Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 13:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe
- Size 408KB
- Sample240302-q9rxdaec89
- SHA256 cdbba5de25d02dd854ada432bc4295a6fae2f70a723f410aa6a8850799fb8b67
- MD5 e85e58fbe854da79124c76505fc2c18c
- SHA1 a5023810e194d12310241133611ab69558dc5b0c
- SHA512 36ef6ce9ff70822bca8ca7bd72bd6b7efa76ce7d5dcfe27a96d5ed394200c7e95dfa771d4f7acc7eca1ee4a1ad08140b1419ccac387a5ffb43ffe93fef8c4272
- SSDEEP 3072:CEGh0oil3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x0004000000022ea1-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023252-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023259-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000022e9f-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023259-17.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000022e9f-21.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023259-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000022e9f-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023259-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000022e9f-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023259-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11865B59-35CF-474f-8FE1-888A1C194D22} {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11865B59-35CF-474f-8FE1-888A1C194D22}\stubpath = "C:\\Windows\\{11865B59-35CF-474f-8FE1-888A1C194D22}.exe" {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F17AAC57-7ED0-4365-B46F-05E08D756407} {11865B59-35CF-474f-8FE1-888A1C194D22}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{705C52AC-51A5-4509-B27A-0D3504C18631} {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}\stubpath = "C:\\Windows\\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe" {705C52AC-51A5-4509-B27A-0D3504C18631}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{705C52AC-51A5-4509-B27A-0D3504C18631}\stubpath = "C:\\Windows\\{705C52AC-51A5-4509-B27A-0D3504C18631}.exe" {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A} {705C52AC-51A5-4509-B27A-0D3504C18631}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42A76A43-564B-4e64-8E79-112052662CA3} {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42A76A43-564B-4e64-8E79-112052662CA3}\stubpath = "C:\\Windows\\{42A76A43-564B-4e64-8E79-112052662CA3}.exe" {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE272DE6-8520-4505-90AB-F523488CB0D6}\stubpath = "C:\\Windows\\{CE272DE6-8520-4505-90AB-F523488CB0D6}.exe" {42A76A43-564B-4e64-8E79-112052662CA3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA120392-F41B-4115-B583-E92B7D6C414A} {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26} {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}\stubpath = "C:\\Windows\\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe" {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA120392-F41B-4115-B583-E92B7D6C414A}\stubpath = "C:\\Windows\\{AA120392-F41B-4115-B583-E92B7D6C414A}.exe" {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{717BFF29-CD11-4c32-9F62-2574F9743C99} {AA120392-F41B-4115-B583-E92B7D6C414A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC344D76-E051-4a9e-BD58-389ABD22DBF4} 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B} {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE272DE6-8520-4505-90AB-F523488CB0D6} {42A76A43-564B-4e64-8E79-112052662CA3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F17AAC57-7ED0-4365-B46F-05E08D756407}\stubpath = "C:\\Windows\\{F17AAC57-7ED0-4365-B46F-05E08D756407}.exe" {11865B59-35CF-474f-8FE1-888A1C194D22}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{717BFF29-CD11-4c32-9F62-2574F9743C99}\stubpath = "C:\\Windows\\{717BFF29-CD11-4c32-9F62-2574F9743C99}.exe" {AA120392-F41B-4115-B583-E92B7D6C414A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC344D76-E051-4a9e-BD58-389ABD22DBF4}\stubpath = "C:\\Windows\\{FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe" 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B}\stubpath = "C:\\Windows\\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe" {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe - Executes dropped EXE 11 IoCs
pid Process 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 2296 {AA120392-F41B-4115-B583-E92B7D6C414A}.exe 2800 {717BFF29-CD11-4c32-9F62-2574F9743C99}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{CE272DE6-8520-4505-90AB-F523488CB0D6}.exe {42A76A43-564B-4e64-8E79-112052662CA3}.exe File created C:\Windows\{F17AAC57-7ED0-4365-B46F-05E08D756407}.exe {11865B59-35CF-474f-8FE1-888A1C194D22}.exe File created C:\Windows\{AA120392-F41B-4115-B583-E92B7D6C414A}.exe {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe File created C:\Windows\{717BFF29-CD11-4c32-9F62-2574F9743C99}.exe {AA120392-F41B-4115-B583-E92B7D6C414A}.exe File created C:\Windows\{FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe File created C:\Windows\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe File created C:\Windows\{705C52AC-51A5-4509-B27A-0D3504C18631}.exe {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe File created C:\Windows\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe {705C52AC-51A5-4509-B27A-0D3504C18631}.exe File created C:\Windows\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe File created C:\Windows\{42A76A43-564B-4e64-8E79-112052662CA3}.exe {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe File created C:\Windows\{11865B59-35CF-474f-8FE1-888A1C194D22}.exe {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe Token: SeIncBasePriorityPrivilege 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe Token: SeIncBasePriorityPrivilege 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe Token: SeIncBasePriorityPrivilege 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe Token: SeIncBasePriorityPrivilege 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe Token: SeIncBasePriorityPrivilege 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe Token: SeIncBasePriorityPrivilege 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe Token: SeIncBasePriorityPrivilege 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe Token: SeIncBasePriorityPrivilege 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe Token: SeIncBasePriorityPrivilege 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe Token: SeIncBasePriorityPrivilege 2296 {AA120392-F41B-4115-B583-E92B7D6C414A}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 4360 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe 96 PID 5016 wrote to memory of 4360 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe 96 PID 5016 wrote to memory of 4360 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe 96 PID 5016 wrote to memory of 3500 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe 97 PID 5016 wrote to memory of 3500 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe 97 PID 5016 wrote to memory of 3500 5016 2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe 97 PID 4360 wrote to memory of 1096 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 98 PID 4360 wrote to memory of 1096 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 98 PID 4360 wrote to memory of 1096 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 98 PID 4360 wrote to memory of 2856 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 99 PID 4360 wrote to memory of 2856 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 99 PID 4360 wrote to memory of 2856 4360 {FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe 99 PID 1096 wrote to memory of 2916 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 102 PID 1096 wrote to memory of 2916 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 102 PID 1096 wrote to memory of 2916 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 102 PID 1096 wrote to memory of 2392 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 103 PID 1096 wrote to memory of 2392 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 103 PID 1096 wrote to memory of 2392 1096 {5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe 103 PID 2916 wrote to memory of 1072 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 106 PID 2916 wrote to memory of 1072 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 106 PID 2916 wrote to memory of 1072 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 106 PID 2916 wrote to memory of 1260 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 107 PID 2916 wrote to memory of 1260 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 107 PID 2916 wrote to memory of 1260 2916 {D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe 107 PID 1072 wrote to memory of 4568 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 108 PID 1072 wrote to memory of 4568 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 108 PID 1072 wrote to memory of 4568 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 108 PID 1072 wrote to memory of 3604 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 109 PID 1072 wrote to memory of 3604 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 109 PID 1072 wrote to memory of 3604 1072 {705C52AC-51A5-4509-B27A-0D3504C18631}.exe 109 PID 4568 wrote to memory of 4340 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 110 PID 4568 wrote to memory of 4340 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 110 PID 4568 wrote to memory of 4340 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 110 PID 4568 wrote to memory of 3696 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 111 PID 4568 wrote to memory of 3696 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 111 PID 4568 wrote to memory of 3696 4568 {D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe 111 PID 4340 wrote to memory of 772 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 112 PID 4340 wrote to memory of 772 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 112 PID 4340 wrote to memory of 772 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 112 PID 4340 wrote to memory of 2268 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 113 PID 4340 wrote to memory of 2268 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 113 PID 4340 wrote to memory of 2268 4340 {42A76A43-564B-4e64-8E79-112052662CA3}.exe 113 PID 772 wrote to memory of 3980 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 114 PID 772 wrote to memory of 3980 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 114 PID 772 wrote to memory of 3980 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 114 PID 772 wrote to memory of 1688 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 115 PID 772 wrote to memory of 1688 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 115 PID 772 wrote to memory of 1688 772 {CE272DE6-8520-4505-90AB-F523488CB0D6}.exe 115 PID 3980 wrote to memory of 4092 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 116 PID 3980 wrote to memory of 4092 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 116 PID 3980 wrote to memory of 4092 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 116 PID 3980 wrote to memory of 1408 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 117 PID 3980 wrote to memory of 1408 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 117 PID 3980 wrote to memory of 1408 3980 {11865B59-35CF-474f-8FE1-888A1C194D22}.exe 117 PID 4092 wrote to memory of 2296 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 118 PID 4092 wrote to memory of 2296 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 118 PID 4092 wrote to memory of 2296 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 118 PID 4092 wrote to memory of 4908 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 119 PID 4092 wrote to memory of 4908 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 119 PID 4092 wrote to memory of 4908 4092 {F17AAC57-7ED0-4365-B46F-05E08D756407}.exe 119 PID 2296 wrote to memory of 2800 2296 {AA120392-F41B-4115-B583-E92B7D6C414A}.exe 120 PID 2296 wrote to memory of 2800 2296 {AA120392-F41B-4115-B583-E92B7D6C414A}.exe 120 PID 2296 wrote to memory of 2800 2296 {AA120392-F41B-4115-B583-E92B7D6C414A}.exe 120 PID 2296 wrote to memory of 2008 2296 {AA120392-F41B-4115-B583-E92B7D6C414A}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_e85e58fbe854da79124c76505fc2c18c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\{FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exeC:\Windows\{FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exeC:\Windows\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exeC:\Windows\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\{705C52AC-51A5-4509-B27A-0D3504C18631}.exeC:\Windows\{705C52AC-51A5-4509-B27A-0D3504C18631}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exeC:\Windows\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\{42A76A43-564B-4e64-8E79-112052662CA3}.exeC:\Windows\{42A76A43-564B-4e64-8E79-112052662CA3}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\{CE272DE6-8520-4505-90AB-F523488CB0D6}.exeC:\Windows\{CE272DE6-8520-4505-90AB-F523488CB0D6}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\{11865B59-35CF-474f-8FE1-888A1C194D22}.exeC:\Windows\{11865B59-35CF-474f-8FE1-888A1C194D22}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\{F17AAC57-7ED0-4365-B46F-05E08D756407}.exeC:\Windows\{F17AAC57-7ED0-4365-B46F-05E08D756407}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\{AA120392-F41B-4115-B583-E92B7D6C414A}.exeC:\Windows\{AA120392-F41B-4115-B583-E92B7D6C414A}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\{717BFF29-CD11-4c32-9F62-2574F9743C99}.exeC:\Windows\{717BFF29-CD11-4c32-9F62-2574F9743C99}.exe12⤵
- Executes dropped EXE
PID:2800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA120~1.EXE > nul12⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F17AA~1.EXE > nul11⤵PID:4908
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11865~1.EXE > nul10⤵PID:1408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE272~1.EXE > nul9⤵PID:1688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42A76~1.EXE > nul8⤵PID:2268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D366D~1.EXE > nul7⤵PID:3696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{705C5~1.EXE > nul6⤵PID:3604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D821C~1.EXE > nul5⤵PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5DC4F~1.EXE > nul4⤵PID:2392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC344~1.EXE > nul3⤵PID:2856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{11865B59-35CF-474f-8FE1-888A1C194D22}.exe
- Size 408KB
- SHA256 9f27a9cb80289cde66f15570be64815a4c8529eb83d066f5d01fdb61891bab03
- MD5 6a551f40097ac22f07f87a8bb288fce8
- SHA1 05a67a463d9b908e48d4f99bb0694c4712294396
- SHA512 fd7e20b7f964d62005c605fc3f1def87e338a929a26f2a7c4c241143c0c067012aedd21934d3b15ada2c6692a954d92aed37a348f69a7404bb2e00d01e164a6d
- SSDEEP 3072:CEGh0oSl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG8ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{42A76A43-564B-4e64-8E79-112052662CA3}.exe
- Size 408KB
- SHA256 caad283645de789fb48908faaac15d7a8f727056c23e8090208c9d95286dc998
- MD5 88336e45b8995b528048b263dd4867b5
- SHA1 0ab54e9e363ac6e658c844734f6af833fc5da88e
- SHA512 1a9c305765294346fcfa466ae0158498cf38647eaa256387488b7ee35241f72f13cd703414d1d13ffc5e3a49a42d67f54d56a79d0d44a8f34dbaa68d30aa7f56
- SSDEEP 3072:CEGh0oRl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG7ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5DC4FCF4-986B-4695-A0CD-30BF47C4EF26}.exe
- Size 408KB
- SHA256 86db868a411277082ebce543fd261f22e9e6915091b5526f349a798e2adcb2d3
- MD5 9d5f42e845cdabe43b850867a6c694eb
- SHA1 0f786e3c0754125c1bc04c4408d16352c0d031aa
- SHA512 57b989c98801f27a5d041fd3773262ed21740e03bf1e7a2d4e56e7f611a48c2d8f1188888c17260e531645b493c057fc4edad075ec24ba3509138653c784a0e5
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGgldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{705C52AC-51A5-4509-B27A-0D3504C18631}.exe
- Size 408KB
- SHA256 17d7e774d3df9d9c385d72b738d3c0b3ae0b3d5bc81c4e68857322c42552868e
- MD5 b1e97df7111cff983f76158c10be07bb
- SHA1 7467bdc050ec9a7a67013cf4951ba1e00222fc4d
- SHA512 c9828dde6d88642c24e94093e6423989e51284b7ea3ac5e46101c80383774a419a794674edb45780415d0e67edfe54b24ffb3be0c5595c0975030847230cdd01
- SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGqldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{717BFF29-CD11-4c32-9F62-2574F9743C99}.exe
- Size 408KB
- SHA256 3804b711dabb56a68e746dc27e787dd00c2402ef69154f4afceee9eba5a20990
- MD5 dbce2a61531980d4f53ca7201cb7b201
- SHA1 7796121e1017f0dc501c45ed241b74a5dcaeb320
- SHA512 866039b6c73fd7aaf3eeaec61b685bf9d3645612e99534b043fc27180943ad72f445ed278edd34f79486355d1c98581ddd1ee254b3f9d6896114b92c902ec1ec
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGWldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AA120392-F41B-4115-B583-E92B7D6C414A}.exe
- Size 408KB
- SHA256 e73d418974ff6599a200d73dc7a7fa22c1c107b047b14ec4cc574fb3f4602fd9
- MD5 54ca47e69706f73a4bf48184e5b0d441
- SHA1 b187e2afdf94f66883b8e71c67a461d9855a211a
- SHA512 158f3d71d32cd1a8f7b705cc0332139d2dc23242302489a2168b49122d9acf68c8c6045934bca8a1d29d5f8c892c3d0a6c280902a7243f17ac48483439418c62
- SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGpldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CE272DE6-8520-4505-90AB-F523488CB0D6}.exe
- Size 408KB
- SHA256 29eaa0f0668ed04dc986a666a65196e9fb1dc67351ffe5befce2a331a68d502f
- MD5 15130f6a3632ca6dfa2932b6c813bc52
- SHA1 3d57c10a0cb1d43406a5ba0307fb561942965d22
- SHA512 f1f2c73a2ac6377546dbb07e2da9a154312d86828942c44de828a42cebe90b0b01bc2337a16898daa707e17c21f3a0a2a9686bc320d6c1a08341be5fc7155a56
- SSDEEP 3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG4ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D366DF0A-F207-43ae-8AC5-42FBB74CCE5A}.exe
- Size 408KB
- SHA256 89e15b9f2e713e6631ebc6f76408ef1157721e2dead6820f139234db608d09a7
- MD5 1ac2af838b480b75354dfd17270f3a10
- SHA1 25dd5f019479669fd7227c574e6b98ff6e2b0bbd
- SHA512 5738d7527bf16b3dff06b293deadcf7d25ce0c18cb060afb7db4bd0abe932d892f79e86375f99bb00a898fb0a59ca41a29b056eab55bd07fcca5d85b7b847320
- SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D821CE12-912E-4de5-AD2A-7DBD44FDE15B}.exe
- Size 408KB
- SHA256 a36d0159f4f4a175c12eac32da1fb19043e76eed4b3d7c535acb2bab46a8e8a5
- MD5 b2b86fb9b521aadc06321763680e8112
- SHA1 406d99cf578d38e93dec3bb3c059f82476022271
- SHA512 6901200b97d6425f010132d84497095e8a2b1112ea7e940038932a588d7b875c27efc436fc68a020f53ec2b66b2a88511c5453f6b8ef3c7d40e2d1f85c322e49
- SSDEEP 3072:CEGh0oFZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTB1:CEGFldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F17AAC57-7ED0-4365-B46F-05E08D756407}.exe
- Size 408KB
- SHA256 30e96bd597f1fd893226ecc8e9ca01a9db21c8a98496076209fc0e5a15544769
- MD5 1e401ec737ba98714a69aba7577cc038
- SHA1 c135f308d94015fa618c629fe430f4cda58c9022
- SHA512 4396fc819609f2ad3974bff2171a7e6fec41bc37bf4356b70b26b1ea4d54b439231dc36659b83e4bab6ce1efd371d556a80437e9508e1ba90d90a420b2653bbd
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FC344D76-E051-4a9e-BD58-389ABD22DBF4}.exe
- Size 408KB
- SHA256 b89496f2da4bb86f8d26eaf8ca9419daa1500b34dc3f081a6393112524d494ba
- MD5 c7f472743336473fc37eb7aa87036e2f
- SHA1 3258b3190ca45b6e68fe307c0114238990ffde12
- SHA512 ca4b24e7ed360aed834f1dbcfba919fa6d5b07cd511d7bc97f6e10a4193561aef59170d070b36b465e7cfffebfb97b70b89e15bf721083813eee48901b6e5e92
- SSDEEP 3072:CEGh0o3l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGlldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP