Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe
-
Size
197KB
-
MD5
4f6c09e04013bf5246d5d2b728161717
-
SHA1
58f618fd92edbc8825b3043f8b617df33f277396
-
SHA256
192c384d910f442f1a8969223d0abc2f6f18360d453d0de6476cd3501c7f5798
-
SHA512
b44678e9d57765be335502fb68ff2f5ca1addbc684abfbfcbc31a307dce10094a9c001b50608608dbabde48cec765259e8bc10de35bd088348eeca336e7914f5
-
SSDEEP
3072:jEGh0okl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGmlEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
resource yara_rule behavioral1/files/0x000a000000012252-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000014323-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000014323-13.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000012252-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0035000000014502-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000012252-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012252-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000012252-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85306343-1C1B-4e98-BB6D-B9BB78FF26BA}\stubpath = "C:\\Windows\\{85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe" {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D7132CE-B1B3-4593-A15F-4E5282830DA7}\stubpath = "C:\\Windows\\{0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe" {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{490E0F29-F931-4d6d-95DA-0CB3FCBB5993}\stubpath = "C:\\Windows\\{490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe" {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22BE5929-9302-403d-9E9D-A79C775DAC6F} {27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D70F30D8-DCA0-46e4-B398-7FFC3027F581} {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D70F30D8-DCA0-46e4-B398-7FFC3027F581}\stubpath = "C:\\Windows\\{D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe" {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0} {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFE68F3E-A2D6-46b9-8A96-A379DEF5368B} {D7D466F2-35BC-45e0-81A4-151DE5378018}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}\stubpath = "C:\\Windows\\{5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe" {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D7132CE-B1B3-4593-A15F-4E5282830DA7} {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7D466F2-35BC-45e0-81A4-151DE5378018} {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22BE5929-9302-403d-9E9D-A79C775DAC6F}\stubpath = "C:\\Windows\\{22BE5929-9302-403d-9E9D-A79C775DAC6F}.exe" {27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{923D457B-D5A4-4c7c-B136-52D828C9D4CE} 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{923D457B-D5A4-4c7c-B136-52D828C9D4CE}\stubpath = "C:\\Windows\\{923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe" 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}\stubpath = "C:\\Windows\\{FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe" {D7D466F2-35BC-45e0-81A4-151DE5378018}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{490E0F29-F931-4d6d-95DA-0CB3FCBB5993} {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7D466F2-35BC-45e0-81A4-151DE5378018}\stubpath = "C:\\Windows\\{D7D466F2-35BC-45e0-81A4-151DE5378018}.exe" {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27D6C699-8AAC-4ab0-9C15-D618168A6321} {FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27D6C699-8AAC-4ab0-9C15-D618168A6321}\stubpath = "C:\\Windows\\{27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe" {FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85306343-1C1B-4e98-BB6D-B9BB78FF26BA} {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2} {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}\stubpath = "C:\\Windows\\{B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe" {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe -
Deletes itself 1 IoCs
pid Process 2584 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 1792 {D7D466F2-35BC-45e0-81A4-151DE5378018}.exe 1676 {FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe 2028 {27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe 692 {22BE5929-9302-403d-9E9D-A79C775DAC6F}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{D7D466F2-35BC-45e0-81A4-151DE5378018}.exe {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe File created C:\Windows\{FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe {D7D466F2-35BC-45e0-81A4-151DE5378018}.exe File created C:\Windows\{923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe File created C:\Windows\{D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe File created C:\Windows\{5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe File created C:\Windows\{490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe File created C:\Windows\{27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe {FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe File created C:\Windows\{22BE5929-9302-403d-9E9D-A79C775DAC6F}.exe {27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe File created C:\Windows\{85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe File created C:\Windows\{B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe File created C:\Windows\{0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe Token: SeIncBasePriorityPrivilege 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe Token: SeIncBasePriorityPrivilege 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe Token: SeIncBasePriorityPrivilege 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe Token: SeIncBasePriorityPrivilege 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe Token: SeIncBasePriorityPrivilege 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe Token: SeIncBasePriorityPrivilege 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe Token: SeIncBasePriorityPrivilege 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe Token: SeIncBasePriorityPrivilege 1792 {D7D466F2-35BC-45e0-81A4-151DE5378018}.exe Token: SeIncBasePriorityPrivilege 1676 {FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe Token: SeIncBasePriorityPrivilege 2028 {27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2652 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 28 PID 2308 wrote to memory of 2652 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 28 PID 2308 wrote to memory of 2652 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 28 PID 2308 wrote to memory of 2652 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 28 PID 2308 wrote to memory of 2584 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 29 PID 2308 wrote to memory of 2584 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 29 PID 2308 wrote to memory of 2584 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 29 PID 2308 wrote to memory of 2584 2308 2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe 29 PID 2652 wrote to memory of 3024 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 30 PID 2652 wrote to memory of 3024 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 30 PID 2652 wrote to memory of 3024 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 30 PID 2652 wrote to memory of 3024 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 30 PID 2652 wrote to memory of 2764 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 31 PID 2652 wrote to memory of 2764 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 31 PID 2652 wrote to memory of 2764 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 31 PID 2652 wrote to memory of 2764 2652 {923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe 31 PID 3024 wrote to memory of 2544 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 32 PID 3024 wrote to memory of 2544 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 32 PID 3024 wrote to memory of 2544 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 32 PID 3024 wrote to memory of 2544 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 32 PID 3024 wrote to memory of 2888 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 33 PID 3024 wrote to memory of 2888 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 33 PID 3024 wrote to memory of 2888 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 33 PID 3024 wrote to memory of 2888 3024 {D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe 33 PID 2544 wrote to memory of 2860 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 37 PID 2544 wrote to memory of 2860 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 37 PID 2544 wrote to memory of 2860 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 37 PID 2544 wrote to memory of 2860 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 37 PID 2544 wrote to memory of 1664 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 36 PID 2544 wrote to memory of 1664 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 36 PID 2544 wrote to memory of 1664 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 36 PID 2544 wrote to memory of 1664 2544 {5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe 36 PID 2860 wrote to memory of 2724 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 38 PID 2860 wrote to memory of 2724 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 38 PID 2860 wrote to memory of 2724 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 38 PID 2860 wrote to memory of 2724 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 38 PID 2860 wrote to memory of 2820 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 39 PID 2860 wrote to memory of 2820 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 39 PID 2860 wrote to memory of 2820 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 39 PID 2860 wrote to memory of 2820 2860 {85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe 39 PID 2724 wrote to memory of 1704 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 40 PID 2724 wrote to memory of 1704 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 40 PID 2724 wrote to memory of 1704 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 40 PID 2724 wrote to memory of 1704 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 40 PID 2724 wrote to memory of 1936 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 41 PID 2724 wrote to memory of 1936 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 41 PID 2724 wrote to memory of 1936 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 41 PID 2724 wrote to memory of 1936 2724 {B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe 41 PID 1704 wrote to memory of 808 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 42 PID 1704 wrote to memory of 808 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 42 PID 1704 wrote to memory of 808 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 42 PID 1704 wrote to memory of 808 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 42 PID 1704 wrote to memory of 1952 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 43 PID 1704 wrote to memory of 1952 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 43 PID 1704 wrote to memory of 1952 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 43 PID 1704 wrote to memory of 1952 1704 {0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe 43 PID 808 wrote to memory of 1792 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 44 PID 808 wrote to memory of 1792 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 44 PID 808 wrote to memory of 1792 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 44 PID 808 wrote to memory of 1792 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 44 PID 808 wrote to memory of 1508 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 45 PID 808 wrote to memory of 1508 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 45 PID 808 wrote to memory of 1508 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 45 PID 808 wrote to memory of 1508 808 {490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_4f6c09e04013bf5246d5d2b728161717_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\{923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exeC:\Windows\{923D457B-D5A4-4c7c-B136-52D828C9D4CE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\{D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exeC:\Windows\{D70F30D8-DCA0-46e4-B398-7FFC3027F581}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\{5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exeC:\Windows\{5DB84009-CD15-4d6d-ABCF-EF9F1369CAD0}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5DB84~1.EXE > nul5⤵PID:1664
-
-
C:\Windows\{85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exeC:\Windows\{85306343-1C1B-4e98-BB6D-B9BB78FF26BA}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\{B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exeC:\Windows\{B0B4815C-FCD7-49d6-8C97-EDD9A4B87FE2}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\{0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exeC:\Windows\{0D7132CE-B1B3-4593-A15F-4E5282830DA7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\{490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exeC:\Windows\{490E0F29-F931-4d6d-95DA-0CB3FCBB5993}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\{D7D466F2-35BC-45e0-81A4-151DE5378018}.exeC:\Windows\{D7D466F2-35BC-45e0-81A4-151DE5378018}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Windows\{FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exeC:\Windows\{FFE68F3E-A2D6-46b9-8A96-A379DEF5368B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\{27D6C699-8AAC-4ab0-9C15-D618168A6321}.exeC:\Windows\{27D6C699-8AAC-4ab0-9C15-D618168A6321}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\{22BE5929-9302-403d-9E9D-A79C775DAC6F}.exeC:\Windows\{22BE5929-9302-403d-9E9D-A79C775DAC6F}.exe12⤵
- Executes dropped EXE
PID:692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27D6C~1.EXE > nul12⤵PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFE68~1.EXE > nul11⤵PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7D46~1.EXE > nul10⤵PID:2056
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{490E0~1.EXE > nul9⤵PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D713~1.EXE > nul8⤵PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0B48~1.EXE > nul7⤵PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85306~1.EXE > nul6⤵PID:2820
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D70F3~1.EXE > nul4⤵PID:2888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{923D4~1.EXE > nul3⤵PID:2764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5912c3aa752daefb6a0426ebb7c212cd2
SHA1fcfb2125ad4a1ce6360e659b0ee6f23e6b46a1e3
SHA2563a15a156d33bd2c7da0c01cf4e663ae1c9f5dd6ffae63f20d21f97954c51a324
SHA512d8b33cbc7d775f18d17afb57c2ab449bc791e3fd67a67a85ff3f7b6c7980ead006cb6f29c48c3b4d53af572d02221d5a031f6fd9f4016afcd1b53fd6d320c0e1
-
Filesize
197KB
MD55de304cbe2ae505086ce30f55fe5cd86
SHA18cea200383f82d34ca54e7cf4a03e154713162ed
SHA2566cc23b18a3788d7c4ca78f30520b81d164a7a1bba2ccd10df44a9f496e738a1d
SHA512b0b99f4139193bda7e28ae4a99bec8b7f30b9458707a9e400182106ca62a1c01b64a4699df574c24ee7685d1bfeec00389ba5aa521c16c447dc8cf68a9ed58b9
-
Filesize
197KB
MD56c770e3fe998b9e19ec555d48be404a9
SHA107f66927e91af0a23bf7988dc4c55e6d1bc7a70a
SHA256eb0bd1569ad83001636b8dc3b3e8ee5c32109b326fa4b905e0b2d3178b69714f
SHA512f7bd0c78b36132a4147d345390502b9e4043e39b7ef0a1ab09442cd2adc9066b465e51b219e4b603c4a4684d64492543eadaf04ec570b1e74a6c83051a4c34a3
-
Filesize
197KB
MD5720ce63345403d75e8c430f083c43d1d
SHA1ee7c2b5f731c2e65f1f96dd5cecd3c60d1e8f089
SHA256003c7436cd54a81f38eff9069f72a825ee4bb477a85c77b1b93ec201bfccd403
SHA512e179f2348d1f7bf7196b0daaba95527490f8a99c43a72c37681d33907fd01d2ef66be9959da5e9b6cba66a126da3dbaab876c75821f2b0bdadb60220e66bbf67
-
Filesize
197KB
MD590afa271f83070ba273b38738b1705a4
SHA1d58e1a11bf67bc9d93c5fea5dbb614c3642ffe03
SHA256bba3903db6b4afdfeda7bd312f73fbdf7b173bdec6a49a0b782f52fc8a725113
SHA51238eac778d6ec4d66e4f874535c0b7ccae4dd3290eb3c8a3b233747190df08e1d130b607c75dba915c2fe5368db83a070d292e02c2c2ce582e150318c2e5f759a
-
Filesize
197KB
MD54b54510dc9c50fbc7dfc3c9d94ba145f
SHA12d099ebabebb248557ce47310347900d8ee0d1ec
SHA2566df89478724718f135856bea0e647b77333a529e55dcfad45506f544e38b9e34
SHA5123308f694f73f88993e47be25de8bdebbe581807040115d380c8e649c24baa404634f9dcbdf6a4d6dd04f506007f9135f35644aef24b1b2e6b6617dbbdc95c928
-
Filesize
197KB
MD51f95e0cf1864760a17b6c4fb78f5fdda
SHA1e9eec7cd01cb996b1437cd5a751016e03330cb8a
SHA256b45b183daa222c7b71641654e08802b80c01c1a3bfe196de98f67123a6ed0377
SHA512d56b681e2796c779c21fdef392ba6a20a1d97bd1a80beccba470ad43f29edbc092f0eec89f7a6bec6ae423cd589eca81cf04a1397d08cf314c73270344d6facd
-
Filesize
197KB
MD5b59c9d5a0a0654b27ebde8ad0eb9362a
SHA148e219b208686ac76a757e221b898bcca3059d2d
SHA2560fe08a88ae3eeff86e9309d4c7d87ad48a0374ad01f4dd8ad4060236836dadbc
SHA512ef852c10e184ab5070242da2200ed2679c2551ed12b8165782cd417d6b2938fe234e95fbdc42f32c3d5094a20a9f9f5ac7ae1a89896924f3531aa0872767af43
-
Filesize
193KB
MD5e961ceeac7e8188936e23a5cd27b78cc
SHA1d42655275ba09fcc3388240802cee4bd2121a12e
SHA256132119a1b4fa3a6c7ccd13a3748e379cd19bd9b5d5cf1648901d0301f4cc5db2
SHA5128bd493740285bdfd34c586cb4b7cbb3bbb99b0b117f1aefe26d0768b51d659b5f3e0866ff6ab4089587d8db26a9df9de99c3a5d1f27df6c024fc92134d067fe7
-
Filesize
197KB
MD570a26ed115c55212a34c2b8f42982ac8
SHA18cd6e10a34de4096cbbb99766a8f04fbccac5214
SHA25666ae0399ad66671b29efcfd52f4b874fd03dfbe126e7309161649eceb7de78a9
SHA512a81a5a9bacc428af76373844baa6493dd536fdde3d2952b4849235ae0fdcfa41b2a6a749b093e03a24792ec07845720e441f3e4b417c60d76406f013da37c0bc
-
Filesize
197KB
MD5fae85718f7f57681f4c02fed565e8306
SHA186335c64c073288c057569ad8b65e88b1f3db9ec
SHA2562d3035c1a8f9fce4a8a054f4ab06a01ed95b775c4f85bf576d45b7af7bc2f858
SHA512ac69449bc0f1d90663376481a3e2a2833c0e40ade5c350d5db2d47341f51071a6229f78b5fd81191e95ce5e69a0981695a6e2299d5517ed0ffd7f6d6bd16fdba
-
Filesize
197KB
MD5032fb587db93a32e42e2a3207a639149
SHA1b4ccbbe9540703f5417dccc9345131f3dfef76ee
SHA25610e27f35bba988356f2f2f3da1f3fa51024b8ffa8012b36367d2688bb4273752
SHA512a32df54853d5a8d9df0bb3142d682c1fb3c32ac6912fe15fe2e1025806a567451b6b4c73986dc7077ab0a3271dcd60fccca33f4c6f3f27ba9a61b56fa31543c5