Analysis
- max time kernel
144s - max time network
122s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 10:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe
- Size 216KB
- Sample240613-mjktlavdnd
- SHA256 3c20f635aa39055295e0b5548ecda9db7057f2f8fb4c71dc1caa3cd5b098319f
- MD5 58dfd8cd2900375c29eac9d02fb10b2f
- SHA1 18c14d5698331590a6234cf14f6b8ac55aa3219a
- SHA512 daed22fd147e8298e7f866bc6406bcd20825b70b98866a043ba9263ada1d76bf5bfe6346f12111858df383d763270039f72a9707b9a992e2b0e47f95241f7c26
- SSDEEP 3072:jEGh0o+l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGolEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000a00000001227f-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0036000000015cfd-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b00000001227f-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0037000000015d09-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c00000001227f-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d00000001227f-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e00000001227f-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7} {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20909B13-080C-4296-9D07-2BBBDA0CBF21}\stubpath = "C:\\Windows\\{20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe" {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6748E037-710E-4c14-9970-A8E1570A8AEE} {8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}\stubpath = "C:\\Windows\\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe" {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE} {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4034409A-567B-4b63-803B-8FA26C406A14} {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180} {4034409A-567B-4b63-803B-8FA26C406A14}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{979B8049-1EAB-408d-8F72-40F8268A4F3F} {6748E037-710E-4c14-9970-A8E1570A8AEE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CC58092-ABC2-470b-BA4F-0C1D7388A280}\stubpath = "C:\\Windows\\{7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe" 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20909B13-080C-4296-9D07-2BBBDA0CBF21} {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}\stubpath = "C:\\Windows\\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe" {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6748E037-710E-4c14-9970-A8E1570A8AEE}\stubpath = "C:\\Windows\\{6748E037-710E-4c14-9970-A8E1570A8AEE}.exe" {8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7} {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C18C955-3145-4522-BFAA-BA8E5108D4DA} {388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{979B8049-1EAB-408d-8F72-40F8268A4F3F}\stubpath = "C:\\Windows\\{979B8049-1EAB-408d-8F72-40F8268A4F3F}.exe" {6748E037-710E-4c14-9970-A8E1570A8AEE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CC58092-ABC2-470b-BA4F-0C1D7388A280} 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9} {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE}\stubpath = "C:\\Windows\\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe" {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}\stubpath = "C:\\Windows\\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe" {4034409A-567B-4b63-803B-8FA26C406A14}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4034409A-567B-4b63-803B-8FA26C406A14}\stubpath = "C:\\Windows\\{4034409A-567B-4b63-803B-8FA26C406A14}.exe" {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}\stubpath = "C:\\Windows\\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe" {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C18C955-3145-4522-BFAA-BA8E5108D4DA}\stubpath = "C:\\Windows\\{8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe" {388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe - Deletes itself 1 IoCs
pid Process 2252 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 2768 {388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe 1764 {8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe 2008 {6748E037-710E-4c14-9970-A8E1570A8AEE}.exe 580 {979B8049-1EAB-408d-8F72-40F8268A4F3F}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe {388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe File created C:\Windows\{6748E037-710E-4c14-9970-A8E1570A8AEE}.exe {8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe File created C:\Windows\{979B8049-1EAB-408d-8F72-40F8268A4F3F}.exe {6748E037-710E-4c14-9970-A8E1570A8AEE}.exe File created C:\Windows\{7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe File created C:\Windows\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe File created C:\Windows\{4034409A-567B-4b63-803B-8FA26C406A14}.exe {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe File created C:\Windows\{20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe File created C:\Windows\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe File created C:\Windows\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe File created C:\Windows\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe {4034409A-567B-4b63-803B-8FA26C406A14}.exe File created C:\Windows\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe Token: SeIncBasePriorityPrivilege 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe Token: SeIncBasePriorityPrivilege 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe Token: SeIncBasePriorityPrivilege 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe Token: SeIncBasePriorityPrivilege 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe Token: SeIncBasePriorityPrivilege 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe Token: SeIncBasePriorityPrivilege 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe Token: SeIncBasePriorityPrivilege 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe Token: SeIncBasePriorityPrivilege 2768 {388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe Token: SeIncBasePriorityPrivilege 1764 {8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe Token: SeIncBasePriorityPrivilege 2008 {6748E037-710E-4c14-9970-A8E1570A8AEE}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2216 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 28 PID 2320 wrote to memory of 2216 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 28 PID 2320 wrote to memory of 2216 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 28 PID 2320 wrote to memory of 2216 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 28 PID 2320 wrote to memory of 2252 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 29 PID 2320 wrote to memory of 2252 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 29 PID 2320 wrote to memory of 2252 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 29 PID 2320 wrote to memory of 2252 2320 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 29 PID 2216 wrote to memory of 2692 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 30 PID 2216 wrote to memory of 2692 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 30 PID 2216 wrote to memory of 2692 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 30 PID 2216 wrote to memory of 2692 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 30 PID 2216 wrote to memory of 2792 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 31 PID 2216 wrote to memory of 2792 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 31 PID 2216 wrote to memory of 2792 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 31 PID 2216 wrote to memory of 2792 2216 {7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe 31 PID 2692 wrote to memory of 2928 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 32 PID 2692 wrote to memory of 2928 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 32 PID 2692 wrote to memory of 2928 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 32 PID 2692 wrote to memory of 2928 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 32 PID 2692 wrote to memory of 2812 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 33 PID 2692 wrote to memory of 2812 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 33 PID 2692 wrote to memory of 2812 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 33 PID 2692 wrote to memory of 2812 2692 {0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe 33 PID 2928 wrote to memory of 2240 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 36 PID 2928 wrote to memory of 2240 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 36 PID 2928 wrote to memory of 2240 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 36 PID 2928 wrote to memory of 2240 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 36 PID 2928 wrote to memory of 2092 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 37 PID 2928 wrote to memory of 2092 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 37 PID 2928 wrote to memory of 2092 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 37 PID 2928 wrote to memory of 2092 2928 {5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe 37 PID 2240 wrote to memory of 2844 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 38 PID 2240 wrote to memory of 2844 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 38 PID 2240 wrote to memory of 2844 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 38 PID 2240 wrote to memory of 2844 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 38 PID 2240 wrote to memory of 2688 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 39 PID 2240 wrote to memory of 2688 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 39 PID 2240 wrote to memory of 2688 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 39 PID 2240 wrote to memory of 2688 2240 {4034409A-567B-4b63-803B-8FA26C406A14}.exe 39 PID 2844 wrote to memory of 1832 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 40 PID 2844 wrote to memory of 1832 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 40 PID 2844 wrote to memory of 1832 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 40 PID 2844 wrote to memory of 1832 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 40 PID 2844 wrote to memory of 496 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 41 PID 2844 wrote to memory of 496 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 41 PID 2844 wrote to memory of 496 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 41 PID 2844 wrote to memory of 496 2844 {DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe 41 PID 1832 wrote to memory of 1044 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 42 PID 1832 wrote to memory of 1044 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 42 PID 1832 wrote to memory of 1044 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 42 PID 1832 wrote to memory of 1044 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 42 PID 1832 wrote to memory of 1092 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 43 PID 1832 wrote to memory of 1092 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 43 PID 1832 wrote to memory of 1092 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 43 PID 1832 wrote to memory of 1092 1832 {CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe 43 PID 1044 wrote to memory of 2768 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 44 PID 1044 wrote to memory of 2768 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 44 PID 1044 wrote to memory of 2768 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 44 PID 1044 wrote to memory of 2768 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 44 PID 1044 wrote to memory of 2760 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 45 PID 1044 wrote to memory of 2760 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 45 PID 1044 wrote to memory of 2760 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 45 PID 1044 wrote to memory of 2760 1044 {20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\{7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exeC:\Windows\{7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exeC:\Windows\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exeC:\Windows\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\{4034409A-567B-4b63-803B-8FA26C406A14}.exeC:\Windows\{4034409A-567B-4b63-803B-8FA26C406A14}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exeC:\Windows\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exeC:\Windows\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\{20909B13-080C-4296-9D07-2BBBDA0CBF21}.exeC:\Windows\{20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exeC:\Windows\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\{8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exeC:\Windows\{8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\{6748E037-710E-4c14-9970-A8E1570A8AEE}.exeC:\Windows\{6748E037-710E-4c14-9970-A8E1570A8AEE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\{979B8049-1EAB-408d-8F72-40F8268A4F3F}.exeC:\Windows\{979B8049-1EAB-408d-8F72-40F8268A4F3F}.exe12⤵
- Executes dropped EXE
PID:580
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6748E~1.EXE > nul12⤵PID:696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C18C~1.EXE > nul11⤵PID:2472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{388BC~1.EXE > nul10⤵PID:3044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20909~1.EXE > nul9⤵PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA0EF~1.EXE > nul8⤵PID:1092
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE5A6~1.EXE > nul7⤵PID:496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40344~1.EXE > nul6⤵PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FCDE~1.EXE > nul5⤵PID:2092
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AEC1~1.EXE > nul4⤵PID:2812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7CC58~1.EXE > nul3⤵PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0AEC1375-D394-4f31-A9AE-2AA2706EE1E9}.exe
- Size 216KB
- SHA256 228a12b311b0e63441e7f1a7c8427136842be5f2c50f73c2365965031399cc1e
- MD5 e8975d43541f07f74cf305f0433ad765
- SHA1 81aa7233ee05520133b71a8ef9552aa05c47316a
- SHA512 e3eccb1cd0b39e2be57cabb78dd95326bd4bb1002750fcd77e1bdb506836aa66b203084249a1373c61ed2c1c341979f70b6d22e8a339ffe3eea6d45ce115a54c
- SSDEEP 3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG7lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{20909B13-080C-4296-9D07-2BBBDA0CBF21}.exe
- Size 216KB
- SHA256 353c98c8003fbe2a204b544498e8a8817cc4011f502fc80ed8e44515bcd777bb
- MD5 4bf88dc4db506c2ff3009aaa1fc07561
- SHA1 1a8f539612f510fbfd00b88b43766e77cd4f1b2c
- SHA512 3a9b59f0d64845716df0a63688675537815013ddd23c64f431405d6375a6522ac763dd53ce2ef3929f4e28068845cf11f8abac5734e9b49f1313b07b90a20be5
- SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGflEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{388BC468-9B1F-4d0d-AEC2-1081EFEBDCC7}.exe
- Size 216KB
- SHA256 fb519611621cd24c6a7f498ffb1a3f5c456c8382b84a5974b8737d069c18f7c2
- MD5 6d6eeb2cc8f1ebd2231b76b303087299
- SHA1 8d3e02ee1bdbcb7cd028d73e7fddc6adbaa87512
- SHA512 345af4ba86a3d53c968b0673ab32d1b1452dce51911ad6708438593e0c09c4d42871f3f9da6a9a5dcc15701444cfaea9ea75f48af624e568d14654ada4d405bc
- SSDEEP 3072:jEGh0oGl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGQlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4034409A-567B-4b63-803B-8FA26C406A14}.exe
- Size 216KB
- SHA256 9643e6c7a76b4e43d4f0e67a913291d563bf87fce04fed4541bf7ed37f8b3dd0
- MD5 f334738df3d1b8430cb49ea0ca867be5
- SHA1 275d92dbac7908d9de1fc4d750498920f5faf062
- SHA512 42400e4483fea41e6e5265399639d856f8e07b76b47a5aa4af1668bfb7fa80f9ddc716f405e9e5e4fd85bf4b9f2397d6daafd3603732fd1d0f429e09e6006765
- SSDEEP 3072:jEGh0o/l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG1lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5FCDE6F1-C3E6-4477-9F82-8C58120094BE}.exe
- Size 216KB
- SHA256 8a5e115c392c4329f0d35cc91016ecb3c0e342b07bd0cb774c46189d430dd313
- MD5 b44f2f8a81efcb19eb79dbf0e8c4f088
- SHA1 560277dc8f6c5398e24ec9f7ab40ffbbc6ce3c6f
- SHA512 8ac3243df2ed8de993f861a695ed58db9eedc77a45146ab57433b2eb066117930be2e51d28e066d51a99a8cae36b7db1bedd047e69b059bc94c08b41006b8d11
- SSDEEP 3072:jEGh0o/l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGVlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6748E037-710E-4c14-9970-A8E1570A8AEE}.exe
- Size 216KB
- SHA256 f18edf0e379ee925f24e81b7fb3c05bf8768bb6ddd863311ad5f11b73b4469c5
- MD5 dae2a5b09c27d8aaea61d2006a878ba0
- SHA1 e63e11269cdf8dbe401466fd151c15476546453f
- SHA512 d4b230864882f041e4b75247b8302daa61d42ac5db1afca0b2461612b813125bde3077fcff8aa2dc8736efbe871c49c5fd850fb7a8ee734cddd7888542cd73c3
- SSDEEP 3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGxlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7CC58092-ABC2-470b-BA4F-0C1D7388A280}.exe
- Size 216KB
- SHA256 b1825fa46f6b6829f134d10b03145118bd09dd903e357e62a2ad2dd7e6defb3d
- MD5 c0d4a0edf837a68d635d9447d787ccb0
- SHA1 e3cc2dc0123c5e8cb8258210c8df6498fc29bf0e
- SHA512 6e14f3610a8307990876f3f1e8832d45cef17d4d36d6d1a1ab451868a5630418908833956b4418a4d2a0be3f37dc4e5a790848a71a6034a9a0df17c7256be733
- SSDEEP 3072:jEGh0oel+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGwlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8C18C955-3145-4522-BFAA-BA8E5108D4DA}.exe
- Size 216KB
- SHA256 c23b7afb5d37fa7fee46663f056a339ca80b244256d13d9605fd921e707d9ef7
- MD5 1501527b52cf4796887bfa52396796ad
- SHA1 b386e79a543030404fd4cdc92ae367389423cfbf
- SHA512 7f8e3cf6777ab5906d14ce0fac606009e00aa75ae76c3f8371d7c20fa35be18e14d3411179954565f0721be0c9a9875773675e354a74d3daab292a53974b6d0b
- SSDEEP 3072:jEGh0oxl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGPlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{979B8049-1EAB-408d-8F72-40F8268A4F3F}.exe
- Size 216KB
- SHA256 1465b5121ad7193b67a60bf9cafb63c9d1d0b81022be624068a91b50fa4e0749
- MD5 ac3931333b554578c6b73b620fba6dcd
- SHA1 036473201539ffbdae65bc690fe77723ac7944ca
- SHA512 97bc6318ef254f2306ec3e3dbe42e5568e06488fe513a5d1d513bb09a0a0b097a3433cb9688428279482964ad7a94dd06b7970abc08498fcb14575791f8e8369
- SSDEEP 3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGQlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CA0EFF8C-2B05-41a4-AD73-11281F7E26F7}.exe
- Size 216KB
- SHA256 a12cf91cfc77149a34f2e1582776fd334a1fc6fd7bbcce015f35079cf5005fab
- MD5 e5d8394a0ed9a685f56c8af58d1c4dfb
- SHA1 277e7f21d4f22957ef71b7e75112b821b5db0153
- SHA512 7331c91e6ad096b4ac87955a6d165ffc127ffaaddeaa5cc53045cec3c622c0c898866dcb8caa1d736af6fc4c095e9255103c3be410496ea845f9101df64ba632
- SSDEEP 3072:jEGh0oml+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGolEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DE5A6E0E-82E7-4370-A9CF-8BE5DF6EA180}.exe
- Size 216KB
- SHA256 ac604b0b0714806cb0e787954db7e52cfecb1e3d4e26571e04757cbe3a59ddc9
- MD5 58aeae17f2e4a881e1b13032ec3646a5
- SHA1 16bbe6eef8c89fd6c850ded5d727334bc6e55507
- SHA512 bab41834fa8e30ae4ab06e93409512ce36da65c46fb7cc02ae8b8add216bb329dacaa6bbbb1a4eca683dfdaffaea4585e261255769530c0c534d340ecd1aadb6
- SSDEEP 3072:jEGh0ovl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGllEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP