Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 03:24
Static task
static1
Behavioral task
behavioral1
Sample
d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Resource
win10v2004-20240508-en
General
-
Target
d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
-
Size
89KB
-
MD5
aebec3905f0fa3bc8afb2f87f9b15343
-
SHA1
1533300e1dae46ad7881492ee0f6074dc4abf53e
-
SHA256
d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be
-
SHA512
de4e384ece0973d0b77f44d5abd48aee04208716e0497529ba38c397c439b38642616f919857242088c7a672728ddf1525deb658bcf5a9db10df11745f01aba2
-
SSDEEP
768:Qvw9816vhKQLro2L4/wQRNrfrunMxVFA3b7gl5:YEGh0o2Ll2unMxVS3HgX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}\stubpath = "C:\\Windows\\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe" {3DCCD137-670F-4150-8917-074012D1B50B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7} {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}\stubpath = "C:\\Windows\\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe" {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCC766BB-E33C-4577-AC8A-477A854E6671} {D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3DCCD137-670F-4150-8917-074012D1B50B} {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3DCCD137-670F-4150-8917-074012D1B50B}\stubpath = "C:\\Windows\\{3DCCD137-670F-4150-8917-074012D1B50B}.exe" {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}\stubpath = "C:\\Windows\\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe" {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE3F7027-7318-434a-A6E6-EFB2481AAC89} {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}\stubpath = "C:\\Windows\\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe" {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D99A6E4D-A602-4d0e-8792-2FC66837D77A} {EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCC766BB-E33C-4577-AC8A-477A854E6671}\stubpath = "C:\\Windows\\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe" {D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A009F78-435B-465a-B107-5419A7A158D9}\stubpath = "C:\\Windows\\{6A009F78-435B-465a-B107-5419A7A158D9}.exe" {CCC766BB-E33C-4577-AC8A-477A854E6671}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}\stubpath = "C:\\Windows\\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe" d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8} {3DCCD137-670F-4150-8917-074012D1B50B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051} {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}\stubpath = "C:\\Windows\\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe" {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F86C155B-4023-415c-8958-9A14DBAB21A0}\stubpath = "C:\\Windows\\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe" {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}\stubpath = "C:\\Windows\\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe" {EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66} d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F86C155B-4023-415c-8958-9A14DBAB21A0} {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A009F78-435B-465a-B107-5419A7A158D9} {CCC766BB-E33C-4577-AC8A-477A854E6671}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835} {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe -
Deletes itself 1 IoCs
pid Process 1620 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 1760 {EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe 2116 {D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe 2916 {CCC766BB-E33C-4577-AC8A-477A854E6671}.exe 1296 {6A009F78-435B-465a-B107-5419A7A158D9}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe File created C:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe {D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe File created C:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe File created C:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe {3DCCD137-670F-4150-8917-074012D1B50B}.exe File created C:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe File created C:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe File created C:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe File created C:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe File created C:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe {EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe File created C:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exe {CCC766BB-E33C-4577-AC8A-477A854E6671}.exe File created C:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exe {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe Token: SeIncBasePriorityPrivilege 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe Token: SeIncBasePriorityPrivilege 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe Token: SeIncBasePriorityPrivilege 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe Token: SeIncBasePriorityPrivilege 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe Token: SeIncBasePriorityPrivilege 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe Token: SeIncBasePriorityPrivilege 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe Token: SeIncBasePriorityPrivilege 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe Token: SeIncBasePriorityPrivilege 1760 {EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe Token: SeIncBasePriorityPrivilege 2116 {D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe Token: SeIncBasePriorityPrivilege 2916 {CCC766BB-E33C-4577-AC8A-477A854E6671}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 1380 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 28 PID 1276 wrote to memory of 1380 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 28 PID 1276 wrote to memory of 1380 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 28 PID 1276 wrote to memory of 1380 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 28 PID 1276 wrote to memory of 1620 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 29 PID 1276 wrote to memory of 1620 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 29 PID 1276 wrote to memory of 1620 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 29 PID 1276 wrote to memory of 1620 1276 d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe 29 PID 1380 wrote to memory of 2664 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 30 PID 1380 wrote to memory of 2664 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 30 PID 1380 wrote to memory of 2664 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 30 PID 1380 wrote to memory of 2664 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 30 PID 1380 wrote to memory of 2060 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 31 PID 1380 wrote to memory of 2060 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 31 PID 1380 wrote to memory of 2060 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 31 PID 1380 wrote to memory of 2060 1380 {B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe 31 PID 2664 wrote to memory of 2540 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 32 PID 2664 wrote to memory of 2540 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 32 PID 2664 wrote to memory of 2540 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 32 PID 2664 wrote to memory of 2540 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 32 PID 2664 wrote to memory of 2432 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 33 PID 2664 wrote to memory of 2432 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 33 PID 2664 wrote to memory of 2432 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 33 PID 2664 wrote to memory of 2432 2664 {3DCCD137-670F-4150-8917-074012D1B50B}.exe 33 PID 2540 wrote to memory of 2684 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 36 PID 2540 wrote to memory of 2684 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 36 PID 2540 wrote to memory of 2684 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 36 PID 2540 wrote to memory of 2684 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 36 PID 2540 wrote to memory of 1900 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 37 PID 2540 wrote to memory of 1900 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 37 PID 2540 wrote to memory of 1900 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 37 PID 2540 wrote to memory of 1900 2540 {4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe 37 PID 2684 wrote to memory of 2836 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 38 PID 2684 wrote to memory of 2836 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 38 PID 2684 wrote to memory of 2836 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 38 PID 2684 wrote to memory of 2836 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 38 PID 2684 wrote to memory of 2600 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 39 PID 2684 wrote to memory of 2600 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 39 PID 2684 wrote to memory of 2600 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 39 PID 2684 wrote to memory of 2600 2684 {59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe 39 PID 2836 wrote to memory of 2212 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 40 PID 2836 wrote to memory of 2212 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 40 PID 2836 wrote to memory of 2212 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 40 PID 2836 wrote to memory of 2212 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 40 PID 2836 wrote to memory of 1996 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 41 PID 2836 wrote to memory of 1996 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 41 PID 2836 wrote to memory of 1996 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 41 PID 2836 wrote to memory of 1996 2836 {9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe 41 PID 2212 wrote to memory of 2024 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 42 PID 2212 wrote to memory of 2024 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 42 PID 2212 wrote to memory of 2024 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 42 PID 2212 wrote to memory of 2024 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 42 PID 2212 wrote to memory of 2164 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 43 PID 2212 wrote to memory of 2164 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 43 PID 2212 wrote to memory of 2164 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 43 PID 2212 wrote to memory of 2164 2212 {6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe 43 PID 2024 wrote to memory of 1760 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 44 PID 2024 wrote to memory of 1760 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 44 PID 2024 wrote to memory of 1760 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 44 PID 2024 wrote to memory of 1760 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 44 PID 2024 wrote to memory of 1148 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 45 PID 2024 wrote to memory of 1148 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 45 PID 2024 wrote to memory of 1148 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 45 PID 2024 wrote to memory of 1148 2024 {F86C155B-4023-415c-8958-9A14DBAB21A0}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe"C:\Users\Admin\AppData\Local\Temp\d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exeC:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exeC:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exeC:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exeC:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exeC:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exeC:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exeC:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exeC:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exeC:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exeC:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exeC:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exe12⤵
- Executes dropped EXE
PID:1296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCC76~1.EXE > nul12⤵PID:580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D99A6~1.EXE > nul11⤵PID:916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE3F7~1.EXE > nul10⤵PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F86C1~1.EXE > nul9⤵PID:1148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A9AB~1.EXE > nul8⤵PID:2164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D80E~1.EXE > nul7⤵PID:1996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59B3F~1.EXE > nul6⤵PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E305~1.EXE > nul5⤵PID:1900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DCCD~1.EXE > nul4⤵PID:2432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8F70~1.EXE > nul3⤵PID:2060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D9AFD0~1.EXE > nul2⤵
- Deletes itself
PID:1620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5aac8adcf4bbf99c869007b3d233fd160
SHA14bc09706a376f7e8bf9f7d42f233ca153698f97c
SHA2560153c48dcfc7bd0cae5b37a3bc021f29f59656d863a350a73dc3a98a061718e4
SHA51274d429e1075e87f219b844bab6856b1a383bbbaf26d59d727eea39b182f4c6c0703909e44814603abad7c47bfcf61b8ddacd976f3cb99c2a734f961066ed832c
-
Filesize
89KB
MD51cf4e2c41260a369c213f410597374e2
SHA1d0d9fb12b6e61280fb86dd3a27abd8422f60982f
SHA25624db87829fd7fa241a660e140d057a262531974cf6c8c3061d471cf10d1844b3
SHA51245d8faf9a45751eb2f730d078f5040145d1697ac916c201e0c364fa6737fe7e5d1159ebe11655da56413488a65f3f37b9c7e01429c2d596f2c6ba83d011b3d5b
-
Filesize
89KB
MD57497c4f84e05ca7b7e7c20ee089a830b
SHA1a4574c97e6dde57b4b08c87b07ba63f34a88d320
SHA2564ec7698d8bd04b9c487633846f93db91e98e128b0db585338adc33fb1aa77208
SHA51208c5046e7463ce93f0f6f7ae69f220c87648ec1029e003df942aa1fc51ba3f6c1fc88c2bb5ca5e67335f89fdeac04feaefd905f57631b454244b9bfb43820794
-
Filesize
89KB
MD54c50f4bbf5de7a9286819ade69866474
SHA148eb1398883dd69de76349880f97651c3e9dcffa
SHA256443fc166803444dce31122c7e6c6ebcafb3e66c55e4569a4ae701875259f2e9b
SHA512dbaa7b9f5a500c76ce444115d984dbe9a7d3cd1be7a2708a89ee7c51efa445b0a6bf6631d68f3aae32ac66dc7aa20c5171cb4a2f238d9fc17f6efdc538195489
-
Filesize
89KB
MD5b0376d673cc2f0caddb922272f5aadce
SHA18734b5ffdffc950bcc589e0f4eca650b30d3de4a
SHA256b1b4b1d969e253827a9be45d7d93b04acb4b7fd613eb09e98cd2f1a17028295b
SHA512acb43103bdf848a0d7b799c018b157aa6584bdc107a514f25cea73a489ab5f55dd83a26a703afafa8e2351aca0b4b88225e1a64ef50c78b566b018b2d3cdaefc
-
Filesize
89KB
MD56d4153b73e69a5c196fa2b05bc00112c
SHA1420f2b4eb90330b41fe2b2549d56ddb4c8849e90
SHA256b2290b6e36015a1242adc9965b9a2e23176c8b5e35f9cbfdab49abe80020cac5
SHA51266b7a12c3f0eca5c1fa2a77c50aa7e695b212947ab27cfbda111f98ff66ad57d8990b4aaca67ea9483c2e3af52bd3f3e23d18616230f2c4341038b182896c634
-
Filesize
89KB
MD58bac482e58f8f376e9e04cc661a4369e
SHA1fac3a29fb63c0f9303093b48b5dbf88689ab17e0
SHA256d5c2abdab626d88358301dadff00cb285289c7f5cf0f4e0a9f71f5e0c4f1e63a
SHA51216b0f40d1ca2f9101db44cbc35ace8cfdbdec42550c828dfb299a94b816f3a551d399caf271732e4748f4bd9a4e8ce029d6f15b66a427eb1fc74d1cdcea84eb6
-
Filesize
89KB
MD5dfc8192e5e5794a0aa50c827f0328967
SHA19707679d63930d3e5e7684a7d720667de2fc311b
SHA25613d42503827ab11c01ea1a8e84a671a9c7310929826b7c24de12dcc3f3557121
SHA512e5aa0807684af50bdfe3dcd76c162d30de46292989d0a43ec362db6f13de48b5903b7e4690d901429e274881c241e3bfb1702cf8c4eef12e3dcea8ebbb11930e
-
Filesize
89KB
MD52c4ea9868d028d72fe267a818b5cc0a7
SHA12a317c26028c447376ed778d9b98a2d8ada4df19
SHA2568b5f20f1187af750b6ed4a2157a117242c15c6fc153ce1040359cc1d363ec25f
SHA512f2c939433c583e57cf1de24a7683e2a5dbe01f55ebdde5cd9bebdf98d5044c4d65f494d22d33b1f69d24728f1811289a766865a545c9a3d5934adce8577f5811
-
Filesize
89KB
MD59277e66519ce2da03f0379e90f5f1636
SHA1ff7c5c26accf2106fa10aa88e6bd4923ddf68b4f
SHA25661d60b7b3ac8633a7380353f620d35623934a00de2182ffa2b4227ac3ba492b5
SHA512713dd0d329c839672a242de69744e518685db442a4a836f5474732e0bcfc2ef82aca66c32a9803cccf3ecbe6c4e8818470ff9b867e2c62926cfdf59c72b10537
-
Filesize
89KB
MD541fe903e436827353a520e00606f4552
SHA1022d74524c23b24cb2313835797d06e23455fc4b
SHA256d7bd5179a76ca19d1424f2c3f64df3e1c45431560b2d235eecbd81129e988450
SHA5123d8b34f7859e9073e97d06feccf20912743203d965abde4b813ca5965202b838e2d331a1c2b98335c5a29df8c473264af105fd9a5b76d557790271e7a216727c