Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
11/07/2023, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
ebfca9a6c5232eexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
ebfca9a6c5232eexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
ebfca9a6c5232eexeexeexeex.exe
-
Size
408KB
-
MD5
ebfca9a6c5232e1f2a32a43b9325d0ff
-
SHA1
9e7bc8c1b893f55f82efc0fc270193341fc62aa6
-
SHA256
bb6130d499e48c2a0235964ccbd89262c5f62ecce6d2e7c2af9728a36756ffb1
-
SHA512
ed1222b678d107993f237488628fbccd4301234fd1d77dca7581dd9f31bb3baaee8ccbcf37ee765e889be5665dec4d666a8227aa6ea57c9c0b67a0d6b79421f5
-
SSDEEP
3072:CEGh0orl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGpldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81131002-DF81-4918-A686-4E46355C4ADC}\stubpath = "C:\\Windows\\{81131002-DF81-4918-A686-4E46355C4ADC}.exe" {3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8109BE64-79AF-4a09-8A01-E4A3ED267741} {EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3029AB2-9A97-403a-84B6-B0847B05F6EB} {8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0704FF4-FCCD-4a0a-97B6-295FB3153A9E} {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}\stubpath = "C:\\Windows\\{E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe" {8B11C274-68B7-43af-B737-614FCAD962BB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}\stubpath = "C:\\Windows\\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe" {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5779EEB7-0282-49eb-81EE-4581C4955C23} {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B11C274-68B7-43af-B737-614FCAD962BB} {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}\stubpath = "C:\\Windows\\{3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe" {E1D56A03-54E9-454d-9911-891F0D4DD005}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1D56A03-54E9-454d-9911-891F0D4DD005} {E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EACCC01D-5D28-434e-BED6-DDE0875FB3B6} {81131002-DF81-4918-A686-4E46355C4ADC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{956D6087-4D3F-4b23-A9B2-F679D7A1B414} {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}\stubpath = "C:\\Windows\\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe" {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}\stubpath = "C:\\Windows\\{D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe" {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC} {8B11C274-68B7-43af-B737-614FCAD962BB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8109BE64-79AF-4a09-8A01-E4A3ED267741}\stubpath = "C:\\Windows\\{8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe" {EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C} ebfca9a6c5232eexeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5779EEB7-0282-49eb-81EE-4581C4955C23}\stubpath = "C:\\Windows\\{5779EEB7-0282-49eb-81EE-4581C4955C23}.exe" {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B11C274-68B7-43af-B737-614FCAD962BB}\stubpath = "C:\\Windows\\{8B11C274-68B7-43af-B737-614FCAD962BB}.exe" {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81131002-DF81-4918-A686-4E46355C4ADC} {3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}\stubpath = "C:\\Windows\\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe" ebfca9a6c5232eexeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EACCC01D-5D28-434e-BED6-DDE0875FB3B6}\stubpath = "C:\\Windows\\{EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe" {81131002-DF81-4918-A686-4E46355C4ADC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6987F31D-736A-4d04-9CD2-519D0C655E07} {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1D56A03-54E9-454d-9911-891F0D4DD005}\stubpath = "C:\\Windows\\{E1D56A03-54E9-454d-9911-891F0D4DD005}.exe" {E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6987F31D-736A-4d04-9CD2-519D0C655E07}\stubpath = "C:\\Windows\\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exe" {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8} {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7} {E1D56A03-54E9-454d-9911-891F0D4DD005}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3029AB2-9A97-403a-84B6-B0847B05F6EB}\stubpath = "C:\\Windows\\{D3029AB2-9A97-403a-84B6-B0847B05F6EB}.exe" {8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe -
Deletes itself 1 IoCs
pid Process 3032 cmd.exe -
Executes dropped EXE 14 IoCs
pid Process 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 2268 {E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe 544 {E1D56A03-54E9-454d-9911-891F0D4DD005}.exe 2676 {3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe 2596 {81131002-DF81-4918-A686-4E46355C4ADC}.exe 2508 {EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe 2204 {8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe 2524 {D3029AB2-9A97-403a-84B6-B0847B05F6EB}.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\{D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe File created C:\Windows\{E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe {8B11C274-68B7-43af-B737-614FCAD962BB}.exe File created C:\Windows\{81131002-DF81-4918-A686-4E46355C4ADC}.exe {3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe File created C:\Windows\{E1D56A03-54E9-454d-9911-891F0D4DD005}.exe {E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe File created C:\Windows\{3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe {E1D56A03-54E9-454d-9911-891F0D4DD005}.exe File created C:\Windows\{EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe {81131002-DF81-4918-A686-4E46355C4ADC}.exe File created C:\Windows\{D3029AB2-9A97-403a-84B6-B0847B05F6EB}.exe {8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe File created C:\Windows\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe ebfca9a6c5232eexeexeexeex.exe File created C:\Windows\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe File created C:\Windows\{8B11C274-68B7-43af-B737-614FCAD962BB}.exe {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe File created C:\Windows\{8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe {EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe File created C:\Windows\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exe {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe File created C:\Windows\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe File created C:\Windows\{5779EEB7-0282-49eb-81EE-4581C4955C23}.exe {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2300 ebfca9a6c5232eexeexeexeex.exe Token: SeIncBasePriorityPrivilege 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe Token: SeIncBasePriorityPrivilege 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe Token: SeIncBasePriorityPrivilege 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe Token: SeIncBasePriorityPrivilege 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe Token: SeIncBasePriorityPrivilege 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe Token: SeIncBasePriorityPrivilege 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe Token: SeIncBasePriorityPrivilege 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe Token: SeIncBasePriorityPrivilege 2268 {E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe Token: SeIncBasePriorityPrivilege 544 {E1D56A03-54E9-454d-9911-891F0D4DD005}.exe Token: SeIncBasePriorityPrivilege 2676 {3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe Token: SeIncBasePriorityPrivilege 2596 {81131002-DF81-4918-A686-4E46355C4ADC}.exe Token: SeIncBasePriorityPrivilege 2508 {EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe Token: SeIncBasePriorityPrivilege 2204 {8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2996 2300 ebfca9a6c5232eexeexeexeex.exe 27 PID 2300 wrote to memory of 2996 2300 ebfca9a6c5232eexeexeexeex.exe 27 PID 2300 wrote to memory of 2996 2300 ebfca9a6c5232eexeexeexeex.exe 27 PID 2300 wrote to memory of 2996 2300 ebfca9a6c5232eexeexeexeex.exe 27 PID 2300 wrote to memory of 3032 2300 ebfca9a6c5232eexeexeexeex.exe 28 PID 2300 wrote to memory of 3032 2300 ebfca9a6c5232eexeexeexeex.exe 28 PID 2300 wrote to memory of 3032 2300 ebfca9a6c5232eexeexeexeex.exe 28 PID 2300 wrote to memory of 3032 2300 ebfca9a6c5232eexeexeexeex.exe 28 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 1164 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 29 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 2996 wrote to memory of 2656 2996 {8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe 30 PID 1164 wrote to memory of 1964 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 1964 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 1964 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 1964 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 31 PID 1164 wrote to memory of 568 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1164 wrote to memory of 568 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1164 wrote to memory of 568 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1164 wrote to memory of 568 1164 {956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe 32 PID 1964 wrote to memory of 2860 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 1964 wrote to memory of 2860 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 1964 wrote to memory of 2860 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 1964 wrote to memory of 2860 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 33 PID 1964 wrote to memory of 2872 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 1964 wrote to memory of 2872 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 1964 wrote to memory of 2872 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 1964 wrote to memory of 2872 1964 {6987F31D-736A-4d04-9CD2-519D0C655E07}.exe 34 PID 2860 wrote to memory of 2264 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2860 wrote to memory of 2264 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2860 wrote to memory of 2264 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2860 wrote to memory of 2264 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 35 PID 2860 wrote to memory of 368 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2860 wrote to memory of 368 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2860 wrote to memory of 368 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2860 wrote to memory of 368 2860 {A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe 36 PID 2264 wrote to memory of 1952 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 38 PID 2264 wrote to memory of 1952 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 38 PID 2264 wrote to memory of 1952 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 38 PID 2264 wrote to memory of 1952 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 38 PID 2264 wrote to memory of 1660 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 37 PID 2264 wrote to memory of 1660 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 37 PID 2264 wrote to memory of 1660 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 37 PID 2264 wrote to memory of 1660 2264 {D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe 37 PID 1952 wrote to memory of 2072 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 39 PID 1952 wrote to memory of 2072 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 39 PID 1952 wrote to memory of 2072 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 39 PID 1952 wrote to memory of 2072 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 39 PID 1952 wrote to memory of 2140 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 40 PID 1952 wrote to memory of 2140 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 40 PID 1952 wrote to memory of 2140 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 40 PID 1952 wrote to memory of 2140 1952 {5779EEB7-0282-49eb-81EE-4581C4955C23}.exe 40 PID 2072 wrote to memory of 2268 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 41 PID 2072 wrote to memory of 2268 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 41 PID 2072 wrote to memory of 2268 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 41 PID 2072 wrote to memory of 2268 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 41 PID 2072 wrote to memory of 840 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 42 PID 2072 wrote to memory of 840 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 42 PID 2072 wrote to memory of 840 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 42 PID 2072 wrote to memory of 840 2072 {8B11C274-68B7-43af-B737-614FCAD962BB}.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebfca9a6c5232eexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\ebfca9a6c5232eexeexeexeex.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exeC:\Windows\{8DA3E8B1-604E-41e7-9A7A-A37C61E5502C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exeC:\Windows\{956D6087-4D3F-4b23-A9B2-F679D7A1B414}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exeC:\Windows\{6987F31D-736A-4d04-9CD2-519D0C655E07}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exeC:\Windows\{A1991E9D-8F72-49a4-9854-33EA1B2CECE8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\{D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exeC:\Windows\{D0704FF4-FCCD-4a0a-97B6-295FB3153A9E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0704~1.EXE > nul7⤵PID:1660
-
-
C:\Windows\{5779EEB7-0282-49eb-81EE-4581C4955C23}.exeC:\Windows\{5779EEB7-0282-49eb-81EE-4581C4955C23}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\{8B11C274-68B7-43af-B737-614FCAD962BB}.exeC:\Windows\{8B11C274-68B7-43af-B737-614FCAD962BB}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\{E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exeC:\Windows\{E5FAEFA9-1139-4c9d-B00A-8BB9D023DDCC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Windows\{E1D56A03-54E9-454d-9911-891F0D4DD005}.exeC:\Windows\{E1D56A03-54E9-454d-9911-891F0D4DD005}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:544 -
C:\Windows\{3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exeC:\Windows\{3BA40EC7-1FF6-4654-BEB2-EC0BCF91EEA7}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\{81131002-DF81-4918-A686-4E46355C4ADC}.exeC:\Windows\{81131002-DF81-4918-A686-4E46355C4ADC}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Windows\{EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exeC:\Windows\{EACCC01D-5D28-434e-BED6-DDE0875FB3B6}.exe13⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2508 -
C:\Windows\{8109BE64-79AF-4a09-8A01-E4A3ED267741}.exeC:\Windows\{8109BE64-79AF-4a09-8A01-E4A3ED267741}.exe14⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\{D3029AB2-9A97-403a-84B6-B0847B05F6EB}.exeC:\Windows\{D3029AB2-9A97-403a-84B6-B0847B05F6EB}.exe15⤵
- Executes dropped EXE
PID:2524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8109B~1.EXE > nul15⤵PID:2640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EACCC~1.EXE > nul14⤵PID:2476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81131~1.EXE > nul13⤵PID:2572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BA40~1.EXE > nul12⤵PID:2700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1D56~1.EXE > nul11⤵PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5FAE~1.EXE > nul10⤵PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B11C~1.EXE > nul9⤵PID:840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5779E~1.EXE > nul8⤵PID:2140
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1991~1.EXE > nul6⤵PID:368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6987F~1.EXE > nul5⤵PID:2872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{956D6~1.EXE > nul4⤵PID:568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DA3E~1.EXE > nul3⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EBFCA9~1.EXE > nul2⤵
- Deletes itself
PID:3032
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD596809ddb6b0347b987703419ddcd15a7
SHA1e0ba68ca6ce205467ba7f461ec5f0a96493a182e
SHA256f6d5ce15d40089a1a26255791f425077ebc439146bfe91bb12b3446bb8548809
SHA51236a6a3cc344f32a0a1392bcff990d07a4d6b7f50e400d39c578f6ae79b4d40bfb22795201b0653996dfe0889aa8fa350b6fdac255411c5feee0329a2d348f6b8
-
Filesize
408KB
MD596809ddb6b0347b987703419ddcd15a7
SHA1e0ba68ca6ce205467ba7f461ec5f0a96493a182e
SHA256f6d5ce15d40089a1a26255791f425077ebc439146bfe91bb12b3446bb8548809
SHA51236a6a3cc344f32a0a1392bcff990d07a4d6b7f50e400d39c578f6ae79b4d40bfb22795201b0653996dfe0889aa8fa350b6fdac255411c5feee0329a2d348f6b8
-
Filesize
408KB
MD5ba8885467528b87767216ddc81e87712
SHA12052135514b1c7649abcbb2be74c144b3fa5b1df
SHA2560a36da75d83786107899045111126292616975c4ce8e0c289ad9f53dbb0e269e
SHA5121b577fb23383572f99fdde0f4a3dbe73ffd02c8acbe51484de139279780ff710a44614017e9ec73f5a99bed9cc0f98175af52febe8836ac744a6e656f8796325
-
Filesize
408KB
MD5ba8885467528b87767216ddc81e87712
SHA12052135514b1c7649abcbb2be74c144b3fa5b1df
SHA2560a36da75d83786107899045111126292616975c4ce8e0c289ad9f53dbb0e269e
SHA5121b577fb23383572f99fdde0f4a3dbe73ffd02c8acbe51484de139279780ff710a44614017e9ec73f5a99bed9cc0f98175af52febe8836ac744a6e656f8796325
-
Filesize
408KB
MD5c279ba5194dea8a042340b71fa81d938
SHA16d4faa9e8ad4231bffbcc5629378d33c79451ab2
SHA256842b358e457e891fd0c2df6ad424070dba192142ef4bfea2caba8acf1c6d4d04
SHA5123050017f0bf13a37036762a3d1ac5d52c59fab1f23b58fb0549f88e7199d233bef5651e1589814760ba7a472e127cfaf12518760acda2f71e36b979ea6b9091c
-
Filesize
408KB
MD5c279ba5194dea8a042340b71fa81d938
SHA16d4faa9e8ad4231bffbcc5629378d33c79451ab2
SHA256842b358e457e891fd0c2df6ad424070dba192142ef4bfea2caba8acf1c6d4d04
SHA5123050017f0bf13a37036762a3d1ac5d52c59fab1f23b58fb0549f88e7199d233bef5651e1589814760ba7a472e127cfaf12518760acda2f71e36b979ea6b9091c
-
Filesize
408KB
MD56c667408cf9244874776e217caf35b42
SHA1ec46607b81f3a1159dc1f494655c4031477b08bb
SHA256c1d951a3bc1ed68684f991ab8070fc86876a9c85d569e3e96659812dc78c71c1
SHA512e3b750177b7cca85d732780ddf73c3dc20b0926bf854c6884726c91bfd9dc4043fdf8586df1818da242fa111099a03d3facd556c6d84205a37ffdd40ddcf0dd8
-
Filesize
408KB
MD56c667408cf9244874776e217caf35b42
SHA1ec46607b81f3a1159dc1f494655c4031477b08bb
SHA256c1d951a3bc1ed68684f991ab8070fc86876a9c85d569e3e96659812dc78c71c1
SHA512e3b750177b7cca85d732780ddf73c3dc20b0926bf854c6884726c91bfd9dc4043fdf8586df1818da242fa111099a03d3facd556c6d84205a37ffdd40ddcf0dd8
-
Filesize
408KB
MD5125362a6fa9a8e4e5dd79e5314ce4696
SHA1db6ece3f6e89561cfc30d033cf2550c7d2d5b1a7
SHA2562897bd2a1c7ff95678d506153d0c328d0145c09c677b316baa5e4f37cfd8ff05
SHA51241ec3f292d031531fc40ec5ee2ac5972a2f7f2b1950e4d01122f35a7369edb436636711ec2d50d0cb8f66de5ad7927420a60f49eb8b5a731bdc323602282692e
-
Filesize
408KB
MD5125362a6fa9a8e4e5dd79e5314ce4696
SHA1db6ece3f6e89561cfc30d033cf2550c7d2d5b1a7
SHA2562897bd2a1c7ff95678d506153d0c328d0145c09c677b316baa5e4f37cfd8ff05
SHA51241ec3f292d031531fc40ec5ee2ac5972a2f7f2b1950e4d01122f35a7369edb436636711ec2d50d0cb8f66de5ad7927420a60f49eb8b5a731bdc323602282692e
-
Filesize
408KB
MD535620cbb468498ec3a1f6b258bef624f
SHA16d855b67ec45a3d7db7ba3812d700be1616ab1ef
SHA256fef4f383365fdc2e513e37779bb5f961cfc741f3291454a08258d15fa6e040c4
SHA5129710694874c4778dcfb4610fbca874f542109dafa1e191102d959c6959ab1aeb4463d238617abb1e11a86f73ebdf90ae0963d476492f3a30f4e9f5cf544a99ea
-
Filesize
408KB
MD535620cbb468498ec3a1f6b258bef624f
SHA16d855b67ec45a3d7db7ba3812d700be1616ab1ef
SHA256fef4f383365fdc2e513e37779bb5f961cfc741f3291454a08258d15fa6e040c4
SHA5129710694874c4778dcfb4610fbca874f542109dafa1e191102d959c6959ab1aeb4463d238617abb1e11a86f73ebdf90ae0963d476492f3a30f4e9f5cf544a99ea
-
Filesize
408KB
MD51fdffab13211a80f4daecfb34da7197c
SHA1e0864929a97fc4a25c7e73215a5abe45e859bd87
SHA2560d03d064343a8708db7de6d117482678519bcfed4898f404444877a669fbb936
SHA512399a17621fe3f23e3387a425f4554dacd11a4328df1c370d25e63ee96ee095dd3111060b6c6a36d9499c443ac539d6f0aa1d8d02e15f4b5af79fde644fa6569e
-
Filesize
408KB
MD51fdffab13211a80f4daecfb34da7197c
SHA1e0864929a97fc4a25c7e73215a5abe45e859bd87
SHA2560d03d064343a8708db7de6d117482678519bcfed4898f404444877a669fbb936
SHA512399a17621fe3f23e3387a425f4554dacd11a4328df1c370d25e63ee96ee095dd3111060b6c6a36d9499c443ac539d6f0aa1d8d02e15f4b5af79fde644fa6569e
-
Filesize
408KB
MD51fdffab13211a80f4daecfb34da7197c
SHA1e0864929a97fc4a25c7e73215a5abe45e859bd87
SHA2560d03d064343a8708db7de6d117482678519bcfed4898f404444877a669fbb936
SHA512399a17621fe3f23e3387a425f4554dacd11a4328df1c370d25e63ee96ee095dd3111060b6c6a36d9499c443ac539d6f0aa1d8d02e15f4b5af79fde644fa6569e
-
Filesize
408KB
MD52e48f8c1ae46a6f942b28d5748e0769a
SHA1e1a94b22f54e6deeb3ce9d845ae37f358567ec44
SHA256276d92518d3ab68a714b7406c696eee06c64b48efa290c4c499f3b9470986075
SHA51251bedb38f18b2c72f824653ed1a96916104c8a23cc20ff07e32a9cf4fd9ee9175266f375a0b7074fa4f30b5c9f42146f3b1f10c9e3555f4dd635c77cc413d051
-
Filesize
408KB
MD52e48f8c1ae46a6f942b28d5748e0769a
SHA1e1a94b22f54e6deeb3ce9d845ae37f358567ec44
SHA256276d92518d3ab68a714b7406c696eee06c64b48efa290c4c499f3b9470986075
SHA51251bedb38f18b2c72f824653ed1a96916104c8a23cc20ff07e32a9cf4fd9ee9175266f375a0b7074fa4f30b5c9f42146f3b1f10c9e3555f4dd635c77cc413d051
-
Filesize
408KB
MD57b212f6c2d52ddb54ef1855feb6af714
SHA1d39f3c1a4e4305c4191719a200c9da846ee5d51f
SHA2562caf58f3aaf24078e8de07b98cd352513de06d86451dac746a3d2fb9d07b4a80
SHA5124ddc514def711ff3ade4b9b0c2e3153e3f9ad88ad0952211f54b442b2d03f07d0c288b978789c8dc4ceb0a72894ef3cde173c21c8f723b32f8ac9ed143566d9b
-
Filesize
408KB
MD57b212f6c2d52ddb54ef1855feb6af714
SHA1d39f3c1a4e4305c4191719a200c9da846ee5d51f
SHA2562caf58f3aaf24078e8de07b98cd352513de06d86451dac746a3d2fb9d07b4a80
SHA5124ddc514def711ff3ade4b9b0c2e3153e3f9ad88ad0952211f54b442b2d03f07d0c288b978789c8dc4ceb0a72894ef3cde173c21c8f723b32f8ac9ed143566d9b
-
Filesize
408KB
MD55a1a199fb6a3798a58ea09418adeb2e6
SHA1df36c425cfefb58d4bf4d9dc814807ce82dd577f
SHA25604d205b182944b61a496118a953b06df18fbfb3edf5d8985da67ded9b2c2a731
SHA512419f9b2dcb58b75993e380f9ee9c5a6f3b021d8fe56533ba9ce66925c26e27551b50fbac24839fce792567340a2a13649f0d086d48e9466e7bdb218a5e254c21
-
Filesize
408KB
MD55a1a199fb6a3798a58ea09418adeb2e6
SHA1df36c425cfefb58d4bf4d9dc814807ce82dd577f
SHA25604d205b182944b61a496118a953b06df18fbfb3edf5d8985da67ded9b2c2a731
SHA512419f9b2dcb58b75993e380f9ee9c5a6f3b021d8fe56533ba9ce66925c26e27551b50fbac24839fce792567340a2a13649f0d086d48e9466e7bdb218a5e254c21
-
Filesize
408KB
MD598bc27a0f97d3674a97f763c389ba678
SHA1b12ecd67c36cd61b0e00a5795d95d7ba6508ef8c
SHA25681e5972961e978471526ea653bc1a398ac0d4cf39231237156f51d52e6d319e7
SHA5123524c523d25e31ac34ecbe52907aae6ace757440e969c70aaa9ca6fd1c4cae4a2b392ae5b198d478d442325ea67cc326003d5fb99a10b0c1992464efc58fa9e8
-
Filesize
408KB
MD53a83452c3d97255a24c57c8061465dbd
SHA1f379cd2d4e2fee15cebbdc58d6d7017d5edfc329
SHA25683f2a7736ad9b463c96f11a3168da355ed7d31585de57c626ef6d593cb850d2a
SHA512e61eea028cdb683ee48c8c1b2654368bafd0c514ca2267b16bc0e5b762015749a289895edba1772061e23db2d7fe41816103bea0ad475c2bf5ec2e4308845a68
-
Filesize
408KB
MD53a83452c3d97255a24c57c8061465dbd
SHA1f379cd2d4e2fee15cebbdc58d6d7017d5edfc329
SHA25683f2a7736ad9b463c96f11a3168da355ed7d31585de57c626ef6d593cb850d2a
SHA512e61eea028cdb683ee48c8c1b2654368bafd0c514ca2267b16bc0e5b762015749a289895edba1772061e23db2d7fe41816103bea0ad475c2bf5ec2e4308845a68
-
Filesize
408KB
MD5363a601bb246ce5cd18fbb791262a664
SHA1dc910ab6607024a52ccdda8b025134c8979b769a
SHA256ddc65b9493281f001ec443314d8300f786a483d7264c06388db8ec2ac122f56d
SHA51234d53ba0b633a39b48e0bead70981b35bc083deb61012437a188785f10c54fca43fd1c20c76ffa30328f6efd77f823cdae47ce9c921e093ae8536227cf7e184a
-
Filesize
408KB
MD5363a601bb246ce5cd18fbb791262a664
SHA1dc910ab6607024a52ccdda8b025134c8979b769a
SHA256ddc65b9493281f001ec443314d8300f786a483d7264c06388db8ec2ac122f56d
SHA51234d53ba0b633a39b48e0bead70981b35bc083deb61012437a188785f10c54fca43fd1c20c76ffa30328f6efd77f823cdae47ce9c921e093ae8536227cf7e184a
-
Filesize
408KB
MD5dcb36d3319100a63d0412ee933d9bf41
SHA1ebe048cd006d6a85605a5168fcf0c384169203d8
SHA2563db1ac86f6b52b1ab06a1d21326a59e6e24d6993c65a744a83a4d96c148b336b
SHA5128f17f294003e2b66aa20dff3e8ac64c3d333144cfd70bbdea03c0c1733c4a4c82100de1d04efcc4fefc1cc33535d0569e9df96088b278d23f957f77df293ba21
-
Filesize
408KB
MD5dcb36d3319100a63d0412ee933d9bf41
SHA1ebe048cd006d6a85605a5168fcf0c384169203d8
SHA2563db1ac86f6b52b1ab06a1d21326a59e6e24d6993c65a744a83a4d96c148b336b
SHA5128f17f294003e2b66aa20dff3e8ac64c3d333144cfd70bbdea03c0c1733c4a4c82100de1d04efcc4fefc1cc33535d0569e9df96088b278d23f957f77df293ba21