Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/04/2024, 12:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe
- Size 168KB
- Sample240410-p2ndjsgb84
- SHA256 83b804c5a816fe6f09863a389ec42cb9100022ce9e8efdb2902a500c1b570e8b
- MD5 3849a3bb18ff20405d052bd966ce6434
- SHA1 508c25a1ef3b1b8d4778040531bbffc4e3b7764c
- SHA512 7d59f91db18164e3fa18cae8163884fb3e88ceb2e0cc20a774b3452963a0d11bc6fa5539f69e141f81c53b20e7f4593f21abe13110726f690119e335739399f0
- SSDEEP 1536:1EGh0oclq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oclqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 10 IoCs
resource yara_rule behavioral2/files/0x000900000002310e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023223-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002322a-11.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023223-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000021524-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000021526-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000021524-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000037-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{925D4033-C38C-417f-B08C-A79F97442FB4}\stubpath = "C:\\Windows\\{925D4033-C38C-417f-B08C-A79F97442FB4}.exe" {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D} {925D4033-C38C-417f-B08C-A79F97442FB4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6EAFAB0-CE07-445f-A77A-807F94668DB4} {A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48D7A31A-4317-4e86-BE0D-883718E7FBC0} {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2251C18-41A3-4e34-9442-50812344BEF1}\stubpath = "C:\\Windows\\{F2251C18-41A3-4e34-9442-50812344BEF1}.exe" {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}\stubpath = "C:\\Windows\\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe" {F2251C18-41A3-4e34-9442-50812344BEF1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D47350AC-9E4C-4760-9F5E-760EEC68A87D}\stubpath = "C:\\Windows\\{D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe" {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{925D4033-C38C-417f-B08C-A79F97442FB4} {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48D7A31A-4317-4e86-BE0D-883718E7FBC0}\stubpath = "C:\\Windows\\{48D7A31A-4317-4e86-BE0D-883718E7FBC0}.exe" {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE0AAD66-0265-4e1a-A397-7346BDAADE61}\stubpath = "C:\\Windows\\{CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe" {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{185A7521-91D6-4e31-B177-BD07B29F54B7}\stubpath = "C:\\Windows\\{185A7521-91D6-4e31-B177-BD07B29F54B7}.exe" {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75}\stubpath = "C:\\Windows\\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe" 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D47350AC-9E4C-4760-9F5E-760EEC68A87D} {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4139F93-21AB-4d63-A50E-356D11FCB7F5}\stubpath = "C:\\Windows\\{A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe" {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE0AAD66-0265-4e1a-A397-7346BDAADE61} {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75} 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2251C18-41A3-4e34-9442-50812344BEF1} {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{185A7521-91D6-4e31-B177-BD07B29F54B7} {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50} {F2251C18-41A3-4e34-9442-50812344BEF1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D}\stubpath = "C:\\Windows\\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe" {925D4033-C38C-417f-B08C-A79F97442FB4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4139F93-21AB-4d63-A50E-356D11FCB7F5} {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6EAFAB0-CE07-445f-A77A-807F94668DB4}\stubpath = "C:\\Windows\\{B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe" {A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe - Executes dropped EXE 10 IoCs
pid Process 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 3296 {A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 4760 {48D7A31A-4317-4e86-BE0D-883718E7FBC0}.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\{F2251C18-41A3-4e34-9442-50812344BEF1}.exe {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe File created C:\Windows\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe {F2251C18-41A3-4e34-9442-50812344BEF1}.exe File created C:\Windows\{A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe File created C:\Windows\{CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe File created C:\Windows\{185A7521-91D6-4e31-B177-BD07B29F54B7}.exe {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe File created C:\Windows\{48D7A31A-4317-4e86-BE0D-883718E7FBC0}.exe {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe File created C:\Windows\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe File created C:\Windows\{925D4033-C38C-417f-B08C-A79F97442FB4}.exe {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe File created C:\Windows\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe {925D4033-C38C-417f-B08C-A79F97442FB4}.exe File created C:\Windows\{D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe Token: SeIncBasePriorityPrivilege 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe Token: SeIncBasePriorityPrivilege 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe Token: SeIncBasePriorityPrivilege 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe Token: SeIncBasePriorityPrivilege 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe Token: SeIncBasePriorityPrivilege 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe Token: SeIncBasePriorityPrivilege 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe Token: SeIncBasePriorityPrivilege 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe Token: SeIncBasePriorityPrivilege 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe Token: SeIncBasePriorityPrivilege 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe - Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3872 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe 93 PID 1664 wrote to memory of 3872 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe 93 PID 1664 wrote to memory of 3872 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe 93 PID 1664 wrote to memory of 3700 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe 94 PID 1664 wrote to memory of 3700 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe 94 PID 1664 wrote to memory of 3700 1664 2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe 94 PID 3872 wrote to memory of 4352 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 98 PID 3872 wrote to memory of 4352 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 98 PID 3872 wrote to memory of 4352 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 98 PID 3872 wrote to memory of 2916 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 99 PID 3872 wrote to memory of 2916 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 99 PID 3872 wrote to memory of 2916 3872 {B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe 99 PID 4352 wrote to memory of 4628 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 101 PID 4352 wrote to memory of 4628 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 101 PID 4352 wrote to memory of 4628 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 101 PID 4352 wrote to memory of 3436 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 102 PID 4352 wrote to memory of 3436 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 102 PID 4352 wrote to memory of 3436 4352 {F2251C18-41A3-4e34-9442-50812344BEF1}.exe 102 PID 4628 wrote to memory of 4736 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 103 PID 4628 wrote to memory of 4736 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 103 PID 4628 wrote to memory of 4736 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 103 PID 4628 wrote to memory of 3404 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 104 PID 4628 wrote to memory of 3404 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 104 PID 4628 wrote to memory of 3404 4628 {A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe 104 PID 4736 wrote to memory of 3792 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 105 PID 4736 wrote to memory of 3792 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 105 PID 4736 wrote to memory of 3792 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 105 PID 4736 wrote to memory of 320 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 106 PID 4736 wrote to memory of 320 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 106 PID 4736 wrote to memory of 320 4736 {D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe 106 PID 3792 wrote to memory of 5084 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 107 PID 3792 wrote to memory of 5084 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 107 PID 3792 wrote to memory of 5084 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 107 PID 3792 wrote to memory of 3496 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 108 PID 3792 wrote to memory of 3496 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 108 PID 3792 wrote to memory of 3496 3792 {925D4033-C38C-417f-B08C-A79F97442FB4}.exe 108 PID 5084 wrote to memory of 3296 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 109 PID 5084 wrote to memory of 3296 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 109 PID 5084 wrote to memory of 3296 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 109 PID 5084 wrote to memory of 4416 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 110 PID 5084 wrote to memory of 4416 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 110 PID 5084 wrote to memory of 4416 5084 {B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe 110 PID 4132 wrote to memory of 1128 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe 113 PID 4132 wrote to memory of 1128 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe 113 PID 4132 wrote to memory of 1128 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe 113 PID 4132 wrote to memory of 4476 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe 114 PID 4132 wrote to memory of 4476 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe 114 PID 4132 wrote to memory of 4476 4132 {B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe 114 PID 1128 wrote to memory of 1572 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 115 PID 1128 wrote to memory of 1572 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 115 PID 1128 wrote to memory of 1572 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 115 PID 1128 wrote to memory of 116 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 116 PID 1128 wrote to memory of 116 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 116 PID 1128 wrote to memory of 116 1128 {CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe 116 PID 1572 wrote to memory of 4760 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 117 PID 1572 wrote to memory of 4760 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 117 PID 1572 wrote to memory of 4760 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 117 PID 1572 wrote to memory of 3360 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 118 PID 1572 wrote to memory of 3360 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 118 PID 1572 wrote to memory of 3360 1572 {185A7521-91D6-4e31-B177-BD07B29F54B7}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_3849a3bb18ff20405d052bd966ce6434_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exeC:\Windows\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\{F2251C18-41A3-4e34-9442-50812344BEF1}.exeC:\Windows\{F2251C18-41A3-4e34-9442-50812344BEF1}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exeC:\Windows\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\{D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exeC:\Windows\{D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\{925D4033-C38C-417f-B08C-A79F97442FB4}.exeC:\Windows\{925D4033-C38C-417f-B08C-A79F97442FB4}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exeC:\Windows\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\{A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exeC:\Windows\{A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
PID:3296 -
C:\Windows\{B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exeC:\Windows\{B6EAFAB0-CE07-445f-A77A-807F94668DB4}.exe9⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\{CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exeC:\Windows\{CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\{185A7521-91D6-4e31-B177-BD07B29F54B7}.exeC:\Windows\{185A7521-91D6-4e31-B177-BD07B29F54B7}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\{48D7A31A-4317-4e86-BE0D-883718E7FBC0}.exeC:\Windows\{48D7A31A-4317-4e86-BE0D-883718E7FBC0}.exe12⤵
- Executes dropped EXE
PID:4760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{185A7~1.EXE > nul12⤵PID:3360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE0AA~1.EXE > nul11⤵PID:116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6EAF~1.EXE > nul10⤵PID:4476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4139~1.EXE > nul9⤵PID:3232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2424~1.EXE > nul8⤵PID:4416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{925D4~1.EXE > nul7⤵PID:3496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4735~1.EXE > nul6⤵PID:320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A14EF~1.EXE > nul5⤵PID:3404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2251~1.EXE > nul4⤵PID:3436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4D9E~1.EXE > nul3⤵PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{185A7521-91D6-4e31-B177-BD07B29F54B7}.exe
- Size 168KB
- SHA256 991900d5ce6b006481e8d3b8986d3b65538b22b0232a06c9d754f9e9d3bae906
- MD5 433b42489ace000a47ad117e543518a2
- SHA1 00ddaae1662a5ab0310b30ebeae4816bd17fc8d2
- SHA512 6aaec09cfd41addb8da4664b1f222b85914aed7e8eb61434b885dafefc56e99aa893e6347385e1294a1705f14afcfd41aa5c8365e965373ef717f4511059847c
- SSDEEP 1536:1EGh0ohlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{48D7A31A-4317-4e86-BE0D-883718E7FBC0}.exe
- Size 168KB
- SHA256 19a2ef3a984833369a960ecefe3c88079e10922fa472862c6e202dd6d11a78bd
- MD5 bc02b1c68ce1a0529b10bba0a46270a2
- SHA1 43c5c634184b14e31faaead47e485c055cde59b4
- SHA512 c813e79f9fca55ca8db4b77162f0ac001222ef21b55f3e82ef74889748b8666c1076bcbac619d7271c84c2c5aba5b2580c28b75e337fe601cf535810e8df4dad
- SSDEEP 1536:1EGh0oFlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oFlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{925D4033-C38C-417f-B08C-A79F97442FB4}.exe
- Size 168KB
- SHA256 41e43237304d13dde71a513506aa0e0b46a382ca8e58361f731738aeda5ed6bf
- MD5 1152cccdd290174b4869e499bd2cf88e
- SHA1 447c25f4cd63bef750cf7acfa84a4b47bf82bdb6
- SHA512 1cd09371d027df9247b538b652b34ad80ec466620353b79cc7f3b1707d7d4c98107c447dcc73375eabed8426fca9a9b6999beb4f7af64805bab959c16f63b98d
- SSDEEP 1536:1EGh0oqlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oqlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A14EF2BF-E2DE-4673-8E34-AA6B0E888B50}.exe
- Size 168KB
- SHA256 5c672584a1edf84ce822a4812b3ba8b7bd3644f3b565f9506da6b531454e7e66
- MD5 0ae59c5edc481bd1ac7bf4edfcfdac7d
- SHA1 db80528b7e4bd58a7ccc46c197c225b4ebf12db2
- SHA512 7f4716f26a822fa0748f5dd255fc6d940d3b86e46fa799560ac4e240c447d0d489ed2fef048a4e802e80af5879773c2064f27c93187c99fb24cd9ca4a519342a
- SSDEEP 1536:1EGh0oulq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oulqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A4139F93-21AB-4d63-A50E-356D11FCB7F5}.exe
- Size 168KB
- SHA256 0866403b04803fc82aec925a2677ad030a03b1d8c3ac92012d9fb5cac4e22e2b
- MD5 a5a85cb1cf0b45daf8c723c480b2054b
- SHA1 9303743bc4fec400176e4eb54a8ef3def2d00f89
- SHA512 5bf99bf48535e5cf455e3188b580dbf34c0c844e897539f530caac83362c5bb1bd13e1bdb08a9c1634e2f6347e34fc854d0c568f2930d8c04abf005878bacac0
- SSDEEP 1536:1EGh0oolq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oolqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B242489E-8F49-4ded-97EC-6C7D0A95BB2D}.exe
- Size 168KB
- SHA256 c856d4ede4f07ea78a16decfc57371f87e6b517a0476a249801b387195a32532
- MD5 284aef9d0f675a2f7a4da3d115a389f1
- SHA1 ebd26e357ea2a43875b15982646d84e241d43a7c
- SHA512 16ee622a54e2bf00e86596ff804b06377df1192c234af9fcefd3af4c79e8de8b6384d2f90e4a10ee2f69f091b0e429dec17e56b8eef11a91f61aca777e2a5583
- SSDEEP 1536:1EGh0o4lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o4lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B4D9EB4A-E5E3-4735-A24A-052FC6458D75}.exe
- Size 168KB
- SHA256 4e1abd5bc266082de5870f48821b60398260563182b4af68954d820f4a6e302b
- MD5 dfdec1c292d9490628b110bb17ca53f7
- SHA1 d59e9de8ad897196b644e6ef38a2472661118742
- SHA512 461fec351926e4253e882e3de88c302badd6dc9190630f52f47148f312f2528a15b197f81d0f3cd097edce22b74a4916edbaeed81a4726334bb9c1e801477ddf
- SSDEEP 1536:1EGh0oClq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oClqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CE0AAD66-0265-4e1a-A397-7346BDAADE61}.exe
- Size 168KB
- SHA256 a6f23a1c487a48d5cceee0e9ae1913088eae8584264a046b29ac2d49af6eba14
- MD5 411ca15ef6ac3688ec42f16aab85091f
- SHA1 d8e6ae5184cd3a5ac3568752cf96d240c50815a2
- SHA512 b3b73701852f0c8de117abf41b9cb26e6faaa2c2a743763268d470decf1e49ff733e9acfd0862d530cfea1c0b51bf2d69a902a2bc448f75d480fd7b2a9356f4a
- SSDEEP 1536:1EGh0onlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0onlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D47350AC-9E4C-4760-9F5E-760EEC68A87D}.exe
- Size 168KB
- SHA256 d5c6b6f9c7b6c4afeb23393339ca0e292c79776118f02332470812b646d50035
- MD5 a12fa9b481b21b7c66bb102a4a219048
- SHA1 ee9184f06dba9282dd14eb2ce668bbbd513a6af8
- SHA512 37dd44a37373604a5030b89671dc676eb12ebdfad48e1f98655f04dc33cbcba87f5d772e4107fc15303062223a130a5531e654df69989f04e2e7ce37e869d73c
- SSDEEP 1536:1EGh0oTlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oTlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F2251C18-41A3-4e34-9442-50812344BEF1}.exe
- Size 168KB
- SHA256 6ca4f7a6fd71270c8ced142c29882aebcab086c96a56bf280938613d79ea7d17
- MD5 b438b4cedd9741330b2228544f400ef0
- SHA1 cd713add8f4ae19e8da8946679926776d3918e2a
- SHA512 6094de2a829a84924beed53e2f37ac7145c5e603935a141b4f7dbd13eba6b16e388877f9b8f6f064348e4ffa6671e041d1e026e5eab947864b45a924bd7ca3b7
- SSDEEP 1536:1EGh0o0lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o0lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP