acfc29b2d6b8d6d0d796db1fa0f07c46133aa670b0fa313f91708ee8e611125d

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe
Size

408KB
MD5

63491eda1deeecab79878ac00a7cdd2b
SHA1

b1c660e932b753248763d9a20d32cfa703c432e3
SHA256

acfc29b2d6b8d6d0d796db1fa0f07c46133aa670b0fa313f91708ee8e611125d
SHA512

6449c23e7307785f5ec6345616a112ee46203a30f97c82dabf1451990c4749a922df7d8575ae3d9ecb90b64666c1d43ba76ec1204f44cd8f313047c839286df7
SSDEEP

3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGNldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012120-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002f00000001325f-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000012120-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00300000000132f2-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000012120-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012120-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012120-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4ABCA75F-9467-4001-B776-F044403FEF1D}\stubpath = "C:\\Windows\\{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe"	{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61B7DE7B-5955-4076-A82A-E59F529C1F50}\stubpath = "C:\\Windows\\{61B7DE7B-5955-4076-A82A-E59F529C1F50}.exe"	{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{293A2381-6937-4de4-8482-169436BE4EDA}	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F208F434-82C3-40b1-A1DB-91C0708E3B60}	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F208F434-82C3-40b1-A1DB-91C0708E3B60}\stubpath = "C:\\Windows\\{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe"	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9F108325-CC17-4f42-A9FE-467C2FACC478}	{293A2381-6937-4de4-8482-169436BE4EDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9F108325-CC17-4f42-A9FE-467C2FACC478}\stubpath = "C:\\Windows\\{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe"	{293A2381-6937-4de4-8482-169436BE4EDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}\stubpath = "C:\\Windows\\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe"	{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61B7DE7B-5955-4076-A82A-E59F529C1F50}	{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{293A2381-6937-4de4-8482-169436BE4EDA}\stubpath = "C:\\Windows\\{293A2381-6937-4de4-8482-169436BE4EDA}.exe"	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{874873C2-0AB5-4ac6-A079-D81249EF28FC}\stubpath = "C:\\Windows\\{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe"	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}\stubpath = "C:\\Windows\\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe"	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}\stubpath = "C:\\Windows\\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe"	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F63DF959-7556-42fd-AEFF-575C3F81289E}\stubpath = "C:\\Windows\\{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe"	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{874873C2-0AB5-4ac6-A079-D81249EF28FC}	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}\stubpath = "C:\\Windows\\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe"	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}	{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4ABCA75F-9467-4001-B776-F044403FEF1D}	{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F63DF959-7556-42fd-AEFF-575C3F81289E}	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe

Deletes itself 1 IoCs

pid	Process
3064	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe
2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe
2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe
1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
2836	{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
2984	{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
1928	{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe
584	{61B7DE7B-5955-4076-A82A-E59F529C1F50}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe	{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
File created	C:\Windows\{61B7DE7B-5955-4076-A82A-E59F529C1F50}.exe	{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe
File created	C:\Windows\{293A2381-6937-4de4-8482-169436BE4EDA}.exe	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
File created	C:\Windows\{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	{293A2381-6937-4de4-8482-169436BE4EDA}.exe
File created	C:\Windows\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
File created	C:\Windows\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe	{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
File created	C:\Windows\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
File created	C:\Windows\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe
File created	C:\Windows\{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
File created	C:\Windows\{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe
File created	C:\Windows\{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
Token: SeIncBasePriorityPrivilege	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe
Token: SeIncBasePriorityPrivilege	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
Token: SeIncBasePriorityPrivilege	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe
Token: SeIncBasePriorityPrivilege	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe
Token: SeIncBasePriorityPrivilege	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
Token: SeIncBasePriorityPrivilege	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
Token: SeIncBasePriorityPrivilege	2836	{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
Token: SeIncBasePriorityPrivilege	2984	{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
Token: SeIncBasePriorityPrivilege	1928	{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2772	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	28
PID 1008 wrote to memory of 2772	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	28
PID 1008 wrote to memory of 2772	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	28
PID 1008 wrote to memory of 2772	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	28
PID 1008 wrote to memory of 3064	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	29
PID 1008 wrote to memory of 3064	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	29
PID 1008 wrote to memory of 3064	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	29
PID 1008 wrote to memory of 3064	1008	2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe	29
PID 2772 wrote to memory of 2576	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	30
PID 2772 wrote to memory of 2576	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	30
PID 2772 wrote to memory of 2576	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	30
PID 2772 wrote to memory of 2576	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	30
PID 2772 wrote to memory of 2600	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	31
PID 2772 wrote to memory of 2600	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	31
PID 2772 wrote to memory of 2600	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	31
PID 2772 wrote to memory of 2600	2772	{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe	31
PID 2576 wrote to memory of 2492	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	32
PID 2576 wrote to memory of 2492	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	32
PID 2576 wrote to memory of 2492	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	32
PID 2576 wrote to memory of 2492	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	32
PID 2576 wrote to memory of 2828	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	33
PID 2576 wrote to memory of 2828	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	33
PID 2576 wrote to memory of 2828	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	33
PID 2576 wrote to memory of 2828	2576	{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe	33
PID 2492 wrote to memory of 1976	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	36
PID 2492 wrote to memory of 1976	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	36
PID 2492 wrote to memory of 1976	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	36
PID 2492 wrote to memory of 1976	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	36
PID 2492 wrote to memory of 1640	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	37
PID 2492 wrote to memory of 1640	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	37
PID 2492 wrote to memory of 1640	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	37
PID 2492 wrote to memory of 1640	2492	{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe	37
PID 1976 wrote to memory of 2780	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	38
PID 1976 wrote to memory of 2780	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	38
PID 1976 wrote to memory of 2780	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	38
PID 1976 wrote to memory of 2780	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	38
PID 1976 wrote to memory of 2812	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	39
PID 1976 wrote to memory of 2812	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	39
PID 1976 wrote to memory of 2812	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	39
PID 1976 wrote to memory of 2812	1976	{293A2381-6937-4de4-8482-169436BE4EDA}.exe	39
PID 2780 wrote to memory of 1776	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	40
PID 2780 wrote to memory of 1776	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	40
PID 2780 wrote to memory of 1776	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	40
PID 2780 wrote to memory of 1776	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	40
PID 2780 wrote to memory of 2108	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	41
PID 2780 wrote to memory of 2108	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	41
PID 2780 wrote to memory of 2108	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	41
PID 2780 wrote to memory of 2108	2780	{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe	41
PID 1776 wrote to memory of 996	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	42
PID 1776 wrote to memory of 996	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	42
PID 1776 wrote to memory of 996	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	42
PID 1776 wrote to memory of 996	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	42
PID 1776 wrote to memory of 2364	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	43
PID 1776 wrote to memory of 2364	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	43
PID 1776 wrote to memory of 2364	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	43
PID 1776 wrote to memory of 2364	1776	{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe	43
PID 996 wrote to memory of 2836	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	44
PID 996 wrote to memory of 2836	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	44
PID 996 wrote to memory of 2836	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	44
PID 996 wrote to memory of 2836	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	44
PID 996 wrote to memory of 840	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	45
PID 996 wrote to memory of 840	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	45
PID 996 wrote to memory of 840	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	45
PID 996 wrote to memory of 840	996	{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_63491eda1deeecab79878ac00a7cdd2b_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
  C:\Windows\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe
    C:\Windows\{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
      C:\Windows\{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\{293A2381-6937-4de4-8482-169436BE4EDA}.exe
        
        C:\Windows\{293A2381-6937-4de4-8482-169436BE4EDA}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1976
      - C:\Windows\{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe
        
        C:\Windows\{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
        
        C:\Windows\{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
        
        C:\Windows\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
        
        C:\Windows\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
        
        C:\Windows\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Windows\{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe
        
        C:\Windows\{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\{61B7DE7B-5955-4076-A82A-E59F529C1F50}.exe
        
        C:\Windows\{61B7DE7B-5955-4076-A82A-E59F529C1F50}.exe
        12⤵
        Executes dropped EXE
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4ABCA~1.EXE > nul
        12⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BAB3D~1.EXE > nul
        11⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2977C~1.EXE > nul
        10⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D8761~1.EXE > nul
        9⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87487~1.EXE > nul
        8⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F108~1.EXE > nul
        7⤵
        
        PID:2108
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{293A2~1.EXE > nul
        6⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F63DF~1.EXE > nul
        5⤵
        
        PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F208F~1.EXE > nul
      4⤵
      PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1CBBB~1.EXE > nul
    3⤵
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1CBBBE5A-0B1D-44a1-B87B-EA49CF82DF1B}.exe

Filesize
408KB

MD5
ced9cf88ca2ca2eb13609b701362eab8

SHA1
4aa89d1dad93b086905c77c0ac13d595cc1bccf2

SHA256
fac839c3842f258751e98819856f41c7cb273b2b05508b895942680dac390501

SHA512
42c54abb0ac8a457b5b9aaa976f569f083546e813535eb23442c7ae27276550668a521f6048c56987ac4d8595f7e6fa65c84d5f163cbd267ee59244e3fe46034

Download Submit
C:\Windows\{293A2381-6937-4de4-8482-169436BE4EDA}.exe

Filesize
408KB

MD5
3005e5b4ee926204b1c5cc7c9da9b170

SHA1
b8e71aa521c624b9b72a8c56c4e8b92ab53d05af

SHA256
b81842dd14d6ee1b0e9df262fff35062f8f9c39872de81f677748a8cdcc64c95

SHA512
3d993f25d9abd5a755fdd08902b20995c7bbbfa85590f941dd11ce1497721dbe2ef55b6696ee4184bd8e397d82eb012acbe4f386a20b5083da9878b5ca737d8b

Download Submit
C:\Windows\{2977C455-EECC-4dbc-B4FD-4F30AFABD1FD}.exe

Filesize
408KB

MD5
761cab7997c70ee281d23241946a50ea

SHA1
530679d63f397ad92941531e09515e6357475743

SHA256
9202328c1faebd0c9ea802d1a914fc73a3ccfbd6e042dd23faca2393c5ec04aa

SHA512
a2201f312e7bafed762cd868555474e40835969a41f8094a3983a609318565b978102b92bc77b4306dc0df05b6ef9e60d3efeaf19c028afee4489daadecda728

Download Submit
C:\Windows\{4ABCA75F-9467-4001-B776-F044403FEF1D}.exe

Filesize
408KB

MD5
07f52e06bb39176f6d2a747e16fed66c

SHA1
11f3f2f7b5d8189359b3f33c24e146acc5081091

SHA256
bb18638b0dabe2dcf201bade8c4bd365f33d47fe675361a9bda908ad558fea90

SHA512
94e1505aff85fca3adca648c3e0ea586c6884fa8728c4716d7c2cb0c70c5156ef718dd20aabb3c70f1d8ff864baf55434bcde73df159ce3a0ef80faf604e1f11

Download Submit
C:\Windows\{61B7DE7B-5955-4076-A82A-E59F529C1F50}.exe

Filesize
408KB

MD5
8353256a441e8704bcb420747e64b46b

SHA1
08826da936e9245aaf75ec725d2ee1db379515cb

SHA256
23e94ba831a882f5e0dacb8b79951d18634547313e044449459fc532760c755f

SHA512
db0adf0fc098b240defa4778580fbe24672071a5f9b1fc4e079dc01e0b4db2ea959aebfb5debb5bd8b398b7003855bae761f2edaa61f3152e4206a9e94653413

Download Submit
C:\Windows\{874873C2-0AB5-4ac6-A079-D81249EF28FC}.exe

Filesize
408KB

MD5
0f1943d4ef1405e6646b0db6954d5833

SHA1
7ba56c74d4124afcace663a0f4281b03a6026e1a

SHA256
a801b8c0bf60988bc27591ff8787afc0a25221f91a50b371a53b2fbb591ae9fe

SHA512
5810192c4d3b691a618eb675d072f0e1c104fcc2e2721871aa589dc168e71e0571cdceefc064821ebccaaac35dc08275e55755ad582f74fd2b3913801c1f8b3a

Download Submit
C:\Windows\{9F108325-CC17-4f42-A9FE-467C2FACC478}.exe

Filesize
408KB

MD5
188f7aa6a628841a0c283c2c602aa480

SHA1
f2b13463610e05bada68ef77c80f37fa9e075d79

SHA256
7e823bc9dbe2b3b9d9af9934d9ee81f903ba5099a27e4cf1c1fe6a94b19899c1

SHA512
5f3584a5b76f156d21f76bfdf210623e615b503b1e8fadf7a6fa3873e44d1c0692701be5631b8dcedf6b2ce76e9bdf61472a015e57bbe7f0f774087a1a97625e

Download Submit
C:\Windows\{BAB3D35E-E2BB-4372-B7E9-99AB517888BE}.exe

Filesize
408KB

MD5
401634dbe0930277ae8bebc439da7d0b

SHA1
b12771efc6c9119b2100faeb95b52b78d4dfa14c

SHA256
f370c96f81138868b82f7677bbd7509eb3c5be87bf683f744adfb1e02368b47c

SHA512
8a0a0c568a504e3a4740dcfc60565561a3e8bef0a33d6aa03b76262184ed5d70d4f44da12a807987181dfab6500856a9cbf9bd870bf2d3ff8a2ef105d43658f7

Download Submit
C:\Windows\{D876134F-C7AC-49c3-80AE-35117CA6D7F9}.exe

Filesize
408KB

MD5
32da3da53e8f37a3090a7ed348caf00d

SHA1
da50e24ddbd44385a6876c7dee00c30439b2a598

SHA256
07ba68270a4c9892dc5ec92dc612f3d8d719cca287f4f4a387561be3de0058a1

SHA512
b206606a5c0967b056716e59eeb327035cb0538831809de38d7a3574049889b9f839f5563c420ebb6978eebbbd153887f6a1d9b3c07fc19d5c6d956a58a90310

Download Submit
C:\Windows\{F208F434-82C3-40b1-A1DB-91C0708E3B60}.exe

Filesize
408KB

MD5
b915b0b7b1c2f772b034d78decf0a90f

SHA1
e0326c695a2e29cdf07ac740d10b098e170c7f55

SHA256
f65ad87fdf83c642292a0c626e93d76c6087a9c61869e969b55b542b6962cc63

SHA512
6e2e76eae3a5346c4e241c7c3a1b6bba8c147953cd9e682f2580e8d98574dc37e50a093a27d4c9e1d26dffcc984a10a7d2a79f09c1625947880ad4a87aba460c

Download Submit
C:\Windows\{F63DF959-7556-42fd-AEFF-575C3F81289E}.exe

Filesize
408KB

MD5
d0b09be3e7072b0955a9696158b9aef2

SHA1
9bd8db132a6b399331e6d757ba6befb106e8d3f3

SHA256
0bed1219ac58ca7c9f0db202cc38ca93f60f3113e21e65e2a369d30eadd19ade

SHA512
8bfd3d3a19c232b311d39588e70a88d2c2598db75e32f4c6aa83103d3fa1f2d026845f557cd3ba0eb576b86d3a079b9b46a444f708a2e5a2b8bb031b3944af4b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads