Analysis
- max time kernel
144s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/03/2024, 17:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe
- Size 197KB
- Sample240302-vmrqbaff88
- SHA256 82d4421f02c0a734fbf3f9090898f22d45139b7860311464eeda36045b3af036
- MD5 8f3a758d3eee5c668283226109e8bc61
- SHA1 c2418a3c8b5f9dba00b9f016ec966451c58aa7e8
- SHA512 136abde52ea8c26fa8d2b8d4b5606b7bea7e9f26f716ec54a8408d0080e03dc0d5e0f92beae58ae5632e21665961d55a7125071b472d856e12fa5161c146e993
- SSDEEP 3072:jEGh0oml+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b000000012251-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000013420-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000012251-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0037000000013a6e-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012251-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000012251-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000012251-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}\stubpath = "C:\\Windows\\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe" {2E86218A-6455-4055-AFBE-31548778CBA5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97651DE1-CA04-44d7-A45A-A848195A9F9B} {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FF23FB4-5FF9-45c9-BCD2-10959149697F} {71B3641E-7BEE-4418-BD76-95F6980912E9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE} {8456D868-0F40-47e5-A5B5-4C440EC95298}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{886828F9-B248-4692-80A1-E09E110AA9CE}\stubpath = "C:\\Windows\\{886828F9-B248-4692-80A1-E09E110AA9CE}.exe" 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E86218A-6455-4055-AFBE-31548778CBA5} {886828F9-B248-4692-80A1-E09E110AA9CE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15310E2A-E88F-4051-A787-451D43CEA937}\stubpath = "C:\\Windows\\{15310E2A-E88F-4051-A787-451D43CEA937}.exe" {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{71B3641E-7BEE-4418-BD76-95F6980912E9} {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8456D868-0F40-47e5-A5B5-4C440EC95298} {7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8456D868-0F40-47e5-A5B5-4C440EC95298}\stubpath = "C:\\Windows\\{8456D868-0F40-47e5-A5B5-4C440EC95298}.exe" {7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97651DE1-CA04-44d7-A45A-A848195A9F9B}\stubpath = "C:\\Windows\\{97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe" {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15310E2A-E88F-4051-A787-451D43CEA937} {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{71B3641E-7BEE-4418-BD76-95F6980912E9}\stubpath = "C:\\Windows\\{71B3641E-7BEE-4418-BD76-95F6980912E9}.exe" {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE}\stubpath = "C:\\Windows\\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE}.exe" {8456D868-0F40-47e5-A5B5-4C440EC95298}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A} {2E86218A-6455-4055-AFBE-31548778CBA5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908} {15310E2A-E88F-4051-A787-451D43CEA937}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF} {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}\stubpath = "C:\\Windows\\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe" {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}\stubpath = "C:\\Windows\\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe" {15310E2A-E88F-4051-A787-451D43CEA937}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FF23FB4-5FF9-45c9-BCD2-10959149697F}\stubpath = "C:\\Windows\\{7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe" {71B3641E-7BEE-4418-BD76-95F6980912E9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{886828F9-B248-4692-80A1-E09E110AA9CE} 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E86218A-6455-4055-AFBE-31548778CBA5}\stubpath = "C:\\Windows\\{2E86218A-6455-4055-AFBE-31548778CBA5}.exe" {886828F9-B248-4692-80A1-E09E110AA9CE}.exe - Deletes itself 1 IoCs
pid Process 1444 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 1932 {71B3641E-7BEE-4418-BD76-95F6980912E9}.exe 1660 {7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe 2780 {8456D868-0F40-47e5-A5B5-4C440EC95298}.exe 692 {37248060-D1CE-43f3-8EB1-D93CF76C4DAE}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe {2E86218A-6455-4055-AFBE-31548778CBA5}.exe File created C:\Windows\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe File created C:\Windows\{15310E2A-E88F-4051-A787-451D43CEA937}.exe {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe File created C:\Windows\{8456D868-0F40-47e5-A5B5-4C440EC95298}.exe {7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe File created C:\Windows\{886828F9-B248-4692-80A1-E09E110AA9CE}.exe 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe File created C:\Windows\{2E86218A-6455-4055-AFBE-31548778CBA5}.exe {886828F9-B248-4692-80A1-E09E110AA9CE}.exe File created C:\Windows\{97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe File created C:\Windows\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe {15310E2A-E88F-4051-A787-451D43CEA937}.exe File created C:\Windows\{71B3641E-7BEE-4418-BD76-95F6980912E9}.exe {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe File created C:\Windows\{7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe {71B3641E-7BEE-4418-BD76-95F6980912E9}.exe File created C:\Windows\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE}.exe {8456D868-0F40-47e5-A5B5-4C440EC95298}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe Token: SeIncBasePriorityPrivilege 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe Token: SeIncBasePriorityPrivilege 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe Token: SeIncBasePriorityPrivilege 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe Token: SeIncBasePriorityPrivilege 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe Token: SeIncBasePriorityPrivilege 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe Token: SeIncBasePriorityPrivilege 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe Token: SeIncBasePriorityPrivilege 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe Token: SeIncBasePriorityPrivilege 1932 {71B3641E-7BEE-4418-BD76-95F6980912E9}.exe Token: SeIncBasePriorityPrivilege 1660 {7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe Token: SeIncBasePriorityPrivilege 2780 {8456D868-0F40-47e5-A5B5-4C440EC95298}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2396 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 28 PID 2532 wrote to memory of 2396 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 28 PID 2532 wrote to memory of 2396 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 28 PID 2532 wrote to memory of 2396 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 28 PID 2532 wrote to memory of 1444 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 29 PID 2532 wrote to memory of 1444 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 29 PID 2532 wrote to memory of 1444 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 29 PID 2532 wrote to memory of 1444 2532 2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe 29 PID 2396 wrote to memory of 2652 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 30 PID 2396 wrote to memory of 2652 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 30 PID 2396 wrote to memory of 2652 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 30 PID 2396 wrote to memory of 2652 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 30 PID 2396 wrote to memory of 2728 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 31 PID 2396 wrote to memory of 2728 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 31 PID 2396 wrote to memory of 2728 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 31 PID 2396 wrote to memory of 2728 2396 {886828F9-B248-4692-80A1-E09E110AA9CE}.exe 31 PID 2652 wrote to memory of 2804 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 32 PID 2652 wrote to memory of 2804 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 32 PID 2652 wrote to memory of 2804 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 32 PID 2652 wrote to memory of 2804 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 32 PID 2652 wrote to memory of 2480 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 33 PID 2652 wrote to memory of 2480 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 33 PID 2652 wrote to memory of 2480 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 33 PID 2652 wrote to memory of 2480 2652 {2E86218A-6455-4055-AFBE-31548778CBA5}.exe 33 PID 2804 wrote to memory of 2892 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 36 PID 2804 wrote to memory of 2892 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 36 PID 2804 wrote to memory of 2892 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 36 PID 2804 wrote to memory of 2892 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 36 PID 2804 wrote to memory of 2032 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 37 PID 2804 wrote to memory of 2032 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 37 PID 2804 wrote to memory of 2032 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 37 PID 2804 wrote to memory of 2032 2804 {BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe 37 PID 2892 wrote to memory of 2704 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 38 PID 2892 wrote to memory of 2704 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 38 PID 2892 wrote to memory of 2704 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 38 PID 2892 wrote to memory of 2704 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 38 PID 2892 wrote to memory of 2692 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 39 PID 2892 wrote to memory of 2692 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 39 PID 2892 wrote to memory of 2692 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 39 PID 2892 wrote to memory of 2692 2892 {56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe 39 PID 2704 wrote to memory of 2004 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 40 PID 2704 wrote to memory of 2004 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 40 PID 2704 wrote to memory of 2004 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 40 PID 2704 wrote to memory of 2004 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 40 PID 2704 wrote to memory of 2940 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 41 PID 2704 wrote to memory of 2940 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 41 PID 2704 wrote to memory of 2940 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 41 PID 2704 wrote to memory of 2940 2704 {97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe 41 PID 2004 wrote to memory of 1908 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 42 PID 2004 wrote to memory of 1908 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 42 PID 2004 wrote to memory of 1908 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 42 PID 2004 wrote to memory of 1908 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 42 PID 2004 wrote to memory of 2212 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 43 PID 2004 wrote to memory of 2212 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 43 PID 2004 wrote to memory of 2212 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 43 PID 2004 wrote to memory of 2212 2004 {15310E2A-E88F-4051-A787-451D43CEA937}.exe 43 PID 1908 wrote to memory of 1932 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 44 PID 1908 wrote to memory of 1932 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 44 PID 1908 wrote to memory of 1932 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 44 PID 1908 wrote to memory of 1932 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 44 PID 1908 wrote to memory of 1568 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 45 PID 1908 wrote to memory of 1568 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 45 PID 1908 wrote to memory of 1568 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 45 PID 1908 wrote to memory of 1568 1908 {8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_8f3a758d3eee5c668283226109e8bc61_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\{886828F9-B248-4692-80A1-E09E110AA9CE}.exeC:\Windows\{886828F9-B248-4692-80A1-E09E110AA9CE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\{2E86218A-6455-4055-AFBE-31548778CBA5}.exeC:\Windows\{2E86218A-6455-4055-AFBE-31548778CBA5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exeC:\Windows\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exeC:\Windows\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\{97651DE1-CA04-44d7-A45A-A848195A9F9B}.exeC:\Windows\{97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\{15310E2A-E88F-4051-A787-451D43CEA937}.exeC:\Windows\{15310E2A-E88F-4051-A787-451D43CEA937}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exeC:\Windows\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\{71B3641E-7BEE-4418-BD76-95F6980912E9}.exeC:\Windows\{71B3641E-7BEE-4418-BD76-95F6980912E9}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\{7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exeC:\Windows\{7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\{8456D868-0F40-47e5-A5B5-4C440EC95298}.exeC:\Windows\{8456D868-0F40-47e5-A5B5-4C440EC95298}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE}.exeC:\Windows\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE}.exe12⤵
- Executes dropped EXE
PID:692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8456D~1.EXE > nul12⤵PID:332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FF23~1.EXE > nul11⤵PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71B36~1.EXE > nul10⤵PID:1760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DB91~1.EXE > nul9⤵PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15310~1.EXE > nul8⤵PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97651~1.EXE > nul7⤵PID:2940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56B3A~1.EXE > nul6⤵PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCCFE~1.EXE > nul5⤵PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E862~1.EXE > nul4⤵PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88682~1.EXE > nul3⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{15310E2A-E88F-4051-A787-451D43CEA937}.exe
- Size 197KB
- SHA256 96bdec80ba5724a0b52bda9ba41b40411105842fdf7430093a5e6f5002b0c433
- MD5 729846953336fca03012c48e9082d0dd
- SHA1 c9ac7f949646febd9089c8f9ec230283562d2642
- SHA512 7b76794585ede078a5d3d731f7adc45f9f49449c35dcb670a964f8aa0f5313a6674ae1ce642faf97fc9607dd0292ede0fb6333ee7f46d848e263dfee285e9e44
- SSDEEP 3072:jEGh0oHl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGBlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2E86218A-6455-4055-AFBE-31548778CBA5}.exe
- Size 197KB
- SHA256 961871a81976de66d9ecb2105c851ca887555b741529c4dfcba567606a142ae2
- MD5 cac53b5b8b756e16094b3526e2a15cdb
- SHA1 c0c60f6af0b837cc0a7dbbee2833f9987891349f
- SHA512 d02d688f6e92cedbb46e63e0d538dcb2b5389ecba99e538ae836fb74d80b6b9216f1e78baa7b39d9ae34557f9ee6a2ce839e4d0463337c09689278e6b5880567
- SSDEEP 3072:jEGh0opl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGrlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{37248060-D1CE-43f3-8EB1-D93CF76C4DAE}.exe
- Size 197KB
- SHA256 8a7dbabfd7398d4ee77ce6ccff49b43b4759c6d67ce7756ebf0680391f464c3d
- MD5 877133c7baa641de4fdbc1434b3fafb2
- SHA1 5a524f94d0c4fb05bdc711b66dbf57243537a993
- SHA512 4cb4e01840e969e0007bd1927260e38075fec5ebb8164b91c052612040e69ebe043f9a9299b15f4428365f96cfe86d2541c467072d5e60bb4861d04d4dae1c2a
- SSDEEP 3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGIlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{56B3A761-AC74-43ed-A2A8-A6B40FDE70FF}.exe
- Size 197KB
- SHA256 5b6078b19a360cac4de8d4ec51afacb0324f8e825f439f8a9ec11c576de52dd7
- MD5 df89531c98c218bfceb93e7225dfdd43
- SHA1 e83d132e37cd776720f9e15af571e7b168e223fb
- SHA512 dd9474a53cff9544964828d33371c11ba9c8f0523902ee16e873afc7348ca42753ea781f88aae8b49cf90a064e41470784a7c0aec5e56f44d35c1e2b32f027a6
- SSDEEP 3072:jEGh0ohl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGTlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{71B3641E-7BEE-4418-BD76-95F6980912E9}.exe
- Size 197KB
- SHA256 30a9ac319a2586a9fd19c5d127a9f95eac7b76709799c27da36be85074ee95d6
- MD5 5d37c97c61fe66afbabe8c90b7237740
- SHA1 4ed0e58ed23c683b5553bab642fc45552e834b2f
- SHA512 f3aa0e98ec6eb0592bba31bd45c335bc770811b7aac754b5d381b3af89f2fb2a1673376e77bedb25cef1d78c37da30d6cc5280a9d6d1f913179ed6ce612a83cf
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGJlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7FF23FB4-5FF9-45c9-BCD2-10959149697F}.exe
- Size 197KB
- SHA256 089d9e7a86c29d0c9cafa7b1fede16a1a936219958c773727b0f39c5214b7de3
- MD5 38a79e309ba44a272039b0802482de8a
- SHA1 bddbae534cee0debd8dc43cc0a5e108683cfaf7b
- SHA512 74ea199d6881ce1d85960553e37c422adef0690448f45aa85434c32b90a1e2462e77c8763020d68053cd4c336bb459ad8f90b60ba4e43a3447ae2eeead9d080b
- SSDEEP 3072:jEGh0okl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGKlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8456D868-0F40-47e5-A5B5-4C440EC95298}.exe
- Size 197KB
- SHA256 c932a704fe02852748fb0068b0ce90ec6a93f5e205000310d04274439d3030a9
- MD5 b40c07353b6486a8bfe5c80750fbf1e9
- SHA1 c999c7aefa8ce5c767d828224211134cbddfe757
- SHA512 615bff1a56404577ffba230ab6c2d18259526da44764cf17e683d146493f6bbf3d8e0731da7619ca0b9dfda81382523b96e6d577d40630f78bdffda996b71be8
- SSDEEP 3072:jEGh0opl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGHlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{886828F9-B248-4692-80A1-E09E110AA9CE}.exe
- Size 197KB
- SHA256 0224e2d931113046ebf9688cf7c14c74524240ce1bde92215f7694aa4eea3fe0
- MD5 32059418ee5faf1e59f26d5ea9688b73
- SHA1 a9df669ea51cae56d8001c2742f2214467eb109b
- SHA512 4a7d6761d714f270cd412faa8fe055cc55eeefacc8436f22546c2afdac779ddd63abe6463316d4ff22d4c5c976ae34ffa20f5cd7a86d28e6bd777fa4af8d667a
- SSDEEP 3072:jEGh0oEl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGSlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8DB913D3-1FA5-4e0b-999B-6D3C37AE8908}.exe
- Size 197KB
- SHA256 d2120d4b5545404a7d327f566884db94770d15e136b19bf60a49116c62d478de
- MD5 a08f4e02532a5e93a18d44849f58ec64
- SHA1 44890002b5582426b2980709c982f4ca5859f6fb
- SHA512 80fb92e889dfb129ac8b45387eee996de24453c41209ecf37b19255d492a64feee2ca912106880b409ef9dbd4f7acff304f3ae157b1860711dc5badeb2863428
- SSDEEP 3072:jEGh0ocl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGulEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{97651DE1-CA04-44d7-A45A-A848195A9F9B}.exe
- Size 197KB
- SHA256 7b0abc5584c14392f5c657517d2fe509be8974a346493de9a2175c7172ad6c9e
- MD5 90c2b1e08a66aad0e5c71d3019893055
- SHA1 3073948d8ad93569ef682bb1a74a261852212839
- SHA512 0a0210c4ec64d3bd8b58195125a46af760fca362f41b05ad752bdec46165d4a48582897e3369389e40c7f0fdace2e38db4b9c56b17e6b5d2737e9c03bbaa86db
- SSDEEP 3072:jEGh0onl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGllEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BCCFE9B9-1C1F-4c7f-A35C-376DA3310B1A}.exe
- Size 197KB
- SHA256 e6cd682ea91da25106b559d932f2e96fbe33b3705fbf0c810e33a04ade14d5e7
- MD5 ac263180ae230e4b798b0bdfe0622677
- SHA1 928be6a2ee1dbf45f0ecb7a46d9dc17a527a2ce1
- SHA512 c5a3ab980a31942be1664e6b3fbd2113a0ef12257c91a0f85eb9d495f147059abc46d2d0d01c3303c9c04fac450b7d21cc747952b73be0145d98a7b1614e2db5
- SSDEEP 3072:jEGh0oGl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG0lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP