Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 21:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe
-
Size
204KB
-
MD5
6030608dbda6f24061302a8b96132583
-
SHA1
cd1e19ddf03775d138f6fc00ba20572f68d2690d
-
SHA256
3c8f713770473a68fa2f70b65f1c2298547b78ca26462e0d7db89518b8fbe950
-
SHA512
bda887b542d4825d6583addc4fcefa68ea03e67e2d093ee85d5bc9c6291899add0486f616458619a55b1eec9b2ff5debad8e3f4202aa29ae324c1bf63f1cdcbe
-
SSDEEP
1536:1EGh0oGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oGl1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000231de-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00110000000231ec-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231f3-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00120000000231ec-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d41-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d42-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021d41-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000707-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89E72E84-049C-44e8-A114-B65F8736614D}\stubpath = "C:\\Windows\\{89E72E84-049C-44e8-A114-B65F8736614D}.exe" {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD620C2A-9F46-4605-8F8C-FE9952BB8272} {89E72E84-049C-44e8-A114-B65F8736614D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2} {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A975883-4A2A-4c58-AEB1-C4D279630A26}\stubpath = "C:\\Windows\\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe" {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}\stubpath = "C:\\Windows\\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe" {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}\stubpath = "C:\\Windows\\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe" {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6499CC57-06F0-48d9-B4ED-A8C2B311B531} {082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}\stubpath = "C:\\Windows\\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe" 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89E72E84-049C-44e8-A114-B65F8736614D} {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}\stubpath = "C:\\Windows\\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe" {89E72E84-049C-44e8-A114-B65F8736614D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F} {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{108134B4-B6AF-4668-8F16-CAED54D980FB}\stubpath = "C:\\Windows\\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exe" {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4596DCFF-B727-41d9-8C06-38B209A66420} {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB26D8AA-4CA9-4653-B66E-65145673825A} {4596DCFF-B727-41d9-8C06-38B209A66420}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A416E20-9B36-4346-9E43-D3823FDBADEF} {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4} 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A416E20-9B36-4346-9E43-D3823FDBADEF}\stubpath = "C:\\Windows\\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe" {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A} {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4596DCFF-B727-41d9-8C06-38B209A66420}\stubpath = "C:\\Windows\\{4596DCFF-B727-41d9-8C06-38B209A66420}.exe" {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A975883-4A2A-4c58-AEB1-C4D279630A26} {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{108134B4-B6AF-4668-8F16-CAED54D980FB} {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB26D8AA-4CA9-4653-B66E-65145673825A}\stubpath = "C:\\Windows\\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exe" {4596DCFF-B727-41d9-8C06-38B209A66420}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}\stubpath = "C:\\Windows\\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe" {082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}\stubpath = "C:\\Windows\\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe" {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe -
Executes dropped EXE 12 IoCs
pid Process 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 1624 {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe 1404 {082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe 2288 {6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe File created C:\Windows\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe File created C:\Windows\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exe {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe File created C:\Windows\{4596DCFF-B727-41d9-8C06-38B209A66420}.exe {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe File created C:\Windows\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe {082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe File created C:\Windows\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe File created C:\Windows\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe File created C:\Windows\{89E72E84-049C-44e8-A114-B65F8736614D}.exe {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe File created C:\Windows\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe {89E72E84-049C-44e8-A114-B65F8736614D}.exe File created C:\Windows\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe File created C:\Windows\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exe {4596DCFF-B727-41d9-8C06-38B209A66420}.exe File created C:\Windows\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe Token: SeIncBasePriorityPrivilege 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe Token: SeIncBasePriorityPrivilege 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe Token: SeIncBasePriorityPrivilege 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe Token: SeIncBasePriorityPrivilege 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe Token: SeIncBasePriorityPrivilege 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe Token: SeIncBasePriorityPrivilege 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe Token: SeIncBasePriorityPrivilege 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe Token: SeIncBasePriorityPrivilege 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe Token: SeIncBasePriorityPrivilege 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe Token: SeIncBasePriorityPrivilege 1624 {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe Token: SeIncBasePriorityPrivilege 1404 {082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 2424 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe 96 PID 3260 wrote to memory of 2424 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe 96 PID 3260 wrote to memory of 2424 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe 96 PID 3260 wrote to memory of 3068 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe 97 PID 3260 wrote to memory of 3068 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe 97 PID 3260 wrote to memory of 3068 3260 2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe 97 PID 2424 wrote to memory of 2336 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 98 PID 2424 wrote to memory of 2336 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 98 PID 2424 wrote to memory of 2336 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 98 PID 2424 wrote to memory of 2776 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 99 PID 2424 wrote to memory of 2776 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 99 PID 2424 wrote to memory of 2776 2424 {F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe 99 PID 2336 wrote to memory of 4548 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 101 PID 2336 wrote to memory of 4548 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 101 PID 2336 wrote to memory of 4548 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 101 PID 2336 wrote to memory of 4196 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 102 PID 2336 wrote to memory of 4196 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 102 PID 2336 wrote to memory of 4196 2336 {89E72E84-049C-44e8-A114-B65F8736614D}.exe 102 PID 4548 wrote to memory of 3092 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 103 PID 4548 wrote to memory of 3092 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 103 PID 4548 wrote to memory of 3092 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 103 PID 4548 wrote to memory of 2840 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 104 PID 4548 wrote to memory of 2840 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 104 PID 4548 wrote to memory of 2840 4548 {DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe 104 PID 3092 wrote to memory of 720 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 105 PID 3092 wrote to memory of 720 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 105 PID 3092 wrote to memory of 720 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 105 PID 3092 wrote to memory of 1332 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 106 PID 3092 wrote to memory of 1332 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 106 PID 3092 wrote to memory of 1332 3092 {C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe 106 PID 720 wrote to memory of 5004 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 107 PID 720 wrote to memory of 5004 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 107 PID 720 wrote to memory of 5004 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 107 PID 720 wrote to memory of 4328 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 108 PID 720 wrote to memory of 4328 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 108 PID 720 wrote to memory of 4328 720 {9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe 108 PID 5004 wrote to memory of 4420 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 109 PID 5004 wrote to memory of 4420 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 109 PID 5004 wrote to memory of 4420 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 109 PID 5004 wrote to memory of 3112 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 110 PID 5004 wrote to memory of 3112 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 110 PID 5004 wrote to memory of 3112 5004 {8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe 110 PID 4420 wrote to memory of 4964 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 111 PID 4420 wrote to memory of 4964 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 111 PID 4420 wrote to memory of 4964 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 111 PID 4420 wrote to memory of 1356 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 112 PID 4420 wrote to memory of 1356 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 112 PID 4420 wrote to memory of 1356 4420 {108134B4-B6AF-4668-8F16-CAED54D980FB}.exe 112 PID 4964 wrote to memory of 1660 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 113 PID 4964 wrote to memory of 1660 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 113 PID 4964 wrote to memory of 1660 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 113 PID 4964 wrote to memory of 4432 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 114 PID 4964 wrote to memory of 4432 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 114 PID 4964 wrote to memory of 4432 4964 {4596DCFF-B727-41d9-8C06-38B209A66420}.exe 114 PID 1660 wrote to memory of 1624 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 115 PID 1660 wrote to memory of 1624 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 115 PID 1660 wrote to memory of 1624 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 115 PID 1660 wrote to memory of 2688 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 116 PID 1660 wrote to memory of 2688 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 116 PID 1660 wrote to memory of 2688 1660 {CB26D8AA-4CA9-4653-B66E-65145673825A}.exe 116 PID 1624 wrote to memory of 1404 1624 {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe 117 PID 1624 wrote to memory of 1404 1624 {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe 117 PID 1624 wrote to memory of 1404 1624 {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe 117 PID 1624 wrote to memory of 3896 1624 {8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exeC:\Windows\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\{89E72E84-049C-44e8-A114-B65F8736614D}.exeC:\Windows\{89E72E84-049C-44e8-A114-B65F8736614D}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exeC:\Windows\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exeC:\Windows\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exeC:\Windows\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exeC:\Windows\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exeC:\Windows\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\{4596DCFF-B727-41d9-8C06-38B209A66420}.exeC:\Windows\{4596DCFF-B727-41d9-8C06-38B209A66420}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exeC:\Windows\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exeC:\Windows\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exeC:\Windows\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Windows\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exeC:\Windows\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe13⤵
- Executes dropped EXE
PID:2288
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{082CC~1.EXE > nul13⤵PID:4628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A416~1.EXE > nul12⤵PID:3896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB26D~1.EXE > nul11⤵PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4596D~1.EXE > nul10⤵PID:4432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10813~1.EXE > nul9⤵PID:1356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A045~1.EXE > nul8⤵PID:3112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A975~1.EXE > nul7⤵PID:4328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C18F7~1.EXE > nul6⤵PID:1332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD620~1.EXE > nul5⤵PID:2840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89E72~1.EXE > nul4⤵PID:4196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F41E8~1.EXE > nul3⤵PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD52f55271c1f7fa228f2e407fae7431fea
SHA1373a078cee52df2dcf0a6501deb2b994a4ec856c
SHA2564746a30301d6521a6a93536d41db4c19576d3c871528f987bb086720fcabdefa
SHA512f1cd427c73d2500cf051068bdc23d48ad10bac0487d617bacaca37357aa990070b9e3f268e49829f84b54255922626b479ef22d556a97f67ce6e9e67a5a641f5
-
Filesize
204KB
MD598b22da199f32b1242533c603d23480a
SHA14d5636cb728dafb9fa8843984a79dcd882dc36e8
SHA256cf0cb716ebc31f66d6311aab6e06d5e4bc8faed8edb7653593f27cc53c1b3491
SHA512f669a6a48897118d022cc3f8833ecf7e8bf74c3ce612188c06daa9ed2c937c041fae2abc7295cc0dd2850e51c179ab660504b11b2fd5b6f580ebe8622e60b217
-
Filesize
204KB
MD5de223f4d099942c112d3a2218d995ba5
SHA125aedd8015623450d0cb0198d6f69dee39af4962
SHA256d4b19bebf9df83612ac5a34e2589c5f1fefc73bf5f0524f003d4cdeaf552d3e6
SHA512a65ffc56ca4dfd98bf0473e7416b6b65cbd38e393a1866f7f3628db718cd160e4b8fb1645284e189cb1e11cbf865b7fd275b515976e2c4e20cb3f842359dda28
-
Filesize
204KB
MD57631ce79fd0f38d9532aaa38f8b8b487
SHA13db3d7acfc243e196a7961fed61a0424b6e7198c
SHA25689594b34419287d6f4e38c4913026a9741842d9776c07d3edbee9181266779b1
SHA5127a3244276878e6bc39922cd1dfd1bc410707aadfed56442e83ea9dd25804d956690b31e5391cc5fd1f65c5fea614f219429a6e95d5fd3c5cedaf85bf71fe535d
-
Filesize
204KB
MD5886bbffa5313033a4177396260837d0c
SHA123e5c987c4b01c5bdb7aa9fef8df34a738f5bb6a
SHA2561a06d9971881570242f1740d03249e3f0400494554d87a7966e82b42fce63578
SHA51295bdc57eb5a4e45ed50195a19d2794bbb22618b99146a163b75aae6017757e834f1fda73ffd6bcd79009c36471172c946985169d16910bc94bca6079b5749bc1
-
Filesize
204KB
MD5c64dcffa33ebb2b6ec9179a3a31ee84e
SHA161d17e94a2f8dbadce8a7d6c2fb03b27ff5b8eb3
SHA256358ca50c302361c1390d0511834c3f6b8686084f5c3256d48c17ee5c27ae2af5
SHA512add92f5c99a729c6bf0e8b4f60247fa06886fe9b4aacec749603ebe974e57cfc8bdd092aded76dc3fc747ca470eb3c61ef073526d16a7f2cf6c028bc004aecb8
-
Filesize
204KB
MD5242bce61c35ed833f5f25b0d62929b4f
SHA12b967228b72e4e647d476263fdbd5d7cf7429e82
SHA2564566f674bbf504569e983859d4bee1d54abf3083c3ba9221819daa248c7a51db
SHA51276a47e605d7f12fb88f7cc6bc7c26f7487cdea6cfe35e2913d3e45b78540df789f533c60ee5be998e1d6931c4e3af3dde0ccfffe4fbff25a413790b3e369e4cf
-
Filesize
204KB
MD5ee14e0fa5db5b055e9cde495316644e0
SHA1881e32d948202edbceb623741da70b8a2a0509cb
SHA25645d1d81dbfd13d82b1f677fa90f105b52b668d3ea4c4dd14d0a65b9cb820b90e
SHA512c35fe92546bec22b48f3fc832a8a7d01e551b71693be675cd530d2a6351d61ef2fdb15a06efd83efa44fd732389606a73c6f1cade40fdcda18da8222b099d4b5
-
Filesize
204KB
MD51bae2fc1c8da90401a0f6620f58acd47
SHA132815dd1e885ad7a0b4716598460be6650757eb7
SHA25691a9ca8a3ade3d6b8d26e10f962fa1b07680064841f4c116479db81b7d7530f1
SHA512f73ab1292e2deb0975ed5b71a473aef900a4d5961eaaa82a35cea22d9a3d1a9bcbc2bc5de982205e18fb817be6e5ec381b56c03bf6ad2cd2c941abd175ee03fc
-
Filesize
204KB
MD5537b9e76bcd13b39721537decba86e0e
SHA11a8c74c548e1046a463b26af9f69851cc47e372b
SHA25666d32fe1aac97e377ae0af7c5e23fdd60645896d07f3ff75d9c3a88d5bb99308
SHA512bf2b024dd66685bf729980d2a8f82e883845c92d744a27f574c24c9ab8ea477f223aff3283ba664818f925e35a127725913cc7cab44be11317bf71972538f63f
-
Filesize
204KB
MD54c49fa65433da4f6b772058f0e6be866
SHA1ecd01ad428ca4431ab2ec87bca5dd33296b74a9a
SHA256640c49575250a404eeec21f3671a0eab4b8ed92c7f21e092e2fcb522d4261062
SHA5129b79bd0c4f00476f30cd73fc9d44c25187140fba06b39caad097255ce60c161ddfcb6de40f1b446e41a94ab7a021727cdfffc4877764917a81881779ac221b3c
-
Filesize
204KB
MD5e21404cd1c8330379b22f9d13c6bb04d
SHA143777f6486305c5fdf6c2ef39c4d0df1aabef2b9
SHA256f1b6c0e1bca8d2b9918c7bf32795e8775635f8de57c0189b6ba2a3271865b5a0
SHA512dc81a4d2f071cfb4ddb0aaa39d031151cb16809415ababec95157fdbc1588156bda8d6d1655d7b980176b7e0d282962cd97c2ac4aba51fe1b6c722b3197a3401