Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe
-
Size
344KB
-
MD5
416cd2df03d64c68249c5d6ab1f320fb
-
SHA1
798bbd4005a7f6b4806fec139c2f5717d48a613b
-
SHA256
71a59cf51dd9ea88f77acd47c6a3b9efb119a8aaf3e83d5ea105cc2dbe6b5870
-
SHA512
8097118a410e640fe3b5f4d47e709877b8d8020a6cac7c1fbc7a34c67bbbb6c9b29c429146ff51a363b00df4e09a767e40c2e54c47c837a100ed8936a27e1e72
-
SSDEEP
3072:mEGh0o8lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGWlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b000000012265-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x00040000000130fc-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000012265-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012265-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000012265-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000012265-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0010000000012265-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9A909C7-520D-4b2b-A88F-BC45108DD56D}\stubpath = "C:\\Windows\\{D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe" {80107138-41BE-46f8-8288-05BA0D6A2845}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9993CFA8-4214-4233-B6B7-85D68467ED56} {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40DE3A22-C326-482c-922A-D90B6ACFEBFB}\stubpath = "C:\\Windows\\{40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe" {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A287C2F3-BA83-42ee-91CE-C8C434F7E9BE} {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7524234-F543-4e39-BE96-891C69D7B632}\stubpath = "C:\\Windows\\{D7524234-F543-4e39-BE96-891C69D7B632}.exe" {97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{682B2F09-94B8-42a7-972B-486D3F0743B9}\stubpath = "C:\\Windows\\{682B2F09-94B8-42a7-972B-486D3F0743B9}.exe" 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0195A872-2B5E-4b5c-81DA-03553301EDDD} {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9A909C7-520D-4b2b-A88F-BC45108DD56D} {80107138-41BE-46f8-8288-05BA0D6A2845}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9993CFA8-4214-4233-B6B7-85D68467ED56}\stubpath = "C:\\Windows\\{9993CFA8-4214-4233-B6B7-85D68467ED56}.exe" {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40DE3A22-C326-482c-922A-D90B6ACFEBFB} {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}\stubpath = "C:\\Windows\\{A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe" {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}\stubpath = "C:\\Windows\\{AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe" {A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97565752-F2BD-4ae4-8391-5F6CEC6C23F5} {AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97565752-F2BD-4ae4-8391-5F6CEC6C23F5}\stubpath = "C:\\Windows\\{97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe" {AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80107138-41BE-46f8-8288-05BA0D6A2845} {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80107138-41BE-46f8-8288-05BA0D6A2845}\stubpath = "C:\\Windows\\{80107138-41BE-46f8-8288-05BA0D6A2845}.exe" {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9D0AF0B-534E-438a-AD91-30E1E47A5941} {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9D0AF0B-534E-438a-AD91-30E1E47A5941}\stubpath = "C:\\Windows\\{E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe" {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0195A872-2B5E-4b5c-81DA-03553301EDDD}\stubpath = "C:\\Windows\\{0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe" {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270} {A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7524234-F543-4e39-BE96-891C69D7B632} {97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{682B2F09-94B8-42a7-972B-486D3F0743B9} 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe -
Deletes itself 1 IoCs
pid Process 2612 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 2748 {A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe 2012 {AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe 544 {97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe 836 {D7524234-F543-4e39-BE96-891C69D7B632}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{D7524234-F543-4e39-BE96-891C69D7B632}.exe {97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe File created C:\Windows\{80107138-41BE-46f8-8288-05BA0D6A2845}.exe {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe File created C:\Windows\{D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe {80107138-41BE-46f8-8288-05BA0D6A2845}.exe File created C:\Windows\{9993CFA8-4214-4233-B6B7-85D68467ED56}.exe {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe File created C:\Windows\{E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe File created C:\Windows\{40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe File created C:\Windows\{AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe {A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe File created C:\Windows\{682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe File created C:\Windows\{0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe File created C:\Windows\{A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe File created C:\Windows\{97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe {AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe Token: SeIncBasePriorityPrivilege 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe Token: SeIncBasePriorityPrivilege 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe Token: SeIncBasePriorityPrivilege 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe Token: SeIncBasePriorityPrivilege 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe Token: SeIncBasePriorityPrivilege 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe Token: SeIncBasePriorityPrivilege 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe Token: SeIncBasePriorityPrivilege 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe Token: SeIncBasePriorityPrivilege 2748 {A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe Token: SeIncBasePriorityPrivilege 2012 {AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe Token: SeIncBasePriorityPrivilege 544 {97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 868 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 28 PID 768 wrote to memory of 868 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 28 PID 768 wrote to memory of 868 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 28 PID 768 wrote to memory of 868 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 28 PID 768 wrote to memory of 2612 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 29 PID 768 wrote to memory of 2612 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 29 PID 768 wrote to memory of 2612 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 29 PID 768 wrote to memory of 2612 768 2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe 29 PID 868 wrote to memory of 3056 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 30 PID 868 wrote to memory of 3056 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 30 PID 868 wrote to memory of 3056 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 30 PID 868 wrote to memory of 3056 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 30 PID 868 wrote to memory of 2708 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 31 PID 868 wrote to memory of 2708 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 31 PID 868 wrote to memory of 2708 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 31 PID 868 wrote to memory of 2708 868 {682B2F09-94B8-42a7-972B-486D3F0743B9}.exe 31 PID 3056 wrote to memory of 2584 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 32 PID 3056 wrote to memory of 2584 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 32 PID 3056 wrote to memory of 2584 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 32 PID 3056 wrote to memory of 2584 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 32 PID 3056 wrote to memory of 2416 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 33 PID 3056 wrote to memory of 2416 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 33 PID 3056 wrote to memory of 2416 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 33 PID 3056 wrote to memory of 2416 3056 {80107138-41BE-46f8-8288-05BA0D6A2845}.exe 33 PID 2584 wrote to memory of 2828 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 36 PID 2584 wrote to memory of 2828 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 36 PID 2584 wrote to memory of 2828 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 36 PID 2584 wrote to memory of 2828 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 36 PID 2584 wrote to memory of 2868 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 37 PID 2584 wrote to memory of 2868 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 37 PID 2584 wrote to memory of 2868 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 37 PID 2584 wrote to memory of 2868 2584 {D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe 37 PID 2828 wrote to memory of 528 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 38 PID 2828 wrote to memory of 528 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 38 PID 2828 wrote to memory of 528 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 38 PID 2828 wrote to memory of 528 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 38 PID 2828 wrote to memory of 2760 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 39 PID 2828 wrote to memory of 2760 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 39 PID 2828 wrote to memory of 2760 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 39 PID 2828 wrote to memory of 2760 2828 {9993CFA8-4214-4233-B6B7-85D68467ED56}.exe 39 PID 528 wrote to memory of 2000 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 40 PID 528 wrote to memory of 2000 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 40 PID 528 wrote to memory of 2000 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 40 PID 528 wrote to memory of 2000 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 40 PID 528 wrote to memory of 1096 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 41 PID 528 wrote to memory of 1096 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 41 PID 528 wrote to memory of 1096 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 41 PID 528 wrote to memory of 1096 528 {E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe 41 PID 2000 wrote to memory of 596 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 42 PID 2000 wrote to memory of 596 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 42 PID 2000 wrote to memory of 596 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 42 PID 2000 wrote to memory of 596 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 42 PID 2000 wrote to memory of 440 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 43 PID 2000 wrote to memory of 440 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 43 PID 2000 wrote to memory of 440 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 43 PID 2000 wrote to memory of 440 2000 {40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe 43 PID 596 wrote to memory of 2748 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 44 PID 596 wrote to memory of 2748 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 44 PID 596 wrote to memory of 2748 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 44 PID 596 wrote to memory of 2748 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 44 PID 596 wrote to memory of 2740 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 45 PID 596 wrote to memory of 2740 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 45 PID 596 wrote to memory of 2740 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 45 PID 596 wrote to memory of 2740 596 {0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_416cd2df03d64c68249c5d6ab1f320fb_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\{682B2F09-94B8-42a7-972B-486D3F0743B9}.exeC:\Windows\{682B2F09-94B8-42a7-972B-486D3F0743B9}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\{80107138-41BE-46f8-8288-05BA0D6A2845}.exeC:\Windows\{80107138-41BE-46f8-8288-05BA0D6A2845}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\{D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exeC:\Windows\{D9A909C7-520D-4b2b-A88F-BC45108DD56D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\{9993CFA8-4214-4233-B6B7-85D68467ED56}.exeC:\Windows\{9993CFA8-4214-4233-B6B7-85D68467ED56}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\{E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exeC:\Windows\{E9D0AF0B-534E-438a-AD91-30E1E47A5941}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\{40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exeC:\Windows\{40DE3A22-C326-482c-922A-D90B6ACFEBFB}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\{0195A872-2B5E-4b5c-81DA-03553301EDDD}.exeC:\Windows\{0195A872-2B5E-4b5c-81DA-03553301EDDD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\{A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exeC:\Windows\{A287C2F3-BA83-42ee-91CE-C8C434F7E9BE}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\{AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exeC:\Windows\{AC5F6CE1-87DE-466a-BF1F-9A0BC51FA270}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\{97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exeC:\Windows\{97565752-F2BD-4ae4-8391-5F6CEC6C23F5}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:544 -
C:\Windows\{D7524234-F543-4e39-BE96-891C69D7B632}.exeC:\Windows\{D7524234-F543-4e39-BE96-891C69D7B632}.exe12⤵
- Executes dropped EXE
PID:836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97565~1.EXE > nul12⤵PID:2100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC5F6~1.EXE > nul11⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A287C~1.EXE > nul10⤵PID:2312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0195A~1.EXE > nul9⤵PID:2740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40DE3~1.EXE > nul8⤵PID:440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9D0A~1.EXE > nul7⤵PID:1096
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9993C~1.EXE > nul6⤵PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9A90~1.EXE > nul5⤵PID:2868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80107~1.EXE > nul4⤵PID:2416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{682B2~1.EXE > nul3⤵PID:2708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5474301e43985565cbd9de80ceeb0957c
SHA18d06f6b86a531236ceb5150d26a6f3b89892df13
SHA256ddd9aed78465abaef66340d0bc287c23fa3077674181725294f38a6f7266d68e
SHA512bb9f836a3a76f47622c14851b74bc04edd5a0416a4bd2ff576d5e39285364ac023bc4b1372174b6f61826cc994b3a7a7c8cc4a616db1d34d2fa1a8b340233c9c
-
Filesize
344KB
MD5c7d14550db0ef5f6b99ac31d29287b1d
SHA1d7a49d0f820e5c77ece74d054a6bfb14e08fea5b
SHA256b6ff9023910524d367df993754a6d50b8b35fa6e2c64fd393d66525c588a30e6
SHA51253cd6b4b8ba92eb1987b6c52a2ce8fc363bc74146352e9ecb2b340af563abc881670cf53d12d46bf62892acaa6fcc220f9e9ed1efc3b6ac3f35f5321d64bf621
-
Filesize
344KB
MD5e4e4eb84b213a41c0ed9e4bccada4dbc
SHA149cf4c5d26be7c976dbe3fca47d6a40b7d14d616
SHA256c003db05906b8aa769727847f0358579b170c82d968f48dc4090ea88dbd00e9d
SHA5120b677e4f647423fd7430add38b0593ce635e98a1c2e1620687480f1f908b6b476e8e70679f767415ba260e3c30389c5c79ab2ea3a5b00ffe855992869accf5b7
-
Filesize
344KB
MD59fa2de9e0c0520b345901cb777c7fafe
SHA123fb7d69f970603f3c2f446aa4000b6e429353ec
SHA2562c05249a1701caaa0b1e4728c6b825a454238c72129c430858646d8c997d5a6f
SHA5120bb81bd24eb5263810c0d7e7ca8ec327b9d650d327e908ae9fa4c4b945a238e5d4fbcc6fa7a1f75878103243977c3bb14efe67164af3b88c29f7761feb3c9332
-
Filesize
344KB
MD546bfde5dd49d94b3161095766425fbf8
SHA16c039ad7140bc9b28a377d3385e63812481852a7
SHA256dd37f1f584dd1686f4221e9f8fba4a88f0147e0473dc793544050138292fee99
SHA512bb15ba234d00ac0977de0b61e65b16d07ff5208ce439e1643266b2bb6a3807019aa77b7536d0b072f4740e271cf41c3f12f84412433dd95316f00f05fc42b33e
-
Filesize
344KB
MD5b08749750855bd78ce2dcb62fdd538f9
SHA1fcc48d4964cee414a01ff2911cdc8faa3bc71f8f
SHA2562abadfa5da7dfcfa28091f39f9438373a55a5df0c99ab4c28174d218177340c0
SHA512443932cab1928d011f79d58a4c063f8251e030da89480c5bd17111c3ad31fb60b4a0808244227cd1a1ac2fc625bba4a064b2b706a29e643f9097207882a7ad2e
-
Filesize
344KB
MD515ac5f356e143c1f28af0c7365a63638
SHA1ca94fab9d7f341b70667d364f665b56eddfb7122
SHA256324b6c44c7e7f93912a063b49ab44ff67d5d9efb47b34fcfff4c9b83f1a9c248
SHA512c0a0396f5b5501add162c83f5037ba4f95c387cf0c39f995d7a179f3c73f57e25626d9428b4755a2f3ed2f6a81235946a202f263093453b44fb037fa07382a8a
-
Filesize
344KB
MD592e377ff014aeb2742d9a0385c8c83b8
SHA1bacbd48c1679b81d17f1d1c73ad545570e824af5
SHA25652af85b5409d49f81ff0352e7dec8230fa6990f2e488634a9a015e63027efe2c
SHA5122762bd26ccd5994fea17a4270bb002fb8cc4e744a6a7905c52ed825f2905c536b70edcc2d5ad1dda972918e4772e8293d4263e2ae44fd817519d763e5f456159
-
Filesize
344KB
MD5d219dcb1bf53503e488aee48e66f9789
SHA1c1a6bd2e32c0d8bef6e0808c1df97b896ce6a614
SHA25614b0120ba9d1c0613c50bba7a494b645e2ae3450a27b424d7e6086090ee07621
SHA512ebfdfded9241b904f0d68a63d87da0fca144eda071604c0a4d7e699856ec0506fab40f2343e6c1a17d8077ac7907970e4e80ec1ff4f1c4e2a5065fedd86a8eed
-
Filesize
344KB
MD5669513b5e6c71c414342de2208921790
SHA1ab4a208a4fcfe346eab41ad1033c91d170d020a8
SHA2569619701c5c619f0f4857b58be844eaa0b816c902f0114861a342b444e94f7c65
SHA5120e54f5f26a7ec9b343fc8d6ee90c870c154742f5217bf08ed6d1356980962929edbe09a4667a77dea13962867129e86f58356ecfe48d265376978adba867cc50
-
Filesize
344KB
MD52ecbe24ad4bd9fc256d27d3a71695525
SHA1466b9d828672afa7688241d30d135b1b0a3b7269
SHA2564aa118d6b01c826860d8a8813fb0bd69ea3a5634bef00bf5e841984c2a1d7182
SHA5120fd0568940d9e7e7e6a49bc6e4fe384586285ea413687e91dd826f878fd095276bd037080d510311932f79155eb9b639a75b1f570fcdf35300229d8703d6efd1