Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe
- Size 380KB
- Sample240611-pyf53axfpr
- SHA256 a7dc4b7114a31c705c3d8ea3d98346ede3ad48f840fef3415ad094198282d1a8
- MD5 020f64fef60741eb89a29fb2671972b0
- SHA1 16f3041da628768532d883c15e53c3856dd126e5
- SHA512 5fac02fe8ac00b52b86b257fcd41a31787a3c697bf01aa81670b71089b36e3d6f333ab688b63247113caf3e03833a77a375db206899de6d2759dde2a273a0d6e
- SSDEEP 3072:mEGh0oqlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGIl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x000700000002325e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002326e-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000022ff2-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e00000002325e-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000022ff2-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219e9-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070f-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000026-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000500000000070d-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360} {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360}\stubpath = "C:\\Windows\\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe" {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D} 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC441ACC-3629-407f-8C20-227925B6BC1A} {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC441ACC-3629-407f-8C20-227925B6BC1A}\stubpath = "C:\\Windows\\{AC441ACC-3629-407f-8C20-227925B6BC1A}.exe" {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13}\stubpath = "C:\\Windows\\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe" {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F27A14C5-E13E-44ba-923B-710A926D55B4} {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90252768-D4C8-47e4-80B1-81D49137D819}\stubpath = "C:\\Windows\\{90252768-D4C8-47e4-80B1-81D49137D819}.exe" {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{176EF86D-C628-463a-88E0-93E174AFD129}\stubpath = "C:\\Windows\\{176EF86D-C628-463a-88E0-93E174AFD129}.exe" {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF3EE874-B057-4212-AB16-5519F157353B}\stubpath = "C:\\Windows\\{EF3EE874-B057-4212-AB16-5519F157353B}.exe" {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}\stubpath = "C:\\Windows\\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe" {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13} {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F27A14C5-E13E-44ba-923B-710A926D55B4}\stubpath = "C:\\Windows\\{F27A14C5-E13E-44ba-923B-710A926D55B4}.exe" {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90252768-D4C8-47e4-80B1-81D49137D819} {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441}\stubpath = "C:\\Windows\\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe" {176EF86D-C628-463a-88E0-93E174AFD129}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF3EE874-B057-4212-AB16-5519F157353B} {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F} {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD} {EF3EE874-B057-4212-AB16-5519F157353B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD}\stubpath = "C:\\Windows\\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe" {EF3EE874-B057-4212-AB16-5519F157353B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D}\stubpath = "C:\\Windows\\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe" 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{176EF86D-C628-463a-88E0-93E174AFD129} {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441} {176EF86D-C628-463a-88E0-93E174AFD129}.exe - Executes dropped EXE 11 IoCs
pid Process 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 3828 {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe 2412 {90252768-D4C8-47e4-80B1-81D49137D819}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe File created C:\Windows\{176EF86D-C628-463a-88E0-93E174AFD129}.exe {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe File created C:\Windows\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe {176EF86D-C628-463a-88E0-93E174AFD129}.exe File created C:\Windows\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe {EF3EE874-B057-4212-AB16-5519F157353B}.exe File created C:\Windows\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe File created C:\Windows\{90252768-D4C8-47e4-80B1-81D49137D819}.exe {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe File created C:\Windows\{EF3EE874-B057-4212-AB16-5519F157353B}.exe {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe File created C:\Windows\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe File created C:\Windows\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe File created C:\Windows\{F27A14C5-E13E-44ba-923B-710A926D55B4}.exe {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe File created C:\Windows\{AC441ACC-3629-407f-8C20-227925B6BC1A}.exe {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe Token: SeIncBasePriorityPrivilege 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe Token: SeIncBasePriorityPrivilege 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe Token: SeIncBasePriorityPrivilege 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe Token: SeIncBasePriorityPrivilege 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe Token: SeIncBasePriorityPrivilege 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe Token: SeIncBasePriorityPrivilege 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe Token: SeIncBasePriorityPrivilege 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe Token: SeIncBasePriorityPrivilege 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe Token: SeIncBasePriorityPrivilege 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe Token: SeIncBasePriorityPrivilege 3828 {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 380 wrote to memory of 4936 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe 91 PID 380 wrote to memory of 4936 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe 91 PID 380 wrote to memory of 4936 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe 91 PID 380 wrote to memory of 4700 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe 92 PID 380 wrote to memory of 4700 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe 92 PID 380 wrote to memory of 4700 380 2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe 92 PID 4936 wrote to memory of 1628 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 101 PID 4936 wrote to memory of 1628 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 101 PID 4936 wrote to memory of 1628 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 101 PID 4936 wrote to memory of 4576 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 102 PID 4936 wrote to memory of 4576 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 102 PID 4936 wrote to memory of 4576 4936 {D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe 102 PID 1628 wrote to memory of 4308 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 103 PID 1628 wrote to memory of 4308 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 103 PID 1628 wrote to memory of 4308 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 103 PID 1628 wrote to memory of 2236 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 104 PID 1628 wrote to memory of 2236 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 104 PID 1628 wrote to memory of 2236 1628 {176EF86D-C628-463a-88E0-93E174AFD129}.exe 104 PID 4308 wrote to memory of 4760 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 106 PID 4308 wrote to memory of 4760 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 106 PID 4308 wrote to memory of 4760 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 106 PID 4308 wrote to memory of 3996 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 107 PID 4308 wrote to memory of 3996 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 107 PID 4308 wrote to memory of 3996 4308 {81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe 107 PID 4760 wrote to memory of 1180 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 108 PID 4760 wrote to memory of 1180 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 108 PID 4760 wrote to memory of 1180 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 108 PID 4760 wrote to memory of 976 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 109 PID 4760 wrote to memory of 976 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 109 PID 4760 wrote to memory of 976 4760 {EF3EE874-B057-4212-AB16-5519F157353B}.exe 109 PID 1180 wrote to memory of 4584 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 110 PID 1180 wrote to memory of 4584 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 110 PID 1180 wrote to memory of 4584 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 110 PID 1180 wrote to memory of 4212 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 111 PID 1180 wrote to memory of 4212 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 111 PID 1180 wrote to memory of 4212 1180 {97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe 111 PID 4584 wrote to memory of 1980 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 112 PID 4584 wrote to memory of 1980 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 112 PID 4584 wrote to memory of 1980 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 112 PID 4584 wrote to memory of 2148 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 113 PID 4584 wrote to memory of 2148 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 113 PID 4584 wrote to memory of 2148 4584 {61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe 113 PID 1980 wrote to memory of 1524 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 114 PID 1980 wrote to memory of 1524 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 114 PID 1980 wrote to memory of 1524 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 114 PID 1980 wrote to memory of 4984 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 115 PID 1980 wrote to memory of 4984 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 115 PID 1980 wrote to memory of 4984 1980 {C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe 115 PID 1524 wrote to memory of 2772 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 116 PID 1524 wrote to memory of 2772 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 116 PID 1524 wrote to memory of 2772 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 116 PID 1524 wrote to memory of 4920 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 117 PID 1524 wrote to memory of 4920 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 117 PID 1524 wrote to memory of 4920 1524 {F27A14C5-E13E-44ba-923B-710A926D55B4}.exe 117 PID 2772 wrote to memory of 3828 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 118 PID 2772 wrote to memory of 3828 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 118 PID 2772 wrote to memory of 3828 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 118 PID 2772 wrote to memory of 2480 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 119 PID 2772 wrote to memory of 2480 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 119 PID 2772 wrote to memory of 2480 2772 {AC441ACC-3629-407f-8C20-227925B6BC1A}.exe 119 PID 3828 wrote to memory of 2412 3828 {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe 120 PID 3828 wrote to memory of 2412 3828 {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe 120 PID 3828 wrote to memory of 2412 3828 {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe 120 PID 3828 wrote to memory of 5024 3828 {86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_020f64fef60741eb89a29fb2671972b0_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exeC:\Windows\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\{176EF86D-C628-463a-88E0-93E174AFD129}.exeC:\Windows\{176EF86D-C628-463a-88E0-93E174AFD129}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exeC:\Windows\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\{EF3EE874-B057-4212-AB16-5519F157353B}.exeC:\Windows\{EF3EE874-B057-4212-AB16-5519F157353B}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exeC:\Windows\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exeC:\Windows\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exeC:\Windows\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\{F27A14C5-E13E-44ba-923B-710A926D55B4}.exeC:\Windows\{F27A14C5-E13E-44ba-923B-710A926D55B4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\{AC441ACC-3629-407f-8C20-227925B6BC1A}.exeC:\Windows\{AC441ACC-3629-407f-8C20-227925B6BC1A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exeC:\Windows\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\{90252768-D4C8-47e4-80B1-81D49137D819}.exeC:\Windows\{90252768-D4C8-47e4-80B1-81D49137D819}.exe12⤵
- Executes dropped EXE
PID:2412
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86FC9~1.EXE > nul12⤵PID:5024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC441~1.EXE > nul11⤵PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F27A1~1.EXE > nul10⤵PID:4920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2A86~1.EXE > nul9⤵PID:4984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61BFA~1.EXE > nul8⤵PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97E18~1.EXE > nul7⤵PID:4212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF3EE~1.EXE > nul6⤵PID:976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81D54~1.EXE > nul5⤵PID:3996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{176EF~1.EXE > nul4⤵PID:2236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D27B4~1.EXE > nul3⤵PID:4576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{176EF86D-C628-463a-88E0-93E174AFD129}.exe
- Size 380KB
- SHA256 54be6ed0dbd752f1fb8f2d6a03244174a0b5e281fe2af8ba3eff2e45704f8325
- MD5 490f0b3c883e5c90ec536be001207ed6
- SHA1 66ba3ad3a2a09cae4fc101b18dc20e88fc29c830
- SHA512 7b18db1924af80f35e0dd0b86fd8072eb93dd4d84f24abf9b67764a5661d46d28ef649d032c706009325d633d2b770da5fb04d1f2d599f4b080f301742bd29a9
- SSDEEP 3072:mEGh0oJlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGrl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{61BFA0B3-13B2-4a2e-BFD2-C05041699A8F}.exe
- Size 380KB
- SHA256 e2f0a7bf1eb2ca535eee602182a5e4f91d9f48e2c643dc31f4b46a74cfaaba3c
- MD5 be77d17a02a8c9901edc533bbe695860
- SHA1 8fc9b015c5b5f48b80828e12a05c990c5b2b5ffb
- SHA512 8036afe9cad36a7ed838cfc4e5d0232d66a50d83f8c0b5f8920015f5a8c640a35ab99153eed0f91d97e6c9797bc6d63038bcb69a0ebb4a49521300493202a019
- SSDEEP 3072:mEGh0oLlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGVl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{81D54F06-3121-4d8d-8E8D-F1AA41D1A441}.exe
- Size 380KB
- SHA256 0e0fc58f120ad0f49438109b69bbd6fc518231b0b23035d38f71e890293c44e9
- MD5 9d5e1883267e28b2bf0aaa3299e2238f
- SHA1 e8821fc848ebf99baa52eaad645e9ba3b9e268bd
- SHA512 00229d64d307b014fa9dfa24934c3a8fac97068b02b0af5e5f9f895ecfbdfe1d5e9ce204f8cd7b4e212da642e814944dfb964a38b48c6645d574f8de5b2681b7
- SSDEEP 3072:mEGh0ovlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG5l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{86FC94A8-56D7-44c8-8BB8-147FCF2AB360}.exe
- Size 380KB
- SHA256 9249525a0a814e3f2084583625eb75b5cc3f472e36d520209d9b1a28f64312b6
- MD5 aa0ccb9bc9f5e1e7d3b8833a55fffc77
- SHA1 d48687ef011b11a49809a6a1b29904a823e9c4ce
- SHA512 c487f9da247b7df0fe62ea59694b0d918a795e9de14eacadf579341a767cd807420585ffdaddc99e0530cf9c5272f8da5f9dcb9a5acb01133d22f400c4b6f6af
- SSDEEP 3072:mEGh0oxlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGHl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{90252768-D4C8-47e4-80B1-81D49137D819}.exe
- Size 380KB
- SHA256 1e55eae7c61bd363140530dba5da46adbec1b2c417c9dbd00263f54a9c3d60c4
- MD5 01b6a09335a5480df95fe2a7a42b5dd9
- SHA1 d51d767fafd382d8603c8f9942d1deeee113aa6b
- SHA512 1eff9cdeeaeab670b54c48f02e722bd694685e6ba091723cb1a333353adb1d16cd9f79fe3766a2c0875540414d3115de45f870c336a0e6677eae1c1056f71e51
- SSDEEP 3072:mEGh0oclPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGWl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{97E1858A-7CC2-49b8-929C-E009C8ABEDCD}.exe
- Size 380KB
- SHA256 5588b6f750e1ce1d8a5f7798b87b41753037a57e5fdf978823bb8c452a3cfb36
- MD5 b3865997622a17380f3d459fd5abc380
- SHA1 d0e44db90cade2627d0ad2f2215744017675485c
- SHA512 30f5d296a37d23c0a16ca4ebeb17cef27fd2ef689d11a8ec6e42adffcc9984aca6826452d68b2a94db28ca1c4e96de5741aec49193517768425e5ad0a08b2c34
- SSDEEP 3072:mEGh0oTlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGFl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AC441ACC-3629-407f-8C20-227925B6BC1A}.exe
- Size 380KB
- SHA256 86cccd9365a94dffb0afbef4c5da432820807e63657b203f73615cdfefc91dbb
- MD5 473649e5e7b98ddcd4c0edcad9deb503
- SHA1 12e2810915364416cc2ec4ef5c18792efebb65c5
- SHA512 8e05019843a502127d71c7b26d6c72bad1d26d5e1bb8d3ef14b683cae974073bdffe75884d4837bd83e293e9635ba2918c6f0c00e80a50bfee49384938310287
- SSDEEP 3072:mEGh0oalPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGwl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2A861BF-A5D4-42ff-8629-F1CFAA202D13}.exe
- Size 380KB
- SHA256 c5a0e9b763c44588f2d3e9c30342b2c748dd27525d97d754b5d61f3a4b910ddc
- MD5 3d1cf335e2ccfa79e8a8672cbc2ce778
- SHA1 f7e9ce934d2a8c5a83ab1121f40082792bd38488
- SHA512 345ed15e4b4045731136eca521fec5399da9c2461992e4bffe5dcd6dbd5d4bf3259eb5c492f9b853af31c224e7f19ddedadd7de6589ab744f88cbdd7420afd73
- SSDEEP 3072:mEGh0oElPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGal7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D27B4619-7F03-4a67-8DC1-F677C8E37F8D}.exe
- Size 380KB
- SHA256 aa658271e8c5cf49d7240adc9dbff068225bc056036e538b31186fca77ee6ce3
- MD5 a8cd464cb9fb8d7b08c979369374ef24
- SHA1 b1c2efccd8051e82b4d29f5418d13b43d696acc9
- SHA512 293f90a1183591531ff464b0e015bd6b703c6186b1a4467eac55a66afbae34c5da5ef58333e4bdaeb4a82f9dd4621e218a16b8475e4b4bb74b110f6c5cfb8f97
- SSDEEP 3072:mEGh0oPlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGll7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF3EE874-B057-4212-AB16-5519F157353B}.exe
- Size 380KB
- SHA256 f55e0bbaf52a3127d1943d48a4908ffe69130c3938abafbd05f9f8f25dc222f6
- MD5 7f3bae76c23a0e67e2c7e2721a95ad8f
- SHA1 f6b7894f70b802eaecca4c7919cc41d5b6fe4efd
- SHA512 43afb4394a6ef4b424017f13ef215e42cc8427885428d6cf59686bf85ee1aae402104fb3941a10f089e865d75b22505b31b673f67e59f0a5dcc8b10bdb264035
- SSDEEP 3072:mEGh0oclPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGSl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F27A14C5-E13E-44ba-923B-710A926D55B4}.exe
- Size 380KB
- SHA256 7ff33c7b59886b84a7d767dfd5745af8a08cc5d55aed3bc061b9f05198bd3a5d
- MD5 cdd55c94576d9bd61267c0bc309a4c05
- SHA1 6d108c472b467bf88838f5de6f3d7a008da78d9f
- SHA512 444fd0f542462c276f8d94b490eb696234630923177ce40df8624435a8d3ec83485983a194744d5c56e8d2cc057b900ab24c8f614596dceacc933fab24ce9ff1
- SSDEEP 3072:mEGh0oslPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGOl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP