78c0bdc3e6e95392c00788073149173320093427d91da2fda64c9bd17faa289b

Analysis

max time kernel
144s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe
Size

344KB
MD5

7406e49c5c5c0eed317bc1b64e61bbd6
SHA1

38bd5e0e0b2b5d3e65685df9526d093b0f372c0c
SHA256

78c0bdc3e6e95392c00788073149173320093427d91da2fda64c9bd17faa289b
SHA512

f2810c9b06602ec3f8a33e6e5b1ed1b05ea7c24145c0865492bcb1b9e894ca65b9a12a7423154b1c1f9f4cea5cd21689bfb1b9922c55983527abf13701126efd
SSDEEP

3072:mEGh0oMlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG6lqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001227e-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00380000000141ab-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001227e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00380000000141af-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001227e-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001227e-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000001227e-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}\stubpath = "C:\\Windows\\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe"	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}\stubpath = "C:\\Windows\\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe"	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}\stubpath = "C:\\Windows\\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe"	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}\stubpath = "C:\\Windows\\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe"	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}\stubpath = "C:\\Windows\\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe"	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}\stubpath = "C:\\Windows\\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe"	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A942273-4F00-4a11-BCE8-211596649439}	{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63577FEC-F951-4512-BECB-8C963AA4BDF2}\stubpath = "C:\\Windows\\{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe"	{0A942273-4F00-4a11-BCE8-211596649439}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}\stubpath = "C:\\Windows\\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe"	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12BE75AD-0755-4df3-826A-51947C8A7BEA}	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12BE75AD-0755-4df3-826A-51947C8A7BEA}\stubpath = "C:\\Windows\\{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe"	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A942273-4F00-4a11-BCE8-211596649439}\stubpath = "C:\\Windows\\{0A942273-4F00-4a11-BCE8-211596649439}.exe"	{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63577FEC-F951-4512-BECB-8C963AA4BDF2}	{0A942273-4F00-4a11-BCE8-211596649439}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}	{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}\stubpath = "C:\\Windows\\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}.exe"	{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe

Deletes itself 1 IoCs

pid	Process
1152	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
468	{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
2060	{0A942273-4F00-4a11-BCE8-211596649439}.exe
2876	{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe
336	{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe
File created	C:\Windows\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
File created	C:\Windows\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
File created	C:\Windows\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
File created	C:\Windows\{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
File created	C:\Windows\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
File created	C:\Windows\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
File created	C:\Windows\{0A942273-4F00-4a11-BCE8-211596649439}.exe	{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
File created	C:\Windows\{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe	{0A942273-4F00-4a11-BCE8-211596649439}.exe
File created	C:\Windows\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
File created	C:\Windows\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}.exe	{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
Token: SeIncBasePriorityPrivilege	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
Token: SeIncBasePriorityPrivilege	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
Token: SeIncBasePriorityPrivilege	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
Token: SeIncBasePriorityPrivilege	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
Token: SeIncBasePriorityPrivilege	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
Token: SeIncBasePriorityPrivilege	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
Token: SeIncBasePriorityPrivilege	468	{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
Token: SeIncBasePriorityPrivilege	2060	{0A942273-4F00-4a11-BCE8-211596649439}.exe
Token: SeIncBasePriorityPrivilege	2876	{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2092	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	28
PID 2928 wrote to memory of 2092	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	28
PID 2928 wrote to memory of 2092	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	28
PID 2928 wrote to memory of 2092	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	28
PID 2928 wrote to memory of 1152	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	29
PID 2928 wrote to memory of 1152	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	29
PID 2928 wrote to memory of 1152	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	29
PID 2928 wrote to memory of 1152	2928	2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe	29
PID 2092 wrote to memory of 2720	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	30
PID 2092 wrote to memory of 2720	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	30
PID 2092 wrote to memory of 2720	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	30
PID 2092 wrote to memory of 2720	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	30
PID 2092 wrote to memory of 2628	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	31
PID 2092 wrote to memory of 2628	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	31
PID 2092 wrote to memory of 2628	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	31
PID 2092 wrote to memory of 2628	2092	{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe	31
PID 2720 wrote to memory of 2708	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	32
PID 2720 wrote to memory of 2708	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	32
PID 2720 wrote to memory of 2708	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	32
PID 2720 wrote to memory of 2708	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	32
PID 2720 wrote to memory of 3068	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	33
PID 2720 wrote to memory of 3068	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	33
PID 2720 wrote to memory of 3068	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	33
PID 2720 wrote to memory of 3068	2720	{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe	33
PID 2708 wrote to memory of 2408	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	36
PID 2708 wrote to memory of 2408	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	36
PID 2708 wrote to memory of 2408	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	36
PID 2708 wrote to memory of 2408	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	36
PID 2708 wrote to memory of 1916	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	37
PID 2708 wrote to memory of 1916	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	37
PID 2708 wrote to memory of 1916	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	37
PID 2708 wrote to memory of 1916	2708	{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe	37
PID 2408 wrote to memory of 2856	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	38
PID 2408 wrote to memory of 2856	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	38
PID 2408 wrote to memory of 2856	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	38
PID 2408 wrote to memory of 2856	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	38
PID 2408 wrote to memory of 2892	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	39
PID 2408 wrote to memory of 2892	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	39
PID 2408 wrote to memory of 2892	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	39
PID 2408 wrote to memory of 2892	2408	{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe	39
PID 2856 wrote to memory of 2904	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	40
PID 2856 wrote to memory of 2904	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	40
PID 2856 wrote to memory of 2904	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	40
PID 2856 wrote to memory of 2904	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	40
PID 2856 wrote to memory of 1940	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	41
PID 2856 wrote to memory of 1940	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	41
PID 2856 wrote to memory of 1940	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	41
PID 2856 wrote to memory of 1940	2856	{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe	41
PID 2904 wrote to memory of 1612	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	42
PID 2904 wrote to memory of 1612	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	42
PID 2904 wrote to memory of 1612	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	42
PID 2904 wrote to memory of 1612	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	42
PID 2904 wrote to memory of 764	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	43
PID 2904 wrote to memory of 764	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	43
PID 2904 wrote to memory of 764	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	43
PID 2904 wrote to memory of 764	2904	{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe	43
PID 1612 wrote to memory of 468	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	44
PID 1612 wrote to memory of 468	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	44
PID 1612 wrote to memory of 468	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	44
PID 1612 wrote to memory of 468	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	44
PID 1612 wrote to memory of 1396	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	45
PID 1612 wrote to memory of 1396	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	45
PID 1612 wrote to memory of 1396	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	45
PID 1612 wrote to memory of 1396	1612	{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_7406e49c5c5c0eed317bc1b64e61bbd6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
  C:\Windows\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
    C:\Windows\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
      C:\Windows\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
        
        C:\Windows\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
        
        C:\Windows\{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
        
        C:\Windows\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
        
        C:\Windows\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
        
        C:\Windows\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
        
        C:\Windows\{0A942273-4F00-4a11-BCE8-211596649439}.exe
        
        C:\Windows\{0A942273-4F00-4a11-BCE8-211596649439}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe
        
        C:\Windows\{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}.exe
        
        C:\Windows\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}.exe
        12⤵
        Executes dropped EXE
        
        PID:336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{63577~1.EXE > nul
        12⤵
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A942~1.EXE > nul
        11⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E9502~1.EXE > nul
        10⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA5CC~1.EXE > nul
        9⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4DBF0~1.EXE > nul
        8⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12BE7~1.EXE > nul
        7⤵
        
        PID:1940
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{39562~1.EXE > nul
        6⤵
        
        PID:2892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E115D~1.EXE > nul
        5⤵
        
        PID:1916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8E4A2~1.EXE > nul
      4⤵
      PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9A91E~1.EXE > nul
    3⤵
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A942273-4F00-4a11-BCE8-211596649439}.exe

Filesize
344KB

MD5
84c01886b6463f8a58d63c0a02da9903

SHA1
318257054cbdec668a0000a6094dc4b7acd82dc5

SHA256
a315c8aade21174c5285dfa0b3c7f463dc251e27287ef93d876e1823c0345ce8

SHA512
656b71c12e7e2f199c1b7dea21ce45703b0c1cbad528bbb8c62a79f5fa2dcb7e645f28c6bfc7bc9c74ed47df75210623a94cb3ad29356dd3af24996475a42b46

Download Submit
C:\Windows\{12BE75AD-0755-4df3-826A-51947C8A7BEA}.exe

Filesize
344KB

MD5
d3bb38cb6f2b8c6a46d5f92cac15d91c

SHA1
b03dbfed6953ee37d861e58f2a70c2b045c5e751

SHA256
9f1cd2d3ca089be69fd9bfb3df20fdc8da8d879cbfa32dd7e3b75bace3c84dd7

SHA512
5166cb956ce89ca037baf46c07283c9f909394f9ba9315662656094648778625b9f46dda65cce19d86adb2cbb38d17838a4f0bf243e7f813e3ac0f226fadeebd

Download Submit
C:\Windows\{39562429-9DC0-45d6-B1AE-A51E3F0DD200}.exe

Filesize
344KB

MD5
e50506418e3e9010871308674fb35081

SHA1
d72c79b28d7dc16ba86b98eaa3799cf9a0f4fd7d

SHA256
d875172873210d1006ef8ac092af0eb79b631516b21f429774877a10c83d9440

SHA512
6464cea873b1a6bf96ec169be45da9b4c27a742509cbed091aeee03969b51663406533c8a101fa9196e080414e14812c690334893fddb598c3519e8d50f58f11

Download Submit
C:\Windows\{4DBF08F9-BAA0-4852-8142-DB7EA926431E}.exe

Filesize
344KB

MD5
f7567609a654a4207a93c0d214264b2a

SHA1
1053197fc29b17203ff2de6e90afb46bb3585705

SHA256
72c0952cd7bacefd7f63ec22d7781a69995200bbbcb05b2f6ccbd2ae9c6986af

SHA512
75d0527faa7208de68c0c62ec6408d84f324efb29afaa040c2d2018ac50fdb6fec75cbe96f63ffafb49f9a59041d01a38ae993b83283e4ef6603cbb1f3e4f02c

Download Submit
C:\Windows\{63577FEC-F951-4512-BECB-8C963AA4BDF2}.exe

Filesize
344KB

MD5
a4e5ce7c9fdcad5c452483511442c8e0

SHA1
a6e245b745e5cb919ce3afb93cee57426357a834

SHA256
c65cdac1d7f0c76e07bc90d03358124b79e109518c93b060b77c04073b625c38

SHA512
a4afeebf027c43babda63c50c572c864337971a689f6867ed3ec786b1f5cc11a00d39c0694eb6a6d3323dc705e72516329b33769260f3621268cff5b0292c4cf

Download Submit
C:\Windows\{79B453DA-720B-498c-83DB-9DBEAA6EBEC4}.exe

Filesize
344KB

MD5
520ed0ee5c1de6e736504961c64dc0b8

SHA1
3922b848eb78eea76ba561b431017c09c945dbe5

SHA256
078d2cdb1d62a377a7ea52afd995e63cf585d1bcd8611272f845ebebe7255028

SHA512
8d5a96e8c9d09615e24538d45a0742f7336f50be380a522f2b5e5b01ea27e499f769e461195cbeb9d49c5d98b0583c33370c590a393f93d8acf005c7a9123d76

Download Submit
C:\Windows\{8E4A2323-D4FA-454e-8DC8-EF1F309AE576}.exe

Filesize
344KB

MD5
d4df2201ae89c9ee8fb062fe8a8eb941

SHA1
0c9cfa9b618aef7f2950dd5aafba4ada799506be

SHA256
6d6fbd3c4e035870cb25f1522076458e59e3c8db6c4108765d29ef9eb151b8ca

SHA512
122f14b8fa95c5f298ae004fe548876f7a9f596dc09d7c72af7c2e3e15c7dfadd47ef3f30ee09452f985b91c1bdcca1390d7ee6de776c61e16e45930ae245bc3

Download Submit
C:\Windows\{9A91EDCC-1CD7-4eec-8005-7B987B1166F1}.exe

Filesize
344KB

MD5
a179d022f2f94f24e7df33a2a00c6380

SHA1
0e5b2340284acdc673e18e9f950f55ffabf0304d

SHA256
e41835d4bdc502ebdccb815155769ca5ccf2bd0fe9f8799ef61ead69a8b2e687

SHA512
444b81610f856d643277db743883fab8d555f966ecf488ff3443f541c802c82fbee03c5e21f52f519b9c6cdf1a3d22cbec50e857e4a064a32f3435c39648b03c

Download Submit
C:\Windows\{E115DAFF-E77F-4f6c-B9BE-9D8FCEAED282}.exe

Filesize
344KB

MD5
43202a5b5da9d9d3236f90f41075e1ff

SHA1
b40f04f034aa2d0df6fd393ecaa7a8d2f3421dfb

SHA256
07cb3dac265b8a630d0c72d20c6dffc816b5e080142d3af21fa8c41f67acca09

SHA512
3fb6a78b5f0b26106c6c5b95682119bb5e32de01e48dc8209c6df8891f394cca6a2a32eff519974d3c099f223a50c68942fc710e8d614fc3e51c6965dcca75d8

Download Submit
C:\Windows\{E9502D4A-BC61-4b93-8B75-9B29F850B2EC}.exe

Filesize
344KB

MD5
de06d4a115683f8ec957433a71d8e6cb

SHA1
7bddf032973c13027e9c39aaf593006708489323

SHA256
cfa91dfdc4ffe04478beed026a224084d85b7e9be13748e89ee0293c8ab09340

SHA512
8aa1f2cbb5e4b45d21fcda8e8eac45ca1129777567864c157050f15cbeecf68f8a06d63ed57119cfa9652939c547f8e442a07d2a9a87638461b20510596755f4

Download Submit
C:\Windows\{FA5CC6D1-71D9-4b90-9D02-21B4D53453FA}.exe

Filesize
344KB

MD5
13b480de32824de982ab6a8777d48d33

SHA1
01de0b8d62993bfe1bd5a787a98e1dd322866959

SHA256
a2f57b5388161ac4db406daf9afd36b363290ffd44431a1be8299946ef5a5192

SHA512
1aa41990b76ff9b061021bb968ead66d629507b03ae1b8eaa5550e3f99c568a462c8bd8bfc83e8475884019e1e25f2b47bf88ecf9a14388093ec079a633d0c4e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads