Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
05/07/2023, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
1495fa156f2a21exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
1495fa156f2a21exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
1495fa156f2a21exeexeexeex.exe
-
Size
168KB
-
MD5
1495fa156f2a21bbbf84415c8ce24c45
-
SHA1
7c9d5cd30fcaee50b4b090e6d491c2c8104d8675
-
SHA256
22f2d3e46a945f27d45e0a13f5616ec2137662a5a9a5a202909a0ef9c8083270
-
SHA512
f3c592855097b913dcc7a20ea7828942fa15b33f824c7188c0aa5e5089209ae6dc7d4050337476490c363ce2834e3629b5fd147b0c70bc3283d3e910162eb38c
-
SSDEEP
1536:1EGh0oJlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B6769FDF-827F-4698-B148-A3EEF0C42596} {72AE6C41-E8B5-4688-93C5-96A354160982}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5831B5E1-7166-4dfa-A4F3-8302219DF9B2}\stubpath = "C:\\Windows\\{5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe" {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72AE6C41-E8B5-4688-93C5-96A354160982} {D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}\stubpath = "C:\\Windows\\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe" {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5831B5E1-7166-4dfa-A4F3-8302219DF9B2} {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6E34AAB-7225-41a0-9C83-91F9F164BDBD} {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68FD6B79-7381-479b-897E-BD893AE4BBE6}\stubpath = "C:\\Windows\\{68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe" {C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B6769FDF-827F-4698-B148-A3EEF0C42596}\stubpath = "C:\\Windows\\{B6769FDF-827F-4698-B148-A3EEF0C42596}.exe" {72AE6C41-E8B5-4688-93C5-96A354160982}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C} 1495fa156f2a21exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}\stubpath = "C:\\Windows\\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe" 1495fa156f2a21exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6E34AAB-7225-41a0-9C83-91F9F164BDBD}\stubpath = "C:\\Windows\\{F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe" {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C99C2831-F806-4207-BCF4-ACF4609A1AE1}\stubpath = "C:\\Windows\\{C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe" {47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D837B92B-9E06-4bad-8234-2BBE74B037CE}\stubpath = "C:\\Windows\\{D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe" {68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6987F31D-736A-4d04-9CD2-519D0C655E07}\stubpath = "C:\\Windows\\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exe" {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}\stubpath = "C:\\Windows\\{47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe" {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C99C2831-F806-4207-BCF4-ACF4609A1AE1} {47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}\stubpath = "C:\\Windows\\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe" {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{47CAF39D-CC61-45a9-8EA3-1D3BA7E55259} {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D837B92B-9E06-4bad-8234-2BBE74B037CE} {68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4304A708-63C5-49e6-B67C-78C68215EE5F}\stubpath = "C:\\Windows\\{4304A708-63C5-49e6-B67C-78C68215EE5F}.exe" {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF2252B5-FD1F-4060-88AA-0ABAC0B8970E}\stubpath = "C:\\Windows\\{EF2252B5-FD1F-4060-88AA-0ABAC0B8970E}.exe" {B6769FDF-827F-4698-B148-A3EEF0C42596}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6987F31D-736A-4d04-9CD2-519D0C655E07} {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8} {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4304A708-63C5-49e6-B67C-78C68215EE5F} {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF2252B5-FD1F-4060-88AA-0ABAC0B8970E} {B6769FDF-827F-4698-B148-A3EEF0C42596}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{956D6087-4D3F-4b23-A9B2-F679D7A1B414} {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68FD6B79-7381-479b-897E-BD893AE4BBE6} {C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72AE6C41-E8B5-4688-93C5-96A354160982}\stubpath = "C:\\Windows\\{72AE6C41-E8B5-4688-93C5-96A354160982}.exe" {D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe -
Deletes itself 1 IoCs
pid Process 3032 cmd.exe -
Executes dropped EXE 14 IoCs
pid Process 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 2140 {47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe 840 {C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe 2600 {68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe 2624 {D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe 2736 {72AE6C41-E8B5-4688-93C5-96A354160982}.exe 2608 {B6769FDF-827F-4698-B148-A3EEF0C42596}.exe 2484 {EF2252B5-FD1F-4060-88AA-0ABAC0B8970E}.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 1495fa156f2a21exeexeexeex.exe File created C:\Windows\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe File created C:\Windows\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe File created C:\Windows\{68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe {C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe File created C:\Windows\{B6769FDF-827F-4698-B148-A3EEF0C42596}.exe {72AE6C41-E8B5-4688-93C5-96A354160982}.exe File created C:\Windows\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exe {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe File created C:\Windows\{5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe File created C:\Windows\{47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe File created C:\Windows\{EF2252B5-FD1F-4060-88AA-0ABAC0B8970E}.exe {B6769FDF-827F-4698-B148-A3EEF0C42596}.exe File created C:\Windows\{72AE6C41-E8B5-4688-93C5-96A354160982}.exe {D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe File created C:\Windows\{4304A708-63C5-49e6-B67C-78C68215EE5F}.exe {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe File created C:\Windows\{F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe File created C:\Windows\{C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe {47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe File created C:\Windows\{D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe {68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2280 1495fa156f2a21exeexeexeex.exe Token: SeIncBasePriorityPrivilege 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe Token: SeIncBasePriorityPrivilege 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe Token: SeIncBasePriorityPrivilege 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe Token: SeIncBasePriorityPrivilege 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe Token: SeIncBasePriorityPrivilege 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe Token: SeIncBasePriorityPrivilege 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe Token: SeIncBasePriorityPrivilege 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe Token: SeIncBasePriorityPrivilege 2140 {47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe Token: SeIncBasePriorityPrivilege 840 {C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe Token: SeIncBasePriorityPrivilege 2600 {68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe Token: SeIncBasePriorityPrivilege 2624 {D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe Token: SeIncBasePriorityPrivilege 2736 {72AE6C41-E8B5-4688-93C5-96A354160982}.exe Token: SeIncBasePriorityPrivilege 2608 {B6769FDF-827F-4698-B148-A3EEF0C42596}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2996 2280 1495fa156f2a21exeexeexeex.exe 27 PID 2280 wrote to memory of 2996 2280 1495fa156f2a21exeexeexeex.exe 27 PID 2280 wrote to memory of 2996 2280 1495fa156f2a21exeexeexeex.exe 27 PID 2280 wrote to memory of 2996 2280 1495fa156f2a21exeexeexeex.exe 27 PID 2280 wrote to memory of 3032 2280 1495fa156f2a21exeexeexeex.exe 28 PID 2280 wrote to memory of 3032 2280 1495fa156f2a21exeexeexeex.exe 28 PID 2280 wrote to memory of 3032 2280 1495fa156f2a21exeexeexeex.exe 28 PID 2280 wrote to memory of 3032 2280 1495fa156f2a21exeexeexeex.exe 28 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 1164 wrote to memory of 2968 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 2968 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 2968 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 2968 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 1200 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1164 wrote to memory of 1200 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1164 wrote to memory of 1200 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1164 wrote to memory of 1200 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 2968 wrote to memory of 2808 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 2968 wrote to memory of 2808 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 2968 wrote to memory of 2808 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 2968 wrote to memory of 2808 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 2968 wrote to memory of 2864 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 2968 wrote to memory of 2864 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 2968 wrote to memory of 2864 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 2968 wrote to memory of 2864 2968 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 2808 wrote to memory of 2888 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2808 wrote to memory of 2888 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2808 wrote to memory of 2888 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2808 wrote to memory of 2888 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2808 wrote to memory of 2264 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2808 wrote to memory of 2264 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2808 wrote to memory of 2264 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2808 wrote to memory of 2264 2808 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2888 wrote to memory of 368 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 37 PID 2888 wrote to memory of 368 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 37 PID 2888 wrote to memory of 368 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 37 PID 2888 wrote to memory of 368 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 37 PID 2888 wrote to memory of 1676 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 38 PID 2888 wrote to memory of 1676 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 38 PID 2888 wrote to memory of 1676 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 38 PID 2888 wrote to memory of 1676 2888 {4304A708-63C5-49e6-B67C-78C68215EE5F}.exe 38 PID 368 wrote to memory of 1660 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 39 PID 368 wrote to memory of 1660 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 39 PID 368 wrote to memory of 1660 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 39 PID 368 wrote to memory of 1660 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 39 PID 368 wrote to memory of 1784 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 40 PID 368 wrote to memory of 1784 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 40 PID 368 wrote to memory of 1784 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 40 PID 368 wrote to memory of 1784 368 {5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe 40 PID 1660 wrote to memory of 2140 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 41 PID 1660 wrote to memory of 2140 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 41 PID 1660 wrote to memory of 2140 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 41 PID 1660 wrote to memory of 2140 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 41 PID 1660 wrote to memory of 2268 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 42 PID 1660 wrote to memory of 2268 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 42 PID 1660 wrote to memory of 2268 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 42 PID 1660 wrote to memory of 2268 1660 {F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\1495fa156f2a21exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\1495fa156f2a21exeexeexeex.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exeC:\Windows\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exeC:\Windows\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exeC:\Windows\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exeC:\Windows\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\{4304A708-63C5-49e6-B67C-78C68215EE5F}.exeC:\Windows\{4304A708-63C5-49e6-B67C-78C68215EE5F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\{5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exeC:\Windows\{5831B5E1-7166-4dfa-A4F3-8302219DF9B2}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\{F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exeC:\Windows\{F6E34AAB-7225-41a0-9C83-91F9F164BDBD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\{47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exeC:\Windows\{47CAF39D-CC61-45a9-8EA3-1D3BA7E55259}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Windows\{C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exeC:\Windows\{C99C2831-F806-4207-BCF4-ACF4609A1AE1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:840 -
C:\Windows\{68FD6B79-7381-479b-897E-BD893AE4BBE6}.exeC:\Windows\{68FD6B79-7381-479b-897E-BD893AE4BBE6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Windows\{D837B92B-9E06-4bad-8234-2BBE74B037CE}.exeC:\Windows\{D837B92B-9E06-4bad-8234-2BBE74B037CE}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Windows\{72AE6C41-E8B5-4688-93C5-96A354160982}.exeC:\Windows\{72AE6C41-E8B5-4688-93C5-96A354160982}.exe13⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Windows\{B6769FDF-827F-4698-B148-A3EEF0C42596}.exeC:\Windows\{B6769FDF-827F-4698-B148-A3EEF0C42596}.exe14⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Windows\{EF2252B5-FD1F-4060-88AA-0ABAC0B8970E}.exeC:\Windows\{EF2252B5-FD1F-4060-88AA-0ABAC0B8970E}.exe15⤵
- Executes dropped EXE
PID:2484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6769~1.EXE > nul15⤵PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72AE6~1.EXE > nul14⤵PID:2536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D837B~1.EXE > nul13⤵PID:2508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68FD6~1.EXE > nul12⤵PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C99C2~1.EXE > nul11⤵PID:2676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47CAF~1.EXE > nul10⤵PID:544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6E34~1.EXE > nul9⤵PID:2268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5831B~1.EXE > nul8⤵PID:1784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4304A~1.EXE > nul7⤵PID:1676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1991~1.EXE > nul6⤵PID:2264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6987F~1.EXE > nul5⤵PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{956D6~1.EXE > nul4⤵PID:1200
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DA3E~1.EXE > nul3⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\1495FA~1.EXE > nul2⤵
- Deletes itself
PID:3032
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5e25b9c367dc38bfbb76296481cece008
SHA199ccdd886e171df701cf58a30ab5df0e1ee5cff7
SHA256d11faa9708bc2d780677616f7722f925d0af6d331bcb7f3a67a22245a4256b23
SHA51239cc8864b66aa2ead9daaa79bc836300e7d0aaab49d0fc4d2e65bde19dad5aac6219bc507ea3ad600abd5739d1f83904497229ab65001c97af96c8047f04320c
-
Filesize
168KB
MD5e25b9c367dc38bfbb76296481cece008
SHA199ccdd886e171df701cf58a30ab5df0e1ee5cff7
SHA256d11faa9708bc2d780677616f7722f925d0af6d331bcb7f3a67a22245a4256b23
SHA51239cc8864b66aa2ead9daaa79bc836300e7d0aaab49d0fc4d2e65bde19dad5aac6219bc507ea3ad600abd5739d1f83904497229ab65001c97af96c8047f04320c
-
Filesize
168KB
MD5a43b025d756f0e26e73a9744b9d0a349
SHA1d1bc454624652be15c145468940e55dcab641f4f
SHA25648385e323129e421eb3ae9a1bc8c591e5070ad876f4fac995c3e656f9a8fc6f6
SHA5129d3f6ab0c4d40febfdd932d5badb4dec1a9d82933021d8d3e05625396b0cf6d65dade205e10f1d55467b6f4d31b083291e9c11331409f74d3429f538619408a3
-
Filesize
168KB
MD5a43b025d756f0e26e73a9744b9d0a349
SHA1d1bc454624652be15c145468940e55dcab641f4f
SHA25648385e323129e421eb3ae9a1bc8c591e5070ad876f4fac995c3e656f9a8fc6f6
SHA5129d3f6ab0c4d40febfdd932d5badb4dec1a9d82933021d8d3e05625396b0cf6d65dade205e10f1d55467b6f4d31b083291e9c11331409f74d3429f538619408a3
-
Filesize
168KB
MD5080a69365381d5a9a7bd788f2436662f
SHA12ef0488fcc14a7adeeb7e42c8d9705e527a3c8a0
SHA25603b2d25b5e519cebd3898b684385c9909677e165af084cba2ed26be891119a1c
SHA5126faabbdb6d4a8cee467dc9081c307ef3cc94efc0dcbbe6a72974838666ab833b520e1ad28a2bbe054946a90afb2f723c674ba7c9e82ddaa666e6ca48feed9c6a
-
Filesize
168KB
MD5080a69365381d5a9a7bd788f2436662f
SHA12ef0488fcc14a7adeeb7e42c8d9705e527a3c8a0
SHA25603b2d25b5e519cebd3898b684385c9909677e165af084cba2ed26be891119a1c
SHA5126faabbdb6d4a8cee467dc9081c307ef3cc94efc0dcbbe6a72974838666ab833b520e1ad28a2bbe054946a90afb2f723c674ba7c9e82ddaa666e6ca48feed9c6a
-
Filesize
168KB
MD555ace9d72b030e05840c808fece9c97d
SHA1064af1c13334b19e71ab0f4d6bb69b7909c492e5
SHA256f9ffdc6ea828d7bfe954f61a430b08c627b5cdcaddc6a0ddafbdf1b6d349b99e
SHA512bf0e6b4b1b8ead1c913b3e438c0a4e3af0232b494b9be2de13f2d9ecaa2832e09f5d992ee9954093c2baf9798f4741956ea3079ba34c6fb44bf3497a4f6e3be4
-
Filesize
168KB
MD555ace9d72b030e05840c808fece9c97d
SHA1064af1c13334b19e71ab0f4d6bb69b7909c492e5
SHA256f9ffdc6ea828d7bfe954f61a430b08c627b5cdcaddc6a0ddafbdf1b6d349b99e
SHA512bf0e6b4b1b8ead1c913b3e438c0a4e3af0232b494b9be2de13f2d9ecaa2832e09f5d992ee9954093c2baf9798f4741956ea3079ba34c6fb44bf3497a4f6e3be4
-
Filesize
168KB
MD56b2bad5c7dc1e4019bc5a4dc0f728ae3
SHA13d622656df8a270ef80b8c2364958b523c12f2a3
SHA2561184fcd7455a4d1f8483b88b477c78343bc7168492398076f88b2e4e97bc48ad
SHA5126d280e9bab163e7050cc0012012fecf0df0ff40e4391cc30f2f9bd950bf44fcb884b99422fc0ac79d0afa09df5757e45724d56aebb0c1311cee2cbe107034015
-
Filesize
168KB
MD56b2bad5c7dc1e4019bc5a4dc0f728ae3
SHA13d622656df8a270ef80b8c2364958b523c12f2a3
SHA2561184fcd7455a4d1f8483b88b477c78343bc7168492398076f88b2e4e97bc48ad
SHA5126d280e9bab163e7050cc0012012fecf0df0ff40e4391cc30f2f9bd950bf44fcb884b99422fc0ac79d0afa09df5757e45724d56aebb0c1311cee2cbe107034015
-
Filesize
168KB
MD54b1b39dae7fb28d88b50654228e2958d
SHA16840319fcfde4c29d0c72042e08183f25d69dc10
SHA25673f38e00b5c46dd693885c829885c4631297abf5caabee19bfd7b27b34d11436
SHA512f1a2a24f90becdbb52b0d84d24bf6689f1223b4d26077ea22e7d21dfb91fad29a605e0efcbecc548795b8d88c2f36baabd70e7cf15dff0b745ba2a90b9b14a03
-
Filesize
168KB
MD54b1b39dae7fb28d88b50654228e2958d
SHA16840319fcfde4c29d0c72042e08183f25d69dc10
SHA25673f38e00b5c46dd693885c829885c4631297abf5caabee19bfd7b27b34d11436
SHA512f1a2a24f90becdbb52b0d84d24bf6689f1223b4d26077ea22e7d21dfb91fad29a605e0efcbecc548795b8d88c2f36baabd70e7cf15dff0b745ba2a90b9b14a03
-
Filesize
168KB
MD53c2ef9f4e05b204663db12f569e6a623
SHA1607d8b21abf1ea614ca2f27bfbac85d512311523
SHA25652ce0b55b4b238542023b9233ead9eb6ece5584db408a2379d509cc42ee5e556
SHA512e9adc35b5a6e640bf4f7a8b04810b5cdf618ee7c37d967910f85f5183cb9cc66dcf879cf66d154e9fba31e740617cb186ac4bf0caa3ca5283669083ec375155e
-
Filesize
168KB
MD53c2ef9f4e05b204663db12f569e6a623
SHA1607d8b21abf1ea614ca2f27bfbac85d512311523
SHA25652ce0b55b4b238542023b9233ead9eb6ece5584db408a2379d509cc42ee5e556
SHA512e9adc35b5a6e640bf4f7a8b04810b5cdf618ee7c37d967910f85f5183cb9cc66dcf879cf66d154e9fba31e740617cb186ac4bf0caa3ca5283669083ec375155e
-
Filesize
168KB
MD53c2ef9f4e05b204663db12f569e6a623
SHA1607d8b21abf1ea614ca2f27bfbac85d512311523
SHA25652ce0b55b4b238542023b9233ead9eb6ece5584db408a2379d509cc42ee5e556
SHA512e9adc35b5a6e640bf4f7a8b04810b5cdf618ee7c37d967910f85f5183cb9cc66dcf879cf66d154e9fba31e740617cb186ac4bf0caa3ca5283669083ec375155e
-
Filesize
168KB
MD568c80a97275ccdc9918f74449eed4d97
SHA18e47d41ace9c20ad3420fada2d679e878d3d466b
SHA256964ddba422eaaa4ce5a542b88bd67bb865d04164b26f311246edd30a46da8ddc
SHA512282edf5ac8c907237331726401364c012fb64835b1de1ea880dbce0f827738378e7164710eacb2aa0158a243c5ec37dac9a6b7c7b50075141db05c6a1831be64
-
Filesize
168KB
MD568c80a97275ccdc9918f74449eed4d97
SHA18e47d41ace9c20ad3420fada2d679e878d3d466b
SHA256964ddba422eaaa4ce5a542b88bd67bb865d04164b26f311246edd30a46da8ddc
SHA512282edf5ac8c907237331726401364c012fb64835b1de1ea880dbce0f827738378e7164710eacb2aa0158a243c5ec37dac9a6b7c7b50075141db05c6a1831be64
-
Filesize
168KB
MD5e9b750597e4e08426cdf2734aedb4246
SHA152a1173344760ad65ae3fdf6e5dd1aa605f42d41
SHA25692bb4eef9f8e641ef4a3b1a59f407a7c71caf17bad830a6a35ec5398651e3983
SHA5123beb83461377a5b989d2705b9d4ecd9bc63519e83c48e28b5b4ee71e69f9ac96e0baa2deb3ee3728ba0b3b03e953994ef69999c52fc9ee6614fcd12b8afbfd16
-
Filesize
168KB
MD5e9b750597e4e08426cdf2734aedb4246
SHA152a1173344760ad65ae3fdf6e5dd1aa605f42d41
SHA25692bb4eef9f8e641ef4a3b1a59f407a7c71caf17bad830a6a35ec5398651e3983
SHA5123beb83461377a5b989d2705b9d4ecd9bc63519e83c48e28b5b4ee71e69f9ac96e0baa2deb3ee3728ba0b3b03e953994ef69999c52fc9ee6614fcd12b8afbfd16
-
Filesize
168KB
MD566b33278845109d100e6e1845c92d1cb
SHA1746d4b81c12f0e3f163cfa70b19a6df99cafd011
SHA256a5dad540066af75d7e1a0df0492e699c25a44c7951f290f9a633545ba33c64b1
SHA512797e466ba1b915601f60cdf279c65288aa0b491b1877efabdf9f5a5d16225be0c7e72cfb80ef1f10c16df3e4cd88e532b40744d876064eae1b8127536f9bfd1a
-
Filesize
168KB
MD566b33278845109d100e6e1845c92d1cb
SHA1746d4b81c12f0e3f163cfa70b19a6df99cafd011
SHA256a5dad540066af75d7e1a0df0492e699c25a44c7951f290f9a633545ba33c64b1
SHA512797e466ba1b915601f60cdf279c65288aa0b491b1877efabdf9f5a5d16225be0c7e72cfb80ef1f10c16df3e4cd88e532b40744d876064eae1b8127536f9bfd1a
-
Filesize
168KB
MD5e734a70f7713d9a6c8ae0242979f5b5f
SHA1d193fa6aed85b9aca0e9451e216f03fcca277edd
SHA2565d90360f55c6134ea6c39f4ae42fb1dfa78513445b0adfa35c852c79c6f288bc
SHA512ccf8e56f98be357b2ca515c36adc8a20598095da2f95f094507aa936cf5229b0d3546e3eeda0627d1d5d3b70c580ecd6e131a8303fee3f717c1aea8b25c2f5a3
-
Filesize
168KB
MD5e734a70f7713d9a6c8ae0242979f5b5f
SHA1d193fa6aed85b9aca0e9451e216f03fcca277edd
SHA2565d90360f55c6134ea6c39f4ae42fb1dfa78513445b0adfa35c852c79c6f288bc
SHA512ccf8e56f98be357b2ca515c36adc8a20598095da2f95f094507aa936cf5229b0d3546e3eeda0627d1d5d3b70c580ecd6e131a8303fee3f717c1aea8b25c2f5a3
-
Filesize
168KB
MD5b82c48eb74c40704b4c23658d63e27e9
SHA1d23f04a67213769d5ee212013359b2bf54ec2874
SHA25625419685e3e948a22951751e193f5031fa4acc5c360214d051113f31c0f5622a
SHA512648493f72e6656dd2d782f264a524e06558e358c39e4d4bb1134a3c8a8b06f8f3a4a4f109fdbec58ba5fbb45bb26db38bb0e764aea77eeb7f3275127906e705d
-
Filesize
168KB
MD5b82c48eb74c40704b4c23658d63e27e9
SHA1d23f04a67213769d5ee212013359b2bf54ec2874
SHA25625419685e3e948a22951751e193f5031fa4acc5c360214d051113f31c0f5622a
SHA512648493f72e6656dd2d782f264a524e06558e358c39e4d4bb1134a3c8a8b06f8f3a4a4f109fdbec58ba5fbb45bb26db38bb0e764aea77eeb7f3275127906e705d
-
Filesize
168KB
MD5ea81c6415eb0a823d2396308436433f7
SHA11714b7f026a734b4fa98c67331dab8ea91fb59b2
SHA256150421961cd5e8155698d3eb001f59e067b16bc60e8830e527e55e10306d5f2b
SHA512856252d55bde1a1e0134feb4cee2f260025d9cf4b6ebe3723582b2ffce5b096be5329d56b9b79033892ebfc4056a0042c337ec2c8ffdb559d4072ea195eb0c52
-
Filesize
168KB
MD512b5e4b8b77cd6423e612224d6430144
SHA1b30ec1ea8588cc7df24583be8e677aed89d6bdba
SHA256d6260532733bbbd45b454b8420636ffaed8e684331857146a0a99855fb8ea128
SHA5128f9f9a2bd4760c8f71b9666dc4484a2f8ad7a88b0fcd5164752b43d2ac4cf7dddc683a39c63a4adf3c8e326dbe9ffb5f34031f7fb90f1648d4d009bd13786ebb
-
Filesize
168KB
MD512b5e4b8b77cd6423e612224d6430144
SHA1b30ec1ea8588cc7df24583be8e677aed89d6bdba
SHA256d6260532733bbbd45b454b8420636ffaed8e684331857146a0a99855fb8ea128
SHA5128f9f9a2bd4760c8f71b9666dc4484a2f8ad7a88b0fcd5164752b43d2ac4cf7dddc683a39c63a4adf3c8e326dbe9ffb5f34031f7fb90f1648d4d009bd13786ebb