Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe
-
Size
216KB
-
MD5
9d1fe7d17517bd7369f642e839235c31
-
SHA1
781bdaa49ba7f4629cdf00251be01b2c35c4b27f
-
SHA256
0867ba00b210a2b2e44f258f9b8fb43a4fb44ca59e0fa3c0c29ebd412c2895ce
-
SHA512
85b1f3257671ed384421b9a960722dbd3217191fd1fdbb6441699e382505197ae650fe03892d47eb7992b3d7ec5673772652cf3f0e2a752b5f9ee3e33c741417
-
SSDEEP
3072:jEGh0oEl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGGlEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9709970F-0763-4eaa-9F0A-15811BF7E032}\stubpath = "C:\\Windows\\{9709970F-0763-4eaa-9F0A-15811BF7E032}.exe" 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9091E49-71EE-4767-B419-B729EF3AA3FC}\stubpath = "C:\\Windows\\{F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe" {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{74D0B809-3B68-4f8a-B629-28C2977E4AE3}\stubpath = "C:\\Windows\\{74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe" {96B6C821-F180-4255-ADB4-7BB80630E113}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80B61655-1809-4c23-AAA3-F4FB1E38FF1D}\stubpath = "C:\\Windows\\{80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe" {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D984C053-2719-4434-8170-45EE973A8406} {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B890AFB2-3D84-4dca-96AC-276E965D932C} {E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9091E49-71EE-4767-B419-B729EF3AA3FC} {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF} {D984C053-2719-4434-8170-45EE973A8406}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}\stubpath = "C:\\Windows\\{C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe" {D984C053-2719-4434-8170-45EE973A8406}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0B1F904-A4A0-4ffb-8ABE-840591F55CF6} {C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B890AFB2-3D84-4dca-96AC-276E965D932C}\stubpath = "C:\\Windows\\{B890AFB2-3D84-4dca-96AC-276E965D932C}.exe" {E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C67D4E3C-D876-43e2-A961-3A0C2F095FD1} {B890AFB2-3D84-4dca-96AC-276E965D932C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9709970F-0763-4eaa-9F0A-15811BF7E032} 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96B6C821-F180-4255-ADB4-7BB80630E113} {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80B61655-1809-4c23-AAA3-F4FB1E38FF1D} {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}\stubpath = "C:\\Windows\\{31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe" {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D984C053-2719-4434-8170-45EE973A8406}\stubpath = "C:\\Windows\\{D984C053-2719-4434-8170-45EE973A8406}.exe" {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96B6C821-F180-4255-ADB4-7BB80630E113}\stubpath = "C:\\Windows\\{96B6C821-F180-4255-ADB4-7BB80630E113}.exe" {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{74D0B809-3B68-4f8a-B629-28C2977E4AE3} {96B6C821-F180-4255-ADB4-7BB80630E113}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31C528D9-9756-4d4d-BB87-5EE33DA7ACFA} {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}\stubpath = "C:\\Windows\\{E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe" {C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C67D4E3C-D876-43e2-A961-3A0C2F095FD1}\stubpath = "C:\\Windows\\{C67D4E3C-D876-43e2-A961-3A0C2F095FD1}.exe" {B890AFB2-3D84-4dca-96AC-276E965D932C}.exe -
Deletes itself 1 IoCs
pid Process 2524 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 784 {C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe 880 {E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe 2840 {B890AFB2-3D84-4dca-96AC-276E965D932C}.exe 1052 {C67D4E3C-D876-43e2-A961-3A0C2F095FD1}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe File created C:\Windows\{80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe File created C:\Windows\{31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe File created C:\Windows\{D984C053-2719-4434-8170-45EE973A8406}.exe {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe File created C:\Windows\{C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe {D984C053-2719-4434-8170-45EE973A8406}.exe File created C:\Windows\{E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe {C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe File created C:\Windows\{9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe File created C:\Windows\{96B6C821-F180-4255-ADB4-7BB80630E113}.exe {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe File created C:\Windows\{74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe {96B6C821-F180-4255-ADB4-7BB80630E113}.exe File created C:\Windows\{B890AFB2-3D84-4dca-96AC-276E965D932C}.exe {E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe File created C:\Windows\{C67D4E3C-D876-43e2-A961-3A0C2F095FD1}.exe {B890AFB2-3D84-4dca-96AC-276E965D932C}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe Token: SeIncBasePriorityPrivilege 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe Token: SeIncBasePriorityPrivilege 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe Token: SeIncBasePriorityPrivilege 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe Token: SeIncBasePriorityPrivilege 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe Token: SeIncBasePriorityPrivilege 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe Token: SeIncBasePriorityPrivilege 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe Token: SeIncBasePriorityPrivilege 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe Token: SeIncBasePriorityPrivilege 784 {C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe Token: SeIncBasePriorityPrivilege 880 {E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe Token: SeIncBasePriorityPrivilege 2840 {B890AFB2-3D84-4dca-96AC-276E965D932C}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2992 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 28 PID 2968 wrote to memory of 2992 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 28 PID 2968 wrote to memory of 2992 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 28 PID 2968 wrote to memory of 2992 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 28 PID 2968 wrote to memory of 2524 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 29 PID 2968 wrote to memory of 2524 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 29 PID 2968 wrote to memory of 2524 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 29 PID 2968 wrote to memory of 2524 2968 2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe 29 PID 2992 wrote to memory of 2544 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 30 PID 2992 wrote to memory of 2544 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 30 PID 2992 wrote to memory of 2544 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 30 PID 2992 wrote to memory of 2544 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 30 PID 2992 wrote to memory of 2456 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 31 PID 2992 wrote to memory of 2456 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 31 PID 2992 wrote to memory of 2456 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 31 PID 2992 wrote to memory of 2456 2992 {9709970F-0763-4eaa-9F0A-15811BF7E032}.exe 31 PID 2544 wrote to memory of 2620 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 32 PID 2544 wrote to memory of 2620 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 32 PID 2544 wrote to memory of 2620 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 32 PID 2544 wrote to memory of 2620 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 32 PID 2544 wrote to memory of 2476 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 33 PID 2544 wrote to memory of 2476 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 33 PID 2544 wrote to memory of 2476 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 33 PID 2544 wrote to memory of 2476 2544 {F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe 33 PID 2620 wrote to memory of 2616 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 36 PID 2620 wrote to memory of 2616 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 36 PID 2620 wrote to memory of 2616 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 36 PID 2620 wrote to memory of 2616 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 36 PID 2620 wrote to memory of 2684 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 37 PID 2620 wrote to memory of 2684 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 37 PID 2620 wrote to memory of 2684 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 37 PID 2620 wrote to memory of 2684 2620 {96B6C821-F180-4255-ADB4-7BB80630E113}.exe 37 PID 2616 wrote to memory of 2868 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 38 PID 2616 wrote to memory of 2868 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 38 PID 2616 wrote to memory of 2868 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 38 PID 2616 wrote to memory of 2868 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 38 PID 2616 wrote to memory of 2000 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 39 PID 2616 wrote to memory of 2000 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 39 PID 2616 wrote to memory of 2000 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 39 PID 2616 wrote to memory of 2000 2616 {74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe 39 PID 2868 wrote to memory of 2012 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 40 PID 2868 wrote to memory of 2012 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 40 PID 2868 wrote to memory of 2012 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 40 PID 2868 wrote to memory of 2012 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 40 PID 2868 wrote to memory of 404 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 41 PID 2868 wrote to memory of 404 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 41 PID 2868 wrote to memory of 404 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 41 PID 2868 wrote to memory of 404 2868 {80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe 41 PID 2012 wrote to memory of 1356 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 42 PID 2012 wrote to memory of 1356 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 42 PID 2012 wrote to memory of 1356 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 42 PID 2012 wrote to memory of 1356 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 42 PID 2012 wrote to memory of 1204 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 43 PID 2012 wrote to memory of 1204 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 43 PID 2012 wrote to memory of 1204 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 43 PID 2012 wrote to memory of 1204 2012 {31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe 43 PID 1356 wrote to memory of 784 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 44 PID 1356 wrote to memory of 784 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 44 PID 1356 wrote to memory of 784 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 44 PID 1356 wrote to memory of 784 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 44 PID 1356 wrote to memory of 332 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 45 PID 1356 wrote to memory of 332 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 45 PID 1356 wrote to memory of 332 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 45 PID 1356 wrote to memory of 332 1356 {D984C053-2719-4434-8170-45EE973A8406}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_9d1fe7d17517bd7369f642e839235c31_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\{9709970F-0763-4eaa-9F0A-15811BF7E032}.exeC:\Windows\{9709970F-0763-4eaa-9F0A-15811BF7E032}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\{F9091E49-71EE-4767-B419-B729EF3AA3FC}.exeC:\Windows\{F9091E49-71EE-4767-B419-B729EF3AA3FC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\{96B6C821-F180-4255-ADB4-7BB80630E113}.exeC:\Windows\{96B6C821-F180-4255-ADB4-7BB80630E113}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\{74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exeC:\Windows\{74D0B809-3B68-4f8a-B629-28C2977E4AE3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\{80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exeC:\Windows\{80B61655-1809-4c23-AAA3-F4FB1E38FF1D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\{31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exeC:\Windows\{31C528D9-9756-4d4d-BB87-5EE33DA7ACFA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\{D984C053-2719-4434-8170-45EE973A8406}.exeC:\Windows\{D984C053-2719-4434-8170-45EE973A8406}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\{C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exeC:\Windows\{C2928AA2-6178-4ef5-B5B7-F3AAF3DC1AEF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:784 -
C:\Windows\{E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exeC:\Windows\{E0B1F904-A4A0-4ffb-8ABE-840591F55CF6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:880 -
C:\Windows\{B890AFB2-3D84-4dca-96AC-276E965D932C}.exeC:\Windows\{B890AFB2-3D84-4dca-96AC-276E965D932C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Windows\{C67D4E3C-D876-43e2-A961-3A0C2F095FD1}.exeC:\Windows\{C67D4E3C-D876-43e2-A961-3A0C2F095FD1}.exe12⤵
- Executes dropped EXE
PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B890A~1.EXE > nul12⤵PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0B1F~1.EXE > nul11⤵PID:692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2928~1.EXE > nul10⤵PID:1748
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D984C~1.EXE > nul9⤵PID:332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31C52~1.EXE > nul8⤵PID:1204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80B61~1.EXE > nul7⤵PID:404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74D0B~1.EXE > nul6⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96B6C~1.EXE > nul5⤵PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9091~1.EXE > nul4⤵PID:2476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97099~1.EXE > nul3⤵PID:2456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5dab1f1ed9d10bc6e06c86635ceeab19e
SHA1804186ff793fea7ae7f2bc054b4d1c8d5e7a6a7f
SHA256769e68255b37dd9725b53577d6ca54f63d1d6df5a21839580a47463278351a2e
SHA512af94a36d6ac9061b01f830f539157e3abcd2124edf1426d1b06d7f7b34a661c9644c3db5f935c0b7c77c255a7059ecca57a4028900d46c6572056c52eaba5991
-
Filesize
216KB
MD559484f8b03e6481bc80eafaedc604542
SHA15c2e1d906d37f08f58f88e831e0fa4f02a160a1b
SHA256d4953737d28b14a35f5db73e0e5994b9b151a68ba5a437cb46a59bc656655c1b
SHA5126556f1d05979378647e759f8ee52e5fff8829055a52f8e1b80a0f13785a91aa4df9436292babcaa7fe3ffbdd5de878b5a22c67f93e18ac1f9f25430e4cc990f3
-
Filesize
216KB
MD5beea6fdea837b4d916e1555ec9290dec
SHA1c543a51a2b4f1176f4e97a12367aae00fd35514e
SHA256417d4f6f41fe39c226cefbd413c4e14fc8333b0f973a142c2192053589da9e7a
SHA512a44b3090f91920baaae9001dc3ba6e7ebacf1f6e166c68fe8e85523f7b5353150495f4d763c0e684bf93c0162714f902e34e09cbd6e4077c84837b9df8891fcc
-
Filesize
216KB
MD59ee899d66f10397a668dbd7727e2f1ac
SHA1ecebbdbe82ba38c2d8343691d4c1f220fa2127c9
SHA256bd3dbe98635eaabc1b286e43ab1ad1d5fbe3ed8bd8c1a02bd979e55e1ea7f800
SHA512ac5e9931a85003a041f4d38b9929dd8d9fb8f6af9fe6986bca50c9e5e148efad2a46558e72378bb8d8af188b99c46dfc22080d6dd1ba17c1fa579eb2783b4a35
-
Filesize
216KB
MD5f0ea60e5f17f73211a48b52052c18966
SHA10d31740ab3670171e24b0717b0e2fb5c27913e5e
SHA2564cfe950da9962e9f99545131ef9e299ca09adf4dcc8f756315e49fbb104a0f6e
SHA512a4a003b704934a5aa5a2b67889afbbe9c7aab1f34eab3e72d1da7d16e84c4ac6d7f471dfbd49edb544bbb44abe74c1401f7309aaf858bd634ea3a2e13895c484
-
Filesize
216KB
MD5989eeada5c6a07dff04b240cf6685ab7
SHA175a653fbbb3dcacaeb00d06dc6029b19289e02bb
SHA256c5aeab6c576b1ae63c37d132daa27f6824d5e4a94837fcdb11a2503fbf083e99
SHA5129bd931098dd8ac0fc1f12379e5b9a716f99e823a4d35c4de926f6c9dcf759df9b871f5bae0681456bf40baca5e9069162c529ba80d7db7e172a53dca635619c2
-
Filesize
216KB
MD5e64e25d442aa9df4b557e131ccf13008
SHA13ddd20e47e39f42a1671a10d2bbf7e57a42d7ed5
SHA2566abf1c1d5c8bde0a4edf1c360cbea4a38e21803efffafc3d5e004b4672f42609
SHA512036ef1192bc56fc0a7b4935cb1e41fa13cd0e0dfdd98a80264ca245f7f65b03db9162033a0a4405d1cc44f8feff6e4f349612676201e0d2c163fe06bf630e9b2
-
Filesize
216KB
MD53b66114fa10218b74c8fdb40e1009a10
SHA1145de4d59f439490f654c61965832137ebb228ec
SHA2565d049abe538516f5c92a15869d94bee887d861c500268e919c50e20bd314bd62
SHA5123674cbe59a1f82b25b33995545304992c5646b888d806e9ae06f0a86980f5be70d5cf7c732cdc15f6bb627748a106ac78c4effbd4e5d2e454b167f648a72533b
-
Filesize
216KB
MD55f086fe6e95db3a4a9db036a2ff05b3a
SHA115bc3de58763e5a76876923a43ec7d3f619363d7
SHA2568cf03e9781dd402fa2907d40d7aaa40dfd478e08baed2193bc8353b20e481a42
SHA5128749e12bff55c117af1a76c75de75965d1f450a64b1947477f180c3574d832ccfe8b388fab9e812b5050f38d166f3e4fe82d9b0ec6a04aeb479daac788d84789
-
Filesize
216KB
MD5ff2171991492bcf05db4ccad0a4e7230
SHA1490c7a135d6c85d07a92c0f6df5edaa71879fc48
SHA256cbaaeddb2299bef69155710770cb54ec86a1b3aefb76c4e79819110c74b3d4ad
SHA512f0b2b3f7b42422d037c2fc5e56fd57e3f0a1684875898c3404288b43f4d7626823dad32c42a273aa385cd750938c4b0a910eb1dc325eb2c6fc9d8698af6135e6
-
Filesize
216KB
MD504847ce40e9689f68e6800b1dc36930a
SHA10b74bac44ea4ea721458f450e72e68d3daf8947f
SHA2563aff84ab3bc63b716984e80dbc7ca8982ec2fba0e1f4a60fe8bd9851eee622d2
SHA51292a63d09c73e51a71725280bc307aa45faa09e63c1b3aee51b35fa3b0b28aaccb1eba852f0b14a154d92e35fd503b17747762024719fc918df08d95a025161c0