Analysis
- max time kernel
144s - max time network
118s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 12:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe
- Size 168KB
- Sample240404-ptdjdagc39
- SHA256 ea111e987f05eafdbe28fd42777ed5c29dd9bc692526656257546fa8295d0737
- MD5 5c982ec9af28da155a2ab51d64df4b0c
- SHA1 aea22028fe47ff886c27a4243aa9a37eb83af639
- SHA512 70f12788122a9883f80135911cc9fa6ab3d6d28c0c780b25376be9b1b9034e51de39403d684cdd5292c09eec3635503559b14df7352f3a4e571beb389f30c630
- SSDEEP 1536:1EGh0ovli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ovliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000a00000001220d-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000a0000000126e1-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b00000001220d-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b0000000126e1-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000005a59-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c0000000126e1-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000005a59-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d0000000126e1-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000005a59-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e0000000126e1-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000005a59-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6D601D7A-EB88-418e-901E-306AE2840F23} {C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75130E3F-2CBA-4d14-8936-0287AB7B37B6}\stubpath = "C:\\Windows\\{75130E3F-2CBA-4d14-8936-0287AB7B37B6}.exe" {6D601D7A-EB88-418e-901E-306AE2840F23}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1} 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAE4962A-9C05-4c75-B826-B4A79598733C}\stubpath = "C:\\Windows\\{FAE4962A-9C05-4c75-B826-B4A79598733C}.exe" {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7} {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50D51C42-70FB-49bc-99E8-C68534066171}\stubpath = "C:\\Windows\\{50D51C42-70FB-49bc-99E8-C68534066171}.exe" {D618422F-84F4-4b39-99D1-1E16C696101C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7}\stubpath = "C:\\Windows\\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe" {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{622ED743-C306-4b14-8C67-6516CC895498}\stubpath = "C:\\Windows\\{622ED743-C306-4b14-8C67-6516CC895498}.exe" {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D618422F-84F4-4b39-99D1-1E16C696101C}\stubpath = "C:\\Windows\\{D618422F-84F4-4b39-99D1-1E16C696101C}.exe" {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6D601D7A-EB88-418e-901E-306AE2840F23}\stubpath = "C:\\Windows\\{6D601D7A-EB88-418e-901E-306AE2840F23}.exe" {C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED5AA591-DE92-4866-BDF9-9442C6CE9237}\stubpath = "C:\\Windows\\{ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe" {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6421C45-3F81-44fe-B53A-6EEC68803A33} {622ED743-C306-4b14-8C67-6516CC895498}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D618422F-84F4-4b39-99D1-1E16C696101C} {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{622ED743-C306-4b14-8C67-6516CC895498} {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6421C45-3F81-44fe-B53A-6EEC68803A33}\stubpath = "C:\\Windows\\{E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe" {622ED743-C306-4b14-8C67-6516CC895498}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50D51C42-70FB-49bc-99E8-C68534066171} {D618422F-84F4-4b39-99D1-1E16C696101C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA} {50D51C42-70FB-49bc-99E8-C68534066171}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}\stubpath = "C:\\Windows\\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe" {50D51C42-70FB-49bc-99E8-C68534066171}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}\stubpath = "C:\\Windows\\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe" 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAE4962A-9C05-4c75-B826-B4A79598733C} {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED5AA591-DE92-4866-BDF9-9442C6CE9237} {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75130E3F-2CBA-4d14-8936-0287AB7B37B6} {6D601D7A-EB88-418e-901E-306AE2840F23}.exe - Deletes itself 1 IoCs
pid Process 2532 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 1892 {50D51C42-70FB-49bc-99E8-C68534066171}.exe 2076 {C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe 540 {6D601D7A-EB88-418e-901E-306AE2840F23}.exe 2072 {75130E3F-2CBA-4d14-8936-0287AB7B37B6}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe File created C:\Windows\{ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe File created C:\Windows\{622ED743-C306-4b14-8C67-6516CC895498}.exe {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe File created C:\Windows\{E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe {622ED743-C306-4b14-8C67-6516CC895498}.exe File created C:\Windows\{D618422F-84F4-4b39-99D1-1E16C696101C}.exe {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe File created C:\Windows\{50D51C42-70FB-49bc-99E8-C68534066171}.exe {D618422F-84F4-4b39-99D1-1E16C696101C}.exe File created C:\Windows\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe {50D51C42-70FB-49bc-99E8-C68534066171}.exe File created C:\Windows\{6D601D7A-EB88-418e-901E-306AE2840F23}.exe {C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe File created C:\Windows\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe File created C:\Windows\{FAE4962A-9C05-4c75-B826-B4A79598733C}.exe {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe File created C:\Windows\{75130E3F-2CBA-4d14-8936-0287AB7B37B6}.exe {6D601D7A-EB88-418e-901E-306AE2840F23}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe Token: SeIncBasePriorityPrivilege 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe Token: SeIncBasePriorityPrivilege 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe Token: SeIncBasePriorityPrivilege 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe Token: SeIncBasePriorityPrivilege 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe Token: SeIncBasePriorityPrivilege 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe Token: SeIncBasePriorityPrivilege 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe Token: SeIncBasePriorityPrivilege 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe Token: SeIncBasePriorityPrivilege 1892 {50D51C42-70FB-49bc-99E8-C68534066171}.exe Token: SeIncBasePriorityPrivilege 2076 {C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe Token: SeIncBasePriorityPrivilege 540 {6D601D7A-EB88-418e-901E-306AE2840F23}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2420 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 28 PID 3056 wrote to memory of 2420 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 28 PID 3056 wrote to memory of 2420 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 28 PID 3056 wrote to memory of 2420 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 28 PID 3056 wrote to memory of 2532 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 29 PID 3056 wrote to memory of 2532 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 29 PID 3056 wrote to memory of 2532 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 29 PID 3056 wrote to memory of 2532 3056 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 29 PID 2420 wrote to memory of 2648 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 30 PID 2420 wrote to memory of 2648 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 30 PID 2420 wrote to memory of 2648 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 30 PID 2420 wrote to memory of 2648 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 30 PID 2420 wrote to memory of 2864 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 31 PID 2420 wrote to memory of 2864 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 31 PID 2420 wrote to memory of 2864 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 31 PID 2420 wrote to memory of 2864 2420 {BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe 31 PID 2648 wrote to memory of 3020 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 32 PID 2648 wrote to memory of 3020 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 32 PID 2648 wrote to memory of 3020 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 32 PID 2648 wrote to memory of 3020 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 32 PID 2648 wrote to memory of 2484 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 33 PID 2648 wrote to memory of 2484 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 33 PID 2648 wrote to memory of 2484 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 33 PID 2648 wrote to memory of 2484 2648 {FAE4962A-9C05-4c75-B826-B4A79598733C}.exe 33 PID 3020 wrote to memory of 2560 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 34 PID 3020 wrote to memory of 2560 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 34 PID 3020 wrote to memory of 2560 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 34 PID 3020 wrote to memory of 2560 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 34 PID 3020 wrote to memory of 2444 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 35 PID 3020 wrote to memory of 2444 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 35 PID 3020 wrote to memory of 2444 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 35 PID 3020 wrote to memory of 2444 3020 {1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe 35 PID 2560 wrote to memory of 2736 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 38 PID 2560 wrote to memory of 2736 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 38 PID 2560 wrote to memory of 2736 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 38 PID 2560 wrote to memory of 2736 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 38 PID 2560 wrote to memory of 2924 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 39 PID 2560 wrote to memory of 2924 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 39 PID 2560 wrote to memory of 2924 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 39 PID 2560 wrote to memory of 2924 2560 {ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe 39 PID 2736 wrote to memory of 1328 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 40 PID 2736 wrote to memory of 1328 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 40 PID 2736 wrote to memory of 1328 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 40 PID 2736 wrote to memory of 1328 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 40 PID 2736 wrote to memory of 1272 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 41 PID 2736 wrote to memory of 1272 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 41 PID 2736 wrote to memory of 1272 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 41 PID 2736 wrote to memory of 1272 2736 {622ED743-C306-4b14-8C67-6516CC895498}.exe 41 PID 1328 wrote to memory of 2000 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 42 PID 1328 wrote to memory of 2000 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 42 PID 1328 wrote to memory of 2000 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 42 PID 1328 wrote to memory of 2000 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 42 PID 1328 wrote to memory of 2788 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 43 PID 1328 wrote to memory of 2788 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 43 PID 1328 wrote to memory of 2788 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 43 PID 1328 wrote to memory of 2788 1328 {E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe 43 PID 2000 wrote to memory of 1892 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 44 PID 2000 wrote to memory of 1892 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 44 PID 2000 wrote to memory of 1892 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 44 PID 2000 wrote to memory of 1892 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 44 PID 2000 wrote to memory of 1776 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 45 PID 2000 wrote to memory of 1776 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 45 PID 2000 wrote to memory of 1776 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 45 PID 2000 wrote to memory of 1776 2000 {D618422F-84F4-4b39-99D1-1E16C696101C}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exeC:\Windows\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\{FAE4962A-9C05-4c75-B826-B4A79598733C}.exeC:\Windows\{FAE4962A-9C05-4c75-B826-B4A79598733C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exeC:\Windows\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\{ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exeC:\Windows\{ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\{622ED743-C306-4b14-8C67-6516CC895498}.exeC:\Windows\{622ED743-C306-4b14-8C67-6516CC895498}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\{E6421C45-3F81-44fe-B53A-6EEC68803A33}.exeC:\Windows\{E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\{D618422F-84F4-4b39-99D1-1E16C696101C}.exeC:\Windows\{D618422F-84F4-4b39-99D1-1E16C696101C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\{50D51C42-70FB-49bc-99E8-C68534066171}.exeC:\Windows\{50D51C42-70FB-49bc-99E8-C68534066171}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Windows\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exeC:\Windows\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\{6D601D7A-EB88-418e-901E-306AE2840F23}.exeC:\Windows\{6D601D7A-EB88-418e-901E-306AE2840F23}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Windows\{75130E3F-2CBA-4d14-8936-0287AB7B37B6}.exeC:\Windows\{75130E3F-2CBA-4d14-8936-0287AB7B37B6}.exe12⤵
- Executes dropped EXE
PID:2072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D601~1.EXE > nul12⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4F7E~1.EXE > nul11⤵PID:1216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50D51~1.EXE > nul10⤵PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6184~1.EXE > nul9⤵PID:1776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6421~1.EXE > nul8⤵PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{622ED~1.EXE > nul7⤵PID:1272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED5AA~1.EXE > nul6⤵PID:2924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C4A9~1.EXE > nul5⤵PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAE49~1.EXE > nul4⤵PID:2484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA4E8~1.EXE > nul3⤵PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1C4A996F-5BE0-44ef-AA38-C2855172D7B7}.exe
- Size 168KB
- SHA256 24458d6cd09bd075e4ce3ed85ce31cd001e6b3f1c8ac305c8fad7be229dec5bb
- MD5 9bc190357296b8c92671ebcdf1b80a03
- SHA1 d17a061440051e84bb7ec96a935858277d883ee5
- SHA512 6c0f8923a72b294bdbf9f7e782219dcbc06900705a142411f7fd7d4b16a600c12c59e7d3e5f46f18d72edf2ac0ce877bdbf642612d1d142c810d5f70a6b9be44
- SSDEEP 1536:1EGh0oYli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oYliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{50D51C42-70FB-49bc-99E8-C68534066171}.exe
- Size 168KB
- SHA256 f3092f4ac4e937420bc72d8443cddd3c5ac4be441b9f7cf713d55807567e2b4b
- MD5 94d63153696ef32fde3bc804f5d36319
- SHA1 3d4cba5a4357505cc8fd76c9fdf6a6bf92aff2c3
- SHA512 efab6976048f6da11e74d8406dcaaf4d1f76447124b245695353af60630913baa6722e0ae2fe478b262e9918b15fa7ba8348dca457e0daf9e89f1149c8a0d15e
- SSDEEP 1536:1EGh0oTeli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oqliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{622ED743-C306-4b14-8C67-6516CC895498}.exe
- Size 168KB
- SHA256 a8b5973c15b67e55e7449e90c431c75e83431ae712dfd0ba9b76446b378de201
- MD5 eff91d88892c012ad33a8848ec40ce91
- SHA1 2951ede3dca874fa66207c30dea8f6dab806e180
- SHA512 ff43c08b6eefa01d7a5937dfe1c85de3a4449a1ec97f048dad0b486b784e6a41f58268190f63fac4076b05fefff388c299bc1aa03c8f7f8f637a1cb304f45fd2
- SSDEEP 1536:1EGh0oFli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oFliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6D601D7A-EB88-418e-901E-306AE2840F23}.exe
- Size 168KB
- SHA256 3073e3e9b834e02ba280131899a5c97cdcdc165a9d2c584ca8905d658d59b430
- MD5 417f80d3c6168930e354a49b71c35c36
- SHA1 ecb42ec6a996e711024a617c196cc06b1790cf81
- SHA512 e6c246e06ef6652c9241dad2336ffbf036d53ec107350bd2670c55573b1488f9b20ad5159e91f5937dbfe55b968a372097687142a5e6749fec440f1076468696
- SSDEEP 1536:1EGh0o7li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7liOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{75130E3F-2CBA-4d14-8936-0287AB7B37B6}.exe
- Size 168KB
- SHA256 72d07faf6308ff5eae4b5e2fbaa32a23d4349af7a76962a1d0901ff87b8fc052
- MD5 5191cebca8c8930f6c74b1b0e3eb2600
- SHA1 40a373e5f27b0f5d0a1f5133b00cc648f2de3093
- SHA512 f6d121d6fc4ea65daa10a43d3fe636a446c051ec9fe1e7d9b058b7c01a36e403282fbf914c930fe5f41a57441c2fe9395192c3faa78e58a8903526ae35de15b0
- SSDEEP 1536:1EGh0ogli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ogliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BA4E8438-A065-4d5f-929A-C3EC99EC6BC1}.exe
- Size 168KB
- SHA256 4ff1bafd4a152dab377b00d95b32634953b660ca90a42396d3c2be5dea606641
- MD5 c37c1d768be29bf37698f36d15127b4d
- SHA1 29022c1c681b288293c5e316858e181c0efeccff
- SHA512 c861c10db121b759220a99bb0279c84e2532b286edfcba0e64bacd898fab6a5445e0caa9d3c34c68a799a2c1da789b49110c2acea989c1f42a958c0495522ed3
- SSDEEP 1536:1EGh0ophli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ovliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C4F7E9E4-F51F-4bff-B800-71FAFBB68FEA}.exe
- Size 168KB
- SHA256 99ca68ccec1125f54428b854b710979218df1f0d7d78ad2a53dc1ab6e4532442
- MD5 e91e29c2773ab361542f17fb0884653d
- SHA1 8531237def190c43e2daa9e29162f71abd6baf39
- SHA512 69a58ba7bdfa2101d260aefdab9327d5d08873dc4a8bee8a61061066a10270a4d7a8ccd2af0a1dc9913229757a7fe11082eecb46447ea49fe85977a96440d421
- SSDEEP 1536:1EGh0oEli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oEliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D618422F-84F4-4b39-99D1-1E16C696101C}.exe
- Size 168KB
- SHA256 092b5715862409ec11e3242d65af8ffcb0be02594266a4a827ef70f107e6ba90
- MD5 6fe83a66173f76af65595894c6dbcd4a
- SHA1 096325f635da6c8e2b59f1c1eab746971bfc2fe6
- SHA512 df114abd08adced5a8af384f98fd7bf1f0e10b290ccffa8a1417790f08a1a722d9d3d95833f1f7845b86e9c0f42dbf4c0589980f6bf7104d1bd8504d469f2fa8
- SSDEEP 1536:1EGh0oUli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oUliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E6421C45-3F81-44fe-B53A-6EEC68803A33}.exe
- Size 168KB
- SHA256 52297984923534fb9574f6a250df58d34081df23bc3560fc0e20a32063d7f271
- MD5 00324f4cc35205d9456eb24e92b3276c
- SHA1 d8d0d10ef75a799447095cf1a7f45d8676ef0577
- SHA512 22a7f8b14f5e5a815db1449514deb5dd0f50e8817e7ba050749ccb288c7f8053af1eff9ed7a400c2b68d92319fb44492f19b41ae71360afd981ded4a845e7c2b
- SSDEEP 1536:1EGh0ohli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ED5AA591-DE92-4866-BDF9-9442C6CE9237}.exe
- Size 168KB
- SHA256 00f7de9f832f254036bca5fefc9f2618fdb90fb8189410585d2c0f85f6d0cc32
- MD5 e82d9c2f224cafa52125397a56e7c298
- SHA1 7e8ff1b8943e4a3c09663c32fd08a27ca4501098
- SHA512 b31b39847132326a4de01a7d3b15243585dd0f773e4838727f624489390f5ed3cc77911c36685e5912641addecd91b3d8df87937793a1aa3424480d2d7737de3
- SSDEEP 1536:1EGh0ojli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FAE4962A-9C05-4c75-B826-B4A79598733C}.exe
- Size 168KB
- SHA256 f4bfb1c950bbf11997f6a504c7fd7b0fa8ffec8f2e0326faf45d780167b0d900
- MD5 5aab5172a9ccca382acbe1eb1230e42b
- SHA1 afc63bef56c48cafb7f37ce34493dd213347c0d0
- SHA512 a792413daa9af999165a786f91cbfc063f45e931fcbd6edcb4617644551ab4bd27c1b82d7d6083c0c50a66026bcddddb70b876490a1ed47368df7688a6b64f3d
- SSDEEP 1536:1EGh0ovli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ovliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP