Analysis
- max time kernel
155s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 14:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe
Resource
win7-20240319-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe
- Size 204KB
- Sample240404-rb5agshg21
- SHA256 250475d6ad28aeb91e27781f75ca54602d27029802c7c38a7e4f211af84da4ab
- MD5 ff2ae185b503e21f3028d1ac20f8ee72
- SHA1 34c93e16122c914499510af429b379791a818973
- SHA512 afbddfca6b5d9b66f4079ce40c354d21436bf5c9cb18c3481dba68de607ff883674cb539e9a9717682e1ab0dc7f1f0d581970eafd69ffb07d59ffce9b356e7fe
- SSDEEP 1536:1EGh0oPl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oPl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x0009000000023131-3.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023210-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023211-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023216-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023211-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000021838-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000000037-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000000037-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072f-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61C95CA8-5C76-48ae-977D-8278531844D5} 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61C95CA8-5C76-48ae-977D-8278531844D5}\stubpath = "C:\\Windows\\{61C95CA8-5C76-48ae-977D-8278531844D5}.exe" 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5} {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECAE1ABB-25D0-417f-AC54-17197B29AD85} {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91541AB3-6788-478e-BD8C-67A4F62F8CA2} {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECAE1ABB-25D0-417f-AC54-17197B29AD85}\stubpath = "C:\\Windows\\{ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe" {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8} {41FA98F0-F187-41e4-9970-0B390579510A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{633751BC-B40E-41ea-AEAD-E9DD047C5971}\stubpath = "C:\\Windows\\{633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe" {61C95CA8-5C76-48ae-977D-8278531844D5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4} {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}\stubpath = "C:\\Windows\\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe" {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}\stubpath = "C:\\Windows\\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe" {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B712A00-8EA7-4058-838F-E0F2609E23A4} {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1663DE8-37A2-493f-8269-DD239CF458EC} {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1663DE8-37A2-493f-8269-DD239CF458EC}\stubpath = "C:\\Windows\\{B1663DE8-37A2-493f-8269-DD239CF458EC}.exe" {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{633751BC-B40E-41ea-AEAD-E9DD047C5971} {61C95CA8-5C76-48ae-977D-8278531844D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41FA98F0-F187-41e4-9970-0B390579510A}\stubpath = "C:\\Windows\\{41FA98F0-F187-41e4-9970-0B390579510A}.exe" {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}\stubpath = "C:\\Windows\\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe" {41FA98F0-F187-41e4-9970-0B390579510A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{871C1C92-9F78-46fd-AC92-4AA301852BEF} {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{871C1C92-9F78-46fd-AC92-4AA301852BEF}\stubpath = "C:\\Windows\\{871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe" {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B712A00-8EA7-4058-838F-E0F2609E23A4}\stubpath = "C:\\Windows\\{6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe" {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91541AB3-6788-478e-BD8C-67A4F62F8CA2}\stubpath = "C:\\Windows\\{91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe" {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41FA98F0-F187-41e4-9970-0B390579510A} {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe - Executes dropped EXE 11 IoCs
pid Process 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 736 {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe 3892 {B1663DE8-37A2-493f-8269-DD239CF458EC}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe File created C:\Windows\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe {41FA98F0-F187-41e4-9970-0B390579510A}.exe File created C:\Windows\{61C95CA8-5C76-48ae-977D-8278531844D5}.exe 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe File created C:\Windows\{871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe File created C:\Windows\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe File created C:\Windows\{91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe File created C:\Windows\{ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe File created C:\Windows\{41FA98F0-F187-41e4-9970-0B390579510A}.exe {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe File created C:\Windows\{B1663DE8-37A2-493f-8269-DD239CF458EC}.exe {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe File created C:\Windows\{633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe {61C95CA8-5C76-48ae-977D-8278531844D5}.exe File created C:\Windows\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe Token: SeIncBasePriorityPrivilege 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe Token: SeIncBasePriorityPrivilege 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe Token: SeIncBasePriorityPrivilege 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe Token: SeIncBasePriorityPrivilege 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe Token: SeIncBasePriorityPrivilege 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe Token: SeIncBasePriorityPrivilege 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe Token: SeIncBasePriorityPrivilege 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe Token: SeIncBasePriorityPrivilege 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe Token: SeIncBasePriorityPrivilege 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe Token: SeIncBasePriorityPrivilege 736 {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 4880 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe 93 PID 1520 wrote to memory of 4880 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe 93 PID 1520 wrote to memory of 4880 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe 93 PID 1520 wrote to memory of 3884 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe 94 PID 1520 wrote to memory of 3884 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe 94 PID 1520 wrote to memory of 3884 1520 2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe 94 PID 4880 wrote to memory of 2632 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 98 PID 4880 wrote to memory of 2632 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 98 PID 4880 wrote to memory of 2632 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 98 PID 4880 wrote to memory of 2712 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 99 PID 4880 wrote to memory of 2712 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 99 PID 4880 wrote to memory of 2712 4880 {61C95CA8-5C76-48ae-977D-8278531844D5}.exe 99 PID 2632 wrote to memory of 664 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 100 PID 2632 wrote to memory of 664 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 100 PID 2632 wrote to memory of 664 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 100 PID 2632 wrote to memory of 3560 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 101 PID 2632 wrote to memory of 3560 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 101 PID 2632 wrote to memory of 3560 2632 {633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe 101 PID 664 wrote to memory of 3260 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 102 PID 664 wrote to memory of 3260 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 102 PID 664 wrote to memory of 3260 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 102 PID 664 wrote to memory of 1948 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 103 PID 664 wrote to memory of 1948 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 103 PID 664 wrote to memory of 1948 664 {E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe 103 PID 3260 wrote to memory of 3772 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 104 PID 3260 wrote to memory of 3772 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 104 PID 3260 wrote to memory of 3772 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 104 PID 3260 wrote to memory of 3184 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 105 PID 3260 wrote to memory of 3184 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 105 PID 3260 wrote to memory of 3184 3260 {7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe 105 PID 3772 wrote to memory of 4956 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 106 PID 3772 wrote to memory of 4956 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 106 PID 3772 wrote to memory of 4956 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 106 PID 3772 wrote to memory of 4344 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 107 PID 3772 wrote to memory of 4344 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 107 PID 3772 wrote to memory of 4344 3772 {871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe 107 PID 4956 wrote to memory of 1836 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 109 PID 4956 wrote to memory of 1836 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 109 PID 4956 wrote to memory of 1836 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 109 PID 4956 wrote to memory of 3312 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 110 PID 4956 wrote to memory of 3312 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 110 PID 4956 wrote to memory of 3312 4956 {6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe 110 PID 1836 wrote to memory of 4660 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 111 PID 1836 wrote to memory of 4660 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 111 PID 1836 wrote to memory of 4660 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 111 PID 1836 wrote to memory of 5040 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 112 PID 1836 wrote to memory of 5040 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 112 PID 1836 wrote to memory of 5040 1836 {91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe 112 PID 4660 wrote to memory of 4156 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 113 PID 4660 wrote to memory of 4156 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 113 PID 4660 wrote to memory of 4156 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 113 PID 4660 wrote to memory of 1424 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 114 PID 4660 wrote to memory of 1424 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 114 PID 4660 wrote to memory of 1424 4660 {ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe 114 PID 4156 wrote to memory of 736 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 115 PID 4156 wrote to memory of 736 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 115 PID 4156 wrote to memory of 736 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 115 PID 4156 wrote to memory of 4016 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 116 PID 4156 wrote to memory of 4016 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 116 PID 4156 wrote to memory of 4016 4156 {41FA98F0-F187-41e4-9970-0B390579510A}.exe 116 PID 736 wrote to memory of 3892 736 {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe 117 PID 736 wrote to memory of 3892 736 {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe 117 PID 736 wrote to memory of 3892 736 {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe 117 PID 736 wrote to memory of 4248 736 {EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_ff2ae185b503e21f3028d1ac20f8ee72_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\{61C95CA8-5C76-48ae-977D-8278531844D5}.exeC:\Windows\{61C95CA8-5C76-48ae-977D-8278531844D5}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\{633751BC-B40E-41ea-AEAD-E9DD047C5971}.exeC:\Windows\{633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exeC:\Windows\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exeC:\Windows\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\{871C1C92-9F78-46fd-AC92-4AA301852BEF}.exeC:\Windows\{871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\{6B712A00-8EA7-4058-838F-E0F2609E23A4}.exeC:\Windows\{6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\{91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exeC:\Windows\{91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\{ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exeC:\Windows\{ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\{41FA98F0-F187-41e4-9970-0B390579510A}.exeC:\Windows\{41FA98F0-F187-41e4-9970-0B390579510A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exeC:\Windows\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\{B1663DE8-37A2-493f-8269-DD239CF458EC}.exeC:\Windows\{B1663DE8-37A2-493f-8269-DD239CF458EC}.exe12⤵
- Executes dropped EXE
PID:3892
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE103~1.EXE > nul12⤵PID:4248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41FA9~1.EXE > nul11⤵PID:4016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECAE1~1.EXE > nul10⤵PID:1424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91541~1.EXE > nul9⤵PID:5040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B712~1.EXE > nul8⤵PID:3312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{871C1~1.EXE > nul7⤵PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A6CD~1.EXE > nul6⤵PID:3184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6B36~1.EXE > nul5⤵PID:1948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63375~1.EXE > nul4⤵PID:3560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61C95~1.EXE > nul3⤵PID:2712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{41FA98F0-F187-41e4-9970-0B390579510A}.exe
- Size 204KB
- SHA256 94816e02343c7ce3bd5aebfb26ec1145868a4817486584058b118d0a23568350
- MD5 42ddff1db203cccb17f0908574bc5555
- SHA1 d5930e2c9e1dbf85185490dda0f6f22c13f72450
- SHA512 58013c9ae8e63d999774d0a0f99d3eb47d6610d073d64d65fd432f50deed8d13ecac6b4dbb66ae2c555218ceacaf13cf2b72b25b428c1a00f1867887ffd6a71d
- SSDEEP 1536:1EGh0oSl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oSl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{61C95CA8-5C76-48ae-977D-8278531844D5}.exe
- Size 204KB
- SHA256 7e8c49d9de278c6f787afb7c4ec435e94a6f8768b5dd6b11b52ee6c5795588dd
- MD5 5654ee0b69ae8de7580efd489b04e06e
- SHA1 87a5f7ffa4d5581059e090e1ebd1407b2b4597a4
- SHA512 3a6e47425789191c7c0b2d8f900fecdd9f592d65748694faf109d11b3fe80d60c6617f6e08a91f56fe1b6dd5d98893a17beae421cde07a12389c443786e7fa36
- SSDEEP 1536:1EGh0oTl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oTl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{633751BC-B40E-41ea-AEAD-E9DD047C5971}.exe
- Size 204KB
- SHA256 4ef1db42c6deec9e2c2eb29032e67d59eff88aaca8e0961114363d1500207b08
- MD5 cf4993145da94379d56652fb26edbbcc
- SHA1 1682514df082f5eb30472101d2ff6e81645c26ae
- SHA512 2c2b70d5e1800c50ccb81a1c0451945f97d9b86a2af67f4a68514b50c992da3efec7a481248036d4924a6dd53526dd5d2651c561d5b27318bd44fd303ba1522d
- SSDEEP 1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o5l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6B712A00-8EA7-4058-838F-E0F2609E23A4}.exe
- Size 204KB
- SHA256 fbb8299eec7a1d7020c5fc4e734f1d34cbdd3e098079aad83d66241e7817282a
- MD5 b98a5cd6546920b080fe1c07aa39ae37
- SHA1 7a95b8f8cd505f19b41ec69fd54eb442243eab0c
- SHA512 0543354b77e1f68f81cc693fdc42dc573ceb2864c7470e4cfbcf419ebba8fd3c296bde886d475ef04c56f564b5a3ee40494d4443e5adca4c25b3f018378f07f1
- SSDEEP 1536:1EGh0obl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0obl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7A6CD33C-6B05-4b7c-A561-20BCD9B497F5}.exe
- Size 204KB
- SHA256 b702271f177db9f9e03d0a9b53a80584565b40c84fcbe68042fa8556f9d95a16
- MD5 7c4cca6ea1e2962d9d8808771b3eced5
- SHA1 07abc90c048618b6b0e6823406a3abc2dfe4c6e2
- SHA512 44bb389a31a57e38b1992b12f48bbea89cfd05cff1e4f86d7b01760ac1cba0955d73c39546d653f13c2f1fb9dccfcc6b517efa0a994e11eabab9374916609427
- SSDEEP 1536:1EGh0oFl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oFl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{871C1C92-9F78-46fd-AC92-4AA301852BEF}.exe
- Size 204KB
- SHA256 3e10db8e4b6fc513e1d019b3ec6bdadb9453151bf1f3b783c333c9395034de22
- MD5 a7bc52267769e98f40f8f23c3cd9521f
- SHA1 55b123597b57206c390a837704784c1769285912
- SHA512 150b5aa1d1d086cc13d13d8140f25fc627240743fe58c759fdd3f7ccce69c21afa11572288cd02e5b64eca61670395a13ff12622b727b101a319344a53551bd7
- SSDEEP 1536:1EGh0onl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0onl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{91541AB3-6788-478e-BD8C-67A4F62F8CA2}.exe
- Size 204KB
- SHA256 b50048f36b97e513b958128f395f48d3770b20ff363741d66be37e27612766c8
- MD5 c9ee8247368901234146c385aa5fb35f
- SHA1 2be80b0c1e18265dff516a9d358684e6347ac598
- SHA512 35274d6f80c706a8d80d4ed49441fe735605c9615bba93aef4fce39e52cfac61d208c3e3061fb1693508ee23610d65b016fe8333d091d789b1e0740cd892cb62
- SSDEEP 1536:1EGh0oal15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oal1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B1663DE8-37A2-493f-8269-DD239CF458EC}.exe
- Size 204KB
- SHA256 f995f03214363bec097b97b21519bb79e198813148451d50dbf37b2eef5a67bb
- MD5 50a08de9f09a0bee03aa2df8c7e8f08a
- SHA1 7bd2f03ee1a07d56a17117ad86a0e03bed2895ce
- SHA512 584a53bd2761e3e2b10ba667038cb1d3f231ceca546de2277be1bb5dc7a578f1c48b59c4d2819e8b0c4d853838711b1aeb238278803bf76b656163f988fd8b38
- SSDEEP 1536:1EGh0oDl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oDl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E6B366D3-C32B-4a1a-9BFD-6BC0667F23D4}.exe
- Size 204KB
- SHA256 3672760579221b609bbec5bf09c9b5b0d028e5792484327f9908bca0892235d2
- MD5 6a4e72332ac2d6c8a15b72f856978c14
- SHA1 3d836fbbc89445e44f1c7f33229582d978c0b765
- SHA512 05881cea21532411bca94f187bd175800a3afd4f14e0b5b76c2b439fc64f372980ed8fab63584c004946a3d2b1567db4403bba1d51018b32e9f112a82724e3e0
- SSDEEP 1536:1EGh0oWl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oWl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ECAE1ABB-25D0-417f-AC54-17197B29AD85}.exe
- Size 204KB
- SHA256 e5fdef699441ab703a8f19589d6e33d95dcd72424128237fea0cc7ee42723e0a
- MD5 f378b640776ab931341f13e249c0edba
- SHA1 5b943502c0c5813a22d0e9f64d6c64abbfb2e0bc
- SHA512 2171e1547893f16ccf90e84be40ad20a2906f64a5670372fcf3cb5050cd824bd7d4e045b87e527637640ef4efda917060894ab42bf4ba3db8c382bc5b5a4c3d8
- SSDEEP 1536:1EGh0oUl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oUl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EE103E0F-2D04-4b7e-8C91-8E45EFEB2BA8}.exe
- Size 204KB
- SHA256 50145d1ef256a88fb7ecf80584eb21f796a2bed580a0bf809bf1a111cbc61441
- MD5 a892a268b1a8f36466e8c32ee6f4b352
- SHA1 f1fb2174c1deb6d458c59fa710564dcde34f5c04
- SHA512 0837d70d26c8945be2afcbc94b48bb65a13157049861968e1b9a8a36c0020e21b950ed631afe2c2361b3100f6599671ac138870b8fd7dd51fc46c4a5b7a02675
- SSDEEP 1536:1EGh0oVl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oVl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP