Overview

overview

8

Static

static

3

CLOSE_YOUR_EYES.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CLOSE_YOUR_EYES.exe
  • Size 49.1MB
  • Sample261014-e32bpav15n
  • SHA256 6090409c359ae0caf10e55aa46b7435a84803fc0796e308286e1975ba0a25802
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CLOSE_YOUR_EYES.exe
    C:\Users\Admin\AppData\Local\Temp\CLOSE_YOUR_EYES.exe stage2
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3336
    • C:\Windows\SYSTEM32\takeown.exe
      "takeown.exe" /f "C:\Windows\System32\LogonUI.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:4732
    • C:\Windows\SYSTEM32\icacls.exe
      "icacls.exe" "C:\Windows\System32\LogonUI.exe" /grant Everyone:F /grant SYSTEM:F /grant Administrators:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4688
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill" /f /im LogonUI.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5024

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        WMSDKNS.XML.bak
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
        • Size 9KB
        • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hr.gif
        • Path C:\Users\Admin\AppData\Roaming\SystemUpdate\hr.gif
        • Size 1.4MB
        • SHA256 6affb38603ae9a596fded76b5fb7c7d177976168a2c5395a1a45e7ae25bcc29a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kf.gif
        • Path C:\Users\Admin\AppData\Roaming\SystemUpdate\kf.gif
        • Size 13.4MB
        • SHA256 90a1f45ed8217771141a946c1b83234746bba5fc6e2760aa917d7f7838e60135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kj.gif
        • Path C:\Users\Admin\AppData\Roaming\SystemUpdate\kj.gif
        • Size 1.3MB
        • SHA256 d833f610cd7eb9755618520c2e43d6ab5bf64e7bf1918b76b9b8be1c8b649127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3336-0-0x000001DA4E0E0000-0x000001DA51206000-memory.dmp
        Download

        memory/3336-3-0x000001DA6B870000-0x000001DA6B880000-memory.dmp
        Download

        memory/3336-28-0x000001DA6D830000-0x000001DA6DA89000-memory.dmp
        Download

        memory/3336-29-0x000001DA6B870000-0x000001DA6B880000-memory.dmp
        Download