Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe
-
Size
408KB
-
MD5
be6a88c723dd114772f8b51a5bb8087f
-
SHA1
0ff979602fc0fb522ae51fb481087164397ac6ef
-
SHA256
eef59936c57c004f2d70b7b5f5d3efde38efe8badd119b0ee22073bea4fbe61a
-
SHA512
0d795f135d8770b9df66a6acc3b16994fa531e645f0d1795fadf1af1fcdf0410f59d03822c8e6b35ccfb500732d1801462334688a88f6b58444bc7d8325e96b1
-
SSDEEP
3072:CEGh0oZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGrldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x000300000002276d-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023120-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023127-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002312b-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000023134-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f0000000217fa-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00030000000006df-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070b-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE6E1856-4E58-44b2-9648-99FA6D6015A0} {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD76470B-61D4-4c82-B38A-271A3AF1B7D6} {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8C94A45-19AD-4f69-89EE-BD3E693755AC} {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1937F83-258E-40ba-87EA-3E2069BCCE4E}\stubpath = "C:\\Windows\\{E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe" {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9605A85F-998F-4edc-A7FB-CF2BA5C0E493} 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9605A85F-998F-4edc-A7FB-CF2BA5C0E493}\stubpath = "C:\\Windows\\{9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe" 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1937F83-258E-40ba-87EA-3E2069BCCE4E} {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}\stubpath = "C:\\Windows\\{F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe" {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C2CBCFC-016B-4711-A7CE-308B98D704ED} {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C2CBCFC-016B-4711-A7CE-308B98D704ED}\stubpath = "C:\\Windows\\{6C2CBCFC-016B-4711-A7CE-308B98D704ED}.exe" {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CA7B81B-1217-4dd2-8B35-D2DF22201019} {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CA7B81B-1217-4dd2-8B35-D2DF22201019}\stubpath = "C:\\Windows\\{0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe" {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E90814CC-4A3C-4c93-93FC-EBB71B110615} {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AE29F2C-CF58-429b-9937-18FED0D22782} {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8C94A45-19AD-4f69-89EE-BD3E693755AC}\stubpath = "C:\\Windows\\{A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe" {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B} {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}\stubpath = "C:\\Windows\\{19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe" {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE6E1856-4E58-44b2-9648-99FA6D6015A0}\stubpath = "C:\\Windows\\{DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe" {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD76470B-61D4-4c82-B38A-271A3AF1B7D6}\stubpath = "C:\\Windows\\{FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe" {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E90814CC-4A3C-4c93-93FC-EBB71B110615}\stubpath = "C:\\Windows\\{E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe" {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AE29F2C-CF58-429b-9937-18FED0D22782}\stubpath = "C:\\Windows\\{9AE29F2C-CF58-429b-9937-18FED0D22782}.exe" {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269} {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe -
Executes dropped EXE 11 IoCs
pid Process 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 928 {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe 2528 {6C2CBCFC-016B-4711-A7CE-308B98D704ED}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe File created C:\Windows\{FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe File created C:\Windows\{E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe File created C:\Windows\{9AE29F2C-CF58-429b-9937-18FED0D22782}.exe {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe File created C:\Windows\{A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe File created C:\Windows\{6C2CBCFC-016B-4711-A7CE-308B98D704ED}.exe {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe File created C:\Windows\{DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe File created C:\Windows\{0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe File created C:\Windows\{E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe File created C:\Windows\{F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe File created C:\Windows\{19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe Token: SeIncBasePriorityPrivilege 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe Token: SeIncBasePriorityPrivilege 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe Token: SeIncBasePriorityPrivilege 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe Token: SeIncBasePriorityPrivilege 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe Token: SeIncBasePriorityPrivilege 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe Token: SeIncBasePriorityPrivilege 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe Token: SeIncBasePriorityPrivilege 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe Token: SeIncBasePriorityPrivilege 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe Token: SeIncBasePriorityPrivilege 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe Token: SeIncBasePriorityPrivilege 928 {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 404 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe 89 PID 4200 wrote to memory of 404 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe 89 PID 4200 wrote to memory of 404 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe 89 PID 4200 wrote to memory of 2800 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe 90 PID 4200 wrote to memory of 2800 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe 90 PID 4200 wrote to memory of 2800 4200 2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe 90 PID 404 wrote to memory of 4052 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 93 PID 404 wrote to memory of 4052 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 93 PID 404 wrote to memory of 4052 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 93 PID 404 wrote to memory of 2556 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 94 PID 404 wrote to memory of 2556 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 94 PID 404 wrote to memory of 2556 404 {9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe 94 PID 4052 wrote to memory of 464 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 97 PID 4052 wrote to memory of 464 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 97 PID 4052 wrote to memory of 464 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 97 PID 4052 wrote to memory of 4876 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 96 PID 4052 wrote to memory of 4876 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 96 PID 4052 wrote to memory of 4876 4052 {DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe 96 PID 464 wrote to memory of 2700 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 103 PID 464 wrote to memory of 2700 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 103 PID 464 wrote to memory of 2700 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 103 PID 464 wrote to memory of 5112 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 104 PID 464 wrote to memory of 5112 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 104 PID 464 wrote to memory of 5112 464 {FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe 104 PID 2700 wrote to memory of 2876 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 106 PID 2700 wrote to memory of 2876 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 106 PID 2700 wrote to memory of 2876 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 106 PID 2700 wrote to memory of 4112 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 107 PID 2700 wrote to memory of 4112 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 107 PID 2700 wrote to memory of 4112 2700 {0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe 107 PID 2876 wrote to memory of 4444 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 108 PID 2876 wrote to memory of 4444 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 108 PID 2876 wrote to memory of 4444 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 108 PID 2876 wrote to memory of 4160 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 109 PID 2876 wrote to memory of 4160 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 109 PID 2876 wrote to memory of 4160 2876 {E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe 109 PID 4444 wrote to memory of 4408 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 110 PID 4444 wrote to memory of 4408 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 110 PID 4444 wrote to memory of 4408 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 110 PID 4444 wrote to memory of 2624 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 111 PID 4444 wrote to memory of 2624 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 111 PID 4444 wrote to memory of 2624 4444 {9AE29F2C-CF58-429b-9937-18FED0D22782}.exe 111 PID 4408 wrote to memory of 3888 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 112 PID 4408 wrote to memory of 3888 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 112 PID 4408 wrote to memory of 3888 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 112 PID 4408 wrote to memory of 3820 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 113 PID 4408 wrote to memory of 3820 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 113 PID 4408 wrote to memory of 3820 4408 {A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe 113 PID 3888 wrote to memory of 1288 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 114 PID 3888 wrote to memory of 1288 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 114 PID 3888 wrote to memory of 1288 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 114 PID 3888 wrote to memory of 228 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 115 PID 3888 wrote to memory of 228 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 115 PID 3888 wrote to memory of 228 3888 {E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe 115 PID 1288 wrote to memory of 928 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 116 PID 1288 wrote to memory of 928 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 116 PID 1288 wrote to memory of 928 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 116 PID 1288 wrote to memory of 2608 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 117 PID 1288 wrote to memory of 2608 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 117 PID 1288 wrote to memory of 2608 1288 {F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe 117 PID 928 wrote to memory of 2528 928 {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe 118 PID 928 wrote to memory of 2528 928 {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe 118 PID 928 wrote to memory of 2528 928 {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe 118 PID 928 wrote to memory of 2880 928 {19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-19_be6a88c723dd114772f8b51a5bb8087f_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\{9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exeC:\Windows\{9605A85F-998F-4edc-A7FB-CF2BA5C0E493}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\{DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exeC:\Windows\{DE6E1856-4E58-44b2-9648-99FA6D6015A0}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE6E1~1.EXE > nul4⤵PID:4876
-
-
C:\Windows\{FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exeC:\Windows\{FD76470B-61D4-4c82-B38A-271A3AF1B7D6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\{0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exeC:\Windows\{0CA7B81B-1217-4dd2-8B35-D2DF22201019}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\{E90814CC-4A3C-4c93-93FC-EBB71B110615}.exeC:\Windows\{E90814CC-4A3C-4c93-93FC-EBB71B110615}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\{9AE29F2C-CF58-429b-9937-18FED0D22782}.exeC:\Windows\{9AE29F2C-CF58-429b-9937-18FED0D22782}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\{A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exeC:\Windows\{A8C94A45-19AD-4f69-89EE-BD3E693755AC}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\{E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exeC:\Windows\{E1937F83-258E-40ba-87EA-3E2069BCCE4E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\{F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exeC:\Windows\{F4162DA0-A77E-499b-A2C8-7EA2A8DC3C2B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\{19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exeC:\Windows\{19DC1BD8-65FA-4bb5-9DCA-A9EC8E12F269}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\{6C2CBCFC-016B-4711-A7CE-308B98D704ED}.exeC:\Windows\{6C2CBCFC-016B-4711-A7CE-308B98D704ED}.exe12⤵
- Executes dropped EXE
PID:2528
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19DC1~1.EXE > nul12⤵PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4162~1.EXE > nul11⤵PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1937~1.EXE > nul10⤵PID:228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8C94~1.EXE > nul9⤵PID:3820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AE29~1.EXE > nul8⤵PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9081~1.EXE > nul7⤵PID:4160
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CA7B~1.EXE > nul6⤵PID:4112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD764~1.EXE > nul5⤵PID:5112
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9605A~1.EXE > nul3⤵PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5cce585b8098806c6bb9aec2875dacb2b
SHA1c6d1eb6a476a66e2a3c97dd5b18bcff6fc67aec4
SHA25665508dd6e408ae748d4f1f27b8d53c3b31de117e30250c63649d833ef62f43e4
SHA512757efcb477c975cf14d1959b22b0e8aa039e89a2d7231c6f9032cee992aa781c832f0f827a5e7a1b5d5615335b96fab94ea5007a345c5d3c01e247712ced11a1
-
Filesize
408KB
MD54cd721f9d4cd5fd8f252c74d25055290
SHA1012dfff8b0ad8e8c1fd12c71be36b6bfc0b7cfc5
SHA256e6b891242312c53dbcb9ebdfb4e32d47562b19b4504d34e1e260d9d928eecea6
SHA512bf88386b8f2d7bec3623f1d4ee5d0e95362992fa37f0df459a4a959c591a7133bc3c0b959cf42f2a4e3f66ffa6bfa03f7c3263c19589c60c9f5cad84514353ae
-
Filesize
408KB
MD5f90e77d004769baa20fb72ef13d5e9dc
SHA1eeb43c2fa0708b03042842c41d13c0b20a5f7902
SHA256aef248beccbfa42a7e6f52e9ea0c97ba1f7cb16457932c88f65b57a5852ad8c9
SHA512d91727e4a253c8a56e48b7956f0f50449c34a6d6d1f44dd8b7249c982165012374baa072265ccd3e25c5ffbd4f20cd3a8dad3bf48482bb4de8ee7d0f8aa41e11
-
Filesize
408KB
MD5d5ec2d5b3b853fc4a05236eeda94f06b
SHA138e9ee717ec1cafe8c6a979a72f78d676bf6573c
SHA2566aa98e9e6647d66f1f41059cf97bded25574059fe847ed54cd6240f6ea713551
SHA5128b5983efef548e97952a10d34402fc79becf468db098f1f7d224ec429f1dd365e1063a8af3d9d7ade8f21282993a40b1ba7f28df66ae0681f7541ba1975d7035
-
Filesize
408KB
MD57cea65ead37d80f9060aaa91279d16fb
SHA19b8b07569f6be808105c71f8abbdf37ce0712739
SHA2564b2439f72220e4758512f800bc24bded8d40ccc0fa97cb0e3c15feddba68ec4f
SHA512756bc39fc186a679e45bcc2159431e46d810c5a4523a9be3680b204da6afb79a710067bf0607c659b5f5d5938b857201e5691471d5d1d16224e01b3115ec6253
-
Filesize
408KB
MD5cbcbb7526b3438db3c0c33ae1e4d5d86
SHA171a0833b867284c103bd6c55f1bcd8bab36d826d
SHA2563dc07d312a31e1f9d46f0ea0a82a79d0618e0c595b22ae28544e628f4455061e
SHA512c5ee2f4f8c077d42c6c133a160b27cdddc599f990994c00138d06d61ad32356cb748ddf33dd397ec3e9525f966148649975e85826b014851d5784c2c3116a431
-
Filesize
408KB
MD58e8277642d83595b20039ca865901257
SHA1054d3b58590e33ed0cd653f69936e25b4a78efdc
SHA2562ba6499269fe3e3f26a34d97b690f93ef17e6390faa97f7fe0d3e077748390fb
SHA512b5c2448c781c5b0293dc25197923a223dd8d2a16e73c6b97b59162723ab2c420505a8e70fb125026a1b2ed74d64f1a17bae50c9d3f55ce028237f2b4f101e189
-
Filesize
408KB
MD56704880a2eb18de6457b93edd299e210
SHA198729c9854560f8d985a4606aa20e28a36e1bb31
SHA256b4ba50bed35d93ab31b0d5aae27d0c13079b6f12cca0d805d631658ace610064
SHA512d0777b4f0a15dcaac689aec953b86d977063ea15567dd32a39512680b264b1dd76a5cfd04e64eaff78cbfc98d1004d442852b763cd4c60be5615d7ec04b31631
-
Filesize
408KB
MD5f4f89fcf864fc5a2d11abc36072fa83a
SHA1252e3eb1799d6463fefeb6dc5b10ab4e74d9ea72
SHA256fac04df983019cd8873699c3aef574f0d1ba242afd58597a38541628deee1eca
SHA512a8a8251a2d6f61f1357741aee2f90f21ccb38cb122dd9659c49c787eb9f1c0cbb78e212292708b2c88de796830d04e78d95f017848406f85a37ef1958bef5f16
-
Filesize
408KB
MD59d933beb7829dac64277f23a1adaaf44
SHA1334fabce792235e25019f975a7222a896fde4c2c
SHA2566aee825e1c4c1803364f967c758de312175fdfa20941484af67a3e980ac607b6
SHA512d46cecc1c84189290d3ff7165e085c3170ee5586c9617313076cf4096fdebed40ee787753994bbd880144bb392b15a2ef0b4acfd4535b13f1b57980bcc475247
-
Filesize
408KB
MD52752458dbb496aedc3ddca71cee6cf34
SHA121c263f69adff24167f21c534ef2b5a128db5276
SHA256d1537e49c85b6bdf5eb90591d117964018f41a27b77d26646c56d3404193a7a1
SHA5126c265058b310193673152dc22b664fe6b9e735310667b4d915cd44349a72084a7a8cae48f9a7468f07236c7822bdd6bf9f5e467e204763d1a3eac8608326cedb