Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 13:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe
- Size 192KB
- Sample240611-qagmcsybll
- SHA256 4366f252914d24a785b3eaefd26cef844f44db321aa4a6e88d4556e4c06aebc5
- MD5 f6b5164b46afb0b588a3b2682bb91666
- SHA1 dc7f5f40aa575875f904875cb23c1cbe3b1f2f84
- SHA512 05f89ba88b9af2d46d0cd3dc2d407885998d02d5e521c42b1aa518594910cbf996fd76fe7afb2799150d16e8273956700aa4992f3e14ee84e062c3b452b2fa45
- SSDEEP 1536:1EGh0odl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0odl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0011000000023410-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023415-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002341b-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023415-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fbd-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fbe-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021fbd-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00030000000006df-45.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B} {AC49C922-4DAE-4660-B303-BB299419C027}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA} {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA}\stubpath = "C:\\Windows\\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe" {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC}\stubpath = "C:\\Windows\\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe" {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45557D1C-E480-46ea-A7D2-24CEECE49BB3}\stubpath = "C:\\Windows\\{45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe" {36D7C925-101B-41ee-8993-406E49ED443A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCE6D289-4154-4dd8-B039-66E94056C74F}\stubpath = "C:\\Windows\\{FCE6D289-4154-4dd8-B039-66E94056C74F}.exe" 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}\stubpath = "C:\\Windows\\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe" {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8446A88-508E-4836-9085-DF7EF04E4471}\stubpath = "C:\\Windows\\{C8446A88-508E-4836-9085-DF7EF04E4471}.exe" {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71821069-88EA-48f6-A19C-67051417AEA6}\stubpath = "C:\\Windows\\{71821069-88EA-48f6-A19C-67051417AEA6}.exe" {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36D7C925-101B-41ee-8993-406E49ED443A} {71821069-88EA-48f6-A19C-67051417AEA6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36D7C925-101B-41ee-8993-406E49ED443A}\stubpath = "C:\\Windows\\{36D7C925-101B-41ee-8993-406E49ED443A}.exe" {71821069-88EA-48f6-A19C-67051417AEA6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC49C922-4DAE-4660-B303-BB299419C027}\stubpath = "C:\\Windows\\{AC49C922-4DAE-4660-B303-BB299419C027}.exe" {C8446A88-508E-4836-9085-DF7EF04E4471}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}\stubpath = "C:\\Windows\\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe" {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71821069-88EA-48f6-A19C-67051417AEA6} {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4} {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45557D1C-E480-46ea-A7D2-24CEECE49BB3} {36D7C925-101B-41ee-8993-406E49ED443A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E} {45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCE6D289-4154-4dd8-B039-66E94056C74F} 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477} {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8446A88-508E-4836-9085-DF7EF04E4471} {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E}\stubpath = "C:\\Windows\\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E}.exe" {45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC49C922-4DAE-4660-B303-BB299419C027} {C8446A88-508E-4836-9085-DF7EF04E4471}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}\stubpath = "C:\\Windows\\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe" {AC49C922-4DAE-4660-B303-BB299419C027}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC} {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe - Executes dropped EXE 12 IoCs
pid Process 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 4732 {36D7C925-101B-41ee-8993-406E49ED443A}.exe 3872 {45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe 2268 {8057CE78-586D-4f24-BDCC-B8AB1C527F7E}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{AC49C922-4DAE-4660-B303-BB299419C027}.exe {C8446A88-508E-4836-9085-DF7EF04E4471}.exe File created C:\Windows\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe File created C:\Windows\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe File created C:\Windows\{71821069-88EA-48f6-A19C-67051417AEA6}.exe {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe File created C:\Windows\{45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe {36D7C925-101B-41ee-8993-406E49ED443A}.exe File created C:\Windows\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe File created C:\Windows\{C8446A88-508E-4836-9085-DF7EF04E4471}.exe {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe File created C:\Windows\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe {AC49C922-4DAE-4660-B303-BB299419C027}.exe File created C:\Windows\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe File created C:\Windows\{36D7C925-101B-41ee-8993-406E49ED443A}.exe {71821069-88EA-48f6-A19C-67051417AEA6}.exe File created C:\Windows\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E}.exe {45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe File created C:\Windows\{FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe Token: SeIncBasePriorityPrivilege 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe Token: SeIncBasePriorityPrivilege 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe Token: SeIncBasePriorityPrivilege 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe Token: SeIncBasePriorityPrivilege 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe Token: SeIncBasePriorityPrivilege 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe Token: SeIncBasePriorityPrivilege 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe Token: SeIncBasePriorityPrivilege 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe Token: SeIncBasePriorityPrivilege 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe Token: SeIncBasePriorityPrivilege 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe Token: SeIncBasePriorityPrivilege 4732 {36D7C925-101B-41ee-8993-406E49ED443A}.exe Token: SeIncBasePriorityPrivilege 3872 {45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 4560 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe 90 PID 2284 wrote to memory of 4560 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe 90 PID 2284 wrote to memory of 4560 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe 90 PID 2284 wrote to memory of 3232 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe 91 PID 2284 wrote to memory of 3232 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe 91 PID 2284 wrote to memory of 3232 2284 2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe 91 PID 4560 wrote to memory of 848 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 92 PID 4560 wrote to memory of 848 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 92 PID 4560 wrote to memory of 848 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 92 PID 4560 wrote to memory of 3804 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 93 PID 4560 wrote to memory of 3804 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 93 PID 4560 wrote to memory of 3804 4560 {FCE6D289-4154-4dd8-B039-66E94056C74F}.exe 93 PID 848 wrote to memory of 4820 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 95 PID 848 wrote to memory of 4820 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 95 PID 848 wrote to memory of 4820 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 95 PID 848 wrote to memory of 3204 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 96 PID 848 wrote to memory of 3204 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 96 PID 848 wrote to memory of 3204 848 {70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe 96 PID 4820 wrote to memory of 556 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 97 PID 4820 wrote to memory of 556 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 97 PID 4820 wrote to memory of 556 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 97 PID 4820 wrote to memory of 2192 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 98 PID 4820 wrote to memory of 2192 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 98 PID 4820 wrote to memory of 2192 4820 {C8446A88-508E-4836-9085-DF7EF04E4471}.exe 98 PID 556 wrote to memory of 1740 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 99 PID 556 wrote to memory of 1740 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 99 PID 556 wrote to memory of 1740 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 99 PID 556 wrote to memory of 1748 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 100 PID 556 wrote to memory of 1748 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 100 PID 556 wrote to memory of 1748 556 {AC49C922-4DAE-4660-B303-BB299419C027}.exe 100 PID 1740 wrote to memory of 1656 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 101 PID 1740 wrote to memory of 1656 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 101 PID 1740 wrote to memory of 1656 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 101 PID 1740 wrote to memory of 4024 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 102 PID 1740 wrote to memory of 4024 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 102 PID 1740 wrote to memory of 4024 1740 {C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe 102 PID 1656 wrote to memory of 2876 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 103 PID 1656 wrote to memory of 2876 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 103 PID 1656 wrote to memory of 2876 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 103 PID 1656 wrote to memory of 3612 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 104 PID 1656 wrote to memory of 3612 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 104 PID 1656 wrote to memory of 3612 1656 {27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe 104 PID 2876 wrote to memory of 1892 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 105 PID 2876 wrote to memory of 1892 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 105 PID 2876 wrote to memory of 1892 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 105 PID 2876 wrote to memory of 1712 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 106 PID 2876 wrote to memory of 1712 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 106 PID 2876 wrote to memory of 1712 2876 {6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe 106 PID 1892 wrote to memory of 2276 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 107 PID 1892 wrote to memory of 2276 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 107 PID 1892 wrote to memory of 2276 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 107 PID 1892 wrote to memory of 3776 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 108 PID 1892 wrote to memory of 3776 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 108 PID 1892 wrote to memory of 3776 1892 {9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe 108 PID 2276 wrote to memory of 4732 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 109 PID 2276 wrote to memory of 4732 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 109 PID 2276 wrote to memory of 4732 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 109 PID 2276 wrote to memory of 1388 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 110 PID 2276 wrote to memory of 1388 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 110 PID 2276 wrote to memory of 1388 2276 {71821069-88EA-48f6-A19C-67051417AEA6}.exe 110 PID 4732 wrote to memory of 3872 4732 {36D7C925-101B-41ee-8993-406E49ED443A}.exe 111 PID 4732 wrote to memory of 3872 4732 {36D7C925-101B-41ee-8993-406E49ED443A}.exe 111 PID 4732 wrote to memory of 3872 4732 {36D7C925-101B-41ee-8993-406E49ED443A}.exe 111 PID 4732 wrote to memory of 2656 4732 {36D7C925-101B-41ee-8993-406E49ED443A}.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_f6b5164b46afb0b588a3b2682bb91666_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\{FCE6D289-4154-4dd8-B039-66E94056C74F}.exeC:\Windows\{FCE6D289-4154-4dd8-B039-66E94056C74F}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exeC:\Windows\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\{C8446A88-508E-4836-9085-DF7EF04E4471}.exeC:\Windows\{C8446A88-508E-4836-9085-DF7EF04E4471}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\{AC49C922-4DAE-4660-B303-BB299419C027}.exeC:\Windows\{AC49C922-4DAE-4660-B303-BB299419C027}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exeC:\Windows\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exeC:\Windows\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exeC:\Windows\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exeC:\Windows\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\{71821069-88EA-48f6-A19C-67051417AEA6}.exeC:\Windows\{71821069-88EA-48f6-A19C-67051417AEA6}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\{36D7C925-101B-41ee-8993-406E49ED443A}.exeC:\Windows\{36D7C925-101B-41ee-8993-406E49ED443A}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\{45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exeC:\Windows\{45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3872 -
C:\Windows\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E}.exeC:\Windows\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E}.exe13⤵
- Executes dropped EXE
PID:2268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45557~1.EXE > nul13⤵PID:2060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36D7C~1.EXE > nul12⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71821~1.EXE > nul11⤵PID:1388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C0D0~1.EXE > nul10⤵PID:3776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C8B6~1.EXE > nul9⤵PID:1712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27EBE~1.EXE > nul8⤵PID:3612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1E7F~1.EXE > nul7⤵PID:4024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC49C~1.EXE > nul6⤵PID:1748
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8446~1.EXE > nul5⤵PID:2192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70D5B~1.EXE > nul4⤵PID:3204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCE6D~1.EXE > nul3⤵PID:3804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{27EBE31B-44B6-4984-9F50-7AD91E24F8EA}.exe
- Size 192KB
- SHA256 9ec900c9faf689b0d975053f7804eb942a3b28264ea0c040c1a58e5f4e6d1f66
- MD5 e15213178b4d22e6d1adc7794040b23d
- SHA1 124bd8a253c7be1dbe9ccc137321b70155706f9a
- SHA512 c57ffe24ace5a993f1caa9cbad268d3865e97ec47e56272fe58b65cc4abd535ac09515c575c2c874a02bcadc38f1d970936039f2829b4801319f73427604f00a
- SSDEEP 1536:1EGh0oVl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oVl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{36D7C925-101B-41ee-8993-406E49ED443A}.exe
- Size 192KB
- SHA256 0f2a2f20633358396194365c07817a62317792f117f20fe37d8fda96f32ed055
- MD5 a10c9241af1b30724d11072f5cb15f17
- SHA1 0309cbd584155af28a42a9324efc5dd1d807b41e
- SHA512 f5c7bbf69ed51fbaf0952b9cd6d7a5da11582452ec37bf0845d8cb641186dac1232a38652a1bf57b4790872235de8407b5cdd8b90d13434f66fcef2f7b4fa4cf
- SSDEEP 1536:1EGh0oyl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oyl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{45557D1C-E480-46ea-A7D2-24CEECE49BB3}.exe
- Size 192KB
- SHA256 13768cb8db206e35326b2aa9aa430907e8350f1d22a3065f3321ad80712839fd
- MD5 7fd37820ab4870f9f4ba94b992d71ed7
- SHA1 43da3afbd856d26db2be49a9865ea489164feed8
- SHA512 48856a6d858020757852a53bc144203a3cb65ad346e68a581e9bf22c0f04b38ddfe3636a3205067dded18014a8a8e37c27236f422ab47c2a2d8ca608948d3c94
- SSDEEP 1536:1EGh0oql15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oql1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6C8B6A33-4E65-4c45-BCA9-32FC089C83B4}.exe
- Size 192KB
- SHA256 9698a3e9518d41294f1bfda1dd0f5b090511d5cbe540ed74b1f11dbd662260f9
- MD5 9e9157808847edb593289d9e41cb778f
- SHA1 8eff0fd4d0d31609469ad1c5fb3c6ea75e759884
- SHA512 c0d3eb8bf689ee8fbd6ad1456afda2db02e3cbe402b8ff5f1ded002f3d7563ac009ce594b1001e3946153514402e240b89bc13845c7b36e9f35b59f08c3605c9
- SSDEEP 1536:1EGh0o2l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o2l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{70D5B9A3-D7B0-4e72-8E97-5DA304DD2477}.exe
- Size 192KB
- SHA256 dad341aa37b2ff6c3d789567888d22493d8112f3c9f76b35e40116d2a8c8e6ac
- MD5 a054e30ff9ecf14d34e7252bd1837e91
- SHA1 5668b8331adcca4b520182f35297e0ab4a823bf2
- SHA512 4a7774bf7274d8823ed1c8cf766aa365321c1b3ad7a9f68fdd2f64d1548007c2b26105d73287225fac327ef4b81d0d0d438cac6691b5b08f379f70dcc3ccd737
- SSDEEP 1536:1EGh0o4l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o4l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{71821069-88EA-48f6-A19C-67051417AEA6}.exe
- Size 192KB
- SHA256 30f2979d5be59cfd8b8e2caa3e72899c66de9d95abd043136d06117417edae7e
- MD5 b83e0d2c6c990842a66b0f0c0d3c2097
- SHA1 4ce4b3c5710054d2913d71890b014887e9f1a9d8
- SHA512 9e9529947d7166313aba889e3af5f41e89453311adbbea3112f3128e868b77d9db7c696547f783516dcb1e8583383d91c40e6b8ed324d7e739e65087c55b5e90
- SSDEEP 1536:1EGh0osl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0osl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8057CE78-586D-4f24-BDCC-B8AB1C527F7E}.exe
- Size 192KB
- SHA256 5fad21d66ba15d61085e8f3a93cfdb20c6b1a107b4105cbbb13ab8c4d42c634c
- MD5 88850a348ed2c61c2d8d97a5c0c55a32
- SHA1 b796dd39d330a055e22060a73ff089908f1d917d
- SHA512 153ecefd3fcea8e63c39c6c34610615b5474e5f1ab941e3196b90bf9c0a3f37c3372e348f1f6f9f6ad4ffd1502920acdb4f38e88ac8e7f4d7af8a1855f75374b
- SSDEEP 1536:1EGh0oVl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oVl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9C0D048F-1D88-4cd6-975B-DF37A31D09AC}.exe
- Size 192KB
- SHA256 69fbcda1ed8503c62437d3581cec328675103731f29badab3d238ebf093e6b71
- MD5 ec759e50014f903ce2fddc6a47df1bce
- SHA1 2e3fd2b6a6eecd2a7ee8010865072926c24cd586
- SHA512 a68a85ee84337c161d1a8a2a5ea8867b29e6353397b6c27704af1d36ef4cf93fa58ee7cac2fc5070e4b464b267ab3508dc7f8f7df9c71bf7fbf8dc4d71765c4c
- SSDEEP 1536:1EGh0oZl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oZl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AC49C922-4DAE-4660-B303-BB299419C027}.exe
- Size 192KB
- SHA256 fccd938e71a38695cc5b372407e4e4317cdf497b7e4aca2ec53a62f3179c69a6
- MD5 db4023a2cf22486141c8634a955baf77
- SHA1 30c224403b40dfc4cd9e38c7390ab2ee9d3ff488
- SHA512 6f9e806759bb749665109ba5dd303c46749bea847238e990e2e3b522ff59f056460f945f5cb9b11254156fc96692bc169c975bd880776b202f7ee83e63313823
- SSDEEP 1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o5l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C1E7FA82-BE6B-4064-9159-2C6F0C752B2B}.exe
- Size 192KB
- SHA256 0b44da29117f8c3535ff05f43be6b90a2badaac6edd1c9daea5ddec5b72424c7
- MD5 a76d74b2f4d7f5c314342d0fe826bda4
- SHA1 3027b66e8e57d514c5dc65b898bf64cd6f57b69c
- SHA512 c163c98ab0c4199ac139caa9ae45f27524c4b2751bab9ec18fcf611d2a0761fd7465896cd8665ff54c2dda9b99b9947bb2e4acf51ca239501afd8e337e2af34a
- SSDEEP 1536:1EGh0oWl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oWl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C8446A88-508E-4836-9085-DF7EF04E4471}.exe
- Size 192KB
- SHA256 ac64c34591db4ac0094d5ce9d2fc10126309cb1e13a05be74766952dc29b6c65
- MD5 31e4c08b4949ae948dd670298e4a799f
- SHA1 0016411d949f40107f320128dd2a12e122197e1a
- SHA512 41a6369d9439d506da86e431e2319a4d7579f9160351cac10bdfab3588b9ad33872d126eb74ea7b0164227195df3dda0ae41285752ab270c6665e7b240d0b76c
- SSDEEP 1536:1EGh0oWl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oWl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FCE6D289-4154-4dd8-B039-66E94056C74F}.exe
- Size 192KB
- SHA256 37e617648897817f6c152b3e85ff06995f993c840e6c24bc3f5b90459b91caf2
- MD5 cfa3853be9579dd79a4f649f16a8fc87
- SHA1 661fcc4b20a165d22d9fbdc946245422ed884258
- SHA512 e5a6ed5124a7886bb992977d1ce2eda31ce1cfe25e3f22e699edc1594e10cc99bc51fbd1000036a5a751dc2208fe77e6161d6e394d3e0802404438ad9f21d378
- SSDEEP 1536:1EGh0oil15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oil1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP