Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe
-
Size
168KB
-
MD5
7cef5df66ff7e58f9788b662f6f660c6
-
SHA1
3be730923e04347c9b10dc89f65d08b4619d4517
-
SHA256
4428b755338c423f4b0d8e3273b77918208171919fc3cf38b86df7565eb6bfe5
-
SHA512
49d07f6427139419338d4083e78b6787e7f1b0e2be447b2cbba96630948a039862813ac5afbe759345a2e4fa75ed28c7b500256dca2c8382cff9fda75ec805e9
-
SSDEEP
1536:1EGh0oflq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oflqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000b000000013420-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000015ccd-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000c000000013420-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000013420-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000013420-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000013420-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0010000000013420-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CC7B88A-035D-40ad-960E-28ECEC034048} {29CE7A06-2207-4147-9AE1-5E026110F827}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CC7B88A-035D-40ad-960E-28ECEC034048}\stubpath = "C:\\Windows\\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe" {29CE7A06-2207-4147-9AE1-5E026110F827}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCF369AD-7648-47b2-9702-E2992FAC89C1}\stubpath = "C:\\Windows\\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe" {30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE3766D7-BD84-425f-A273-861EF3A863B4}\stubpath = "C:\\Windows\\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe" 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5} {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43718F63-390C-4991-A7B2-8069AB9C063E} {43936A58-A620-4de2-8776-D2F71A729056}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29CE7A06-2207-4147-9AE1-5E026110F827}\stubpath = "C:\\Windows\\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe" {43718F63-390C-4991-A7B2-8069AB9C063E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE3766D7-BD84-425f-A273-861EF3A863B4} 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2972D8E3-39DA-4b29-BB84-2766F6478DA2} {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}\stubpath = "C:\\Windows\\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe" {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}\stubpath = "C:\\Windows\\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe" {8CC7B88A-035D-40ad-960E-28ECEC034048}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCF369AD-7648-47b2-9702-E2992FAC89C1} {30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}\stubpath = "C:\\Windows\\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe" {FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A} {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43936A58-A620-4de2-8776-D2F71A729056} {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43936A58-A620-4de2-8776-D2F71A729056}\stubpath = "C:\\Windows\\{43936A58-A620-4de2-8776-D2F71A729056}.exe" {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{29CE7A06-2207-4147-9AE1-5E026110F827} {43718F63-390C-4991-A7B2-8069AB9C063E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7} {8CC7B88A-035D-40ad-960E-28ECEC034048}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED} {FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}\stubpath = "C:\\Windows\\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe" {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}\stubpath = "C:\\Windows\\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe" {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43718F63-390C-4991-A7B2-8069AB9C063E}\stubpath = "C:\\Windows\\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe" {43936A58-A620-4de2-8776-D2F71A729056}.exe -
Deletes itself 1 IoCs
pid Process 2476 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 2436 {8CC7B88A-035D-40ad-960E-28ECEC034048}.exe 1400 {30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe 1668 {FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe 2020 {C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe File created C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe {43936A58-A620-4de2-8776-D2F71A729056}.exe File created C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe {43718F63-390C-4991-A7B2-8069AB9C063E}.exe File created C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe {FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe File created C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe File created C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe File created C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe File created C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe {29CE7A06-2207-4147-9AE1-5E026110F827}.exe File created C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe {8CC7B88A-035D-40ad-960E-28ECEC034048}.exe File created C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe {30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe File created C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe Token: SeIncBasePriorityPrivilege 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe Token: SeIncBasePriorityPrivilege 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe Token: SeIncBasePriorityPrivilege 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe Token: SeIncBasePriorityPrivilege 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe Token: SeIncBasePriorityPrivilege 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe Token: SeIncBasePriorityPrivilege 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe Token: SeIncBasePriorityPrivilege 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe Token: SeIncBasePriorityPrivilege 2436 {8CC7B88A-035D-40ad-960E-28ECEC034048}.exe Token: SeIncBasePriorityPrivilege 1400 {30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe Token: SeIncBasePriorityPrivilege 1668 {FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1956 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 28 PID 2320 wrote to memory of 1956 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 28 PID 2320 wrote to memory of 1956 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 28 PID 2320 wrote to memory of 1956 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 28 PID 2320 wrote to memory of 2476 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 29 PID 2320 wrote to memory of 2476 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 29 PID 2320 wrote to memory of 2476 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 29 PID 2320 wrote to memory of 2476 2320 2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe 29 PID 1956 wrote to memory of 2600 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 30 PID 1956 wrote to memory of 2600 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 30 PID 1956 wrote to memory of 2600 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 30 PID 1956 wrote to memory of 2600 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 30 PID 1956 wrote to memory of 2696 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 31 PID 1956 wrote to memory of 2696 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 31 PID 1956 wrote to memory of 2696 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 31 PID 1956 wrote to memory of 2696 1956 {FE3766D7-BD84-425f-A273-861EF3A863B4}.exe 31 PID 2600 wrote to memory of 2684 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 32 PID 2600 wrote to memory of 2684 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 32 PID 2600 wrote to memory of 2684 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 32 PID 2600 wrote to memory of 2684 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 32 PID 2600 wrote to memory of 2800 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 33 PID 2600 wrote to memory of 2800 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 33 PID 2600 wrote to memory of 2800 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 33 PID 2600 wrote to memory of 2800 2600 {4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe 33 PID 2684 wrote to memory of 2472 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 36 PID 2684 wrote to memory of 2472 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 36 PID 2684 wrote to memory of 2472 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 36 PID 2684 wrote to memory of 2472 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 36 PID 2684 wrote to memory of 3008 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 37 PID 2684 wrote to memory of 3008 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 37 PID 2684 wrote to memory of 3008 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 37 PID 2684 wrote to memory of 3008 2684 {0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe 37 PID 2472 wrote to memory of 2712 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 38 PID 2472 wrote to memory of 2712 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 38 PID 2472 wrote to memory of 2712 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 38 PID 2472 wrote to memory of 2712 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 38 PID 2472 wrote to memory of 2744 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 39 PID 2472 wrote to memory of 2744 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 39 PID 2472 wrote to memory of 2744 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 39 PID 2472 wrote to memory of 2744 2472 {2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe 39 PID 2712 wrote to memory of 2884 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 40 PID 2712 wrote to memory of 2884 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 40 PID 2712 wrote to memory of 2884 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 40 PID 2712 wrote to memory of 2884 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 40 PID 2712 wrote to memory of 2620 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 41 PID 2712 wrote to memory of 2620 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 41 PID 2712 wrote to memory of 2620 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 41 PID 2712 wrote to memory of 2620 2712 {43936A58-A620-4de2-8776-D2F71A729056}.exe 41 PID 2884 wrote to memory of 1548 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 42 PID 2884 wrote to memory of 1548 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 42 PID 2884 wrote to memory of 1548 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 42 PID 2884 wrote to memory of 1548 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 42 PID 2884 wrote to memory of 1648 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 43 PID 2884 wrote to memory of 1648 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 43 PID 2884 wrote to memory of 1648 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 43 PID 2884 wrote to memory of 1648 2884 {43718F63-390C-4991-A7B2-8069AB9C063E}.exe 43 PID 1548 wrote to memory of 2436 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 44 PID 1548 wrote to memory of 2436 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 44 PID 1548 wrote to memory of 2436 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 44 PID 1548 wrote to memory of 2436 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 44 PID 1548 wrote to memory of 2656 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 45 PID 1548 wrote to memory of 2656 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 45 PID 1548 wrote to memory of 2656 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 45 PID 1548 wrote to memory of 2656 1548 {29CE7A06-2207-4147-9AE1-5E026110F827}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exeC:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exeC:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exeC:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exeC:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exeC:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exeC:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exeC:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exeC:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2436 -
C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exeC:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exeC:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1668 -
C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exeC:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe12⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCF36~1.EXE > nul12⤵PID:296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30FFE~1.EXE > nul11⤵PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CC7B~1.EXE > nul10⤵PID:1172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29CE7~1.EXE > nul9⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43718~1.EXE > nul8⤵PID:1648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43936~1.EXE > nul7⤵PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2972D~1.EXE > nul6⤵PID:2744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A9E8~1.EXE > nul5⤵PID:3008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FCCD~1.EXE > nul4⤵PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE376~1.EXE > nul3⤵PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5991c39e2ede9ae4d2a60ea652cf04506
SHA1af302222f7d1d7f8461cad11e34aeb9fc1c3e6e2
SHA25641b1e09ac96959c7be420c2cd32a7437fa243b67abcc260469860903723e280b
SHA512245bca01b8b88e25ba8c04490feffe135c316bd8948db867ecc032e9770e7f76afc5ab3f6c815dc06e9366ebb1d1ac11bbb79f55d9ed9e4f5ee3fdfc5231406c
-
Filesize
168KB
MD5bdd73b4422d2d6e085d596164c59d751
SHA160f93eb59a89ecd33a7d5ca2fd61c149aaedb15f
SHA256a4eebd156f2e941e2162e23d100c02ed23acfef8ebc33367453853f5894d81e3
SHA5124b2ae8bde0d151f58f1fedb18d1ef891a3832cb72b15b2a260e310c105f6ed0f68e337edf9a8d19201565c71d04b060f18a40b06df88fc480805e7ca9c9be6ea
-
Filesize
168KB
MD5b2d0b3374cd44fe2bcc9b79eedfe6605
SHA15f06a620d3d2a7edf9036a72723d19e1c44942fc
SHA2561b9082e216cbac73b77e76d189c2393b0b5810837d9a27f86a44b88c04849069
SHA512beb50df4339ccafc1080152fb6013bb8b2cbeac100449cea5afc3a880e36cb326cf629b1245d69d7082d88ddc8eb4e899c279ffec73bec56b6d7a5c748eb08cf
-
Filesize
168KB
MD5b84c53f83f74de9dbdc2712c54831525
SHA1a9c45f6a2d3bc2fae451b7471c8f125d87f330a4
SHA2560ec07c6a0098c56ae533bf026e8f0841672d0ef1ed5c3418c598f51315719c56
SHA5124495639d68ec1380fbca8cbfdcdc0477f6f8e6d21145ab7300a70927eef0939b8549a1900fdbacd3ed65f881a8cbe6936fd138b7da8c8d43e6903c125fb80f3f
-
Filesize
168KB
MD53a471ee6a3714b30805891c8ea0dc458
SHA1f3f0ab50f99049a8c6cc1a51c18017cd570eb6f6
SHA256dca091b8bc2ae4c2a5bcf306348bbfdb81073ef8da2f082efdb3c071f2d91055
SHA512f5b2a2633ec52f0521bc30a5ea6fa0dcd43817926e06fe7748571d0c822133b3322f5bb0521bb6a0141db42fe3c06c365a78f4c46fa3c983ed33dfd42abda080
-
Filesize
168KB
MD5f13f8974e550a514d8e0a11538741e3f
SHA1c4955f91a3e6d338028c502f2c0d0a6706519316
SHA256976a82d56d8cd021248b436e36dfd8d1490268b73e2ba3223315a35a06847091
SHA5122d85158ac7c32bd15478a9a49c9bc492384c2c7b0267b914c7d0fcadddb509810126d5dca7489473fe03a409193cea9778fcbb4c619bc1dae0f9cee32b2c7302
-
Filesize
168KB
MD59b6fb2aa39f4b74d0342cbffc8d925fe
SHA13569d9b6dcb4474dd16dbaea63b6fa6d6e973082
SHA256810019b2ca25e1f4a315502182ec3581dbd7400f099a69f97e793c0efbe25072
SHA5121fb01a90872c9a06d75fae1eab97bdedc40484b39b411a7b91230835e641cda0c90f74dde8de544b255824420b8bcaf8b7532c4f6e2db9c0d1a62a11681a77ab
-
Filesize
168KB
MD55095cbfa261a0c20d25f94735a0b3ce2
SHA1ec52e21704b3088c982ffdfe377c6c4218298aef
SHA256fa78f6710e3ea4adce82ac21ed17f483466b391fb3bbf233e4ef3c63741e3892
SHA5129d7cacb320cc67de01708063287875a913e25f28293b2a837ff873c3a67a3418bb53dd1733ea66f08ad98221b9cdd977a0ba47ca01735d6a22f3d7c28b8fead9
-
Filesize
168KB
MD51ece3c80fdb05c0da196cbc435f25419
SHA1a6a39585fcbbd491aa34b49883785c69ce3660d7
SHA256a47f22d708917cb0ce0d6379e95b2c35ebfdd93db9f6cda271481f662dad46a1
SHA512e67b0aa3c9b238126a3a6fc141f0281bdb28cf3d25b98462b54a5cee697af7aa21e02979c2780fb180bce7dd4f7239e6af9fe873c8bd2bdd6aba3d87e5ad4532
-
Filesize
168KB
MD5568614f9a0189101cc695146ea085523
SHA164eeb19b44711d6a87b26c30fc57fabcbaa062b1
SHA25665068179e3212802565666dec0cc193b2edccff1902e2b11a17fd0ce5e8c7b69
SHA5125b5c78cc341ba58e1e5baa91999c8c3e249bec101e6a2387e57f84b1cc99a4452e5d8b959fbb64f2785870b1c9452c84fa4da04f47a2ec75e4eca5a08a677f96
-
Filesize
168KB
MD50d4ffd22cf722d08267fe7be755ab611
SHA12cdce78c0a19631e3b1bdc6b9b30810fe677fcac
SHA2561bd669eefdd330dcabaa6d00b9339c391ce67975c1a3910d48d97483e32c6be7
SHA5122a0cb21d5c769487d43ac6b778e215c88ea45d00d2323405f98da934e110743f5086a58facf594e39e8d0fe4722052c8704d79c9258eac58353ab66844bb2015