f8c6c073451dbe3dc391ddfc2819f7ab249a062866d7a5306bd87c26025317a8

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe
Size

216KB
MD5

3ef7fbb7c3226131fe89452e12df0bb5
SHA1

abd94fc8456f7c5acc6f11167c18f7e887674e33
SHA256

f8c6c073451dbe3dc391ddfc2819f7ab249a062866d7a5306bd87c26025317a8
SHA512

3fc2ddf999e73537e1b6240426c994fcc50901924a5ddf7e1528c03fb8d4a2e1ec24ec329af3a27f7a54ee6be1e3700cef5eca9a8d6006318f21fc6ac2164181
SSDEEP

3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG0lEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d000000015612-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002c000000015c60-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015c91-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000f6e4-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002d000000015c60-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000f6e4-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002e000000015c60-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000f6e4-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002f000000015c60-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000f6e4-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0030000000015c60-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77986156-F087-4703-823B-D83C19A2AF46}\stubpath = "C:\\Windows\\{77986156-F087-4703-823B-D83C19A2AF46}.exe"	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5221761-51D8-4adf-83CA-A4C110A63B9B}\stubpath = "C:\\Windows\\{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe"	{77986156-F087-4703-823B-D83C19A2AF46}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96EA127B-C158-4799-A8FF-05923050850D}\stubpath = "C:\\Windows\\{96EA127B-C158-4799-A8FF-05923050850D}.exe"	{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}\stubpath = "C:\\Windows\\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe"	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}\stubpath = "C:\\Windows\\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe"	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77986156-F087-4703-823B-D83C19A2AF46}	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5221761-51D8-4adf-83CA-A4C110A63B9B}	{77986156-F087-4703-823B-D83C19A2AF46}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{574EDEE7-404D-44c7-8C82-5504780700C7}\stubpath = "C:\\Windows\\{574EDEE7-404D-44c7-8C82-5504780700C7}.exe"	{96EA127B-C158-4799-A8FF-05923050850D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{574EDEE7-404D-44c7-8C82-5504780700C7}	{96EA127B-C158-4799-A8FF-05923050850D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}\stubpath = "C:\\Windows\\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe"	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}\stubpath = "C:\\Windows\\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe"	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}\stubpath = "C:\\Windows\\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe"	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F74A02AE-8977-4136-B8E6-FFDA82731828}	{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}\stubpath = "C:\\Windows\\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe"	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F74A02AE-8977-4136-B8E6-FFDA82731828}\stubpath = "C:\\Windows\\{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe"	{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96EA127B-C158-4799-A8FF-05923050850D}	{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe

Deletes itself 1 IoCs

pid	Process
876	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe
1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
572	{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
2312	{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe
2012	{96EA127B-C158-4799-A8FF-05923050850D}.exe
2916	{574EDEE7-404D-44c7-8C82-5504780700C7}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{96EA127B-C158-4799-A8FF-05923050850D}.exe	{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe
File created	C:\Windows\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
File created	C:\Windows\{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	{77986156-F087-4703-823B-D83C19A2AF46}.exe
File created	C:\Windows\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
File created	C:\Windows\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
File created	C:\Windows\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
File created	C:\Windows\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe
File created	C:\Windows\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
File created	C:\Windows\{77986156-F087-4703-823B-D83C19A2AF46}.exe	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
File created	C:\Windows\{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe	{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
File created	C:\Windows\{574EDEE7-404D-44c7-8C82-5504780700C7}.exe	{96EA127B-C158-4799-A8FF-05923050850D}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
Token: SeIncBasePriorityPrivilege	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
Token: SeIncBasePriorityPrivilege	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
Token: SeIncBasePriorityPrivilege	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe
Token: SeIncBasePriorityPrivilege	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
Token: SeIncBasePriorityPrivilege	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
Token: SeIncBasePriorityPrivilege	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
Token: SeIncBasePriorityPrivilege	572	{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
Token: SeIncBasePriorityPrivilege	2312	{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe
Token: SeIncBasePriorityPrivilege	2012	{96EA127B-C158-4799-A8FF-05923050850D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1460	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	28
PID 1756 wrote to memory of 1460	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	28
PID 1756 wrote to memory of 1460	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	28
PID 1756 wrote to memory of 1460	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	28
PID 1756 wrote to memory of 876	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	29
PID 1756 wrote to memory of 876	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	29
PID 1756 wrote to memory of 876	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	29
PID 1756 wrote to memory of 876	1756	2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe	29
PID 1460 wrote to memory of 2624	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	30
PID 1460 wrote to memory of 2624	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	30
PID 1460 wrote to memory of 2624	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	30
PID 1460 wrote to memory of 2624	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	30
PID 1460 wrote to memory of 2824	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	31
PID 1460 wrote to memory of 2824	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	31
PID 1460 wrote to memory of 2824	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	31
PID 1460 wrote to memory of 2824	1460	{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe	31
PID 2624 wrote to memory of 2484	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	34
PID 2624 wrote to memory of 2484	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	34
PID 2624 wrote to memory of 2484	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	34
PID 2624 wrote to memory of 2484	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	34
PID 2624 wrote to memory of 2524	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	35
PID 2624 wrote to memory of 2524	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	35
PID 2624 wrote to memory of 2524	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	35
PID 2624 wrote to memory of 2524	2624	{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe	35
PID 2484 wrote to memory of 2456	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	36
PID 2484 wrote to memory of 2456	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	36
PID 2484 wrote to memory of 2456	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	36
PID 2484 wrote to memory of 2456	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	36
PID 2484 wrote to memory of 1672	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	37
PID 2484 wrote to memory of 1672	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	37
PID 2484 wrote to memory of 1672	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	37
PID 2484 wrote to memory of 1672	2484	{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe	37
PID 2456 wrote to memory of 1344	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	38
PID 2456 wrote to memory of 1344	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	38
PID 2456 wrote to memory of 1344	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	38
PID 2456 wrote to memory of 1344	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	38
PID 2456 wrote to memory of 2700	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	39
PID 2456 wrote to memory of 2700	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	39
PID 2456 wrote to memory of 2700	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	39
PID 2456 wrote to memory of 2700	2456	{77986156-F087-4703-823B-D83C19A2AF46}.exe	39
PID 1344 wrote to memory of 2980	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	40
PID 1344 wrote to memory of 2980	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	40
PID 1344 wrote to memory of 2980	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	40
PID 1344 wrote to memory of 2980	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	40
PID 1344 wrote to memory of 2388	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	41
PID 1344 wrote to memory of 2388	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	41
PID 1344 wrote to memory of 2388	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	41
PID 1344 wrote to memory of 2388	1344	{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe	41
PID 2980 wrote to memory of 2152	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	42
PID 2980 wrote to memory of 2152	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	42
PID 2980 wrote to memory of 2152	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	42
PID 2980 wrote to memory of 2152	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	42
PID 2980 wrote to memory of 2676	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	43
PID 2980 wrote to memory of 2676	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	43
PID 2980 wrote to memory of 2676	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	43
PID 2980 wrote to memory of 2676	2980	{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe	43
PID 2152 wrote to memory of 572	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	44
PID 2152 wrote to memory of 572	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	44
PID 2152 wrote to memory of 572	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	44
PID 2152 wrote to memory of 572	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	44
PID 2152 wrote to memory of 2652	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	45
PID 2152 wrote to memory of 2652	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	45
PID 2152 wrote to memory of 2652	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	45
PID 2152 wrote to memory of 2652	2152	{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-14_3ef7fbb7c3226131fe89452e12df0bb5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
  C:\Windows\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
    C:\Windows\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
      C:\Windows\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\{77986156-F087-4703-823B-D83C19A2AF46}.exe
        
        C:\Windows\{77986156-F087-4703-823B-D83C19A2AF46}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
      - C:\Windows\{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
        
        C:\Windows\{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
        
        C:\Windows\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
        
        C:\Windows\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
        
        C:\Windows\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
        
        C:\Windows\{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe
        
        C:\Windows\{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
        
        C:\Windows\{96EA127B-C158-4799-A8FF-05923050850D}.exe
        
        C:\Windows\{96EA127B-C158-4799-A8FF-05923050850D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
        
        C:\Windows\{574EDEE7-404D-44c7-8C82-5504780700C7}.exe
        
        C:\Windows\{574EDEE7-404D-44c7-8C82-5504780700C7}.exe
        12⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96EA1~1.EXE > nul
        12⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F74A0~1.EXE > nul
        11⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{08A1F~1.EXE > nul
        10⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8F23~1.EXE > nul
        9⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADE4C~1.EXE > nul
        8⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C5221~1.EXE > nul
        7⤵
        
        PID:2388
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{77986~1.EXE > nul
        6⤵
        
        PID:2700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B66E0~1.EXE > nul
        5⤵
        
        PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{739E1~1.EXE > nul
      4⤵
      PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D329F~1.EXE > nul
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{08A1F5E4-4065-4abb-8924-F8A5AE6A3741}.exe

Filesize
216KB

MD5
6be52ffc112c2ace6447afc690d689c0

SHA1
13c85bd1e755f633d3f009d0d7a58de4b5e4f7d1

SHA256
c6bf6bc7e05de3d586903d23a425a81b5383c350aed3e82e92c37d7c56755786

SHA512
0a976a0cd4e42d93db690f5154ec8f170331fe7839b3aff8fc2d13e174a713e1e28be081084287780b406f71cc7a73b4ef6008342ac6e572cf5e603b6c37eb48

Download Submit
C:\Windows\{574EDEE7-404D-44c7-8C82-5504780700C7}.exe

Filesize
216KB

MD5
446e0ba9e8df988fce4fea9d897e31f1

SHA1
b87764d4eea2c5750de70cd02b657b83d5311cf4

SHA256
76c436f002d8a0dd32ab8ef6275fab5ab8546b4fb821476f5aba2b613a203d96

SHA512
9140f227d27a414ba0f43a4f6b291e698caa7e90a2557a0b81e2e1107deed137ab5fe73fcfa4115407f170219f0d70b98b26af7af2295a8076df674e71be53be

Download Submit
C:\Windows\{739E1664-3A50-4c11-8FF4-55A42DBDA1BD}.exe

Filesize
216KB

MD5
417eac88d8d784f349ac8a7f33802825

SHA1
ce369bd2db76667e83450da39cbfe3b81b8642c6

SHA256
2ccc3f29ae0b849aa019368c7c55ed83fc30fb363f71fca095c1a697e5c1975b

SHA512
be381d544a008eeff12f27d7f45c2f7b7389c0192bbf62b98753c504d39969228ca9e70362bdf3bda68db1c50d755111d0e2b1b8ccfade4e8d04b1471c9ed70d

Download Submit
C:\Windows\{77986156-F087-4703-823B-D83C19A2AF46}.exe

Filesize
216KB

MD5
403da865deb12708e8a926ae19e3f00d

SHA1
d823c9d4aa5058f3771c69c0095e5fe61a50e8e9

SHA256
a2cb26068fa8ee5382a82b9dfbdde56566e0123538c0718b200d47336ace14a0

SHA512
80957fccb9e936bfab357304e02e29129d7a49e8eb0b7a70740781394ab024c4b7b8a440d51aebeca45ccc4eefc56aa4ce0703fa43ca3ca0e527922650d861e0

Download Submit
C:\Windows\{96EA127B-C158-4799-A8FF-05923050850D}.exe

Filesize
216KB

MD5
1e9e10fc4fd09a7bb65272ca3ccc445d

SHA1
6bf3200180e86bee4f57107a82e4bf152ca013c1

SHA256
de55e39310d6eff1d0dcaf0dfea314b78ecb8183d569009718f640ad1e956a94

SHA512
9f7543894e9d7cb8d4aa9333c94b0617a45e67eb69dcdbe19a3cc58fc4e84d7f132f281680400acc27601dcf8d292137cfec2bcf2f48f68dc27fdf021017db49

Download Submit
C:\Windows\{ADE4C42F-E02E-4c76-8BA4-7EBF53D501E1}.exe

Filesize
216KB

MD5
f0012fb0d4287cc275dfab45cb175ff9

SHA1
ae74ff107cd2676bd556bb6a4a6324f4041190d9

SHA256
b30737597bb174a7db81a83daa1a833fa9db4186f1793aac98983539af25b3cc

SHA512
f057fb70252dc65a220bb1a138f2acc47e4c9fef2b1b6e1f468e922948e5acf4b344887e9254f5413bb623f22f3cb5b42c249dca92fbdb4e4276882d0dbbce7f

Download Submit
C:\Windows\{B66E0A9F-0BB6-4103-B97F-3709BD3B754F}.exe

Filesize
216KB

MD5
d1ee2cb1c8baf3c15743304135102e87

SHA1
e0ad77a33b1f877440050e7a5ea15ca77bf19418

SHA256
be6a0faaa28861dbdf02b05df34caf1a672052c121e59d9a2a010526fa4f6acb

SHA512
e8fedbacfd0d0f7772fd670035bace6131890b211edee0b7bc60372cebf668f0f698dc718860e8545857f1a7471593ee4b7c0a0ead0e4c93cbbf5bc4c6ed054e

Download Submit
C:\Windows\{B8F23ED1-D155-4d96-9DE7-0DB8E1CD5E04}.exe

Filesize
216KB

MD5
9b9810abef6d1d1d2261875615223beb

SHA1
2cf4f4adeca50bff021d757429888244e41eae7e

SHA256
8aeaa88acaeda4dfbd398a6656e188418579be60b6365570798852b5d0f993d4

SHA512
adb368b2d7fbd25c5c154ebd9d5e6c4b8cb6d1820ca9bfbc045e1355ede661811a4ac534ee1d46eed8ddddf9e3bae4b6a4d79652d46b2b24192f49a363c532a6

Download Submit
C:\Windows\{C5221761-51D8-4adf-83CA-A4C110A63B9B}.exe

Filesize
216KB

MD5
7b499f4e3fa432d6d70a353590801171

SHA1
24c295b62b842d5593d4d31a3625e11f7038c176

SHA256
a311db0933c25a72bf5d7beee78c2e3546c5056d516aa953de50028dabfea0c4

SHA512
dbb7a8d741e30d719d176d79466e0b5b6731b216dceabe5f4484241f01d78d0ffa2f1fb4b2e6754869ceee99a22aae2b855664a1bf56ce91f31a83daead2a12d

Download Submit
C:\Windows\{D329FCAA-5505-4d72-A9DC-1E9952A6F366}.exe

Filesize
216KB

MD5
d4b7f1ae28ee99096f2bc29e7938958b

SHA1
808dcd78c0b6dc3c808286f0186f876912a2c802

SHA256
e9e5930d9b07c7089eb9e3d43107bca9237d1f1cd1e7edd663fc171227566e66

SHA512
f7aaac954df11170d3f10305e6c658eed349ec3b708526a981a94fb4f35effa02903c05f8396daf2c961dcdf48ecf785844ebed209ba520023866634c3fd6ed9

Download Submit
C:\Windows\{F74A02AE-8977-4136-B8E6-FFDA82731828}.exe

Filesize
216KB

MD5
4d4e3825362c74e628361e19a0bbbca4

SHA1
0e0e2c27398173b77ece756f8303236550210a45

SHA256
a0d10fbdd13f6a0bffbdb4865fcadd0579e2e38806b6cf3ffb5411865ab1b02d

SHA512
37b72a7370072b633396af0cfe0128b348ed13aef6b5ede55911c8cdf8957289359c719e059540e98709b56fbd7fd6925f69ffeb94765792d4632f369a4677d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads