Analysis
- max time kernel
144s - max time network
124s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 23:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe
- Size 408KB
- Sample240404-3gf1maec24
- SHA256 0584d487ec03b812d5ad2db8435ed70b92fdf64e009ad91bdb6dfc6712fd1dba
- MD5 3d7cbf5790c8cedb0005de3fde2909d1
- SHA1 afff39cb3b619e208cecbe9709cb616e07374d1f
- SHA512 573512649d7612784eba6f4753d516842d70d9ec9da5886ab2cdf5892260e2a244759daadc227e760edea2347cc9b9163b158543a7a72a7e26f46f68f0c32240
- SSDEEP 3072:CEGh0oZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000c000000012240-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0024000000015c23-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f00000000f680-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015c52-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000015c69-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000015c7c-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015c69-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015c7c-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000015c87-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015c7c-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015d88-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B05BE8B8-49CD-497e-BD13-313B6B5DF975} {1099C677-FC09-4002-B750-F2E59854869C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D2A537FA-C491-41bb-B6E8-4D100015FEDC}\stubpath = "C:\\Windows\\{D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe" {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61523938-0325-4d97-B3B3-6CD3D7ED3F64}\stubpath = "C:\\Windows\\{61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe" {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D2A537FA-C491-41bb-B6E8-4D100015FEDC} {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AEAB936C-B25A-4166-B235-2277D9A980A3} {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0} {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC}\stubpath = "C:\\Windows\\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe" {17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4} 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}\stubpath = "C:\\Windows\\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe" 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1099C677-FC09-4002-B750-F2E59854869C} {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61523938-0325-4d97-B3B3-6CD3D7ED3F64} {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AEAB936C-B25A-4166-B235-2277D9A980A3}\stubpath = "C:\\Windows\\{AEAB936C-B25A-4166-B235-2277D9A980A3}.exe" {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC} {17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{402D41F1-4354-4509-91F4-9BB08B3F2D43} {C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{402D41F1-4354-4509-91F4-9BB08B3F2D43}\stubpath = "C:\\Windows\\{402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe" {C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B05BE8B8-49CD-497e-BD13-313B6B5DF975}\stubpath = "C:\\Windows\\{B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe" {1099C677-FC09-4002-B750-F2E59854869C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87} {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}\stubpath = "C:\\Windows\\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe" {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D744260-3E9E-4b01-A4EF-B53C34DAB021} {402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D744260-3E9E-4b01-A4EF-B53C34DAB021}\stubpath = "C:\\Windows\\{5D744260-3E9E-4b01-A4EF-B53C34DAB021}.exe" {402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1099C677-FC09-4002-B750-F2E59854869C}\stubpath = "C:\\Windows\\{1099C677-FC09-4002-B750-F2E59854869C}.exe" {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}\stubpath = "C:\\Windows\\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe" {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe - Deletes itself 1 IoCs
pid Process 2488 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 1296 {17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe 2212 {C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe 2728 {402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe 792 {5D744260-3E9E-4b01-A4EF-B53C34DAB021}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe File created C:\Windows\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe {17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe File created C:\Windows\{402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe {C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe File created C:\Windows\{5D744260-3E9E-4b01-A4EF-B53C34DAB021}.exe {402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe File created C:\Windows\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe File created C:\Windows\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe File created C:\Windows\{61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe File created C:\Windows\{D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe File created C:\Windows\{1099C677-FC09-4002-B750-F2E59854869C}.exe {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe File created C:\Windows\{B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe {1099C677-FC09-4002-B750-F2E59854869C}.exe File created C:\Windows\{AEAB936C-B25A-4166-B235-2277D9A980A3}.exe {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe Token: SeIncBasePriorityPrivilege 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe Token: SeIncBasePriorityPrivilege 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe Token: SeIncBasePriorityPrivilege 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe Token: SeIncBasePriorityPrivilege 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe Token: SeIncBasePriorityPrivilege 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe Token: SeIncBasePriorityPrivilege 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe Token: SeIncBasePriorityPrivilege 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe Token: SeIncBasePriorityPrivilege 1296 {17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe Token: SeIncBasePriorityPrivilege 2212 {C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe Token: SeIncBasePriorityPrivilege 2728 {402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1396 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 28 PID 1368 wrote to memory of 1396 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 28 PID 1368 wrote to memory of 1396 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 28 PID 1368 wrote to memory of 1396 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 28 PID 1368 wrote to memory of 2488 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 29 PID 1368 wrote to memory of 2488 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 29 PID 1368 wrote to memory of 2488 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 29 PID 1368 wrote to memory of 2488 1368 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 29 PID 1396 wrote to memory of 2120 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 32 PID 1396 wrote to memory of 2120 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 32 PID 1396 wrote to memory of 2120 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 32 PID 1396 wrote to memory of 2120 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 32 PID 1396 wrote to memory of 2424 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 33 PID 1396 wrote to memory of 2424 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 33 PID 1396 wrote to memory of 2424 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 33 PID 1396 wrote to memory of 2424 1396 {097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe 33 PID 2120 wrote to memory of 2408 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 34 PID 2120 wrote to memory of 2408 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 34 PID 2120 wrote to memory of 2408 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 34 PID 2120 wrote to memory of 2408 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 34 PID 2120 wrote to memory of 2468 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 35 PID 2120 wrote to memory of 2468 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 35 PID 2120 wrote to memory of 2468 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 35 PID 2120 wrote to memory of 2468 2120 {1099C677-FC09-4002-B750-F2E59854869C}.exe 35 PID 2408 wrote to memory of 1972 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 36 PID 2408 wrote to memory of 1972 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 36 PID 2408 wrote to memory of 1972 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 36 PID 2408 wrote to memory of 1972 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 36 PID 2408 wrote to memory of 1492 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 37 PID 2408 wrote to memory of 1492 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 37 PID 2408 wrote to memory of 1492 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 37 PID 2408 wrote to memory of 1492 2408 {B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe 37 PID 1972 wrote to memory of 848 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 38 PID 1972 wrote to memory of 848 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 38 PID 1972 wrote to memory of 848 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 38 PID 1972 wrote to memory of 848 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 38 PID 1972 wrote to memory of 840 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 39 PID 1972 wrote to memory of 840 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 39 PID 1972 wrote to memory of 840 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 39 PID 1972 wrote to memory of 840 1972 {3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe 39 PID 848 wrote to memory of 2632 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 40 PID 848 wrote to memory of 2632 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 40 PID 848 wrote to memory of 2632 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 40 PID 848 wrote to memory of 2632 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 40 PID 848 wrote to memory of 2600 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 41 PID 848 wrote to memory of 2600 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 41 PID 848 wrote to memory of 2600 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 41 PID 848 wrote to memory of 2600 848 {61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe 41 PID 2632 wrote to memory of 616 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 42 PID 2632 wrote to memory of 616 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 42 PID 2632 wrote to memory of 616 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 42 PID 2632 wrote to memory of 616 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 42 PID 2632 wrote to memory of 1172 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 43 PID 2632 wrote to memory of 1172 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 43 PID 2632 wrote to memory of 1172 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 43 PID 2632 wrote to memory of 1172 2632 {D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe 43 PID 616 wrote to memory of 1296 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 44 PID 616 wrote to memory of 1296 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 44 PID 616 wrote to memory of 1296 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 44 PID 616 wrote to memory of 1296 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 44 PID 616 wrote to memory of 1100 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 45 PID 616 wrote to memory of 1100 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 45 PID 616 wrote to memory of 1100 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 45 PID 616 wrote to memory of 1100 616 {AEAB936C-B25A-4166-B235-2277D9A980A3}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exeC:\Windows\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\{1099C677-FC09-4002-B750-F2E59854869C}.exeC:\Windows\{1099C677-FC09-4002-B750-F2E59854869C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\{B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exeC:\Windows\{B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exeC:\Windows\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\{61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exeC:\Windows\{61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\{D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exeC:\Windows\{D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\{AEAB936C-B25A-4166-B235-2277D9A980A3}.exeC:\Windows\{AEAB936C-B25A-4166-B235-2277D9A980A3}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exeC:\Windows\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exeC:\Windows\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\{402D41F1-4354-4509-91F4-9BB08B3F2D43}.exeC:\Windows\{402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Windows\{5D744260-3E9E-4b01-A4EF-B53C34DAB021}.exeC:\Windows\{5D744260-3E9E-4b01-A4EF-B53C34DAB021}.exe12⤵
- Executes dropped EXE
PID:792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{402D4~1.EXE > nul12⤵PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C963B~1.EXE > nul11⤵PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17B9A~1.EXE > nul10⤵PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEAB9~1.EXE > nul9⤵PID:1100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2A53~1.EXE > nul8⤵PID:1172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61523~1.EXE > nul7⤵PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CCB1~1.EXE > nul6⤵PID:840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B05BE~1.EXE > nul5⤵PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1099C~1.EXE > nul4⤵PID:2468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{097C7~1.EXE > nul3⤵PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{097C79C5-97BD-43ed-87B1-2F81DFB0B5A4}.exe
- Size 408KB
- SHA256 b9308b36898f33b69601b223358ec5d57afe15be795d6241f8bb90d0216ba3fd
- MD5 430e9f564601eec67fe1046576fe8191
- SHA1 91ed3ba9e9edb5058bfbbb2fcf6172cffbc0d3d2
- SHA512 42b4e87fed634c9f8ffd6ec58fbebf9529a85f73a5dd7204b9b66e0f36dcdaf92cf1bd3f5274fce9f862f30d54771acfe5b681c1756078dae4e512673df55060
- SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGEldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1099C677-FC09-4002-B750-F2E59854869C}.exe
- Size 408KB
- SHA256 1c157b7fb65de68ec5834144e120b23b3f29b749f95cdc246e7c87a56a8274ff
- MD5 8c16953b13286e1bf9abeb349bb4d676
- SHA1 48831ed03fcee1f1599d50cbe0cf172cddbaa495
- SHA512 2dd4a8faa830a6071a329981993c3a72fb44ec9bbe4581a197aa9637b63604555cf1bf5b4f8f04b19ab5bfc68997202d485916ae32db5549d27fb8e170a9812b
- SSDEEP 3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGoldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{17B9A6ED-F2BB-421d-9C8E-C4A0144B5BB0}.exe
- Size 408KB
- SHA256 2e9c770b1988a9092b0e7d6164e0f2057925b02f35f28e2835c8624a6bf57cbe
- MD5 9233cdb3b0a42caea6c43fa5161272ce
- SHA1 72fb6f70c560edd95358fa284114506b2d735d0e
- SHA512 e890ecd4f3d755b71479218fb11cd490af3fd74b0e7f178d67cc104164233adf478069310d3247ae75b54ac4544b0f237972c9216b9795da3be770ffae36dd80
- SSDEEP 3072:CEGh0opl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGjldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3CCB1F96-2F35-4057-9BFC-F0A2F88CBB87}.exe
- Size 408KB
- SHA256 5403b42055d607b8eacfb9444f057993562961ade852f5defe397f3af593a190
- MD5 92e0b2a277eb805733fed1cef1d05ef1
- SHA1 c7153f579de0e15118d7a455c3d79f3809e95bd2
- SHA512 875b2d68f492f1c8d1ac0e161a9c043da5dad04a2bdc79dca808cabcfb04e3df9be9fe9b3992377f5042689dd7ba88318c9ed87046ba37271155bd17c0f2733b
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGIldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{402D41F1-4354-4509-91F4-9BB08B3F2D43}.exe
- Size 408KB
- SHA256 16fe8b565ac4d97a9ddab1552ca2865a67519b3f386f4161bc3e6ca4b026a5bf
- MD5 000bdadfe19638eba51f7c15d6b849bb
- SHA1 cdc6c6c7fff4c1cc495d7a9c7575474e8191b23d
- SHA512 1da5f21e1950d410f171617dff19f4319e84040ce36fc0a71275c5daa68428c4bd94b9a7f02865e66af1821093aa695a32ede29b1c923ec96ebfa32b42bffe63
- SSDEEP 3072:CEGh0o1l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGnldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5D744260-3E9E-4b01-A4EF-B53C34DAB021}.exe
- Size 408KB
- SHA256 85fad0e4f85baecf13b7ee7617d3512ed8e1ad30fb5c037d5a5ec8153e556e21
- MD5 45c6e9213d7c92e2b08164ffdc8c2906
- SHA1 ab45a4e020f444f9015e9340b717145865eb127a
- SHA512 2145ea9c481836c67eb9b3f7e6ec352c402658c3d92e07fb1bd62f1b08597d24ba9eaa9c64263c5ba659fd1bc870f5e8a5e13cdc3a9e1f8240097df5b264f239
- SSDEEP 3072:CEGh0oLl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGxldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{61523938-0325-4d97-B3B3-6CD3D7ED3F64}.exe
- Size 408KB
- SHA256 1ee4cb236d8892ae938ea50147a8607320574a72997563b4c2b83c8cbc790eb6
- MD5 4b56285aec1231510a1295e4f4f1cd9c
- SHA1 eb1c688d93675a186fb3b2d10a2a441fd44b9095
- SHA512 b61e47adf5acd4b85eee336e0d9de4c8f029f775f81fd55f2c73e7bd9b3509b1b9fbc63b76cbbcdbb2b95baa1013d5adb1bc58b6b970f7982ca23bc6ab8500b3
- SSDEEP 3072:CEGh0oil3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGYldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AEAB936C-B25A-4166-B235-2277D9A980A3}.exe
- Size 408KB
- SHA256 9542b22f5e56d145a5eb9b95e0fd36e6e25342f8f2bf6365ece3e82b4215c8f8
- MD5 507e8ab7547dfc16a58ec0831ead2886
- SHA1 c6043b004750b3250f59d79aa09c6e53810eb3b8
- SHA512 cc62c874a088553110276bc41b56a2a36a3ef7d22c975bfef28494a4b3d65856ce85217b54179495c766a748e156ae8b26cd1847a2b86cf2e6b5e76f79081e0d
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGUldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B05BE8B8-49CD-497e-BD13-313B6B5DF975}.exe
- Size 408KB
- SHA256 9891f2c8c188da72fd39f868d4b8158441067f218aa2d48dd760035b8c330058
- MD5 b55dda093fa2f72a2f75bf5ed2dc28c2
- SHA1 514af27594fbc1492635b461e9b88f5d77ea1606
- SHA512 58174cc82f67664cc5f4515ed0d28c79ca8e475c7bd7893956e6664e712164c53019200ff774e287aea13e66dbcae745b475878f2c17880aa51349e6385ed19a
- SSDEEP 3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGOldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C963BFD5-B9AC-4310-9BC9-542EAF9472AC}.exe
- Size 408KB
- SHA256 83dbb5bd4b742a17c69b759b633b90a7b82f9b229bee79c48598bf87d61c7c52
- MD5 14255ea9d677b59aad7549fb4ca42d24
- SHA1 03ab8723967e85247a20bdbde7ca0edcb9032f31
- SHA512 743c499b67350be7316a2ae383495e533945e57e11ee2aab92c86b333ecb9c95a2e350a8dd6e80dee76ef55ae3c6b6cf6100fc4acce831a7193f508b6d9cefc2
- SSDEEP 3072:CEGh0o1l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGXldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D2A537FA-C491-41bb-B6E8-4D100015FEDC}.exe
- Size 408KB
- SHA256 53955ff92c4398017df86b815a6490cf1e2828c30cde42bf09530187c88e3b31
- MD5 0b313f14d02fa7c4aae498078208c10f
- SHA1 19fc9959e8b4748846064b4972e682e16c793e28
- SHA512 1a3c5b0356040e2da493eda40ae6277b0b9f749eb5add9af12e2cb3eb6ab4683b4310769f8fcd4d5a191392a71695319c1c2af626c786e8549708c0b643cf225
- SSDEEP 3072:CEGh0oHl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGxldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP