74a04d922b9ea02ac8deb5a75a98cbbac65cbe9d66e4b2a89ebaa0333373338c

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
Size

372KB
MD5

287de4024681a217040de9387e6431ec
SHA1

b54539b660169ae332920d1a64279dc6a13b94e8
SHA256

74a04d922b9ea02ac8deb5a75a98cbbac65cbe9d66e4b2a89ebaa0333373338c
SHA512

aedc5b5a01e6ddf20d57c3492dc59865e0ba43298f8b80c0b58e3bf460d3b7d15cb0ee27b76e634b46d5b68aae0e49a745d46eb132dfdca577e5f0ac32daa5d5
SSDEEP

3072:CEGh0oelMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGclkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000139d9-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003300000001416f-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000139d9-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000014183-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000139d9-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00100000000139d9-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00110000000139d9-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}	{0B275638-0ED9-4760-8944-F8122DC32368}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}\stubpath = "C:\\Windows\\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe"	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}\stubpath = "C:\\Windows\\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe"	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B5962E6-140B-467b-BA9A-26400477E628}\stubpath = "C:\\Windows\\{7B5962E6-140B-467b-BA9A-26400477E628}.exe"	{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}\stubpath = "C:\\Windows\\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe"	{0B275638-0ED9-4760-8944-F8122DC32368}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}\stubpath = "C:\\Windows\\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe"	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}\stubpath = "C:\\Windows\\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe"	{C7DA7439-5196-451d-9492-12486CD952CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E065D0D3-295B-4752-95C1-4606A9E52043}	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7DA7439-5196-451d-9492-12486CD952CF}	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7DA7439-5196-451d-9492-12486CD952CF}\stubpath = "C:\\Windows\\{C7DA7439-5196-451d-9492-12486CD952CF}.exe"	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B5962E6-140B-467b-BA9A-26400477E628}	{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B275638-0ED9-4760-8944-F8122DC32368}	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B275638-0ED9-4760-8944-F8122DC32368}\stubpath = "C:\\Windows\\{0B275638-0ED9-4760-8944-F8122DC32368}.exe"	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}\stubpath = "C:\\Windows\\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe"	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E065D0D3-295B-4752-95C1-4606A9E52043}\stubpath = "C:\\Windows\\{E065D0D3-295B-4752-95C1-4606A9E52043}.exe"	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}	{C7DA7439-5196-451d-9492-12486CD952CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}	{7B5962E6-140B-467b-BA9A-26400477E628}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}\stubpath = "C:\\Windows\\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}.exe"	{7B5962E6-140B-467b-BA9A-26400477E628}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe
3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe
2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
1244	{C7DA7439-5196-451d-9492-12486CD952CF}.exe
880	{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe
2840	{7B5962E6-140B-467b-BA9A-26400477E628}.exe
656	{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	{0B275638-0ED9-4760-8944-F8122DC32368}.exe
File created	C:\Windows\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
File created	C:\Windows\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
File created	C:\Windows\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
File created	C:\Windows\{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
File created	C:\Windows\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}.exe	{7B5962E6-140B-467b-BA9A-26400477E628}.exe
File created	C:\Windows\{0B275638-0ED9-4760-8944-F8122DC32368}.exe	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
File created	C:\Windows\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe
File created	C:\Windows\{C7DA7439-5196-451d-9492-12486CD952CF}.exe	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
File created	C:\Windows\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe	{C7DA7439-5196-451d-9492-12486CD952CF}.exe
File created	C:\Windows\{7B5962E6-140B-467b-BA9A-26400477E628}.exe	{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe
Token: SeIncBasePriorityPrivilege	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
Token: SeIncBasePriorityPrivilege	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
Token: SeIncBasePriorityPrivilege	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe
Token: SeIncBasePriorityPrivilege	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
Token: SeIncBasePriorityPrivilege	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
Token: SeIncBasePriorityPrivilege	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
Token: SeIncBasePriorityPrivilege	1244	{C7DA7439-5196-451d-9492-12486CD952CF}.exe
Token: SeIncBasePriorityPrivilege	880	{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe
Token: SeIncBasePriorityPrivilege	2840	{7B5962E6-140B-467b-BA9A-26400477E628}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2992	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	28
PID 2324 wrote to memory of 2992	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	28
PID 2324 wrote to memory of 2992	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	28
PID 2324 wrote to memory of 2992	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	28
PID 2324 wrote to memory of 2524	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	29
PID 2324 wrote to memory of 2524	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	29
PID 2324 wrote to memory of 2524	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	29
PID 2324 wrote to memory of 2524	2324	2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe	29
PID 2992 wrote to memory of 3008	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	30
PID 2992 wrote to memory of 3008	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	30
PID 2992 wrote to memory of 3008	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	30
PID 2992 wrote to memory of 3008	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	30
PID 2992 wrote to memory of 1376	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	31
PID 2992 wrote to memory of 1376	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	31
PID 2992 wrote to memory of 1376	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	31
PID 2992 wrote to memory of 1376	2992	{0B275638-0ED9-4760-8944-F8122DC32368}.exe	31
PID 3008 wrote to memory of 2584	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	32
PID 3008 wrote to memory of 2584	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	32
PID 3008 wrote to memory of 2584	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	32
PID 3008 wrote to memory of 2584	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	32
PID 3008 wrote to memory of 2008	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	33
PID 3008 wrote to memory of 2008	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	33
PID 3008 wrote to memory of 2008	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	33
PID 3008 wrote to memory of 2008	3008	{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe	33
PID 2584 wrote to memory of 2024	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	36
PID 2584 wrote to memory of 2024	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	36
PID 2584 wrote to memory of 2024	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	36
PID 2584 wrote to memory of 2024	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	36
PID 2584 wrote to memory of 2676	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	37
PID 2584 wrote to memory of 2676	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	37
PID 2584 wrote to memory of 2676	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	37
PID 2584 wrote to memory of 2676	2584	{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe	37
PID 2024 wrote to memory of 2880	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	38
PID 2024 wrote to memory of 2880	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	38
PID 2024 wrote to memory of 2880	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	38
PID 2024 wrote to memory of 2880	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	38
PID 2024 wrote to memory of 1720	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	39
PID 2024 wrote to memory of 1720	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	39
PID 2024 wrote to memory of 1720	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	39
PID 2024 wrote to memory of 1720	2024	{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe	39
PID 2880 wrote to memory of 1188	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	40
PID 2880 wrote to memory of 1188	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	40
PID 2880 wrote to memory of 1188	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	40
PID 2880 wrote to memory of 1188	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	40
PID 2880 wrote to memory of 2140	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	41
PID 2880 wrote to memory of 2140	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	41
PID 2880 wrote to memory of 2140	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	41
PID 2880 wrote to memory of 2140	2880	{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe	41
PID 1188 wrote to memory of 1012	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	42
PID 1188 wrote to memory of 1012	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	42
PID 1188 wrote to memory of 1012	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	42
PID 1188 wrote to memory of 1012	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	42
PID 1188 wrote to memory of 2916	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	43
PID 1188 wrote to memory of 2916	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	43
PID 1188 wrote to memory of 2916	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	43
PID 1188 wrote to memory of 2916	1188	{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe	43
PID 1012 wrote to memory of 1244	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	44
PID 1012 wrote to memory of 1244	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	44
PID 1012 wrote to memory of 1244	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	44
PID 1012 wrote to memory of 1244	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	44
PID 1012 wrote to memory of 1696	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	45
PID 1012 wrote to memory of 1696	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	45
PID 1012 wrote to memory of 1696	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	45
PID 1012 wrote to memory of 1696	1012	{E065D0D3-295B-4752-95C1-4606A9E52043}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\{0B275638-0ED9-4760-8944-F8122DC32368}.exe
  C:\Windows\{0B275638-0ED9-4760-8944-F8122DC32368}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
    C:\Windows\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
      C:\Windows\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe
        
        C:\Windows\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
        
        C:\Windows\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
        
        C:\Windows\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
        
        C:\Windows\{E065D0D3-295B-4752-95C1-4606A9E52043}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\{C7DA7439-5196-451d-9492-12486CD952CF}.exe
        
        C:\Windows\{C7DA7439-5196-451d-9492-12486CD952CF}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe
        
        C:\Windows\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
        
        C:\Windows\{7B5962E6-140B-467b-BA9A-26400477E628}.exe
        
        C:\Windows\{7B5962E6-140B-467b-BA9A-26400477E628}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
        
        C:\Windows\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}.exe
        
        C:\Windows\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}.exe
        12⤵
        Executes dropped EXE
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B596~1.EXE > nul
        12⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1C48E~1.EXE > nul
        11⤵
        
        PID:692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7DA7~1.EXE > nul
        10⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E065D~1.EXE > nul
        9⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53C5E~1.EXE > nul
        8⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02EC9~1.EXE > nul
        7⤵
        
        PID:2140
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AC870~1.EXE > nul
        6⤵
        
        PID:1720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9BA3B~1.EXE > nul
        5⤵
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AA5E9~1.EXE > nul
      4⤵
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0B275~1.EXE > nul
    3⤵
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{02EC91B1-1B93-4001-AB3C-39F257FD98CE}.exe

Filesize
372KB

MD5
acba9d8ed8c6731b23dc4565119e00c3

SHA1
d2d94e2eec5001005c76cf7effe57d7016f16456

SHA256
e415e32c1d39360cd93856be7cf21c4dfb3bd39e5191a8a8818bb1948bbdd1b3

SHA512
a63fa7c15cd8e64efe07fd4e518df142f047173adc50e3ab85ac99937482bbf85ed5328a11ea18008cfe7349ffb49204d31099c77b480cd34cfbc658bfa2bd9c

Download Submit
C:\Windows\{0B275638-0ED9-4760-8944-F8122DC32368}.exe

Filesize
372KB

MD5
349c0c8e685b8e176980e4d65857f259

SHA1
8d929ee6afdbf24653d124543296f9118c1514b7

SHA256
cc45788f7f9605edb357dabdf5cf2b9a956972c4224a300aaec210fca4bb9211

SHA512
1ce79386261002e7f740e5d2fe0dee148d010102e10f6c458e4ab4083eb154723812b545f784022d0522ffcadd66bf58717f66df8a20135b4b9f0d788784d3ab

Download Submit
C:\Windows\{1C48E80C-0CE9-46a3-AEB8-BA8CFEA80CCF}.exe

Filesize
372KB

MD5
cc2986dc0aee02c5aad1b32cae22fce2

SHA1
544b6376ed0937811c0cc9cf4f4ae16d77036185

SHA256
75e7e19a1dbc2113bc286c6ed005b53ccb514f14e27399fc80694061023c4767

SHA512
745bf61dbfda70e94088af2b3ade8c66da2eec8d03f9fede2c9972e07931c84ac3d923eb8b6169acc14419b2ad2e81a0fe0dc73d1a7649e3f3bcc881ae98187f

Download Submit
C:\Windows\{53C5E2D1-1D99-48cc-BD0C-6587003D00C4}.exe

Filesize
372KB

MD5
d51a43b5e82ae27c91dd46673c75753b

SHA1
919a3f5ceedf403b989607e968834c661341b551

SHA256
d0900d3370a08aeab2ff1ad7fe537f591b87b15cd57768ca01a11f9438ae0dd5

SHA512
ceefbbc7bc82c80bf19d90242a8676040bce95d4db339cd78cbb6d225fe5c416e9f7303a6e4a409e0440ae0316590fd911710338a2f70b777966304d80a5c7b0

Download Submit
C:\Windows\{7B5962E6-140B-467b-BA9A-26400477E628}.exe

Filesize
372KB

MD5
a02a3cfd4d7d55b346ab607568143234

SHA1
cdcedd5569f0be330010f8b348a213a7b46e5a50

SHA256
ac98388384cf0a2e9d73508fd6f1cda6effd42f8822e30313ff2d0336a36169f

SHA512
5fbcec59ce4dd3b46bed7c4640ec2b92a28462d864d18dd4ed53e549453090137c3e63acec76e336b2786857f9c170a50bf56a02d69097cd0216e02de7f91cad

Download Submit
C:\Windows\{9BA3B657-B54C-46d9-A7D3-EB0E2E97D676}.exe

Filesize
372KB

MD5
efcd36ed4bd767dcb56edb4ab6ef0e2d

SHA1
99b97ed9d97e144f3e261fa84de0649c619bc501

SHA256
dff6e17411c1c2e28e95ccafd3a6702265e4aff96856abaaccfe92fce54e484e

SHA512
7f031c255e2eaae6ebf83dedc03a2a8249900be3ff68774e87dd8b3a61f371b3cf87f6d4e3b037d05d3985d0049defc40e6e7924c09db09b5e3294179152403a

Download Submit
C:\Windows\{AA5E99DE-BFC8-423e-B252-49B51DB755AB}.exe

Filesize
372KB

MD5
8617ad09c17a949f66a7a6e88e5d7a0e

SHA1
477461c3706733fcc084babcd93af823d4e746e7

SHA256
3f7eb7b304afa7062796a0f152d10058af6e0d5e0b1f75ce4a9e8d53b4140778

SHA512
b819fa764537acef3dd4a6c0ea2d32650e03fb0dfe6cf3ff3dde4d7170273b9283ab45a7204e8d70c8baa4fd50d3d0cabfaa5635654bb4c9831fb199708868af

Download Submit
C:\Windows\{AC870C92-8EA9-49e8-B49C-0E4BA24F34AF}.exe

Filesize
372KB

MD5
415d9303b03ca67b0a5325f6cb9f0d1d

SHA1
f5e0d687491540130a9e723dd5c8aded331ec18c

SHA256
9c0a740c8def30ca6c6809301f1a9fa3379692809cc4ba6d5cf820170a0b594a

SHA512
6c8913915665de0a3c971b6d3edb2d42541fc6e45263515d8198ca4197199fdf341b0ac942e1c28be0538b63ae844873ab877ae025f9b50adf2952f988a8243f

Download Submit
C:\Windows\{C7DA7439-5196-451d-9492-12486CD952CF}.exe

Filesize
372KB

MD5
f043ca4fa66b2dd520989312d91865ac

SHA1
335ef0e34e35c5e906d8b204031f3c8727b59a34

SHA256
3039ca3cf796da286331eb0adc7ac2bad18ccf7bd04d7dd6cf29ff2694602b71

SHA512
0e1ba20e4e1572d75eb1a4b77e477450157bfc6ec1d0729174de5bee22352ae95aecb1c3b5c2e2e506818df309777058c8eaaea6ab7ffd381bf09f12e1297ddd

Download Submit
C:\Windows\{E065D0D3-295B-4752-95C1-4606A9E52043}.exe

Filesize
372KB

MD5
8db966539329768d4f1c0dc23aa80551

SHA1
8ac36ec0e2c2071793ef7a3a83bac91cccbe3c17

SHA256
9f1ded4b83f0e4f97e7b2b1bb2a893576a89bfc302dfafc941741dec2ce9c827

SHA512
f55d04791030f115d01cda8f14408e3813da2dedb7d45956ca7b5c293c8facdff3f98a1100fc1f230161b99b0502ed394ab02129b381bd9761b3b0309933fb30

Download Submit
C:\Windows\{FAC50E93-5480-4d5c-A1CA-E4BB939F577E}.exe

Filesize
372KB

MD5
6b1d9b6425d893bc428cd0486669e03a

SHA1
563314ed28e4534274d19997fa477371fcc708a4

SHA256
030148e683a9f0bd16ac615543d2c73cbcf52170ea3c13677a6a2f0f74110191

SHA512
f3917f62b02b0157213cd6b3ff167b25d9e4d893c9280cf6b26bb8be6c302566df39ff9f3dd44eb65c8aab070c9a121566a7ba04a628d167b30edcc99d25971a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads