Analysis
- max time kernel
149s - max time network
126s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 17:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
- Size 180KB
- Sample240404-vzdn8ade4v
- SHA256 e813f5045d267bcd57f05adb5c0627c1bd39e7e47166808ce36f94f6818d3abb
- MD5 11b0ce922f0155fe91da91b57e9fb027
- SHA1 f421640d5c4eb37a509b84e1900e4231bd98a4ef
- SHA512 b127620e6c570641e33251efe6982fa4f148efefd8bd0a60ad2b6eea65cedc6a773eb0f85e581de4d7fb7c56d2a922a532824b535913f659a109e6614f06f73d
- SSDEEP 3072:jEGh0o6lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG8l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral1/files/0x0008000000012262-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0014000000015c52-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f00000000f680-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000012262-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0015000000015c52-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000a000000012262-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0016000000015c52-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000012262-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0017000000015c52-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000012262-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015c69-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012262-82.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}\stubpath = "C:\\Windows\\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe" {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A395A7DA-EE79-479d-9E12-5861B58BE501}\stubpath = "C:\\Windows\\{A395A7DA-EE79-479d-9E12-5861B58BE501}.exe" {A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{356F16A4-0B04-4d4c-A106-D5FFB81F5892}\stubpath = "C:\\Windows\\{356F16A4-0B04-4d4c-A106-D5FFB81F5892}.exe" {B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{256138E4-75FE-44a7-9AE1-6CA9222959FE} 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6487139-1EC5-45ec-9D9A-36C076F3CE98}\stubpath = "C:\\Windows\\{F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe" {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F61EA2DD-0B57-40e2-82A3-986802759930}\stubpath = "C:\\Windows\\{F61EA2DD-0B57-40e2-82A3-986802759930}.exe" {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BDACDCC-9A46-46ec-8888-29856D5373F7} {24571E0D-7361-481f-86A3-70236A012080}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A395A7DA-EE79-479d-9E12-5861B58BE501} {A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{356F16A4-0B04-4d4c-A106-D5FFB81F5892} {B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{256138E4-75FE-44a7-9AE1-6CA9222959FE}\stubpath = "C:\\Windows\\{256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe" 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BDACDCC-9A46-46ec-8888-29856D5373F7}\stubpath = "C:\\Windows\\{6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe" {24571E0D-7361-481f-86A3-70236A012080}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51} {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0} {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B67E128-85AD-4d19-B98A-D9F62D947627} {A395A7DA-EE79-479d-9E12-5861B58BE501}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B67E128-85AD-4d19-B98A-D9F62D947627}\stubpath = "C:\\Windows\\{3B67E128-85AD-4d19-B98A-D9F62D947627}.exe" {A395A7DA-EE79-479d-9E12-5861B58BE501}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596}\stubpath = "C:\\Windows\\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe" {3B67E128-85AD-4d19-B98A-D9F62D947627}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F61EA2DD-0B57-40e2-82A3-986802759930} {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24571E0D-7361-481f-86A3-70236A012080} {F61EA2DD-0B57-40e2-82A3-986802759930}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}\stubpath = "C:\\Windows\\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe" {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD} {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6487139-1EC5-45ec-9D9A-36C076F3CE98} {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24571E0D-7361-481f-86A3-70236A012080}\stubpath = "C:\\Windows\\{24571E0D-7361-481f-86A3-70236A012080}.exe" {F61EA2DD-0B57-40e2-82A3-986802759930}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51}\stubpath = "C:\\Windows\\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe" {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596} {3B67E128-85AD-4d19-B98A-D9F62D947627}.exe - Deletes itself 1 IoCs
pid Process 2524 cmd.exe - Executes dropped EXE 12 IoCs
pid Process 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 1756 {A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe 844 {A395A7DA-EE79-479d-9E12-5861B58BE501}.exe 2208 {3B67E128-85AD-4d19-B98A-D9F62D947627}.exe 600 {B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe 2880 {356F16A4-0B04-4d4c-A106-D5FFB81F5892}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{F61EA2DD-0B57-40e2-82A3-986802759930}.exe {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe File created C:\Windows\{24571E0D-7361-481f-86A3-70236A012080}.exe {F61EA2DD-0B57-40e2-82A3-986802759930}.exe File created C:\Windows\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe File created C:\Windows\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe File created C:\Windows\{3B67E128-85AD-4d19-B98A-D9F62D947627}.exe {A395A7DA-EE79-479d-9E12-5861B58BE501}.exe File created C:\Windows\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe {3B67E128-85AD-4d19-B98A-D9F62D947627}.exe File created C:\Windows\{356F16A4-0B04-4d4c-A106-D5FFB81F5892}.exe {B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe File created C:\Windows\{256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe File created C:\Windows\{F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe File created C:\Windows\{6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe {24571E0D-7361-481f-86A3-70236A012080}.exe File created C:\Windows\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe File created C:\Windows\{A395A7DA-EE79-479d-9E12-5861B58BE501}.exe {A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe Token: SeIncBasePriorityPrivilege 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe Token: SeIncBasePriorityPrivilege 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe Token: SeIncBasePriorityPrivilege 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe Token: SeIncBasePriorityPrivilege 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe Token: SeIncBasePriorityPrivilege 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe Token: SeIncBasePriorityPrivilege 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe Token: SeIncBasePriorityPrivilege 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe Token: SeIncBasePriorityPrivilege 1756 {A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe Token: SeIncBasePriorityPrivilege 844 {A395A7DA-EE79-479d-9E12-5861B58BE501}.exe Token: SeIncBasePriorityPrivilege 2208 {3B67E128-85AD-4d19-B98A-D9F62D947627}.exe Token: SeIncBasePriorityPrivilege 600 {B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2116 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 28 PID 2612 wrote to memory of 2116 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 28 PID 2612 wrote to memory of 2116 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 28 PID 2612 wrote to memory of 2116 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 28 PID 2612 wrote to memory of 2524 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 29 PID 2612 wrote to memory of 2524 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 29 PID 2612 wrote to memory of 2524 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 29 PID 2612 wrote to memory of 2524 2612 2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe 29 PID 2116 wrote to memory of 2860 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 32 PID 2116 wrote to memory of 2860 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 32 PID 2116 wrote to memory of 2860 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 32 PID 2116 wrote to memory of 2860 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 32 PID 2116 wrote to memory of 2488 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 33 PID 2116 wrote to memory of 2488 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 33 PID 2116 wrote to memory of 2488 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 33 PID 2116 wrote to memory of 2488 2116 {256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe 33 PID 2860 wrote to memory of 1908 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 34 PID 2860 wrote to memory of 1908 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 34 PID 2860 wrote to memory of 1908 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 34 PID 2860 wrote to memory of 1908 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 34 PID 2860 wrote to memory of 3008 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 35 PID 2860 wrote to memory of 3008 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 35 PID 2860 wrote to memory of 3008 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 35 PID 2860 wrote to memory of 3008 2860 {F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe 35 PID 1908 wrote to memory of 1672 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 36 PID 1908 wrote to memory of 1672 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 36 PID 1908 wrote to memory of 1672 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 36 PID 1908 wrote to memory of 1672 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 36 PID 1908 wrote to memory of 1656 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 37 PID 1908 wrote to memory of 1656 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 37 PID 1908 wrote to memory of 1656 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 37 PID 1908 wrote to memory of 1656 1908 {F61EA2DD-0B57-40e2-82A3-986802759930}.exe 37 PID 1672 wrote to memory of 828 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 38 PID 1672 wrote to memory of 828 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 38 PID 1672 wrote to memory of 828 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 38 PID 1672 wrote to memory of 828 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 38 PID 1672 wrote to memory of 1452 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 39 PID 1672 wrote to memory of 1452 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 39 PID 1672 wrote to memory of 1452 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 39 PID 1672 wrote to memory of 1452 1672 {24571E0D-7361-481f-86A3-70236A012080}.exe 39 PID 828 wrote to memory of 1620 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 40 PID 828 wrote to memory of 1620 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 40 PID 828 wrote to memory of 1620 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 40 PID 828 wrote to memory of 1620 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 40 PID 828 wrote to memory of 1760 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 41 PID 828 wrote to memory of 1760 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 41 PID 828 wrote to memory of 1760 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 41 PID 828 wrote to memory of 1760 828 {6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe 41 PID 1620 wrote to memory of 940 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 42 PID 1620 wrote to memory of 940 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 42 PID 1620 wrote to memory of 940 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 42 PID 1620 wrote to memory of 940 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 42 PID 1620 wrote to memory of 1824 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 43 PID 1620 wrote to memory of 1824 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 43 PID 1620 wrote to memory of 1824 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 43 PID 1620 wrote to memory of 1824 1620 {F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe 43 PID 940 wrote to memory of 1756 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 44 PID 940 wrote to memory of 1756 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 44 PID 940 wrote to memory of 1756 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 44 PID 940 wrote to memory of 1756 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 44 PID 940 wrote to memory of 1640 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 45 PID 940 wrote to memory of 1640 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 45 PID 940 wrote to memory of 1640 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 45 PID 940 wrote to memory of 1640 940 {3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\{256138E4-75FE-44a7-9AE1-6CA9222959FE}.exeC:\Windows\{256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\{F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exeC:\Windows\{F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\{F61EA2DD-0B57-40e2-82A3-986802759930}.exeC:\Windows\{F61EA2DD-0B57-40e2-82A3-986802759930}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\{24571E0D-7361-481f-86A3-70236A012080}.exeC:\Windows\{24571E0D-7361-481f-86A3-70236A012080}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\{6BDACDCC-9A46-46ec-8888-29856D5373F7}.exeC:\Windows\{6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exeC:\Windows\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exeC:\Windows\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exeC:\Windows\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1756 -
C:\Windows\{A395A7DA-EE79-479d-9E12-5861B58BE501}.exeC:\Windows\{A395A7DA-EE79-479d-9E12-5861B58BE501}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:844 -
C:\Windows\{3B67E128-85AD-4d19-B98A-D9F62D947627}.exeC:\Windows\{3B67E128-85AD-4d19-B98A-D9F62D947627}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Windows\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exeC:\Windows\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:600 -
C:\Windows\{356F16A4-0B04-4d4c-A106-D5FFB81F5892}.exeC:\Windows\{356F16A4-0B04-4d4c-A106-D5FFB81F5892}.exe13⤵
- Executes dropped EXE
PID:2880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B96C8~1.EXE > nul13⤵PID:848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B67E~1.EXE > nul12⤵PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A395A~1.EXE > nul11⤵PID:1948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A04F8~1.EXE > nul10⤵PID:2724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3FFA5~1.EXE > nul9⤵PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0AB1~1.EXE > nul8⤵PID:1824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6BDAC~1.EXE > nul7⤵PID:1760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24571~1.EXE > nul6⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F61EA~1.EXE > nul5⤵PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6487~1.EXE > nul4⤵PID:3008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25613~1.EXE > nul3⤵PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{24571E0D-7361-481f-86A3-70236A012080}.exe
- Size 180KB
- SHA256 fde9f4cff7b9964d818406bf0e3a64e7b54b00d149740ff63e06e297ba62d8a3
- MD5 398f0ffd7666a77863730183ba8695e9
- SHA1 774d1da5035efd649464683391585985557afd81
- SHA512 0108f5ee857c01f8d158f3344a1ae63668ac88a6e2f31b2c6d0dbb02ece5451f445ad4c124f225e9289997427e9520ed1fedae02fad188a71de946807474e393
- SSDEEP 3072:jEGh0o6lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGkl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{256138E4-75FE-44a7-9AE1-6CA9222959FE}.exe
- Size 180KB
- SHA256 2483cd3202416ba4c26861b23c20baa9de54965f728b738947e44afa169da908
- MD5 26a53394af61d0a50ccdbc838b60e459
- SHA1 a1de65563f1b197a8302f6083bcdfda7ce8abbd1
- SHA512 f98cf15d20b45a125f9315fbae04399c5356de055df0838ffb0697ab0693b9ab37021ff6d1898edf68adf35cabee24227b9dd8e1e63acd253c7cead3660357f3
- SSDEEP 3072:jEGh0oElfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGql5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{356F16A4-0B04-4d4c-A106-D5FFB81F5892}.exe
- Size 180KB
- SHA256 a25bc7a3ab2bcad3a938b797ce8bbb276241223c4cea744b7260a1f5959f64f6
- MD5 8e697da6845265705accbbc5798bccb0
- SHA1 159667cee60c384bbaddea7e6978c4bd5710b7ee
- SHA512 9be80ef6ccc81735ad5a7330db6c68d63bc291eea5efdf4d1acaab8e2cc1f20480c1bc9d6fbe1abba2151c3408be63a0e65d8b2e60b5fc060a87644acb604321
- SSDEEP 3072:jEGh0otlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGjl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3B67E128-85AD-4d19-B98A-D9F62D947627}.exe
- Size 180KB
- SHA256 900b003fcb6280060b7dae69ffbfdd5de708cabc6dc6d2458d79586d1a82df20
- MD5 f842488100515197e022c71a08756b77
- SHA1 f537590bbd71d6e511980017b41b709eacf6a541
- SHA512 838ae0f7319fca8293faed3cc395d887599b592131b13188c1747562a2097f48cd65d4e57bd620f67c8b7b72e9b312994ec2229a24f87e02802ddbe9a3d8eaf3
- SSDEEP 3072:jEGh0oMlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG+l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3FFA58CA-D32F-4c77-88E4-22EC5AC6D3C0}.exe
- Size 180KB
- SHA256 9d4ebb177c705033cff6d4f198ed1300b20f9fa93c18fd55aaa71650396d7311
- MD5 15fd7a2a51391118f31e6ae508c94dfe
- SHA1 cbf6eb2cb303d31aceb3a79c33f53119f158f46c
- SHA512 3a5c35f9e4062129d7de5e56afa8c638da862d34df5525f4e7c9fa65b2d4a6288c320b52f46a0b066a5e76578892876bf5ed0309b7ee1d04741b7aed3d55bbf3
- SSDEEP 3072:jEGh0ovlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG5l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6BDACDCC-9A46-46ec-8888-29856D5373F7}.exe
- Size 180KB
- SHA256 eb888465225d51a52371c576f71dad84b77a5740c403aa236f0d3e33aade835c
- MD5 7fa3eac04f64f47f953a6df6f5960961
- SHA1 c543ea2480ef49c09b2af338d5e92c52fce5d83f
- SHA512 936581574d85c814f5fbf026715fb6341bd6b727ebec15164e953b67c5ea5e622b122db2d44d760d21722ac8c653efebbe4d6cb5acf42e5a8e427dcc12509d58
- SSDEEP 3072:jEGh0oZlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG7l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A04F85B3-E24F-4a0e-ADCE-2B79E72337CD}.exe
- Size 180KB
- SHA256 ab687f11c31545048d7454d6aa061fc35b75f83b7b2917aaaeed7375114ed8e1
- MD5 f783077dce92396f86cb836771b3b652
- SHA1 6200df5d5f2b3997eec3689f43db4cb1c19b96d7
- SHA512 24060435189f7b30fb21a47b20f5318a186ed1001f7bdf95e3cb591e15ad569ce6c665a8ce690c6877a2932be4eb21d01b588c3e1547f68306773bc8466d1b96
- SSDEEP 3072:jEGh0oZlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGTl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A395A7DA-EE79-479d-9E12-5861B58BE501}.exe
- Size 180KB
- SHA256 56cd1bc1057ea4e769841c9743dffc60feb599c975c03cc15826f457ebd69781
- MD5 3cc12c6faa8bc6f76aa7f25fb28e7ad6
- SHA1 0e93b0aef9f26a08ca0539c46141362875676bb8
- SHA512 b539c68eeebd51d8a09c46318914db16e20958e3063ef3e865d503eeb1467965c51d3227974fa5b116fb42e68d8701991be09ed55d6048c39ef7800be0e37a65
- SSDEEP 3072:jEGh0owlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGOl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B96C8593-EEA0-4395-99BB-D5E2A8BF9596}.exe
- Size 180KB
- SHA256 4f45070ab0aa988026ff810a372a36969808fc8c86e35ae4b4761225c579dcbb
- MD5 0642fda872fc7aa01a2b65d516e169e2
- SHA1 0f2802096cc4330ed0f2888f9fb65762bf42bc5b
- SHA512 8c2bfee990fe4dff125dcdde2559622d856f599ec0d3bc5b6a53d510f70ae135c11ef4eabb3bc1032388b05a9be479799dc9ebf6d34d3a2fc5d21e57d104c898
- SSDEEP 3072:jEGh0oZlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGDl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F0AB17D7-1D6E-4f15-A734-504CD05FDE51}.exe
- Size 180KB
- SHA256 81aa7823188541cd378869f94c1d9a305ebb6b79c4c8917e167f93cb1d2eb115
- MD5 27dcd4c15fff59e7fe7d1d46aab37dc5
- SHA1 f07cd712a309626e5d51344072953a271be75c3c
- SHA512 1bf72728cee8f14bc181b0caf10bc758197edc843f55cf00c32beae75adc65fa2c84295805e1dd0e7f17e39d889014f0fefd6544fa474e1855a50b3941a9a3b2
- SSDEEP 3072:jEGh0ovlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGFl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F61EA2DD-0B57-40e2-82A3-986802759930}.exe
- Size 180KB
- SHA256 f18332ef8dfc342453e03ef1ca5d81fb6b2e29611172c2274e033716d8d2c694
- MD5 ca65c5f2b2c7c38a0d71c162976eb7b4
- SHA1 f72b56bfc5c4b72f19a727473c9c9f444de54ba6
- SHA512 175d29276d3341bab3115b204c8f43bde651cdd2c44bc444bc890e839c3c4a2bcd285c791b809030b92852155690fa332e250f9c07b532a44aa9c72e7ce48f88
- SSDEEP 3072:jEGh0oElfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F6487139-1EC5-45ec-9D9A-36C076F3CE98}.exe
- Size 180KB
- SHA256 ab76a69a4d98ba263ded917e0489c475c8192c58edceb082a0c808f9b6f17838
- MD5 4f72fba7ce8c3e1e3c7dbacd177c8978
- SHA1 f167655c77f58d01db27a415ff7423002c68ea71
- SHA512 50bacaf6b76334ffc64583aec51601dd888d7344fe5a1ef66ed22225324e970e6bdf66b627596ac60b6a16bcf6d3e07fcdf90ca4437a7772fc3e467907fec20f
- SSDEEP 3072:jEGh0oVlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGLl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP