3e80d34feae311e159baf564aa086b09e535dc4d5860aaaa3b91a686bb4ee21b

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe
Size 344KB
Sample240613-mscjksvglb
SHA256 3e80d34feae311e159baf564aa086b09e535dc4d5860aaaa3b91a686bb4ee21b
MD5 16e03f717fdddad5bc762dae03a5720e
SHA1 ef1c7a088f05341d422ceaab09b8afe10138b490
SHA512 b8c102a3821c08a5460cf2754d5ec25e7676f881664e045c7304476f060e5ec97870dcc48a35da070945487dd2b233408839489174d12ceab7f10a733d6d3c91
SSDEEP 3072:mEGh0oslEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGClqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 10 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023240-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023247-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023250-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000022fda-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219e9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000000026-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000000070d-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}\stubpath = "C:\\Windows\\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe"	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}\stubpath = "C:\\Windows\\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe"	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792E6018-2561-4e73-A749-93F805EC477F}\stubpath = "C:\\Windows\\{792E6018-2561-4e73-A749-93F805EC477F}.exe"	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}\stubpath = "C:\\Windows\\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe"	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{792E6018-2561-4e73-A749-93F805EC477F}	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}\stubpath = "C:\\Windows\\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe"	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3897070E-43AC-4d90-931A-3DF55BB81E20}\stubpath = "C:\\Windows\\{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe"	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}\stubpath = "C:\\Windows\\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe"	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{780F5299-4DDE-4618-BBE1-4BF97198D009}	{792E6018-2561-4e73-A749-93F805EC477F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3897070E-43AC-4d90-931A-3DF55BB81E20}	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6975FE6C-3984-4d01-BB3D-10051B88FA85}	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6975FE6C-3984-4d01-BB3D-10051B88FA85}\stubpath = "C:\\Windows\\{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe"	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}\stubpath = "C:\\Windows\\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe"	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{780F5299-4DDE-4618-BBE1-4BF97198D009}\stubpath = "C:\\Windows\\{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe"	{792E6018-2561-4e73-A749-93F805EC477F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe

Executes dropped EXE 10 IoCs

pid	Process
2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe
2644	{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
File created	C:\Windows\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
File created	C:\Windows\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
File created	C:\Windows\{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe	{792E6018-2561-4e73-A749-93F805EC477F}.exe
File created	C:\Windows\{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe
File created	C:\Windows\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
File created	C:\Windows\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
File created	C:\Windows\{792E6018-2561-4e73-A749-93F805EC477F}.exe	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
File created	C:\Windows\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
File created	C:\Windows\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
Token: SeIncBasePriorityPrivilege	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
Token: SeIncBasePriorityPrivilege	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
Token: SeIncBasePriorityPrivilege	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
Token: SeIncBasePriorityPrivilege	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
Token: SeIncBasePriorityPrivilege	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
Token: SeIncBasePriorityPrivilege	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
Token: SeIncBasePriorityPrivilege	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
Token: SeIncBasePriorityPrivilege	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2484	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe	92
PID 4948 wrote to memory of 2484	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe	92
PID 4948 wrote to memory of 2484	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe	92
PID 4948 wrote to memory of 3596	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe	93
PID 4948 wrote to memory of 3596	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe	93
PID 4948 wrote to memory of 3596	4948	2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe	93
PID 2484 wrote to memory of 2460	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	97
PID 2484 wrote to memory of 2460	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	97
PID 2484 wrote to memory of 2460	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	97
PID 2484 wrote to memory of 3540	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	98
PID 2484 wrote to memory of 3540	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	98
PID 2484 wrote to memory of 3540	2484	{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe	98
PID 2460 wrote to memory of 4240	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	103
PID 2460 wrote to memory of 4240	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	103
PID 2460 wrote to memory of 4240	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	103
PID 2460 wrote to memory of 2884	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	104
PID 2460 wrote to memory of 2884	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	104
PID 2460 wrote to memory of 2884	2460	{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe	104
PID 4240 wrote to memory of 3052	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	105
PID 4240 wrote to memory of 3052	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	105
PID 4240 wrote to memory of 3052	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	105
PID 4240 wrote to memory of 2088	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	106
PID 4240 wrote to memory of 2088	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	106
PID 4240 wrote to memory of 2088	4240	{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe	106
PID 3052 wrote to memory of 4144	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	107
PID 3052 wrote to memory of 4144	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	107
PID 3052 wrote to memory of 4144	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	107
PID 3052 wrote to memory of 3100	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	108
PID 3052 wrote to memory of 3100	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	108
PID 3052 wrote to memory of 3100	3052	{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe	108
PID 4144 wrote to memory of 4024	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	109
PID 4144 wrote to memory of 4024	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	109
PID 4144 wrote to memory of 4024	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	109
PID 4144 wrote to memory of 5008	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	110
PID 4144 wrote to memory of 5008	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	110
PID 4144 wrote to memory of 5008	4144	{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe	110
PID 4024 wrote to memory of 2224	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	111
PID 4024 wrote to memory of 2224	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	111
PID 4024 wrote to memory of 2224	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	111
PID 4024 wrote to memory of 2772	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	112
PID 4024 wrote to memory of 2772	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	112
PID 4024 wrote to memory of 2772	4024	{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe	112
PID 2224 wrote to memory of 4304	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	113
PID 2224 wrote to memory of 4304	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	113
PID 2224 wrote to memory of 4304	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	113
PID 2224 wrote to memory of 4200	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	114
PID 2224 wrote to memory of 4200	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	114
PID 2224 wrote to memory of 4200	2224	{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe	114
PID 4304 wrote to memory of 1920	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	115
PID 4304 wrote to memory of 1920	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	115
PID 4304 wrote to memory of 1920	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	115
PID 4304 wrote to memory of 2440	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	116
PID 4304 wrote to memory of 2440	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	116
PID 4304 wrote to memory of 2440	4304	{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe	116
PID 1920 wrote to memory of 2644	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe	117
PID 1920 wrote to memory of 2644	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe	117
PID 1920 wrote to memory of 2644	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe	117
PID 1920 wrote to memory of 2940	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe	118
PID 1920 wrote to memory of 2940	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe	118
PID 1920 wrote to memory of 2940	1920	{792E6018-2561-4e73-A749-93F805EC477F}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_16e03f717fdddad5bc762dae03a5720e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
  C:\Windows\{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
    C:\Windows\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
      C:\Windows\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
        
        C:\Windows\{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3052
      - C:\Windows\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
        
        C:\Windows\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
        
        C:\Windows\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
        
        C:\Windows\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
        
        C:\Windows\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\{792E6018-2561-4e73-A749-93F805EC477F}.exe
        
        C:\Windows\{792E6018-2561-4e73-A749-93F805EC477F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe
        
        C:\Windows\{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe
        11⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{792E6~1.EXE > nul
        11⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8F8E4~1.EXE > nul
        10⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E1570~1.EXE > nul
        9⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EBE1D~1.EXE > nul
        8⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DF004~1.EXE > nul
        7⤵
        
        PID:5008
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6975F~1.EXE > nul
        6⤵
        
        PID:3100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28D92~1.EXE > nul
        5⤵
        
        PID:2088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E1DC4~1.EXE > nul
      4⤵
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{38970~1.EXE > nul
    3⤵
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe

Path C:\Windows\{28D9258B-8F4E-48aa-8889-BCCC031A85EC}.exe
Size 344KB
SHA256 27c5f0e050f88e16e8cea5ba79c35c934e142b1029cd2d5fcacd48460eb938c4
MD5 8e03961980e27c552c4999796462e61f
SHA1 bfcb90a28513fe0a8d657b95594a74fb1e977953
SHA512 91f6ce824eec1ed81999de7373f3808ec583411135ae9de5d12153f6231717dc86c1a73607b7cee4abcd9a59da37247911e54d4b642a331d4b7649a89d1abb6a
SSDEEP 3072:mEGh0oxlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGrlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe

Path C:\Windows\{3897070E-43AC-4d90-931A-3DF55BB81E20}.exe
Size 344KB
SHA256 a5e19f51400d99dd261205473fa69e8becb9db81262aa240311310c1087d90c3
MD5 afd91079a47869cbb8c96c2957d8206d
SHA1 d4821f184cc0b5e0343b671a0c3b15e0e1c603a8
SHA512 019a60f13d8d830ec0932da912dbad0a88230085a3d1754f0a328e031560409fb72ed66814f275ed3ae4d1982ef580896eae3052232c1cae2e39e2b20e3f608e
SSDEEP 3072:mEGh0oOlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe

Path C:\Windows\{6975FE6C-3984-4d01-BB3D-10051B88FA85}.exe
Size 344KB
SHA256 1d311e74a428fa28a0b683e90bc84dcd6f924acf4c2d6e1b2d7c3032117cf09a
MD5 ddc238f8548ddb1cb503a280b1654a00
SHA1 8e1f6861669980629765d0bd601a350d4d556637
SHA512 774fbae24fe2bbc4bce39ef2efa7dc0cbf23954aae92f4d8488313dc3348dc36ef889e4c820fdcada27ed45cb867666e310cc41f9dfcb77a5f78fc30b875f314
SSDEEP 3072:mEGh0oulEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGklqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe

Path C:\Windows\{780F5299-4DDE-4618-BBE1-4BF97198D009}.exe
Size 344KB
SHA256 1f98c771afbef01708d9409b93c5b6233ae13a40c29e289a8045af5cf5118e81
MD5 da9b6b2d8ec5f93180f664fe6ebf6d73
SHA1 1d3568df0bee97b9e341ecb9ef492709dcc060f5
SHA512 a7694cc08f28ac79134a7ed048e7c31b8a9fd5a8dae85b6fae5e1fae01dbb8f2baab4e5bf331bad99a8cc1b31d85feb46e1de7d39475750a11ac5b34ab5697c0
SSDEEP 3072:mEGh0ozlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGBlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{792E6018-2561-4e73-A749-93F805EC477F}.exe

Path C:\Windows\{792E6018-2561-4e73-A749-93F805EC477F}.exe
Size 344KB
SHA256 adb1f0358ae085401c36c36facabb39f9e025f1a673331db6f39726dd39132ce
MD5 ff4b0f039b94471e4c106ab0a06d8bbb
SHA1 41c1ab51466e1e4e9afedf3b040dc4a3b13e53d5
SHA512 7f47477a85aa0e8bc082cc50d2df80bed49cf64bd8956fadcf7926654f5331d9216ad1f6c10920e2a393bec1aa34af60494b8e7d084df4f90d43d5e4a29d241e
SSDEEP 3072:mEGh0oxlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGDlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe

Path C:\Windows\{8F8E4712-1AB4-4b05-8A2B-EA81DD4019DA}.exe
Size 344KB
SHA256 0139797814eb039fba17adaf0122e0319415d92ae8793e6842641a628c98d2ed
MD5 90fcdf4a70e1670be23ed59269cf5908
SHA1 362ba50c7a4258c099bcde26c4911e0c7649df56
SHA512 20ce8f7a33f179104606992480d849ae212e77f1dcad1e0dca87bc4c9ddb2d3975dcceb42511aa24733ffdecbd39f9770459a2c0e3b572d533d780a55a8a493d
SSDEEP 3072:mEGh0oJlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG/lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe

Path C:\Windows\{DF0044CA-1978-4b02-B29E-9EAFD6CBF045}.exe
Size 344KB
SHA256 715da59df2c6fa8dffcc22a02ac264feaad1ae6a2276b37290a9f5de3a7e8401
MD5 ec5e840fd0f75a25f6493161ca42cdee
SHA1 2fdf6f3d05d1ec0986af5e646a9a079997bd9365
SHA512 66bd5d691d25eee935edc05e60b8efb5aa84471b775f2e9bfd70224baa912bbcabcbcb687c74672dcf99f7f751ad63689a1c4f6a43eb5454a846ae5d7229c5e5
SSDEEP 3072:mEGh0oIlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGqlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe

Path C:\Windows\{E15705DD-4BEF-43d5-AD23-95D28098A3DC}.exe
Size 344KB
SHA256 642d21794e36a991512362208a42450e00e85c85180b574f88e591a153ddd844
MD5 82ebef58233244ce6e88ddbf9a734571
SHA1 445fbdee8c007ba9265a0a9e9b708fcd2d8c4076
SHA512 3b9db80171772e6636d49301c039dcc802e45615bff3ecca97e360b555acd812e10d5045d0d58a4eb4ec8ac3a64721c208e206c6d5c8b2954455b7f7571a28aa
SSDEEP 3072:mEGh0oelEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe

Path C:\Windows\{E1DC48EF-126B-4d6e-A5CB-FE93967AC480}.exe
Size 344KB
SHA256 b8ac7556732b145f4f78cca812af8ae407f60ecb0cc4c14ac931fa035c5cfcb7
MD5 5dd206f63677ce590f6f70b66a30980f
SHA1 1e64b361afecc1fecc8a4333d58204deb25db683
SHA512 a1a922b12c01a772c9b603908e6f849f8a733df200ebbe11a81cd94e7dbdd3f1678e422178b0468cf5febe2d011f7fda015bfd417b561b31d6b58e7855668be4
SSDEEP 3072:mEGh0oElEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG6lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe

Path C:\Windows\{EBE1DF53-8472-452a-9C92-BEF7D04934C1}.exe
Size 344KB
SHA256 41abfc7c26a0e629a649acba10e01b3f79bb81af04abee4f5f4ff10edfcaafbb
MD5 54cee6d3eb1a56ca1945b6f52cf7361d
SHA1 528d3a157762aa521d34988ab4f4af2542e7ada4
SHA512 58f337c43a102c6563a9408c5783d3b8c2d2fc99253eb9a9da0ce2d1e936ffe9bd5703df059a7aa7f0e1a4b7df43c24cc3dc474d8e9d70e61689e52e5976cd69
SSDEEP 3072:mEGh0oflEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGtlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads