Analysis
- max time kernel
144s - max time network
125s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 15:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe
- Size 180KB
- Sample240612-se25zazake
- SHA256 b2a81c9d1823c96c767dfb3df2e4d9c58a8c5dc84c1195fd26a5adc01c9985b5
- MD5 2977d24926c59b659f495ae6e8692f89
- SHA1 e9b40f63f8bf0087283af22d08fac54bdd4acc77
- SHA512 dedd05970a56a324cb67893403c66ab04013ba5e681213bdde354c525f1d5401b6a2e899a49bb18aa654c9f3b123159c8266d187ed14d10d1467a2e1cd22c752
- SSDEEP 3072:jEGh0oolfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGml5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x002c000000016812-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002d000000016c07-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000400000000f6e4-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002e000000016c07-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000500000000f6e4-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002f000000016c07-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000600000000f6e4-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0030000000016c07-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000700000000f6e4-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0031000000016c07-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000800000000f6e4-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{776F40D3-7A37-4ac3-A047-F25F2022D26D} {323F6C90-AD31-4f78-A156-950E1C748B18}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{776F40D3-7A37-4ac3-A047-F25F2022D26D}\stubpath = "C:\\Windows\\{776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe" {323F6C90-AD31-4f78-A156-950E1C748B18}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C60759D9-AD8A-4a68-9EF3-92B2EE943974} {5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16} 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A402F328-3F46-48dc-98F4-F2304FA932F0}\stubpath = "C:\\Windows\\{A402F328-3F46-48dc-98F4-F2304FA932F0}.exe" {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33511011-EDDE-4e2f-99A1-FF5DF37B9178}\stubpath = "C:\\Windows\\{33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe" {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732} {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD} {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{323F6C90-AD31-4f78-A156-950E1C748B18}\stubpath = "C:\\Windows\\{323F6C90-AD31-4f78-A156-950E1C748B18}.exe" {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5204DA85-B61C-4f5b-BD89-8DB6437119E0} {776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5204DA85-B61C-4f5b-BD89-8DB6437119E0}\stubpath = "C:\\Windows\\{5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe" {776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}\stubpath = "C:\\Windows\\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe" 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44781CAC-2018-4502-85C3-3AF4B2E8C61C}\stubpath = "C:\\Windows\\{44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe" {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33511011-EDDE-4e2f-99A1-FF5DF37B9178} {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}\stubpath = "C:\\Windows\\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe" {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD}\stubpath = "C:\\Windows\\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe" {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05B156C0-15FE-4421-9CB7-A58632F25C2A} {C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A402F328-3F46-48dc-98F4-F2304FA932F0} {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44781CAC-2018-4502-85C3-3AF4B2E8C61C} {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C60759D9-AD8A-4a68-9EF3-92B2EE943974}\stubpath = "C:\\Windows\\{C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe" {5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05B156C0-15FE-4421-9CB7-A58632F25C2A}\stubpath = "C:\\Windows\\{05B156C0-15FE-4421-9CB7-A58632F25C2A}.exe" {C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{323F6C90-AD31-4f78-A156-950E1C748B18} {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe - Deletes itself 1 IoCs
pid Process 2708 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 920 {776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe 1600 {5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe 2020 {C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe 2296 {05B156C0-15FE-4421-9CB7-A58632F25C2A}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{05B156C0-15FE-4421-9CB7-A58632F25C2A}.exe {C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe File created C:\Windows\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe File created C:\Windows\{44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe File created C:\Windows\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe File created C:\Windows\{776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe {323F6C90-AD31-4f78-A156-950E1C748B18}.exe File created C:\Windows\{C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe {5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe File created C:\Windows\{A402F328-3F46-48dc-98F4-F2304FA932F0}.exe {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe File created C:\Windows\{33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe File created C:\Windows\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe File created C:\Windows\{323F6C90-AD31-4f78-A156-950E1C748B18}.exe {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe File created C:\Windows\{5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe {776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe Token: SeIncBasePriorityPrivilege 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe Token: SeIncBasePriorityPrivilege 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe Token: SeIncBasePriorityPrivilege 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe Token: SeIncBasePriorityPrivilege 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe Token: SeIncBasePriorityPrivilege 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe Token: SeIncBasePriorityPrivilege 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe Token: SeIncBasePriorityPrivilege 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe Token: SeIncBasePriorityPrivilege 920 {776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe Token: SeIncBasePriorityPrivilege 1600 {5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe Token: SeIncBasePriorityPrivilege 2020 {C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 3064 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 28 PID 2536 wrote to memory of 3064 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 28 PID 2536 wrote to memory of 3064 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 28 PID 2536 wrote to memory of 3064 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 28 PID 2536 wrote to memory of 2708 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 29 PID 2536 wrote to memory of 2708 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 29 PID 2536 wrote to memory of 2708 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 29 PID 2536 wrote to memory of 2708 2536 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 29 PID 3064 wrote to memory of 2672 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 30 PID 3064 wrote to memory of 2672 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 30 PID 3064 wrote to memory of 2672 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 30 PID 3064 wrote to memory of 2672 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 30 PID 3064 wrote to memory of 2656 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 31 PID 3064 wrote to memory of 2656 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 31 PID 3064 wrote to memory of 2656 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 31 PID 3064 wrote to memory of 2656 3064 {8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe 31 PID 2672 wrote to memory of 2684 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 34 PID 2672 wrote to memory of 2684 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 34 PID 2672 wrote to memory of 2684 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 34 PID 2672 wrote to memory of 2684 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 34 PID 2672 wrote to memory of 2468 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 35 PID 2672 wrote to memory of 2468 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 35 PID 2672 wrote to memory of 2468 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 35 PID 2672 wrote to memory of 2468 2672 {A402F328-3F46-48dc-98F4-F2304FA932F0}.exe 35 PID 2684 wrote to memory of 2500 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 36 PID 2684 wrote to memory of 2500 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 36 PID 2684 wrote to memory of 2500 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 36 PID 2684 wrote to memory of 2500 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 36 PID 2684 wrote to memory of 2952 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 37 PID 2684 wrote to memory of 2952 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 37 PID 2684 wrote to memory of 2952 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 37 PID 2684 wrote to memory of 2952 2684 {44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe 37 PID 2500 wrote to memory of 2168 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 38 PID 2500 wrote to memory of 2168 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 38 PID 2500 wrote to memory of 2168 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 38 PID 2500 wrote to memory of 2168 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 38 PID 2500 wrote to memory of 300 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 39 PID 2500 wrote to memory of 300 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 39 PID 2500 wrote to memory of 300 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 39 PID 2500 wrote to memory of 300 2500 {33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe 39 PID 2168 wrote to memory of 620 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 40 PID 2168 wrote to memory of 620 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 40 PID 2168 wrote to memory of 620 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 40 PID 2168 wrote to memory of 620 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 40 PID 2168 wrote to memory of 2820 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 41 PID 2168 wrote to memory of 2820 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 41 PID 2168 wrote to memory of 2820 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 41 PID 2168 wrote to memory of 2820 2168 {DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe 41 PID 620 wrote to memory of 2140 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 42 PID 620 wrote to memory of 2140 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 42 PID 620 wrote to memory of 2140 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 42 PID 620 wrote to memory of 2140 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 42 PID 620 wrote to memory of 1688 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 43 PID 620 wrote to memory of 1688 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 43 PID 620 wrote to memory of 1688 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 43 PID 620 wrote to memory of 1688 620 {4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe 43 PID 2140 wrote to memory of 920 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 44 PID 2140 wrote to memory of 920 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 44 PID 2140 wrote to memory of 920 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 44 PID 2140 wrote to memory of 920 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 44 PID 2140 wrote to memory of 1112 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 45 PID 2140 wrote to memory of 1112 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 45 PID 2140 wrote to memory of 1112 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 45 PID 2140 wrote to memory of 1112 2140 {323F6C90-AD31-4f78-A156-950E1C748B18}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exeC:\Windows\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\{A402F328-3F46-48dc-98F4-F2304FA932F0}.exeC:\Windows\{A402F328-3F46-48dc-98F4-F2304FA932F0}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\{44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exeC:\Windows\{44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\{33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exeC:\Windows\{33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exeC:\Windows\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exeC:\Windows\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\{323F6C90-AD31-4f78-A156-950E1C748B18}.exeC:\Windows\{323F6C90-AD31-4f78-A156-950E1C748B18}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\{776F40D3-7A37-4ac3-A047-F25F2022D26D}.exeC:\Windows\{776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Windows\{5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exeC:\Windows\{5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\{C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exeC:\Windows\{C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\{05B156C0-15FE-4421-9CB7-A58632F25C2A}.exeC:\Windows\{05B156C0-15FE-4421-9CB7-A58632F25C2A}.exe12⤵
- Executes dropped EXE
PID:2296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6075~1.EXE > nul12⤵PID:2872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5204D~1.EXE > nul11⤵PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{776F4~1.EXE > nul10⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{323F6~1.EXE > nul9⤵PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B4C2~1.EXE > nul8⤵PID:1688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEC0A~1.EXE > nul7⤵PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33511~1.EXE > nul6⤵PID:300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44781~1.EXE > nul5⤵PID:2952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A402F~1.EXE > nul4⤵PID:2468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8797C~1.EXE > nul3⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{05B156C0-15FE-4421-9CB7-A58632F25C2A}.exe
- Size 180KB
- SHA256 5fe2f11a0ca168a3e3f976157d15e681bba386162171372c79fa4d9a52340504
- MD5 f750280eeacdef6a2667d52c86bd3e7f
- SHA1 9e42853ef190852c3ed19b499e357254a9ee5213
- SHA512 e8e11257745b4e7bb49f63a14ea86a972f3d2d3be74d36e627c097ab2004cf44adec541fe01c403e3d929aab915c513ce7ddbd26ad786bb1046c50dc1eea4104
- SSDEEP 3072:jEGh0ozlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGdl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{323F6C90-AD31-4f78-A156-950E1C748B18}.exe
- Size 180KB
- SHA256 c67c13c809b499f26c23e81de6420243fe7409136e789403ab37e9a23b1eaba9
- MD5 6781779a7e29d1a4c232121334672c26
- SHA1 18a8432e236a04c4a48bb38b40925df5f0d30362
- SHA512 035f71e8563e370a01d33bf8f07fc8790221da728e339b73eb390bdb349e5270394f9b7ad404f2c6269cb49d158d55792cb9222ece53afeb645d43464f109e5a
- SSDEEP 3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGOl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{33511011-EDDE-4e2f-99A1-FF5DF37B9178}.exe
- Size 180KB
- SHA256 5dd78b1fd0917298c8ecf5d281e5665785bf9960326f5a202149f8658392b913
- MD5 86b47bfe0d9005d1a4da046ea46f6fd4
- SHA1 2c1d26abb2b6ed533924def2edfab033dcc4a8d6
- SHA512 0f7bd803b42e1874d28727ddeb45f09c6cbfe17a28cf3ee94e7217d8f6c699a35aeff4db2e601ef4172a6b9bf32015e9bd4f01b5855a0462b839c61dceb17e6e
- SSDEEP 3072:jEGh0o2lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGAl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{44781CAC-2018-4502-85C3-3AF4B2E8C61C}.exe
- Size 180KB
- SHA256 d78de1803a2001d75236728d01f695c357cb3c00284ad01e72982521d4345c13
- MD5 e433c857e0a1a55b73476cb44f96087d
- SHA1 6176a01a3299aa437f5a2ce2c6b51e13af358dd7
- SHA512 bea090d41ed18b8f524c6ca79d8c0551619aa3285a17bca30e4d74652457b1bf13de080ae7de08059a83536814de3c785ec110a58a1a8c001d3a29d95312440e
- SSDEEP 3072:jEGh0oklfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGSl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4B4C299C-523A-4094-9EE0-B5C6771B2AAD}.exe
- Size 180KB
- SHA256 6e09c47bd489f2d02324df04ba9773955a904f5bf72c6490060ebb38dd3cc925
- MD5 aa567d0696900f46522617da8596b1a9
- SHA1 2dfc9c4639eff0eaa1caa4143e9b64aaa1981285
- SHA512 3787b4188c4498a9f4f8f2d383e35b3c2caeb7bf6ec7b99becb5251cea652c3e0bcb468ccfa6ef14f724418320dd81923433730258159ab3017aa51b3cff3987
- SSDEEP 3072:jEGh0oYlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGyl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5204DA85-B61C-4f5b-BD89-8DB6437119E0}.exe
- Size 180KB
- SHA256 e46db3df1bf05ca6f7023f7a8b57839faf26514aab6f10a67339fb009682bb7f
- MD5 005c697ed78fa56c524ed0fed1da370a
- SHA1 6458729e29082c74e978c7abe346506b519a73f3
- SHA512 15f6d21f41457b64e85d38eb0130c33b15267c1d08368f3ee37bfd031ff5519fb678cc92f2f21b901e256c1a442f9ace3726001e2f6d1272865203c1444e30bc
- SSDEEP 3072:jEGh0ozlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{776F40D3-7A37-4ac3-A047-F25F2022D26D}.exe
- Size 180KB
- SHA256 fdf2417ebdfcbbf2181bede6d86204ff2b2b0efa3bf8a1fc4d8cf05c4a6f7ebd
- MD5 b27c8f22aebc6efae7c1824414c673ce
- SHA1 17429386ca29930cd5566fe2f19cb743136bea2c
- SHA512 2442ff406699664ea6d2956bbac572a8d50acd70df90bd7229a60f16afc2f45f876824160316648ba3b6ac6beefccca4072abc1080a50fc60f241a2428986010
- SSDEEP 3072:jEGh0oNlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGnl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8797C7EA-C2F2-40ae-9475-C83BC4FE3B16}.exe
- Size 180KB
- SHA256 1c93db07c58f8717c045b7f9e4b302880ba4d3f02d2a284b6db0d7966e98b2e6
- MD5 0855b33dcaf660d7b87dcbc4e0812f88
- SHA1 218cc94b3b2033b86fb00661b0aaaf304e33e4ac
- SHA512 c44a5ddded97b68924a965dcc793aa5803172cb37affd3bd986f5381b882ead0ee94f1b159d683e61065fef4123a22eb0a0b9636e46ce18637ae833a14c749ee
- SSDEEP 3072:jEGh0ohlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGzl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A402F328-3F46-48dc-98F4-F2304FA932F0}.exe
- Size 180KB
- SHA256 ed7ab5acf1a242b7bcc24287c68abcde9fa71fbafe21e27cb97e2f85de957470
- MD5 482dadf0b7af7cfe57513390179da739
- SHA1 efb72723938a6aee42e7c599330292265f302a35
- SHA512 c5be351f62da9fc006866d7f81b3c19c965ded1b91c6099fc9deda0410dece13d8f46cdff1f8eecb3d5fde64d126e43db9cd7508609fade9ea14e6695521ff5f
- SSDEEP 3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGBl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C60759D9-AD8A-4a68-9EF3-92B2EE943974}.exe
- Size 180KB
- SHA256 a3a43ae815c3f77920a4ccf661452469d761941a1fdd9c3a737362bcb26c28fa
- MD5 2cbb5bc324c921111a7260db2b37f369
- SHA1 afd5c094e7c54c4b3e9714d206108001013c3772
- SHA512 cae2659df1dbccbaac9cdbe4c851142eb0f868c186c69effa53f4fef5786ea33c4a151e576a2feb1aa96b76bd3fc4f690814640294372dcf80a0240a692ea1b6
- SSDEEP 3072:jEGh0oglfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DEC0AFC8-5DEA-4cd6-AADC-92CA14746732}.exe
- Size 180KB
- SHA256 0bf3b0651657c3c038147171b199ce38f8cecf57bc2c9db16291671b5e9139b0
- MD5 305521b0300fd75cf36382a9a4bc92eb
- SHA1 a9327c79c7e3e6acaa8c73031925bc541030272a
- SHA512 727e3da6e9699d335731f2a9761ca3cf5c573e17157c4d49a85a1854c3a4daa7089b10d93bb6858938423c5df4c6bb80e1fc3dc837cc73ed906855c5ec49a910
- SSDEEP 3072:jEGh0oGlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGgl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP