Analysis
- max time kernel
144s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 12:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe
- Size 408KB
- Sample240404-p3llcagg95
- SHA256 ebc8e44bb3436880476194a2717c3474295ada0140b9bbdd7b31da5b15e2b30b
- MD5 cf185452cce4c01ab48d5aef6562e4fa
- SHA1 103b9f8dabe6fc8df7a8ad06f8c48deb10b63537
- SHA512 b2e7a295114e8551e7f5b7a062589880e3be06e0d023e80bdf7d0c5298ef9af260cae3da6ace0e50d3017d979061e38c84a234dd40a60912ffe3c5eae40c633e
- SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b00000001507e-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002f000000016d37-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000300000000b1f3-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000400000000b1f3-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000500000000b1f3-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0030000000016d37-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000600000000b1f3-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0031000000016d37-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}\stubpath = "C:\\Windows\\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe" {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}\stubpath = "C:\\Windows\\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe" {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7616997B-0CD4-497d-B395-89F77A47E918}\stubpath = "C:\\Windows\\{7616997B-0CD4-497d-B395-89F77A47E918}.exe" {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A25915D6-6C17-4a4e-BA66-02280A5CD958}\stubpath = "C:\\Windows\\{A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe" {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F} {E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}\stubpath = "C:\\Windows\\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}.exe" {FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A} {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}\stubpath = "C:\\Windows\\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe" {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{527AE7EE-A50B-4252-A2EE-B67C42566C6B} {7616997B-0CD4-497d-B395-89F77A47E918}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}\stubpath = "C:\\Windows\\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe" {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A25915D6-6C17-4a4e-BA66-02280A5CD958} {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E359A1CA-83BE-4cfc-B45D-013D47A2480E} 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56} {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7616997B-0CD4-497d-B395-89F77A47E918} {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{527AE7EE-A50B-4252-A2EE-B67C42566C6B}\stubpath = "C:\\Windows\\{527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe" {7616997B-0CD4-497d-B395-89F77A47E918}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8} {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}\stubpath = "C:\\Windows\\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe" {A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F} {FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E359A1CA-83BE-4cfc-B45D-013D47A2480E}\stubpath = "C:\\Windows\\{E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe" 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440} {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9} {A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}\stubpath = "C:\\Windows\\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe" {E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe - Deletes itself 1 IoCs
pid Process 2472 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 1344 {A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe 300 {E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe 2264 {FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe 3044 {CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}.exe {FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe File created C:\Windows\{E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe File created C:\Windows\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe File created C:\Windows\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe File created C:\Windows\{527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe {7616997B-0CD4-497d-B395-89F77A47E918}.exe File created C:\Windows\{A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe File created C:\Windows\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe {E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe File created C:\Windows\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe File created C:\Windows\{7616997B-0CD4-497d-B395-89F77A47E918}.exe {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe File created C:\Windows\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe File created C:\Windows\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe {A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe Token: SeIncBasePriorityPrivilege 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe Token: SeIncBasePriorityPrivilege 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe Token: SeIncBasePriorityPrivilege 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe Token: SeIncBasePriorityPrivilege 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe Token: SeIncBasePriorityPrivilege 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe Token: SeIncBasePriorityPrivilege 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe Token: SeIncBasePriorityPrivilege 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe Token: SeIncBasePriorityPrivilege 1344 {A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe Token: SeIncBasePriorityPrivilege 300 {E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe Token: SeIncBasePriorityPrivilege 2264 {FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1212 wrote to memory of 3004 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 28 PID 1212 wrote to memory of 3004 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 28 PID 1212 wrote to memory of 3004 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 28 PID 1212 wrote to memory of 3004 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 28 PID 1212 wrote to memory of 2472 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 29 PID 1212 wrote to memory of 2472 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 29 PID 1212 wrote to memory of 2472 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 29 PID 1212 wrote to memory of 2472 1212 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 29 PID 3004 wrote to memory of 2580 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 30 PID 3004 wrote to memory of 2580 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 30 PID 3004 wrote to memory of 2580 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 30 PID 3004 wrote to memory of 2580 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 30 PID 3004 wrote to memory of 2572 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 31 PID 3004 wrote to memory of 2572 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 31 PID 3004 wrote to memory of 2572 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 31 PID 3004 wrote to memory of 2572 3004 {E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe 31 PID 2580 wrote to memory of 2484 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 34 PID 2580 wrote to memory of 2484 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 34 PID 2580 wrote to memory of 2484 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 34 PID 2580 wrote to memory of 2484 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 34 PID 2580 wrote to memory of 2408 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 35 PID 2580 wrote to memory of 2408 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 35 PID 2580 wrote to memory of 2408 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 35 PID 2580 wrote to memory of 2408 2580 {377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe 35 PID 2484 wrote to memory of 580 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 36 PID 2484 wrote to memory of 580 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 36 PID 2484 wrote to memory of 580 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 36 PID 2484 wrote to memory of 580 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 36 PID 2484 wrote to memory of 768 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 37 PID 2484 wrote to memory of 768 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 37 PID 2484 wrote to memory of 768 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 37 PID 2484 wrote to memory of 768 2484 {C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe 37 PID 580 wrote to memory of 1084 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 38 PID 580 wrote to memory of 1084 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 38 PID 580 wrote to memory of 1084 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 38 PID 580 wrote to memory of 1084 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 38 PID 580 wrote to memory of 2728 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 39 PID 580 wrote to memory of 2728 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 39 PID 580 wrote to memory of 2728 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 39 PID 580 wrote to memory of 2728 580 {E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe 39 PID 1084 wrote to memory of 2972 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 40 PID 1084 wrote to memory of 2972 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 40 PID 1084 wrote to memory of 2972 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 40 PID 1084 wrote to memory of 2972 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 40 PID 1084 wrote to memory of 2280 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 41 PID 1084 wrote to memory of 2280 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 41 PID 1084 wrote to memory of 2280 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 41 PID 1084 wrote to memory of 2280 1084 {7616997B-0CD4-497d-B395-89F77A47E918}.exe 41 PID 2972 wrote to memory of 2424 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 42 PID 2972 wrote to memory of 2424 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 42 PID 2972 wrote to memory of 2424 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 42 PID 2972 wrote to memory of 2424 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 42 PID 2972 wrote to memory of 2152 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 43 PID 2972 wrote to memory of 2152 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 43 PID 2972 wrote to memory of 2152 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 43 PID 2972 wrote to memory of 2152 2972 {527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe 43 PID 2424 wrote to memory of 1344 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 44 PID 2424 wrote to memory of 1344 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 44 PID 2424 wrote to memory of 1344 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 44 PID 2424 wrote to memory of 1344 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 44 PID 2424 wrote to memory of 2676 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 45 PID 2424 wrote to memory of 2676 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 45 PID 2424 wrote to memory of 2676 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 45 PID 2424 wrote to memory of 2676 2424 {0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\{E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exeC:\Windows\{E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exeC:\Windows\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exeC:\Windows\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exeC:\Windows\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\{7616997B-0CD4-497d-B395-89F77A47E918}.exeC:\Windows\{7616997B-0CD4-497d-B395-89F77A47E918}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\{527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exeC:\Windows\{527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exeC:\Windows\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\{A25915D6-6C17-4a4e-BA66-02280A5CD958}.exeC:\Windows\{A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Windows\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exeC:\Windows\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:300 -
C:\Windows\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exeC:\Windows\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Windows\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}.exeC:\Windows\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}.exe12⤵
- Executes dropped EXE
PID:3044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF705~1.EXE > nul12⤵PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9B35~1.EXE > nul11⤵PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2591~1.EXE > nul10⤵PID:1000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D470~1.EXE > nul9⤵PID:2676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{527AE~1.EXE > nul8⤵PID:2152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76169~1.EXE > nul7⤵PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5E8E~1.EXE > nul6⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C85FD~1.EXE > nul5⤵PID:768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{377CA~1.EXE > nul4⤵PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E359A~1.EXE > nul3⤵PID:2572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0D47036A-0BB5-43cd-B3D9-68A6E222BEB8}.exe
- Size 408KB
- SHA256 65602a849734180ef2aee5781c1b76d1659ef12c968ad1647e4f5dc611ffe175
- MD5 72c7fde7f962df2daf56863056736b6c
- SHA1 4779e20483d4fb1c56ed036b75ffe6fe9ec09b84
- SHA512 c9dd353ba8c71d64dcd12db3c70a3e8b7f0af7aa0dd0d767627fb38e61150c259fa15cf2225a6460bc5ec835bf4493fcd84525fba6997b90bc815777ebc65952
- SSDEEP 3072:CEGh0oLl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGBldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{377CA5EB-F5E2-4882-A86D-7DA7404CBA4A}.exe
- Size 408KB
- SHA256 7dcb6d4116e7cf5e6a79f96455c1b640849134d5f172b2afa6f929e7a3b6eaf8
- MD5 31da22c68a433e2ac2fd3afb7c33e085
- SHA1 2bfd12312e4599907cdac3292f7dcd5ee5941214
- SHA512 8fbc49225f6b3e5b09b064c94a3d7d7c26b30c5d153901e6208123d2a1d9db44ad05f8bf7f8068c9a858b62397c4486fa2ab3fb9ea34d4a02dc7913dcaad962a
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGgldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{527AE7EE-A50B-4252-A2EE-B67C42566C6B}.exe
- Size 408KB
- SHA256 0ce3873d127ed3822a1a79bf86e68d174cf87fc3477b337f479fe78e059df9e7
- MD5 dea50fbbc2ad6524833ff2a7ca9e752b
- SHA1 f90695614154bb367f6bc5b43cad1584339b804b
- SHA512 a58d746c74af73212e596c2cefd98b067680a1d5385756c36cbb45e53387435cf503d6e3d62d8c8b37ae4225fb916a3279b3b3b57681b28a7a877738c1e9e372
- SSDEEP 3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGhldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7616997B-0CD4-497d-B395-89F77A47E918}.exe
- Size 408KB
- SHA256 307a0a9da59ed37b94055c85e5a074d83e1e3ccb224994d3ffff39deb7186405
- MD5 f8a016cd85f95b7cb4f8a0eaffc7eb8e
- SHA1 f4b809f5136d6763db3858f0cc4742e86e3c0e3c
- SHA512 7aeafcfc21f0adbbeea61733869e531a886850c1c61b309c53be7c1874a5b4b8f96bf24545e0a1a5a539788a078482c0b23e844c029e70c6cdde7aa149d52385
- SSDEEP 3072:CEGh0oTl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGtldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A25915D6-6C17-4a4e-BA66-02280A5CD958}.exe
- Size 408KB
- SHA256 b569bd8e536d51c3f5412f1d92782bbb3a3ecdd97b7ff14f3623268315554f65
- MD5 cdf93d71671495bd46e919bcc052fe5e
- SHA1 0dd468a589f784eb1f2d2b691eba88f694d41b6d
- SHA512 3e347ca68cb18ba8f1210ea141f1adf29d50de54b61d6e2e4f18e785ae2c9cb85d38f36a1085b3ef19128842fdbc7e987b264f09f192e28aaf53b5aeede2f653
- SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGqldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C85FD7BD-5A3F-4f6d-A5B7-881DAAC03440}.exe
- Size 408KB
- SHA256 fc2ca85d549ca6912072e673dec2edcea350e1e6a330f2a12b4ae30499822abc
- MD5 9818fec943f0046395a6901cc8eb5d8b
- SHA1 09d0d4a40b0deb95177f00f5a4077a49fb2ab2ce
- SHA512 6806b601347b8e957b1055c74d7b2f16c2b3a5b2833eb3a9f553b5709b8c123b51170cab2fae9bd4d204915836ff4e163f55247befe50e8a57fabdd6754511f2
- SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CDEBE02D-F669-4b4e-BAAA-4C7549D5452F}.exe
- Size 408KB
- SHA256 03c0a7994b99c58745aff260766212acf4b380261666a2a444572c057152a0e7
- MD5 37e957dfa25152b87b08c6cdf075f885
- SHA1 2576387530fd33dc924c2bc7a0bbd0321f17fb26
- SHA512 c3bee29d51efbd0ba9cb84144788e5e1ece9bdcc3c1cd21f50a2ad115b498326362a7c2e35e33675ad07ad45e8973cca7686aa8be43364c18d5e626a6e9c0c2f
- SSDEEP 3072:CEGh0o8l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGyldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E359A1CA-83BE-4cfc-B45D-013D47A2480E}.exe
- Size 408KB
- SHA256 65f0117bf1a3217286119f8599fc5630db9b8a9a971d3dcb403ac43c9bcb8a72
- MD5 7c081db9d6c18c4a777c611435d64def
- SHA1 bd1c2584c2fc5f5563f994f731071596b2dcb703
- SHA512 fd34701b61da46c292f2646cb7d2ef6ec95c5dc7ade8403e2bad4044fb6c17799e2b3c91ae6c1fba1855e3a9816a1fcbac38028290975afd1fcd24266a939108
- SSDEEP 3072:CEGh0oQl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGildOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E5E8E7E4-82BF-49b8-9EE6-EB44D9747F56}.exe
- Size 408KB
- SHA256 8a4aeb2e6f7f52f3a31cb846013322cf4dbec2d3393e77d8cf011ca0b5e555f9
- MD5 8513642b3a744b0825a60a00f7f12d18
- SHA1 fd1f0144a00ffd4aa7482bab1110c18c363d073a
- SHA512 086c1ed77a77de9ab0ef517fdeb25d81c27345d3ddcbb75eacdfc6746bf5516cfbee71085e99adf826780a119238f00bea8f56636e0f67cb5c91131d832611e8
- SSDEEP 3072:CEGh0ovl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGBldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E9B35C1A-DF6E-414c-BB65-E0EDEE4B73F9}.exe
- Size 408KB
- SHA256 036d2cb5fe07d303f1f5e6b60f615672d0e9ff52466b13469291bc81a5406cb6
- MD5 1f76e82c82e9dafc6d5bf3951ddbebf9
- SHA1 59a1d2253e22bbfc00bb624a40d76edcd69bb1fa
- SHA512 16f54e82e3abe5b1acd90c62a791cedb7e24d4ddc9f3044cb8e25d84f03f1003a40fd514f9cd19df07d1ab00a2e1c8d45760e7129a442cca8f6eef404791b9f3
- SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FF7052B0-05D7-4e87-8FB4-B4BC90CE028F}.exe
- Size 408KB
- SHA256 079970c5bd151f4bfddfc790a9eb6c4471bd973f78ab651630d2dc4d3a331f1f
- MD5 5a1adf1cb41c4afa3f365dcc768fd88f
- SHA1 e8b0aecf50ee8ed1f1eb1d10570469ec292962c3
- SHA512 c4fedc0cc5f5d399737cf555a1ebbbccf6d16d1656624cf81bc7cc757137ae6d305194334f92e43c2754d40a9e6738108c4235e9e9793635d4b230deff51fde6
- SSDEEP 3072:CEGh0o8l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGeldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP