Analysis
- max time kernel
144s - max time network
124s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
10/06/2024, 04:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe
- Size 204KB
- Sample240610-elvskscd98
- SHA256 4fdabd6e806b9991daebeed55e7b68c577ad4c27854aad8272943823be4d4448
- MD5 3056e2c7b5cd79e6935a0bd11157a1f4
- SHA1 992c550f667d9ef1cb2b25db1773d7e3ccde0e23
- SHA512 89ea4de13097957a44d1d7e4d5452743e5f55ca66e77ce0536c52ed227398f6989f0ab39b956e06b9b69e6f24d73e3c73b803ba171fc0583d0f63321f77580bb
- SSDEEP 1536:1EGh0oyl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oyl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b0000000155e2-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0014000000015c2f-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f00000000f680-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0015000000015c2f-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015c52-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0016000000015c2f-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000015c5d-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0017000000015c2f-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015c5d-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0018000000015c2f-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000015c69-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9236487-A75C-40c3-ACB8-CF50DEE92784} {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95C0510F-F26D-4f71-9455-7D082EE262A4}\stubpath = "C:\\Windows\\{95C0510F-F26D-4f71-9455-7D082EE262A4}.exe" {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09B6143F-57E2-4827-9295-87ED5C123A33}\stubpath = "C:\\Windows\\{09B6143F-57E2-4827-9295-87ED5C123A33}.exe" {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB82CFF6-12FD-421b-BBD4-530298245BE7} {09B6143F-57E2-4827-9295-87ED5C123A33}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB82CFF6-12FD-421b-BBD4-530298245BE7}\stubpath = "C:\\Windows\\{DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe" {09B6143F-57E2-4827-9295-87ED5C123A33}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0} {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0}\stubpath = "C:\\Windows\\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe" {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}\stubpath = "C:\\Windows\\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe" {DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75} {B3908300-4D84-41c8-B89B-731EF03F220A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75}\stubpath = "C:\\Windows\\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75}.exe" {B3908300-4D84-41c8-B89B-731EF03F220A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95C0510F-F26D-4f71-9455-7D082EE262A4} {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E}\stubpath = "C:\\Windows\\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe" {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B35BB9E1-ECF1-4da7-A529-227701F03CB1} 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09B6143F-57E2-4827-9295-87ED5C123A33} {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E} {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5} {DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3908300-4D84-41c8-B89B-731EF03F220A} {B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3908300-4D84-41c8-B89B-731EF03F220A}\stubpath = "C:\\Windows\\{B3908300-4D84-41c8-B89B-731EF03F220A}.exe" {B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B35BB9E1-ECF1-4da7-A529-227701F03CB1}\stubpath = "C:\\Windows\\{B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe" 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9236487-A75C-40c3-ACB8-CF50DEE92784}\stubpath = "C:\\Windows\\{C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe" {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705} {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705}\stubpath = "C:\\Windows\\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe" {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe - Deletes itself 1 IoCs
pid Process 2488 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 1296 {DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe 2212 {B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe 2728 {B3908300-4D84-41c8-B89B-731EF03F220A}.exe 792 {B9A35C45-0BF2-49f7-9ECA-2449145B2C75}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75}.exe {B3908300-4D84-41c8-B89B-731EF03F220A}.exe File created C:\Windows\{C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe File created C:\Windows\{95C0510F-F26D-4f71-9455-7D082EE262A4}.exe {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe File created C:\Windows\{09B6143F-57E2-4827-9295-87ED5C123A33}.exe {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe File created C:\Windows\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe File created C:\Windows\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe File created C:\Windows\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe {DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe File created C:\Windows\{B3908300-4D84-41c8-B89B-731EF03F220A}.exe {B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe File created C:\Windows\{B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe File created C:\Windows\{DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe {09B6143F-57E2-4827-9295-87ED5C123A33}.exe File created C:\Windows\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe Token: SeIncBasePriorityPrivilege 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe Token: SeIncBasePriorityPrivilege 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe Token: SeIncBasePriorityPrivilege 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe Token: SeIncBasePriorityPrivilege 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe Token: SeIncBasePriorityPrivilege 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe Token: SeIncBasePriorityPrivilege 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe Token: SeIncBasePriorityPrivilege 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe Token: SeIncBasePriorityPrivilege 1296 {DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe Token: SeIncBasePriorityPrivilege 2212 {B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe Token: SeIncBasePriorityPrivilege 2728 {B3908300-4D84-41c8-B89B-731EF03F220A}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1396 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 28 PID 1500 wrote to memory of 1396 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 28 PID 1500 wrote to memory of 1396 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 28 PID 1500 wrote to memory of 1396 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 28 PID 1500 wrote to memory of 2488 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 29 PID 1500 wrote to memory of 2488 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 29 PID 1500 wrote to memory of 2488 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 29 PID 1500 wrote to memory of 2488 1500 2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe 29 PID 1396 wrote to memory of 2756 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 32 PID 1396 wrote to memory of 2756 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 32 PID 1396 wrote to memory of 2756 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 32 PID 1396 wrote to memory of 2756 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 32 PID 1396 wrote to memory of 2732 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 33 PID 1396 wrote to memory of 2732 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 33 PID 1396 wrote to memory of 2732 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 33 PID 1396 wrote to memory of 2732 1396 {B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe 33 PID 2756 wrote to memory of 2400 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 34 PID 2756 wrote to memory of 2400 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 34 PID 2756 wrote to memory of 2400 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 34 PID 2756 wrote to memory of 2400 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 34 PID 2756 wrote to memory of 2444 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 35 PID 2756 wrote to memory of 2444 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 35 PID 2756 wrote to memory of 2444 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 35 PID 2756 wrote to memory of 2444 2756 {C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe 35 PID 2400 wrote to memory of 2844 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 36 PID 2400 wrote to memory of 2844 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 36 PID 2400 wrote to memory of 2844 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 36 PID 2400 wrote to memory of 2844 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 36 PID 2400 wrote to memory of 556 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 37 PID 2400 wrote to memory of 556 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 37 PID 2400 wrote to memory of 556 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 37 PID 2400 wrote to memory of 556 2400 {95C0510F-F26D-4f71-9455-7D082EE262A4}.exe 37 PID 2844 wrote to memory of 636 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 38 PID 2844 wrote to memory of 636 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 38 PID 2844 wrote to memory of 636 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 38 PID 2844 wrote to memory of 636 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 38 PID 2844 wrote to memory of 572 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 39 PID 2844 wrote to memory of 572 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 39 PID 2844 wrote to memory of 572 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 39 PID 2844 wrote to memory of 572 2844 {09B6143F-57E2-4827-9295-87ED5C123A33}.exe 39 PID 636 wrote to memory of 2384 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 40 PID 636 wrote to memory of 2384 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 40 PID 636 wrote to memory of 2384 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 40 PID 636 wrote to memory of 2384 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 40 PID 636 wrote to memory of 2688 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 41 PID 636 wrote to memory of 2688 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 41 PID 636 wrote to memory of 2688 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 41 PID 636 wrote to memory of 2688 636 {DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe 41 PID 2384 wrote to memory of 616 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 42 PID 2384 wrote to memory of 616 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 42 PID 2384 wrote to memory of 616 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 42 PID 2384 wrote to memory of 616 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 42 PID 2384 wrote to memory of 1172 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 43 PID 2384 wrote to memory of 1172 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 43 PID 2384 wrote to memory of 1172 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 43 PID 2384 wrote to memory of 1172 2384 {81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe 43 PID 616 wrote to memory of 1296 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 44 PID 616 wrote to memory of 1296 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 44 PID 616 wrote to memory of 1296 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 44 PID 616 wrote to memory of 1296 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 44 PID 616 wrote to memory of 1100 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 45 PID 616 wrote to memory of 1100 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 45 PID 616 wrote to memory of 1100 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 45 PID 616 wrote to memory of 1100 616 {7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_3056e2c7b5cd79e6935a0bd11157a1f4_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\{B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exeC:\Windows\{B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\{C9236487-A75C-40c3-ACB8-CF50DEE92784}.exeC:\Windows\{C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\{95C0510F-F26D-4f71-9455-7D082EE262A4}.exeC:\Windows\{95C0510F-F26D-4f71-9455-7D082EE262A4}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\{09B6143F-57E2-4827-9295-87ED5C123A33}.exeC:\Windows\{09B6143F-57E2-4827-9295-87ED5C123A33}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\{DB82CFF6-12FD-421b-BBD4-530298245BE7}.exeC:\Windows\{DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exeC:\Windows\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exeC:\Windows\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exeC:\Windows\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exeC:\Windows\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\{B3908300-4D84-41c8-B89B-731EF03F220A}.exeC:\Windows\{B3908300-4D84-41c8-B89B-731EF03F220A}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Windows\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75}.exeC:\Windows\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75}.exe12⤵
- Executes dropped EXE
PID:792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3908~1.EXE > nul12⤵PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B10CD~1.EXE > nul11⤵PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDE58~1.EXE > nul10⤵PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FD9C~1.EXE > nul9⤵PID:1100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81DA1~1.EXE > nul8⤵PID:1172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB82C~1.EXE > nul7⤵PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09B61~1.EXE > nul6⤵PID:572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95C05~1.EXE > nul5⤵PID:556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9236~1.EXE > nul4⤵PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B35BB~1.EXE > nul3⤵PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{09B6143F-57E2-4827-9295-87ED5C123A33}.exe
- Size 204KB
- SHA256 89901e7da8ba02bd48054a8b0be36c84e663c9661393854ace91243670df7860
- MD5 e79531659c924d3e3d2cb5ede3c250cc
- SHA1 c1ba829002f9d81d1ab2428b89d02387be1a4143
- SHA512 15f3c495fda1e3b247e596a03451e27ceabc57c0d3b648ff8e89164f956b9bdc9f7f232ce17f620aaa19634532e29c14e6b9f73c6032905279d5cb73ccd57e91
- SSDEEP 1536:1EGh0ofl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0ofl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7FD9CF0D-A328-4cb3-9353-E64B29894D6E}.exe
- Size 204KB
- SHA256 ada57b74b9fdd29c9ff2cbcfc5985532f32772c9188400ad4d9a7e4c5c1eb015
- MD5 3b25e7f062d3ad9298682e17474e3d0b
- SHA1 7215ed3178e41cead97d44c42acfaa762bf3a345
- SHA512 656d43fa66b58bd1cdafa8619e157093f030eb85208d36058f2c68c3254bb7ca204c21c6e243b4f256b472e13cfac958d8157687ae5f42e0c7dce8bdd3facfc5
- SSDEEP 1536:1EGh0o1Ll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o5l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{81DA15CB-DFA5-4b92-8383-C82EEB6DD705}.exe
- Size 204KB
- SHA256 e58a7bec2b0abfa132434a2bc49205cf01015b9e92fda57b1ea5cd4868300dad
- MD5 2f7c85bb65001ee1a3b8393c816bc11b
- SHA1 9f21f09413110b09a37a41934934222031ca818e
- SHA512 435bfa42f9a29bbbb2c9feb58a480d5d6a4611018ba80a7ec247eaa92e0445d6c76ab89100f72098da8898be968df96f1127937caa3f9e962f44cf95bd9b4185
- SSDEEP 1536:1EGh0oPl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oPl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{95C0510F-F26D-4f71-9455-7D082EE262A4}.exe
- Size 204KB
- SHA256 294384657187582855d02d4f9eca559cceee5cd6683e1df48ea4d8366fa039de
- MD5 902e3c98b3ad622477e550249c8c86a2
- SHA1 e455f90d03542d6097015b389b69ba1c2b2df5a6
- SHA512 d1706f78a894353593f73112f7d12e7e2c625c0d0044bdcc3731f69868f791e62fdb4ea3341d5617d8f4cf6948b32712d8ed6d9d6540bd51052f3be10226039a
- SSDEEP 1536:1EGh0oql15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oql1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B10CD9E5-A3E2-4b2e-B233-9C35D3BBA4E5}.exe
- Size 204KB
- SHA256 6bcb55c17243e2eab73975aee6cfa0cf732c1b7eaf3f5a4f6a8f278285055942
- MD5 e164e23fa9c13243dea9860d14050c7e
- SHA1 5b4be3d256c8eba3013cb391990f66b0e932c686
- SHA512 1897d9cf4877267a184dad082b317d89d555c4e95d8f1391948ae9acdec629bb3d93f5c4bff7628becb67b39a226ed35a50883f40c14dfb6add06406ca8a9d2b
- SSDEEP 1536:1EGh0o3l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o3l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B35BB9E1-ECF1-4da7-A529-227701F03CB1}.exe
- Size 204KB
- SHA256 d90ab80763b32d5070d2f02b4ef4d9aabdff96fa551cf9dacc2774ac85ee8379
- MD5 fcfc937fb6283bd1a8b1263d4bfaa66a
- SHA1 b5b39b8665ae01753a6369b3000e5cc79f8319a2
- SHA512 6b3e0c67aebfbabbb890999badbb27cf4df239acbf05e511e4cc6c6583466e627cb0dd2dce39a5135a7c30c21dbe4b143281cb059ad1787111960bdb587ee521
- SSDEEP 1536:1EGh0o1l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o1l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B3908300-4D84-41c8-B89B-731EF03F220A}.exe
- Size 204KB
- SHA256 07f8ef251aa4a83ebc9f758918ce3357f1664ea6d9c9fe1afdad32c306ca8436
- MD5 191f367a56589348b67f4c542f1f4b62
- SHA1 9fc803cfdd6e83d6976ca874ead80c5ebadd3e36
- SHA512 242890d2039ac84f18c5a6e272c61a0f55a8a532fefb5757640a48e9694e4390b8d8b9ec607f67981c91bc49865a237a39da29fe4082c02d22b9794cb0c6d189
- SSDEEP 1536:1EGh0oGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oGl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B9A35C45-0BF2-49f7-9ECA-2449145B2C75}.exe
- Size 204KB
- SHA256 fa1e05fb6177c10aaad34bb64fcd5000f723a781d71f6e9407b072aed48fc27b
- MD5 b8f2a1cde2c887e44e02bda206d4074c
- SHA1 dcced61926bcf7fae4177ddd5a0043ff3373f988
- SHA512 82dbba1bdbb67fa5d4f484e0bf975e160310879cdfa6a0619d68e950f365080e4a547f325585056fc3165574939f599add4b9768b11e241684dfbf7da46e4535
- SSDEEP 1536:1EGh0owl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0owl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C9236487-A75C-40c3-ACB8-CF50DEE92784}.exe
- Size 204KB
- SHA256 3cb358c72dcbe06307a77245f84c05bf06bf724c6d3a3bdd64ea285d225c371b
- MD5 5de18d543f680f589058b010bc0710fc
- SHA1 9010777508d0586c01a653123ac7ca45facacaee
- SHA512 4d1bcd4228fcdf536c4eebf145fe37561aaacb1829af2fcb1f36f6ea6ade9651ace446822a5b4c55d58b8785dbb1c014a18012402e4bd9a2749c6be498c2dc82
- SSDEEP 1536:1EGh0o0l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o0l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DB82CFF6-12FD-421b-BBD4-530298245BE7}.exe
- Size 204KB
- SHA256 a910919b337d9b4be358facdf7211d99b00b9b9070eb0720c859a9fae93c915a
- MD5 7d9390f07a9fc451d187addee213589e
- SHA1 98c98dd8f36aa63692deb38184564b6a74cf3269
- SHA512 06f0d88cbb4ce960b15a64d3eb108ca177070d921b33d0bcfb9c9dae3bc95444a9c0a26aa80a63128bbd812072ca9b93fa3ae85fb8315d5871b976ee6c32f332
- SSDEEP 1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o5l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DDE588DD-703C-41a7-B5AC-590D6D4C27E0}.exe
- Size 204KB
- SHA256 d91fcf91b52aa5a37d3eec111cca691c0b82f18aeae83fcba53eae20577ff12c
- MD5 aeb0bfd763833a3d45f2fd78d33c12de
- SHA1 da392132135e7960d00863c1d61086433bdcd84b
- SHA512 e222680668411e36a46eae2376feb81ff113aecab52bb38107c83c552db725a00ca95a07b4d4c6738604c8fdbdf257034e3c0cd50ef3a52dfd5635ca781a88b5
- SSDEEP 1536:1EGh0okl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0okl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP