Overview

overview

8

Static

static

3

CLOSE_YOUR_EYES.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CLOSE_YOUR_EYES.exe
  • Size 49.1MB
  • Sample261014-e7p48aws2m
  • SHA256 915f3c84edabe0938769aeb4dfc1311d0524b23adce4f4a503ec4dea3230e963
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CLOSE_YOUR_EYES.exe
    C:\Users\Admin\AppData\Local\Temp\CLOSE_YOUR_EYES.exe stage2
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5720
    • C:\Windows\SYSTEM32\takeown.exe
      "takeown.exe" /f "C:\Windows\System32\LogonUI.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:2080
    • C:\Windows\SYSTEM32\icacls.exe
      "icacls.exe" "C:\Windows\System32\LogonUI.exe" /grant Everyone:F /grant SYSTEM:F /grant Administrators:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2064
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill" /f /im LogonUI.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        WMSDKNS.XML
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
        • Size 9KB
        • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hr.gif
        • Path C:\Users\Admin\AppData\Roaming\SystemUpdate\hr.gif
        • Size 1.4MB
        • SHA256 6affb38603ae9a596fded76b5fb7c7d177976168a2c5395a1a45e7ae25bcc29a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kf.gif
        • Path C:\Users\Admin\AppData\Roaming\SystemUpdate\kf.gif
        • Size 13.4MB
        • SHA256 90a1f45ed8217771141a946c1b83234746bba5fc6e2760aa917d7f7838e60135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vd.gif
        • Path C:\Users\Admin\AppData\Roaming\SystemUpdate\vd.gif
        • Size 16.1MB
        • SHA256 b6c4f98f2480bc95ad35a3bfc9d902a6086477c803ffd8b1ffc888ab96392a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5720-0-0x00000247EE0D0000-0x00000247F11F6000-memory.dmp
        Download

        memory/5720-3-0x00000247F37C0000-0x00000247F37D0000-memory.dmp
        Download

        memory/5720-28-0x00000247F5280000-0x00000247F5D84000-memory.dmp
        Download

        memory/5720-29-0x00000247F37C0000-0x00000247F37D0000-memory.dmp
        Download