
PID 1220 wrote to memory of 2112	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	42
PID 1220 wrote to memory of 2112	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	42
PID 1220 wrote to memory of 2112	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	42
PID 1220 wrote to memory of 1936	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	43
PID 1220 wrote to memory of 1936	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	43
PID 1220 wrote to memory of 1936	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	43
PID 1220 wrote to memory of 1936	1220	{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe	43
PID 2112 wrote to memory of 1544	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	44
PID 2112 wrote to memory of 1544	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	44
PID 2112 wrote to memory of 1544	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	44
PID 2112 wrote to memory of 1544	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	44
PID 2112 wrote to memory of 3008	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	45
PID 2112 wrote to memory of 3008	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	45
PID 2112 wrote to memory of 3008	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	45
PID 2112 wrote to memory of 3008	2112	{05C05B07-957F-4184-8415-CFAA646E0313}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_3ecf06040e090df8f50709fb0bbb8e76_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
  C:\Windows\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe
    C:\Windows\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
      C:\Windows\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
        
        C:\Windows\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Windows\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
        
        C:\Windows\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
        
        C:\Windows\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\{05C05B07-957F-4184-8415-CFAA646E0313}.exe
        
        C:\Windows\{05C05B07-957F-4184-8415-CFAA646E0313}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
        
        C:\Windows\{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Windows\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
        
        C:\Windows\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Windows\{382ED6AF-0030-4da2-830C-748C48113707}.exe
        
        C:\Windows\{382ED6AF-0030-4da2-830C-748C48113707}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
        
        C:\Windows\{6A5B0088-490E-4030-8D67-C0EBBA08218A}.exe
        
        C:\Windows\{6A5B0088-490E-4030-8D67-C0EBBA08218A}.exe
        12⤵
        Executes dropped EXE
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{382ED~1.EXE > nul
        12⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB3FD~1.EXE > nul
        11⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1CF9~1.EXE > nul
        10⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05C05~1.EXE > nul
        9⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB127~1.EXE > nul
        8⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD706~1.EXE > nul
        7⤵
        
        PID:2404
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EEAEA~1.EXE > nul
        6⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49B8F~1.EXE > nul
        5⤵
        
        PID:2928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{9A178~1.EXE > nul
      4⤵
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{65055~1.EXE > nul
    3⤵
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05C05B07-957F-4184-8415-CFAA646E0313}.exe

Filesize
344KB

MD5
bbeebe37a58778a270c169ee296d5e38

SHA1
d5771c15bcf579015e7733177f365f88f1eaa7e4

SHA256
ece61210a3138aa8c000688d2a7f021939e37d6c2204ae6978c9725c095e55bd

SHA512
d2ca4852484271ba98a9fefbf0452eb9286cd6f383fba4b2e7737d4695bebac2275af87a441d9dc37c102f2fc24e9dd1b4f32dacdd3388e98017e7dc07e81eb9

Download Submit
C:\Windows\{382ED6AF-0030-4da2-830C-748C48113707}.exe

Filesize
344KB

MD5
3c6029600d6bc968ad050562eac8bc38

SHA1
3ee3345042674b7243ef946dadb3c315cb307aa4

SHA256
f650b4f60c387df9b60a2b583500e9b90a0cfc64b46cc78ae889a6ebda52e097

SHA512
614c84d2c39d5b636cc5132e616e668a112dbe25d6ead6eef31047c0932bf7715a03e8ed886175c734f3f965e748c73d4c960692b2ce7a5eeb74ccbf1b7cf8b2

Download Submit
C:\Windows\{49B8F162-C222-4cc0-9EA2-0CE846EBEBC9}.exe

Filesize
344KB

MD5
5b5243179ad395dfb83409a393f9a051

SHA1
eff48b00eaa6049df7854158d9476063042758ec

SHA256
4a73020d52c27dc7f020406e52e5a737766fe2de41a47394e86b86d1587b8214

SHA512
d27fd971e65fdb2d93aa0934cf65a3881d8899f40dad674e6f4e68a52558ae767e3aea8677d6287b791b93523c96b7b429cb39b560009d8167c2700ee9dcdbbd

Download Submit
C:\Windows\{65055F97-47C6-4e7c-ACD0-3A19342BA53A}.exe

Filesize
344KB

MD5
ea994a0c5f5697b76791423f615fe4f9

SHA1
ec9796802a31289241ace6b7f5f04ff7c6c1e407

SHA256
2de77ae9a84befc7d85f9a150e890db928b00eda479177a32257229810ecc3ea

SHA512
455c0a6d3ac4f377579e2e84e1f33a7e0168cf1bdafc486a3c19084d5506424adb8224dfa0cd30e1d992db37a17915e994a4f67d1f925174b73f571e6d5d6407

