Analysis
- max time kernel
144s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 13:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe
- Size 168KB
- Sample240404-ratglahf8x
- SHA256 76126d246188b3d27be00e5c16553cd6fa3eca8843b7aea3b6569a4ec0b28427
- MD5 f24f39bbe28e4dfa90912dcf91f5deb6
- SHA1 1d9b9a900c1b1040b0f883ff6de6056afd838701
- SHA512 843627447f48a4d93d49fab254254e83fa79341844a661a1dc92556516f67bfb84fe482370febde782035ca89267da43d816637bd279e09c058e34ebb7233361
- SSDEEP 1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x0009000000014909-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002c000000014c67-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f00000000f680-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002d000000014c67-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x001000000000f680-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015264-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x001100000000f680-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015264-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000015364-60.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000a000000015264-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015364-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1DE517BD-24E1-49c8-BA3A-7382E98882C2}\stubpath = "C:\\Windows\\{1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe" 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8EC54F48-EC7E-4c7d-94C1-6912A9676568}\stubpath = "C:\\Windows\\{8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe" {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1E13E06-7D21-454e-98D0-E23330907DDD} {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D} {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}\stubpath = "C:\\Windows\\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe" {9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{26561496-0485-45f0-BD1A-97E160E26194}\stubpath = "C:\\Windows\\{26561496-0485-45f0-BD1A-97E160E26194}.exe" {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EF6CD23-12FF-4f21-8B57-501D02AE424D} {F23202AA-6302-433c-830D-E64FBF0630E3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EF6CD23-12FF-4f21-8B57-501D02AE424D}\stubpath = "C:\\Windows\\{9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe" {F23202AA-6302-433c-830D-E64FBF0630E3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1} {9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{468BA82D-A86B-429e-A101-F1D444A87F73} {EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1DE517BD-24E1-49c8-BA3A-7382E98882C2} 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9} {26561496-0485-45f0-BD1A-97E160E26194}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}\stubpath = "C:\\Windows\\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe" {26561496-0485-45f0-BD1A-97E160E26194}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8EC54F48-EC7E-4c7d-94C1-6912A9676568} {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1E13E06-7D21-454e-98D0-E23330907DDD}\stubpath = "C:\\Windows\\{C1E13E06-7D21-454e-98D0-E23330907DDD}.exe" {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D}\stubpath = "C:\\Windows\\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe" {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{468BA82D-A86B-429e-A101-F1D444A87F73}\stubpath = "C:\\Windows\\{468BA82D-A86B-429e-A101-F1D444A87F73}.exe" {EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87} {468BA82D-A86B-429e-A101-F1D444A87F73}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{26561496-0485-45f0-BD1A-97E160E26194} {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F23202AA-6302-433c-830D-E64FBF0630E3} {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F23202AA-6302-433c-830D-E64FBF0630E3}\stubpath = "C:\\Windows\\{F23202AA-6302-433c-830D-E64FBF0630E3}.exe" {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87}\stubpath = "C:\\Windows\\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87}.exe" {468BA82D-A86B-429e-A101-F1D444A87F73}.exe - Deletes itself 1 IoCs
pid Process 2700 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 2724 {9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe 1840 {EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe 2868 {468BA82D-A86B-429e-A101-F1D444A87F73}.exe 2128 {C137DAB8-F3EA-4d68-8740-77FFE9D05D87}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe File created C:\Windows\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe {26561496-0485-45f0-BD1A-97E160E26194}.exe File created C:\Windows\{F23202AA-6302-433c-830D-E64FBF0630E3}.exe {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe File created C:\Windows\{9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe {F23202AA-6302-433c-830D-E64FBF0630E3}.exe File created C:\Windows\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87}.exe {468BA82D-A86B-429e-A101-F1D444A87F73}.exe File created C:\Windows\{26561496-0485-45f0-BD1A-97E160E26194}.exe {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe File created C:\Windows\{8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe File created C:\Windows\{C1E13E06-7D21-454e-98D0-E23330907DDD}.exe {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe File created C:\Windows\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe File created C:\Windows\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe {9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe File created C:\Windows\{468BA82D-A86B-429e-A101-F1D444A87F73}.exe {EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe Token: SeIncBasePriorityPrivilege 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe Token: SeIncBasePriorityPrivilege 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe Token: SeIncBasePriorityPrivilege 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe Token: SeIncBasePriorityPrivilege 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe Token: SeIncBasePriorityPrivilege 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe Token: SeIncBasePriorityPrivilege 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe Token: SeIncBasePriorityPrivilege 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe Token: SeIncBasePriorityPrivilege 2724 {9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe Token: SeIncBasePriorityPrivilege 1840 {EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe Token: SeIncBasePriorityPrivilege 2868 {468BA82D-A86B-429e-A101-F1D444A87F73}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2528 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 28 PID 1548 wrote to memory of 2528 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 28 PID 1548 wrote to memory of 2528 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 28 PID 1548 wrote to memory of 2528 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 28 PID 1548 wrote to memory of 2700 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 29 PID 1548 wrote to memory of 2700 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 29 PID 1548 wrote to memory of 2700 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 29 PID 1548 wrote to memory of 2700 1548 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 29 PID 2528 wrote to memory of 2768 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 30 PID 2528 wrote to memory of 2768 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 30 PID 2528 wrote to memory of 2768 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 30 PID 2528 wrote to memory of 2768 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 30 PID 2528 wrote to memory of 2720 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 31 PID 2528 wrote to memory of 2720 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 31 PID 2528 wrote to memory of 2720 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 31 PID 2528 wrote to memory of 2720 2528 {1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe 31 PID 2768 wrote to memory of 2044 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 34 PID 2768 wrote to memory of 2044 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 34 PID 2768 wrote to memory of 2044 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 34 PID 2768 wrote to memory of 2044 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 34 PID 2768 wrote to memory of 2212 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 35 PID 2768 wrote to memory of 2212 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 35 PID 2768 wrote to memory of 2212 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 35 PID 2768 wrote to memory of 2212 2768 {26561496-0485-45f0-BD1A-97E160E26194}.exe 35 PID 2044 wrote to memory of 2404 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 36 PID 2044 wrote to memory of 2404 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 36 PID 2044 wrote to memory of 2404 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 36 PID 2044 wrote to memory of 2404 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 36 PID 2044 wrote to memory of 436 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 37 PID 2044 wrote to memory of 436 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 37 PID 2044 wrote to memory of 436 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 37 PID 2044 wrote to memory of 436 2044 {CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe 37 PID 2404 wrote to memory of 1384 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 38 PID 2404 wrote to memory of 1384 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 38 PID 2404 wrote to memory of 1384 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 38 PID 2404 wrote to memory of 1384 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 38 PID 2404 wrote to memory of 860 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 39 PID 2404 wrote to memory of 860 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 39 PID 2404 wrote to memory of 860 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 39 PID 2404 wrote to memory of 860 2404 {8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe 39 PID 1384 wrote to memory of 2904 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 40 PID 1384 wrote to memory of 2904 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 40 PID 1384 wrote to memory of 2904 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 40 PID 1384 wrote to memory of 2904 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 40 PID 1384 wrote to memory of 1324 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 41 PID 1384 wrote to memory of 1324 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 41 PID 1384 wrote to memory of 1324 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 41 PID 1384 wrote to memory of 1324 1384 {C1E13E06-7D21-454e-98D0-E23330907DDD}.exe 41 PID 2904 wrote to memory of 2648 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 42 PID 2904 wrote to memory of 2648 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 42 PID 2904 wrote to memory of 2648 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 42 PID 2904 wrote to memory of 2648 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 42 PID 2904 wrote to memory of 2012 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 43 PID 2904 wrote to memory of 2012 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 43 PID 2904 wrote to memory of 2012 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 43 PID 2904 wrote to memory of 2012 2904 {7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe 43 PID 2648 wrote to memory of 2724 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 44 PID 2648 wrote to memory of 2724 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 44 PID 2648 wrote to memory of 2724 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 44 PID 2648 wrote to memory of 2724 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 44 PID 2648 wrote to memory of 2684 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 45 PID 2648 wrote to memory of 2684 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 45 PID 2648 wrote to memory of 2684 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 45 PID 2648 wrote to memory of 2684 2648 {F23202AA-6302-433c-830D-E64FBF0630E3}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\{1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exeC:\Windows\{1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\{26561496-0485-45f0-BD1A-97E160E26194}.exeC:\Windows\{26561496-0485-45f0-BD1A-97E160E26194}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exeC:\Windows\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\{8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exeC:\Windows\{8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\{C1E13E06-7D21-454e-98D0-E23330907DDD}.exeC:\Windows\{C1E13E06-7D21-454e-98D0-E23330907DDD}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exeC:\Windows\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\{F23202AA-6302-433c-830D-E64FBF0630E3}.exeC:\Windows\{F23202AA-6302-433c-830D-E64FBF0630E3}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\{9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exeC:\Windows\{9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exeC:\Windows\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1840 -
C:\Windows\{468BA82D-A86B-429e-A101-F1D444A87F73}.exeC:\Windows\{468BA82D-A86B-429e-A101-F1D444A87F73}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\Windows\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87}.exeC:\Windows\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87}.exe12⤵
- Executes dropped EXE
PID:2128
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{468BA~1.EXE > nul12⤵PID:2316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF120~1.EXE > nul11⤵PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EF6C~1.EXE > nul10⤵PID:2320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2320~1.EXE > nul9⤵PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7688E~1.EXE > nul8⤵PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1E13~1.EXE > nul7⤵PID:1324
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EC54~1.EXE > nul6⤵PID:860
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA7D3~1.EXE > nul5⤵PID:436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26561~1.EXE > nul4⤵PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DE51~1.EXE > nul3⤵PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1DE517BD-24E1-49c8-BA3A-7382E98882C2}.exe
- Size 168KB
- SHA256 c0162886a01e3ed537231ba5a57378ffd0190ad26f24d3ce5286407b03b36297
- MD5 b6b8ee4efeb2cb7923a28a94a3995271
- SHA1 03d72e9998709c12e3ab6f62f62c219d847123d5
- SHA512 7b85776c723f3a497486c073851a16a6572b560d088f475b1218fd02cac60799aef91bec0cfbc8d96c9cb7280afe6989302f998a06565801dd0cc8e0d5259d8b
- SSDEEP 1536:1EGh0oOlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{26561496-0485-45f0-BD1A-97E160E26194}.exe
- Size 168KB
- SHA256 b5da54e1975b92b1b5db38f03519bfa2f33c71f79961498f3c36d832ac08a29e
- MD5 24ab61e4dc6204356743a052debf377b
- SHA1 23bc27511ff58c8c91a64d122e91692b01217847
- SHA512 bcd3d11513016b4d581ab58c1f32b2a157f4a4661d3459b2d3a3e594157067d3184f47876428b46eec949b8f2d65fd92075a8ea5f6812d518e9796a928c953fa
- SSDEEP 1536:1EGh0oNlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oNlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{468BA82D-A86B-429e-A101-F1D444A87F73}.exe
- Size 168KB
- SHA256 e19b7182c6fe360878d3f95e4184d941acf16b52231eee86ac505d6960072342
- MD5 62395b8bc9e7473fd01e7e06c4172e15
- SHA1 ee316b3c644b2b981ad36a989bc8e17580eb35e4
- SHA512 c75bafe3cc32d6877e07620c1449ccc01921cba76f31fbdcdf73a7b31c5d7fb2e32086063ee41e94525f1efb20940440bd3cb9dcecc664780f2cdbccd624a8f5
- SSDEEP 1536:1EGh0oTlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oTlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7688E12C-3127-4e3a-AEB0-4CCA887EA46D}.exe
- Size 168KB
- SHA256 22ddfd171f66d67b00949e17507faa4ebf576d5d503401c9ad792eac7f8261a6
- MD5 260c9eedaf2fc24ec02a6bd3daf7ea5e
- SHA1 cee4550365ca97c03a0b62b7261e9c22691a28d9
- SHA512 73c16548efdc5cfbab774b6aa935bf050354ce432bb495653c5ebe07dc4dcc2af3a000394a2080a317d6910a45c14540506cb04d0411f061b9918343032c942d
- SSDEEP 1536:1EGh0ojlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8EC54F48-EC7E-4c7d-94C1-6912A9676568}.exe
- Size 168KB
- SHA256 4a620e31582c74fa7d4ae43419ce3049e21312fe8092a8dd7ad9733f343761c2
- MD5 3980b873310abd2d7c542ad7e5c4635c
- SHA1 99b0215826603da83c13c67a6aef59e75117aca4
- SHA512 59ee8c62869a19824310b64565d52180128bf64c918e3bcfaff344385b10ab3197764baf9cf72940932606ec35d18f91d4ebc06bba99c56ceb39618b34057516
- SSDEEP 1536:1EGh0ozlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ozlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9EF6CD23-12FF-4f21-8B57-501D02AE424D}.exe
- Size 168KB
- SHA256 d223b69c8bad7e0624d1b9e455141f11d0f13e292686b9be22b79d81135c2bc2
- MD5 c77ed55a6945d813ee43d8696b2c38db
- SHA1 39ce3c840027802d018d311941c3625a3c108ab3
- SHA512 9632c34ad656d856a67a351dddb713c400b4fb5d7a8da67a6fbe03b3c1a47fc96b28a9fdfe2f152ebe259f6bd9914d8bcd54b89643ca5c478220eefee3382e92
- SSDEEP 1536:1EGh0oPlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oPlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C137DAB8-F3EA-4d68-8740-77FFE9D05D87}.exe
- Size 168KB
- SHA256 1451b50a672bbc55bebbde05f686a9e3250323d03e060312b91fd082afdc8953
- MD5 f2519a0939c134de1be170ed1f9b4a47
- SHA1 3b4801b6c81daac916d175c5f63ac0c40192fa49
- SHA512 15d4b07d6c95fac827087364b5913648b031868bfc40ce2959cb45c766400b1f26419a8d944fbb55359b63019a0fb404e268490bffeff09a3dffe6126c045ed8
- SSDEEP 1536:1EGh0oAlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oAlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C1E13E06-7D21-454e-98D0-E23330907DDD}.exe
- Size 168KB
- SHA256 8243b2ed80d0b4c6c6c82e2fc085a6b1d5840996989d125aa7ef0ba6e62b7efb
- MD5 63a81fdf5c7110e5a198440d7dfbb9d2
- SHA1 82d69e7427e148178844a259d34fa41fc9594790
- SHA512 3045777591cc6ac470360a0f8743be7229e829ba5c8b815f3b217adea7958db0a0b8967bfc8f0de95421384278affc5e1ce522306f756474e7a487bf9263ca80
- SSDEEP 1536:1EGh0oMlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oMlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CA7D3EFB-A85F-48ef-836E-249AE5F08EF9}.exe
- Size 168KB
- SHA256 a394142c3156e4106a315a4926efb510d2b7d039d9edefb98e75a7fec76ab0cf
- MD5 f304ce1b8e0b44a3bcba5bbaa3050821
- SHA1 1c6d8c33776129f039297d8d41cb62bd677956ae
- SHA512 f5cc574f34e801024fe86b977c99ea881e32bc467af907563f727af9600c65ecfd1bd7d1cf440567083ecc1471b34c380d1f4164ce90e4e74d0c037b992bff2c
- SSDEEP 1536:1EGh0oDlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oDlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF120AD3-D6EA-4f4f-BB60-0EBC3E3B0EB1}.exe
- Size 168KB
- SHA256 7146c19ff1ae6acf7c34bbf6e93ebc3b12a9c35ee7210eeda85561c3c4621637
- MD5 38731122f4b0c9aeebf751dffb6dbbfa
- SHA1 a2046493f7f601bf0a0eb20f3e2130c29d0a59fe
- SHA512 b75d822de46e61c515653bd0bbe8ad99a8f9a8e6d80f472e3c81d7c4044d78b750508c43f8bb90c69db5903a9f9f45226096abd567465b92ff2af24ef38e09fa
- SSDEEP 1536:1EGh0oylq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oylqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F23202AA-6302-433c-830D-E64FBF0630E3}.exe
- Size 168KB
- SHA256 62f250a1ce14b9b3ad7994f7529c1115f392866f606b00bd4ab475d0102b9941
- MD5 b10f1dc7a315096be5c0b2daeeda2225
- SHA1 602aefb9d981d2c23a3c421b194aebafc4257593
- SHA512 80e9e409d0f49823eeaf94dab1859624b951afe3ca23fb1f219fca38cf1dc04c29c184c0aa262cd9b98365bf068e2c8ebf53260046bcfd63a0ad4408ccead67c
- SSDEEP 1536:1EGh0oFlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oFlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP