Analysis
- max time kernel
144s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 12:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe
- Size 380KB
- Sample240404-py7m1sgf25
- SHA256 7f8511d46497f4fec008aaf040184a53750ea8ad44458361e8b59f5c22b4726c
- MD5 98420a65ac6e602d5f355a93071817c6
- SHA1 77086bd51477eb8e20bad7cdf241b783eb4964c9
- SHA512 b2cdc725e986bd8aa6e827650a0cfd1db85885c1b9f30d03fb92030d0bb74f096085936bbbc7f743b208d5b62b2207e4778fa5bf411f8353bd5a0cffa6cf14b5
- SSDEEP 3072:mEGh0ojlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGll7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 10 IoCs
resource yara_rule behavioral1/files/0x0009000000016d24-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000016d84-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000016d89-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000700000001704f-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000017090-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000800000001704f-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x00020000000180e5-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000500000001868c-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x00030000000180e5-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000600000001868c-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D94D283D-9CFE-4d64-86AE-6ACE540074AE}\stubpath = "C:\\Windows\\{D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe" {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{426C282A-5B41-487e-8EBD-584A7F245C53}\stubpath = "C:\\Windows\\{426C282A-5B41-487e-8EBD-584A7F245C53}.exe" {B06542D2-9887-4e1c-B258-352ABC78F095}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B} {34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}\stubpath = "C:\\Windows\\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe" {34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39DC2FAB-30C3-4f20-A32C-976BDACC2470}\stubpath = "C:\\Windows\\{39DC2FAB-30C3-4f20-A32C-976BDACC2470}.exe" {A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3DBBB8B-11E2-4c85-8961-9AA794C63302} 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B06542D2-9887-4e1c-B258-352ABC78F095} {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B06542D2-9887-4e1c-B258-352ABC78F095}\stubpath = "C:\\Windows\\{B06542D2-9887-4e1c-B258-352ABC78F095}.exe" {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34E9556F-5D59-4dca-A97F-63E00C9F5388} {426C282A-5B41-487e-8EBD-584A7F245C53}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34E9556F-5D59-4dca-A97F-63E00C9F5388}\stubpath = "C:\\Windows\\{34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe" {426C282A-5B41-487e-8EBD-584A7F245C53}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3DBBB8B-11E2-4c85-8961-9AA794C63302}\stubpath = "C:\\Windows\\{D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe" 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5}\stubpath = "C:\\Windows\\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe" {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D94D283D-9CFE-4d64-86AE-6ACE540074AE} {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{426C282A-5B41-487e-8EBD-584A7F245C53} {B06542D2-9887-4e1c-B258-352ABC78F095}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39DC2FAB-30C3-4f20-A32C-976BDACC2470} {A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5} {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F8010B4-987C-4135-8D36-F66473034F1A} {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F8010B4-987C-4135-8D36-F66473034F1A}\stubpath = "C:\\Windows\\{4F8010B4-987C-4135-8D36-F66473034F1A}.exe" {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495B5348-4B70-4b18-8D68-934960BFC9F9} {4F8010B4-987C-4135-8D36-F66473034F1A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495B5348-4B70-4b18-8D68-934960BFC9F9}\stubpath = "C:\\Windows\\{495B5348-4B70-4b18-8D68-934960BFC9F9}.exe" {4F8010B4-987C-4135-8D36-F66473034F1A}.exe - Deletes itself 1 IoCs
pid Process 1636 cmd.exe - Executes dropped EXE 10 IoCs
pid Process 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 2860 {34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe 1624 {A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe 3008 {39DC2FAB-30C3-4f20-A32C-976BDACC2470}.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\{495B5348-4B70-4b18-8D68-934960BFC9F9}.exe {4F8010B4-987C-4135-8D36-F66473034F1A}.exe File created C:\Windows\{D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe File created C:\Windows\{B06542D2-9887-4e1c-B258-352ABC78F095}.exe {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe File created C:\Windows\{39DC2FAB-30C3-4f20-A32C-976BDACC2470}.exe {A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe File created C:\Windows\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe File created C:\Windows\{4F8010B4-987C-4135-8D36-F66473034F1A}.exe {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe File created C:\Windows\{426C282A-5B41-487e-8EBD-584A7F245C53}.exe {B06542D2-9887-4e1c-B258-352ABC78F095}.exe File created C:\Windows\{34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe {426C282A-5B41-487e-8EBD-584A7F245C53}.exe File created C:\Windows\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe {34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe File created C:\Windows\{D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe Token: SeIncBasePriorityPrivilege 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe Token: SeIncBasePriorityPrivilege 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe Token: SeIncBasePriorityPrivilege 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe Token: SeIncBasePriorityPrivilege 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe Token: SeIncBasePriorityPrivilege 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe Token: SeIncBasePriorityPrivilege 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe Token: SeIncBasePriorityPrivilege 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe Token: SeIncBasePriorityPrivilege 2860 {34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe Token: SeIncBasePriorityPrivilege 1624 {A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1316 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 30 PID 2336 wrote to memory of 1316 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 30 PID 2336 wrote to memory of 1316 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 30 PID 2336 wrote to memory of 1316 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 30 PID 2336 wrote to memory of 1636 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 31 PID 2336 wrote to memory of 1636 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 31 PID 2336 wrote to memory of 1636 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 31 PID 2336 wrote to memory of 1636 2336 2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe 31 PID 1316 wrote to memory of 2324 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 32 PID 1316 wrote to memory of 2324 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 32 PID 1316 wrote to memory of 2324 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 32 PID 1316 wrote to memory of 2324 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 32 PID 1316 wrote to memory of 1992 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 33 PID 1316 wrote to memory of 1992 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 33 PID 1316 wrote to memory of 1992 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 33 PID 1316 wrote to memory of 1992 1316 {D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe 33 PID 2324 wrote to memory of 572 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 34 PID 2324 wrote to memory of 572 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 34 PID 2324 wrote to memory of 572 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 34 PID 2324 wrote to memory of 572 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 34 PID 2324 wrote to memory of 464 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 35 PID 2324 wrote to memory of 464 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 35 PID 2324 wrote to memory of 464 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 35 PID 2324 wrote to memory of 464 2324 {5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe 35 PID 572 wrote to memory of 1752 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 36 PID 572 wrote to memory of 1752 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 36 PID 572 wrote to memory of 1752 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 36 PID 572 wrote to memory of 1752 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 36 PID 572 wrote to memory of 2412 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 37 PID 572 wrote to memory of 2412 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 37 PID 572 wrote to memory of 2412 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 37 PID 572 wrote to memory of 2412 572 {4F8010B4-987C-4135-8D36-F66473034F1A}.exe 37 PID 1752 wrote to memory of 920 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 38 PID 1752 wrote to memory of 920 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 38 PID 1752 wrote to memory of 920 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 38 PID 1752 wrote to memory of 920 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 38 PID 1752 wrote to memory of 2772 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 39 PID 1752 wrote to memory of 2772 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 39 PID 1752 wrote to memory of 2772 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 39 PID 1752 wrote to memory of 2772 1752 {495B5348-4B70-4b18-8D68-934960BFC9F9}.exe 39 PID 920 wrote to memory of 1332 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 40 PID 920 wrote to memory of 1332 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 40 PID 920 wrote to memory of 1332 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 40 PID 920 wrote to memory of 1332 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 40 PID 920 wrote to memory of 2868 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 41 PID 920 wrote to memory of 2868 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 41 PID 920 wrote to memory of 2868 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 41 PID 920 wrote to memory of 2868 920 {D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe 41 PID 1332 wrote to memory of 2548 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 42 PID 1332 wrote to memory of 2548 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 42 PID 1332 wrote to memory of 2548 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 42 PID 1332 wrote to memory of 2548 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 42 PID 1332 wrote to memory of 2636 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 43 PID 1332 wrote to memory of 2636 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 43 PID 1332 wrote to memory of 2636 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 43 PID 1332 wrote to memory of 2636 1332 {B06542D2-9887-4e1c-B258-352ABC78F095}.exe 43 PID 2548 wrote to memory of 2860 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 44 PID 2548 wrote to memory of 2860 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 44 PID 2548 wrote to memory of 2860 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 44 PID 2548 wrote to memory of 2860 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 44 PID 2548 wrote to memory of 2620 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 45 PID 2548 wrote to memory of 2620 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 45 PID 2548 wrote to memory of 2620 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 45 PID 2548 wrote to memory of 2620 2548 {426C282A-5B41-487e-8EBD-584A7F245C53}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_98420a65ac6e602d5f355a93071817c6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\{D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exeC:\Windows\{D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exeC:\Windows\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\{4F8010B4-987C-4135-8D36-F66473034F1A}.exeC:\Windows\{4F8010B4-987C-4135-8D36-F66473034F1A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\{495B5348-4B70-4b18-8D68-934960BFC9F9}.exeC:\Windows\{495B5348-4B70-4b18-8D68-934960BFC9F9}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\{D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exeC:\Windows\{D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\{B06542D2-9887-4e1c-B258-352ABC78F095}.exeC:\Windows\{B06542D2-9887-4e1c-B258-352ABC78F095}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\{426C282A-5B41-487e-8EBD-584A7F245C53}.exeC:\Windows\{426C282A-5B41-487e-8EBD-584A7F245C53}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\{34E9556F-5D59-4dca-A97F-63E00C9F5388}.exeC:\Windows\{34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Windows\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exeC:\Windows\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Windows\{39DC2FAB-30C3-4f20-A32C-976BDACC2470}.exeC:\Windows\{39DC2FAB-30C3-4f20-A32C-976BDACC2470}.exe11⤵
- Executes dropped EXE
PID:3008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0495~1.EXE > nul11⤵PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34E95~1.EXE > nul10⤵PID:2944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{426C2~1.EXE > nul9⤵PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0654~1.EXE > nul8⤵PID:2636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D94D2~1.EXE > nul7⤵PID:2868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{495B5~1.EXE > nul6⤵PID:2772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F801~1.EXE > nul5⤵PID:2412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F864~1.EXE > nul4⤵PID:464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3DBB~1.EXE > nul3⤵PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{34E9556F-5D59-4dca-A97F-63E00C9F5388}.exe
- Size 380KB
- SHA256 452fd313484db2665467b1fe9ec2ab3367a1defe7da3083ac0fbb322d7d8e28b
- MD5 77a1c729b8b12915a286d9554d5603ee
- SHA1 03cc693e7fa5a6f58eeeec9d372a49c95b222452
- SHA512 6021deb5f5eb00f735fcc846f51b96a2f617a829e97eb337be6c7f35b5491f65f09e4046b2772221e4cf210326dfd61376156dcab1cc1c698ae5d76faf5a903a
- SSDEEP 3072:mEGh0oDlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG9l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{39DC2FAB-30C3-4f20-A32C-976BDACC2470}.exe
- Size 380KB
- SHA256 23856e7e11e6c363c5f7ca0b527dec298d667f8af7efb5ef2d7447dc2c30f134
- MD5 be183144eb5f2623e169d06563980e27
- SHA1 ebca2723e4ff8a7f0ee89394d11becb00b1b311b
- SHA512 3c702cd063676edd4ac2ef8320080acfb9904f768121d79c214b9d8ba96260d624739a34d7a806a077b3d18991097b848822a1e478d61d4ccf26b0d0fe727781
- SSDEEP 3072:mEGh0o6lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGwl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{426C282A-5B41-487e-8EBD-584A7F245C53}.exe
- Size 380KB
- SHA256 ed9214d292e0dd28ecf77626334ca02301da3215a1dfbee762d15871ea55f033
- MD5 c9acdaec8fa6ddf29f9a1f8b1c50e2e5
- SHA1 144e768703499faee7ceb2d0b6117b965980fabd
- SHA512 f60c09390f0781e871090ed4adc51f38e9fdb934c69ec3990a7a179e9218332b9ffe94ea4317bbfd7e80cd641c02959fbdeb40685852fd46bf2cdf2452152926
- SSDEEP 3072:mEGh0oulPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGIl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{495B5348-4B70-4b18-8D68-934960BFC9F9}.exe
- Size 380KB
- SHA256 2d01a6adeccb328561b43d357e2145f189b84ac98770f2e2b404cb71cf8dded9
- MD5 7fec114ff7415e7e73d9fd8b678e3063
- SHA1 a1718daed8064b36210704c677b9a64becb91cb8
- SHA512 7548d3edb3f28b2c1c192ac09a5871d1409d43b5f70ba69c44e06558831158420c8513cb3f7b8a6569b0a91c20a8a24a055d7816dd83199e1714c39ce4b449b5
- SSDEEP 3072:mEGh0oolPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGel7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4F8010B4-987C-4135-8D36-F66473034F1A}.exe
- Size 380KB
- SHA256 fe377acaed22d26df5d5b2329810080e0616919c2edd482b9215be7baf9e9e3a
- MD5 42403384a42d9470a8564fad75ad49bf
- SHA1 7901fa5413df7978e4c67e3487a2add0a03dafef
- SHA512 48346da724cf0b11800ee319d5bf27dc09106768c995209a5e59f023df036f89cc43d816e33e03c998b8b1757fa8093f412875ccdabd8c7e5c4875ea94bd4310
- SSDEEP 3072:mEGh0ohlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGXl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5F864659-25E0-4144-9BF7-8CB7AF4B72A5}.exe
- Size 380KB
- SHA256 abb024aa28f2236ec931c866eee0696875385b23363f15ffd552322f6ef410c8
- MD5 4cf2f825661fd766cec40c1fa6cfba81
- SHA1 96c1f6c354138fdec9a95fe73faeffbe8e9866b5
- SHA512 3b049569f294d6a398d73b854071c4d0e11326454f0160f4e65ba06ca4015c7518a54c8f531779c940e578da5af0e82bba182254d97d85af594c12d530a52cf4
- SSDEEP 3072:mEGh0oglPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGel7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A0495C3D-0D1E-4003-9BB0-C9CE4F7DE94B}.exe
- Size 380KB
- SHA256 a08ee2a97b96ce0ccd7cad9fe85ff5aa95ef1748d4dd85ad3db32a3e20ccae8f
- MD5 c4d8e7707e10ba88a804f28839e51b7b
- SHA1 c97190fe423bddba6233cd01d05a7b39c40bfca4
- SHA512 59ae4250b0041412fba078a988e7ddd574532bd6d17d92bc1e75de976a0bb06f6dd09354f3d010797d5bf979f17b83763ef437e6de2840d9e5d350544fd00d99
- SSDEEP 3072:mEGh0oKlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGgl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B06542D2-9887-4e1c-B258-352ABC78F095}.exe
- Size 380KB
- SHA256 fd98ef0e5596c475af9ee75519073a396b63860333ab1d3db66c727fbf0e9e12
- MD5 6d68f4513aa32edbd7fff652a4e58856
- SHA1 3cb3e9b6a6d1d44359abe3a2e009a197ca464932
- SHA512 b8ce70a78782e97c3f021f1d9d5b9e5aff3e907269b71aa8ab56101ab5122077b5332ef0322275e06c62448901c4f2822510f2b116317ac121fe681121b78462
- SSDEEP 3072:mEGh0o4lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGel7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D3DBBB8B-11E2-4c85-8961-9AA794C63302}.exe
- Size 380KB
- SHA256 2da8d29f4ba6629e8b41223f422ab6c708bfd4c56485219d244ca1c7072af3ce
- MD5 f1e1d71c40e473d63e46d8da00bd81f3
- SHA1 6e16847c0e3f6185c0983d56f768c10d9d459aa1
- SHA512 ae63a44f757327f3624f869ffe5ae1d1685ca911767aed04ca3fb8bbf9546b4168a497dd6bab1f7f595a7c07287556e0e44774813138bf535473e65ba0db5d44
- SSDEEP 3072:mEGh0oOlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D94D283D-9CFE-4d64-86AE-6ACE540074AE}.exe
- Size 380KB
- SHA256 722cc4ca96d6753c07074b533fa1f41de8e69062b5cd056d986ebaedf84b444a
- MD5 7c593a910c47316e27302e583dc7f34b
- SHA1 b18882de9f74e157e69573c8c525b9474fa6f472
- SHA512 5dc2da9b080ec52313ddd6a4c32ca888ad57967c3a6c3faf9c5ec4e7bf827412c79f6c38196cf27b02b111815e67d1944576080734b0458ec0e1ebc95fc43404
- SSDEEP 3072:mEGh0oIlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG6l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP