Analysis
- max time kernel
144s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 13:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe
- Size 180KB
- Sample240404-q4epvsab44
- SHA256 75374a5be2b9f4f7ba642236a8023b5ae949db61849d2468feeca85a702aac85
- MD5 b1cf90a03d72f461f0eb632f21edbbdf
- SHA1 56d3bc1141e42cf8577ad053bf244669201b46e9
- SHA512 ae28fe5f837b43433dc2aea8010d2eb393b0de183f90cc769bff12a8679d07df3d3e50230520c4fd64d1083bdec4c63d71f38385b34e7a1834f3842b62ff5e85
- SSDEEP 3072:jEGh0oTlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGNl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000c00000001224c-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b0000000144e8-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d00000001224c-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0035000000014712-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e00000001224c-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f00000001224c-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x001000000001224c-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1} {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}\stubpath = "C:\\Windows\\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe" {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{765EF18A-0A9B-4412-B149-A8739DBCBADD}\stubpath = "C:\\Windows\\{765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe" {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2397765-1DCB-46b1-B8F1-9014D84861EA} {D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}\stubpath = "C:\\Windows\\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe" {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB}\stubpath = "C:\\Windows\\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe" {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71}\stubpath = "C:\\Windows\\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe" {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A3FCFEAF-A240-4171-991C-E30567F0CF7D} {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A3FCFEAF-A240-4171-991C-E30567F0CF7D}\stubpath = "C:\\Windows\\{A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe" {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813} {C025F34D-10E0-4935-992C-942D980BE9C4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2397765-1DCB-46b1-B8F1-9014D84861EA}\stubpath = "C:\\Windows\\{C2397765-1DCB-46b1-B8F1-9014D84861EA}.exe" {D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{104102F4-E9D3-40cb-A621-2A3BA37382F6}\stubpath = "C:\\Windows\\{104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe" 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71} {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{765EF18A-0A9B-4412-B149-A8739DBCBADD} {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{104102F4-E9D3-40cb-A621-2A3BA37382F6} 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC5144EE-A5A4-451c-91EF-46DA556760F1} {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB} {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C025F34D-10E0-4935-992C-942D980BE9C4} {A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C025F34D-10E0-4935-992C-942D980BE9C4}\stubpath = "C:\\Windows\\{C025F34D-10E0-4935-992C-942D980BE9C4}.exe" {A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813}\stubpath = "C:\\Windows\\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe" {C025F34D-10E0-4935-992C-942D980BE9C4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F} {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC5144EE-A5A4-451c-91EF-46DA556760F1}\stubpath = "C:\\Windows\\{CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe" {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe - Deletes itself 1 IoCs
pid Process 2740 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 2044 {A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe 1124 {C025F34D-10E0-4935-992C-942D980BE9C4}.exe 268 {D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe 1796 {C2397765-1DCB-46b1-B8F1-9014D84861EA}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe File created C:\Windows\{765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe File created C:\Windows\{C025F34D-10E0-4935-992C-942D980BE9C4}.exe {A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe File created C:\Windows\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe {C025F34D-10E0-4935-992C-942D980BE9C4}.exe File created C:\Windows\{C2397765-1DCB-46b1-B8F1-9014D84861EA}.exe {D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe File created C:\Windows\{104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe File created C:\Windows\{CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe File created C:\Windows\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe File created C:\Windows\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe File created C:\Windows\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe File created C:\Windows\{A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe Token: SeIncBasePriorityPrivilege 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe Token: SeIncBasePriorityPrivilege 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe Token: SeIncBasePriorityPrivilege 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe Token: SeIncBasePriorityPrivilege 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe Token: SeIncBasePriorityPrivilege 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe Token: SeIncBasePriorityPrivilege 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe Token: SeIncBasePriorityPrivilege 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe Token: SeIncBasePriorityPrivilege 2044 {A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe Token: SeIncBasePriorityPrivilege 1124 {C025F34D-10E0-4935-992C-942D980BE9C4}.exe Token: SeIncBasePriorityPrivilege 268 {D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2872 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 28 PID 1736 wrote to memory of 2872 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 28 PID 1736 wrote to memory of 2872 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 28 PID 1736 wrote to memory of 2872 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 28 PID 1736 wrote to memory of 2740 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 29 PID 1736 wrote to memory of 2740 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 29 PID 1736 wrote to memory of 2740 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 29 PID 1736 wrote to memory of 2740 1736 2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe 29 PID 2872 wrote to memory of 2636 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 30 PID 2872 wrote to memory of 2636 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 30 PID 2872 wrote to memory of 2636 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 30 PID 2872 wrote to memory of 2636 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 30 PID 2872 wrote to memory of 2688 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 31 PID 2872 wrote to memory of 2688 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 31 PID 2872 wrote to memory of 2688 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 31 PID 2872 wrote to memory of 2688 2872 {104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe 31 PID 2636 wrote to memory of 2584 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 32 PID 2636 wrote to memory of 2584 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 32 PID 2636 wrote to memory of 2584 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 32 PID 2636 wrote to memory of 2584 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 32 PID 2636 wrote to memory of 2684 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 33 PID 2636 wrote to memory of 2684 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 33 PID 2636 wrote to memory of 2684 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 33 PID 2636 wrote to memory of 2684 2636 {8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe 33 PID 2584 wrote to memory of 1596 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 36 PID 2584 wrote to memory of 1596 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 36 PID 2584 wrote to memory of 1596 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 36 PID 2584 wrote to memory of 1596 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 36 PID 2584 wrote to memory of 2300 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 37 PID 2584 wrote to memory of 2300 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 37 PID 2584 wrote to memory of 2300 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 37 PID 2584 wrote to memory of 2300 2584 {CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe 37 PID 1596 wrote to memory of 1668 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 38 PID 1596 wrote to memory of 1668 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 38 PID 1596 wrote to memory of 1668 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 38 PID 1596 wrote to memory of 1668 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 38 PID 1596 wrote to memory of 2376 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 39 PID 1596 wrote to memory of 2376 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 39 PID 1596 wrote to memory of 2376 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 39 PID 1596 wrote to memory of 2376 1596 {3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe 39 PID 1668 wrote to memory of 1884 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 40 PID 1668 wrote to memory of 1884 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 40 PID 1668 wrote to memory of 1884 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 40 PID 1668 wrote to memory of 1884 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 40 PID 1668 wrote to memory of 2184 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 41 PID 1668 wrote to memory of 2184 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 41 PID 1668 wrote to memory of 2184 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 41 PID 1668 wrote to memory of 2184 1668 {F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe 41 PID 1884 wrote to memory of 1228 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 42 PID 1884 wrote to memory of 1228 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 42 PID 1884 wrote to memory of 1228 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 42 PID 1884 wrote to memory of 1228 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 42 PID 1884 wrote to memory of 1208 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 43 PID 1884 wrote to memory of 1208 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 43 PID 1884 wrote to memory of 1208 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 43 PID 1884 wrote to memory of 1208 1884 {3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe 43 PID 1228 wrote to memory of 2044 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 44 PID 1228 wrote to memory of 2044 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 44 PID 1228 wrote to memory of 2044 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 44 PID 1228 wrote to memory of 2044 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 44 PID 1228 wrote to memory of 3048 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 45 PID 1228 wrote to memory of 3048 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 45 PID 1228 wrote to memory of 3048 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 45 PID 1228 wrote to memory of 3048 1228 {765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_b1cf90a03d72f461f0eb632f21edbbdf_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\{104102F4-E9D3-40cb-A621-2A3BA37382F6}.exeC:\Windows\{104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exeC:\Windows\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\{CC5144EE-A5A4-451c-91EF-46DA556760F1}.exeC:\Windows\{CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exeC:\Windows\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exeC:\Windows\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exeC:\Windows\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\{765EF18A-0A9B-4412-B149-A8739DBCBADD}.exeC:\Windows\{765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\{A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exeC:\Windows\{A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Windows\{C025F34D-10E0-4935-992C-942D980BE9C4}.exeC:\Windows\{C025F34D-10E0-4935-992C-942D980BE9C4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Windows\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exeC:\Windows\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:268 -
C:\Windows\{C2397765-1DCB-46b1-B8F1-9014D84861EA}.exeC:\Windows\{C2397765-1DCB-46b1-B8F1-9014D84861EA}.exe12⤵
- Executes dropped EXE
PID:1796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D42B0~1.EXE > nul12⤵PID:1760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C025F~1.EXE > nul11⤵PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3FCF~1.EXE > nul10⤵PID:1856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{765EF~1.EXE > nul9⤵PID:3048
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3680B~1.EXE > nul8⤵PID:1208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0EB0~1.EXE > nul7⤵PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3278C~1.EXE > nul6⤵PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC514~1.EXE > nul5⤵PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D53F~1.EXE > nul4⤵PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10410~1.EXE > nul3⤵PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{104102F4-E9D3-40cb-A621-2A3BA37382F6}.exe
- Size 180KB
- SHA256 3520811c3dfc4588786f5cc5f22eaf18c86d6b524effd7ccfc481546dd5e530a
- MD5 082e676b15c1ca7b0dd804ba5922c15e
- SHA1 1f6cb592d86e50741f3ece87146dc91a34c639a7
- SHA512 9cd5361fd83b701f38a04a4ec462328af66a38734f0f262020a0041c7b5f06d716088b7b54b637dd9c06fbc1971c869a05c047d9ddf22414b89f1740cb72e435
- SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG0l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3278CCC9-D583-4a70-9BB6-C1B3887C00EB}.exe
- Size 180KB
- SHA256 6d842ea313443c1c4c6b55dfd1542045ecbc6e9a19c33b1998308aa2de60210a
- MD5 3a80ffeb3aae84caa736c688bd5c1193
- SHA1 156b79fe4d65ed7119a3bb9d1e717a1d8e4a1e63
- SHA512 c1bdcb6751998b00d319a294d0c63bb7a0fdfc4b7bb6064fdfb8c78af7fda4f940f47eda1642ed17a2a26bc04055dd31b2e42aa35ebe358578d4e0bdbe264364
- SSDEEP 3072:jEGh0oRlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGjl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3680BFD3-CEAF-4e1d-ACC1-2A781D5ED8B1}.exe
- Size 180KB
- SHA256 936b8dabf9f562a8c9fb99ce3008e39fd83afc1e0aa0e8f51c7417c98048a849
- MD5 fd70dfaec24bdca8c5f6e7d5a4b150c3
- SHA1 33e0de4282ba8ccf53e2c5fa42f8d93825ad4338
- SHA512 3cce2f0144c24dac90597df32b6e9916c3520d6c746d6e7ed9a050315c6daa568ecfd167f5708cdcdbf91ae2f55c3e9e22a3c47ea9a12433ccc3b9fe28611cb5
- SSDEEP 3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGtl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{765EF18A-0A9B-4412-B149-A8739DBCBADD}.exe
- Size 180KB
- SHA256 7fb0bdf3ed077cc64bbc468024b3a8019789c32fc14144c221afa22c10e8acac
- MD5 b7647c5304fedfb067c713c395881c47
- SHA1 3ef3104834148c2d17749fa3f8d35e6fa45d8782
- SHA512 374cd1381b132505cf79896decf37a3a07286aec8e8a3e483eb333a22ed9a00be371d61702d7c01135f8cc59680cdc1b9f37bd8b9b04b44b67941d5d1d9fdcab
- SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG4l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8D53FA14-0AAF-498b-8DFD-C4BDBDF8F36F}.exe
- Size 180KB
- SHA256 6996c53923c34d340d8519f6c79c406cd2bd56ede95129049e7155be91848b3e
- MD5 ccee3080cb3d4deacd4d1c37ea385af0
- SHA1 37cfbeedac26e7938183af8c932fe2c23d99cd74
- SHA512 48c3a38ba511b81b24be951ae8e915a95e8676aaea7f8b6ab205966b577bee864b7c5a2b32fad5096a35d8ba777d6a3f7feb03afadfc12356e67f97c2d1904e6
- SSDEEP 3072:jEGh0oJlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGjl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A3FCFEAF-A240-4171-991C-E30567F0CF7D}.exe
- Size 180KB
- SHA256 2b1903719284ea12f3fcae3038e6c1b10d628d3e25a12bd6af197262b5a6ef95
- MD5 52efc31d4b017d31248cbb870cd2a27a
- SHA1 ef4e2e435c7427073e9cc305f7580dc8ba2ec4ba
- SHA512 d962f804e88a0ee8e46f8f7df7e21229924e587303e2ecb647ab28cb24fda8217828d13e0010b0d1662c4d6710e82180c3946e03cdbd758a2c044dd1588b54f5
- SSDEEP 3072:jEGh0o1lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG/l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C025F34D-10E0-4935-992C-942D980BE9C4}.exe
- Size 180KB
- SHA256 6a482c43126659c5773f1ccbb67dc28c3e81a2f09c15de5c2bec0fb096933b42
- MD5 21a50bcbc8fe305ccf8dc576f072a00d
- SHA1 04fb9614f5bc6c41877312ebe883a4e427250121
- SHA512 34f9d77a98d4d96a28d4f828fa8ce1118357ce728e9307cca968cdc20e85248a16a7478871621caaff74009f962d93324b4f7cf480f0e9e6772ddce43ad15a4e
- SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGkl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2397765-1DCB-46b1-B8F1-9014D84861EA}.exe
- Size 180KB
- SHA256 3eb31884f188011250d680139bd89feaec0704e380123afa2349975d1d49de91
- MD5 432089993eacbe69eb7fb82e5fa90515
- SHA1 2cfdea978bb96d1187b4fd2586eeafe81ae3a497
- SHA512 15271a6475cedcc004225c7f43eb249b0f44c1610583d5a815d430ccd8b43a60bb753f1467b4f74d1db20610ee3b69678b876b42e758b383c1adbda53c15722d
- SSDEEP 3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGBl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CC5144EE-A5A4-451c-91EF-46DA556760F1}.exe
- Size 180KB
- SHA256 4f46068a565307cf6e04b075c60845d12aba5b14bd749b5e95246f8fa4c6633c
- MD5 6527ae2f385d027cd10db395aa96b04a
- SHA1 4cbcaef90d61f6dd77da0eecbb5a2cdbf7a9ecb5
- SHA512 ff25d8713a57831b9936678dfc915f4076d88d1ac214192c58ffe870a0f43e17690a68eaf7c89d46970b92347a7af159f084e0f051794292803aa1946abf494c
- SSDEEP 3072:jEGh0oalfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGMl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D42B0443-F7E0-4b2c-9479-BBAB53ADE813}.exe
- Size 180KB
- SHA256 8ae353c15364c0038a88f899070567e1ab5fd2e2906323222fc424699fd4f719
- MD5 7d5994bc67d11ad7eb096996eb32d1cd
- SHA1 49e80b4f1003401d239b53de67be09c046475bff
- SHA512 8e732acd7ae197f0baeffbf7ec76615c226e36ac8292ca6247a8557bad89a97471d27814316115f5c4c40a714cdc2cd7360ee782a4b62799e39ff077706f720b
- SSDEEP 3072:jEGh0oAlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG2l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F0EB0EE8-6927-4d64-AA59-1BEED0328E71}.exe
- Size 180KB
- SHA256 5a900a2badbe2839ce610359185b1d6299b4598aef0b9f692bf91e2b4f94993c
- MD5 ba75fb36bd8978b6ea87f25fdb2ce985
- SHA1 dbbe086b42d52f0065c74f01f1d30121a4c5bbf7
- SHA512 6e73ac8ad90d652b716b34496f77b9c6c776d8e891d73ecc90a141f223cc5187852b06e7afa26397c7ff8ed02fcfbcece75c703d7cd4b0fdf628d174f9f08191
- SSDEEP 3072:jEGh0oilfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGol5eKcAEc
- MD5 SHA1 SHA512 SSDEEP