Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe
-
Size
408KB
-
MD5
d10e2efb41a5a24b8253472f2124880f
-
SHA1
f4abcc793b27aeefb255c5ed90ad8521e45fac53
-
SHA256
893820562a57268aadc67e5d18dabc2deb73d08f4db8a7bfd0ce6be750df12fa
-
SHA512
cdb4d8e8bf7f549b86d684cfc9b27ad01216c0400213390387f870a926a485b666263e01e0606436a9371d60c6d9f0588628877d4a10cd40b9a35824aba15b69
-
SSDEEP
3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGrldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E09D114-E51A-463f-8F13-50FF691FE709}\stubpath = "C:\\Windows\\{3E09D114-E51A-463f-8F13-50FF691FE709}.exe" {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}\stubpath = "C:\\Windows\\{B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe" {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF24AA03-63A6-4dd8-8A2D-81C176A5412F} {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF24AA03-63A6-4dd8-8A2D-81C176A5412F}\stubpath = "C:\\Windows\\{DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe" {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CE03331-13C2-4fe6-AF97-08AE494A2088}\stubpath = "C:\\Windows\\{3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe" {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D1996A3-05C8-4d92-B677-95CF1D617272} 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D1996A3-05C8-4d92-B677-95CF1D617272}\stubpath = "C:\\Windows\\{2D1996A3-05C8-4d92-B677-95CF1D617272}.exe" 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58676EED-B1C5-4763-A9FB-494AABCBAE23} {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E09D114-E51A-463f-8F13-50FF691FE709} {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4C0C21D-587B-4ee5-A9AE-9A42C42FD683} {3E09D114-E51A-463f-8F13-50FF691FE709}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}\stubpath = "C:\\Windows\\{F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe" {3E09D114-E51A-463f-8F13-50FF691FE709}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7B79F99-FC42-46cd-9D2C-A49E6DA729E0} {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FC2AFCE-9140-4f87-913C-0060C9A16CB0} {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FC2AFCE-9140-4f87-913C-0060C9A16CB0}\stubpath = "C:\\Windows\\{9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe" {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A1981E5-993C-4529-BB22-9CA3B3E7B63B}\stubpath = "C:\\Windows\\{0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe" {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CE03331-13C2-4fe6-AF97-08AE494A2088} {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBAD8214-F1B2-43fb-87A5-BF627D308B04} {3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBAD8214-F1B2-43fb-87A5-BF627D308B04}\stubpath = "C:\\Windows\\{CBAD8214-F1B2-43fb-87A5-BF627D308B04}.exe" {3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58676EED-B1C5-4763-A9FB-494AABCBAE23}\stubpath = "C:\\Windows\\{58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe" {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7} {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}\stubpath = "C:\\Windows\\{9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe" {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01EF59D4-B947-492b-91EB-E1D9DFEC3195} {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01EF59D4-B947-492b-91EB-E1D9DFEC3195}\stubpath = "C:\\Windows\\{01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe" {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A1981E5-993C-4529-BB22-9CA3B3E7B63B} {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe -
Executes dropped EXE 12 IoCs
pid Process 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 2416 {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe 1872 {3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe 2736 {CBAD8214-F1B2-43fb-87A5-BF627D308B04}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe File created C:\Windows\{58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe File created C:\Windows\{B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe File created C:\Windows\{9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe File created C:\Windows\{01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe File created C:\Windows\{CBAD8214-F1B2-43fb-87A5-BF627D308B04}.exe {3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe File created C:\Windows\{3E09D114-E51A-463f-8F13-50FF691FE709}.exe {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe File created C:\Windows\{F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe {3E09D114-E51A-463f-8F13-50FF691FE709}.exe File created C:\Windows\{9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe File created C:\Windows\{DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe File created C:\Windows\{0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe File created C:\Windows\{3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe Token: SeIncBasePriorityPrivilege 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe Token: SeIncBasePriorityPrivilege 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe Token: SeIncBasePriorityPrivilege 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe Token: SeIncBasePriorityPrivilege 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe Token: SeIncBasePriorityPrivilege 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe Token: SeIncBasePriorityPrivilege 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe Token: SeIncBasePriorityPrivilege 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe Token: SeIncBasePriorityPrivilege 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe Token: SeIncBasePriorityPrivilege 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe Token: SeIncBasePriorityPrivilege 2416 {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe Token: SeIncBasePriorityPrivilege 1872 {3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 3004 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe 91 PID 1696 wrote to memory of 3004 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe 91 PID 1696 wrote to memory of 3004 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe 91 PID 1696 wrote to memory of 3412 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe 92 PID 1696 wrote to memory of 3412 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe 92 PID 1696 wrote to memory of 3412 1696 2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe 92 PID 3004 wrote to memory of 828 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 97 PID 3004 wrote to memory of 828 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 97 PID 3004 wrote to memory of 828 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 97 PID 3004 wrote to memory of 4744 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 98 PID 3004 wrote to memory of 4744 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 98 PID 3004 wrote to memory of 4744 3004 {2D1996A3-05C8-4d92-B677-95CF1D617272}.exe 98 PID 828 wrote to memory of 2220 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 102 PID 828 wrote to memory of 2220 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 102 PID 828 wrote to memory of 2220 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 102 PID 828 wrote to memory of 1420 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 101 PID 828 wrote to memory of 1420 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 101 PID 828 wrote to memory of 1420 828 {58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe 101 PID 2220 wrote to memory of 1496 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 109 PID 2220 wrote to memory of 1496 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 109 PID 2220 wrote to memory of 1496 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 109 PID 2220 wrote to memory of 5044 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 110 PID 2220 wrote to memory of 5044 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 110 PID 2220 wrote to memory of 5044 2220 {3E09D114-E51A-463f-8F13-50FF691FE709}.exe 110 PID 1496 wrote to memory of 3420 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 111 PID 1496 wrote to memory of 3420 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 111 PID 1496 wrote to memory of 3420 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 111 PID 1496 wrote to memory of 4180 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 112 PID 1496 wrote to memory of 4180 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 112 PID 1496 wrote to memory of 4180 1496 {F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe 112 PID 3420 wrote to memory of 4368 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 114 PID 3420 wrote to memory of 4368 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 114 PID 3420 wrote to memory of 4368 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 114 PID 3420 wrote to memory of 2520 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 113 PID 3420 wrote to memory of 2520 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 113 PID 3420 wrote to memory of 2520 3420 {B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe 113 PID 4368 wrote to memory of 4196 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 116 PID 4368 wrote to memory of 4196 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 116 PID 4368 wrote to memory of 4196 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 116 PID 4368 wrote to memory of 2528 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 117 PID 4368 wrote to memory of 2528 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 117 PID 4368 wrote to memory of 2528 4368 {9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe 117 PID 4196 wrote to memory of 3980 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 118 PID 4196 wrote to memory of 3980 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 118 PID 4196 wrote to memory of 3980 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 118 PID 4196 wrote to memory of 2480 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 119 PID 4196 wrote to memory of 2480 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 119 PID 4196 wrote to memory of 2480 4196 {9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe 119 PID 3980 wrote to memory of 4272 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 120 PID 3980 wrote to memory of 4272 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 120 PID 3980 wrote to memory of 4272 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 120 PID 3980 wrote to memory of 4208 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 121 PID 3980 wrote to memory of 4208 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 121 PID 3980 wrote to memory of 4208 3980 {DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe 121 PID 4272 wrote to memory of 2416 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 122 PID 4272 wrote to memory of 2416 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 122 PID 4272 wrote to memory of 2416 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 122 PID 4272 wrote to memory of 1984 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 123 PID 4272 wrote to memory of 1984 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 123 PID 4272 wrote to memory of 1984 4272 {01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe 123 PID 2416 wrote to memory of 1872 2416 {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe 124 PID 2416 wrote to memory of 1872 2416 {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe 124 PID 2416 wrote to memory of 1872 2416 {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe 124 PID 2416 wrote to memory of 5068 2416 {0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_d10e2efb41a5a24b8253472f2124880f_goldeneye_JC.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\{2D1996A3-05C8-4d92-B677-95CF1D617272}.exeC:\Windows\{2D1996A3-05C8-4d92-B677-95CF1D617272}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\{58676EED-B1C5-4763-A9FB-494AABCBAE23}.exeC:\Windows\{58676EED-B1C5-4763-A9FB-494AABCBAE23}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58676~1.EXE > nul4⤵PID:1420
-
-
C:\Windows\{3E09D114-E51A-463f-8F13-50FF691FE709}.exeC:\Windows\{3E09D114-E51A-463f-8F13-50FF691FE709}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\{F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exeC:\Windows\{F4C0C21D-587B-4ee5-A9AE-9A42C42FD683}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\{B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exeC:\Windows\{B7B79F99-FC42-46cd-9D2C-A49E6DA729E0}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7B79~1.EXE > nul7⤵PID:2520
-
-
C:\Windows\{9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exeC:\Windows\{9E5D3E5F-1E8A-4c9d-92AB-178E71E8A9E7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\{9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exeC:\Windows\{9FC2AFCE-9140-4f87-913C-0060C9A16CB0}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\{DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exeC:\Windows\{DF24AA03-63A6-4dd8-8A2D-81C176A5412F}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\{01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exeC:\Windows\{01EF59D4-B947-492b-91EB-E1D9DFEC3195}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\{0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exeC:\Windows\{0A1981E5-993C-4529-BB22-9CA3B3E7B63B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\{3CE03331-13C2-4fe6-AF97-08AE494A2088}.exeC:\Windows\{3CE03331-13C2-4fe6-AF97-08AE494A2088}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Windows\{CBAD8214-F1B2-43fb-87A5-BF627D308B04}.exeC:\Windows\{CBAD8214-F1B2-43fb-87A5-BF627D308B04}.exe13⤵
- Executes dropped EXE
PID:2736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CE03~1.EXE > nul13⤵PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A198~1.EXE > nul12⤵PID:5068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01EF5~1.EXE > nul11⤵PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF24A~1.EXE > nul10⤵PID:4208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FC2A~1.EXE > nul9⤵PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E5D3~1.EXE > nul8⤵PID:2528
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4C0C~1.EXE > nul6⤵PID:4180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E09D~1.EXE > nul5⤵PID:5044
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D199~1.EXE > nul3⤵PID:4744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul2⤵PID:3412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5c2abe390dc1107a6243012c8b06bee4f
SHA13c01e7654448bd30fbbb17bfd8ba268cd4041aca
SHA256cedf86494fc95259baf6bd07cfe1fd40f85d076de121a4afde22094efd4ced70
SHA512c1d9de94dbaa5063712dc1c2c768a4ad24c32cdc51dc105e942683df1994ac10998ca9160b7566a1f11a62646e81890ada75ba1c77a8a6205f703f0032f828d7
-
Filesize
408KB
MD5c2abe390dc1107a6243012c8b06bee4f
SHA13c01e7654448bd30fbbb17bfd8ba268cd4041aca
SHA256cedf86494fc95259baf6bd07cfe1fd40f85d076de121a4afde22094efd4ced70
SHA512c1d9de94dbaa5063712dc1c2c768a4ad24c32cdc51dc105e942683df1994ac10998ca9160b7566a1f11a62646e81890ada75ba1c77a8a6205f703f0032f828d7
-
Filesize
408KB
MD565c4bb2234fd50d949b7d8cf6fc854e4
SHA124251e7139e42dbe577efd7caa0d273534e19d3f
SHA2569d43b0f332713ad550e59945f0bf31217b3d63381a8b1e99217dc66665218deb
SHA512e5c8415c138ccaf14e2cf633101fd33dc1b47da0cb9faa6963b3c042b57b3f26055e79e225c326d04d18ed46dc48d337da6cf552f067171dee174a4ac56147b8
-
Filesize
408KB
MD565c4bb2234fd50d949b7d8cf6fc854e4
SHA124251e7139e42dbe577efd7caa0d273534e19d3f
SHA2569d43b0f332713ad550e59945f0bf31217b3d63381a8b1e99217dc66665218deb
SHA512e5c8415c138ccaf14e2cf633101fd33dc1b47da0cb9faa6963b3c042b57b3f26055e79e225c326d04d18ed46dc48d337da6cf552f067171dee174a4ac56147b8
-
Filesize
408KB
MD58fe9f6585498d8be2efd0389aa44c7bd
SHA16fb23b4966ad602c5480dd8fb3b48624160ad4df
SHA2563ff86ecc05dc25065eb53375927815e2fdd6eef9ebc3557e28c6c457ee1c3e4c
SHA512504fc37911b4da0d78d8b13f297fcf78c1b86ec80fdac793c05a86927ddb7060af15333aa8954da3d7131e61570b6159a450c46b6304ddb1929cc58a0de7f393
-
Filesize
408KB
MD58fe9f6585498d8be2efd0389aa44c7bd
SHA16fb23b4966ad602c5480dd8fb3b48624160ad4df
SHA2563ff86ecc05dc25065eb53375927815e2fdd6eef9ebc3557e28c6c457ee1c3e4c
SHA512504fc37911b4da0d78d8b13f297fcf78c1b86ec80fdac793c05a86927ddb7060af15333aa8954da3d7131e61570b6159a450c46b6304ddb1929cc58a0de7f393
-
Filesize
408KB
MD5a0e5737031b850db730964b277195097
SHA1883110873cbd8a65a85e4af5abce2e7e6250885d
SHA2564dacffe19bdb3b084e800884169bc8d649fe06dec5d172ef31605acb8923685f
SHA512007cfe934a11442ef53a71b83c6bf03e8599222afeec97656e6ca1b8dad5db53262b3320969baefb74a7d730cc08e9dbc1e973d711a74bf6cdc92b99a748c177
-
Filesize
408KB
MD5a0e5737031b850db730964b277195097
SHA1883110873cbd8a65a85e4af5abce2e7e6250885d
SHA2564dacffe19bdb3b084e800884169bc8d649fe06dec5d172ef31605acb8923685f
SHA512007cfe934a11442ef53a71b83c6bf03e8599222afeec97656e6ca1b8dad5db53262b3320969baefb74a7d730cc08e9dbc1e973d711a74bf6cdc92b99a748c177
-
Filesize
408KB
MD55b4f18dc5893a1e4e109e6dff55aed87
SHA1e5ebf00096bb4c892f59d3b68fce5d4950688c72
SHA256b12ed3b3e01a92eee5b6083e0b763d867a3374df5454da72d68edbfc56211c11
SHA51248a10c694faf3f4702f9d61a1c320b042eb64be53b8b60baab3e131bc7b89d179d9a32227e4e6867dc988962b74e1fd3467a10d2e9d68d7577e57953f6decf51
-
Filesize
408KB
MD55b4f18dc5893a1e4e109e6dff55aed87
SHA1e5ebf00096bb4c892f59d3b68fce5d4950688c72
SHA256b12ed3b3e01a92eee5b6083e0b763d867a3374df5454da72d68edbfc56211c11
SHA51248a10c694faf3f4702f9d61a1c320b042eb64be53b8b60baab3e131bc7b89d179d9a32227e4e6867dc988962b74e1fd3467a10d2e9d68d7577e57953f6decf51
-
Filesize
408KB
MD55b4f18dc5893a1e4e109e6dff55aed87
SHA1e5ebf00096bb4c892f59d3b68fce5d4950688c72
SHA256b12ed3b3e01a92eee5b6083e0b763d867a3374df5454da72d68edbfc56211c11
SHA51248a10c694faf3f4702f9d61a1c320b042eb64be53b8b60baab3e131bc7b89d179d9a32227e4e6867dc988962b74e1fd3467a10d2e9d68d7577e57953f6decf51
-
Filesize
408KB
MD56ed3a10ef71d5405888064ed4cc4f5b4
SHA1ae8299106f779b3799e7a4d9de5a1fe4628320c4
SHA256e4d6e872bb76d1b3a9237d19436e1178cecda1cb0783dd913580183280ea02d4
SHA512420f7e41594fd907fc7d5ddf82c495fd063a7df9abd0af995279dfbd2454895ddce6f359af83306949a9cb78d815a0f67615641c143e8e270b3861f370868a55
-
Filesize
408KB
MD56ed3a10ef71d5405888064ed4cc4f5b4
SHA1ae8299106f779b3799e7a4d9de5a1fe4628320c4
SHA256e4d6e872bb76d1b3a9237d19436e1178cecda1cb0783dd913580183280ea02d4
SHA512420f7e41594fd907fc7d5ddf82c495fd063a7df9abd0af995279dfbd2454895ddce6f359af83306949a9cb78d815a0f67615641c143e8e270b3861f370868a55
-
Filesize
408KB
MD54be427cb4b59692bc2244a860c1f36bd
SHA16f8ab92883a827107ebac575e789c1c613f4467f
SHA256c425504f7ff0fb0d905c3628c8d5b2dbbb891606182279861888b91c55194352
SHA512c57c1fbd79209d16f8d905088c161aa9f275b745aef675031bfc481adf70dc4d3c4634e0a4319ec6ea2f678a8fd9a4cf40f3ea2177824a2dc817c6da97f8fca4
-
Filesize
408KB
MD54be427cb4b59692bc2244a860c1f36bd
SHA16f8ab92883a827107ebac575e789c1c613f4467f
SHA256c425504f7ff0fb0d905c3628c8d5b2dbbb891606182279861888b91c55194352
SHA512c57c1fbd79209d16f8d905088c161aa9f275b745aef675031bfc481adf70dc4d3c4634e0a4319ec6ea2f678a8fd9a4cf40f3ea2177824a2dc817c6da97f8fca4
-
Filesize
408KB
MD50cefd69ab4e69c38503a4d34a4a0c47e
SHA117c35c3c76c05d3b866a4702d60ab8386773c3ee
SHA256bf57d00a1b028d350605b61f70b4b16ff000cef7a4c724521e21dc2f9bae0be0
SHA512fbb2fdb0c0e3fa62bee8f33179ed81a5a59857db52f76d7f3f4b44122e188da40e31a25bd11f9be8f0d9616f84d0d36bcdfb8d2d0b52073f6f8e3534b176f17e
-
Filesize
408KB
MD50cefd69ab4e69c38503a4d34a4a0c47e
SHA117c35c3c76c05d3b866a4702d60ab8386773c3ee
SHA256bf57d00a1b028d350605b61f70b4b16ff000cef7a4c724521e21dc2f9bae0be0
SHA512fbb2fdb0c0e3fa62bee8f33179ed81a5a59857db52f76d7f3f4b44122e188da40e31a25bd11f9be8f0d9616f84d0d36bcdfb8d2d0b52073f6f8e3534b176f17e
-
Filesize
408KB
MD558a4cf9463f3e4cb7c6a358c2052d46d
SHA134cfa0ed5cf1318298c0d8a7368c1bc1d1aed56d
SHA2561b60ab64ab3404dca36289eb7aede6d5852ab73f1a68c8b50f6a2c5c182db92a
SHA51248661dc6f4b7d37685bf2cabf27d493c9600c6227cdb710957bd062a7d34c0e6b3b54e2cb35d2f59c10a543b5858c1efd411e0e7653169f9997cbb7b645534d8
-
Filesize
408KB
MD558a4cf9463f3e4cb7c6a358c2052d46d
SHA134cfa0ed5cf1318298c0d8a7368c1bc1d1aed56d
SHA2561b60ab64ab3404dca36289eb7aede6d5852ab73f1a68c8b50f6a2c5c182db92a
SHA51248661dc6f4b7d37685bf2cabf27d493c9600c6227cdb710957bd062a7d34c0e6b3b54e2cb35d2f59c10a543b5858c1efd411e0e7653169f9997cbb7b645534d8
-
Filesize
408KB
MD58e1e940c69baab3186e05cca97be6897
SHA19180eed41c7a475ee77a34aebf2f8e0aa9d1d7ad
SHA2560455b6bacdf1f7659065ed3d315a24e62bf070027ea2ed64bc91931f851df302
SHA51230bf0418960c211dd9c0f2fcc53633eb7b2e88b4bb9d705e972b91f5af6952d2725d8ea15211d1458f9c23cf8cbb51f490dc94f918a25dc2a4a04373a21ae943
-
Filesize
408KB
MD58e1e940c69baab3186e05cca97be6897
SHA19180eed41c7a475ee77a34aebf2f8e0aa9d1d7ad
SHA2560455b6bacdf1f7659065ed3d315a24e62bf070027ea2ed64bc91931f851df302
SHA51230bf0418960c211dd9c0f2fcc53633eb7b2e88b4bb9d705e972b91f5af6952d2725d8ea15211d1458f9c23cf8cbb51f490dc94f918a25dc2a4a04373a21ae943
-
Filesize
408KB
MD5fef35cd956fcf8d194321f3ad5a4155d
SHA1f4e45a08a16016802ccf16f9e1688431b5f70af2
SHA2564abe8c5f17d61456b366873276bfcf2c2dca92d3002f574e2af2c3200a51e121
SHA51268fd4f91384ed546216742fa352a860d0ebb5949e2c99ced727d0f55a0f56f4941af6ff5602652ee301d2317eff263858423f3d41025789a643a44e45ec2274b
-
Filesize
408KB
MD5fef35cd956fcf8d194321f3ad5a4155d
SHA1f4e45a08a16016802ccf16f9e1688431b5f70af2
SHA2564abe8c5f17d61456b366873276bfcf2c2dca92d3002f574e2af2c3200a51e121
SHA51268fd4f91384ed546216742fa352a860d0ebb5949e2c99ced727d0f55a0f56f4941af6ff5602652ee301d2317eff263858423f3d41025789a643a44e45ec2274b
-
Filesize
408KB
MD500538e050df8f5442f5bd4dc293b4ccb
SHA158bd02ce8b777080fcaa70265c104bd1183a12a9
SHA256a051a91c89b885885e87fd90ef02bafd3ccf9b8356aeede643030f66b671bee6
SHA5129b5fd0c807fc45dc5c344dbafdb826edaf63317a7b1a48a035efe8b488901448218571217df42c2bf6a5fad8f3bde5b3caaa79907cd6c49372d1113bd98e7b95
-
Filesize
408KB
MD500538e050df8f5442f5bd4dc293b4ccb
SHA158bd02ce8b777080fcaa70265c104bd1183a12a9
SHA256a051a91c89b885885e87fd90ef02bafd3ccf9b8356aeede643030f66b671bee6
SHA5129b5fd0c807fc45dc5c344dbafdb826edaf63317a7b1a48a035efe8b488901448218571217df42c2bf6a5fad8f3bde5b3caaa79907cd6c49372d1113bd98e7b95