Download Submit
C:\Windows\{6A5B0088-490E-4030-8D67-C0EBBA08218A}.exe

Filesize
344KB

MD5
483c88787cc421199427328d4e605e68

SHA1
f8c3c4e5fd41e782cb71f1623bfaf2f3d84e3b70

SHA256
d2e784188eb2e29421623929f6112750e3348c4c6a698d2178e7234c21d51d0a

SHA512
e86dc6a01c02b7d1716a7c9c6ab180c0bcb0255aad696d0dd4fc5e86110147c22b01aa5f5e6a5e5cbd421ac9dc743f97bdbb1343ec87d71c15799008c14219ba

Download Submit
C:\Windows\{9A178C70-BC4D-4ee0-85CE-DD76729CDFC8}.exe

Filesize
344KB

MD5
b31f0a8e2486189cd4c4273cac046dbb

SHA1
fe6c0d61f00bb8e208d6ed95d26de669efeb5d63

SHA256
72cf31edc3181d67fb852f5b09a810d49876b96f32ab04c212342dc01c5b399b

SHA512
453029978fb93cf81d84c582301e9561b9d9f62974cb6ff3a469ee9308689de83181f2fd0f7b814994abceb03c1a0f20502b21afbe806928267b7c028aca905e

Download Submit
C:\Windows\{B1CF996B-BF14-40e3-B40A-857F486EF256}.exe

Filesize
344KB

MD5
30e596b418818ea0236efddb2af2423a

SHA1
4537208228659f1af92a5a31ad250dc10b5343e1

SHA256
bb88d7fafb896dbc4d9685770bcd7258f209f2ddc9679f0180f4b9653cba1145

SHA512
85719a8091eaa8ee15c4deeab8ba943ce0d578f0c2e6dfef0fa673650470fa776cc4531227b30ca68362c14af6abb0e93c331d221191e866c7990517f6114614

Download Submit
C:\Windows\{BB1271A1-87ED-4c64-A70C-A8BA656D1DF0}.exe

Filesize
344KB

MD5
9260d55267b920459dfd0f71f40e9666

SHA1
9a58f07c57e1d8a9f56f5c72f94715e5bb6783fb

SHA256
d24be5f3696d192515f73d0c024a3c89708c29fa07bb00b3060f724498672ede

SHA512
b9578ad203132eea4f3b4ba3e1fdf84d2dded222cc9e9093d2d65ebf5a4c5d0c3c2b82ef91f2640fbc55d43f4e60efbcbf2396815915715efbba0d98059f1093

Download Submit
C:\Windows\{CD7067E0-35EA-4afe-9B4F-160293E03BDF}.exe

Filesize
344KB

MD5
0395f8d0352d05d02065196a3f436b99

SHA1
b893abb43feb1a52d89fdc6cd652afd2433a1d83

SHA256
bea8c75f04ef9a462b82966bda752a90dbbd01ab281b18cbb43d3e32e806ad9f

SHA512
f847456fdfb3925bb5bc69a0872156eae8c42099401ce81063017ef8df2bece102fe270d38fa7a3467a74428aaaab21e918890ca710cc83c0c753fcaa30c31b5

Download Submit
C:\Windows\{DB3FDCEE-8057-4f1f-89C9-D1C66513FAE7}.exe

Filesize
344KB

MD5
d965c71ee7bc41e63dcfa40bc4439af4

SHA1
35fad50c6e5fe23ad545258dbdc0d036c8e360ff

SHA256
97db07d7436df962f9ded68aa3ece5dae1c4b89a5c27771cf9f114a8dc9f60bc

SHA512
05d04eceeb4565ee03cbdffa00a55df4e574a4eb0263df3392e065011104b5da3cb90609d7298678c8b1ee66f3c362235b43b55305f990875736cd4b2e73c646

Download Submit
C:\Windows\{EEAEA010-BFFD-480a-8DE9-480DCBB9041C}.exe

Filesize
344KB

MD5
d7a5b55089ba10a27309c205dc1d0efa

SHA1
6cefe7b3da4e1a91549c298f4c0b342d51389ff4

SHA256
89707a8905506813f41bb3e2183eb8c4762691016616539303f57c4702714c9d

SHA512
994a89915886b53e2e33f1d5dcf6d16fac539ffd07df2f7d1debfb6b1d80c0220889e69d79c14c34c397a867e1dd8a9450757e204d04d50961d4bc959350a181

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads