Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe
-
Size
197KB
-
MD5
5485695f8bbc60562998d1755b1248ad
-
SHA1
ba77ee5ad1c669989a4788c0caa20fac70aff9cc
-
SHA256
520e7dd5ea39aa84c837fc3ec9ebfaeb5503d3e4400a0f77507e11ab809711c8
-
SHA512
43e4f71bcef2ba80cbbcd032120f0d6cb76e67df53b81f45e5864cec5c3902a88898f3e161936c807550db6f99a94edc3d27ade0f8ca83610be1a3178a9fcd15
-
SSDEEP
3072:jEGh0oWl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG8lEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000a000000012252-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d00000001231c-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000012252-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0031000000014502-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000012252-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012252-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000012252-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{936E81BC-139F-4637-BA27-821606B69326}\stubpath = "C:\\Windows\\{936E81BC-139F-4637-BA27-821606B69326}.exe" {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C73A2CE9-7831-4c33-9518-3BE027DAAF35}\stubpath = "C:\\Windows\\{C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe" {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B29B8603-A5B3-4219-9197-B1C4BECCCF9B} {DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C5FA84A-9B68-46d3-9501-975A2285526A} {B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C5FA84A-9B68-46d3-9501-975A2285526A}\stubpath = "C:\\Windows\\{2C5FA84A-9B68-46d3-9501-975A2285526A}.exe" {B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73A3E1D5-DF91-42ee-A7B8-B3384BBE7021} {2C5FA84A-9B68-46d3-9501-975A2285526A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73A3E1D5-DF91-42ee-A7B8-B3384BBE7021}\stubpath = "C:\\Windows\\{73A3E1D5-DF91-42ee-A7B8-B3384BBE7021}.exe" {2C5FA84A-9B68-46d3-9501-975A2285526A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B928FCC-2808-4d8f-990A-EEDF58BCA7E2} {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}\stubpath = "C:\\Windows\\{7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe" {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59C20C84-FFFC-41a7-8C98-8A98DDB23850}\stubpath = "C:\\Windows\\{59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe" {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ECDFC863-75C8-414e-A687-F5E5731DF9FF} {936E81BC-139F-4637-BA27-821606B69326}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ECDFC863-75C8-414e-A687-F5E5731DF9FF}\stubpath = "C:\\Windows\\{ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe" {936E81BC-139F-4637-BA27-821606B69326}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B} {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B29B8603-A5B3-4219-9197-B1C4BECCCF9B}\stubpath = "C:\\Windows\\{B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe" {DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6FA44326-6BAE-4cea-8FA8-D31712D0017C} 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6FA44326-6BAE-4cea-8FA8-D31712D0017C}\stubpath = "C:\\Windows\\{6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe" 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4AC155A-F8B9-4c3d-8890-C165A7799122} {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4AC155A-F8B9-4c3d-8890-C165A7799122}\stubpath = "C:\\Windows\\{E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe" {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{936E81BC-139F-4637-BA27-821606B69326} {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C73A2CE9-7831-4c33-9518-3BE027DAAF35} {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59C20C84-FFFC-41a7-8C98-8A98DDB23850} {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}\stubpath = "C:\\Windows\\{DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe" {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe -
Executes dropped EXE 11 IoCs
pid Process 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 1128 {DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe 2040 {B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe 780 {2C5FA84A-9B68-46d3-9501-975A2285526A}.exe 1820 {73A3E1D5-DF91-42ee-A7B8-B3384BBE7021}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe File created C:\Windows\{59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe File created C:\Windows\{ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe {936E81BC-139F-4637-BA27-821606B69326}.exe File created C:\Windows\{C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe File created C:\Windows\{DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe File created C:\Windows\{6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe File created C:\Windows\{7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe File created C:\Windows\{936E81BC-139F-4637-BA27-821606B69326}.exe {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe File created C:\Windows\{B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe {DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe File created C:\Windows\{2C5FA84A-9B68-46d3-9501-975A2285526A}.exe {B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe File created C:\Windows\{73A3E1D5-DF91-42ee-A7B8-B3384BBE7021}.exe {2C5FA84A-9B68-46d3-9501-975A2285526A}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe Token: SeIncBasePriorityPrivilege 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe Token: SeIncBasePriorityPrivilege 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe Token: SeIncBasePriorityPrivilege 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe Token: SeIncBasePriorityPrivilege 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe Token: SeIncBasePriorityPrivilege 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe Token: SeIncBasePriorityPrivilege 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe Token: SeIncBasePriorityPrivilege 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe Token: SeIncBasePriorityPrivilege 1128 {DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe Token: SeIncBasePriorityPrivilege 2040 {B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe Token: SeIncBasePriorityPrivilege 780 {2C5FA84A-9B68-46d3-9501-975A2285526A}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2080 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 28 PID 2700 wrote to memory of 2080 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 28 PID 2700 wrote to memory of 2080 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 28 PID 2700 wrote to memory of 2080 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 28 PID 2700 wrote to memory of 2628 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 29 PID 2700 wrote to memory of 2628 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 29 PID 2700 wrote to memory of 2628 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 29 PID 2700 wrote to memory of 2628 2700 2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe 29 PID 2080 wrote to memory of 2932 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 30 PID 2080 wrote to memory of 2932 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 30 PID 2080 wrote to memory of 2932 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 30 PID 2080 wrote to memory of 2932 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 30 PID 2080 wrote to memory of 2696 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 31 PID 2080 wrote to memory of 2696 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 31 PID 2080 wrote to memory of 2696 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 31 PID 2080 wrote to memory of 2696 2080 {6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe 31 PID 2932 wrote to memory of 2476 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 33 PID 2932 wrote to memory of 2476 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 33 PID 2932 wrote to memory of 2476 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 33 PID 2932 wrote to memory of 2476 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 33 PID 2932 wrote to memory of 2432 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 32 PID 2932 wrote to memory of 2432 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 32 PID 2932 wrote to memory of 2432 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 32 PID 2932 wrote to memory of 2432 2932 {E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe 32 PID 2476 wrote to memory of 1832 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 37 PID 2476 wrote to memory of 1832 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 37 PID 2476 wrote to memory of 1832 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 37 PID 2476 wrote to memory of 1832 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 37 PID 2476 wrote to memory of 2320 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 36 PID 2476 wrote to memory of 2320 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 36 PID 2476 wrote to memory of 2320 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 36 PID 2476 wrote to memory of 2320 2476 {7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe 36 PID 1832 wrote to memory of 1144 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 39 PID 1832 wrote to memory of 1144 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 39 PID 1832 wrote to memory of 1144 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 39 PID 1832 wrote to memory of 1144 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 39 PID 1832 wrote to memory of 1616 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 38 PID 1832 wrote to memory of 1616 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 38 PID 1832 wrote to memory of 1616 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 38 PID 1832 wrote to memory of 1616 1832 {59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe 38 PID 1144 wrote to memory of 2196 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 41 PID 1144 wrote to memory of 2196 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 41 PID 1144 wrote to memory of 2196 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 41 PID 1144 wrote to memory of 2196 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 41 PID 1144 wrote to memory of 636 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 40 PID 1144 wrote to memory of 636 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 40 PID 1144 wrote to memory of 636 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 40 PID 1144 wrote to memory of 636 1144 {936E81BC-139F-4637-BA27-821606B69326}.exe 40 PID 2196 wrote to memory of 1588 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 43 PID 2196 wrote to memory of 1588 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 43 PID 2196 wrote to memory of 1588 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 43 PID 2196 wrote to memory of 1588 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 43 PID 2196 wrote to memory of 1972 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 42 PID 2196 wrote to memory of 1972 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 42 PID 2196 wrote to memory of 1972 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 42 PID 2196 wrote to memory of 1972 2196 {ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe 42 PID 1588 wrote to memory of 1128 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 44 PID 1588 wrote to memory of 1128 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 44 PID 1588 wrote to memory of 1128 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 44 PID 1588 wrote to memory of 1128 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 44 PID 1588 wrote to memory of 2824 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 45 PID 1588 wrote to memory of 2824 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 45 PID 1588 wrote to memory of 2824 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 45 PID 1588 wrote to memory of 2824 1588 {C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_5485695f8bbc60562998d1755b1248ad_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\{6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exeC:\Windows\{6FA44326-6BAE-4cea-8FA8-D31712D0017C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\{E4AC155A-F8B9-4c3d-8890-C165A7799122}.exeC:\Windows\{E4AC155A-F8B9-4c3d-8890-C165A7799122}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4AC1~1.EXE > nul4⤵PID:2432
-
-
C:\Windows\{7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exeC:\Windows\{7B928FCC-2808-4d8f-990A-EEDF58BCA7E2}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B928~1.EXE > nul5⤵PID:2320
-
-
C:\Windows\{59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exeC:\Windows\{59C20C84-FFFC-41a7-8C98-8A98DDB23850}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59C20~1.EXE > nul6⤵PID:1616
-
-
C:\Windows\{936E81BC-139F-4637-BA27-821606B69326}.exeC:\Windows\{936E81BC-139F-4637-BA27-821606B69326}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{936E8~1.EXE > nul7⤵PID:636
-
-
C:\Windows\{ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exeC:\Windows\{ECDFC863-75C8-414e-A687-F5E5731DF9FF}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECDFC~1.EXE > nul8⤵PID:1972
-
-
C:\Windows\{C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exeC:\Windows\{C73A2CE9-7831-4c33-9518-3BE027DAAF35}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\{DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exeC:\Windows\{DCBB02F9-1B40-4b7c-A3AB-644DADD87F4B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1128 -
C:\Windows\{B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exeC:\Windows\{B29B8603-A5B3-4219-9197-B1C4BECCCF9B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\{2C5FA84A-9B68-46d3-9501-975A2285526A}.exeC:\Windows\{2C5FA84A-9B68-46d3-9501-975A2285526A}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\{73A3E1D5-DF91-42ee-A7B8-B3384BBE7021}.exeC:\Windows\{73A3E1D5-DF91-42ee-A7B8-B3384BBE7021}.exe12⤵
- Executes dropped EXE
PID:1820
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C5FA~1.EXE > nul12⤵PID:1124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B29B8~1.EXE > nul11⤵PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCBB0~1.EXE > nul10⤵PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C73A2~1.EXE > nul9⤵PID:2824
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FA44~1.EXE > nul3⤵PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD52fbddbb4e3a1bcc5bb5b12736f5dbfa0
SHA11848fe7b4e4f5485b7bee3b297b4a78128fcc371
SHA256e4f937ab90299d1c64750a27577a151e3c5f8abc50247a23633bbbca69659ea0
SHA512534e0ac5078734eb8f76536e37137c9306bc06b4e7edc21f16316b76f9039faa523c122d184cef200657bde916b07accbb664483d0c65125a3752bf32a7e7b56
-
Filesize
197KB
MD5557c7cdc41cb7686174688e5f6b7c385
SHA100db0c939243efd590d86c9c4df11e343656e436
SHA2563b20e7def4c4472405b4658e51f6f41514e2c88a873eb87f291156b2925602c2
SHA512e4bf60ed439669f59bb4e0f3dbd90cce154d7bed5a65436e14d31fb8745c17d9e4e98d81958261730ee6b0a9a3307c7840c5ceddfc0b57591781d673a6d3a352
-
Filesize
197KB
MD5dfac218e92096d267b863cc6a8e3b01d
SHA1f2558f259640525ab8e4d519e2918e61da48b77e
SHA2560add0fb607a65c1c80164054dd0b21ac19e85137e504a4640b23ae33e3cd7bc5
SHA512f525646b8eaa6f2322c2dbde4886fde487efcba3f9fa7f8cc06e24a2b056ccd6d4fce30e94dbc7c4973c2099d0be6eb4b9d1a62b7e8270c81a110aec7774bc05
-
Filesize
197KB
MD535e87f19266b1ec6cbc81aef7415907e
SHA1b549c3045c1413b1e09a81a4f1cf54516c405056
SHA256cc6493f1e063a6d6a64b710df7440ec9878d5a62b837ad01ae4abb0e3a8297ac
SHA512cac2caff999689dad35a7e151702007aaed4e83eaf4c77d56380253f6ba1be54b6939571944528de7d8bbb19b828b805c738dd03ac850ce94f191560899873ae
-
Filesize
197KB
MD5a1bab32167e7144d30fcd9bc65bab71c
SHA1013a5ee63df32d51d906a6f6f55e0a59bf2c6d00
SHA256bdaa21ac88772458d3720a47c2cfc87254a79314d9e189c491d1815a8f22ff78
SHA512dffbecc94bcdaa829a076af55215cf052f4417b87df21f8a93f897794868bba8465afb9533a78882901ec4e21328ce58b87c3382544f9f3224869fbf21eaaf4a
-
Filesize
197KB
MD5c2bdbe62f43a28574ab04fdd3406452d
SHA1a04940fd1a004f6957aee35d11c884daf6042138
SHA256a3122c4fc521cc2b5d85966b979881622a40f73abbf0e1135a0dfdbb5ecc4ddf
SHA5127ea5cb5f43d89b1291e0c8070599e06d4921de54b8b47e1bc836c121a1feae419153e3eb2634cb8efa765586b14d14fb3b2be3ba62414d1e8812c5d1ecf1bd7c
-
Filesize
197KB
MD51aa3922530460aee08bf51c0b36be2cf
SHA1126067b9844a246ae5cc0e9b8e1700959a1616af
SHA256b09f182c01ace2469101babe9d753385adce0ec9d0f460e66242fd369e25d516
SHA5126aa813232d900a90ae03871f0938dc019622f1d1b93a47ed7146a97673485193a1d21e200533f09d86823b10b809b86976b1249873a4bf38fb1c1c23eaea0410
-
Filesize
197KB
MD5e25bb8fe6f8a974b2dc685d0224143dd
SHA19b521d6edf5992470f07797d16eda2b7149278d8
SHA256aa280d385f199f02eee3ad528d6ae82bcf4ec8c14a67d09d6bca8d805f5ff4ec
SHA51253d7ea644375e66c61f253e462831253386f8b4c3803398461408ef4d99fcffa3563b80360e22448ca107c16c355c15adc12a12e83e63b57964dd0bf45344b86
-
Filesize
197KB
MD5aab9c8136f0a9c65e86aceabf5cab5f7
SHA14c674f6f3c33f1d97d15e967713ede8f374b1791
SHA256d041e3bee017735cd55e77f2f969f6339b843124dc2febec726c7b0c28b57b43
SHA512972561735aa819ea1b596ded7dd12e95d5413b49e7d22d3d12304f09cac574f9f02bd0baf1a9d73b8f11475ee9375144d9ef59d7f5f75486c1e90d22f4426b34
-
Filesize
197KB
MD5bff5ebe4d3ed2b1564f912593f50ebeb
SHA1454ad1c420d70bc949688f799e65d186a6e84dd3
SHA25601a520b76e577e0f1d5b19155bbbcbf76f5fbdc0bacac692dec66fee0f328ece
SHA512324ac996daa7e1db372f39d828b1f55365fa95345c56820367f469d3e50f602044cb2417753103ffdaf94d1368e06d76cc8eef90b3e955705b2115df756e276f
-
Filesize
197KB
MD5642e66c2232c51f3b75f104d6071584d
SHA1e951e64ead4b6fc9c3761aeec429a4c6894c128c
SHA2560eb1a8e701a285ed740fb54158ed15e7b637b7efd823373bd3608255565ee96c
SHA51279ddd75748d578b682306cd877dc31d9083b1ca7d3001208bdc842a330c28f08859e1ba77a14bc751bbc5294532ae63490807cdc5b42fbfcc9e4703df6eee473