Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
-
Size
372KB
-
MD5
39fc6a37b1b3a7574cbf8d757353b255
-
SHA1
52c8610784a3c7a649a3da285bd506843d1747e1
-
SHA256
59fe019f0c6741b09bd88bb33b1fae93c7a49bb20652ab79a431d06d6c22c70a
-
SHA512
58c03076fbdcb0e64939c97be7edcb48984ac82c56924680cdd947a06094b5107d494d85a2373dec9f68e29d7659393dfa992b3f896acd6babeb2ef4206c0ea7
-
SSDEEP
3072:CEGh0oLmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGcl/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b000000012251-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000012331-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000012251-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0032000000013a88-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000012251-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000012251-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000012251-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}\stubpath = "C:\\Windows\\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe" 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{491FA3FC-379F-451c-A6A4-94E9291C0310}\stubpath = "C:\\Windows\\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe" {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}\stubpath = "C:\\Windows\\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe" {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E0656E8-C38E-4357-92F7-69735FC553AD} {21873168-2952-4009-8CF2-353C54F91646}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5} {FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC3A56B-5862-40a5-9344-D4B349F546E1}\stubpath = "C:\\Windows\\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe" {BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2845C377-E238-4dbc-B1C1-E0043F72E436}\stubpath = "C:\\Windows\\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe" {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{491FA3FC-379F-451c-A6A4-94E9291C0310} {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}\stubpath = "C:\\Windows\\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe" {6E0656E8-C38E-4357-92F7-69735FC553AD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}\stubpath = "C:\\Windows\\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe" {FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC3A56B-5862-40a5-9344-D4B349F546E1} {BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850} {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A51969B0-EC48-4885-A455-A1A8E61BEDFF} {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21873168-2952-4009-8CF2-353C54F91646} {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21873168-2952-4009-8CF2-353C54F91646}\stubpath = "C:\\Windows\\{21873168-2952-4009-8CF2-353C54F91646}.exe" {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E0656E8-C38E-4357-92F7-69735FC553AD}\stubpath = "C:\\Windows\\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe" {21873168-2952-4009-8CF2-353C54F91646}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE1008E1-50BE-43ab-AF2A-F83F865185CD} {6E0656E8-C38E-4357-92F7-69735FC553AD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B} 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}\stubpath = "C:\\Windows\\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe" {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2845C377-E238-4dbc-B1C1-E0043F72E436} {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8736918-22D7-45b0-B1E8-47F9B7826C67} {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8736918-22D7-45b0-B1E8-47F9B7826C67}\stubpath = "C:\\Windows\\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe" {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe -
Deletes itself 1 IoCs
pid Process 2608 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 1188 {6E0656E8-C38E-4357-92F7-69735FC553AD}.exe 2516 {FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe 2216 {BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe 596 {CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe File created C:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe File created C:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe File created C:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe {21873168-2952-4009-8CF2-353C54F91646}.exe File created C:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe {FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe File created C:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe {BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe File created C:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe File created C:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe File created C:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe File created C:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exe {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe File created C:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe {6E0656E8-C38E-4357-92F7-69735FC553AD}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe Token: SeIncBasePriorityPrivilege 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe Token: SeIncBasePriorityPrivilege 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe Token: SeIncBasePriorityPrivilege 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe Token: SeIncBasePriorityPrivilege 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe Token: SeIncBasePriorityPrivilege 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe Token: SeIncBasePriorityPrivilege 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe Token: SeIncBasePriorityPrivilege 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe Token: SeIncBasePriorityPrivilege 1188 {6E0656E8-C38E-4357-92F7-69735FC553AD}.exe Token: SeIncBasePriorityPrivilege 2516 {FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe Token: SeIncBasePriorityPrivilege 2216 {BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2956 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 28 PID 2932 wrote to memory of 2956 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 28 PID 2932 wrote to memory of 2956 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 28 PID 2932 wrote to memory of 2956 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 28 PID 2932 wrote to memory of 2608 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 29 PID 2932 wrote to memory of 2608 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 29 PID 2932 wrote to memory of 2608 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 29 PID 2932 wrote to memory of 2608 2932 2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe 29 PID 2956 wrote to memory of 2028 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 30 PID 2956 wrote to memory of 2028 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 30 PID 2956 wrote to memory of 2028 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 30 PID 2956 wrote to memory of 2028 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 30 PID 2956 wrote to memory of 2676 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 31 PID 2956 wrote to memory of 2676 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 31 PID 2956 wrote to memory of 2676 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 31 PID 2956 wrote to memory of 2676 2956 {2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe 31 PID 2028 wrote to memory of 2556 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 32 PID 2028 wrote to memory of 2556 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 32 PID 2028 wrote to memory of 2556 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 32 PID 2028 wrote to memory of 2556 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 32 PID 2028 wrote to memory of 2656 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 33 PID 2028 wrote to memory of 2656 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 33 PID 2028 wrote to memory of 2656 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 33 PID 2028 wrote to memory of 2656 2028 {F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe 33 PID 2556 wrote to memory of 2408 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 36 PID 2556 wrote to memory of 2408 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 36 PID 2556 wrote to memory of 2408 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 36 PID 2556 wrote to memory of 2408 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 36 PID 2556 wrote to memory of 2720 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 37 PID 2556 wrote to memory of 2720 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 37 PID 2556 wrote to memory of 2720 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 37 PID 2556 wrote to memory of 2720 2556 {2845C377-E238-4dbc-B1C1-E0043F72E436}.exe 37 PID 2408 wrote to memory of 2768 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 38 PID 2408 wrote to memory of 2768 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 38 PID 2408 wrote to memory of 2768 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 38 PID 2408 wrote to memory of 2768 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 38 PID 2408 wrote to memory of 1244 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 39 PID 2408 wrote to memory of 1244 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 39 PID 2408 wrote to memory of 1244 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 39 PID 2408 wrote to memory of 1244 2408 {491FA3FC-379F-451c-A6A4-94E9291C0310}.exe 39 PID 2768 wrote to memory of 2300 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 40 PID 2768 wrote to memory of 2300 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 40 PID 2768 wrote to memory of 2300 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 40 PID 2768 wrote to memory of 2300 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 40 PID 2768 wrote to memory of 1268 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 41 PID 2768 wrote to memory of 1268 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 41 PID 2768 wrote to memory of 1268 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 41 PID 2768 wrote to memory of 1268 2768 {A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe 41 PID 2300 wrote to memory of 1264 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 42 PID 2300 wrote to memory of 1264 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 42 PID 2300 wrote to memory of 1264 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 42 PID 2300 wrote to memory of 1264 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 42 PID 2300 wrote to memory of 1256 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 43 PID 2300 wrote to memory of 1256 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 43 PID 2300 wrote to memory of 1256 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 43 PID 2300 wrote to memory of 1256 2300 {B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe 43 PID 1264 wrote to memory of 1188 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 44 PID 1264 wrote to memory of 1188 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 44 PID 1264 wrote to memory of 1188 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 44 PID 1264 wrote to memory of 1188 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 44 PID 1264 wrote to memory of 2036 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 45 PID 1264 wrote to memory of 2036 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 45 PID 1264 wrote to memory of 2036 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 45 PID 1264 wrote to memory of 2036 1264 {21873168-2952-4009-8CF2-353C54F91646}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exeC:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exeC:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exeC:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exeC:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exeC:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exeC:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exeC:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exeC:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1188 -
C:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exeC:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exeC:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2216 -
C:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exeC:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe12⤵
- Executes dropped EXE
PID:596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCDC6~1.EXE > nul12⤵PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE100~1.EXE > nul11⤵PID:608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E065~1.EXE > nul10⤵PID:2192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21873~1.EXE > nul9⤵PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8736~1.EXE > nul8⤵PID:1256
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5196~1.EXE > nul7⤵PID:1268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{491FA~1.EXE > nul6⤵PID:1244
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2845C~1.EXE > nul5⤵PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F52CF~1.EXE > nul4⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D6B8~1.EXE > nul3⤵PID:2676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD51bb57a4316c2a45c4e76e8ac27f381df
SHA18179c04ce873a2a756343f967bc83e3bedfad30e
SHA256ae4c82fe42712dc2a0f4688c0ce98a07a5ed7dbf06c4aa62eda98954dfbb3493
SHA51244c80516727dd085c9e2d793856d0d81a486edb8cc58d98a03269f06bcab6762c650d7b9296e5f724a43e6ff487f99e5111efdeb6395aa7a0d564c7c2b95e990
-
Filesize
372KB
MD50227cc9ac093d90fb718c1bca8cbbe69
SHA160da259c9cca29357758196868292f66c0e6cb1e
SHA256da3069c2fdbaf6ad539dcc91c2c6acf72eaed05195ccb3261514a493009dc199
SHA5128a5933d7e8148e933d839faa5273b833ec25bf1ebaf4eb65a74f1dd4d98a80ac58351b35fa0a982b4c476ec24613ad174093b2cd18c86515afeae3687a069a89
-
Filesize
372KB
MD5c5d1d8a67540c1c521432eef0ef558d5
SHA1dcf5ec643d85a8f0d11413e5e0d15d30df7bd99b
SHA256b4d6e8d24bfcd55b471a6975d6650f77f5e9f7b64843111b13936a7fcb55c378
SHA512a43a5436b53a386d0f376b86af49d80fad26edaf01f2c02e8b2a4bf124df49bd17c230f8379277d216e178d7bb3004d5aa5e5385454357445c8adf490e89ee59
-
Filesize
372KB
MD5f3cf935fb8ca24bb36b23844e0e7f65b
SHA1444bf2924f2ce1627c9c003909eb61a69f37f681
SHA256ea313067ee9fb01442d699c08c6c69c31232ccd6cbfece073871da90902a05d8
SHA5122a97559ce4205df2d4baae9d12034a900843ee301e844ef74c5df8cd45d38b79978e6e503a6d48d2ab3e973c7be5759a5f9e846df717e54835b20dce7d8b1155
-
Filesize
372KB
MD599d8b18508d7b88cc3e4843fcd4eae0d
SHA1802f46c1676c02e81e1d62263c8d173c42be30dd
SHA2566795a1feedf03b0506549de8a3c08b2163495b400a4d09e9e919ec6eeb514bb9
SHA5123e8bf6aaa5e4061a2f6d782ca713eb002c7c9ae4ca739746b890d69a11346dad7968116ae98c9152613bfe00a8d81cb8b7884bb95fc272b2122fb22f68505c16
-
Filesize
372KB
MD58a9626981b6a32fe1754992215b1d3b9
SHA1a57a23336b59c0b05c9ddaa0e6ae2bc9e57fc353
SHA256780bce42837b432fe2ecaa45afc111c330e4f1f57a84c586ab59bf33b859cc76
SHA512f53251749b39f274405a2dbd11f79ee341e68c2b4865d9107f988344a6d629437ccc80d0c1583eddd8478cd3a12d6291696889f9b076f8dae5f4b624fb1585ec
-
Filesize
372KB
MD54d3047b9f42d8408c0471f1f26d8b7af
SHA1c3a2b8813e81a59d333a6814377c5466ee131bc2
SHA2564a20246569013524866f152c90253210b8d8dc1539854e88f6fcc516474e87d4
SHA512da7b446d0f23348313ebcb40a1580bd5c2536d84e18254421c8811d2b0506435fd67c7ff431a6ac37963a8b9fe3a7f6b0852df9cdf719e10787f07da9ddbada7
-
Filesize
372KB
MD5bdea93b2fbe036976e0e2ba4a7bfe93a
SHA16038d619ea7b9f29fec122855aa08c339c0185ce
SHA2566e4416432f8942cb3d8685f53c92c612f848e5279cac0afead7217596a60e563
SHA5125a8e336cfca9e9bc7b256d75c2486eef551d2bcc2615d54fd9411b01abdfabe2fad94275cb00fa36a00117c2e60e71c7ebef5881cb6cdc768e501508b5953428
-
Filesize
372KB
MD5c8a88a57c3f0bab3fba5d7aad1f29c8e
SHA11c46325ccd25bd8f2f4c5446baece968fcebf0c4
SHA256df3e24646764b5f83546d81346ce2aec9474f4b60c31f697be5ecb0ab66f74e7
SHA5128ad52f9731479467f46aaed3be3c21ad1010e00201c6703ca93faa2377c51fbf35c7ac87c6aba2a4adea4f57e3b870dfe956625522b99a8873a823872b897bab
-
Filesize
372KB
MD551cb69aeb02d633e13ba39e1d760755d
SHA1c487718d014fc662a638bbb9e09c8da98ab51739
SHA256c46900acd1ab59cbb92e0af6969a2a99c33211ae45c207a58aa3c81a02c5113c
SHA5122239584fd4e6228f0980af04a8a556a1ee8e03bdda9acb2d470509850f168bc0fda7ca93c0a59c11f299deb86e8b6ab45fbf626d58e5122bd7791ed7ca19f849
-
Filesize
372KB
MD5656294f6d2b21611b16708378832f8d3
SHA12564ad77eff359054c4858809ad07863849abac6
SHA25690706389b634195ed85f977e41864178ea0ebfa6ad637cca131b23a34bf6cd96
SHA512c0475d162606e5db92db0a4749493aa806ddfeb930aa195a5ac6d90fb2af4cd198266454d48c3cfa7f2dfbcd5aabd6d20ed825185aa7f7384a67e58b11909e50