Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
Resource
win10v2004-20240508-en
General
-
Target
58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
-
Size
90KB
-
MD5
4511d44ebb6011fcd1159a1a297b4f39
-
SHA1
85375dc2a261eaa559f21a7a8be48f29d166328c
-
SHA256
58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b
-
SHA512
a71ae08abd9db210126059abf558fe6c7a143496d510be1abf9db92a12d6ea8aa7d3166dba14db9ef3ea5c87181275901ecc7611dba2ac4f03ff619fee69c6c1
-
SSDEEP
768:Qvw9816vhKQLroR4/wQRNrfrunMxVFA3b7glw6:YEGh0oRl2unMxVS3Hgl
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF844EE7-70C8-42be-8546-018D5904AA7C}\stubpath = "C:\\Windows\\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe" 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2533F393-E2E3-43b2-9079-C3A6416935F4} {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95E6A248-7D9F-4587-80EA-E4B4309D3345} {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95E6A248-7D9F-4587-80EA-E4B4309D3345}\stubpath = "C:\\Windows\\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe" {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}\stubpath = "C:\\Windows\\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe" {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3} {975DD46B-63BB-4235-9920-11A61344DAA4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4} {D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{975DD46B-63BB-4235-9920-11A61344DAA4} {12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}\stubpath = "C:\\Windows\\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe" {975DD46B-63BB-4235-9920-11A61344DAA4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}\stubpath = "C:\\Windows\\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe" {D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF844EE7-70C8-42be-8546-018D5904AA7C} 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2533F393-E2E3-43b2-9079-C3A6416935F4}\stubpath = "C:\\Windows\\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe" {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BA920A8-BB67-4e44-8187-E7C1336A8403} {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BA920A8-BB67-4e44-8187-E7C1336A8403}\stubpath = "C:\\Windows\\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe" {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE17A831-9232-466f-A45F-B151A3E1F7C2} {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE17A831-9232-466f-A45F-B151A3E1F7C2}\stubpath = "C:\\Windows\\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe" {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127} {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}\stubpath = "C:\\Windows\\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe" {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{975DD46B-63BB-4235-9920-11A61344DAA4}\stubpath = "C:\\Windows\\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe" {12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4} {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F0914C-084F-4ef4-BB1D-3090EB1F5082} {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}\stubpath = "C:\\Windows\\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe" {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe -
Deletes itself 1 IoCs
pid Process 2060 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 1648 {12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe 2968 {975DD46B-63BB-4235-9920-11A61344DAA4}.exe 2884 {D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe 796 {E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe File created C:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe File created C:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe File created C:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe File created C:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe File created C:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe {12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe File created C:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe File created C:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe File created C:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe File created C:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe {975DD46B-63BB-4235-9920-11A61344DAA4}.exe File created C:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe {D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe Token: SeIncBasePriorityPrivilege 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe Token: SeIncBasePriorityPrivilege 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe Token: SeIncBasePriorityPrivilege 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe Token: SeIncBasePriorityPrivilege 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe Token: SeIncBasePriorityPrivilege 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe Token: SeIncBasePriorityPrivilege 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe Token: SeIncBasePriorityPrivilege 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe Token: SeIncBasePriorityPrivilege 1648 {12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe Token: SeIncBasePriorityPrivilege 2968 {975DD46B-63BB-4235-9920-11A61344DAA4}.exe Token: SeIncBasePriorityPrivilege 2884 {D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2588 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 29 PID 2108 wrote to memory of 2588 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 29 PID 2108 wrote to memory of 2588 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 29 PID 2108 wrote to memory of 2588 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 29 PID 2108 wrote to memory of 2060 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 30 PID 2108 wrote to memory of 2060 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 30 PID 2108 wrote to memory of 2060 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 30 PID 2108 wrote to memory of 2060 2108 58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe 30 PID 2588 wrote to memory of 2364 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 31 PID 2588 wrote to memory of 2364 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 31 PID 2588 wrote to memory of 2364 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 31 PID 2588 wrote to memory of 2364 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 31 PID 2588 wrote to memory of 3024 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 32 PID 2588 wrote to memory of 3024 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 32 PID 2588 wrote to memory of 3024 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 32 PID 2588 wrote to memory of 3024 2588 {AF844EE7-70C8-42be-8546-018D5904AA7C}.exe 32 PID 2364 wrote to memory of 2360 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 33 PID 2364 wrote to memory of 2360 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 33 PID 2364 wrote to memory of 2360 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 33 PID 2364 wrote to memory of 2360 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 33 PID 2364 wrote to memory of 2692 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 34 PID 2364 wrote to memory of 2692 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 34 PID 2364 wrote to memory of 2692 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 34 PID 2364 wrote to memory of 2692 2364 {2533F393-E2E3-43b2-9079-C3A6416935F4}.exe 34 PID 2360 wrote to memory of 3004 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 37 PID 2360 wrote to memory of 3004 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 37 PID 2360 wrote to memory of 3004 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 37 PID 2360 wrote to memory of 3004 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 37 PID 2360 wrote to memory of 2972 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 38 PID 2360 wrote to memory of 2972 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 38 PID 2360 wrote to memory of 2972 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 38 PID 2360 wrote to memory of 2972 2360 {0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe 38 PID 3004 wrote to memory of 1928 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 39 PID 3004 wrote to memory of 1928 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 39 PID 3004 wrote to memory of 1928 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 39 PID 3004 wrote to memory of 1928 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 39 PID 3004 wrote to memory of 1236 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 40 PID 3004 wrote to memory of 1236 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 40 PID 3004 wrote to memory of 1236 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 40 PID 3004 wrote to memory of 1236 3004 {95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe 40 PID 1928 wrote to memory of 1600 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 41 PID 1928 wrote to memory of 1600 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 41 PID 1928 wrote to memory of 1600 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 41 PID 1928 wrote to memory of 1600 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 41 PID 1928 wrote to memory of 1968 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 42 PID 1928 wrote to memory of 1968 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 42 PID 1928 wrote to memory of 1968 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 42 PID 1928 wrote to memory of 1968 1928 {8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe 42 PID 1600 wrote to memory of 1644 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 43 PID 1600 wrote to memory of 1644 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 43 PID 1600 wrote to memory of 1644 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 43 PID 1600 wrote to memory of 1644 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 43 PID 1600 wrote to memory of 2404 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 44 PID 1600 wrote to memory of 2404 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 44 PID 1600 wrote to memory of 2404 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 44 PID 1600 wrote to memory of 2404 1600 {AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe 44 PID 1644 wrote to memory of 1648 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 45 PID 1644 wrote to memory of 1648 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 45 PID 1644 wrote to memory of 1648 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 45 PID 1644 wrote to memory of 1648 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 45 PID 1644 wrote to memory of 2408 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 46 PID 1644 wrote to memory of 2408 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 46 PID 1644 wrote to memory of 2408 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 46 PID 1644 wrote to memory of 2408 1644 {D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe"C:\Users\Admin\AppData\Local\Temp\58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exeC:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exeC:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exeC:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exeC:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exeC:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exeC:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exeC:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exeC:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exeC:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exeC:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exeC:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe12⤵
- Executes dropped EXE
PID:796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6724~1.EXE > nul12⤵PID:692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{975DD~1.EXE > nul11⤵PID:2808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12F09~1.EXE > nul10⤵PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0B0D~1.EXE > nul9⤵PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE17A~1.EXE > nul8⤵PID:2404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8667B~1.EXE > nul7⤵PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95E6A~1.EXE > nul6⤵PID:1236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BA92~1.EXE > nul5⤵PID:2972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2533F~1.EXE > nul4⤵PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF844~1.EXE > nul3⤵PID:3024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\58E7FC~1.EXE > nul2⤵
- Deletes itself
PID:2060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD50d55d818fbb51d3886455bd4fd46f062
SHA16c2483ad1d0d7fe144dc0755c25d641e3f2bd741
SHA25692c0fc2bfb684cddb59eb8f70eb82daf314f8b9dc4e039a77c386ef6bf1bf1a9
SHA5128de543fcfd0b5d17b3bc5c407f4e79fe43c667eb3d7449b6577fd82e4075f0d31586f809efff23435b2bdcd5f0db4546786249d78142fc67541287dec245c469
-
Filesize
90KB
MD5a85bba324c48cc0ce8ba646bbf6c77aa
SHA16e09c7622dd017d13f11f5a5616a184d634cdefb
SHA25697be366f2c71c386ae74711e21bf95ac712d8b1065da20891dc59e3e5c137d6c
SHA51264566c8e20075f887689cc49495ea2590856766cbe0d2a65d3feb961ca36c95302cd8a8676a779eaa8f9dda09c63e00cae12b0c5d59c6fd4fb913cfc6df590d6
-
Filesize
90KB
MD5383a1b5df46bb00ffa5fa34c5a397715
SHA121b888af3bb85c6982f5e4a8c4902892438800a8
SHA256c4283842a64c2caa9fd40d3bd0ff3bbd3e8c5a36128f55be797933090fbd3ba4
SHA512c747b6c0670660e15b8cc6afda0e0e9c59c03f097d456234de4fe79990ad75aa4229a32a335f2802deb113a4e261d52f4813e705af9256ab217bc0d870f2c91e
-
Filesize
90KB
MD503e2fda90f8d8ac0a40dd4a42959c1ab
SHA148e5c8919e0204ab7c4d13603b0e719709989824
SHA256a18919a0bdbf24f5592071774e0b9b04bdf5a4e6c86a898221e665119935b78b
SHA5124809322b57abf59e69e9fc942955e0c66ca3fc540da3aa1f17034a2d13b1047393e33efef4ebcec6373c7aecabc5ada26195768218a27591671364b0971fe7d9
-
Filesize
90KB
MD5d529414e9f41a4760597ba121941277b
SHA1fcf7808b46cef4fdcceaba4ec8ce042705a7868a
SHA256cea4bd6afcef209c9494fc4850ed5b053a89c429e3883b18e0a62fd9a4afe2d0
SHA51221b0c8b4b260a242d5866549e38ff942cfc458ca711525abba03a22d8a2e6af385dd4fb6851459fc80763d2dfb1c4238562fa77e35d071f4b6067e010b1decb9
-
Filesize
90KB
MD5a6a8ab220d52e63fb9b74a5be897854a
SHA1b5235272e277fccb295a1f37246d8251ce03c4a8
SHA256ac92541e552c96732e71a06b128736314e73c237032726b5a0b14ca30aae25f3
SHA51299e4dcc40bcc2a752ff9bc8a605d556e6b6bb823d087bdef7c8047f52d539db4ca8ef5d8bf027f039f2a8058192f92d029a24e761bfe2ef6d44c822634996ffe
-
Filesize
90KB
MD502bd3d55cae3986d5fefbed5217a1f39
SHA10d70fad2f64f1073591c431f3ce50ac1dd351692
SHA2566de38037c500fbc162547f6aaf5841c8d218ac7460a7de58d7d21f30a19d3d28
SHA51270fbd13269c34402bc3ac2317be1389bc080a63182d376b36929436b9979e994d90c7f86979e9e2e8778f99410fbcd77368c9aa10c6e1e69eaf1d6d085da1660
-
Filesize
90KB
MD585a6b1ac8fd047718f615457591b7203
SHA169477a7033bd120c521c92ea19e8add84f193642
SHA2568f20d7eeee886642c3ebda2461e0673d80b1d31a49795907b1344d2e2072a345
SHA512529b0d4be5871e186570612afacdd6f95559a293de32371fb3e9a6a329f80a1df900de5a94975b5bd5fdf9154ba0a8e14a487c9f583a9ad4f2e6e39c15d38c94
-
Filesize
90KB
MD5fc6999edfe3796d723a4dfb9db319419
SHA1dd17eb8bd05a82f14d839fbac5543aea9284284d
SHA256afbf0b54baf0c3793a5afc174033a01dce96b009718b3e00d5de709fb9fe4ff8
SHA51250faaaf1b0193118af5a565cf817fd6254465bc905456c530e1edf412ac70ef0888f1f216b455a55a372c5a373e0673d2e7978e2317e2ace1161950db2545700
-
Filesize
90KB
MD5ae79b74885d069e917c65934964180bf
SHA127cad69ed5e85ef258c74c9b49685969942d39f7
SHA256f994bd7a0f94dca15bdc3197166cc5ca5b063ca72fc88e199dbc78abd262d9b7
SHA512367614c61fe6c10650e3dc6db92bd4e3d5bc0bdfb2017c4b98e85d8947df9a022a10117740761457d43af047a7ee8b27a8aa46d9c907e18ca83eab7149007c0c
-
Filesize
90KB
MD56f6ad8ca305ed6bbce6dcd496e259f0c
SHA1cf3faf979f3ba0cc042d9dfa610282d3d6e44990
SHA256ea8a9cfb0025a06b2c66485b33dabc016fb8a65c7507a141863f24b15f0a1f39
SHA51254f46f71de9078e6436bee6a3348ab093b6450b0e5567c3ae9a0a2fd15e004be5c541f1c5111e52cdfce2340c40761eb7b5dec2e5e57b362adf43b759532e2fa