Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
-
Size
180KB
-
MD5
325ad5cab02211ba043f6a1ec096bc26
-
SHA1
50d54c83f2a838652bef7e12981a8576527d2113
-
SHA256
c7f7a7ddc0c84f60366206b41c11ec34c73094fc8718a3c358dadec33ba5a837
-
SHA512
e08b85acb7fcf1845d5b2194db1591c3ebf1c98fad8c174fa7e86807407a382dc8a876fe990eff7e35d762e6e69ab71d1c5604d0402934339a2678fddc816ab1
-
SSDEEP
3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGVl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0008000000023255-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001100000002325f-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023265-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001200000002325f-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023265-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000016fa5-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219ea-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070f-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000026-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000507-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2F071F2-B353-4cb0-8036-9CF52260162D}\stubpath = "C:\\Windows\\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe" {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}\stubpath = "C:\\Windows\\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe" {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0} {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{525E4A82-DC86-4c4a-8F00-F99791820440}\stubpath = "C:\\Windows\\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe" {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{409E57DE-3362-4722-B0D7-8AC9FBD91320}\stubpath = "C:\\Windows\\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe" {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22733B27-4FDD-4f97-B060-FDB7D27811E5} {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22733B27-4FDD-4f97-B060-FDB7D27811E5}\stubpath = "C:\\Windows\\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe" {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2F071F2-B353-4cb0-8036-9CF52260162D} {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}\stubpath = "C:\\Windows\\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe" {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1} {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C33332C-36DE-4e23-8B20-F5569518FE02} {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B15B89B-748F-4bfa-97A0-220B326DD01F}\stubpath = "C:\\Windows\\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe" {525E4A82-DC86-4c4a-8F00-F99791820440}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3305248C-2B82-4839-AA3D-9B68836D751F}\stubpath = "C:\\Windows\\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe" {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C545106-F38C-4d32-96B1-2235E4953089}\stubpath = "C:\\Windows\\{0C545106-F38C-4d32-96B1-2235E4953089}.exe" {3305248C-2B82-4839-AA3D-9B68836D751F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}\stubpath = "C:\\Windows\\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe" 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C33332C-36DE-4e23-8B20-F5569518FE02}\stubpath = "C:\\Windows\\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe" {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}\stubpath = "C:\\Windows\\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe" {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B15B89B-748F-4bfa-97A0-220B326DD01F} {525E4A82-DC86-4c4a-8F00-F99791820440}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3305248C-2B82-4839-AA3D-9B68836D751F} {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C545106-F38C-4d32-96B1-2235E4953089} {3305248C-2B82-4839-AA3D-9B68836D751F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC} 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7} {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{525E4A82-DC86-4c4a-8F00-F99791820440} {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{409E57DE-3362-4722-B0D7-8AC9FBD91320} {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe -
Executes dropped EXE 12 IoCs
pid Process 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 3152 {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe 4452 {3305248C-2B82-4839-AA3D-9B68836D751F}.exe 4856 {0C545106-F38C-4d32-96B1-2235E4953089}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe File created C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe {525E4A82-DC86-4c4a-8F00-F99791820440}.exe File created C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe File created C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe File created C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe File created C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe File created C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe File created C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe File created C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe File created C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe File created C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe {3305248C-2B82-4839-AA3D-9B68836D751F}.exe File created C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Token: SeIncBasePriorityPrivilege 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe Token: SeIncBasePriorityPrivilege 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe Token: SeIncBasePriorityPrivilege 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe Token: SeIncBasePriorityPrivilege 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe Token: SeIncBasePriorityPrivilege 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe Token: SeIncBasePriorityPrivilege 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe Token: SeIncBasePriorityPrivilege 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe Token: SeIncBasePriorityPrivilege 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe Token: SeIncBasePriorityPrivilege 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe Token: SeIncBasePriorityPrivilege 3152 {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe Token: SeIncBasePriorityPrivilege 4452 {3305248C-2B82-4839-AA3D-9B68836D751F}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 3852 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 96 PID 2412 wrote to memory of 3852 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 96 PID 2412 wrote to memory of 3852 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 96 PID 2412 wrote to memory of 3476 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 97 PID 2412 wrote to memory of 3476 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 97 PID 2412 wrote to memory of 3476 2412 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 97 PID 3852 wrote to memory of 2344 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 101 PID 3852 wrote to memory of 2344 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 101 PID 3852 wrote to memory of 2344 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 101 PID 3852 wrote to memory of 4208 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 102 PID 3852 wrote to memory of 4208 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 102 PID 3852 wrote to memory of 4208 3852 {D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe 102 PID 2344 wrote to memory of 3948 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 104 PID 2344 wrote to memory of 3948 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 104 PID 2344 wrote to memory of 3948 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 104 PID 2344 wrote to memory of 3624 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 105 PID 2344 wrote to memory of 3624 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 105 PID 2344 wrote to memory of 3624 2344 {B2F071F2-B353-4cb0-8036-9CF52260162D}.exe 105 PID 3948 wrote to memory of 400 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 107 PID 3948 wrote to memory of 400 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 107 PID 3948 wrote to memory of 400 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 107 PID 3948 wrote to memory of 4620 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 108 PID 3948 wrote to memory of 4620 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 108 PID 3948 wrote to memory of 4620 3948 {470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe 108 PID 400 wrote to memory of 1536 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 109 PID 400 wrote to memory of 1536 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 109 PID 400 wrote to memory of 1536 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 109 PID 400 wrote to memory of 2532 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 110 PID 400 wrote to memory of 2532 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 110 PID 400 wrote to memory of 2532 400 {94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe 110 PID 1536 wrote to memory of 2664 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 111 PID 1536 wrote to memory of 2664 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 111 PID 1536 wrote to memory of 2664 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 111 PID 1536 wrote to memory of 2332 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 112 PID 1536 wrote to memory of 2332 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 112 PID 1536 wrote to memory of 2332 1536 {6C33332C-36DE-4e23-8B20-F5569518FE02}.exe 112 PID 2664 wrote to memory of 4308 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 113 PID 2664 wrote to memory of 4308 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 113 PID 2664 wrote to memory of 4308 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 113 PID 2664 wrote to memory of 1588 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 114 PID 2664 wrote to memory of 1588 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 114 PID 2664 wrote to memory of 1588 2664 {CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe 114 PID 4308 wrote to memory of 3388 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 115 PID 4308 wrote to memory of 3388 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 115 PID 4308 wrote to memory of 3388 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 115 PID 4308 wrote to memory of 3220 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 116 PID 4308 wrote to memory of 3220 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 116 PID 4308 wrote to memory of 3220 4308 {525E4A82-DC86-4c4a-8F00-F99791820440}.exe 116 PID 3388 wrote to memory of 5072 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 117 PID 3388 wrote to memory of 5072 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 117 PID 3388 wrote to memory of 5072 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 117 PID 3388 wrote to memory of 5028 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 118 PID 3388 wrote to memory of 5028 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 118 PID 3388 wrote to memory of 5028 3388 {9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe 118 PID 5072 wrote to memory of 3152 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 119 PID 5072 wrote to memory of 3152 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 119 PID 5072 wrote to memory of 3152 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 119 PID 5072 wrote to memory of 3232 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 120 PID 5072 wrote to memory of 3232 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 120 PID 5072 wrote to memory of 3232 5072 {409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe 120 PID 3152 wrote to memory of 4452 3152 {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe 121 PID 3152 wrote to memory of 4452 3152 {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe 121 PID 3152 wrote to memory of 4452 3152 {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe 121 PID 3152 wrote to memory of 4432 3152 {22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exeC:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exeC:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exeC:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exeC:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exeC:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exeC:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exeC:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exeC:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exeC:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exeC:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exeC:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4452 -
C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exeC:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe13⤵
- Executes dropped EXE
PID:4856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33052~1.EXE > nul13⤵PID:4144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22733~1.EXE > nul12⤵PID:4432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{409E5~1.EXE > nul11⤵PID:3232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B15B~1.EXE > nul10⤵PID:5028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{525E4~1.EXE > nul9⤵PID:3220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE8B3~1.EXE > nul8⤵PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C333~1.EXE > nul7⤵PID:2332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94A22~1.EXE > nul6⤵PID:2532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47022~1.EXE > nul5⤵PID:4620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2F07~1.EXE > nul4⤵PID:3624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4AF0~1.EXE > nul3⤵PID:4208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:2348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD539a9888ea7d625351497b110200d40e8
SHA10e2f3d444068688fe524cb5c69844c6c53f77111
SHA256f93e5de1c85a56411f6209bbd91bfb8d9183574f29d7d3e559f73334b24d40f2
SHA512def6c49abb95e7992878fc12f3e8f27cc9c5d0f9088d6ff0c1a712abfd2e0f36428ee7588510870ff987e5fc6d2274dc322cd6c1eae51b1f35a1087eaee5fcb8
-
Filesize
180KB
MD5533ec6109a92dd2d9d91b38ea66227ea
SHA162209b8b1c91ab314587e9403a6dc0c479e92b1a
SHA2567c6ff16c422d84c9b96b230dfee10ad096f69ed4ebcaba19abffc2816e3f12b0
SHA512b9a7f71d56fa91ec602876091bef58b965f22fb6b95b33652a24ec8492cf01557a835de3e46688333eec87b8233871243526d372083a8cf6c824f3c0c2d3304e
-
Filesize
180KB
MD5ac7041106f3e65c4dac328b123946e50
SHA19111cc017ce177aab4381771cdfbc84cef73a3c3
SHA256c6999e3c429ddc27b5dc4eb6df4acc37c461d840291469968c4ebb73501ec5ec
SHA512f17bf7a3ff9af22c6c095b58ecf27bfb42fbe2afb2b1bf4d0a266a01c7a7acedf7270776fbbbd2e07c21aa0cb2c8a969a1b78080f9074797c6d0868b03cf2486
-
Filesize
180KB
MD577ca970601bbaa9a23b6f49411cae72e
SHA1ac2c7003e0fd8ec0f3de252dd3e30bdc9c766aba
SHA256efc7b7651b38827bd8d25c39b874566ed54a60e0668bd5f1f93a2e3d55c0883e
SHA51259221c24ad1af6cd155e1abb51d7ddf943606b55d2843507cafeb4d1ae1cf8e91f9d5c955877d05f3c484f94783cc4f7a82fc25e3b775ac4d696d46e4b7f08dc
-
Filesize
180KB
MD5352400cf5b738b7c46c4f9851e29a703
SHA1379712375f6c3f7466c5d16b4f5d89d20af4ec44
SHA25680342f731754278549fc7e3df27d10217d0a7fed380f7f437f88544f7300cefb
SHA51202a90f07568afb3b6cbfbd1366f04c65983765c9515ec2c431577a11005fe9210a265433bb303efab30af95b8f31e54bedff37e9f5613449f176500b84bda751
-
Filesize
180KB
MD500d6ccb49e70a325959de7faffa4e58c
SHA151ef40ff84eeff7c5edfffddb9c4de211c060e72
SHA2568b280e16d40d32ca947fa5fed9e8a3a60dff4e0431f780840625ff03c30b6118
SHA512cbc9300b9b5622e5070f5ff689f5bc6f57b4bc81ba489e10d820760d46fdd20b2ce18cf8ceb547957853e77efca5eb81a0268783ba43a68955d6b7cf028ff340
-
Filesize
180KB
MD59ee774934793940ba560f56dad0a0073
SHA11c72d67e6a1462a4e638a538159f06dcb3b1cc2f
SHA2563adc267eb7eed91b15c39897367462f339152789d5aa76db53abc9359d07ed4e
SHA51262098afd8c564a0aca13bb26bcd2155f4ced133f19318cdd9aae9af77385bd944196bbaecefe0c61ad202eeb07464093cd6033243b67637498e69b4f24fab3ea
-
Filesize
180KB
MD5ac69ba365bd7c3308cb049fac93562b0
SHA153d6e416f87aa08f9879f8538ac2d012a50af139
SHA2561372f1552ee95cc4c35947e3233f33bf8a5128babf5da2c1f63dc1f68a0f7fda
SHA5122f7c7c1bf3eb9c60c09319f81aa0d888f529266841f24169c9dba60ad1b3fba03af0af2f1bf0c52c18ebf8bed1733c23a3701246b833f4ea2041888806e575b0
-
Filesize
180KB
MD551f51449cc769d19208f15fb8bcaf34b
SHA1d7c39a77c25c90c01cf3de0ec383fbc3ba5b5ce5
SHA256e64f6290e726a2db87dcec2900aef3f059111a39fbb95015009e1d6a4030ddb7
SHA5122d2b72c1ee9c70ddc9f6101c194547e1eb2cd7247680573c906ae45143fcb930fa81515f01d2b1ccdeb2182bdd522db0f48da847f9505f349b78068fb1e8e8a5
-
Filesize
180KB
MD50a60aad11dcebb8bfa23633702a7d79a
SHA1b360644da327803302daca4ebca48a324c895f3b
SHA256ef342ab0e5fc33e47aeac3f00a8da0361931d335dea42e285db9eb6b0fc678e1
SHA512a34b09862e9aee15afaefff013283000070ce0acb105099d5d7488fee0e8777572698b3054d959828b0ef9589e193c12848601a8ec982dbcd2093664bacddbbb
-
Filesize
180KB
MD564ac67fe88ab4a59eacfeb51b96e3a3f
SHA163025829d17117a39af6d8a26b501a40fcbae654
SHA256e3eb660d740b5c93b5de0a53fa48fa5f02d2a80e8be98cd4b7db5f5dae6ab0c1
SHA512f706aa56bc5838710c87ecac48c8d8799d3db2eff5947555e8eea01e33bf7a31ffc47152afdafcd7e3886403a5fc99d4c2f9555b355722dbf3c95ac24332aa39
-
Filesize
180KB
MD5479908d6f9e12826ed4e4577705da4bc
SHA162db8706e355428c95b6166f9ef8e5b2e77c6715
SHA256818b7691ace8f1e3f6c83e54fd9d089ee82c90cf4ab1653643eec92d02e61278
SHA512f453efb7d5ff7a8d0fb00ed7d2020a68e9a795234707c03462bb22fd233ec4a5a40f737a840104f3d615d7ad24bc13f36b0f42be785d74a66243ab1205482376