Analysis
- max time kernel
144s - max time network
121s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 12:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe
- Size 408KB
- Sample240404-py3n3agf22
- SHA256 e2f138b2f7b9ae34b9f3211738d94ce064429ca3d1b74dc94924a57696887dbd
- MD5 9773f07c6fef4418e415f616aa6c10b2
- SHA1 28b1c29fe8016e69ab4bc0a7e7be986464180b4d
- SHA512 ae6bba825f5ce89657d9af13c333e9406b5b2c4a6cdc18f1a55c1e6b45100ba91fb3787359c87e833169766a85f28be5cbbd13f175d1b2ce492be02f618071dd
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x00090000000155ed-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c0000000155f7-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000a0000000155ed-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015c6b-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000005a59-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b0000000155ed-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000005a59-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c0000000155ed-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000005a59-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d0000000155ed-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000005a59-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{04A79503-B4BB-4340-8A41-AFE3823785E1}\stubpath = "C:\\Windows\\{04A79503-B4BB-4340-8A41-AFE3823785E1}.exe" {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3787068-01A8-466b-A93F-281AC104D506}\stubpath = "C:\\Windows\\{F3787068-01A8-466b-A93F-281AC104D506}.exe" {04A79503-B4BB-4340-8A41-AFE3823785E1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{095A5EC5-463C-4d80-B496-E0221B1656BE}\stubpath = "C:\\Windows\\{095A5EC5-463C-4d80-B496-E0221B1656BE}.exe" 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974} {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3C92C50-B98A-449e-BDF2-F2672755F303}\stubpath = "C:\\Windows\\{B3C92C50-B98A-449e-BDF2-F2672755F303}.exe" {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}\stubpath = "C:\\Windows\\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe" {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C75C60A2-B22B-4ba9-8F91-A6A48C679396}\stubpath = "C:\\Windows\\{C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe" {F3787068-01A8-466b-A93F-281AC104D506}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76C73D50-878A-4808-BA74-E24BB7033B1A}\stubpath = "C:\\Windows\\{76C73D50-878A-4808-BA74-E24BB7033B1A}.exe" {C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{095A5EC5-463C-4d80-B496-E0221B1656BE} 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31D7E538-BE94-40c3-B39A-527E75AE2B6D}\stubpath = "C:\\Windows\\{31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe" {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF} {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76C73D50-878A-4808-BA74-E24BB7033B1A} {C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97054712-36D7-461e-AD25-A85BD7D554AC} {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{580A9667-299A-476b-86C1-8E4297EFF3B8} {97054712-36D7-461e-AD25-A85BD7D554AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C75C60A2-B22B-4ba9-8F91-A6A48C679396} {F3787068-01A8-466b-A93F-281AC104D506}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974}\stubpath = "C:\\Windows\\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe" {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3C92C50-B98A-449e-BDF2-F2672755F303} {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{04A79503-B4BB-4340-8A41-AFE3823785E1} {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3787068-01A8-466b-A93F-281AC104D506} {04A79503-B4BB-4340-8A41-AFE3823785E1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97054712-36D7-461e-AD25-A85BD7D554AC}\stubpath = "C:\\Windows\\{97054712-36D7-461e-AD25-A85BD7D554AC}.exe" {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{580A9667-299A-476b-86C1-8E4297EFF3B8}\stubpath = "C:\\Windows\\{580A9667-299A-476b-86C1-8E4297EFF3B8}.exe" {97054712-36D7-461e-AD25-A85BD7D554AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31D7E538-BE94-40c3-B39A-527E75AE2B6D} {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe - Deletes itself 1 IoCs
pid Process 848 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 2016 {04A79503-B4BB-4340-8A41-AFE3823785E1}.exe 2452 {F3787068-01A8-466b-A93F-281AC104D506}.exe 1244 {C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe 528 {76C73D50-878A-4808-BA74-E24BB7033B1A}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{B3C92C50-B98A-449e-BDF2-F2672755F303}.exe {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe File created C:\Windows\{04A79503-B4BB-4340-8A41-AFE3823785E1}.exe {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe File created C:\Windows\{F3787068-01A8-466b-A93F-281AC104D506}.exe {04A79503-B4BB-4340-8A41-AFE3823785E1}.exe File created C:\Windows\{76C73D50-878A-4808-BA74-E24BB7033B1A}.exe {C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe File created C:\Windows\{97054712-36D7-461e-AD25-A85BD7D554AC}.exe {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe File created C:\Windows\{31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe File created C:\Windows\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe File created C:\Windows\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe File created C:\Windows\{095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe File created C:\Windows\{580A9667-299A-476b-86C1-8E4297EFF3B8}.exe {97054712-36D7-461e-AD25-A85BD7D554AC}.exe File created C:\Windows\{C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe {F3787068-01A8-466b-A93F-281AC104D506}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe Token: SeIncBasePriorityPrivilege 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe Token: SeIncBasePriorityPrivilege 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe Token: SeIncBasePriorityPrivilege 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe Token: SeIncBasePriorityPrivilege 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe Token: SeIncBasePriorityPrivilege 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe Token: SeIncBasePriorityPrivilege 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe Token: SeIncBasePriorityPrivilege 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe Token: SeIncBasePriorityPrivilege 2016 {04A79503-B4BB-4340-8A41-AFE3823785E1}.exe Token: SeIncBasePriorityPrivilege 2452 {F3787068-01A8-466b-A93F-281AC104D506}.exe Token: SeIncBasePriorityPrivilege 1244 {C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2376 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 28 PID 2244 wrote to memory of 2376 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 28 PID 2244 wrote to memory of 2376 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 28 PID 2244 wrote to memory of 2376 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 28 PID 2244 wrote to memory of 848 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 29 PID 2244 wrote to memory of 848 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 29 PID 2244 wrote to memory of 848 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 29 PID 2244 wrote to memory of 848 2244 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 29 PID 2376 wrote to memory of 2596 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 30 PID 2376 wrote to memory of 2596 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 30 PID 2376 wrote to memory of 2596 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 30 PID 2376 wrote to memory of 2596 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 30 PID 2376 wrote to memory of 2760 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 31 PID 2376 wrote to memory of 2760 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 31 PID 2376 wrote to memory of 2760 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 31 PID 2376 wrote to memory of 2760 2376 {095A5EC5-463C-4d80-B496-E0221B1656BE}.exe 31 PID 2596 wrote to memory of 2572 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 32 PID 2596 wrote to memory of 2572 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 32 PID 2596 wrote to memory of 2572 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 32 PID 2596 wrote to memory of 2572 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 32 PID 2596 wrote to memory of 2728 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 33 PID 2596 wrote to memory of 2728 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 33 PID 2596 wrote to memory of 2728 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 33 PID 2596 wrote to memory of 2728 2596 {97054712-36D7-461e-AD25-A85BD7D554AC}.exe 33 PID 2572 wrote to memory of 2088 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 36 PID 2572 wrote to memory of 2088 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 36 PID 2572 wrote to memory of 2088 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 36 PID 2572 wrote to memory of 2088 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 36 PID 2572 wrote to memory of 1924 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 37 PID 2572 wrote to memory of 1924 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 37 PID 2572 wrote to memory of 1924 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 37 PID 2572 wrote to memory of 1924 2572 {580A9667-299A-476b-86C1-8E4297EFF3B8}.exe 37 PID 2088 wrote to memory of 1104 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 38 PID 2088 wrote to memory of 1104 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 38 PID 2088 wrote to memory of 1104 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 38 PID 2088 wrote to memory of 1104 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 38 PID 2088 wrote to memory of 1904 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 39 PID 2088 wrote to memory of 1904 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 39 PID 2088 wrote to memory of 1904 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 39 PID 2088 wrote to memory of 1904 2088 {31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe 39 PID 1104 wrote to memory of 2704 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 40 PID 1104 wrote to memory of 2704 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 40 PID 1104 wrote to memory of 2704 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 40 PID 1104 wrote to memory of 2704 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 40 PID 1104 wrote to memory of 1636 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 41 PID 1104 wrote to memory of 1636 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 41 PID 1104 wrote to memory of 1636 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 41 PID 1104 wrote to memory of 1636 1104 {D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe 41 PID 2704 wrote to memory of 876 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 42 PID 2704 wrote to memory of 876 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 42 PID 2704 wrote to memory of 876 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 42 PID 2704 wrote to memory of 876 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 42 PID 2704 wrote to memory of 1408 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 43 PID 2704 wrote to memory of 1408 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 43 PID 2704 wrote to memory of 1408 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 43 PID 2704 wrote to memory of 1408 2704 {3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe 43 PID 876 wrote to memory of 2016 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 44 PID 876 wrote to memory of 2016 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 44 PID 876 wrote to memory of 2016 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 44 PID 876 wrote to memory of 2016 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 44 PID 876 wrote to memory of 2852 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 45 PID 876 wrote to memory of 2852 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 45 PID 876 wrote to memory of 2852 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 45 PID 876 wrote to memory of 2852 876 {B3C92C50-B98A-449e-BDF2-F2672755F303}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\{095A5EC5-463C-4d80-B496-E0221B1656BE}.exeC:\Windows\{095A5EC5-463C-4d80-B496-E0221B1656BE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\{97054712-36D7-461e-AD25-A85BD7D554AC}.exeC:\Windows\{97054712-36D7-461e-AD25-A85BD7D554AC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\{580A9667-299A-476b-86C1-8E4297EFF3B8}.exeC:\Windows\{580A9667-299A-476b-86C1-8E4297EFF3B8}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\{31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exeC:\Windows\{31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exeC:\Windows\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exeC:\Windows\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\{B3C92C50-B98A-449e-BDF2-F2672755F303}.exeC:\Windows\{B3C92C50-B98A-449e-BDF2-F2672755F303}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\{04A79503-B4BB-4340-8A41-AFE3823785E1}.exeC:\Windows\{04A79503-B4BB-4340-8A41-AFE3823785E1}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\{F3787068-01A8-466b-A93F-281AC104D506}.exeC:\Windows\{F3787068-01A8-466b-A93F-281AC104D506}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Windows\{C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exeC:\Windows\{C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1244 -
C:\Windows\{76C73D50-878A-4808-BA74-E24BB7033B1A}.exeC:\Windows\{76C73D50-878A-4808-BA74-E24BB7033B1A}.exe12⤵
- Executes dropped EXE
PID:528
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C75C6~1.EXE > nul12⤵PID:860
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3787~1.EXE > nul11⤵PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04A79~1.EXE > nul10⤵PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3C92~1.EXE > nul9⤵PID:2852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B39F~1.EXE > nul8⤵PID:1408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0DE0~1.EXE > nul7⤵PID:1636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31D7E~1.EXE > nul6⤵PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{580A9~1.EXE > nul5⤵PID:1924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97054~1.EXE > nul4⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{095A5~1.EXE > nul3⤵PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{04A79503-B4BB-4340-8A41-AFE3823785E1}.exe
- Size 408KB
- SHA256 faae410b519f0ab7b1cf2ea28f1bf3b6ef44283f9e6fe2384164f2c78de8b6bd
- MD5 b5af7913abde8e752af3f2620da4af00
- SHA1 94013acbecb0d9801bda341f671c299b3f3ba401
- SHA512 cc9541701ddd39206afe2052a184f074394f6b7b19bfece24005fa607c04375cf1623eb89b1dfd69725493fa79e23044f41359602384282fae6bca9783bb021a
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGuldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{095A5EC5-463C-4d80-B496-E0221B1656BE}.exe
- Size 408KB
- SHA256 1034ccb1999b3254be33f9068f9e41089040af576504fd730467d4b50fbf0b61
- MD5 623652cc96b8f3ad5a73178c231c4acd
- SHA1 0f16598efe7ff0ed84dd95e466d3469d604da87a
- SHA512 3cd8135e7d9ef5c10d56efeb0f7f551ccbd10d2bc87d27dad5d9ab7de770ec7dad1c41465cf5fdc57abcf5787de30442ee93dbb4cf48634a789b2032ff7bfc91
- SSDEEP 3072:CEGh0oXl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGNldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{31D7E538-BE94-40c3-B39A-527E75AE2B6D}.exe
- Size 408KB
- SHA256 f71478f080cbb1f1e036b7857f7c25d381d7ab8d9edbddf84fa836f1907f127f
- MD5 280c0ed93bb04ee8a93f74d2346048e1
- SHA1 8ec0181872e9e9e3186a2867c23b5ac1fd77236d
- SHA512 ad6e79c93f20058afe921bc212140d0702e0b3ee065b04fce7b30a5603eefbe981aaec9af827752f3d3ce19d783a697521c65987cad8ed8da4f74b54090a1467
- SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGGldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3B39F8FE-3C20-4ed6-B5C0-471199F3C974}.exe
- Size 408KB
- SHA256 e0953cec5ed4536851a882f333eb88035e06e1854c71ff23807337386146c04d
- MD5 3d997bf7ed98e304912052d5be931f24
- SHA1 776ba59ded02c0b245bed79261ff0ec0e1732a03
- SHA512 26f8b503a0a737442b0f52049ca1c7f5ce3dc7fa9fd2f749a8ac446b544819aeb9807780322c412575aeef48cd734377e58b264e8224289a950520469e26e11b
- SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGoldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{580A9667-299A-476b-86C1-8E4297EFF3B8}.exe
- Size 408KB
- SHA256 48dbea5413987cb4d768dfa6ee90e01095866e6bd2cccea8c4aa6b53d8e25f14
- MD5 e3532c7faf0da4a234aecfb1207599e5
- SHA1 4fafef7b01a0145e26f774bfc5e2eda9bceff675
- SHA512 6909372467df56d296d1973951269ee916de4e0192bba2a32fc5688bbd82fcfabe48b79b602f12e9f3c41072d1bb1f29161d55059c2b84e8ca2a4b2163c6cc84
- SSDEEP 3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG5ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{76C73D50-878A-4808-BA74-E24BB7033B1A}.exe
- Size 408KB
- SHA256 2d2c946ec1a9cbdb4d6e7d9524ec2c4f7ff536ed2c4b020f9977d4b98145abbf
- MD5 1bdc4064371005a32d2e5498be6e2bc1
- SHA1 caa5d3cea9b5d656d96b8d415e310b393909414c
- SHA512 a356cbbc6cda4ddbddacaddc120b0d40237dc55db90ea627d604e886b10f7cc7e52f20b47556df61d1a802f18f132864a8e63d601981e68962c14293e2c4b302
- SSDEEP 3072:CEGh0oVl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{97054712-36D7-461e-AD25-A85BD7D554AC}.exe
- Size 408KB
- SHA256 cb8cfb18cfba59a038fb2045f6186f5f8b47eef25ddf0325a9ad5b81161ed311
- MD5 391c81128a3e9ab758feafc6be0307d7
- SHA1 975e5ec243fba33bdf685f715353188cfe47d9d3
- SHA512 071155697216df0691b7395603b90974e21377610d5560f257498ddb85d33da7290dabc0575c845ef2bfc0205942e3788e061cdc028753b5d6f9240489420f34
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGcldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B3C92C50-B98A-449e-BDF2-F2672755F303}.exe
- Size 408KB
- SHA256 ec1e133f0f1164a5c04039a7538b9c5d4a326f093280657c52d702356b7f689a
- MD5 a1cccc462ea814e2eb91f9e2351b3a59
- SHA1 91fff5aeecbf70a55a0d222e0284256653a77d1e
- SHA512 9408bbe2123a0946344b6b1fca3a7b7f60011e9f436444511e3c6d4d379cc6ea9b0781b9b943073c01f783ec354a3cd2f17a49d3e652fe5a858e3c38117e71b4
- SSDEEP 3072:CEGh0oDl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG5ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C75C60A2-B22B-4ba9-8F91-A6A48C679396}.exe
- Size 408KB
- SHA256 aef47a9fdfd3113a610af3d39fe1fa4c92360e17f0d199d301b6d8cefe237517
- MD5 724b7866618a93f13d337e1b183761e3
- SHA1 f02bfe33ef976a88c3fb7742acc4c7f9ae7d7295
- SHA512 0993d2ed9de93b1b0df03a50b2b62b1df69568efb297985fee2b78e16573befecadd0bb962548b9f36ce9c695ad8661484fa84499fd029b80c300406c83d76f5
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG4ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D0DE0154-5BFA-4506-86E2-D47DDD28D4CF}.exe
- Size 408KB
- SHA256 42ffac6bce42e099ec12783c2b9b18e4a95a4654f6ae126f5097137390f0a36c
- MD5 8569096b647e9843739b1261a7ee6da4
- SHA1 baaefaeb7150e6fe4bf379a4bf8dcca304025dfc
- SHA512 5d45166de92e9446278833946886f3f9715217cd66c97cee67dfa509c69c8cef17f3725659a1287e5c0417cc493cab1af73497807620e0baf8b02557f3db74ae
- SSDEEP 3072:CEGh0opl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGTldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F3787068-01A8-466b-A93F-281AC104D506}.exe
- Size 408KB
- SHA256 81629222c45c95986c081993eaa1764109cc2d4461757de7b81181eeb0db2408
- MD5 329fe76420f1d70044cf77d177ba382d
- SHA1 0b925012def78baa50ccd9982bf204846787a272
- SHA512 f8d17bbd511d9da69c37ca51d601d84fa991755c753cada2b152f0f99c962fbcb7d91ce29444756368740efe7b2046af416e3735acfa4e51b6e0c27a2e643cf6
- SSDEEP 3072:CEGh0odl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGvldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP