Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 15:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe
- Size 180KB
- Sample240612-se25zazake
- SHA256 b2a81c9d1823c96c767dfb3df2e4d9c58a8c5dc84c1195fd26a5adc01c9985b5
- MD5 2977d24926c59b659f495ae6e8692f89
- SHA1 e9b40f63f8bf0087283af22d08fac54bdd4acc77
- SHA512 dedd05970a56a324cb67893403c66ab04013ba5e681213bdde354c525f1d5401b6a2e899a49bb18aa654c9f3b123159c8266d187ed14d10d1467a2e1cd22c752
- SSDEEP 3072:jEGh0oolfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGml5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x000c0000000233d0-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233d3-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233f6-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233d3-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233f6-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233d3-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233f6-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d0000000233d3-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233f6-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e0000000233d6-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00120000000233d3-44.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}\stubpath = "C:\\Windows\\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe" {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A19E134-2294-44af-872A-70D348B0DAFB}\stubpath = "C:\\Windows\\{9A19E134-2294-44af-872A-70D348B0DAFB}.exe" {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79066DB0-BC6D-42e4-A109-2A06F04F28A7} {422FC599-62E6-433d-9B87-450504CB5D10}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D28470A2-1E54-4c9c-9A64-C76242799353} {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1D3164D-2D5C-47a1-90C8-427BFA59B681}\stubpath = "C:\\Windows\\{A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe" {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680} {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{419DC6E7-91F5-46b2-BB06-97DE271218AB}\stubpath = "C:\\Windows\\{419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe" 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F25879B-9271-4deb-ABC5-04B5488EBA6D} {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D28470A2-1E54-4c9c-9A64-C76242799353}\stubpath = "C:\\Windows\\{D28470A2-1E54-4c9c-9A64-C76242799353}.exe" {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{786DE54F-21AA-4130-98D4-45F87472F88B} {D28470A2-1E54-4c9c-9A64-C76242799353}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7C46F1A-7051-40a6-A029-97C97A15066F} {786DE54F-21AA-4130-98D4-45F87472F88B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7C46F1A-7051-40a6-A029-97C97A15066F}\stubpath = "C:\\Windows\\{B7C46F1A-7051-40a6-A029-97C97A15066F}.exe" {786DE54F-21AA-4130-98D4-45F87472F88B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1D3164D-2D5C-47a1-90C8-427BFA59B681} {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{419DC6E7-91F5-46b2-BB06-97DE271218AB} 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{139A368D-3441-407d-B108-D552148CF4C0}\stubpath = "C:\\Windows\\{139A368D-3441-407d-B108-D552148CF4C0}.exe" {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A19E134-2294-44af-872A-70D348B0DAFB} {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}\stubpath = "C:\\Windows\\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe" {9A19E134-2294-44af-872A-70D348B0DAFB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{422FC599-62E6-433d-9B87-450504CB5D10}\stubpath = "C:\\Windows\\{422FC599-62E6-433d-9B87-450504CB5D10}.exe" {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{139A368D-3441-407d-B108-D552148CF4C0} {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F25879B-9271-4deb-ABC5-04B5488EBA6D}\stubpath = "C:\\Windows\\{9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe" {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{422FC599-62E6-433d-9B87-450504CB5D10} {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79066DB0-BC6D-42e4-A109-2A06F04F28A7}\stubpath = "C:\\Windows\\{79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe" {422FC599-62E6-433d-9B87-450504CB5D10}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{786DE54F-21AA-4130-98D4-45F87472F88B}\stubpath = "C:\\Windows\\{786DE54F-21AA-4130-98D4-45F87472F88B}.exe" {D28470A2-1E54-4c9c-9A64-C76242799353}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7} {9A19E134-2294-44af-872A-70D348B0DAFB}.exe - Executes dropped EXE 11 IoCs
pid Process 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 1912 {786DE54F-21AA-4130-98D4-45F87472F88B}.exe 3084 {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe 3284 {139A368D-3441-407d-B108-D552148CF4C0}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{9A19E134-2294-44af-872A-70D348B0DAFB}.exe {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe File created C:\Windows\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe {9A19E134-2294-44af-872A-70D348B0DAFB}.exe File created C:\Windows\{79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe {422FC599-62E6-433d-9B87-450504CB5D10}.exe File created C:\Windows\{786DE54F-21AA-4130-98D4-45F87472F88B}.exe {D28470A2-1E54-4c9c-9A64-C76242799353}.exe File created C:\Windows\{139A368D-3441-407d-B108-D552148CF4C0}.exe {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe File created C:\Windows\{419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe File created C:\Windows\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe File created C:\Windows\{9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe File created C:\Windows\{422FC599-62E6-433d-9B87-450504CB5D10}.exe {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe File created C:\Windows\{D28470A2-1E54-4c9c-9A64-C76242799353}.exe {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe File created C:\Windows\{A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe Token: SeIncBasePriorityPrivilege 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe Token: SeIncBasePriorityPrivilege 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe Token: SeIncBasePriorityPrivilege 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe Token: SeIncBasePriorityPrivilege 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe Token: SeIncBasePriorityPrivilege 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe Token: SeIncBasePriorityPrivilege 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe Token: SeIncBasePriorityPrivilege 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe Token: SeIncBasePriorityPrivilege 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe Token: SeIncBasePriorityPrivilege 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe Token: SeIncBasePriorityPrivilege 3084 {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 504 wrote to memory of 1376 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 86 PID 504 wrote to memory of 1376 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 86 PID 504 wrote to memory of 1376 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 86 PID 504 wrote to memory of 5024 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 87 PID 504 wrote to memory of 5024 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 87 PID 504 wrote to memory of 5024 504 2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe 87 PID 1376 wrote to memory of 1780 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 88 PID 1376 wrote to memory of 1780 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 88 PID 1376 wrote to memory of 1780 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 88 PID 1376 wrote to memory of 5084 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 89 PID 1376 wrote to memory of 5084 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 89 PID 1376 wrote to memory of 5084 1376 {419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe 89 PID 1780 wrote to memory of 1384 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 93 PID 1780 wrote to memory of 1384 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 93 PID 1780 wrote to memory of 1384 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 93 PID 1780 wrote to memory of 668 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 94 PID 1780 wrote to memory of 668 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 94 PID 1780 wrote to memory of 668 1780 {31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe 94 PID 1384 wrote to memory of 2108 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 95 PID 1384 wrote to memory of 2108 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 95 PID 1384 wrote to memory of 2108 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 95 PID 1384 wrote to memory of 3372 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 96 PID 1384 wrote to memory of 3372 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 96 PID 1384 wrote to memory of 3372 1384 {9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe 96 PID 2108 wrote to memory of 5004 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 97 PID 2108 wrote to memory of 5004 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 97 PID 2108 wrote to memory of 5004 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 97 PID 2108 wrote to memory of 3336 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 98 PID 2108 wrote to memory of 3336 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 98 PID 2108 wrote to memory of 3336 2108 {9A19E134-2294-44af-872A-70D348B0DAFB}.exe 98 PID 5004 wrote to memory of 3028 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 99 PID 5004 wrote to memory of 3028 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 99 PID 5004 wrote to memory of 3028 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 99 PID 5004 wrote to memory of 3844 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 100 PID 5004 wrote to memory of 3844 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 100 PID 5004 wrote to memory of 3844 5004 {D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe 100 PID 3028 wrote to memory of 2228 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 101 PID 3028 wrote to memory of 2228 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 101 PID 3028 wrote to memory of 2228 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 101 PID 3028 wrote to memory of 428 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 102 PID 3028 wrote to memory of 428 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 102 PID 3028 wrote to memory of 428 3028 {422FC599-62E6-433d-9B87-450504CB5D10}.exe 102 PID 2228 wrote to memory of 3596 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 103 PID 2228 wrote to memory of 3596 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 103 PID 2228 wrote to memory of 3596 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 103 PID 2228 wrote to memory of 4352 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 104 PID 2228 wrote to memory of 4352 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 104 PID 2228 wrote to memory of 4352 2228 {79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe 104 PID 3596 wrote to memory of 1912 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 105 PID 3596 wrote to memory of 1912 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 105 PID 3596 wrote to memory of 1912 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 105 PID 3596 wrote to memory of 4296 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 106 PID 3596 wrote to memory of 4296 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 106 PID 3596 wrote to memory of 4296 3596 {D28470A2-1E54-4c9c-9A64-C76242799353}.exe 106 PID 2736 wrote to memory of 3084 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe 113 PID 2736 wrote to memory of 3084 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe 113 PID 2736 wrote to memory of 3084 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe 113 PID 2736 wrote to memory of 1616 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe 114 PID 2736 wrote to memory of 1616 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe 114 PID 2736 wrote to memory of 1616 2736 {B7C46F1A-7051-40a6-A029-97C97A15066F}.exe 114 PID 3084 wrote to memory of 3284 3084 {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe 115 PID 3084 wrote to memory of 3284 3084 {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe 115 PID 3084 wrote to memory of 3284 3084 {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe 115 PID 3084 wrote to memory of 5032 3084 {A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_2977d24926c59b659f495ae6e8692f89_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\{419DC6E7-91F5-46b2-BB06-97DE271218AB}.exeC:\Windows\{419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exeC:\Windows\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\{9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exeC:\Windows\{9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\{9A19E134-2294-44af-872A-70D348B0DAFB}.exeC:\Windows\{9A19E134-2294-44af-872A-70D348B0DAFB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exeC:\Windows\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\{422FC599-62E6-433d-9B87-450504CB5D10}.exeC:\Windows\{422FC599-62E6-433d-9B87-450504CB5D10}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\{79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exeC:\Windows\{79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\{D28470A2-1E54-4c9c-9A64-C76242799353}.exeC:\Windows\{D28470A2-1E54-4c9c-9A64-C76242799353}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\{786DE54F-21AA-4130-98D4-45F87472F88B}.exeC:\Windows\{786DE54F-21AA-4130-98D4-45F87472F88B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
PID:1912 -
C:\Windows\{B7C46F1A-7051-40a6-A029-97C97A15066F}.exeC:\Windows\{B7C46F1A-7051-40a6-A029-97C97A15066F}.exe11⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\{A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exeC:\Windows\{A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\{139A368D-3441-407d-B108-D552148CF4C0}.exeC:\Windows\{139A368D-3441-407d-B108-D552148CF4C0}.exe13⤵
- Executes dropped EXE
PID:3284
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1D31~1.EXE > nul13⤵PID:5032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7C46~1.EXE > nul12⤵PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{786DE~1.EXE > nul11⤵PID:4368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2847~1.EXE > nul10⤵PID:4296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79066~1.EXE > nul9⤵PID:4352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{422FC~1.EXE > nul8⤵PID:428
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0DE2~1.EXE > nul7⤵PID:3844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A19E~1.EXE > nul6⤵PID:3336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F258~1.EXE > nul5⤵PID:3372
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31B4B~1.EXE > nul4⤵PID:668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{419DC~1.EXE > nul3⤵PID:5084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:5024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{139A368D-3441-407d-B108-D552148CF4C0}.exe
- Size 180KB
- SHA256 90c49b32a096f848108dcf2724ca69a936b81a5fa06bf170af01d9a76d271451
- MD5 a36f5d7b76d2ce73c0b644107a1b5fbf
- SHA1 2ff2e8e6e29e0ccb1d96ac614c8085e1db8115c2
- SHA512 29fcefaad6006e4d94fb4a3f5dc1cc8822d1781abeea7140aa47f9706d6a1c6b88b2f50a3281d616391be82fbca7744a0a1f1e6f8d5047122e2ac7340792ccce
- SSDEEP 3072:jEGh0owlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGul5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{31B4BBF0-CE1D-4c6e-9EE7-9D9D01D29680}.exe
- Size 180KB
- SHA256 b684a5c5a495cdcf036b666218183424ad9d67f319e4e3cbb12c62903b7e4526
- MD5 bb632a31465c766e6f5f08f92180b363
- SHA1 535450d423d76e11cd6385d7ae3bcdad960b6b7c
- SHA512 02f2795d26cea9ed1d6b2a1b1eed5b015a0c07c432d4a61fb6c574976321614eb6acfd78bdc91dd7636e9856f3e9cf008062dccfbeada385f99a035091cf795e
- SSDEEP 3072:jEGh0o7lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGFl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{419DC6E7-91F5-46b2-BB06-97DE271218AB}.exe
- Size 180KB
- SHA256 98cebf248cd2dedb337c5662bcb2f4a02b9dc16e2a161bfa076fcfe62bdee924
- MD5 d2902c5adbd9565bb28c1e34897c3e54
- SHA1 063056b7b101c469bf4c9e52f00210ff91be87c3
- SHA512 7c4b7d3696b2352a93caa56bf187ed26649c70f52442c6ed68340a3b3c20bfe54e465a0988a046898b1db8819f1793563d62cf53aa00fa99cd00f0271bb20761
- SSDEEP 3072:jEGh0oblfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGNl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{422FC599-62E6-433d-9B87-450504CB5D10}.exe
- Size 180KB
- SHA256 933dd4e93e51d84d383b9e211f725ecb1e95dc25cf7381cf95cdce3ebaac42b2
- MD5 d29e2d07d042b125ad16eb24b6a85fd8
- SHA1 dd3877abc72d05f0e1eafa5bf942274b7628d5fa
- SHA512 88ab07a8ee7881b0f26105a9ce6e1a135910d085ff5f2c7d8288ec534f12c0810c48618a9b28194b129eb5977808197d3c573d04746c33d60810aadd3887ddc2
- SSDEEP 3072:jEGh0oKlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGMl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{786DE54F-21AA-4130-98D4-45F87472F88B}.exe
- Size 180KB
- SHA256 7d4daf985cfb9870a3745fa0438bffc6dbb33776a650336f8a5cdd5373564947
- MD5 a553653118d32077c0dbd564067dde56
- SHA1 ed52bbdd4a42df2d797ffbc02671b38ef9c9631f
- SHA512 7697857d1086a5fe8772db5e20d5a1f8f0b6a6fc6fc29af6a391abd3973fcddf06a53fc5a2dfd7ef059b19240e7a53bf4ffe3a91a961b1c294d775190806f8c4
- SSDEEP 3072:jEGh0oGlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGIl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{79066DB0-BC6D-42e4-A109-2A06F04F28A7}.exe
- Size 180KB
- SHA256 41707a262f6e064cf7877d1733bf77417b5da14b1a0e849ab8a550a2157e562b
- MD5 e75a636bf21da92c4676e42cf5131868
- SHA1 2ee8c1ec68a2c2427c71928002b429d2d172759a
- SHA512 15f252f8be6cc462bd1f85aa95ddcda0bf7e854dc62c602fab25f320799e3655a40f1ab6ca4c5589061fdb2ae86d6233897915af8fcea70db1a298c59bcdd0cc
- SSDEEP 3072:jEGh0oulfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGEl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9A19E134-2294-44af-872A-70D348B0DAFB}.exe
- Size 180KB
- SHA256 c212e9c3765630e2d1ff29eb280d112612d3abba0f5ce59c245b2a4e7d92f79c
- MD5 52fc7c7969fe7b4ed59ea968469f3b77
- SHA1 9e86f7c154329abe9bf22e94c882b210648fa351
- SHA512 3c5098e470fcb4d0ecc19e9c31d5561675fcc41c7c06bb063d19db1dfbf188940c54b78e8cbc6f2632c47ff3a1caf56215f952d57e8666a29c1ed1ffd39c26e1
- SSDEEP 3072:jEGh0oYlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGSl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9F25879B-9271-4deb-ABC5-04B5488EBA6D}.exe
- Size 180KB
- SHA256 370405c6f969b8cca4663f2e03115abe7ead24f18d0f79857d8d852256013497
- MD5 8766c6349a3a6e5b20ce770010e9f0b0
- SHA1 43ce4e49e6cad5c9cbfd3221e5d72c8a4d8454ce
- SHA512 db4b984a7b12e148129f66b9b73bbabbe242ad661e423f2ceb17b1d353e56d52c9466e06a12d8bb5897fb7ef6acff567f40a832ba357712716db1b1baba40941
- SSDEEP 3072:jEGh0oElfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A1D3164D-2D5C-47a1-90C8-427BFA59B681}.exe
- Size 180KB
- SHA256 5c1cf893aa1ec370bd6bc1e72bd920bea4cf0b9d16247633bc30470f9e8fa75c
- MD5 8e444f92f45e61332935827266f6fd40
- SHA1 cb7296b9a36058f25a61882fb355b755f5367001
- SHA512 b2583a3336984e69f6558fcba5d7ebb8906f249c8c5ef2d64d20ac918f1fe40c4c54946360624b9e0b5ae85f6e285676d767423a44a515632630cde5a918bef0
- SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGcl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D0DE2CD1-1310-4171-9825-AA6E9FCDABE7}.exe
- Size 180KB
- SHA256 c3fc8e0766d02bd4b7e06a3912e87db14c70ccb4197ee52cc675415483a98504
- MD5 3f4681b1626ce7e84ec7184d418f0191
- SHA1 a5e188c670e0babeab40c8bf2995821477b9f504
- SHA512 fcae250c4de837b4784c85bd1185e4452d6f46c9f87a18fa6be1576d62d8c569fa50ac9adf60c0a7a48cf000ec60c97b8ff55533d36f52ebff7abd1b3c92a417
- SSDEEP 3072:jEGh0oflfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGFl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D28470A2-1E54-4c9c-9A64-C76242799353}.exe
- Size 180KB
- SHA256 fe5f759aea3f18e620a3c8e67217dc63a6d215eb5fef668327aa76f6fd8d6815
- MD5 e5b4c78abd85ac0974b5f0c2af24caff
- SHA1 fa0704cd0cd43056c53f7dfc1878d6015ed37866
- SHA512 e3e2939a11c927f486bd00f13fbcf77b1564b3d035f406bea6629c65df0ffe08d719c558c29ce6193dd5278b366574cc26abc327a9ae47fbe562500573d1a91a
- SSDEEP 3072:jEGh0o4lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG+l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP