Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/04/2024, 03:30
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe
- Size 372KB
- Sample240419-d2mw8sfd96
- SHA256 8984dcfc99b0d1896591d7fd9a7c29ede8f3290a47d3bfbb63216753dc835537
- MD5 17d2601bc0354ea0c7d2298f20eeac3c
- SHA1 ba4b7502f1be462b964094061b07a789847d8d03
- SHA512 2d4fa1a922b243e930db15eda34d464aee136a88c6f4033cf0512eb1a3f69a8bcde156a6c87636add22aab42c2c812d70ff5e742a405eca81126dda67a561a79
- SSDEEP 3072:CEGh0ovlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGBlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x0007000000023267-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023274-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023277-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023274-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023277-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000016fa5-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070f-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000026-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000500000000070d-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A331ACC4-D120-4e49-B3D0-F3A36C02287A}\stubpath = "C:\\Windows\\{A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe" {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0472CBEE-6AF3-4e61-87CA-275EF167B741} {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2C418C-6CE7-474f-9C09-16728331B4E9} {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A331ACC4-D120-4e49-B3D0-F3A36C02287A} {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D}\stubpath = "C:\\Windows\\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe" {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}\stubpath = "C:\\Windows\\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe" {7619B68E-B290-476b-AA72-90F9DBED1786}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95} {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}\stubpath = "C:\\Windows\\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe" {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2C418C-6CE7-474f-9C09-16728331B4E9}\stubpath = "C:\\Windows\\{1A2C418C-6CE7-474f-9C09-16728331B4E9}.exe" {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D} {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{876CAE70-09DA-4501-AC24-0D47701B3205}\stubpath = "C:\\Windows\\{876CAE70-09DA-4501-AC24-0D47701B3205}.exe" 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7619B68E-B290-476b-AA72-90F9DBED1786} {C5925668-5281-409c-8BF1-398513AF41FD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7619B68E-B290-476b-AA72-90F9DBED1786}\stubpath = "C:\\Windows\\{7619B68E-B290-476b-AA72-90F9DBED1786}.exe" {C5925668-5281-409c-8BF1-398513AF41FD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A} {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}\stubpath = "C:\\Windows\\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe" {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{876CAE70-09DA-4501-AC24-0D47701B3205} 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABDDDA00-D40C-4739-91B0-2A596360930E}\stubpath = "C:\\Windows\\{ABDDDA00-D40C-4739-91B0-2A596360930E}.exe" {876CAE70-09DA-4501-AC24-0D47701B3205}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5925668-5281-409c-8BF1-398513AF41FD} {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5925668-5281-409c-8BF1-398513AF41FD}\stubpath = "C:\\Windows\\{C5925668-5281-409c-8BF1-398513AF41FD}.exe" {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5} {7619B68E-B290-476b-AA72-90F9DBED1786}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0472CBEE-6AF3-4e61-87CA-275EF167B741}\stubpath = "C:\\Windows\\{0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe" {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABDDDA00-D40C-4739-91B0-2A596360930E} {876CAE70-09DA-4501-AC24-0D47701B3205}.exe - Executes dropped EXE 11 IoCs
pid Process 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 4700 {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe 4692 {1A2C418C-6CE7-474f-9C09-16728331B4E9}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{C5925668-5281-409c-8BF1-398513AF41FD}.exe {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe File created C:\Windows\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe {7619B68E-B290-476b-AA72-90F9DBED1786}.exe File created C:\Windows\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe File created C:\Windows\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe File created C:\Windows\{0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe File created C:\Windows\{1A2C418C-6CE7-474f-9C09-16728331B4E9}.exe {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe File created C:\Windows\{876CAE70-09DA-4501-AC24-0D47701B3205}.exe 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe File created C:\Windows\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe File created C:\Windows\{7619B68E-B290-476b-AA72-90F9DBED1786}.exe {C5925668-5281-409c-8BF1-398513AF41FD}.exe File created C:\Windows\{A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe File created C:\Windows\{ABDDDA00-D40C-4739-91B0-2A596360930E}.exe {876CAE70-09DA-4501-AC24-0D47701B3205}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe Token: SeIncBasePriorityPrivilege 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe Token: SeIncBasePriorityPrivilege 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe Token: SeIncBasePriorityPrivilege 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe Token: SeIncBasePriorityPrivilege 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe Token: SeIncBasePriorityPrivilege 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe Token: SeIncBasePriorityPrivilege 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe Token: SeIncBasePriorityPrivilege 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe Token: SeIncBasePriorityPrivilege 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe Token: SeIncBasePriorityPrivilege 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe Token: SeIncBasePriorityPrivilege 4700 {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 3520 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe 96 PID 2252 wrote to memory of 3520 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe 96 PID 2252 wrote to memory of 3520 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe 96 PID 2252 wrote to memory of 4412 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe 97 PID 2252 wrote to memory of 4412 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe 97 PID 2252 wrote to memory of 4412 2252 2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe 97 PID 3520 wrote to memory of 3804 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 101 PID 3520 wrote to memory of 3804 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 101 PID 3520 wrote to memory of 3804 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 101 PID 3520 wrote to memory of 3788 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 102 PID 3520 wrote to memory of 3788 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 102 PID 3520 wrote to memory of 3788 3520 {876CAE70-09DA-4501-AC24-0D47701B3205}.exe 102 PID 3804 wrote to memory of 4704 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 103 PID 3804 wrote to memory of 4704 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 103 PID 3804 wrote to memory of 4704 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 103 PID 3804 wrote to memory of 5008 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 104 PID 3804 wrote to memory of 5008 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 104 PID 3804 wrote to memory of 5008 3804 {ABDDDA00-D40C-4739-91B0-2A596360930E}.exe 104 PID 4704 wrote to memory of 968 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 106 PID 4704 wrote to memory of 968 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 106 PID 4704 wrote to memory of 968 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 106 PID 4704 wrote to memory of 3560 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 107 PID 4704 wrote to memory of 3560 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 107 PID 4704 wrote to memory of 3560 4704 {8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe 107 PID 968 wrote to memory of 3812 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 108 PID 968 wrote to memory of 3812 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 108 PID 968 wrote to memory of 3812 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 108 PID 968 wrote to memory of 1004 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 109 PID 968 wrote to memory of 1004 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 109 PID 968 wrote to memory of 1004 968 {C5925668-5281-409c-8BF1-398513AF41FD}.exe 109 PID 3812 wrote to memory of 5004 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 110 PID 3812 wrote to memory of 5004 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 110 PID 3812 wrote to memory of 5004 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 110 PID 3812 wrote to memory of 4132 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 111 PID 3812 wrote to memory of 4132 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 111 PID 3812 wrote to memory of 4132 3812 {7619B68E-B290-476b-AA72-90F9DBED1786}.exe 111 PID 5004 wrote to memory of 4536 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 112 PID 5004 wrote to memory of 4536 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 112 PID 5004 wrote to memory of 4536 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 112 PID 5004 wrote to memory of 4148 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 113 PID 5004 wrote to memory of 4148 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 113 PID 5004 wrote to memory of 4148 5004 {5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe 113 PID 4536 wrote to memory of 2224 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 114 PID 4536 wrote to memory of 2224 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 114 PID 4536 wrote to memory of 2224 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 114 PID 4536 wrote to memory of 3596 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 115 PID 4536 wrote to memory of 3596 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 115 PID 4536 wrote to memory of 3596 4536 {8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe 115 PID 2224 wrote to memory of 3888 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 116 PID 2224 wrote to memory of 3888 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 116 PID 2224 wrote to memory of 3888 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 116 PID 2224 wrote to memory of 1392 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 117 PID 2224 wrote to memory of 1392 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 117 PID 2224 wrote to memory of 1392 2224 {BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe 117 PID 3888 wrote to memory of 4700 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 118 PID 3888 wrote to memory of 4700 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 118 PID 3888 wrote to memory of 4700 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 118 PID 3888 wrote to memory of 3568 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 119 PID 3888 wrote to memory of 3568 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 119 PID 3888 wrote to memory of 3568 3888 {A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe 119 PID 4700 wrote to memory of 4692 4700 {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe 120 PID 4700 wrote to memory of 4692 4700 {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe 120 PID 4700 wrote to memory of 4692 4700 {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe 120 PID 4700 wrote to memory of 1612 4700 {0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_17d2601bc0354ea0c7d2298f20eeac3c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\{876CAE70-09DA-4501-AC24-0D47701B3205}.exeC:\Windows\{876CAE70-09DA-4501-AC24-0D47701B3205}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\{ABDDDA00-D40C-4739-91B0-2A596360930E}.exeC:\Windows\{ABDDDA00-D40C-4739-91B0-2A596360930E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exeC:\Windows\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\{C5925668-5281-409c-8BF1-398513AF41FD}.exeC:\Windows\{C5925668-5281-409c-8BF1-398513AF41FD}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\{7619B68E-B290-476b-AA72-90F9DBED1786}.exeC:\Windows\{7619B68E-B290-476b-AA72-90F9DBED1786}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exeC:\Windows\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exeC:\Windows\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exeC:\Windows\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\{A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exeC:\Windows\{A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\{0472CBEE-6AF3-4e61-87CA-275EF167B741}.exeC:\Windows\{0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\{1A2C418C-6CE7-474f-9C09-16728331B4E9}.exeC:\Windows\{1A2C418C-6CE7-474f-9C09-16728331B4E9}.exe12⤵
- Executes dropped EXE
PID:4692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0472C~1.EXE > nul12⤵PID:1612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A331A~1.EXE > nul11⤵PID:3568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE186~1.EXE > nul10⤵PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CDC9~1.EXE > nul9⤵PID:3596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F8FC~1.EXE > nul8⤵PID:4148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7619B~1.EXE > nul7⤵PID:4132
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5925~1.EXE > nul6⤵PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EE48~1.EXE > nul5⤵PID:3560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABDDD~1.EXE > nul4⤵PID:5008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{876CA~1.EXE > nul3⤵PID:3788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:2112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0472CBEE-6AF3-4e61-87CA-275EF167B741}.exe
- Size 372KB
- SHA256 7ed63cf646ec0fa10f6295d1a6feff22273d6eeea1c93fc6e04bc9c98383d3ce
- MD5 b52d0efdd5272f757d0f9ae6745423be
- SHA1 8beb09fc5dd9fb75f3d9191e5ed27e2570fc6893
- SHA512 4f5837c6327004ad5decd32ced3bf263fa8b4452bcfd51546930b93f1aa1f3977363adbc4aacc280ea2b3fc13561d6b626032e2112fc08bf593857898ccb2bf7
- SSDEEP 3072:CEGh0oOlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGQlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1A2C418C-6CE7-474f-9C09-16728331B4E9}.exe
- Size 372KB
- SHA256 25dcefdef9b76856fa9e8129497d4d16f6dbedb2096116d4e8d513f57aeb6cc4
- MD5 78443acddbcfe6b322e7bb023df27516
- SHA1 664f688cd52f76ba781e1bb2294da3444a739b10
- SHA512 350dd6f235a2449b57affe197aad31634b6435960e9fe4f48cb2900d0fd756720a061a255e34d82dd61853900cd0e13ec3f50b40ab6a914ec191bbd0a26764f1
- SSDEEP 3072:CEGh0ollMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGflkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5F8FC4B7-DFFD-4b52-A2F3-9F1615E50DA5}.exe
- Size 372KB
- SHA256 7d25c4e0e1be225c6c70d9dd6909134677f9203744f98e09f13b11e20469bcb8
- MD5 b040a1444dd88ff765810de1cbb596b8
- SHA1 403f12b9c1cb29eabbcd486c6474b4f41b3363d4
- SHA512 3856a9b45f2d295674d6b4d592e874069bd310cf6247f02042daf24e40d159972d5dad9e113ec15d338559ae0784a3ed1b97d14347acaf08b1588c7aba0cff1c
- SSDEEP 3072:CEGh0o+lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGMlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7619B68E-B290-476b-AA72-90F9DBED1786}.exe
- Size 372KB
- SHA256 6d9a6a4ddac38e8d07cdecc8b2c1343deda28ca992fba49a8edde59e7daac766
- MD5 9fcd49c0912d45d45a24a80b80497efe
- SHA1 f0454df5e5e13648b69962ab300ccb5c36e20d04
- SHA512 22389c79aba85846de1efc335522357343e4f215079eb559b446993861cb46747592fc86b07990fef63b3531122173dd9b72ecfecdccf6b98417a61fa331c1ef
- SSDEEP 3072:CEGh0oSlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGclkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{876CAE70-09DA-4501-AC24-0D47701B3205}.exe
- Size 372KB
- SHA256 1e4a6133cde10992e33f00a1718fe41eafaf9bc4e81c5d852927e00858649b1b
- MD5 1f726885d10586467419060c9fa045ed
- SHA1 2eacfe6677b21b3c149ac5842f06127cc9091a87
- SHA512 5f321f834a9467e46d82c460dcb40df62e6ea885e4c6f8968caddc791fa8ff74c25c6000bfaed2404bef0f6cd2a1f504fdf8b76ab3bee63935b9f7e78ab445fd
- SSDEEP 3072:CEGh0omlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGIlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8CDC9DAE-A6EF-44b4-9846-3EEF84A7913A}.exe
- Size 372KB
- SHA256 b03be2a9197f0d55de25f5d89e45a2d2e177715996a29cab01319634ebea54d5
- MD5 19e6278b2a0392265403b1d96c7ee3e9
- SHA1 7dd616d4607f198c4d81b7f7442eeac448ee8588
- SHA512 ecc92b62b7b610eb6397f5d6edc54b8e807fe89ffdc759509779b85a46e8b2638f2b86e717796e84f9f06caa080f8830d2e20c50896bed7f9e78a64d0b9d57fa
- SSDEEP 3072:CEGh0oLlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGJlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8EE48124-CC03-4015-B8B1-4B8FA501EA7D}.exe
- Size 372KB
- SHA256 580cd67c9ce23da469644e0e7fb553c314fe5a6c9449e30ef30d760cc8373b4c
- MD5 3f36b516d37f80946fd22708ef332030
- SHA1 9d9a5382a8954b84f4f04b63b04d84a07aa4e1cd
- SHA512 7d902f6f2141b3ae9563c9a350bd653148ba9b32be773353159eaef91763ce7f6bba6913ef1e397bb86598a77836e2423ac021d358a7e1eed788170f970d7287
- SSDEEP 3072:CEGh0oflMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGplkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A331ACC4-D120-4e49-B3D0-F3A36C02287A}.exe
- Size 372KB
- SHA256 1c25afb1ab9051d6ebcf0f1afc319509bb740b1c5e1fb676cf303b88ee6a28e7
- MD5 49d7e1412e9de56c60163fcc3b161509
- SHA1 b85a47fe69f5bcd7ae350481bc8a10ac3225c4b6
- SHA512 66cdfb5837bcbca02657816e97a46d8e92c2a71e15d0cc176d58e7b0fe173c749a194ccfdacd25d3f7ad047fdebdf588136bbd565c7ed81d923e2d8861d641a6
- SSDEEP 3072:CEGh0orlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGllkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ABDDDA00-D40C-4739-91B0-2A596360930E}.exe
- Size 372KB
- SHA256 4b8150854605c33732210ad9da265d59e8000444373e27dede8c99964c9fc612
- MD5 db75201f651854f9c9c5433d2f54455a
- SHA1 d8e842237610465a78345347678b0912b99f7ca6
- SHA512 807c7a1e0c67f5baadf3bcd271c238c507c53d6e6125c4190c27d4be6ef77c0bcd649342c06204bc29583533e20ceeafadec86fd5aee7859628adf147c118b5c
- SSDEEP 3072:CEGh0oplMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGHlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BE1863CE-6AB8-439a-9992-EFDB4E8EDF95}.exe
- Size 372KB
- SHA256 5ce183b773752d735d261055a8600cbd35583dce2eb99a853bf3c5e29d8a001f
- MD5 8a1a0b4940c45f10198244c922501dea
- SHA1 f1b0ea41d0b7a9261b00b12297b69b785933ce76
- SHA512 c6d30125034069501dde6743abd5a65a8a8707212c55fa924d63e03ddf4272a4e1a22cff16d0161d0b4ac1f74c8256603a7e19cd1d773bc2d27e489b80bb2357
- SSDEEP 3072:CEGh0oVlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGvlkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C5925668-5281-409c-8BF1-398513AF41FD}.exe
- Size 372KB
- SHA256 647a3e9dbed31b0ed2a3bbc811c86693158eadcb0e5628add3e8c7482f56a586
- MD5 7370e264c4b86e4373cc262162369bb0
- SHA1 1ffcb135e4299af9625cf119b360ad54ba611429
- SHA512 95ea2bee265efbf7ca5acb1a4c7f582b54e6ce57aa7e1ba8776225b306acf3a8d3cbd2bddf898c8d53f6cea488ee2a3bc51a41ec3764ea6afe3ae64ff98ca288
- SSDEEP 3072:CEGh0oOlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGElkOe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP