Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 13:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe
- Size 372KB
- Sample240404-q2p3taaa83
- SHA256 849500e4bc25ebfbba84f3380841512796306e9a1c39344dc5e5ccc00092b77e
- MD5 96675d8b9a6873b17425038f1ee05738
- SHA1 e26a9799a804197a798414777ed6d799cb8ea35f
- SHA512 940f6b88fc1405913656b883496ad5c08f9c421aae50d7b693fa3f6a09646eda7c54ca70d149f49e322bd716ad13c3e358d4126aa4b80236317ca2679bd85681
- SSDEEP 3072:CEGh0o1lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGnlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00070000000231fb-1.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023201-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023208-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023201-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d41-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d42-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021d41-25.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000006cf-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000006cf-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072f-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D7B6C3F-B8FD-4420-928C-208F1F71D841}\stubpath = "C:\\Windows\\{9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe" {F7111EA3-429B-421e-814E-78C914960907}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25DCB82C-5A70-479f-8E24-73ACED38106B} {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AD3FCAE-0C97-4d72-826F-0264F91572C4} {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D86425ED-8946-4cdd-A30D-D0FC22E22593}\stubpath = "C:\\Windows\\{D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe" {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2FBFC4B-7193-42d9-BD08-84DC33467258}\stubpath = "C:\\Windows\\{A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe" 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F85AC209-F937-4b2e-BB46-A3487BBE59DB} {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A4277AA-01F5-4526-829D-CEEDFD3CE056} {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0948602A-7639-4ce5-82C9-C49F4FB54648}\stubpath = "C:\\Windows\\{0948602A-7639-4ce5-82C9-C49F4FB54648}.exe" {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25DCB82C-5A70-479f-8E24-73ACED38106B}\stubpath = "C:\\Windows\\{25DCB82C-5A70-479f-8E24-73ACED38106B}.exe" {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D86425ED-8946-4cdd-A30D-D0FC22E22593} {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AC169DD-22F9-4015-B9A6-8209A1071227}\stubpath = "C:\\Windows\\{7AC169DD-22F9-4015-B9A6-8209A1071227}.exe" {D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F} {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}\stubpath = "C:\\Windows\\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe" {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F85AC209-F937-4b2e-BB46-A3487BBE59DB}\stubpath = "C:\\Windows\\{F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe" {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A4277AA-01F5-4526-829D-CEEDFD3CE056}\stubpath = "C:\\Windows\\{1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe" {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7111EA3-429B-421e-814E-78C914960907} {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D7B6C3F-B8FD-4420-928C-208F1F71D841} {F7111EA3-429B-421e-814E-78C914960907}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AD3FCAE-0C97-4d72-826F-0264F91572C4}\stubpath = "C:\\Windows\\{6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe" {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2FBFC4B-7193-42d9-BD08-84DC33467258} 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D4FA954-562C-4c65-ACD3-4198147460CB} {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D4FA954-562C-4c65-ACD3-4198147460CB}\stubpath = "C:\\Windows\\{4D4FA954-562C-4c65-ACD3-4198147460CB}.exe" {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0948602A-7639-4ce5-82C9-C49F4FB54648} {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7111EA3-429B-421e-814E-78C914960907}\stubpath = "C:\\Windows\\{F7111EA3-429B-421e-814E-78C914960907}.exe" {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AC169DD-22F9-4015-B9A6-8209A1071227} {D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe - Executes dropped EXE 12 IoCs
pid Process 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 1720 {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe 3968 {D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe 4184 {7AC169DD-22F9-4015-B9A6-8209A1071227}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe File created C:\Windows\{7AC169DD-22F9-4015-B9A6-8209A1071227}.exe {D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe File created C:\Windows\{1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe File created C:\Windows\{0948602A-7639-4ce5-82C9-C49F4FB54648}.exe {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe File created C:\Windows\{F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe File created C:\Windows\{4D4FA954-562C-4c65-ACD3-4198147460CB}.exe {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe File created C:\Windows\{F7111EA3-429B-421e-814E-78C914960907}.exe {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe File created C:\Windows\{9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe {F7111EA3-429B-421e-814E-78C914960907}.exe File created C:\Windows\{25DCB82C-5A70-479f-8E24-73ACED38106B}.exe {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe File created C:\Windows\{D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe File created C:\Windows\{A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe File created C:\Windows\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe Token: SeIncBasePriorityPrivilege 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe Token: SeIncBasePriorityPrivilege 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe Token: SeIncBasePriorityPrivilege 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe Token: SeIncBasePriorityPrivilege 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe Token: SeIncBasePriorityPrivilege 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe Token: SeIncBasePriorityPrivilege 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe Token: SeIncBasePriorityPrivilege 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe Token: SeIncBasePriorityPrivilege 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe Token: SeIncBasePriorityPrivilege 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe Token: SeIncBasePriorityPrivilege 1720 {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe Token: SeIncBasePriorityPrivilege 3968 {D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 4876 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe 96 PID 2760 wrote to memory of 4876 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe 96 PID 2760 wrote to memory of 4876 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe 96 PID 2760 wrote to memory of 4252 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe 97 PID 2760 wrote to memory of 4252 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe 97 PID 2760 wrote to memory of 4252 2760 2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe 97 PID 4876 wrote to memory of 3092 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 98 PID 4876 wrote to memory of 3092 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 98 PID 4876 wrote to memory of 3092 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 98 PID 4876 wrote to memory of 3980 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 99 PID 4876 wrote to memory of 3980 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 99 PID 4876 wrote to memory of 3980 4876 {A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe 99 PID 3092 wrote to memory of 4012 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 101 PID 3092 wrote to memory of 4012 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 101 PID 3092 wrote to memory of 4012 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 101 PID 3092 wrote to memory of 2840 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 102 PID 3092 wrote to memory of 2840 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 102 PID 3092 wrote to memory of 2840 3092 {D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe 102 PID 4012 wrote to memory of 1984 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 103 PID 4012 wrote to memory of 1984 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 103 PID 4012 wrote to memory of 1984 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 103 PID 4012 wrote to memory of 4524 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 104 PID 4012 wrote to memory of 4524 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 104 PID 4012 wrote to memory of 4524 4012 {F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe 104 PID 1984 wrote to memory of 2544 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 105 PID 1984 wrote to memory of 2544 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 105 PID 1984 wrote to memory of 2544 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 105 PID 1984 wrote to memory of 2948 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 106 PID 1984 wrote to memory of 2948 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 106 PID 1984 wrote to memory of 2948 1984 {4D4FA954-562C-4c65-ACD3-4198147460CB}.exe 106 PID 2544 wrote to memory of 3676 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 107 PID 2544 wrote to memory of 3676 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 107 PID 2544 wrote to memory of 3676 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 107 PID 2544 wrote to memory of 2956 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 108 PID 2544 wrote to memory of 2956 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 108 PID 2544 wrote to memory of 2956 2544 {1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe 108 PID 3676 wrote to memory of 2932 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 109 PID 3676 wrote to memory of 2932 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 109 PID 3676 wrote to memory of 2932 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 109 PID 3676 wrote to memory of 4528 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 110 PID 3676 wrote to memory of 4528 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 110 PID 3676 wrote to memory of 4528 3676 {0948602A-7639-4ce5-82C9-C49F4FB54648}.exe 110 PID 2932 wrote to memory of 1764 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 111 PID 2932 wrote to memory of 1764 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 111 PID 2932 wrote to memory of 1764 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 111 PID 2932 wrote to memory of 844 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 112 PID 2932 wrote to memory of 844 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 112 PID 2932 wrote to memory of 844 2932 {F7111EA3-429B-421e-814E-78C914960907}.exe 112 PID 1764 wrote to memory of 1152 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 113 PID 1764 wrote to memory of 1152 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 113 PID 1764 wrote to memory of 1152 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 113 PID 1764 wrote to memory of 1392 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 114 PID 1764 wrote to memory of 1392 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 114 PID 1764 wrote to memory of 1392 1764 {9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe 114 PID 1152 wrote to memory of 1720 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 115 PID 1152 wrote to memory of 1720 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 115 PID 1152 wrote to memory of 1720 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 115 PID 1152 wrote to memory of 3096 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 116 PID 1152 wrote to memory of 3096 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 116 PID 1152 wrote to memory of 3096 1152 {25DCB82C-5A70-479f-8E24-73ACED38106B}.exe 116 PID 1720 wrote to memory of 3968 1720 {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe 117 PID 1720 wrote to memory of 3968 1720 {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe 117 PID 1720 wrote to memory of 3968 1720 {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe 117 PID 1720 wrote to memory of 1188 1720 {6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_96675d8b9a6873b17425038f1ee05738_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\{A2FBFC4B-7193-42d9-BD08-84DC33467258}.exeC:\Windows\{A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exeC:\Windows\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\{F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exeC:\Windows\{F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\{4D4FA954-562C-4c65-ACD3-4198147460CB}.exeC:\Windows\{4D4FA954-562C-4c65-ACD3-4198147460CB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\{1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exeC:\Windows\{1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\{0948602A-7639-4ce5-82C9-C49F4FB54648}.exeC:\Windows\{0948602A-7639-4ce5-82C9-C49F4FB54648}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\{F7111EA3-429B-421e-814E-78C914960907}.exeC:\Windows\{F7111EA3-429B-421e-814E-78C914960907}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\{9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exeC:\Windows\{9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\{25DCB82C-5A70-479f-8E24-73ACED38106B}.exeC:\Windows\{25DCB82C-5A70-479f-8E24-73ACED38106B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\{6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exeC:\Windows\{6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\{D86425ED-8946-4cdd-A30D-D0FC22E22593}.exeC:\Windows\{D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3968 -
C:\Windows\{7AC169DD-22F9-4015-B9A6-8209A1071227}.exeC:\Windows\{7AC169DD-22F9-4015-B9A6-8209A1071227}.exe13⤵
- Executes dropped EXE
PID:4184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8642~1.EXE > nul13⤵PID:3392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6AD3F~1.EXE > nul12⤵PID:1188
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25DCB~1.EXE > nul11⤵PID:3096
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D7B6~1.EXE > nul10⤵PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7111~1.EXE > nul9⤵PID:844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09486~1.EXE > nul8⤵PID:4528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A427~1.EXE > nul7⤵PID:2956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D4FA~1.EXE > nul6⤵PID:2948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F85AC~1.EXE > nul5⤵PID:4524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9D81~1.EXE > nul4⤵PID:2840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2FBF~1.EXE > nul3⤵PID:3980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0948602A-7639-4ce5-82C9-C49F4FB54648}.exe
- Size 372KB
- SHA256 01a7b35cabb2090297363ebd8f6dda05f335efb7a9a04417f802cd2e541c9353
- MD5 802fa879567f138db30097241ef1c8b3
- SHA1 0adc1686aa2431514e12192fe040a5c56033ce13
- SHA512 652c419fcbeea8252b63435863f9910f356ec5c2a26a6a46ce0067c33b9becc72eec365ea0695a97021031dda45026c34545f24550e787b2d4404667d680f487
- SSDEEP 3072:CEGh0ohlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGDlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1A4277AA-01F5-4526-829D-CEEDFD3CE056}.exe
- Size 372KB
- SHA256 abf4cff1bfc8f6e23c8c1434efdda71396f199c016f9b83075f759c1f15510ca
- MD5 4f9c04e7c1569cf99e63c3c5f1304695
- SHA1 50ee98a12a47ec56597d0cf9445b06006b511349
- SHA512 6eed7baf4270632c7fc1ae471daea849d40f79bcbec2cc5aa4a923de84250149ba525abc34ebdb3c8db1a7af673b0e445f07e36f224b2769a8ab8a39ee875dea
- SSDEEP 3072:CEGh0odlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGTlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{25DCB82C-5A70-479f-8E24-73ACED38106B}.exe
- Size 372KB
- SHA256 1ef11b7d14ae93cba6e52004de250a51559e51cef091531bc7a25d7a9ba76d16
- MD5 3b7490e3257c245437b56b856a06e60e
- SHA1 79387173e89a8ca5cecc64c6c6bc634df881d80b
- SHA512 ccb87dbf30203585ff67174ec178a6b107cbb77261ebd902441bdaaff4973dc05012ec1c500dd5ea26bf994bbff2a717cc37542c373937ec959da15f67dde074
- SSDEEP 3072:CEGh0oylMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGklkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4D4FA954-562C-4c65-ACD3-4198147460CB}.exe
- Size 372KB
- SHA256 377e82cc2dd3b885ee3d40e7eba7fb5be8638b864989322949bc46e92b65fa5c
- MD5 6f72ecbc2eb930795c792dca4bc2c805
- SHA1 7550dc8d00f58dd8b84ce60fbfff6a5420f004df
- SHA512 fa398f5e250d18680700bd86739a5ad205d209b13d34a047597a9c77b52a3b845206a4175ca1bd553a9b9e8a1e7603d90f3d10caa4a02c75f5ccf4194b398f87
- SSDEEP 3072:CEGh0oblMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGplkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6AD3FCAE-0C97-4d72-826F-0264F91572C4}.exe
- Size 372KB
- SHA256 222373baa466b09469e8933a5334b5135dbe227710c3dfe6675b62e22d92cbbf
- MD5 6bd8b1552f189860492d6026a59017f6
- SHA1 1283d4b08a64112ba32227fc1c3b1ba1abf6b0bd
- SHA512 ab3aeba188fe2bf7fde3bdd2964b2e6e51d31c929e3f2a0259b3660ab047caa2bba05b908cd74ea89ca388896b6960db1365979651f0af09b9af3b34e1bc3a9c
- SSDEEP 3072:CEGh0oUlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG2lkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7AC169DD-22F9-4015-B9A6-8209A1071227}.exe
- Size 372KB
- SHA256 106adedf059830ec80f07a4294f490b9bb6574b57d79fbbeec9838fff70b7dbb
- MD5 ca15317e8b581d6554c3bda342f01f1d
- SHA1 8ca0ebd70823d73628db1df19b79758bf9b85d7e
- SHA512 40ff5c823ceca5c31e8acf5fd1899f8dbd24cdd054d9c87fb7eb93a5d8f519b7f10c514ada1f905b9092d2de5b6e5a65e25378475eccc1b6058ab671d693fe15
- SSDEEP 3072:CEGh0oIlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGKlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9D7B6C3F-B8FD-4420-928C-208F1F71D841}.exe
- Size 372KB
- SHA256 7f7b306751f6b7dfbaef0df96d99cab3128fd0f51c4b3e2bbb00118eb1b20f82
- MD5 1984b667d596e6f49966d887fa94f004
- SHA1 808e602d6d391d176d77fa19c53451a6daa0d604
- SHA512 a4e0242514123c30036644adfe13784ae0c8eb12552290e5fb15face5e9d703a673faabf006ab972cd113aa7239fc28815b22febdcf298dcb1670888b88f0a59
- SSDEEP 3072:CEGh0oalMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGUlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A2FBFC4B-7193-42d9-BD08-84DC33467258}.exe
- Size 372KB
- SHA256 859cf13d17089bd56611b660c68f4cef1b250c5bd8766f10d926e2d9614b4237
- MD5 460447da07f2925a0a60bf0a8b39f913
- SHA1 04058c4dcb30fc5fa50198a01b8c570c443ca35f
- SHA512 15d2af98887c86beaf7f4b07eb1ddc24d45d3b1b61a6fbadebfca1164c35a88455985749fd4bc006bc711218d941b698e29294deb1dba710f6475cc13714ded3
- SSDEEP 3072:CEGh0oglMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGGlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D86425ED-8946-4cdd-A30D-D0FC22E22593}.exe
- Size 372KB
- SHA256 b1798d20672f07e1a4eadf55e28fd37ab44787eac9ce0f5ef44f7aa4f217b4dd
- MD5 b54e065da0a7ebb5a9a22c216ea0ad50
- SHA1 a92269fe9372b3ccb18fe5f6e691f16d869a4fa3
- SHA512 81f54c9181bd7c8795a108fe1a0a1cea225fdbf3ff293cb8959233f4abb8093caf25fac759981d689f6cb1d6cfd27e0f85b10b8f61ca6f8da06dcd404e91fbac
- SSDEEP 3072:CEGh0orlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGhlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D9D81A6E-E8DB-44f1-926E-4EA40BC12C4F}.exe
- Size 372KB
- SHA256 67aaa30a6769be0ded5c57e61cc23cf18733a3f5c135ec266f059420dbbfa393
- MD5 0ae0b6db44b9bfa6b4556c1617856740
- SHA1 c40279475cc2da290dbe073c3bb9e209e0460a0c
- SHA512 8af19e1385553de8ef5fff72b2137873f77ea40b7d9a556529cf676871ef1444d7e3432f41e414c1b6643730a666358157a7aab9c944876e2ed1b08290650878
- SSDEEP 3072:CEGh0ohlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG/lkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F7111EA3-429B-421e-814E-78C914960907}.exe
- Size 372KB
- SHA256 d6c566349ffa039a3cc87eb0e7851945715de26286c17de967e47b18c61066c4
- MD5 59dff681a2b5c8dadcae9c1c0f1bcc73
- SHA1 9530431ffd7a5d2d9b276ec413d87cb8681438a6
- SHA512 0ee627e69d3681a568bfb1b5a846d6cad36f0fc1a7d2f5b5f3f769d6d5799eba69077a0c3ea06bf784d89ede8560061a649fc0b20ce11620b27adc425aeb0712
- SSDEEP 3072:CEGh0oBlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG/lkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F85AC209-F937-4b2e-BB46-A3487BBE59DB}.exe
- Size 372KB
- SHA256 ac8726efdb2ed549a8b1721deea8626490822dc3b62b32b72d6ce8be980e14e9
- MD5 00c17f415cbb5997cd2a8114b8c288ed
- SHA1 e647a9b2e11939b9543599907237e53760f064ee
- SHA512 2e343ae0f9981a5bbbbb4cac46660cfb4458cac9f2f8396f91c4496ae706f3384f5592cce0da5d1dfe3f787b33ea577b550bea8cadb9b9754a70244cfc344a23
- SSDEEP 3072:CEGh0oSlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGIlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP