Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 16:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe
- Size 197KB
- Sample240404-t7s87sdd27
- SHA256 5f892530a87fa38366c6cf6728984d4a1a83b9153dd5e4a7c17e547ead37b871
- MD5 613fe8772b66d375b11a6e9a61aa7e27
- SHA1 505c8a3cbee036521fe413ee584add40bd6b59ea
- SHA512 ff3799dc95a962968bd77f8316f3d84aa227b70acd54a44e6422b52db5813bcf91f39d203437e684c6900278e570e6ac2e5bd10ee885223402e88856b9a6de4d
- SSDEEP 3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGelEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x000300000001da71-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000001e5b5-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000001e716-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000001db6f-16.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000001db71-20.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000500000001db6f-25.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-29.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-32.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-37.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072d-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}\stubpath = "C:\\Windows\\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe" {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}\stubpath = "C:\\Windows\\{AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe" {51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80F681F1-4C9A-42f9-94AD-FB27144C8B95} {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273} {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}\stubpath = "C:\\Windows\\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe" {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762} {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBD0BE42-0262-4576-B40A-9348221B8590} {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBD0BE42-0262-4576-B40A-9348221B8590}\stubpath = "C:\\Windows\\{DBD0BE42-0262-4576-B40A-9348221B8590}.exe" {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{914B7724-CF28-4633-89DD-26CDD6A41904}\stubpath = "C:\\Windows\\{914B7724-CF28-4633-89DD-26CDD6A41904}.exe" 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4293BA5D-0C99-431e-9E38-05EFF3099AAF} {914B7724-CF28-4633-89DD-26CDD6A41904}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558} {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F} {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023}\stubpath = "C:\\Windows\\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe" {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F9D5604-8BAF-4aef-A752-79E777E94923}\stubpath = "C:\\Windows\\{2F9D5604-8BAF-4aef-A752-79E777E94923}.exe" {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762}\stubpath = "C:\\Windows\\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe" {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB0430E0-61A6-420d-A000-F7FC1746D363}\stubpath = "C:\\Windows\\{BB0430E0-61A6-420d-A000-F7FC1746D363}.exe" {DBD0BE42-0262-4576-B40A-9348221B8590}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{914B7724-CF28-4633-89DD-26CDD6A41904} 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4293BA5D-0C99-431e-9E38-05EFF3099AAF}\stubpath = "C:\\Windows\\{4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe" {914B7724-CF28-4633-89DD-26CDD6A41904}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5} {51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558}\stubpath = "C:\\Windows\\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe" {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023} {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80F681F1-4C9A-42f9-94AD-FB27144C8B95}\stubpath = "C:\\Windows\\{80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe" {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F9D5604-8BAF-4aef-A752-79E777E94923} {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB0430E0-61A6-420d-A000-F7FC1746D363} {DBD0BE42-0262-4576-B40A-9348221B8590}.exe - Deletes itself 1 IoCs
pid Process 3668 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 2144 {51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 740 {DBD0BE42-0262-4576-B40A-9348221B8590}.exe 2752 {BB0430E0-61A6-420d-A000-F7FC1746D363}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{BB0430E0-61A6-420d-A000-F7FC1746D363}.exe {DBD0BE42-0262-4576-B40A-9348221B8590}.exe File created C:\Windows\{914B7724-CF28-4633-89DD-26CDD6A41904}.exe 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe File created C:\Windows\{4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe {914B7724-CF28-4633-89DD-26CDD6A41904}.exe File created C:\Windows\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe File created C:\Windows\{2F9D5604-8BAF-4aef-A752-79E777E94923}.exe {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe File created C:\Windows\{DBD0BE42-0262-4576-B40A-9348221B8590}.exe {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe File created C:\Windows\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe File created C:\Windows\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe File created C:\Windows\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe File created C:\Windows\{80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe File created C:\Windows\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe Token: SeIncBasePriorityPrivilege 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe Token: SeIncBasePriorityPrivilege 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe Token: SeIncBasePriorityPrivilege 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe Token: SeIncBasePriorityPrivilege 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe Token: SeIncBasePriorityPrivilege 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe Token: SeIncBasePriorityPrivilege 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe Token: SeIncBasePriorityPrivilege 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe Token: SeIncBasePriorityPrivilege 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe Token: SeIncBasePriorityPrivilege 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe Token: SeIncBasePriorityPrivilege 740 {DBD0BE42-0262-4576-B40A-9348221B8590}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 3600 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe 102 PID 1728 wrote to memory of 3600 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe 102 PID 1728 wrote to memory of 3600 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe 102 PID 1728 wrote to memory of 3668 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe 103 PID 1728 wrote to memory of 3668 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe 103 PID 1728 wrote to memory of 3668 1728 2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe 103 PID 3600 wrote to memory of 1252 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 104 PID 3600 wrote to memory of 1252 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 104 PID 3600 wrote to memory of 1252 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 104 PID 3600 wrote to memory of 3972 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 105 PID 3600 wrote to memory of 3972 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 105 PID 3600 wrote to memory of 3972 3600 {914B7724-CF28-4633-89DD-26CDD6A41904}.exe 105 PID 1252 wrote to memory of 2144 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 108 PID 1252 wrote to memory of 2144 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 108 PID 1252 wrote to memory of 2144 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 108 PID 1252 wrote to memory of 4320 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 109 PID 1252 wrote to memory of 4320 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 109 PID 1252 wrote to memory of 4320 1252 {4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe 109 PID 3332 wrote to memory of 3676 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe 112 PID 3332 wrote to memory of 3676 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe 112 PID 3332 wrote to memory of 3676 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe 112 PID 3332 wrote to memory of 4904 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe 113 PID 3332 wrote to memory of 4904 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe 113 PID 3332 wrote to memory of 4904 3332 {AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe 113 PID 3676 wrote to memory of 4244 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 114 PID 3676 wrote to memory of 4244 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 114 PID 3676 wrote to memory of 4244 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 114 PID 3676 wrote to memory of 5004 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 115 PID 3676 wrote to memory of 5004 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 115 PID 3676 wrote to memory of 5004 3676 {AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe 115 PID 4244 wrote to memory of 1780 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 116 PID 4244 wrote to memory of 1780 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 116 PID 4244 wrote to memory of 1780 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 116 PID 4244 wrote to memory of 952 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 117 PID 4244 wrote to memory of 952 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 117 PID 4244 wrote to memory of 952 4244 {9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe 117 PID 1780 wrote to memory of 4712 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 118 PID 1780 wrote to memory of 4712 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 118 PID 1780 wrote to memory of 4712 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 118 PID 1780 wrote to memory of 2212 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 119 PID 1780 wrote to memory of 2212 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 119 PID 1780 wrote to memory of 2212 1780 {D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe 119 PID 4712 wrote to memory of 4892 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 120 PID 4712 wrote to memory of 4892 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 120 PID 4712 wrote to memory of 4892 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 120 PID 4712 wrote to memory of 4972 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 121 PID 4712 wrote to memory of 4972 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 121 PID 4712 wrote to memory of 4972 4712 {80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe 121 PID 4892 wrote to memory of 4660 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 122 PID 4892 wrote to memory of 4660 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 122 PID 4892 wrote to memory of 4660 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 122 PID 4892 wrote to memory of 4732 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 123 PID 4892 wrote to memory of 4732 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 123 PID 4892 wrote to memory of 4732 4892 {2F9D5604-8BAF-4aef-A752-79E777E94923}.exe 123 PID 4660 wrote to memory of 740 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 124 PID 4660 wrote to memory of 740 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 124 PID 4660 wrote to memory of 740 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 124 PID 4660 wrote to memory of 2776 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 125 PID 4660 wrote to memory of 2776 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 125 PID 4660 wrote to memory of 2776 4660 {C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe 125 PID 740 wrote to memory of 2752 740 {DBD0BE42-0262-4576-B40A-9348221B8590}.exe 126 PID 740 wrote to memory of 2752 740 {DBD0BE42-0262-4576-B40A-9348221B8590}.exe 126 PID 740 wrote to memory of 2752 740 {DBD0BE42-0262-4576-B40A-9348221B8590}.exe 126 PID 740 wrote to memory of 3560 740 {DBD0BE42-0262-4576-B40A-9348221B8590}.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_613fe8772b66d375b11a6e9a61aa7e27_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\{914B7724-CF28-4633-89DD-26CDD6A41904}.exeC:\Windows\{914B7724-CF28-4633-89DD-26CDD6A41904}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\{4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exeC:\Windows\{4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exeC:\Windows\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
PID:2144 -
C:\Windows\{AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exeC:\Windows\{AA9782FC-26B7-461f-8EC4-70DEBE9B2DF5}.exe5⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exeC:\Windows\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exeC:\Windows\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exeC:\Windows\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\{80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exeC:\Windows\{80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\{2F9D5604-8BAF-4aef-A752-79E777E94923}.exeC:\Windows\{2F9D5604-8BAF-4aef-A752-79E777E94923}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exeC:\Windows\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\{DBD0BE42-0262-4576-B40A-9348221B8590}.exeC:\Windows\{DBD0BE42-0262-4576-B40A-9348221B8590}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\{BB0430E0-61A6-420d-A000-F7FC1746D363}.exeC:\Windows\{BB0430E0-61A6-420d-A000-F7FC1746D363}.exe13⤵
- Executes dropped EXE
PID:2752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBD0B~1.EXE > nul13⤵PID:3560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8D1F~1.EXE > nul12⤵PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F9D5~1.EXE > nul11⤵PID:4732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80F68~1.EXE > nul10⤵PID:4972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D20AF~1.EXE > nul9⤵PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E225~1.EXE > nul8⤵PID:952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD7EB~1.EXE > nul7⤵PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA978~1.EXE > nul6⤵PID:4904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51B5D~1.EXE > nul5⤵PID:3884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4293B~1.EXE > nul4⤵PID:4320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{914B7~1.EXE > nul3⤵PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:3668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{2F9D5604-8BAF-4aef-A752-79E777E94923}.exe
- Size 197KB
- SHA256 f25e735df8637a6834b68ceb55fa77739e63333d1b323971ce2981e28b7154b1
- MD5 955cf8310741f155bcaf59ab978ef73b
- SHA1 5732fd24331500225fa321f5c11f4ef84c4d8fac
- SHA512 eaed24d620b7a1a92152dd28e23285bd959ede608b416209229f4e55f1c69edc7840d4a99314ee1c2f5be64c17927408973383c3b00f61fe440b56a32c60c722
- SSDEEP 3072:jEGh0oWl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGUlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4293BA5D-0C99-431e-9E38-05EFF3099AAF}.exe
- Size 197KB
- SHA256 bd6f7909e6b77561a400108a33bd6afe40742629807a8439f0c965bc1a619344
- MD5 652e389bb558e2e888c5dadca072c385
- SHA1 c1570486ee60e697bb65c1eb7371b0ef0fc34576
- SHA512 f39bf853a93bb8be83c9f21361fde732bacdd8012a522cb1ccf034622a0797f500be599fc25dde9ee9846d211f69933bb8f24f13d7df4cb074822c4b45b28bd7
- SSDEEP 3072:jEGh0o8l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGClEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{51B5D1AE-8B1F-4b81-A85C-2F67ACC2E273}.exe
- Size 197KB
- SHA256 3946fb9f9b364cc18728c83ba400eb906893a75f23647c7f3b6fc3800c7a9171
- MD5 3f6f7482d41982ab8f85fbe7c1671b05
- SHA1 32b5043fab27cd4ab4aa232e575579536cd07560
- SHA512 d4b770bdd6a765cc7b228020e1f645feb48f0d8bd287312787c8cd1ba63ec181c13fb97baab8b229d25c6d2a0fca5efec5701425dbc2dbe12a841b2be52fd30a
- SSDEEP 3072:jEGh0oel+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{80F681F1-4C9A-42f9-94AD-FB27144C8B95}.exe
- Size 197KB
- SHA256 b901d24e53b63789d5aca3f36fad4f4e39ccded179e0cb0d8fa288799a3a765a
- MD5 e5ea0c783efe6d34b56e61319292d2df
- SHA1 f8f4df2c975d2c302e075de9cbeb28f88e432806
- SHA512 a3e4f91f6646f510bf9c5b3478ffd9051ff13a9ffd357334ac328c20e4d550d59588d2ca91764089fdbd2d3f3946e3ecbf86ad5ac08e0184764264daaa5cbd5c
- SSDEEP 3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG5lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{914B7724-CF28-4633-89DD-26CDD6A41904}.exe
- Size 197KB
- SHA256 bd4be917154807a2f314a398d2c3e3a66b454db4f9de0da84ff6c23b974b95c1
- MD5 bc513312b2981a150651c3ea25f2e160
- SHA1 e3d6ed3a4bd3838c748e957e3df8330bdc87124e
- SHA512 334e4397a247ffcd0ed41a4062c791d9b7da50e59f7f3a0776365765cea2acb094ebd85d616950213bd603bd6a420d1f9038ef7aab3cb2f232bb848a95208f33
- SSDEEP 3072:jEGh0oQl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG2lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9E2255C0-AFDC-459f-8B0B-3F81ED7B3C4F}.exe
- Size 197KB
- SHA256 93764a231a7b3e4db91780429a9c7b8d8240a330702817d911fb9564a782588b
- MD5 b3c982ef615a67d15888627caeefa923
- SHA1 026d2a9c0e697419c6daf014fc5f5b73305b148a
- SHA512 5a94d2fc496d37c0429e0a2fddb16e4c3d8d60907af41c3981dc46460c3123cea6caefdbaeda684fb6f67a0d5c655bcc4663ce46d30c29f19dbc094d924d2afa
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG9lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AD7EB62C-789F-40ad-9CB7-6FA7AE874558}.exe
- Size 197KB
- SHA256 8ef9e0818b113a8a609179bd1ffe18fe5aac0d0b5d7465872ac614a001ca9b61
- MD5 f9e8aeba370d2cf28e3004538896ad15
- SHA1 9273f354142723ec2bd74e81aa24ef56e10ef1f1
- SHA512 b6e38dda3da1757d0bc3ec0b9e6335057f11677c3584d6ab01a8739df0207985688cf993375df214557a1d688e2f110ed52c20ea1e8a98b32f9767ae806453df
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGxlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BB0430E0-61A6-420d-A000-F7FC1746D363}.exe
- Size 197KB
- SHA256 41a062ac43597af2af8b60f13ed038135778772b209f02205609e9f447c5954f
- MD5 1a96262aa1f0a835cf3d767e96787955
- SHA1 099582ff7173d71efc83d58dabd4e6a2273de527
- SHA512 86783a71da3ad6d23e1764423c4b8b7229f9ffdb6af1b8a33a992a9e19c8ac48f1686dc5ec6f342b0b50c32d0c18a060a0fd6223d9dcbe908f61b92091f0ef94
- SSDEEP 3072:jEGh0o5l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG7lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C8D1FEA4-5492-4270-8EBA-D72F14A3C762}.exe
- Size 197KB
- SHA256 c19a0c666d2be6efacdb6073b0b05f8ee9a655e2065e6e6f4e27cee361d6df60
- MD5 c5d09bb03e7117e8ccff49fb5647564d
- SHA1 6b1c707f9f5093bc9784df28f462b6a65a209334
- SHA512 264a1190729e7bf0f7519b04bbcace33f6d680c52bb7a5178e63aae8743c9c9324152ed11d85e2d0e8f4fe90808f29f156f11cc1b248475a105d8ed98f22bfaa
- SSDEEP 3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGxlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D20AFB46-AEAD-47b4-AC89-B57C3B20B023}.exe
- Size 197KB
- SHA256 c38df1d2474ee14040ccb9a720c386d6c325026f62e23b2634ca103961640355
- MD5 6f4ad430acf6502132ec5711dba0026d
- SHA1 f9a4d6b2a8ccf62bfd22b7a6411e2b93ee1877e6
- SHA512 24ee721e59ab4ec8e7e1af6d5541a6a6216b4e9758ab0500d9be3813d4e62e7a76467ecac11575c067aa36cf107e95994ee53de160f30f75d6b40f879b884904
- SSDEEP 3072:jEGh0ohl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGXlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DBD0BE42-0262-4576-B40A-9348221B8590}.exe
- Size 197KB
- SHA256 e7949327bdef5a0d4e5a868587433933888a102f657bc5bba7af1d9d3236fb31
- MD5 5ef7c3de0555c13fb51dd171d7448542
- SHA1 12975c1afb4130ff417daebd1b8d3bb03e0bcc74
- SHA512 fc6546b683dfd9ae10f45e188d3dff0b178e9d86ba3e1fb699d23117ea7ca81a295007131187d1d88c7890783ae938199340a6e1820ef95cfdf011be1d7df9c1
- SSDEEP 3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG1lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP