b71f48546ba0351207f8092ed6545a69b724e3f8dadbee81423edfcc8b886228

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe
Size

216KB
MD5

9c8074fb888228dbea488d1e9bb9e3fd
SHA1

763ca5fd627cac8812839a2d2b6c2058ac8242b8
SHA256

b71f48546ba0351207f8092ed6545a69b724e3f8dadbee81423edfcc8b886228
SHA512

295dc7a2b861edf868e9e09311f1012b5c9213289bf4d81e3763c6d637de0dfca1b3774c3b7c4611d33b8489e1a76ce38c30721dcc61b7d237d779e61290267f
SSDEEP

3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGqlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012286-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000015609-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012286-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000015670-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012286-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015670-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012286-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0037000000015670-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015678-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000015693-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE35F73D-5D36-41be-B207-5575E0D0463F}	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23F3079C-C1BD-49bf-A5C8-6748488208A9}	{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}\stubpath = "C:\\Windows\\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe"	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65C09223-EDD6-497d-A029-E50929C39632}\stubpath = "C:\\Windows\\{65C09223-EDD6-497d-A029-E50929C39632}.exe"	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}\stubpath = "C:\\Windows\\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe"	{65C09223-EDD6-497d-A029-E50929C39632}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43A721E0-735C-4af9-B40C-15E4E8834F45}	{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}\stubpath = "C:\\Windows\\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe"	{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{344E55F4-EDCF-424a-9157-8140490DEE00}	{31930382-3E08-4277-8914-1E6E7198D009}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43A721E0-735C-4af9-B40C-15E4E8834F45}\stubpath = "C:\\Windows\\{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe"	{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}	{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{344E55F4-EDCF-424a-9157-8140490DEE00}\stubpath = "C:\\Windows\\{344E55F4-EDCF-424a-9157-8140490DEE00}.exe"	{31930382-3E08-4277-8914-1E6E7198D009}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE35F73D-5D36-41be-B207-5575E0D0463F}\stubpath = "C:\\Windows\\{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe"	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31930382-3E08-4277-8914-1E6E7198D009}	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31930382-3E08-4277-8914-1E6E7198D009}\stubpath = "C:\\Windows\\{31930382-3E08-4277-8914-1E6E7198D009}.exe"	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}\stubpath = "C:\\Windows\\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe"	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65C09223-EDD6-497d-A029-E50929C39632}	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}	{65C09223-EDD6-497d-A029-E50929C39632}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23F3079C-C1BD-49bf-A5C8-6748488208A9}\stubpath = "C:\\Windows\\{23F3079C-C1BD-49bf-A5C8-6748488208A9}.exe"	{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}\stubpath = "C:\\Windows\\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe"	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe
2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe
2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe
2020	{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
2212	{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
1944	{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe
2740	{23F3079C-C1BD-49bf-A5C8-6748488208A9}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe
File created	C:\Windows\{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	{31930382-3E08-4277-8914-1E6E7198D009}.exe
File created	C:\Windows\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
File created	C:\Windows\{65C09223-EDD6-497d-A029-E50929C39632}.exe	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
File created	C:\Windows\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe	{65C09223-EDD6-497d-A029-E50929C39632}.exe
File created	C:\Windows\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe
File created	C:\Windows\{31930382-3E08-4277-8914-1E6E7198D009}.exe	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
File created	C:\Windows\{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
File created	C:\Windows\{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe	{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
File created	C:\Windows\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe	{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
File created	C:\Windows\{23F3079C-C1BD-49bf-A5C8-6748488208A9}.exe	{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe
Token: SeIncBasePriorityPrivilege	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
Token: SeIncBasePriorityPrivilege	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe
Token: SeIncBasePriorityPrivilege	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
Token: SeIncBasePriorityPrivilege	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
Token: SeIncBasePriorityPrivilege	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
Token: SeIncBasePriorityPrivilege	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe
Token: SeIncBasePriorityPrivilege	2020	{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
Token: SeIncBasePriorityPrivilege	2212	{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
Token: SeIncBasePriorityPrivilege	1944	{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2204	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	29
PID 1872 wrote to memory of 2204	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	29
PID 1872 wrote to memory of 2204	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	29
PID 1872 wrote to memory of 2204	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	29
PID 1872 wrote to memory of 2524	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	30
PID 1872 wrote to memory of 2524	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	30
PID 1872 wrote to memory of 2524	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	30
PID 1872 wrote to memory of 2524	1872	2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe	30
PID 2204 wrote to memory of 2684	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	31
PID 2204 wrote to memory of 2684	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	31
PID 2204 wrote to memory of 2684	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	31
PID 2204 wrote to memory of 2684	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	31
PID 2204 wrote to memory of 1192	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	32
PID 2204 wrote to memory of 1192	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	32
PID 2204 wrote to memory of 1192	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	32
PID 2204 wrote to memory of 1192	2204	{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe	32
PID 2684 wrote to memory of 2624	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	33
PID 2684 wrote to memory of 2624	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	33
PID 2684 wrote to memory of 2624	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	33
PID 2684 wrote to memory of 2624	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	33
PID 2684 wrote to memory of 2568	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	34
PID 2684 wrote to memory of 2568	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	34
PID 2684 wrote to memory of 2568	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	34
PID 2684 wrote to memory of 2568	2684	{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe	34
PID 2624 wrote to memory of 2912	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	37
PID 2624 wrote to memory of 2912	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	37
PID 2624 wrote to memory of 2912	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	37
PID 2624 wrote to memory of 2912	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	37
PID 2624 wrote to memory of 624	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	38
PID 2624 wrote to memory of 624	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	38
PID 2624 wrote to memory of 624	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	38
PID 2624 wrote to memory of 624	2624	{31930382-3E08-4277-8914-1E6E7198D009}.exe	38
PID 2912 wrote to memory of 2720	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	39
PID 2912 wrote to memory of 2720	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	39
PID 2912 wrote to memory of 2720	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	39
PID 2912 wrote to memory of 2720	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	39
PID 2912 wrote to memory of 2760	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	40
PID 2912 wrote to memory of 2760	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	40
PID 2912 wrote to memory of 2760	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	40
PID 2912 wrote to memory of 2760	2912	{344E55F4-EDCF-424a-9157-8140490DEE00}.exe	40
PID 2720 wrote to memory of 316	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	41
PID 2720 wrote to memory of 316	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	41
PID 2720 wrote to memory of 316	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	41
PID 2720 wrote to memory of 316	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	41
PID 2720 wrote to memory of 1520	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	42
PID 2720 wrote to memory of 1520	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	42
PID 2720 wrote to memory of 1520	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	42
PID 2720 wrote to memory of 1520	2720	{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe	42
PID 316 wrote to memory of 1428	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	43
PID 316 wrote to memory of 1428	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	43
PID 316 wrote to memory of 1428	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	43
PID 316 wrote to memory of 1428	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	43
PID 316 wrote to memory of 2780	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	44
PID 316 wrote to memory of 2780	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	44
PID 316 wrote to memory of 2780	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	44
PID 316 wrote to memory of 2780	316	{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe	44
PID 1428 wrote to memory of 2020	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	45
PID 1428 wrote to memory of 2020	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	45
PID 1428 wrote to memory of 2020	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	45
PID 1428 wrote to memory of 2020	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	45
PID 1428 wrote to memory of 2036	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	46
PID 1428 wrote to memory of 2036	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	46
PID 1428 wrote to memory of 2036	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	46
PID 1428 wrote to memory of 2036	1428	{65C09223-EDD6-497d-A029-E50929C39632}.exe	46

C:\Users\Admin\AppData\Local\Temp\2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_9c8074fb888228dbea488d1e9bb9e3fd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe
  C:\Windows\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
    C:\Windows\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\{31930382-3E08-4277-8914-1E6E7198D009}.exe
      C:\Windows\{31930382-3E08-4277-8914-1E6E7198D009}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
        
        C:\Windows\{344E55F4-EDCF-424a-9157-8140490DEE00}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2912
      - C:\Windows\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
        
        C:\Windows\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
        
        C:\Windows\{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\{65C09223-EDD6-497d-A029-E50929C39632}.exe
        
        C:\Windows\{65C09223-EDD6-497d-A029-E50929C39632}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
        
        C:\Windows\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
        
        C:\Windows\{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Windows\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe
        
        C:\Windows\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\Windows\{23F3079C-C1BD-49bf-A5C8-6748488208A9}.exe
        
        C:\Windows\{23F3079C-C1BD-49bf-A5C8-6748488208A9}.exe
        12⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4A9B~1.EXE > nul
        12⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{43A72~1.EXE > nul
        11⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9FC47~1.EXE > nul
        10⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{65C09~1.EXE > nul
        9⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE35F~1.EXE > nul
        8⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CFAE4~1.EXE > nul
        7⤵
        
        PID:1520
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{344E5~1.EXE > nul
        6⤵
        
        PID:2760
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31930~1.EXE > nul
        5⤵
        
        PID:624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{079FF~1.EXE > nul
      4⤵
      PID:2568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{931C4~1.EXE > nul
    3⤵
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{079FFBF0-E3B4-4edb-9FEA-9C0F934D9D53}.exe

Filesize
216KB

MD5
a24cf237de6ca4ed5092045a4f873295

SHA1
0fac2f5665b382611adcdd885bf93257f0d6ee8a

SHA256
18d858218ee1b073f031aa6e8127e8a8d6143178aa4f225e72e5f29a80c009ed

SHA512
5ccf951e25540c474df926608d7d622f234655b94d432ea532fce14b0dbd606f60ed9c2c24a946114d318c75efe5c98a55b9aae7342746dd9e57ffff7d2cc276

Download Submit
C:\Windows\{23F3079C-C1BD-49bf-A5C8-6748488208A9}.exe

Filesize
216KB

MD5
59b0fbcbd62e6b2533ebbedf109afdd8

SHA1
464356c0f338397bb4553c91edba280c1a310ad6

SHA256
b6455ffeb445fd1e4af0c22a88cba50bc126495f0651766af8f57d9cc42687ed

SHA512
aea32e8ae82601a756dbb07d92c8e14ea535cad4b14aa3146727515dc7b428e3bb0ef6942a7115002e09a9aa72b376bd59f7b1c03ecea7a39b88f9a05e286ae1

Download Submit
C:\Windows\{31930382-3E08-4277-8914-1E6E7198D009}.exe

Filesize
216KB

MD5
e3bf2084108304d674f20400856ded3a

SHA1
6c50299b383a4928e22509035615e91fe511a670

SHA256
5f705a752e92641c1e28e7c6621db59f8eeb928522b057c2400a40d91965d54d

SHA512
6dfc3170fcd3600eef751db0b27d4f0f4ce85d22ba8504c8680714be84cea0091ca06d552dd9333cb60f3916ac9839a17ebae0ed60ed61e1300ba72a2a6ec930

Download Submit
C:\Windows\{344E55F4-EDCF-424a-9157-8140490DEE00}.exe

Filesize
216KB

MD5
4c1e0bf004b271efbe8cb63df843996f

SHA1
b2786e9a082797c99663ddac91a3d6eb6cf7f4b8

SHA256
48d3aba2303c7c7020bdceca4746c45fa1f92aa70eb63b7efcea4fb309d3036c

SHA512
8573755050fe4fda67cc078c8af3ca71130fbfd6275e3a1aa0ec859d0493652f185ab6c3ebca12973b28a6e0ae17e90dbd2d911943d9cec966a22e70b5eaa44f

Download Submit
C:\Windows\{43A721E0-735C-4af9-B40C-15E4E8834F45}.exe

Filesize
216KB

MD5
9eb77353ce385db4c9d3d700f07d5998

SHA1
55c16838728db43e343e7c1dc4aa2cfd8ab8c975

SHA256
708676312b3d361e1c9ddaf32f20e084d987745813ff8e57b9772f324fd3cec5

SHA512
4c59ef97d793ced28d55fdaf264a0a439da28653b81ad696112c524b02d429a72f920fcf2ba08f7880afe4e1f7e6b79353cebf7d09503f624d1df5f022dc8225

Download Submit
C:\Windows\{65C09223-EDD6-497d-A029-E50929C39632}.exe

Filesize
216KB

MD5
1ddd785830e404786d20355805a8e9c5

SHA1
1f6934df720ce0de2711d568ac0c2871dba24b6c

SHA256
2d565eab8733ee036ce8ab30e596bb336216535d095b1c5b1e19524834e043d7

SHA512
6126191fba846d56aa0547d587f063925b5f59fcb9453abc0798bff7333221216ee6d7723767edc71c6e771a0a3a31d5807d1e36ea9d85e99d52f027c445ef43

Download Submit
C:\Windows\{931C47BF-219A-43b5-BCD3-EB61A25DD7C3}.exe

Filesize
216KB

MD5
1ace4569efe93c5c3eddfd571014cf51

SHA1
bfb48cef546014fac49d695bca37b3f9bf6260e3

SHA256
5e5ebf682a11d0a09f5db373096071bbb2ec47a11e3a6186a24ef4ff3b22b78b

SHA512
139ba3fc45e29166fcce1ac25f990e42d1d3fac18235a81eb31ceb8bfbc0fbf65989a9edc3934d3cbc0fad5277f0b1e0cf9b0bf56e79b1cf0ff23ab71aab09da

Download Submit
C:\Windows\{9FC4734F-5FC1-49f6-A5B7-F87F40BD49DD}.exe

Filesize
216KB

MD5
ec23c47b018011c46437e57c51d05844

SHA1
89b276c067d3254ce08b81dacddaf9e053058551

SHA256
48478113a4bf7c0415e35cfec81017b2c0aabe3cbc6335efbbd3965c7105b67a

SHA512
b0624921557fb07f1b007c4a378c60bf7853ffaccd35ba534ac154522df66608aba8f3fb74a53d292df575c7e1f9c42d25fdad33acda1837547babdf2aa75c5d

Download Submit
C:\Windows\{CFAE4965-E41E-4ef2-AD6C-363AD9365C77}.exe

Filesize
216KB

MD5
31fb25211717176386bce183f70faaf0

SHA1
cd7768fdf3da53476a3c90eea2e4c923b151779c

SHA256
de53a3edd4822df3677750e7432b784e0d2da610686173be92d6c9c069b761f2

SHA512
39c986f486b882510a28f0869020a5005dae96a42752870554fa0bad987969b134d24f4d72234a5a972a255ff1672273b38f280aca8692eda6fb887fe846a5bd

Download Submit
C:\Windows\{D4A9BCFD-55DF-4ca2-9971-6E44BA45D34B}.exe

Filesize
216KB

MD5
fa6f11472cc49fb3e60273a65c989fad

SHA1
d38559bf8d74f435d4809018e4f2a94855e89f74

SHA256
9ea47c89e0c2af941dae610a547520eb69c5f5adb5c36d9d0f59614b5805e043

SHA512
5519505527339e9c20812d030363cccb7c2f3af2ca18f88702ed26ff2ade4ea597d4f6ead7181faad5ac3abc059d027b79c21f820b0def1f8e59a89520517278

Download Submit
C:\Windows\{EE35F73D-5D36-41be-B207-5575E0D0463F}.exe

Filesize
216KB

MD5
2f4d21f2957ca414066f3958d1ba182b

SHA1
61549ba59902d8db480d36e14f441f3eea276f26

SHA256
c111d80be3793b765578170c9c8db06195112d032164edb6c396a652a4525699

SHA512
b732dc7fac78e33c6ff4a371aae97a1da6b4b7cca635c8b5abca295b5b8f094c65e9502f4534d03b136802dd07a71c16b0df9dfcc26b7ea21fb4311a6318a83b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads