Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 13:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe
Resource
win7-20240319-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe
- Size 216KB
- Sample240404-q23c5saa95
- SHA256 83e10e38e07278562137ab66c28b3af293341c606b1387fbaf5bcaa4ccef405c
- MD5 9cad7ffa06deb5f760be99732462d1ed
- SHA1 080d67ade6f3ff5e7bf3138064265a85a752c9c9
- SHA512 62ed27662e7353f401ff2deb8fcebbda157c53e33102e8d19a81bf77e61e80315472996d972da3b685d138e1a95ec35c78cd0ba2289a2e94187047f5fba5e1ad
- SSDEEP 3072:jEGh0oHl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGVlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000023203-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00130000000231f9-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002320a-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00140000000231f9-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021df7-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021df8-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021df7-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072d-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000072d-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000709-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5325622E-760A-4522-85EE-05027074FAE2}\stubpath = "C:\\Windows\\{5325622E-760A-4522-85EE-05027074FAE2}.exe" 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC} {363F1C6D-1930-45df-BE4F-07FB46802604}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}\stubpath = "C:\\Windows\\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe" {363F1C6D-1930-45df-BE4F-07FB46802604}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{140580A6-2FC8-4144-8E38-BB3009F3017F}\stubpath = "C:\\Windows\\{140580A6-2FC8-4144-8E38-BB3009F3017F}.exe" {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A894699-9424-4de0-AEEF-24E984C45545} {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F097E2A-930D-4ced-9F69-69683DAF130D}\stubpath = "C:\\Windows\\{7F097E2A-930D-4ced-9F69-69683DAF130D}.exe" {0A894699-9424-4de0-AEEF-24E984C45545}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3337DA17-73BF-4b80-8257-8BA3172AC10C}\stubpath = "C:\\Windows\\{3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe" {5325622E-760A-4522-85EE-05027074FAE2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA31D768-8E86-4870-94A3-133A0161B685} {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B38056C-C9D2-4dec-B0C2-199E03391375} {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A894699-9424-4de0-AEEF-24E984C45545}\stubpath = "C:\\Windows\\{0A894699-9424-4de0-AEEF-24E984C45545}.exe" {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3337DA17-73BF-4b80-8257-8BA3172AC10C} {5325622E-760A-4522-85EE-05027074FAE2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{363F1C6D-1930-45df-BE4F-07FB46802604}\stubpath = "C:\\Windows\\{363F1C6D-1930-45df-BE4F-07FB46802604}.exe" {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{140580A6-2FC8-4144-8E38-BB3009F3017F} {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B38056C-C9D2-4dec-B0C2-199E03391375}\stubpath = "C:\\Windows\\{8B38056C-C9D2-4dec-B0C2-199E03391375}.exe" {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5325622E-760A-4522-85EE-05027074FAE2} 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{363F1C6D-1930-45df-BE4F-07FB46802604} {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA31D768-8E86-4870-94A3-133A0161B685}\stubpath = "C:\\Windows\\{AA31D768-8E86-4870-94A3-133A0161B685}.exe" {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F653A373-7EF3-4d29-BED7-37CBA6E94A17} {AA31D768-8E86-4870-94A3-133A0161B685}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F653A373-7EF3-4d29-BED7-37CBA6E94A17}\stubpath = "C:\\Windows\\{F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe" {AA31D768-8E86-4870-94A3-133A0161B685}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F097E2A-930D-4ced-9F69-69683DAF130D} {0A894699-9424-4de0-AEEF-24E984C45545}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89} {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}\stubpath = "C:\\Windows\\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe" {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3} {AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}\stubpath = "C:\\Windows\\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}.exe" {AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe - Executes dropped EXE 12 IoCs
pid Process 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 4928 {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe 212 {AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe 1712 {A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe {363F1C6D-1930-45df-BE4F-07FB46802604}.exe File created C:\Windows\{8B38056C-C9D2-4dec-B0C2-199E03391375}.exe {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe File created C:\Windows\{0A894699-9424-4de0-AEEF-24E984C45545}.exe {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe File created C:\Windows\{7F097E2A-930D-4ced-9F69-69683DAF130D}.exe {0A894699-9424-4de0-AEEF-24E984C45545}.exe File created C:\Windows\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe File created C:\Windows\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}.exe {AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe File created C:\Windows\{5325622E-760A-4522-85EE-05027074FAE2}.exe 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe File created C:\Windows\{3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe {5325622E-760A-4522-85EE-05027074FAE2}.exe File created C:\Windows\{363F1C6D-1930-45df-BE4F-07FB46802604}.exe {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe File created C:\Windows\{140580A6-2FC8-4144-8E38-BB3009F3017F}.exe {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe File created C:\Windows\{AA31D768-8E86-4870-94A3-133A0161B685}.exe {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe File created C:\Windows\{F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe {AA31D768-8E86-4870-94A3-133A0161B685}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe Token: SeIncBasePriorityPrivilege 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe Token: SeIncBasePriorityPrivilege 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe Token: SeIncBasePriorityPrivilege 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe Token: SeIncBasePriorityPrivilege 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe Token: SeIncBasePriorityPrivilege 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe Token: SeIncBasePriorityPrivilege 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe Token: SeIncBasePriorityPrivilege 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe Token: SeIncBasePriorityPrivilege 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe Token: SeIncBasePriorityPrivilege 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe Token: SeIncBasePriorityPrivilege 4928 {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe Token: SeIncBasePriorityPrivilege 212 {AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2304 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe 96 PID 2428 wrote to memory of 2304 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe 96 PID 2428 wrote to memory of 2304 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe 96 PID 2428 wrote to memory of 4652 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe 97 PID 2428 wrote to memory of 4652 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe 97 PID 2428 wrote to memory of 4652 2428 2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe 97 PID 2304 wrote to memory of 1908 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 98 PID 2304 wrote to memory of 1908 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 98 PID 2304 wrote to memory of 1908 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 98 PID 2304 wrote to memory of 2928 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 99 PID 2304 wrote to memory of 2928 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 99 PID 2304 wrote to memory of 2928 2304 {5325622E-760A-4522-85EE-05027074FAE2}.exe 99 PID 1908 wrote to memory of 1516 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 101 PID 1908 wrote to memory of 1516 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 101 PID 1908 wrote to memory of 1516 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 101 PID 1908 wrote to memory of 1968 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 102 PID 1908 wrote to memory of 1968 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 102 PID 1908 wrote to memory of 1968 1908 {3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe 102 PID 1516 wrote to memory of 1648 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 103 PID 1516 wrote to memory of 1648 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 103 PID 1516 wrote to memory of 1648 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 103 PID 1516 wrote to memory of 2472 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 104 PID 1516 wrote to memory of 2472 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 104 PID 1516 wrote to memory of 2472 1516 {363F1C6D-1930-45df-BE4F-07FB46802604}.exe 104 PID 1648 wrote to memory of 3384 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 105 PID 1648 wrote to memory of 3384 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 105 PID 1648 wrote to memory of 3384 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 105 PID 1648 wrote to memory of 3008 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 106 PID 1648 wrote to memory of 3008 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 106 PID 1648 wrote to memory of 3008 1648 {12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe 106 PID 3384 wrote to memory of 812 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 107 PID 3384 wrote to memory of 812 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 107 PID 3384 wrote to memory of 812 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 107 PID 3384 wrote to memory of 1380 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 108 PID 3384 wrote to memory of 1380 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 108 PID 3384 wrote to memory of 1380 3384 {140580A6-2FC8-4144-8E38-BB3009F3017F}.exe 108 PID 812 wrote to memory of 4624 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 109 PID 812 wrote to memory of 4624 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 109 PID 812 wrote to memory of 4624 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 109 PID 812 wrote to memory of 2140 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 110 PID 812 wrote to memory of 2140 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 110 PID 812 wrote to memory of 2140 812 {AA31D768-8E86-4870-94A3-133A0161B685}.exe 110 PID 4624 wrote to memory of 1408 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 111 PID 4624 wrote to memory of 1408 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 111 PID 4624 wrote to memory of 1408 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 111 PID 4624 wrote to memory of 4640 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 112 PID 4624 wrote to memory of 4640 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 112 PID 4624 wrote to memory of 4640 4624 {F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe 112 PID 1408 wrote to memory of 4760 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 113 PID 1408 wrote to memory of 4760 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 113 PID 1408 wrote to memory of 4760 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 113 PID 1408 wrote to memory of 3544 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 114 PID 1408 wrote to memory of 3544 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 114 PID 1408 wrote to memory of 3544 1408 {8B38056C-C9D2-4dec-B0C2-199E03391375}.exe 114 PID 4760 wrote to memory of 4928 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 115 PID 4760 wrote to memory of 4928 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 115 PID 4760 wrote to memory of 4928 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 115 PID 4760 wrote to memory of 4124 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 116 PID 4760 wrote to memory of 4124 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 116 PID 4760 wrote to memory of 4124 4760 {0A894699-9424-4de0-AEEF-24E984C45545}.exe 116 PID 4928 wrote to memory of 212 4928 {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe 117 PID 4928 wrote to memory of 212 4928 {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe 117 PID 4928 wrote to memory of 212 4928 {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe 117 PID 4928 wrote to memory of 996 4928 {7F097E2A-930D-4ced-9F69-69683DAF130D}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_9cad7ffa06deb5f760be99732462d1ed_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\{5325622E-760A-4522-85EE-05027074FAE2}.exeC:\Windows\{5325622E-760A-4522-85EE-05027074FAE2}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\{3337DA17-73BF-4b80-8257-8BA3172AC10C}.exeC:\Windows\{3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\{363F1C6D-1930-45df-BE4F-07FB46802604}.exeC:\Windows\{363F1C6D-1930-45df-BE4F-07FB46802604}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exeC:\Windows\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\{140580A6-2FC8-4144-8E38-BB3009F3017F}.exeC:\Windows\{140580A6-2FC8-4144-8E38-BB3009F3017F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\{AA31D768-8E86-4870-94A3-133A0161B685}.exeC:\Windows\{AA31D768-8E86-4870-94A3-133A0161B685}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\{F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exeC:\Windows\{F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\{8B38056C-C9D2-4dec-B0C2-199E03391375}.exeC:\Windows\{8B38056C-C9D2-4dec-B0C2-199E03391375}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\{0A894699-9424-4de0-AEEF-24E984C45545}.exeC:\Windows\{0A894699-9424-4de0-AEEF-24E984C45545}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\{7F097E2A-930D-4ced-9F69-69683DAF130D}.exeC:\Windows\{7F097E2A-930D-4ced-9F69-69683DAF130D}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exeC:\Windows\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:212 -
C:\Windows\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}.exeC:\Windows\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}.exe13⤵
- Executes dropped EXE
PID:1712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAA8E~1.EXE > nul13⤵PID:3664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F097~1.EXE > nul12⤵PID:996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A894~1.EXE > nul11⤵PID:4124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B380~1.EXE > nul10⤵PID:3544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F653A~1.EXE > nul9⤵PID:4640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA31D~1.EXE > nul8⤵PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14058~1.EXE > nul7⤵PID:1380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12E45~1.EXE > nul6⤵PID:3008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{363F1~1.EXE > nul5⤵PID:2472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3337D~1.EXE > nul4⤵PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53256~1.EXE > nul3⤵PID:2928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0A894699-9424-4de0-AEEF-24E984C45545}.exe
- Size 216KB
- SHA256 fc8179b98ba5f34d3613c770ecf62649aae00e27a1d0eab2cd7b3b2135bc27e8
- MD5 994221f06673b89b4100fec520c5e6b6
- SHA1 5352fd25d2954cfc6c6fa11f9db8dabd0ee8c8dd
- SHA512 12e9609efe250a326e3f400cc1cc955d2b3ece03781c9962f90fbc32bf2016ebf2e3f94590b5386f79990f3814f2ac25d178d6b9f440b96472eb9c70e4418da2
- SSDEEP 3072:jEGh0oll+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGflEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{12E4527E-DBD5-490a-B44E-DDB14ED0E5AC}.exe
- Size 216KB
- SHA256 74b392ab439bc4e84310ea56dca8eea9e631fae76aa59a4e908513ca8d24210f
- MD5 f16fb0eb4ffba9e6faa28e7d72045be0
- SHA1 81cea5e8ea01e2cf690778c0331009c00193e149
- SHA512 155be29e70bea16d457073cf31754eda5201dbbbd081008e05f6b86d3f8d959921047e558b548d0221d7a1c43fa7faa8d0101253a1fba853fc3da9cbebcb06b4
- SSDEEP 3072:jEGh0oVl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG/lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{140580A6-2FC8-4144-8E38-BB3009F3017F}.exe
- Size 216KB
- SHA256 adebd08a33da9d71256328a4f7bb5d376e6a8f6d2632efee7e9ce003292c57ee
- MD5 86228f7e18f0ba6ff5c568e8874bf563
- SHA1 503fd00f92e31911e1c12eca180e9daf05920a88
- SHA512 31bdb5be6e60bf3bd93ed4e9b5476d48b07d3664db1c1da9c54906dc2d221607da19644728812f7909321c417f07e58a86412b25dc312ee77ed1742e269525b6
- SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG+lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3337DA17-73BF-4b80-8257-8BA3172AC10C}.exe
- Size 216KB
- SHA256 a48127b04bbd4849ad4b3eb8e877dd1876464d21adaeb0260d38bb34ec27fc8b
- MD5 63d73b6f7a9a460b2a828db180c0d177
- SHA1 e0b3c14811d6039c728780b4a0c74e65fb4b47f2
- SHA512 b85666e93800de8aa14c71b4c21b9d1a60b93a82b3e04a697f057bcb0023d986aa199495b4dfa1abc4c602340ee41dd9736b344b3ea50f4496e141bfd5a80fd8
- SSDEEP 3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGZlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{363F1C6D-1930-45df-BE4F-07FB46802604}.exe
- Size 216KB
- SHA256 e9054cb561ee4d0d81102997778879201042e7d57e110267e50d371e2ad257be
- MD5 95b7ff239653c1e92f2229ac2daa176b
- SHA1 062a570f03b898e47d162784461a7eadfaf40848
- SHA512 6743b09757500a97759d12750ff0d05d0295047dacba19063f404c95e462bdc25ff3ad6d8a08c8e43bb9a819d7ee1390b1d8fef3e2a21274eaa257bddb5976c5
- SSDEEP 3072:jEGh0oUl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGClEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5325622E-760A-4522-85EE-05027074FAE2}.exe
- Size 216KB
- SHA256 df520bdc0841d7c2f22df2ff321958699f7bc6f8236be8d61ed9f1f2ccf3aea4
- MD5 64eb68051bba7c13b070cad1651160b6
- SHA1 a5e5ff9f9963cb6f18d2d45096704c21e86a062a
- SHA512 876cc777c23841cad278c4dabb2a44dd9c6342a853fb9db45ab9fa1b68f04c4c9873baad6bfe48191c4f43e61a088ddc041ecaf4a3d24e54bbfdfc414e9788fa
- SSDEEP 3072:jEGh0oVl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGTlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F097E2A-930D-4ced-9F69-69683DAF130D}.exe
- Size 216KB
- SHA256 9d183569e565004d0040dff8a00ea05e8a44dd103e33884ec7b5ef4349f677e7
- MD5 3ec4751aac5546e5494367eb20f70217
- SHA1 4940dfc27ac51e3eea469dba854d8fbdde67ff7f
- SHA512 b0f5712d67c757d800feb8886645985f1d996261ce971a3f81163172eca0d60f8cdf800cffd04c274333b26203535c09c436f8b1d28f15047dd58550c22010f6
- SSDEEP 3072:jEGh0oUl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGOlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8B38056C-C9D2-4dec-B0C2-199E03391375}.exe
- Size 216KB
- SHA256 0d5cf785f23b78f25809fa639c258fcc0099827e24644669b8b3b8e21df2bc47
- MD5 8ecf6bf9912671cf98e304ce5337a9a4
- SHA1 e6455db29d14b48b0d5fe9bcd1e5b4f739c3bde1
- SHA512 1484eda62b5840a90f5bfc67f95427454a62eaba0cfdbb4e8eef7b91c4030d21da0713ad0758a586719fcb9c4cdb61475ebf8823c10ef544e088aef6f21382b6
- SSDEEP 3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGplEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A207A5B4-31D8-4640-AD06-1AEC8D6B5EF3}.exe
- Size 216KB
- SHA256 f470bafdad9e5593946c6844a7ca506bf882efb427270f521c883cf4bb71f5aa
- MD5 425a7503cb41c498791b24778aee3144
- SHA1 c976217bff465bbe12a96eab3a32179867606ced
- SHA512 4faef909f4863bba4802811630f99f691098998908e0810fbe18e74b7af68a3b456732f3205b9804828496f8926c5d3659e91c3c0be458217c1a37c2ce3b3b54
- SSDEEP 3072:jEGh0o8l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGelEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AA31D768-8E86-4870-94A3-133A0161B685}.exe
- Size 216KB
- SHA256 4b5833eb41d06bafc029848bf037a608f87ccb4dcb8f22624d6fc507a29da114
- MD5 83f0d9e6869707d912abe89e3687e1a3
- SHA1 dd9e70bf5097a8eed8e4f8b50b0c330344b381e5
- SHA512 120f4458f923f66556595472bea7e6af6030db58622fa0d270fd46a7281ad51a279bafe12da1c7753fa1f6cf518e5596f3bc7452828d8a695b4933371e0149b6
- SSDEEP 3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGdlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AAA8E611-09FE-43b4-AFED-5B6E8FAB0F89}.exe
- Size 216KB
- SHA256 5803754703684e96eeb503aa93c5555b59975f5c99f7d595b73773ddd996a0db
- MD5 19f8c885e5e54da854c53f89e1743e9f
- SHA1 31cf57b1ece5d4686e80772a44c42363fbff98df
- SHA512 727954a6a4186cf21a99c9ff760d4138bc3a0a027ca090c62f589cce1542f049d05c5d19ccda8fc31f95a98f416b59219ccfae9f1105cbf689e6f59169355a99
- SSDEEP 3072:jEGh0onl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG9lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F653A373-7EF3-4d29-BED7-37CBA6E94A17}.exe
- Size 216KB
- SHA256 5b50e7cb9d487bd3bba3ddc1f0a4536b052c46471a767579bad2800c14653933
- MD5 3a67ac333675958c5ca25bf3156a5391
- SHA1 0de789ea25ee03805134608c936345b11e69b084
- SHA512 73ae5f36164d2334756f3e192145f21a7358960e2fff5a9598dfcee8fe4572813eb50a7d99b7c4dff04b8d178b77d8579e04e6d841c292c7c5b50c8644dd6397
- SSDEEP 3072:jEGh0o7l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGplEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP