Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe
-
Size
372KB
-
MD5
ce09de74a24ae5891ffdaf2b69c0b5d1
-
SHA1
dba92e1d8f7c659907c6bfa5626dc7c07be54a36
-
SHA256
8f461d836a5540a2c43018397ccea692206512053f77ca03ea6daf48484210e7
-
SHA512
829308d90942e0c266f0894f92eaf609d99c73c4c498bd6d675bf530e6e1e015dc4f70c66c3542059802a5af2fa2d401ab0d4925766cd541afe1578745125d5f
-
SSDEEP
3072:CEGh0oXlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG9lkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b000000015cfa-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015d23-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000015cfa-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b0000000160a7-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000005a5a-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000015cfa-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000005a5a-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000015cfa-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000005a5a-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000015cfa-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000005a5a-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D} {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0508D169-BE44-4097-AE3D-6D6469330088} {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4ED47729-FCE2-44cf-8971-7B883357F29B}\stubpath = "C:\\Windows\\{4ED47729-FCE2-44cf-8971-7B883357F29B}.exe" {0508D169-BE44-4097-AE3D-6D6469330088}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AD16725A-522C-433e-A73D-56FE36552AF0} 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A315B770-2622-4b9f-B98F-129CD28BC94C} {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}\stubpath = "C:\\Windows\\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe" {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3CFF3EAB-CB6A-45da-977C-296E4CE32940} {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}\stubpath = "C:\\Windows\\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe" {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}\stubpath = "C:\\Windows\\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe" {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0508D169-BE44-4097-AE3D-6D6469330088}\stubpath = "C:\\Windows\\{0508D169-BE44-4097-AE3D-6D6469330088}.exe" {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0430D383-2D39-45f4-803D-C7DC25DACD97} {4ED47729-FCE2-44cf-8971-7B883357F29B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AD16725A-522C-433e-A73D-56FE36552AF0}\stubpath = "C:\\Windows\\{AD16725A-522C-433e-A73D-56FE36552AF0}.exe" 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6} {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4ED47729-FCE2-44cf-8971-7B883357F29B} {0508D169-BE44-4097-AE3D-6D6469330088}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0430D383-2D39-45f4-803D-C7DC25DACD97}\stubpath = "C:\\Windows\\{0430D383-2D39-45f4-803D-C7DC25DACD97}.exe" {4ED47729-FCE2-44cf-8971-7B883357F29B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54} {AD16725A-522C-433e-A73D-56FE36552AF0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E} {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}\stubpath = "C:\\Windows\\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe" {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEA03692-AF7B-4752-B1A3-68114BD968E3} {0430D383-2D39-45f4-803D-C7DC25DACD97}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEA03692-AF7B-4752-B1A3-68114BD968E3}\stubpath = "C:\\Windows\\{BEA03692-AF7B-4752-B1A3-68114BD968E3}.exe" {0430D383-2D39-45f4-803D-C7DC25DACD97}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}\stubpath = "C:\\Windows\\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe" {AD16725A-522C-433e-A73D-56FE36552AF0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A315B770-2622-4b9f-B98F-129CD28BC94C}\stubpath = "C:\\Windows\\{A315B770-2622-4b9f-B98F-129CD28BC94C}.exe" {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe -
Deletes itself 1 IoCs
pid Process 1640 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 2256 {0508D169-BE44-4097-AE3D-6D6469330088}.exe 2020 {4ED47729-FCE2-44cf-8971-7B883357F29B}.exe 2136 {0430D383-2D39-45f4-803D-C7DC25DACD97}.exe 1440 {BEA03692-AF7B-4752-B1A3-68114BD968E3}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{AD16725A-522C-433e-A73D-56FE36552AF0}.exe 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe File created C:\Windows\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe {AD16725A-522C-433e-A73D-56FE36552AF0}.exe File created C:\Windows\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe File created C:\Windows\{4ED47729-FCE2-44cf-8971-7B883357F29B}.exe {0508D169-BE44-4097-AE3D-6D6469330088}.exe File created C:\Windows\{0430D383-2D39-45f4-803D-C7DC25DACD97}.exe {4ED47729-FCE2-44cf-8971-7B883357F29B}.exe File created C:\Windows\{BEA03692-AF7B-4752-B1A3-68114BD968E3}.exe {0430D383-2D39-45f4-803D-C7DC25DACD97}.exe File created C:\Windows\{A315B770-2622-4b9f-B98F-129CD28BC94C}.exe {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe File created C:\Windows\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe File created C:\Windows\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe File created C:\Windows\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe File created C:\Windows\{0508D169-BE44-4097-AE3D-6D6469330088}.exe {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe Token: SeIncBasePriorityPrivilege 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe Token: SeIncBasePriorityPrivilege 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe Token: SeIncBasePriorityPrivilege 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe Token: SeIncBasePriorityPrivilege 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe Token: SeIncBasePriorityPrivilege 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe Token: SeIncBasePriorityPrivilege 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe Token: SeIncBasePriorityPrivilege 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe Token: SeIncBasePriorityPrivilege 2256 {0508D169-BE44-4097-AE3D-6D6469330088}.exe Token: SeIncBasePriorityPrivilege 2020 {4ED47729-FCE2-44cf-8971-7B883357F29B}.exe Token: SeIncBasePriorityPrivilege 2136 {0430D383-2D39-45f4-803D-C7DC25DACD97}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2988 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 28 PID 2220 wrote to memory of 2988 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 28 PID 2220 wrote to memory of 2988 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 28 PID 2220 wrote to memory of 2988 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 28 PID 2220 wrote to memory of 1640 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 29 PID 2220 wrote to memory of 1640 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 29 PID 2220 wrote to memory of 1640 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 29 PID 2220 wrote to memory of 1640 2220 2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe 29 PID 2988 wrote to memory of 2644 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 30 PID 2988 wrote to memory of 2644 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 30 PID 2988 wrote to memory of 2644 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 30 PID 2988 wrote to memory of 2644 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 30 PID 2988 wrote to memory of 2692 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 31 PID 2988 wrote to memory of 2692 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 31 PID 2988 wrote to memory of 2692 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 31 PID 2988 wrote to memory of 2692 2988 {AD16725A-522C-433e-A73D-56FE36552AF0}.exe 31 PID 2644 wrote to memory of 2596 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 33 PID 2644 wrote to memory of 2596 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 33 PID 2644 wrote to memory of 2596 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 33 PID 2644 wrote to memory of 2596 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 33 PID 2644 wrote to memory of 2836 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 32 PID 2644 wrote to memory of 2836 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 32 PID 2644 wrote to memory of 2836 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 32 PID 2644 wrote to memory of 2836 2644 {34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe 32 PID 2596 wrote to memory of 2540 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 36 PID 2596 wrote to memory of 2540 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 36 PID 2596 wrote to memory of 2540 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 36 PID 2596 wrote to memory of 2540 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 36 PID 2596 wrote to memory of 2772 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 37 PID 2596 wrote to memory of 2772 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 37 PID 2596 wrote to memory of 2772 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 37 PID 2596 wrote to memory of 2772 2596 {A315B770-2622-4b9f-B98F-129CD28BC94C}.exe 37 PID 2540 wrote to memory of 320 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 38 PID 2540 wrote to memory of 320 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 38 PID 2540 wrote to memory of 320 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 38 PID 2540 wrote to memory of 320 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 38 PID 2540 wrote to memory of 1276 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 39 PID 2540 wrote to memory of 1276 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 39 PID 2540 wrote to memory of 1276 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 39 PID 2540 wrote to memory of 1276 2540 {C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe 39 PID 320 wrote to memory of 1900 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 40 PID 320 wrote to memory of 1900 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 40 PID 320 wrote to memory of 1900 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 40 PID 320 wrote to memory of 1900 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 40 PID 320 wrote to memory of 1548 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 41 PID 320 wrote to memory of 1548 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 41 PID 320 wrote to memory of 1548 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 41 PID 320 wrote to memory of 1548 320 {3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe 41 PID 1900 wrote to memory of 1948 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 42 PID 1900 wrote to memory of 1948 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 42 PID 1900 wrote to memory of 1948 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 42 PID 1900 wrote to memory of 1948 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 42 PID 1900 wrote to memory of 1628 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 43 PID 1900 wrote to memory of 1628 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 43 PID 1900 wrote to memory of 1628 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 43 PID 1900 wrote to memory of 1628 1900 {BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe 43 PID 1948 wrote to memory of 2256 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 45 PID 1948 wrote to memory of 2256 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 45 PID 1948 wrote to memory of 2256 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 45 PID 1948 wrote to memory of 2256 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 45 PID 1948 wrote to memory of 1360 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 44 PID 1948 wrote to memory of 1360 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 44 PID 1948 wrote to memory of 1360 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 44 PID 1948 wrote to memory of 1360 1948 {3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\{AD16725A-522C-433e-A73D-56FE36552AF0}.exeC:\Windows\{AD16725A-522C-433e-A73D-56FE36552AF0}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exeC:\Windows\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34134~1.EXE > nul4⤵PID:2836
-
-
C:\Windows\{A315B770-2622-4b9f-B98F-129CD28BC94C}.exeC:\Windows\{A315B770-2622-4b9f-B98F-129CD28BC94C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exeC:\Windows\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exeC:\Windows\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exeC:\Windows\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exeC:\Windows\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B2FA~1.EXE > nul9⤵PID:1360
-
-
C:\Windows\{0508D169-BE44-4097-AE3D-6D6469330088}.exeC:\Windows\{0508D169-BE44-4097-AE3D-6D6469330088}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0508D~1.EXE > nul10⤵PID:1136
-
-
C:\Windows\{4ED47729-FCE2-44cf-8971-7B883357F29B}.exeC:\Windows\{4ED47729-FCE2-44cf-8971-7B883357F29B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4ED47~1.EXE > nul11⤵PID:596
-
-
C:\Windows\{0430D383-2D39-45f4-803D-C7DC25DACD97}.exeC:\Windows\{0430D383-2D39-45f4-803D-C7DC25DACD97}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0430D~1.EXE > nul12⤵PID:1248
-
-
C:\Windows\{BEA03692-AF7B-4752-B1A3-68114BD968E3}.exeC:\Windows\{BEA03692-AF7B-4752-B1A3-68114BD968E3}.exe12⤵
- Executes dropped EXE
PID:1440
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE4DD~1.EXE > nul8⤵PID:1628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CFF3~1.EXE > nul7⤵PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5FB7~1.EXE > nul6⤵PID:1276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A315B~1.EXE > nul5⤵PID:2772
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD167~1.EXE > nul3⤵PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:1640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5f146d81edf9a34b7365b78e5b24ca7f9
SHA1f250e354a21943ecd01a3de9539bb6f1b12896e1
SHA256d6b86f1c3243b4f126ef0bc4b9a579055a5cd59543f7dd9186d951480f126f8f
SHA512ed1c234d66c1002c3f84ab2ee9d4eab1155f19aa2d59d19dcc90b5afe4f74e7148b8af174d03d1f776b2e766bcc43f75e8ec229fdbb5b4c4482636e401f0405a
-
Filesize
372KB
MD5aa03e59c16baf16411f18a6656852ef5
SHA1f02ad5e41967e994949260a28c08fc23dbdd22c2
SHA2568e352c4a7f83c57232433c22cb0f7c2e454ed005ca4c60cbd20c9beb5b329215
SHA51260fea55df28b23840884bd0e1cea9c6874720ec95ce1b0d31e227ccbb7d1ef717b32505625c5ce8cca6c0c234929e9275c8419cbc28adfa3864381744c7772a8
-
Filesize
372KB
MD5a68fd167193263577aab9888b56a69bd
SHA169a8a1f904136f569a85607686d13b95bf3bfcfe
SHA256972294a5a20b8e59da04945d4edd8d01acfa49a6bc7fd779139084d0c5b8392c
SHA5127538bec2373587865ea929d48b18d0624041d47b74f71a465ba056674caad8d37e13e4f9528e421c01c4c7e5c4f63df0997530bad199ca3234351b95a28513cc
-
Filesize
372KB
MD53075849ea1b05b37e48b0d74287d12f5
SHA157b676b39e29cf7958257f431027b81556a8a78e
SHA256eeff2a50f54d922f0130f6fc9ac6790a194ff6ff42f585cd3dc511b099226894
SHA512288586943d19de732ad6c195b58f1a81ab6f6e5b3245b04e5639ca14edeafda28dc94d8362889f828e20acea5ac5f87bf5a0d356401ba0089a0e6f07e11836c2
-
Filesize
372KB
MD50d7ebb1a20af727dc2b2782bc41da136
SHA103884c7f8082481b3d78cefed4dbaefd49377d82
SHA2563401dfbab46926c8e088e691ff825a27a2105eb3128499e1b71938060b48c3e3
SHA5124c85f317cccbe5098977b17ade1b06ae0af548dff8a3b7c0dbcc807ff290576b04d68a509e96314db9f1370b9e81d45477cdcb736c1943fa8998cc9dcb431293
-
Filesize
372KB
MD516e6eb8fc2ff1addc7c85b87ffbe5ab0
SHA1dc9c45fdca9e43b23a1284dc614a061f0dcbe7a2
SHA2564656b026eccb49834fb752378c6385d82f56e588e65781d3085614d0470aea2e
SHA512e390e5c744258550dd32874768dfd185445a2c4329385b4fd8611c78353dfada4585a27216bc1223d3d1c5c81e7ccc004e1e74cd49f5db10685b3741d579b771
-
Filesize
372KB
MD5140efcb2f37740197e0f85ff3f089bba
SHA19547caace29429f36367ba5b640b56d6d7d89413
SHA256601f612c48e51332363eda2188f5e2679919d2c7fce9c689b126a370a6d65f4f
SHA512cd5a4290009b260878923157b7385c65425fd277c3c19862e355156dcf3983564a5431153c9993e5daa6421bee632d91ca54a0bc1e74d0ca23d9c9d245d6ac11
-
Filesize
372KB
MD5d3dbb409e3d4b9b62ef5168ae14e77e5
SHA1adae990bd4971bcb47f5dac4cdf540b0f526c75e
SHA256b1e51228fd01976cd09a07b661bab8bb6438a6ca2158d8b13210821081e2662b
SHA51231ab53840e06a63beb3404082683871c88aa7a999f839c21f3fe272df67ef6ec35d79f643eec15575163c0c43196cec8fcefb5fc021c6a8866ab38447b9826bf
-
Filesize
372KB
MD5564d1ebe408bd2717db2a8297eb51b3b
SHA1f64ca5233ab420d12f31ef3186852b2fa3962706
SHA2560544777c533c0c71237dab9288d2f8ef2c0716fb28192fabab30ace266594359
SHA512e38993ffc57fd9d9f4963991a476ebda88cd01338dda0a012ac5ff208d080f0b9eac5d4e3b5fa3b2bb78147a3c938f0c56d1ff6b173ea105b12dbfd88b4389a2
-
Filesize
372KB
MD51db91b5c1b8ec81a232980a1336dd99b
SHA1209c9146b50fcd4eaaeb0ae36f28ffea0f7e9861
SHA2561bb06eb5633701bf015c2b69f9668dbc74cf412fe36c92fbba66dc828db21f1f
SHA512dd5644e6d21223971dffbb1d0b3b22fc6a0312b57eb506f34ec543501eed068177cba60694fbfe9a9e5697870dc9522f559d9c523f3812c1f950be0b3718a308
-
Filesize
372KB
MD5ec834b013d523cc07b2ad15873f94b90
SHA1bb9cbd0b5bd019dc5d67bfc743ec109a1cdf8a43
SHA256c8dc125573017a1cedb1887837875eb1b6329bf3722ea256d3260a5ff9ffae3d
SHA5127e25d88037e677e1ca5c1af345abaf90c41772a01f4aacfe1f4aed47416cfbd3815e73ee04f1ee58856b3cd60eb322e64401045a41b59793bb2b9c20d3b1bef6