Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 16:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe
- Size 168KB
- Sample240404-tyh2wada88
- SHA256 5e49aa4cda90d4cd4ce387e5d1476a59e53d3a4250593a7b35de6406827c517a
- MD5 0f1ddeb0ec54ca9bada2e60694ea977a
- SHA1 b5a10dc325b88ce55eaefa932f2d0067ec5bde27
- SHA512 7cdfae9b9b1ad241210020979e4b5b84cbc5f511a5ca41abae26a622bf3543fc3256167f0fd3a7aa9b52f7a569a9c1c79845d2fa02539431039c90290de09c54
- SSDEEP 1536:1EGh0opli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0opliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0004000000022d20-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023275-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002327c-11.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0013000000023275-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002327c-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219e9-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219ea-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070f-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000026-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000507-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46F38741-81FD-403e-BDF1-0F782BD65C42} 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6D670C2-3C4D-4776-892A-E3826C284A63} {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6D670C2-3C4D-4776-892A-E3826C284A63}\stubpath = "C:\\Windows\\{B6D670C2-3C4D-4776-892A-E3826C284A63}.exe" {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{059AECD0-A0D8-4681-A884-9C682FFC600E}\stubpath = "C:\\Windows\\{059AECD0-A0D8-4681-A884-9C682FFC600E}.exe" {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20D37C94-1330-47d7-8876-843175A8CE26}\stubpath = "C:\\Windows\\{20D37C94-1330-47d7-8876-843175A8CE26}.exe" {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46F38741-81FD-403e-BDF1-0F782BD65C42}\stubpath = "C:\\Windows\\{46F38741-81FD-403e-BDF1-0F782BD65C42}.exe" 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE} {878A8701-A665-4e57-83A4-4381F767FB60}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}\stubpath = "C:\\Windows\\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe" {878A8701-A665-4e57-83A4-4381F767FB60}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59836A7F-78D1-41dd-8509-340E7F2D0E1D} {02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99702FA1-F95F-42a8-BDED-1E4941984BF0}\stubpath = "C:\\Windows\\{99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe" {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{059AECD0-A0D8-4681-A884-9C682FFC600E} {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20D37C94-1330-47d7-8876-843175A8CE26} {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE6D402D-5313-4f15-8EC8-D367A3628915} {20D37C94-1330-47d7-8876-843175A8CE26}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE6D402D-5313-4f15-8EC8-D367A3628915}\stubpath = "C:\\Windows\\{BE6D402D-5313-4f15-8EC8-D367A3628915}.exe" {20D37C94-1330-47d7-8876-843175A8CE26}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7151957-989C-4616-9844-EEC54C2276AC} {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{878A8701-A665-4e57-83A4-4381F767FB60} {A7151957-989C-4616-9844-EEC54C2276AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59836A7F-78D1-41dd-8509-340E7F2D0E1D}\stubpath = "C:\\Windows\\{59836A7F-78D1-41dd-8509-340E7F2D0E1D}.exe" {02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99702FA1-F95F-42a8-BDED-1E4941984BF0} {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C} {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}\stubpath = "C:\\Windows\\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe" {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE} {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}\stubpath = "C:\\Windows\\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe" {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7151957-989C-4616-9844-EEC54C2276AC}\stubpath = "C:\\Windows\\{A7151957-989C-4616-9844-EEC54C2276AC}.exe" {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{878A8701-A665-4e57-83A4-4381F767FB60}\stubpath = "C:\\Windows\\{878A8701-A665-4e57-83A4-4381F767FB60}.exe" {A7151957-989C-4616-9844-EEC54C2276AC}.exe - Executes dropped EXE 12 IoCs
pid Process 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 1800 {878A8701-A665-4e57-83A4-4381F767FB60}.exe 3012 {02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe 1524 {59836A7F-78D1-41dd-8509-340E7F2D0E1D}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe File created C:\Windows\{878A8701-A665-4e57-83A4-4381F767FB60}.exe {A7151957-989C-4616-9844-EEC54C2276AC}.exe File created C:\Windows\{20D37C94-1330-47d7-8876-843175A8CE26}.exe {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe File created C:\Windows\{BE6D402D-5313-4f15-8EC8-D367A3628915}.exe {20D37C94-1330-47d7-8876-843175A8CE26}.exe File created C:\Windows\{A7151957-989C-4616-9844-EEC54C2276AC}.exe {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe File created C:\Windows\{46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe File created C:\Windows\{99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe File created C:\Windows\{B6D670C2-3C4D-4776-892A-E3826C284A63}.exe {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe File created C:\Windows\{059AECD0-A0D8-4681-A884-9C682FFC600E}.exe {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe File created C:\Windows\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe File created C:\Windows\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe {878A8701-A665-4e57-83A4-4381F767FB60}.exe File created C:\Windows\{59836A7F-78D1-41dd-8509-340E7F2D0E1D}.exe {02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe Token: SeIncBasePriorityPrivilege 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe Token: SeIncBasePriorityPrivilege 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe Token: SeIncBasePriorityPrivilege 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe Token: SeIncBasePriorityPrivilege 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe Token: SeIncBasePriorityPrivilege 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe Token: SeIncBasePriorityPrivilege 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe Token: SeIncBasePriorityPrivilege 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe Token: SeIncBasePriorityPrivilege 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe Token: SeIncBasePriorityPrivilege 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe Token: SeIncBasePriorityPrivilege 1800 {878A8701-A665-4e57-83A4-4381F767FB60}.exe Token: SeIncBasePriorityPrivilege 3012 {02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 408 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe 98 PID 2240 wrote to memory of 408 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe 98 PID 2240 wrote to memory of 408 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe 98 PID 2240 wrote to memory of 4452 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe 99 PID 2240 wrote to memory of 4452 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe 99 PID 2240 wrote to memory of 4452 2240 2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe 99 PID 408 wrote to memory of 5076 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 105 PID 408 wrote to memory of 5076 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 105 PID 408 wrote to memory of 5076 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 105 PID 408 wrote to memory of 4912 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 106 PID 408 wrote to memory of 4912 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 106 PID 408 wrote to memory of 4912 408 {46F38741-81FD-403e-BDF1-0F782BD65C42}.exe 106 PID 5076 wrote to memory of 4352 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 108 PID 5076 wrote to memory of 4352 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 108 PID 5076 wrote to memory of 4352 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 108 PID 5076 wrote to memory of 2412 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 109 PID 5076 wrote to memory of 2412 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 109 PID 5076 wrote to memory of 2412 5076 {99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe 109 PID 4352 wrote to memory of 516 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 111 PID 4352 wrote to memory of 516 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 111 PID 4352 wrote to memory of 516 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 111 PID 4352 wrote to memory of 1504 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 112 PID 4352 wrote to memory of 1504 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 112 PID 4352 wrote to memory of 1504 4352 {ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe 112 PID 516 wrote to memory of 4312 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 113 PID 516 wrote to memory of 4312 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 113 PID 516 wrote to memory of 4312 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 113 PID 516 wrote to memory of 3684 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 114 PID 516 wrote to memory of 3684 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 114 PID 516 wrote to memory of 3684 516 {B6D670C2-3C4D-4776-892A-E3826C284A63}.exe 114 PID 4312 wrote to memory of 4028 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 115 PID 4312 wrote to memory of 4028 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 115 PID 4312 wrote to memory of 4028 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 115 PID 4312 wrote to memory of 2280 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 116 PID 4312 wrote to memory of 2280 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 116 PID 4312 wrote to memory of 2280 4312 {059AECD0-A0D8-4681-A884-9C682FFC600E}.exe 116 PID 4028 wrote to memory of 3628 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 117 PID 4028 wrote to memory of 3628 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 117 PID 4028 wrote to memory of 3628 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 117 PID 4028 wrote to memory of 1440 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 118 PID 4028 wrote to memory of 1440 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 118 PID 4028 wrote to memory of 1440 4028 {28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe 118 PID 3628 wrote to memory of 3648 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 119 PID 3628 wrote to memory of 3648 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 119 PID 3628 wrote to memory of 3648 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 119 PID 3628 wrote to memory of 4256 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 120 PID 3628 wrote to memory of 4256 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 120 PID 3628 wrote to memory of 4256 3628 {20D37C94-1330-47d7-8876-843175A8CE26}.exe 120 PID 3648 wrote to memory of 2336 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 121 PID 3648 wrote to memory of 2336 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 121 PID 3648 wrote to memory of 2336 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 121 PID 3648 wrote to memory of 2344 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 122 PID 3648 wrote to memory of 2344 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 122 PID 3648 wrote to memory of 2344 3648 {BE6D402D-5313-4f15-8EC8-D367A3628915}.exe 122 PID 2336 wrote to memory of 1800 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 123 PID 2336 wrote to memory of 1800 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 123 PID 2336 wrote to memory of 1800 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 123 PID 2336 wrote to memory of 4984 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 124 PID 2336 wrote to memory of 4984 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 124 PID 2336 wrote to memory of 4984 2336 {A7151957-989C-4616-9844-EEC54C2276AC}.exe 124 PID 1800 wrote to memory of 3012 1800 {878A8701-A665-4e57-83A4-4381F767FB60}.exe 125 PID 1800 wrote to memory of 3012 1800 {878A8701-A665-4e57-83A4-4381F767FB60}.exe 125 PID 1800 wrote to memory of 3012 1800 {878A8701-A665-4e57-83A4-4381F767FB60}.exe 125 PID 1800 wrote to memory of 1600 1800 {878A8701-A665-4e57-83A4-4381F767FB60}.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_0f1ddeb0ec54ca9bada2e60694ea977a_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\{46F38741-81FD-403e-BDF1-0F782BD65C42}.exeC:\Windows\{46F38741-81FD-403e-BDF1-0F782BD65C42}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\{99702FA1-F95F-42a8-BDED-1E4941984BF0}.exeC:\Windows\{99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exeC:\Windows\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\{B6D670C2-3C4D-4776-892A-E3826C284A63}.exeC:\Windows\{B6D670C2-3C4D-4776-892A-E3826C284A63}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\{059AECD0-A0D8-4681-A884-9C682FFC600E}.exeC:\Windows\{059AECD0-A0D8-4681-A884-9C682FFC600E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exeC:\Windows\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\{20D37C94-1330-47d7-8876-843175A8CE26}.exeC:\Windows\{20D37C94-1330-47d7-8876-843175A8CE26}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\{BE6D402D-5313-4f15-8EC8-D367A3628915}.exeC:\Windows\{BE6D402D-5313-4f15-8EC8-D367A3628915}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\{A7151957-989C-4616-9844-EEC54C2276AC}.exeC:\Windows\{A7151957-989C-4616-9844-EEC54C2276AC}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\{878A8701-A665-4e57-83A4-4381F767FB60}.exeC:\Windows\{878A8701-A665-4e57-83A4-4381F767FB60}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exeC:\Windows\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\{59836A7F-78D1-41dd-8509-340E7F2D0E1D}.exeC:\Windows\{59836A7F-78D1-41dd-8509-340E7F2D0E1D}.exe13⤵
- Executes dropped EXE
PID:1524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02C38~1.EXE > nul13⤵PID:3616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{878A8~1.EXE > nul12⤵PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7151~1.EXE > nul11⤵PID:4984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE6D4~1.EXE > nul10⤵PID:2344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20D37~1.EXE > nul9⤵PID:4256
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28550~1.EXE > nul8⤵PID:1440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{059AE~1.EXE > nul7⤵PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6D67~1.EXE > nul6⤵PID:3684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECDD1~1.EXE > nul5⤵PID:1504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99702~1.EXE > nul4⤵PID:2412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46F38~1.EXE > nul3⤵PID:4912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:5036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{02C38C88-3786-435a-B0AC-AC5ED8C5D5EE}.exe
- Size 168KB
- SHA256 7554df2916227b4c921be8400d43d5af8b9c9592b86fa95cfa594085181fe680
- MD5 69e16d0bcadae9ce79912da81629c01e
- SHA1 2506360b2df6844d8ce21512e7eda8de920eb450
- SHA512 2575565396ff0a885c662fcc0bfc5aad3a31357ff3339879dd185aee12b368a953f040ebdadf3bb1266092fe0e263ca4e6ec8b9127102cc7c467c36cf85f44ae
- SSDEEP 1536:1EGh0oJli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{059AECD0-A0D8-4681-A884-9C682FFC600E}.exe
- Size 168KB
- SHA256 b0641cfd8f2d0e00eb6ea473a372251165aa5d359744f0e36bde684620cd6684
- MD5 5dc26ae918ce6dc74fbec758cfaefc8d
- SHA1 9ea3b7f6aec5688649809ae09c5300dec021b553
- SHA512 7a2db876eb066449edff73db467e1106828c73a6086dbe1a76ab2ccb1d290e4f58cebd332e7fb7e734e0e6412ba5ec6c896f23b4f5bcbc64e182c40afd971f86
- SSDEEP 1536:1EGh0o0li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o0liOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{20D37C94-1330-47d7-8876-843175A8CE26}.exe
- Size 168KB
- SHA256 5e18b14e260f94a00c2132c8d15db5b8ba65704580a1ead8ec1f3f91743148fd
- MD5 e05613e2ba155e8551376e06785bd39c
- SHA1 ade719c37d9576f7e4380e468c518e244dec53af
- SHA512 2da11245f8bb5c665855413e3f0bdf05cb55e341bed8a554f1a3066bcf14e834ee799a6b8e54a243e932cc4bec04ad17cc3541a875752b736aa328e4fb36a545
- SSDEEP 1536:1EGh0opli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0opliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{28550F93-8B57-4ac9-B1E8-814C3F2C5CCE}.exe
- Size 168KB
- SHA256 bfa317de77319f9b185357308f1cfbb2ca633c34817d0214a4dd77fb7b824fc6
- MD5 d787766b76d001a16a88563dcf796c1b
- SHA1 dc841f2c2abacad67baa801c2fee5a0cca1d548b
- SHA512 f916db8c14f0e86cc62b009e561bbe6a97c73bfd8512cf80b0f37c69b8fab5f3b3d63fcfee758744982f007f6250381cb95c76e6b574b8d7e62608d72aa9c748
- SSDEEP 1536:1EGh0oJli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{46F38741-81FD-403e-BDF1-0F782BD65C42}.exe
- Size 168KB
- SHA256 743340c14ce75fd30b76ebcbbf57e68d11717abb879686f2c6fdd84cfefff317
- MD5 856ffcc5b7abe29d336e5237f6368c12
- SHA1 6e0f9cbb0f1a5c42939ab8387ab22c4d9c991466
- SHA512 908d3cac464068ac8a95d2132ed08bfd01b4ccc2c814e3e4222770f94ceec265994bd848f01a161b96081c18a6c17f1f1cf9aa81cfb0c68f06a6ce24c35a349e
- SSDEEP 1536:1EGh0oYli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oYliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{59836A7F-78D1-41dd-8509-340E7F2D0E1D}.exe
- Size 168KB
- SHA256 acf9bed0594e970d5a63801cdba242e3d44ffa9ed84363b221fef1804036aaba
- MD5 e8d738a42c2078f647d3251ba475602d
- SHA1 4f7dd34782b1372169524416c09495ef64d07d4f
- SHA512 e6da79b7c469b08cb2a8e8fe34434791606253eb007d36d79619345231102caede2a437296862f08b848a5e911041a84cb6a695215767e94533f822a7af682a0
- SSDEEP 1536:1EGh0ojli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{878A8701-A665-4e57-83A4-4381F767FB60}.exe
- Size 168KB
- SHA256 a6dc9fb086202a389b08bc5ba917f1e1c7b0ecfc8b36270b58f52c7bb292d72a
- MD5 247815e8ff5ddaba5b28ac3690bb1c0d
- SHA1 ab85cf6272fa40bcb88023b55cf546224542793e
- SHA512 00866dade79ab3c4034468ea04d00f84b9f48c527fcf281320b432c6085073ccfee65b5d5166be754d261a86dcdb4b569b13b23b6afae497d59e845da53b7a1c
- SSDEEP 1536:1EGh0ofli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ofliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{99702FA1-F95F-42a8-BDED-1E4941984BF0}.exe
- Size 168KB
- SHA256 1483c45d7c193c6a2df37296d3fc470a0f7a9c21bd3f2c8fc03f3080309bd50c
- MD5 ae10d79a5f7b7851ad184d7897178031
- SHA1 508883a05c980b7279265077ba1e7c134d528e50
- SHA512 85034cd712c4174687f7dba09cc01263a39939b776cbaf491252b781548134a8cfb7669a3f699864dd96b113332c0016fa6e18113f529958a28ce9503ab3fd93
- SSDEEP 1536:1EGh0oAli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oAliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A7151957-989C-4616-9844-EEC54C2276AC}.exe
- Size 168KB
- SHA256 fdd2a719fc5844827fb6743ac7b9f4eed80a30989c00533b684e25f544aa0d98
- MD5 461c215dcb622648060b350da8b45127
- SHA1 02a3cd4fa0ec9d9a0ef6acd9d5c5b27ccc96630d
- SHA512 6c722976a5de7e4d1c7b0d51b3428a2d6106a6fe614ba1c6bea0c52f6c766dc978d54c80f77e0df42d957bfb92baca8095b2b8d7ca93d3809a42e61369c2b420
- SSDEEP 1536:1EGh0o5li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o5liOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B6D670C2-3C4D-4776-892A-E3826C284A63}.exe
- Size 168KB
- SHA256 4660af435d6da7311da523f7b927cd0423cf103e312e5843d2ebf0c7cd534e1a
- MD5 ee5ec895fa05303de798c3b2039dcc1d
- SHA1 cec960f37c461deadbb60c71846911a652affe6d
- SHA512 698859764270f0ebc5f37f32ba928b94d4760a16002a7a80587effd4c2f87073da764038806903ac963f20aa85419a4fc1e8196c5b8452bbc87716dddbf114e3
- SSDEEP 1536:1EGh0oNli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oNliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BE6D402D-5313-4f15-8EC8-D367A3628915}.exe
- Size 168KB
- SHA256 1bcbc4bedfc4f887036c774c14cdafd8e325ecbc5d6af2c9a449d6deea0ed87d
- MD5 9b583b2df5880a0700176d662df93887
- SHA1 208cdc856edbcfb44d09b0ce16957a00113d8ae2
- SHA512 618a3f007a806d6b893b08083c73e4fc791f4fcd24f2fca39b752fba0e6922937227751bb1b6bbb5bd2840ffcc51cb337ed42886a58718578c0f538551ce7fc7
- SSDEEP 1536:1EGh0oSli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oSliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ECDD1DD0-FEF9-4fb8-98A1-22DCF31C537C}.exe
- Size 168KB
- SHA256 de7f2f5fdd37f43475ad14bfa99df8baa09f8be2621e9e4ea17773be15af3f9e
- MD5 ce86960c6834a9593d345c3aa008e003
- SHA1 9d375a6f0c0b4a43442c6cbf510a88b2b8d15246
- SHA512 0dc7fd6d0c4274ffe9ae848bd1045719bc2cd36e2054d208b329ce95b5acd2f03b36407c449524dd9310db910d9e04a0b449679605abfabda897a108358a2364
- SSDEEP 1536:1EGh0okli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0okliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP