Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe
-
Size
180KB
-
MD5
2eacf9b575fda381de9e81f90ddd4791
-
SHA1
eea825deb93806ebb2382558b397e01aeec16416
-
SHA256
c2012d1c2bfde307384aac5bcf86215cc4d3d21d4ba94557d5e88ee4d71227ff
-
SHA512
c7ef521384ca2e0d89a5704ba79e3f53c5ebfb58a8488dde2acde3c87d321e2ff45054cd1c3fdb7c9569da3d7fa36110fc89f205f055b590d90096e1b987db39
-
SSDEEP
3072:jEGh0ovlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGRl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000d00000001226c-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002a000000016c5d-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e00000001226c-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0029000000016c67-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e000000016caf-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000016d1a-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000f000000016caf-55.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000016d1a-62.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000016d2b-69.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000016d33-76.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A059884-35BE-4503-A607-5DBB4661C57A}\stubpath = "C:\\Windows\\{0A059884-35BE-4503-A607-5DBB4661C57A}.exe" 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFA2E7C2-AFC6-4d89-9222-A5D791F51208} {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFA2E7C2-AFC6-4d89-9222-A5D791F51208}\stubpath = "C:\\Windows\\{AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe" {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2132655A-50FB-40b7-BF1F-B7D763E41296}\stubpath = "C:\\Windows\\{2132655A-50FB-40b7-BF1F-B7D763E41296}.exe" {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46B4312C-7736-4fee-91AE-B2245657E371}\stubpath = "C:\\Windows\\{46B4312C-7736-4fee-91AE-B2245657E371}.exe" {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{358725DD-C064-4c16-A253-BD26821B10DC} {46B4312C-7736-4fee-91AE-B2245657E371}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F49C63A7-54CB-4870-A58E-DE848CD62433} {F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F49C63A7-54CB-4870-A58E-DE848CD62433}\stubpath = "C:\\Windows\\{F49C63A7-54CB-4870-A58E-DE848CD62433}.exe" {F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A96BC18-F492-42a5-B041-6DF4294A848E} {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A96BC18-F492-42a5-B041-6DF4294A848E}\stubpath = "C:\\Windows\\{9A96BC18-F492-42a5-B041-6DF4294A848E}.exe" {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}\stubpath = "C:\\Windows\\{4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe" {358725DD-C064-4c16-A253-BD26821B10DC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}\stubpath = "C:\\Windows\\{F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe" {4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69F849CB-8653-4d15-993E-28E8ABC7A627} {0A059884-35BE-4503-A607-5DBB4661C57A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69F849CB-8653-4d15-993E-28E8ABC7A627}\stubpath = "C:\\Windows\\{69F849CB-8653-4d15-993E-28E8ABC7A627}.exe" {0A059884-35BE-4503-A607-5DBB4661C57A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46B4312C-7736-4fee-91AE-B2245657E371} {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C} {358725DD-C064-4c16-A253-BD26821B10DC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F5790B43-72BF-4d51-82F9-BC3C3AEB06EB} {4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E2B566D-6D39-4f80-9468-3A4FF439D59D}\stubpath = "C:\\Windows\\{7E2B566D-6D39-4f80-9468-3A4FF439D59D}.exe" {F49C63A7-54CB-4870-A58E-DE848CD62433}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0A059884-35BE-4503-A607-5DBB4661C57A} 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2132655A-50FB-40b7-BF1F-B7D763E41296} {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{358725DD-C064-4c16-A253-BD26821B10DC}\stubpath = "C:\\Windows\\{358725DD-C064-4c16-A253-BD26821B10DC}.exe" {46B4312C-7736-4fee-91AE-B2245657E371}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E2B566D-6D39-4f80-9468-3A4FF439D59D} {F49C63A7-54CB-4870-A58E-DE848CD62433}.exe -
Deletes itself 1 IoCs
pid Process 2124 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 872 {4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe 1660 {F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe 2896 {F49C63A7-54CB-4870-A58E-DE848CD62433}.exe 2968 {7E2B566D-6D39-4f80-9468-3A4FF439D59D}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe {358725DD-C064-4c16-A253-BD26821B10DC}.exe File created C:\Windows\{F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe {4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe File created C:\Windows\{F49C63A7-54CB-4870-A58E-DE848CD62433}.exe {F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe File created C:\Windows\{7E2B566D-6D39-4f80-9468-3A4FF439D59D}.exe {F49C63A7-54CB-4870-A58E-DE848CD62433}.exe File created C:\Windows\{0A059884-35BE-4503-A607-5DBB4661C57A}.exe 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe File created C:\Windows\{69F849CB-8653-4d15-993E-28E8ABC7A627}.exe {0A059884-35BE-4503-A607-5DBB4661C57A}.exe File created C:\Windows\{AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe File created C:\Windows\{2132655A-50FB-40b7-BF1F-B7D763E41296}.exe {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe File created C:\Windows\{9A96BC18-F492-42a5-B041-6DF4294A848E}.exe {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe File created C:\Windows\{46B4312C-7736-4fee-91AE-B2245657E371}.exe {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe File created C:\Windows\{358725DD-C064-4c16-A253-BD26821B10DC}.exe {46B4312C-7736-4fee-91AE-B2245657E371}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe Token: SeIncBasePriorityPrivilege 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe Token: SeIncBasePriorityPrivilege 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe Token: SeIncBasePriorityPrivilege 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe Token: SeIncBasePriorityPrivilege 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe Token: SeIncBasePriorityPrivilege 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe Token: SeIncBasePriorityPrivilege 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe Token: SeIncBasePriorityPrivilege 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe Token: SeIncBasePriorityPrivilege 872 {4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe Token: SeIncBasePriorityPrivilege 1660 {F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe Token: SeIncBasePriorityPrivilege 2896 {F49C63A7-54CB-4870-A58E-DE848CD62433}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2164 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 28 PID 1284 wrote to memory of 2164 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 28 PID 1284 wrote to memory of 2164 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 28 PID 1284 wrote to memory of 2164 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 28 PID 1284 wrote to memory of 2124 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 29 PID 1284 wrote to memory of 2124 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 29 PID 1284 wrote to memory of 2124 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 29 PID 1284 wrote to memory of 2124 1284 2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe 29 PID 2164 wrote to memory of 2752 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 30 PID 2164 wrote to memory of 2752 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 30 PID 2164 wrote to memory of 2752 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 30 PID 2164 wrote to memory of 2752 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 30 PID 2164 wrote to memory of 2736 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 31 PID 2164 wrote to memory of 2736 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 31 PID 2164 wrote to memory of 2736 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 31 PID 2164 wrote to memory of 2736 2164 {0A059884-35BE-4503-A607-5DBB4661C57A}.exe 31 PID 2752 wrote to memory of 2624 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 32 PID 2752 wrote to memory of 2624 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 32 PID 2752 wrote to memory of 2624 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 32 PID 2752 wrote to memory of 2624 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 32 PID 2752 wrote to memory of 2268 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 33 PID 2752 wrote to memory of 2268 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 33 PID 2752 wrote to memory of 2268 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 33 PID 2752 wrote to memory of 2268 2752 {69F849CB-8653-4d15-993E-28E8ABC7A627}.exe 33 PID 2624 wrote to memory of 3040 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 36 PID 2624 wrote to memory of 3040 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 36 PID 2624 wrote to memory of 3040 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 36 PID 2624 wrote to memory of 3040 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 36 PID 2624 wrote to memory of 2276 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 37 PID 2624 wrote to memory of 2276 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 37 PID 2624 wrote to memory of 2276 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 37 PID 2624 wrote to memory of 2276 2624 {AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe 37 PID 3040 wrote to memory of 2700 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 38 PID 3040 wrote to memory of 2700 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 38 PID 3040 wrote to memory of 2700 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 38 PID 3040 wrote to memory of 2700 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 38 PID 3040 wrote to memory of 2828 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 39 PID 3040 wrote to memory of 2828 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 39 PID 3040 wrote to memory of 2828 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 39 PID 3040 wrote to memory of 2828 3040 {2132655A-50FB-40b7-BF1F-B7D763E41296}.exe 39 PID 2700 wrote to memory of 1956 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 40 PID 2700 wrote to memory of 1956 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 40 PID 2700 wrote to memory of 1956 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 40 PID 2700 wrote to memory of 1956 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 40 PID 2700 wrote to memory of 1708 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 41 PID 2700 wrote to memory of 1708 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 41 PID 2700 wrote to memory of 1708 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 41 PID 2700 wrote to memory of 1708 2700 {9A96BC18-F492-42a5-B041-6DF4294A848E}.exe 41 PID 1956 wrote to memory of 1596 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 42 PID 1956 wrote to memory of 1596 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 42 PID 1956 wrote to memory of 1596 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 42 PID 1956 wrote to memory of 1596 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 42 PID 1956 wrote to memory of 2244 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 43 PID 1956 wrote to memory of 2244 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 43 PID 1956 wrote to memory of 2244 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 43 PID 1956 wrote to memory of 2244 1956 {46B4312C-7736-4fee-91AE-B2245657E371}.exe 43 PID 1596 wrote to memory of 872 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 44 PID 1596 wrote to memory of 872 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 44 PID 1596 wrote to memory of 872 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 44 PID 1596 wrote to memory of 872 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 44 PID 1596 wrote to memory of 1476 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 45 PID 1596 wrote to memory of 1476 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 45 PID 1596 wrote to memory of 1476 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 45 PID 1596 wrote to memory of 1476 1596 {358725DD-C064-4c16-A253-BD26821B10DC}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_2eacf9b575fda381de9e81f90ddd4791_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\{0A059884-35BE-4503-A607-5DBB4661C57A}.exeC:\Windows\{0A059884-35BE-4503-A607-5DBB4661C57A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\{69F849CB-8653-4d15-993E-28E8ABC7A627}.exeC:\Windows\{69F849CB-8653-4d15-993E-28E8ABC7A627}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\{AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exeC:\Windows\{AFA2E7C2-AFC6-4d89-9222-A5D791F51208}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\{2132655A-50FB-40b7-BF1F-B7D763E41296}.exeC:\Windows\{2132655A-50FB-40b7-BF1F-B7D763E41296}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\{9A96BC18-F492-42a5-B041-6DF4294A848E}.exeC:\Windows\{9A96BC18-F492-42a5-B041-6DF4294A848E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\{46B4312C-7736-4fee-91AE-B2245657E371}.exeC:\Windows\{46B4312C-7736-4fee-91AE-B2245657E371}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\{358725DD-C064-4c16-A253-BD26821B10DC}.exeC:\Windows\{358725DD-C064-4c16-A253-BD26821B10DC}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\{4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exeC:\Windows\{4E2EABB8-8C82-4ce5-9A43-EF2E5BBBB68C}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Windows\{F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exeC:\Windows\{F5790B43-72BF-4d51-82F9-BC3C3AEB06EB}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\{F49C63A7-54CB-4870-A58E-DE848CD62433}.exeC:\Windows\{F49C63A7-54CB-4870-A58E-DE848CD62433}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\{7E2B566D-6D39-4f80-9468-3A4FF439D59D}.exeC:\Windows\{7E2B566D-6D39-4f80-9468-3A4FF439D59D}.exe12⤵
- Executes dropped EXE
PID:2968
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F49C6~1.EXE > nul12⤵PID:2328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5790~1.EXE > nul11⤵PID:2544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E2EA~1.EXE > nul10⤵PID:552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35872~1.EXE > nul9⤵PID:1476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46B43~1.EXE > nul8⤵PID:2244
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A96B~1.EXE > nul7⤵PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21326~1.EXE > nul6⤵PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFA2E~1.EXE > nul5⤵PID:2276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69F84~1.EXE > nul4⤵PID:2268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A059~1.EXE > nul3⤵PID:2736
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5acf1e85b62c2c624f7debf363ad5ce81
SHA1e3b280c2ac5af56e5d56eb022d9606131e6f9924
SHA256626ddd0790c3dede89bd5abcfbca493169a0c33e1994e01fee119a1d85e6c662
SHA5122e4c90ba6941ad8a0065c220d8440b2482158deb5a8247f9910710d32c75c045679de495f4956f905993626396715cc7a493d008b68f0ddfd97e7575b33d5e4f
-
Filesize
180KB
MD557b0fb7d54a8f9fcd4e8814a56665572
SHA18c5ed451284a75873b7e518e958e7ccb8e6d82eb
SHA25654f6e4070559d44ee7d40d05eb6b2257751e15c648d0451f9f3eb773a2ae0938
SHA51238c12254d6e2a71dadf9665a67ab4bba1c9b062d91720c92be396e53b44b15d6e4c065c42324e6eefe9825d3c26826e7a85559894915e0deb0fb65737cf6b3bd
-
Filesize
180KB
MD501377fef13426069f53430367c6f3810
SHA139bd51262b285afc70a8ab04284ff5b6f076dd23
SHA256f953721cd9e4a5a34f5a8a313468f4d882baae4e2c4a3089e08d966f5b944d40
SHA512c81e6aef1cd643efc36343c1802669d57ef9c0d9d09cbb7f7f7b7261239fbfcc91974a03af7197454444d930f3e90cb49a5fdc83f5980c2ec7a0dccc67b14ebd
-
Filesize
180KB
MD52d1813e227193fe0d157f5bf553c1a32
SHA1a752f0e421e862177a7c099d0b0b2c0088465800
SHA25622920b46ccf2e0aff08ceb22d9319420b3578d7b3c44d79aeac089646e21822b
SHA512ba75f74dc0725eccd04bff295cee8e145fea5021a46061c05925410e50d2d2f59e14468cb6346ea18e798dab2fe4a7d7fdb002961209887c92ba0d7226f93318
-
Filesize
180KB
MD5a1532d0bde4a989568b8d80f0636247c
SHA16cf96df3c43c162155a5bab2a011623f931a2ac9
SHA2567a749f6445e8850345b06921cc75f80ec8b3fbea326515e7267ed30ad748d231
SHA51276bf713675ecbc62aa065302cee9f7e77fb22d0b32db4b672a62c15a549fa7ae33fa6075ec99a6e3d06299908b8930a6d68a4a0d1195bacded7085776b2fc26c
-
Filesize
180KB
MD559e95011e86aa30f4d35efaeb266e6f7
SHA1a37ccb5e046fc9cac5a6a0d94271e234c35f2e26
SHA2560157ad5c059cff0e38079cefdc524112923f85705c21b7958ea23cacda44e0e4
SHA512c27fbc679b41f36f78722143a02ef0cfe5ecab6b5fc0dc28a75cffa1a8414bb0ee38fe87ab0e71eafd279b78ed72307aee4ca058792804afefb94fccbf31fc2d
-
Filesize
180KB
MD5bd157b9f0f30ebd84e49a003a63f78b4
SHA1ccd7109424dd4d12b225a3db4d357a7e290f6a48
SHA2564914ad0e1100996909540f34bc3cf168e589013a88060a926b747773fa3c174d
SHA512e761091fdb21fbebdda64e8c0f2aff0ff1e9c30a21a76ebb5fa1830aec46659bc82a2796dd764cc4202be206765fdaa6b60c48e3a00beaaff5ab778bb9f1d4eb
-
Filesize
180KB
MD57b1069e47032bee4b1d36ab26f80448e
SHA1e30125a7aebc5132bed2ceb175a4b4b827d67e15
SHA25631934394201a8f4b54c5fa9d5fbecd89a87fec977b7d23d3038060a71e5bdc71
SHA51208fab306a2c0b553bda735f4c5200cb3d48d22998174668dedb2d95f67f454b69ed5df63753ccad5d80a215cbb246b68ae3344195c4cc73e8b7080662a441911
-
Filesize
180KB
MD5c14f41d514c57c8fd3730209d4137d03
SHA14780203c45e262497e0d61fe97893ff07457c5f0
SHA256c7bdf41a920119533e529ce5ee9726e920ca9114f66fffa32dc479b0c54d5e3b
SHA5124d417251879a03e68e9cb517264b569efaf92f3018fe9235109493b6a1fdec7661a3ab50854bf9c259a1343041f640e4347994eee71fef8ecbf4525461de588d
-
Filesize
180KB
MD50c18a047f5d99124b581ddfb844247e0
SHA122e31c084201c38fd3f8ad8b66ffd6b1a8dfcdcd
SHA25607593b58e76e175a9a95a5883c7da499c19152b8b46490878a90161c176527ab
SHA512bb13b3eb8115944d6be1d4fad181045025a0239c9263a6c09a1b3a81970095ebf3898b7fd95c47c10ba7725a75c20f28551471dcd5a0a3d42f9eeb5c7a82a019
-
Filesize
180KB
MD561fdc7bb012ed48763e4e130aaa01c58
SHA13675f08954760938f85f82b27a2f4b3afc79f2b9
SHA2566e12b32e52e39c40f82cc301bfe3da25d939a2266f8a170372783e1e552d75cb
SHA5121d8cd7709549625b43a4960b346b1992b30a4cfbe4cb085a864333e40789bd6959bea698766d9f2057d7e0a6c82732fd85682f14b60fa34e4e9d9341eddcc10a