Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe
Resource
win10v2004-20240704-en
General
-
Target
09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe
-
Size
116KB
-
MD5
99c0caf5c211b625eefcfd223264e044
-
SHA1
afb066c5f47c7c7989a2bf78a68f37204de57ea7
-
SHA256
09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113
-
SHA512
f34693273e7fa80aca3c01d542ea75997415cebbf82e86b3ae2d1739d26991d4617989ec37fb0be79335a285c675a76e6ee0aeb097ed720646a44344fc871814
-
SSDEEP
768:Qvw9816vhKQLroe4/wQRNrfrunMxVFA3b7glwRjMlfwGxEI5nWAwxt6sDntNiLJN:YEGh0oel2unMxVS3HgdoKjhLJhL
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8} {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}\stubpath = "C:\\Windows\\{5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe" {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAF01F0D-8E81-4a56-B3D5-0B520F575BB0} {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A31EA7BD-7BF0-498e-82EF-B5039D986A16}\stubpath = "C:\\Windows\\{A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe" {0023A422-4DD2-447e-A572-59E8225B562B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BA48A64-51BF-4361-91A7-FCDF35321DB1} 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BA48A64-51BF-4361-91A7-FCDF35321DB1}\stubpath = "C:\\Windows\\{0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe" 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1390EFE8-ADDF-41cd-920E-D509AF33143A}\stubpath = "C:\\Windows\\{1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe" {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A31EA7BD-7BF0-498e-82EF-B5039D986A16} {0023A422-4DD2-447e-A572-59E8225B562B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E64C593C-173F-45e1-808B-445280A540B3}\stubpath = "C:\\Windows\\{E64C593C-173F-45e1-808B-445280A540B3}.exe" {A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E48D50A-0B22-411f-BA50-A00B86EB4869}\stubpath = "C:\\Windows\\{3E48D50A-0B22-411f-BA50-A00B86EB4869}.exe" {E64C593C-173F-45e1-808B-445280A540B3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F} {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}\stubpath = "C:\\Windows\\{FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe" {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1390EFE8-ADDF-41cd-920E-D509AF33143A} {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E64C593C-173F-45e1-808B-445280A540B3} {A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D416DB2-94F0-48ab-9A19-BFA144CD52D5}\stubpath = "C:\\Windows\\{5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe" {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0023A422-4DD2-447e-A572-59E8225B562B} {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0023A422-4DD2-447e-A572-59E8225B562B}\stubpath = "C:\\Windows\\{0023A422-4DD2-447e-A572-59E8225B562B}.exe" {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E48D50A-0B22-411f-BA50-A00B86EB4869} {E64C593C-173F-45e1-808B-445280A540B3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}\stubpath = "C:\\Windows\\{C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe" {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE90D6EF-A107-4303-9C81-B3E41282FFEA} {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE90D6EF-A107-4303-9C81-B3E41282FFEA}\stubpath = "C:\\Windows\\{DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe" {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D416DB2-94F0-48ab-9A19-BFA144CD52D5} {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe -
Deletes itself 1 IoCs
pid Process 2128 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 2152 {0023A422-4DD2-447e-A572-59E8225B562B}.exe 2596 {A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe 2124 {E64C593C-173F-45e1-808B-445280A540B3}.exe 576 {3E48D50A-0B22-411f-BA50-A00B86EB4869}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe File created C:\Windows\{1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe File created C:\Windows\{A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe {0023A422-4DD2-447e-A572-59E8225B562B}.exe File created C:\Windows\{3E48D50A-0B22-411f-BA50-A00B86EB4869}.exe {E64C593C-173F-45e1-808B-445280A540B3}.exe File created C:\Windows\{0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe File created C:\Windows\{C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe File created C:\Windows\{5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe File created C:\Windows\{5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe File created C:\Windows\{FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe File created C:\Windows\{0023A422-4DD2-447e-A572-59E8225B562B}.exe {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe File created C:\Windows\{E64C593C-173F-45e1-808B-445280A540B3}.exe {A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe Token: SeIncBasePriorityPrivilege 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe Token: SeIncBasePriorityPrivilege 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe Token: SeIncBasePriorityPrivilege 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe Token: SeIncBasePriorityPrivilege 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe Token: SeIncBasePriorityPrivilege 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe Token: SeIncBasePriorityPrivilege 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe Token: SeIncBasePriorityPrivilege 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe Token: SeIncBasePriorityPrivilege 2152 {0023A422-4DD2-447e-A572-59E8225B562B}.exe Token: SeIncBasePriorityPrivilege 2596 {A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe Token: SeIncBasePriorityPrivilege 2124 {E64C593C-173F-45e1-808B-445280A540B3}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 772 wrote to memory of 484 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 31 PID 772 wrote to memory of 484 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 31 PID 772 wrote to memory of 484 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 31 PID 772 wrote to memory of 484 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 31 PID 772 wrote to memory of 2128 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 32 PID 772 wrote to memory of 2128 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 32 PID 772 wrote to memory of 2128 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 32 PID 772 wrote to memory of 2128 772 09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe 32 PID 484 wrote to memory of 2948 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 33 PID 484 wrote to memory of 2948 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 33 PID 484 wrote to memory of 2948 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 33 PID 484 wrote to memory of 2948 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 33 PID 484 wrote to memory of 2760 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 34 PID 484 wrote to memory of 2760 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 34 PID 484 wrote to memory of 2760 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 34 PID 484 wrote to memory of 2760 484 {0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe 34 PID 2948 wrote to memory of 2672 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 35 PID 2948 wrote to memory of 2672 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 35 PID 2948 wrote to memory of 2672 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 35 PID 2948 wrote to memory of 2672 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 35 PID 2948 wrote to memory of 2000 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 36 PID 2948 wrote to memory of 2000 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 36 PID 2948 wrote to memory of 2000 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 36 PID 2948 wrote to memory of 2000 2948 {C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe 36 PID 2672 wrote to memory of 2632 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 37 PID 2672 wrote to memory of 2632 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 37 PID 2672 wrote to memory of 2632 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 37 PID 2672 wrote to memory of 2632 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 37 PID 2672 wrote to memory of 2688 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 38 PID 2672 wrote to memory of 2688 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 38 PID 2672 wrote to memory of 2688 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 38 PID 2672 wrote to memory of 2688 2672 {DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe 38 PID 2632 wrote to memory of 2292 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 39 PID 2632 wrote to memory of 2292 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 39 PID 2632 wrote to memory of 2292 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 39 PID 2632 wrote to memory of 2292 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 39 PID 2632 wrote to memory of 1916 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 40 PID 2632 wrote to memory of 1916 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 40 PID 2632 wrote to memory of 1916 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 40 PID 2632 wrote to memory of 1916 2632 {5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe 40 PID 2292 wrote to memory of 1904 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 41 PID 2292 wrote to memory of 1904 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 41 PID 2292 wrote to memory of 1904 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 41 PID 2292 wrote to memory of 1904 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 41 PID 2292 wrote to memory of 2840 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 42 PID 2292 wrote to memory of 2840 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 42 PID 2292 wrote to memory of 2840 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 42 PID 2292 wrote to memory of 2840 2292 {5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe 42 PID 1904 wrote to memory of 1268 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 43 PID 1904 wrote to memory of 1268 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 43 PID 1904 wrote to memory of 1268 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 43 PID 1904 wrote to memory of 1268 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 43 PID 1904 wrote to memory of 1740 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 44 PID 1904 wrote to memory of 1740 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 44 PID 1904 wrote to memory of 1740 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 44 PID 1904 wrote to memory of 1740 1904 {FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe 44 PID 1268 wrote to memory of 2152 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 45 PID 1268 wrote to memory of 2152 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 45 PID 1268 wrote to memory of 2152 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 45 PID 1268 wrote to memory of 2152 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 45 PID 1268 wrote to memory of 1672 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 46 PID 1268 wrote to memory of 1672 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 46 PID 1268 wrote to memory of 1672 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 46 PID 1268 wrote to memory of 1672 1268 {1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe"C:\Users\Admin\AppData\Local\Temp\09706998901c2ebd071ca05cbc5ec81921ba9d20ead1cadbc8654735509c8113.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\{0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exeC:\Windows\{0BA48A64-51BF-4361-91A7-FCDF35321DB1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\{C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exeC:\Windows\{C7C7F99F-B7BF-4848-BB8E-54EE70FC6C0F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\{DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exeC:\Windows\{DE90D6EF-A107-4303-9C81-B3E41282FFEA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\{5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exeC:\Windows\{5AC5B9B6-22BC-4d5b-A280-ED16CAA983E8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\{5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exeC:\Windows\{5D416DB2-94F0-48ab-9A19-BFA144CD52D5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\{FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exeC:\Windows\{FAF01F0D-8E81-4a56-B3D5-0B520F575BB0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\{1390EFE8-ADDF-41cd-920E-D509AF33143A}.exeC:\Windows\{1390EFE8-ADDF-41cd-920E-D509AF33143A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\{0023A422-4DD2-447e-A572-59E8225B562B}.exeC:\Windows\{0023A422-4DD2-447e-A572-59E8225B562B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\{A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exeC:\Windows\{A31EA7BD-7BF0-498e-82EF-B5039D986A16}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Windows\{E64C593C-173F-45e1-808B-445280A540B3}.exeC:\Windows\{E64C593C-173F-45e1-808B-445280A540B3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Windows\{3E48D50A-0B22-411f-BA50-A00B86EB4869}.exeC:\Windows\{3E48D50A-0B22-411f-BA50-A00B86EB4869}.exe12⤵
- Executes dropped EXE
PID:576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E64C5~1.EXE > nul12⤵PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A31EA~1.EXE > nul11⤵PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0023A~1.EXE > nul10⤵PID:2372
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1390E~1.EXE > nul9⤵PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAF01~1.EXE > nul8⤵PID:1740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D416~1.EXE > nul7⤵PID:2840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AC5B~1.EXE > nul6⤵PID:1916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE90D~1.EXE > nul5⤵PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7C7F~1.EXE > nul4⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BA48~1.EXE > nul3⤵PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\097069~1.EXE > nul2⤵
- Deletes itself
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD577609829fdcb008f034a806e7e0566c7
SHA199fc2c2576b193d358f80be08152582f9f9c48c0
SHA256894c677f9b7afddd1895d9ec3b1d519c2326ce05b896d77d70ef5666554ca17f
SHA512e0b92ec3c930230149ccb35f4a80ee4c69c2919b6c140fde05ab0ee8bac9afe1542e89200ec7f050b945d6ac1f78e682fad34dff202ca78fd4c24823f1475958
-
Filesize
116KB
MD5e0ab25d07b952951e4a96d5e8a08f46b
SHA1b8286fbf924d5772da59db8c6398a717b5eeb25a
SHA256e4e5127a82778bd1e4090a23dbafa416942bf6b76cafed42d885e217538202ff
SHA512133194b9f2eef33def8112e23a972bbcc03cfa74ba8defcac19d3500ee9b13bd69aa91364ef88145c620531800e792d9e92fa9e8bee3c6bce8fc81c2c7c6543a
-
Filesize
116KB
MD5d080758529dbe078a0c644d9f376f03c
SHA1c28317f13fa403bcb25a70af7db2007ede8406ff
SHA2564550b36d0454067ef93e8da6c11d2f46e478bf8bf35bd525b892fb35eebf5e3d
SHA512a7aaa66f4966c7d5f3cc4b0362098271d7089871ae2babfa6de3aeab984b5a2ead1f4df3a186d69b5d424b2a18601ebbbf993aa3110f57d9e7a0c03ac5d6b5ae
-
Filesize
116KB
MD5b6faf276ad5c7db3d6bdd6d5ef3d50d3
SHA1f48a003cbab6e6399ad0a2d967b7a49b921e8143
SHA256db0f960f48bb2cb3d43ed55d4775bb3f8c3ae63bcd6021198d3471203389bc00
SHA5125c7b404cd9e7ea504c7968c9f1f46586ed0b473fd948ec4431c9ea37ff760beeba48c8f9c93ce9b58fc41e8fcfa6caa849936ae3783aabb5ef813b368b61acf5
-
Filesize
116KB
MD5f13418f665ec3bc73ab455a3d0603950
SHA18aa7c365189da6be57e640bdb4bfbe3d8985ffe3
SHA25635782a101216f519179ee8e60c32a827a897c1ae2043871548fa254bfe578fef
SHA512d843280d42a6edbf1acff3f8dc2e29a344e80cfa507f18a2f0a80717eab03c450da38959d6584e86e2f640a48d2300cfa58f9e5789d94d7a8416a71b15001c7f
-
Filesize
116KB
MD589309a6e397b3593bbb7791aa054015c
SHA10a24bf38de617eea201999f1a75bcf91f0f49da7
SHA256bde4e9c60ffc5bd0282570559a7929fa3621053be9947259e7476a9c950fddd9
SHA512e191e110896fac2e243834084762af51f03798d640c2d6195b7df712c00c9782a349e76224c3f6d20d302b880638b6e01604de390dcc698a13de7c711eb5fc72
-
Filesize
116KB
MD5ab48e0dccd15637c3670ee467d23a5aa
SHA11d8cdff04cccbc66df400f632d2d3af22ef2ef59
SHA2568c7c4e824ea274735697501401f552ed5123ab342bb44c476eb56c36b3da531b
SHA5127061ad246fad2fe8eb25eaa843bac280bb48b205ccea3c98645863ef200bfd2dcb4051d0a7ad380548fd40fedf0e51ecfd0467330a9de6b19a261cde0b21040a
-
Filesize
116KB
MD54560737f6235b69c4bbf0b0e90fd250a
SHA15e895e53dfb116d5c51de91fe4aea42615b71b2a
SHA256b133c64433dac360434b97f301014e949be9cb2e0f3e1aea9df02daf123db3a0
SHA512b245d9cbc5ac2aa6bf2d3dbbcc3cbe3e01433d46debae39a8aec8f3e9a072c8ba716efeb2dc0de378d529ee23edcf8c69de91db6f12f5573fa483d3ad5fb628d
-
Filesize
116KB
MD5dd3a17ee89c325618fbb5ecfe5eb346a
SHA10f4119df4076b3a65f3eafe19ad1814c9546050e
SHA256a6efe2e89b33a4659eb4e3556289bdaafeae028a3f714b04930dfa9115f3fb76
SHA512e2d835c91359fac4ac06b6d3841905d714a34c9ef52efaf9dfe4c04e84108dc7d53ce509309e8c2bab85957cc9d8ee99b67babc10f8ac50a45dd2b832f7db066
-
Filesize
116KB
MD553ffb8a87bd81694bbfc6315ab9f9ffd
SHA107f572b017d4f4f63f2773a7706692602bdfed06
SHA25683363a4c7687ca859640979e67ab2b9662d4660097895ca10ccf8e58fe6756e2
SHA512ef98a30ff03cb12638f08067df151990ae143b37f73a2e1f47c943d605d59b8d3a0afa1a47c4ebd9a46efb7e17eed8ecd8c20f5efa0939c4cb703e72fb5a32b1
-
Filesize
116KB
MD5736c54b94063c448a0c06250de6a1b74
SHA183c17f2cdfaa11f972d9d7d709c3377247a81c25
SHA2566518a723e44ea5cb4995688933cc9ef2d321ba247d42b7ee83a7b3b2a9345d43
SHA512dcbdb068be2d102e9499faec72f7aea550cb7107c55c7aafa881bed816b4a293365bab21890260b9113a7901bde19b146851ea6f2db40c9daa0b050c60ba59f8