Analysis
- max time kernel
144s - max time network
123s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
25/01/2024, 17:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe
- Size 180KB
- Sample240125-v684pscgbn
- SHA256 5d9f1973f2ec098801c0e432c5452fc74da5cf7a5406e70d535c85f9b71e66a5
- MD5 c38a1ee7a2fc8a8b51794c4507367763
- SHA1 9f7ffbb73f95484b306909a9335aa354f78ff6aa
- SHA512 ad2c3c48ff14544f85384f94b4e3ab9628b610fd7794b1dbf3dff04a3fde73b603043ba08c680070a8b118c5f64a3251068233651f1b110206090b27933ff01d
- SSDEEP 3072:jEGh0omlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG4l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000c000000012247-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012716-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000600000000f6f8-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000012716-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000700000000f6f8-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000012716-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000800000000f6f8-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x00310000000139be-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000900000000f6f8-60.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x00320000000139be-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000a00000000f6f8-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{091054B8-A24B-4dfa-9722-476D36DB45BD}\stubpath = "C:\\Windows\\{091054B8-A24B-4dfa-9722-476D36DB45BD}.exe" {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}\stubpath = "C:\\Windows\\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe" {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3} {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82DA2784-60BB-4bb0-A286-739E44BEBAFD} {747283BC-7AEC-453f-A2B9-4892E17C643A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F0D33B6-5551-4c13-9635-5425D2A43105}\stubpath = "C:\\Windows\\{5F0D33B6-5551-4c13-9635-5425D2A43105}.exe" {82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{091054B8-A24B-4dfa-9722-476D36DB45BD} {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}\stubpath = "C:\\Windows\\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe" {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}\stubpath = "C:\\Windows\\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe" {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{944E64F9-B23A-41cb-9BFD-9400684FABD2}\stubpath = "C:\\Windows\\{944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe" {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82DA2784-60BB-4bb0-A286-739E44BEBAFD}\stubpath = "C:\\Windows\\{82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe" {747283BC-7AEC-453f-A2B9-4892E17C643A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D387698B-8EDF-4061-ADAA-87EAC3799323} 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9305F353-6F59-4b0e-983B-B45D45E74475}\stubpath = "C:\\Windows\\{9305F353-6F59-4b0e-983B-B45D45E74475}.exe" {5F0D33B6-5551-4c13-9635-5425D2A43105}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{747283BC-7AEC-453f-A2B9-4892E17C643A} {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3} {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3}\stubpath = "C:\\Windows\\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe" {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848} {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406} {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{944E64F9-B23A-41cb-9BFD-9400684FABD2} {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{747283BC-7AEC-453f-A2B9-4892E17C643A}\stubpath = "C:\\Windows\\{747283BC-7AEC-453f-A2B9-4892E17C643A}.exe" {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F0D33B6-5551-4c13-9635-5425D2A43105} {82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D387698B-8EDF-4061-ADAA-87EAC3799323}\stubpath = "C:\\Windows\\{D387698B-8EDF-4061-ADAA-87EAC3799323}.exe" 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9305F353-6F59-4b0e-983B-B45D45E74475} {5F0D33B6-5551-4c13-9635-5425D2A43105}.exe - Deletes itself 1 IoCs
pid Process 2772 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 1700 {747283BC-7AEC-453f-A2B9-4892E17C643A}.exe 1648 {82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe 2464 {5F0D33B6-5551-4c13-9635-5425D2A43105}.exe 2436 {9305F353-6F59-4b0e-983B-B45D45E74475}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe {747283BC-7AEC-453f-A2B9-4892E17C643A}.exe File created C:\Windows\{5F0D33B6-5551-4c13-9635-5425D2A43105}.exe {82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe File created C:\Windows\{D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe File created C:\Windows\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe File created C:\Windows\{944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe File created C:\Windows\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe File created C:\Windows\{747283BC-7AEC-453f-A2B9-4892E17C643A}.exe {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe File created C:\Windows\{9305F353-6F59-4b0e-983B-B45D45E74475}.exe {5F0D33B6-5551-4c13-9635-5425D2A43105}.exe File created C:\Windows\{091054B8-A24B-4dfa-9722-476D36DB45BD}.exe {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe File created C:\Windows\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe File created C:\Windows\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe Token: SeIncBasePriorityPrivilege 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe Token: SeIncBasePriorityPrivilege 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe Token: SeIncBasePriorityPrivilege 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe Token: SeIncBasePriorityPrivilege 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe Token: SeIncBasePriorityPrivilege 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe Token: SeIncBasePriorityPrivilege 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe Token: SeIncBasePriorityPrivilege 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe Token: SeIncBasePriorityPrivilege 1700 {747283BC-7AEC-453f-A2B9-4892E17C643A}.exe Token: SeIncBasePriorityPrivilege 1648 {82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe Token: SeIncBasePriorityPrivilege 2464 {5F0D33B6-5551-4c13-9635-5425D2A43105}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2668 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 28 PID 2912 wrote to memory of 2668 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 28 PID 2912 wrote to memory of 2668 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 28 PID 2912 wrote to memory of 2668 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 28 PID 2912 wrote to memory of 2772 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 29 PID 2912 wrote to memory of 2772 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 29 PID 2912 wrote to memory of 2772 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 29 PID 2912 wrote to memory of 2772 2912 2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe 29 PID 2668 wrote to memory of 2704 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 30 PID 2668 wrote to memory of 2704 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 30 PID 2668 wrote to memory of 2704 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 30 PID 2668 wrote to memory of 2704 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 30 PID 2668 wrote to memory of 2740 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 31 PID 2668 wrote to memory of 2740 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 31 PID 2668 wrote to memory of 2740 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 31 PID 2668 wrote to memory of 2740 2668 {D387698B-8EDF-4061-ADAA-87EAC3799323}.exe 31 PID 2704 wrote to memory of 3008 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 34 PID 2704 wrote to memory of 3008 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 34 PID 2704 wrote to memory of 3008 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 34 PID 2704 wrote to memory of 3008 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 34 PID 2704 wrote to memory of 2324 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 35 PID 2704 wrote to memory of 2324 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 35 PID 2704 wrote to memory of 2324 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 35 PID 2704 wrote to memory of 2324 2704 {091054B8-A24B-4dfa-9722-476D36DB45BD}.exe 35 PID 3008 wrote to memory of 960 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 36 PID 3008 wrote to memory of 960 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 36 PID 3008 wrote to memory of 960 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 36 PID 3008 wrote to memory of 960 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 36 PID 3008 wrote to memory of 1932 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 37 PID 3008 wrote to memory of 1932 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 37 PID 3008 wrote to memory of 1932 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 37 PID 3008 wrote to memory of 1932 3008 {596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe 37 PID 960 wrote to memory of 900 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 38 PID 960 wrote to memory of 900 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 38 PID 960 wrote to memory of 900 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 38 PID 960 wrote to memory of 900 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 38 PID 960 wrote to memory of 2876 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 39 PID 960 wrote to memory of 2876 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 39 PID 960 wrote to memory of 2876 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 39 PID 960 wrote to memory of 2876 960 {963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe 39 PID 900 wrote to memory of 2780 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 40 PID 900 wrote to memory of 2780 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 40 PID 900 wrote to memory of 2780 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 40 PID 900 wrote to memory of 2780 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 40 PID 900 wrote to memory of 2984 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 41 PID 900 wrote to memory of 2984 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 41 PID 900 wrote to memory of 2984 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 41 PID 900 wrote to memory of 2984 900 {8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe 41 PID 2780 wrote to memory of 944 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 42 PID 2780 wrote to memory of 944 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 42 PID 2780 wrote to memory of 944 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 42 PID 2780 wrote to memory of 944 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 42 PID 2780 wrote to memory of 1096 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 43 PID 2780 wrote to memory of 1096 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 43 PID 2780 wrote to memory of 1096 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 43 PID 2780 wrote to memory of 1096 2780 {FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe 43 PID 944 wrote to memory of 1700 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 44 PID 944 wrote to memory of 1700 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 44 PID 944 wrote to memory of 1700 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 44 PID 944 wrote to memory of 1700 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 44 PID 944 wrote to memory of 1680 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 45 PID 944 wrote to memory of 1680 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 45 PID 944 wrote to memory of 1680 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 45 PID 944 wrote to memory of 1680 944 {944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\{D387698B-8EDF-4061-ADAA-87EAC3799323}.exeC:\Windows\{D387698B-8EDF-4061-ADAA-87EAC3799323}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\{091054B8-A24B-4dfa-9722-476D36DB45BD}.exeC:\Windows\{091054B8-A24B-4dfa-9722-476D36DB45BD}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exeC:\Windows\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exeC:\Windows\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exeC:\Windows\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exeC:\Windows\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\{944E64F9-B23A-41cb-9BFD-9400684FABD2}.exeC:\Windows\{944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\{747283BC-7AEC-453f-A2B9-4892E17C643A}.exeC:\Windows\{747283BC-7AEC-453f-A2B9-4892E17C643A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\{82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exeC:\Windows\{82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\{5F0D33B6-5551-4c13-9635-5425D2A43105}.exeC:\Windows\{5F0D33B6-5551-4c13-9635-5425D2A43105}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\{9305F353-6F59-4b0e-983B-B45D45E74475}.exeC:\Windows\{9305F353-6F59-4b0e-983B-B45D45E74475}.exe12⤵
- Executes dropped EXE
PID:2436
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F0D3~1.EXE > nul12⤵PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82DA2~1.EXE > nul11⤵PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74728~1.EXE > nul10⤵PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{944E6~1.EXE > nul9⤵PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBFC1~1.EXE > nul8⤵PID:1096
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8063E~1.EXE > nul7⤵PID:2984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{963F5~1.EXE > nul6⤵PID:2876
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{596FB~1.EXE > nul5⤵PID:1932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09105~1.EXE > nul4⤵PID:2324
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3876~1.EXE > nul3⤵PID:2740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{091054B8-A24B-4dfa-9722-476D36DB45BD}.exe
- Size 180KB
- SHA256 5280c97f40d2456b6abddd57fec898cdde4d31b11b692de6dd6dc42baecc39b3
- MD5 9d074c679c3b93decff1a1b493e35eb4
- SHA1 9c4cde8a037a14945a835b79d1da123de8335dff
- SHA512 f9f4301c5aaddcba717f8f3d6aa502d6989ed20c9174e49d501a5dde7f4548a22cc4ceadbdcebb20845551d8efc84441d3c4e71c2da01b35ff24ad587a41be65
- SSDEEP 3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGml5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{596FB18B-A57E-448a-BE1C-5C6CDC5471F3}.exe
- Size 180KB
- SHA256 97123f0d6d006e942acf3494833922ea3c9a7b2cfa526006326e048233e881f8
- MD5 41014937101cb8860dfabd3a519175e0
- SHA1 3b64321ccca9d3c11f176d6a3f9fb35de607cb5f
- SHA512 16266a4b912132ac71b1d8b3f4246223625e353d46cf3edbeb463e0a993769a76f851fafea4ce4cdf51eb863f64676a507cb8e4e6978175228b7b41d9cb1764a
- SSDEEP 3072:jEGh0oXlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5F0D33B6-5551-4c13-9635-5425D2A43105}.exe
- Size 180KB
- SHA256 a3cb515785121bfeeae533aed14ac60e301dbd18a65a999a0966e117242fd977
- MD5 523584efc9444be30880c137cbbefc67
- SHA1 ed3049c7e83b9074ff203dde438d7fcdf5639118
- SHA512 1180df0dd3b70de67ea61d235658177c4444366b003d9e47d66ccddd1d3f158e9b5092a4b354a43d99531fb75ee0feb16f736bc424ec6f914cb39d15ec82ba10
- SSDEEP 3072:jEGh0odlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGLl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{747283BC-7AEC-453f-A2B9-4892E17C643A}.exe
- Size 180KB
- SHA256 f044753b87b2d1b2ec9e21f9a5e7218b60f960e256c9eca18b268d384bf8ab20
- MD5 e4ff5f29e0510b5212cd7f75ed02cfa7
- SHA1 c8cdd392d9b882ac56bd335c70d9aadc93abd39d
- SHA512 26d9bff71a935c4755c5f2c11167f15f17b107d76366397e1d34cf0bc92de691fda40aef474c91737b96fd62ae77c77686e2f85d74869a110f964e01a97acec1
- SSDEEP 3072:jEGh0oFlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGnl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8063E80F-AC3E-4e6f-ABCA-A49FCB3F9406}.exe
- Size 180KB
- SHA256 bdaad67c179f9879de3b6d97a55573d398fb95fc29aa49fb670ce71d23084744
- MD5 27f00389a06d1e3a2b415a03646c7bbf
- SHA1 27de08411b2cd3f9c9c8309d6c7972f4756f8274
- SHA512 c78c92137b1fc4722135aba562416c640e160b260d47e690213aa74352767e5c8373ac3f40a42ae8af7a1553638677d6bad1385e2d608394052d1785471d2a3e
- SSDEEP 3072:jEGh0oHlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGZl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{82DA2784-60BB-4bb0-A286-739E44BEBAFD}.exe
- Size 180KB
- SHA256 3391634d7aa442649b999d0ee1635e9e07fcbd8728be5a33df6dae789903a110
- MD5 977080317d066a4e13af20e9d738089f
- SHA1 0a0eaed64514b7d744b2cc57947055cf15b336e5
- SHA512 53cd641b0299f015dffa745d3fde1171fe04d95632ff13a061afb499d48c977ac29af81d93f5e8bba9db0cd0c1e6c5389ed5c812eb861bdd799e3a4bb5b574ff
- SSDEEP 3072:jEGh0oplfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGbl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9305F353-6F59-4b0e-983B-B45D45E74475}.exe
- Size 180KB
- SHA256 f2327f255780cc9607baf6bfc69fd0208af6b6c7f5ff4b10c5216af471dffc3f
- MD5 de37f7849f1d72e652187564c1ba0f3d
- SHA1 0728a17beef4a9d43ff8f33ae84670728d94f4da
- SHA512 ed463e8c981aa098810c11a3be461fc935062fac06c18c916e37acc408a2309e633867d6dc53f4a160601e2677d3f66cd550577652382afd8f026e7d6aa69c85
- SSDEEP 3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{944E64F9-B23A-41cb-9BFD-9400684FABD2}.exe
- Size 180KB
- SHA256 501415c2f2cd259c61e53d7df05f65f8de808ca2c75a9ef0c23797417734dd25
- MD5 c1437bc11acef734c2706be1d74bc227
- SHA1 5b6fb3179f8ac1f79ba71578bb554a71ad729b00
- SHA512 8668559f8e2941713673ad5d16cf5ae657e1a145e2e282227c0728c7f239526da51cacbc5fbde05ca2567320a127e7b8314bc65ccda1ebd41e3e604fd7a453fc
- SSDEEP 3072:jEGh0oOlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGIl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{963F5CF8-1C6D-4aa6-B9AB-3804B3C57848}.exe
- Size 180KB
- SHA256 b12e73bfc4b379b9e3e9934d0a948f5245d74a2366ea9584e78ddf7bf11f2c7e
- MD5 f02190989bbd61de888b51d8b24ddf85
- SHA1 2cf6534542af401c98219ccd51cf41ce97b313f6
- SHA512 8366716ff7c91c78c80f7a8433765be710e1d6d00c43f5dff005d0d8a9c6e96aee230a9b2acc878096d3f861c5460e28a2716116282f02088c2d500231a87503
- SSDEEP 3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGBl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D387698B-8EDF-4061-ADAA-87EAC3799323}.exe
- Size 180KB
- SHA256 099c286e710a813606d688604e695c045c14b350a43274161fc3aad40f29ed0a
- MD5 f254fedc1944966f8e0e790b1c9013ef
- SHA1 9b79492b72d84aa98b9012639d00862c65795cc3
- SHA512 4e256489c741d96f4fa62006c5b54cfdb772877110433ad0484cdf8b9759b437298a968b1cac61a5605e9afe3e85819c3b10166c302cc3746f25b70f91141788
- SSDEEP 3072:jEGh0o8lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGOl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FBFC1D14-EB2F-44ed-8E5E-63A9E42346C3}.exe
- Size 180KB
- SHA256 8eb27d7ef7f5147706952bfb0df7452999857f498d0cc29e560a2fe38f1c99f2
- MD5 6eec6578deaf6c799a7e8b62661ccb54
- SHA1 16cbb51cd4cf05ee3947905bcca6be0dd784890c
- SHA512 74987796ce4d434dab01b118ccb1fd304f9481bda77e76f4352c85d6c22ad9942b3c3833d6ef97cb1da901953e9cc768b908ae8f9c0282c3177f90a3039458e9
- SSDEEP 3072:jEGh0oHlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGFl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP