20f2b14cf8e1427b0cf75e87d6174fbaf1235cc98eca1eacd805c56774c1f433

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe
Size

344KB
MD5

57a36226fa578947489c80ae163aa9a6
SHA1

1229c580f2aa536cce3f10e67ffd588b80cc9669
SHA256

20f2b14cf8e1427b0cf75e87d6174fbaf1235cc98eca1eacd805c56774c1f433
SHA512

9bd20e3f8b501e660ffb613cfc59f8556ac1a8ff1a393147373397f733e5b1d12930b982e88e783f4f0463cbdac496cd26f4bb62062f7cdc72cbbb3740c41379
SSDEEP

3072:mEGh0o4lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGqlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012280-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000013108-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012280-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000013153-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012280-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012280-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012280-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}	{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24B2608B-7767-4b72-BDAF-746958A095BD}	{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22E576D8-265C-4fe8-9AD4-FC601265D553}\stubpath = "C:\\Windows\\{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe"	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{71158F5A-D821-4212-831C-FA202F7573D0}\stubpath = "C:\\Windows\\{71158F5A-D821-4212-831C-FA202F7573D0}.exe"	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5AAFF2D-7645-4609-A618-B5356EA460F5}\stubpath = "C:\\Windows\\{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe"	{71158F5A-D821-4212-831C-FA202F7573D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E43FCA26-82F7-4c88-911F-339997906A7A}\stubpath = "C:\\Windows\\{E43FCA26-82F7-4c88-911F-339997906A7A}.exe"	{B534C9BF-7670-4077-9095-48B361311DD2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}\stubpath = "C:\\Windows\\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe"	{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}\stubpath = "C:\\Windows\\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe"	{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22E576D8-265C-4fe8-9AD4-FC601265D553}	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5AAFF2D-7645-4609-A618-B5356EA460F5}	{71158F5A-D821-4212-831C-FA202F7573D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}\stubpath = "C:\\Windows\\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe"	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{71158F5A-D821-4212-831C-FA202F7573D0}	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B534C9BF-7670-4077-9095-48B361311DD2}\stubpath = "C:\\Windows\\{B534C9BF-7670-4077-9095-48B361311DD2}.exe"	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B534C9BF-7670-4077-9095-48B361311DD2}	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E43FCA26-82F7-4c88-911F-339997906A7A}	{B534C9BF-7670-4077-9095-48B361311DD2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}\stubpath = "C:\\Windows\\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe"	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}	{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24B2608B-7767-4b72-BDAF-746958A095BD}\stubpath = "C:\\Windows\\{24B2608B-7767-4b72-BDAF-746958A095BD}.exe"	{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}\stubpath = "C:\\Windows\\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe"	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe

Deletes itself 1 IoCs

pid	Process
2968	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe
2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe
788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
2780	{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
2884	{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
1916	{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe
1568	{24B2608B-7767-4b72-BDAF-746958A095BD}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{B534C9BF-7670-4077-9095-48B361311DD2}.exe	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
File created	C:\Windows\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
File created	C:\Windows\{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	{B534C9BF-7670-4077-9095-48B361311DD2}.exe
File created	C:\Windows\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
File created	C:\Windows\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe	{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
File created	C:\Windows\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe	{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
File created	C:\Windows\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe
File created	C:\Windows\{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
File created	C:\Windows\{71158F5A-D821-4212-831C-FA202F7573D0}.exe	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
File created	C:\Windows\{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	{71158F5A-D821-4212-831C-FA202F7573D0}.exe
File created	C:\Windows\{24B2608B-7767-4b72-BDAF-746958A095BD}.exe	{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
Token: SeIncBasePriorityPrivilege	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
Token: SeIncBasePriorityPrivilege	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe
Token: SeIncBasePriorityPrivilege	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
Token: SeIncBasePriorityPrivilege	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe
Token: SeIncBasePriorityPrivilege	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
Token: SeIncBasePriorityPrivilege	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
Token: SeIncBasePriorityPrivilege	2780	{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
Token: SeIncBasePriorityPrivilege	2884	{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
Token: SeIncBasePriorityPrivilege	1916	{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1708	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	28
PID 2284 wrote to memory of 1708	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	28
PID 2284 wrote to memory of 1708	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	28
PID 2284 wrote to memory of 1708	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	28
PID 2284 wrote to memory of 2968	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	29
PID 2284 wrote to memory of 2968	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	29
PID 2284 wrote to memory of 2968	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	29
PID 2284 wrote to memory of 2968	2284	2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe	29
PID 1708 wrote to memory of 2560	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	30
PID 1708 wrote to memory of 2560	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	30
PID 1708 wrote to memory of 2560	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	30
PID 1708 wrote to memory of 2560	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	30
PID 1708 wrote to memory of 2568	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	31
PID 1708 wrote to memory of 2568	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	31
PID 1708 wrote to memory of 2568	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	31
PID 1708 wrote to memory of 2568	1708	{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe	31
PID 2560 wrote to memory of 2788	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	32
PID 2560 wrote to memory of 2788	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	32
PID 2560 wrote to memory of 2788	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	32
PID 2560 wrote to memory of 2788	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	32
PID 2560 wrote to memory of 2548	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	33
PID 2560 wrote to memory of 2548	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	33
PID 2560 wrote to memory of 2548	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	33
PID 2560 wrote to memory of 2548	2560	{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe	33
PID 2788 wrote to memory of 2396	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	36
PID 2788 wrote to memory of 2396	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	36
PID 2788 wrote to memory of 2396	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	36
PID 2788 wrote to memory of 2396	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	36
PID 2788 wrote to memory of 1236	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	37
PID 2788 wrote to memory of 1236	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	37
PID 2788 wrote to memory of 1236	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	37
PID 2788 wrote to memory of 1236	2788	{71158F5A-D821-4212-831C-FA202F7573D0}.exe	37
PID 2396 wrote to memory of 2504	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	38
PID 2396 wrote to memory of 2504	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	38
PID 2396 wrote to memory of 2504	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	38
PID 2396 wrote to memory of 2504	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	38
PID 2396 wrote to memory of 992	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	39
PID 2396 wrote to memory of 992	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	39
PID 2396 wrote to memory of 992	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	39
PID 2396 wrote to memory of 992	2396	{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe	39
PID 2504 wrote to memory of 788	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	40
PID 2504 wrote to memory of 788	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	40
PID 2504 wrote to memory of 788	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	40
PID 2504 wrote to memory of 788	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	40
PID 2504 wrote to memory of 1244	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	41
PID 2504 wrote to memory of 1244	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	41
PID 2504 wrote to memory of 1244	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	41
PID 2504 wrote to memory of 1244	2504	{B534C9BF-7670-4077-9095-48B361311DD2}.exe	41
PID 788 wrote to memory of 2388	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	42
PID 788 wrote to memory of 2388	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	42
PID 788 wrote to memory of 2388	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	42
PID 788 wrote to memory of 2388	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	42
PID 788 wrote to memory of 2096	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	43
PID 788 wrote to memory of 2096	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	43
PID 788 wrote to memory of 2096	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	43
PID 788 wrote to memory of 2096	788	{E43FCA26-82F7-4c88-911F-339997906A7A}.exe	43
PID 2388 wrote to memory of 2780	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	44
PID 2388 wrote to memory of 2780	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	44
PID 2388 wrote to memory of 2780	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	44
PID 2388 wrote to memory of 2780	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	44
PID 2388 wrote to memory of 2776	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	45
PID 2388 wrote to memory of 2776	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	45
PID 2388 wrote to memory of 2776	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	45
PID 2388 wrote to memory of 2776	2388	{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_57a36226fa578947489c80ae163aa9a6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
  C:\Windows\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
    C:\Windows\{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\{71158F5A-D821-4212-831C-FA202F7573D0}.exe
      C:\Windows\{71158F5A-D821-4212-831C-FA202F7573D0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Windows\{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
        
        C:\Windows\{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\{B534C9BF-7670-4077-9095-48B361311DD2}.exe
        
        C:\Windows\{B534C9BF-7670-4077-9095-48B361311DD2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
        
        C:\Windows\{E43FCA26-82F7-4c88-911F-339997906A7A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:788
        
        C:\Windows\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
        
        C:\Windows\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
        
        C:\Windows\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
        
        C:\Windows\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Windows\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe
        
        C:\Windows\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\{24B2608B-7767-4b72-BDAF-746958A095BD}.exe
        
        C:\Windows\{24B2608B-7767-4b72-BDAF-746958A095BD}.exe
        12⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8DB4F~1.EXE > nul
        12⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7799~1.EXE > nul
        11⤵
        
        PID:532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CC5D~1.EXE > nul
        10⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4B384~1.EXE > nul
        9⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E43FC~1.EXE > nul
        8⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B534C~1.EXE > nul
        7⤵
        
        PID:1244
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E5AAF~1.EXE > nul
        6⤵
        
        PID:992
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71158~1.EXE > nul
        5⤵
        
        PID:1236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{22E57~1.EXE > nul
      4⤵
      PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EE99B~1.EXE > nul
    3⤵
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{22E576D8-265C-4fe8-9AD4-FC601265D553}.exe

Filesize
344KB

MD5
6c4c2926b7bbd898999fe7ffad18f6ce

SHA1
e2cd31f1cfe399a4b4b51317a4bb37a35cc3d307

SHA256
d27b5b889a9eacde2155540e1a448039659ac5d66fd264404a5b8d121a747f08

SHA512
dd610a2263ac42b2cb276ab83d5650329302b28f2beb0c479e8d8fc1975e9b27665e1f62de2a70d2dd7e5af11bcccb3844b17cd8a4c9c099ad51a2ebedcd139b

Download Submit
C:\Windows\{24B2608B-7767-4b72-BDAF-746958A095BD}.exe

Filesize
344KB

MD5
5cbc33e54a297f25c8feb72587223e3d

SHA1
9cbbb30183607357f8521d9d0f557df872169e3c

SHA256
036ae98f828a11bd39c153d4edac963824561a5951bc06b568dc4d0ceac0e7b6

SHA512
b75872eff458eafa17ca4cd81c78123d616d2f6e2107265d41c77be8acf8560fd6e7811dd00fb7c94fc04b11dd002b4b66dd6811ef7359e56d22bb596cacd805

Download Submit
C:\Windows\{4B3849A7-68A4-49cd-BB2D-7ED356A9813B}.exe

Filesize
344KB

MD5
4b04f1c57edf40e819ee5ec8a195396f

SHA1
68f755008a1181e9bcff6ed9f1e08e93a7ab2fd1

SHA256
ddd0e73becc68e1967caae2b1141eb8d4fab55e242b6965bf0532547884b98a2

SHA512
409390cbd8a34291106304d60fbadcc8f9fa04978cf0aa8ff92a63ae0a7063bb78ceadd3e7f42af589201e77e03a8b67f6fdc6797bf903d5b6b10c205b24eedd

Download Submit
C:\Windows\{71158F5A-D821-4212-831C-FA202F7573D0}.exe

Filesize
344KB

MD5
5325ce0c3a1d1af85ee3a91130374228

SHA1
ca94295e3c227ee736ff17f556f2fc0e75edf19c

SHA256
abca584641ca6d45d87b57945305dba75911eaf9682a1442ce1b63bfd929ab0b

SHA512
bbfbb796590d4d8f5040b9c71b080b172ed6ef398673ec7688198b2f215e9755517d9c2e9c52ca83079ebf36e5a3eb7bb1eb552d4a8cf15628a4a8865a9dce50

Download Submit
C:\Windows\{7CC5DD09-C8A9-4358-99BD-5DDB56E9DF72}.exe

Filesize
344KB

MD5
948c49dbb69fd9929472d22ee5fa6a08

SHA1
a86c4884249bdeb7723222c1ddda8a979c55ea2f

SHA256
da4c11e75311cc1dce0ac1baeae8295463a82dde690e673328cacd3e0d9e80d3

SHA512
62d0d6aff123deae74870367124ca91d9e520f74d0674ae8aad7781a89b19cd760ae669a3196d2feaa3e63f0bbc3c01762128c7cd0178f77f208542e07e63763

Download Submit
C:\Windows\{8DB4F687-5551-41d3-9765-32B31EB3B5BF}.exe

Filesize
344KB

MD5
a1ab0a314e70984f51bf4f3c2b0382f4

SHA1
b387179ff67bf311ea38f30735351031eec16e0f

SHA256
f07259a9bfe2b3465cb668e32b5ee1f960445122c3af1455e5cb2d0d28604ef8

SHA512
30d7fc428200b9742b823e7ce52e461f7ba64cc46162cdeb977bd52f4d3056644863ea019e5fe523d7a199fcc8bca1b23a10d395792da5152adf48c2931bd05d

Download Submit
C:\Windows\{B534C9BF-7670-4077-9095-48B361311DD2}.exe

Filesize
344KB

MD5
a1f5bfa7b3a66b56003ca42b59506454

SHA1
b779f916f46d2aee5d40547e586f711a9bd4399e

SHA256
6dc97d3db7ed86df8c7a122f804c67f412c8ff0b5a12f433976a2772a54d4b9a

SHA512
7107f17b472731f510f9543587f09ae6071f014adb5a838699a264feb63d384fe837c502b65212690e504b470fc47598a53d02081c20cfe7b16018734b26c7db

Download Submit
C:\Windows\{B7799D3E-64AD-46cd-B324-3AEE2F86C13D}.exe

Filesize
344KB

MD5
d73638ee059234f3b10e7d754aa19f0f

SHA1
dd145b22369ae79783f9b8e5356f966528c41445

SHA256
9278e8530e2bf764b468d179cb064ce9cfa7cb3c3614af2667a68bddf59bf9ef

SHA512
ba5d6458e7bccae105d9ec3ac070c7ab5ea8a4cb30862b0b2d89687428b90f7915e1999d41e40c34df2677f943fda622041ad255511aa8de18ba6a17a888bb3d

Download Submit
C:\Windows\{E43FCA26-82F7-4c88-911F-339997906A7A}.exe

Filesize
344KB

MD5
7765beb0be7ce77231abb433f118635f

SHA1
e3c771166d10f6e6dc53df9cdca4ec6b3ff7da5d

SHA256
daf88437f58c0221c4c4f8be1e8f8b0cb6fc96a8effbc8fb08ce6555af0ee33c

SHA512
0b5dfae189dcf4e7777bfd1c5e55e43079a1b6d9ee0f139d38d8f1fb8992378cc99b6aa8cada72e91a8b3e1d54c53befaab2399fff18f934a29d218e2c28af80

Download Submit
C:\Windows\{E5AAFF2D-7645-4609-A618-B5356EA460F5}.exe

Filesize
344KB

MD5
5cabc75824d449cb98c52c6a15c14880

SHA1
95a1f2d11495ce1da1f6052f0ed17c88f1b93c20

SHA256
4bcd6bd03ed7c03202bb4f5e383aed0d01b00a63bb54b7ca353fb5e201c6b08b

SHA512
5986bf3670d939c140270e20a66f86adf30d7a42400a8eb3db38146fbb5ce4834b9d2c03bb8611e99306808b4d3488603da8374f59699b7f11fb3249d9bfd10f

Download Submit
C:\Windows\{EE99B23B-8996-44ee-9225-B5DD1BB654F2}.exe

Filesize
344KB

MD5
ee925d1b70e74800687588ec7492f6cc

SHA1
06fccae96d40997da92824c471d6d76a0410315c

SHA256
e9c81a63b856321471ebd62029be4b2a72205d3945261f0118ab6b78d92ce916

SHA512
e47f2d30337a79e07ebaa0c4c019b57476f59430e207d2f520f1494523ca2b7ce546159065f00048f0c07df20d094761a2fdc6b2f000a0108a484873f66e3da3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads