Analysis
- max time kernel
144s - max time network
123s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
11/06/2024, 12:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe
- Size 380KB
- Sample240611-py2f1axclc
- SHA256 4011c8a50303f70e093bb529a7adf6ead5a9780a4506c0bcd1d7d178f4465b31
- MD5 89bf2642ec55f90a437a897262e3ef24
- SHA1 0165f91fbc76e81268663d52f3cd025d4d4d1666
- SHA512 6bce4254ccc6d4be0de8ec508736a085b88838cb5db7b7dd3ae86eed74a55e4e55bfd7e92191f701ba1eb480c6ca900b17cf83c3de9b2714ab238d1794a2a0ea
- SSDEEP 3072:mEGh0odlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG7l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000c000000013417-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0036000000013a53-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000013417-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0036000000013a88-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000013417-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000013417-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0010000000013417-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B699EBF-2388-475f-AF86-742B04F6E033} {BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1669602A-A8BD-4732-A122-49648D5EB300}\stubpath = "C:\\Windows\\{1669602A-A8BD-4732-A122-49648D5EB300}.exe" 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C72BE10B-AD2D-4904-A844-86A4D498ABA1}\stubpath = "C:\\Windows\\{C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe" {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C598A698-0353-46e2-9551-8B94A60C22D6} {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}\stubpath = "C:\\Windows\\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe" {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1669602A-A8BD-4732-A122-49648D5EB300} 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5614824-DFC1-47b6-95E6-2B1E130717E3} {1669602A-A8BD-4732-A122-49648D5EB300}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5614824-DFC1-47b6-95E6-2B1E130717E3}\stubpath = "C:\\Windows\\{D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe" {1669602A-A8BD-4732-A122-49648D5EB300}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C598A698-0353-46e2-9551-8B94A60C22D6}\stubpath = "C:\\Windows\\{C598A698-0353-46e2-9551-8B94A60C22D6}.exe" {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5818F907-6AFA-4609-8489-4E2331AC97A1} {C598A698-0353-46e2-9551-8B94A60C22D6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5818F907-6AFA-4609-8489-4E2331AC97A1}\stubpath = "C:\\Windows\\{5818F907-6AFA-4609-8489-4E2331AC97A1}.exe" {C598A698-0353-46e2-9551-8B94A60C22D6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2} {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D496217E-A0D7-421e-B373-2E5A0565DD34}\stubpath = "C:\\Windows\\{D496217E-A0D7-421e-B373-2E5A0565DD34}.exe" {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B699EBF-2388-475f-AF86-742B04F6E033}\stubpath = "C:\\Windows\\{5B699EBF-2388-475f-AF86-742B04F6E033}.exe" {BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13B0A042-2C16-453d-968A-C9E12ED32081} {5B699EBF-2388-475f-AF86-742B04F6E033}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C72BE10B-AD2D-4904-A844-86A4D498ABA1} {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D496217E-A0D7-421e-B373-2E5A0565DD34} {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{015B009C-D01B-4fc7-8638-1247AE1D9B73} {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{015B009C-D01B-4fc7-8638-1247AE1D9B73}\stubpath = "C:\\Windows\\{015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe" {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F} {015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F}\stubpath = "C:\\Windows\\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe" {015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13B0A042-2C16-453d-968A-C9E12ED32081}\stubpath = "C:\\Windows\\{13B0A042-2C16-453d-968A-C9E12ED32081}.exe" {5B699EBF-2388-475f-AF86-742B04F6E033}.exe - Deletes itself 1 IoCs
pid Process 2568 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 328 {015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe 1480 {BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe 2244 {5B699EBF-2388-475f-AF86-742B04F6E033}.exe 2112 {13B0A042-2C16-453d-968A-C9E12ED32081}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe {1669602A-A8BD-4732-A122-49648D5EB300}.exe File created C:\Windows\{C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe File created C:\Windows\{5818F907-6AFA-4609-8489-4E2331AC97A1}.exe {C598A698-0353-46e2-9551-8B94A60C22D6}.exe File created C:\Windows\{D496217E-A0D7-421e-B373-2E5A0565DD34}.exe {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe File created C:\Windows\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe {015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe File created C:\Windows\{1669602A-A8BD-4732-A122-49648D5EB300}.exe 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe File created C:\Windows\{C598A698-0353-46e2-9551-8B94A60C22D6}.exe {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe File created C:\Windows\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe File created C:\Windows\{015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe File created C:\Windows\{5B699EBF-2388-475f-AF86-742B04F6E033}.exe {BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe File created C:\Windows\{13B0A042-2C16-453d-968A-C9E12ED32081}.exe {5B699EBF-2388-475f-AF86-742B04F6E033}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe Token: SeIncBasePriorityPrivilege 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe Token: SeIncBasePriorityPrivilege 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe Token: SeIncBasePriorityPrivilege 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe Token: SeIncBasePriorityPrivilege 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe Token: SeIncBasePriorityPrivilege 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe Token: SeIncBasePriorityPrivilege 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe Token: SeIncBasePriorityPrivilege 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe Token: SeIncBasePriorityPrivilege 328 {015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe Token: SeIncBasePriorityPrivilege 1480 {BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe Token: SeIncBasePriorityPrivilege 2244 {5B699EBF-2388-475f-AF86-742B04F6E033}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2372 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 28 PID 1508 wrote to memory of 2372 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 28 PID 1508 wrote to memory of 2372 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 28 PID 1508 wrote to memory of 2372 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 28 PID 1508 wrote to memory of 2568 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 29 PID 1508 wrote to memory of 2568 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 29 PID 1508 wrote to memory of 2568 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 29 PID 1508 wrote to memory of 2568 1508 2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe 29 PID 2372 wrote to memory of 1952 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 30 PID 2372 wrote to memory of 1952 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 30 PID 2372 wrote to memory of 1952 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 30 PID 2372 wrote to memory of 1952 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 30 PID 2372 wrote to memory of 1728 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 31 PID 2372 wrote to memory of 1728 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 31 PID 2372 wrote to memory of 1728 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 31 PID 2372 wrote to memory of 1728 2372 {1669602A-A8BD-4732-A122-49648D5EB300}.exe 31 PID 1952 wrote to memory of 2724 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 32 PID 1952 wrote to memory of 2724 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 32 PID 1952 wrote to memory of 2724 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 32 PID 1952 wrote to memory of 2724 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 32 PID 1952 wrote to memory of 2480 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 33 PID 1952 wrote to memory of 2480 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 33 PID 1952 wrote to memory of 2480 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 33 PID 1952 wrote to memory of 2480 1952 {D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe 33 PID 2724 wrote to memory of 1844 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 36 PID 2724 wrote to memory of 1844 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 36 PID 2724 wrote to memory of 1844 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 36 PID 2724 wrote to memory of 1844 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 36 PID 2724 wrote to memory of 1344 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 37 PID 2724 wrote to memory of 1344 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 37 PID 2724 wrote to memory of 1344 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 37 PID 2724 wrote to memory of 1344 2724 {C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe 37 PID 1844 wrote to memory of 2668 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 38 PID 1844 wrote to memory of 2668 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 38 PID 1844 wrote to memory of 2668 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 38 PID 1844 wrote to memory of 2668 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 38 PID 1844 wrote to memory of 2016 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 39 PID 1844 wrote to memory of 2016 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 39 PID 1844 wrote to memory of 2016 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 39 PID 1844 wrote to memory of 2016 1844 {C598A698-0353-46e2-9551-8B94A60C22D6}.exe 39 PID 2668 wrote to memory of 1960 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 40 PID 2668 wrote to memory of 1960 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 40 PID 2668 wrote to memory of 1960 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 40 PID 2668 wrote to memory of 1960 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 40 PID 2668 wrote to memory of 2024 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 41 PID 2668 wrote to memory of 2024 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 41 PID 2668 wrote to memory of 2024 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 41 PID 2668 wrote to memory of 2024 2668 {5818F907-6AFA-4609-8489-4E2331AC97A1}.exe 41 PID 1960 wrote to memory of 1568 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 42 PID 1960 wrote to memory of 1568 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 42 PID 1960 wrote to memory of 1568 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 42 PID 1960 wrote to memory of 1568 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 42 PID 1960 wrote to memory of 988 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 43 PID 1960 wrote to memory of 988 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 43 PID 1960 wrote to memory of 988 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 43 PID 1960 wrote to memory of 988 1960 {0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe 43 PID 1568 wrote to memory of 328 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 44 PID 1568 wrote to memory of 328 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 44 PID 1568 wrote to memory of 328 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 44 PID 1568 wrote to memory of 328 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 44 PID 1568 wrote to memory of 1240 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 45 PID 1568 wrote to memory of 1240 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 45 PID 1568 wrote to memory of 1240 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 45 PID 1568 wrote to memory of 1240 1568 {D496217E-A0D7-421e-B373-2E5A0565DD34}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_89bf2642ec55f90a437a897262e3ef24_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\{1669602A-A8BD-4732-A122-49648D5EB300}.exeC:\Windows\{1669602A-A8BD-4732-A122-49648D5EB300}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\{D5614824-DFC1-47b6-95E6-2B1E130717E3}.exeC:\Windows\{D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\{C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exeC:\Windows\{C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\{C598A698-0353-46e2-9551-8B94A60C22D6}.exeC:\Windows\{C598A698-0353-46e2-9551-8B94A60C22D6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\{5818F907-6AFA-4609-8489-4E2331AC97A1}.exeC:\Windows\{5818F907-6AFA-4609-8489-4E2331AC97A1}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exeC:\Windows\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\{D496217E-A0D7-421e-B373-2E5A0565DD34}.exeC:\Windows\{D496217E-A0D7-421e-B373-2E5A0565DD34}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\{015B009C-D01B-4fc7-8638-1247AE1D9B73}.exeC:\Windows\{015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:328 -
C:\Windows\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exeC:\Windows\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Windows\{5B699EBF-2388-475f-AF86-742B04F6E033}.exeC:\Windows\{5B699EBF-2388-475f-AF86-742B04F6E033}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\{13B0A042-2C16-453d-968A-C9E12ED32081}.exeC:\Windows\{13B0A042-2C16-453d-968A-C9E12ED32081}.exe12⤵
- Executes dropped EXE
PID:2112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B699~1.EXE > nul12⤵PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFE52~1.EXE > nul11⤵PID:676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{015B0~1.EXE > nul10⤵PID:108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4962~1.EXE > nul9⤵PID:1240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A959~1.EXE > nul8⤵PID:988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5818F~1.EXE > nul7⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C598A~1.EXE > nul6⤵PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C72BE~1.EXE > nul5⤵PID:1344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5614~1.EXE > nul4⤵PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16696~1.EXE > nul3⤵PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{015B009C-D01B-4fc7-8638-1247AE1D9B73}.exe
- Size 380KB
- SHA256 d0fa880dc21212697c2c832bc359daaf72439333a89d2104867aeb029c690f8a
- MD5 cf8aaa0809c8fd08180bd3116036e4a0
- SHA1 cd196c0eb58365f7fc8bcf31041ef97d695eaab4
- SHA512 1898e171a3b5da3b31a666dfcd45add066a501ce817609ad876cb49529cc52035add0104661d8f74e42fcb3423363f2a41e1e9589a71f17f76aecee098289c3c
- SSDEEP 3072:mEGh0oUlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG2l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{0A9597DE-B65F-4981-AFC6-7C011BDEDFE2}.exe
- Size 380KB
- SHA256 c4ee5cb2711eac46f1fb702afa65131a160d382cd3a1146e8a0fe49258630bfa
- MD5 5c24b46abd091cdca108718cfb197221
- SHA1 d4d69b0bf8e73162743da2b1b68402e7a9c39ce3
- SHA512 8aae75282b88e87492c601eb572cb38f53b64d9319979102d9c372dd7e25004df5ba2645374c24348ae7d2714f2af81beb7d765c53bffaef2845f0ec7e55a4ae
- SSDEEP 3072:mEGh0oxlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGHl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{13B0A042-2C16-453d-968A-C9E12ED32081}.exe
- Size 380KB
- SHA256 91960c586238d53f713a42a841580f68b5553ca245c057400e874bb9c4fb8ff4
- MD5 68601ff716b8276e7367728c69bd0233
- SHA1 feff381739f9461172b50c6d4f54cfdbe0c00f4f
- SHA512 887195f828a733edd73621e43ad722cfa168ea828530e4025e7845d8f57e5de30a3717c9579a5847193bf77eb5b8ba8e9a25adea6016fc2c234c220a0836aaf4
- SSDEEP 3072:mEGh0oslPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGSl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1669602A-A8BD-4732-A122-49648D5EB300}.exe
- Size 380KB
- SHA256 812bf6c4cabd296436bca50a9982ebe5440bcadd6c98d912a6948474bebcda73
- MD5 328ce8774ce325c41e6283423fa7da81
- SHA1 c8aff75d0e5d1873137ad5da46fc4df88ec9acbb
- SHA512 5ba7267446fa3a8fc5d638fc6d02d060a8e5c7be780344d1da723bceffac068e5e8a8be166123a869203dc980155321de53325d5687193630f65521e1a7760ba
- SSDEEP 3072:mEGh0oolPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGql7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5818F907-6AFA-4609-8489-4E2331AC97A1}.exe
- Size 380KB
- SHA256 efa922a105e0b90181e059a58eb7edea0fee7ee47bc70587fe1949bf7ae1c035
- MD5 9a26ff409d6de71edfe82cbc9938ec2e
- SHA1 cfe2646fa7aa6568fbd6a3084847d93445ac4fa6
- SHA512 89b3c9a78b0566b788418e67139655b5ccb0f2a5be352c6310117e10d751620bb2d7e70bda72dfc0d2775870745d47ee7649a8316317ce985f55c89d09487bd1
- SSDEEP 3072:mEGh0oolPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGGl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5B699EBF-2388-475f-AF86-742B04F6E033}.exe
- Size 380KB
- SHA256 215ccdd4deaaab9c279115c3b730ff4b852bbc599ce33ecb492262e4d1ccf116
- MD5 4a3cbfc0a0c6be5da9453ac1ab0b84fb
- SHA1 8fc083b9e07b2b7cb7f22634bce4b40d68724068
- SHA512 cb4cb64cc3145c481cb0b8334199a2bf9f66f2cbd11ee9966b18844a0efcd709a22a494383fe0f3355830da92ed37c62093edcefefe8359af2d4b287c0cd0cdb
- SSDEEP 3072:mEGh0oOlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGol7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BFE52A31-CD3F-4728-AB8B-740848B8FB7F}.exe
- Size 380KB
- SHA256 7d9d020eef63b68459793ae305a0443625c95f29bea2561955df2f1b382fb9ef
- MD5 702680447f8ef8ae454d22f38d468495
- SHA1 cc575ef6bbf963220d2593e627882914e4b2c4b5
- SHA512 d5b167cc07875a03c930855fd433b0be41f8329ece50ac223275feead533cba7e6340beaae29b8c9ecb8c9848125c9aeb0bc9cd722b2b59bd05c2959001979fa
- SSDEEP 3072:mEGh0o5lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGLl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C598A698-0353-46e2-9551-8B94A60C22D6}.exe
- Size 380KB
- SHA256 143a057e1f95ee072720df8cbba997d38beaf67c6ce7601d691edfbb1e55c899
- MD5 f411d22c7ee324b3f11430151552ba05
- SHA1 fcd5847720a5089d6546d56b8031d7bc8f5971f8
- SHA512 13bb570ac21e2edd5706e3995aa34f6b7723aa364ff2c907cf287de79c1a6ccbca237972a2848891b8e2294bd8813c1dfbda5fc446498b9d971e16d70f196604
- SSDEEP 3072:mEGh0oQlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG+l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C72BE10B-AD2D-4904-A844-86A4D498ABA1}.exe
- Size 380KB
- SHA256 d524abb176c97e88d48f90ad2a946b0baac216f08f9ce92816749f8a12bb79fd
- MD5 bfd9e7405d8d27457b09034faaa9f98f
- SHA1 cfda941cfef13e54c862a17e4939907e83058530
- SHA512 da18462274004ced770011a697310dc1ccac33d64b816ecbffd6fb09cfa17cae4d972635acccf549d3955892421a82b01c5d499631f7c1cb0640ff1131636e18
- SSDEEP 3072:mEGh0oSlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGol7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D496217E-A0D7-421e-B373-2E5A0565DD34}.exe
- Size 380KB
- SHA256 3ac9e92ab6df3f070507d770b26008af6e52700ef332cd7d7120546ee7c938e8
- MD5 e727462b9f1bb5d7bee7ad20cabfa30d
- SHA1 e786b9390fc5363c035b40213c89199df54bea6c
- SHA512 919a45f913fe8373e23a039aec0eb241efde045276664afebf2ab38f5b87f29f839bd4623f43c5564190ac8316530d9e09f886ef5f7f4e49bcc517bb934b3b7e
- SSDEEP 3072:mEGh0oblPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGpl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D5614824-DFC1-47b6-95E6-2B1E130717E3}.exe
- Size 380KB
- SHA256 42484c898ddc982662965dc2b9f00d0cc94bfcc1c2796a90a57e0917765e118e
- MD5 5e4156934cdba32213f2d5f23a0d821c
- SHA1 a396ea5b0eb90bf6f882f784ff948b21cf3c4194
- SHA512 c123ab02c8a2ecf6083fee3f7bd38af6649d0e25717327a6449c8be4a07796b06c6c6831042bbfc1f28df4bed755f48d8581658484144ef97bfefb9715bd4bda
- SSDEEP 3072:mEGh0oLlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGRl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP