Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2024, 03:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe
- Size 168KB
- Sample240308-dqwp1aea25
- SHA256 2bec45665e6fbfcf9fb4614ebf9cc7192ecf9d4b8627e009738fadbc806121f3
- MD5 ea0ff22cb32ad11bde837b57e6b6e2b8
- SHA1 918c2de3d180b15c1baffbac8600b806781f2826
- SHA512 0e97635e005135f2ba02de13f5aab678e6b5255ab9a047342b7008f551487fc80ec9eb5ce160eba049944ded1f0c45767bb4a2882b1114a7e94c8b478e136686
- SSDEEP 1536:1EGh0o9lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o9lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000c00000002327b-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002328c-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023291-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023141-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000002328c-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023141-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e00000002328c-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023141-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001200000002328c-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000022d09-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000022d09-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000022d0c-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E29E0424-C165-4d28-8D55-07128CFC5409} {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{151BF1ED-338B-4f44-9CF2-2CED2421162B}\stubpath = "C:\\Windows\\{151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe" {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B877529C-4E67-4d0e-869F-6844170D3726}\stubpath = "C:\\Windows\\{B877529C-4E67-4d0e-869F-6844170D3726}.exe" {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}\stubpath = "C:\\Windows\\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe" {B877529C-4E67-4d0e-869F-6844170D3726}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3} {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3}\stubpath = "C:\\Windows\\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe" {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE3EE594-3781-4086-B67A-6AE89C54DBA1} {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0} {37793801-D47D-4967-B811-7F6502F62AB4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E29E0424-C165-4d28-8D55-07128CFC5409}\stubpath = "C:\\Windows\\{E29E0424-C165-4d28-8D55-07128CFC5409}.exe" {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4401E9F-630F-4751-BE3C-0A57F1248C2D}\stubpath = "C:\\Windows\\{D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe" 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8579F67D-62A6-4606-BE4C-E214B62B2A5C}\stubpath = "C:\\Windows\\{8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe" {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{151BF1ED-338B-4f44-9CF2-2CED2421162B} {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8} {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}\stubpath = "C:\\Windows\\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe" {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37793801-D47D-4967-B811-7F6502F62AB4}\stubpath = "C:\\Windows\\{37793801-D47D-4967-B811-7F6502F62AB4}.exe" {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4401E9F-630F-4751-BE3C-0A57F1248C2D} 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8579F67D-62A6-4606-BE4C-E214B62B2A5C} {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B877529C-4E67-4d0e-869F-6844170D3726} {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD} {B877529C-4E67-4d0e-869F-6844170D3726}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0}\stubpath = "C:\\Windows\\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe" {37793801-D47D-4967-B811-7F6502F62AB4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}\stubpath = "C:\\Windows\\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe" {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37793801-D47D-4967-B811-7F6502F62AB4} {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe - Executes dropped EXE 11 IoCs
pid Process 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 116 {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe 3792 {E29E0424-C165-4d28-8D55-07128CFC5409}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe File created C:\Windows\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe {37793801-D47D-4967-B811-7F6502F62AB4}.exe File created C:\Windows\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe File created C:\Windows\{E29E0424-C165-4d28-8D55-07128CFC5409}.exe {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe File created C:\Windows\{D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe File created C:\Windows\{B877529C-4E67-4d0e-869F-6844170D3726}.exe {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe File created C:\Windows\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe {B877529C-4E67-4d0e-869F-6844170D3726}.exe File created C:\Windows\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe File created C:\Windows\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe File created C:\Windows\{37793801-D47D-4967-B811-7F6502F62AB4}.exe {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe File created C:\Windows\{8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe Token: SeIncBasePriorityPrivilege 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe Token: SeIncBasePriorityPrivilege 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe Token: SeIncBasePriorityPrivilege 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe Token: SeIncBasePriorityPrivilege 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe Token: SeIncBasePriorityPrivilege 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe Token: SeIncBasePriorityPrivilege 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe Token: SeIncBasePriorityPrivilege 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe Token: SeIncBasePriorityPrivilege 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe Token: SeIncBasePriorityPrivilege 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe Token: SeIncBasePriorityPrivilege 116 {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 3592 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe 100 PID 4956 wrote to memory of 3592 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe 100 PID 4956 wrote to memory of 3592 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe 100 PID 4956 wrote to memory of 2172 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe 101 PID 4956 wrote to memory of 2172 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe 101 PID 4956 wrote to memory of 2172 4956 2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe 101 PID 3592 wrote to memory of 5064 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 109 PID 3592 wrote to memory of 5064 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 109 PID 3592 wrote to memory of 5064 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 109 PID 3592 wrote to memory of 624 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 110 PID 3592 wrote to memory of 624 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 110 PID 3592 wrote to memory of 624 3592 {D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe 110 PID 5064 wrote to memory of 1192 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 112 PID 5064 wrote to memory of 1192 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 112 PID 5064 wrote to memory of 1192 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 112 PID 5064 wrote to memory of 5068 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 113 PID 5064 wrote to memory of 5068 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 113 PID 5064 wrote to memory of 5068 5064 {8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe 113 PID 1192 wrote to memory of 4632 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 116 PID 1192 wrote to memory of 4632 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 116 PID 1192 wrote to memory of 4632 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 116 PID 1192 wrote to memory of 3016 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 117 PID 1192 wrote to memory of 3016 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 117 PID 1192 wrote to memory of 3016 1192 {151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe 117 PID 4632 wrote to memory of 4660 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 118 PID 4632 wrote to memory of 4660 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 118 PID 4632 wrote to memory of 4660 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 118 PID 4632 wrote to memory of 2148 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 119 PID 4632 wrote to memory of 2148 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 119 PID 4632 wrote to memory of 2148 4632 {B877529C-4E67-4d0e-869F-6844170D3726}.exe 119 PID 4660 wrote to memory of 1368 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 121 PID 4660 wrote to memory of 1368 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 121 PID 4660 wrote to memory of 1368 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 121 PID 4660 wrote to memory of 5012 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 122 PID 4660 wrote to memory of 5012 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 122 PID 4660 wrote to memory of 5012 4660 {71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe 122 PID 1368 wrote to memory of 3488 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 123 PID 1368 wrote to memory of 3488 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 123 PID 1368 wrote to memory of 3488 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 123 PID 1368 wrote to memory of 3648 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 124 PID 1368 wrote to memory of 3648 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 124 PID 1368 wrote to memory of 3648 1368 {B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe 124 PID 3488 wrote to memory of 2628 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 125 PID 3488 wrote to memory of 2628 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 125 PID 3488 wrote to memory of 2628 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 125 PID 3488 wrote to memory of 3184 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 126 PID 3488 wrote to memory of 3184 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 126 PID 3488 wrote to memory of 3184 3488 {6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe 126 PID 2628 wrote to memory of 3084 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 129 PID 2628 wrote to memory of 3084 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 129 PID 2628 wrote to memory of 3084 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 129 PID 2628 wrote to memory of 4040 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 130 PID 2628 wrote to memory of 4040 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 130 PID 2628 wrote to memory of 4040 2628 {37793801-D47D-4967-B811-7F6502F62AB4}.exe 130 PID 3084 wrote to memory of 116 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 137 PID 3084 wrote to memory of 116 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 137 PID 3084 wrote to memory of 116 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 137 PID 3084 wrote to memory of 1688 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 138 PID 3084 wrote to memory of 1688 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 138 PID 3084 wrote to memory of 1688 3084 {CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe 138 PID 116 wrote to memory of 3792 116 {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe 139 PID 116 wrote to memory of 3792 116 {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe 139 PID 116 wrote to memory of 3792 116 {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe 139 PID 116 wrote to memory of 3996 116 {FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe 140
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_ea0ff22cb32ad11bde837b57e6b6e2b8_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\{D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exeC:\Windows\{D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\{8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exeC:\Windows\{8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\{151BF1ED-338B-4f44-9CF2-2CED2421162B}.exeC:\Windows\{151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\{B877529C-4E67-4d0e-869F-6844170D3726}.exeC:\Windows\{B877529C-4E67-4d0e-869F-6844170D3726}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exeC:\Windows\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exeC:\Windows\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exeC:\Windows\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\{37793801-D47D-4967-B811-7F6502F62AB4}.exeC:\Windows\{37793801-D47D-4967-B811-7F6502F62AB4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exeC:\Windows\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exeC:\Windows\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\{E29E0424-C165-4d28-8D55-07128CFC5409}.exeC:\Windows\{E29E0424-C165-4d28-8D55-07128CFC5409}.exe12⤵
- Executes dropped EXE
PID:3792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE3EE~1.EXE > nul12⤵PID:3996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEDE3~1.EXE > nul11⤵PID:1688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37793~1.EXE > nul10⤵PID:4040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CD66~1.EXE > nul9⤵PID:3184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B96B5~1.EXE > nul8⤵PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71E82~1.EXE > nul7⤵PID:5012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8775~1.EXE > nul6⤵PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{151BF~1.EXE > nul5⤵PID:3016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8579F~1.EXE > nul4⤵PID:5068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4401~1.EXE > nul3⤵PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:4344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{151BF1ED-338B-4f44-9CF2-2CED2421162B}.exe
- Size 168KB
- SHA256 ee15eb69feb6c89dcb27a6971e64af0dd4b76568383475584d30fe18e8a0adcc
- MD5 19086e296776b05608cfc0507ab19410
- SHA1 08203a6010ea70a02b526a30aea9f4f5b29f9d01
- SHA512 d99dcfe693533faf6e5c4d0aa08701573d7c7a3faa3a075bed7f39a1ff73b3a8c7056b1dd3a982570fa57b5f26fa31d4f5c73286edc7cfcc857576933cbdd16c
- SSDEEP 1536:1EGh0oUlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oUlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{37793801-D47D-4967-B811-7F6502F62AB4}.exe
- Size 168KB
- SHA256 21e3f0a4d23524d3fda21fff38a542098b000c9e4d4cee076b893c9b71ef13ab
- MD5 88458f3172fbf469d6bfd4f81c334919
- SHA1 0714e6d7d8ad5a79765b130679c57955c226c095
- SHA512 30e944f06175704e325a96cccd144154b0726dff9074b8e5ad797aa2ee89a98e97fc0048bf56296704c99c09feec6bb15453783c28c58add3c3e2cc7acf7fc5b
- SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6CD66B0B-B281-4eba-9A92-9E0C7FB7F6B8}.exe
- Size 168KB
- SHA256 a926486829c962cbece33d7fa514c473f66c94e6365c8fa667e594ab0f623337
- MD5 f76d5782d4e6268a8a7da5a9f74a48b4
- SHA1 e4372df1e26f3b484b9f791bd1e760e8fa8a6a1f
- SHA512 9446783ad4b62113aef3a71f60187084689c9886962602ba6da92905f852cd81aaa7f3edd282d8b06977c07481abe248370f98382c30ea3a5e47e1366212b7f3
- SSDEEP 1536:1EGh0ovlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ovlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{71E82D16-29EC-4a3f-887B-E8F2DE19E2AD}.exe
- Size 168KB
- SHA256 0b480e0e8241e03aba549a8c32d7b9fa5dc1ef789d7af155f2530bc5c18840c2
- MD5 378a3c9e8abb5d7b62a5345ea6d88038
- SHA1 152c157ad39317af8b3eb709bd23dda6c4881a42
- SHA512 c77c559383b36e12ff475878a584ab75b02c339db5ffa3d92f73c2358bd8e9c211086d100ad659b4f513d3db2ca663f06a608e7841816b5930eea569bc00b81e
- SSDEEP 1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8579F67D-62A6-4606-BE4C-E214B62B2A5C}.exe
- Size 168KB
- SHA256 0b548212c63933be0c1f5cc7a2b194b0758a7ab3eefa4d6fa0e198a77e9f4dbc
- MD5 07579ac41d13fd051353e73a72d34c1c
- SHA1 e8b7b06ec1c33ba580ab22f831d41df206b22437
- SHA512 3b136c9f8c5fa707108fb2c281aac42da1e604b68be6660f5e94c2828cb27b61700ef64b7fd53e17c00b3a4d2d00163b8c56c43801240f0ce64bc498fe70f8ea
- SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B877529C-4E67-4d0e-869F-6844170D3726}.exe
- Size 168KB
- SHA256 7b1532b7972c7c9b6df34d5d5d550174fec744a54df9f61b5488e5fe5299f5e4
- MD5 f44441b48ab1e6cd023ae752cdfbd404
- SHA1 59383333af26738669f19b435cfe0cf74dc6faaa
- SHA512 41e7f8d4f8dbdb486640a2339f922eb9664307dfb1c9cbd896ff88f1c61ece2282a74516ee8bda45207440d0d04e13a0214e82bf11bc7b4948feffa1590690a7
- SSDEEP 1536:1EGh0oilq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oilqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B96B5BF7-4278-4c31-B4E7-B1A790622FD3}.exe
- Size 168KB
- SHA256 945987125eed0be8a1068b379144d793a671b60bc04c3eabbc11bd14e934c84c
- MD5 63bc7353c8869c2ef7aea2defd4be86d
- SHA1 577af89cffdcb75f92a171698efc796aeaa9b117
- SHA512 3e0318c5761e0fc36ccf2384996eded153935323fd21a155f4ccce74903722d2d0c8f0f0db0d1745bf2b1d1fd5a63649cbc22523e73caf7a8e7cf291ffe6cd9a
- SSDEEP 1536:1EGh0oHlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oHlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CEDE34B6-FF0D-4663-8C52-26F48DE988D0}.exe
- Size 168KB
- SHA256 481a9e4676d35e30d50c058dce22fd51416bee11598edf40b2e733c6e6a77a45
- MD5 435f981e5ced1b19791fd131359a8cbb
- SHA1 9739390510e43362dec17266e0e5dab8a0c71ac1
- SHA512 ad596036b016e98567334fa8a8581bd86a53bc7aed0b134457bf207fa11cce51111a5b8c780a312da9dc547e36224c1724d6927203bdba1dc6902d00fd0e5384
- SSDEEP 1536:1EGh0o2lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o2lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D4401E9F-630F-4751-BE3C-0A57F1248C2D}.exe
- Size 168KB
- SHA256 4fffff91d143f3db4d3603e776a4ea5524b858005aaa8aa304ef109f82cda6ae
- MD5 29f999f1a71667a8e529454e21181a56
- SHA1 1274dbd9e94b7c503ee9f30b5313e127cd1897d2
- SHA512 a0bd1406181d0dbfb9aec1cf8b33b6a360b6b266ea7ab01a0ae25db8dec07c316de2be8b2b40a8b966279fa5db7ae4d91aa7598529a90d98adb2c8f2d727a852
- SSDEEP 1536:1EGh0oOlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E29E0424-C165-4d28-8D55-07128CFC5409}.exe
- Size 168KB
- SHA256 948f576672846955c999e1928dba20ffc0fa7f24df664c948c4a37edc89b13e0
- MD5 2ac274b87152388c7aeeba6ebd114e36
- SHA1 aa91460a8a767b5071cbae3f5a83eb64a52419a5
- SHA512 c92fa3fe79c85b71bc8a6e6861b74565a8e90ab1ed342dcfdf472ca73e8b6e895018da0df55e3cf2fa82a3c80e2c0e1115dfe0d4248ea1b73ecede1e6c7b114f
- SSDEEP 1536:1EGh0o9lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o9lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe
- Size 65KB
- SHA256 2c93b166f90fa512f29397e77167e64c820e00204a4570fb7814d466c06b4332
- MD5 0a60f6f4e198e8db02fe284edb1342b5
- SHA1 1e2be7b80d613253e2d8457ce58a586415b61041
- SHA512 8e09f6c44d2572c4089dbaa49a4879220c9c7d1f4e2d6bdbafd4398fd249f2dbe4a6ea869e0dbb92d9e969d80ce50a0fe792d91dc587f0872bd6af942c32f7b4
- SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwHh4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroHh4/CFsrd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FE3EE594-3781-4086-B67A-6AE89C54DBA1}.exe
- Size 168KB
- SHA256 16c5dcf030139acf3aa8078493647b9bbffd9958edd4f85ece7c468fda9a3c98
- MD5 4b6c18495657152e401d0c2811cb142f
- SHA1 d0833cac9664c80db63badde9ce0b137a6f8f940
- SHA512 835ddf75c707c269c781b6206da747c70fae940e2e3b7e5646d8057006cddc033582af66db0e49b9e1114c5b3db3e81b0a25c909ad3d2a5b98ef021cc03d6a0c
- SSDEEP 1536:1EGh0oBlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oBlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP