Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe
-
Size
180KB
-
MD5
4326dee944bcc8c239eb01e4928c0058
-
SHA1
c7cca13f118e4eeba6b885e0d20f314fa38722a3
-
SHA256
955cafb96504cbc14aec61936f3354dc4460e0743901f187e6b6b1603deaea2d
-
SHA512
ee6aaee7ce0a9fc49fae6e12cb5cf3d4959ca7f0bf218e77e4fcb0352c26439d85a42f8c13eead0200472105f0e8fa2b47b820c4b90b2dc22dab45522520c930
-
SSDEEP
3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGWl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0006000000023229-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023203-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023230-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023203-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021f82-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021f83-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021f82-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000705-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}\stubpath = "C:\\Windows\\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe" {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}\stubpath = "C:\\Windows\\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe" 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{711C2C51-040F-40c2-90B5-823419E89B21} {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}\stubpath = "C:\\Windows\\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe" {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0} {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}\stubpath = "C:\\Windows\\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe" {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}\stubpath = "C:\\Windows\\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe" {711C2C51-040F-40c2-90B5-823419E89B21}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC} {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}\stubpath = "C:\\Windows\\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe" {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0} {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB259EF2-B813-49f5-BBD8-C99034FE65B8} {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}\stubpath = "C:\\Windows\\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe" {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AAFFC82-5398-4fa4-8151-C45378B0F09B} {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C693D759-D7A6-4f9a-93E9-F92F87C3262D} {7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}\stubpath = "C:\\Windows\\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe" {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}\stubpath = "C:\\Windows\\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe" {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9} {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2} {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6963156-1B3E-491d-AAD7-5A1EB90738CE} 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{711C2C51-040F-40c2-90B5-823419E89B21}\stubpath = "C:\\Windows\\{711C2C51-040F-40c2-90B5-823419E89B21}.exe" {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861} {711C2C51-040F-40c2-90B5-823419E89B21}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FFBA6BC-24E3-4228-B338-6864C472D1F8} {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}\stubpath = "C:\\Windows\\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe" {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}\stubpath = "C:\\Windows\\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe" {7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe -
Executes dropped EXE 12 IoCs
pid Process 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 2224 {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe 2568 {7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe 3808 {C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe File created C:\Windows\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe File created C:\Windows\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe File created C:\Windows\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe File created C:\Windows\{711C2C51-040F-40c2-90B5-823419E89B21}.exe {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe File created C:\Windows\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe {711C2C51-040F-40c2-90B5-823419E89B21}.exe File created C:\Windows\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe File created C:\Windows\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe File created C:\Windows\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe File created C:\Windows\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe File created C:\Windows\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe File created C:\Windows\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe {7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe Token: SeIncBasePriorityPrivilege 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe Token: SeIncBasePriorityPrivilege 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe Token: SeIncBasePriorityPrivilege 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe Token: SeIncBasePriorityPrivilege 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe Token: SeIncBasePriorityPrivilege 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe Token: SeIncBasePriorityPrivilege 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe Token: SeIncBasePriorityPrivilege 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe Token: SeIncBasePriorityPrivilege 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe Token: SeIncBasePriorityPrivilege 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe Token: SeIncBasePriorityPrivilege 2224 {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe Token: SeIncBasePriorityPrivilege 2568 {7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3300 wrote to memory of 5064 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe 92 PID 3300 wrote to memory of 5064 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe 92 PID 3300 wrote to memory of 5064 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe 92 PID 3300 wrote to memory of 5088 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe 93 PID 3300 wrote to memory of 5088 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe 93 PID 3300 wrote to memory of 5088 3300 2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe 93 PID 5064 wrote to memory of 2508 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 94 PID 5064 wrote to memory of 2508 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 94 PID 5064 wrote to memory of 2508 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 94 PID 5064 wrote to memory of 4428 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 95 PID 5064 wrote to memory of 4428 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 95 PID 5064 wrote to memory of 4428 5064 {B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe 95 PID 2508 wrote to memory of 836 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 98 PID 2508 wrote to memory of 836 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 98 PID 2508 wrote to memory of 836 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 98 PID 2508 wrote to memory of 1556 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 97 PID 2508 wrote to memory of 1556 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 97 PID 2508 wrote to memory of 1556 2508 {711C2C51-040F-40c2-90B5-823419E89B21}.exe 97 PID 836 wrote to memory of 1992 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 100 PID 836 wrote to memory of 1992 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 100 PID 836 wrote to memory of 1992 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 100 PID 836 wrote to memory of 3156 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 99 PID 836 wrote to memory of 3156 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 99 PID 836 wrote to memory of 3156 836 {7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe 99 PID 1992 wrote to memory of 3600 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 101 PID 1992 wrote to memory of 3600 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 101 PID 1992 wrote to memory of 3600 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 101 PID 1992 wrote to memory of 2856 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 102 PID 1992 wrote to memory of 2856 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 102 PID 1992 wrote to memory of 2856 1992 {5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe 102 PID 3600 wrote to memory of 3844 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 103 PID 3600 wrote to memory of 3844 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 103 PID 3600 wrote to memory of 3844 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 103 PID 3600 wrote to memory of 4608 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 104 PID 3600 wrote to memory of 4608 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 104 PID 3600 wrote to memory of 4608 3600 {ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe 104 PID 3844 wrote to memory of 4848 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 105 PID 3844 wrote to memory of 4848 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 105 PID 3844 wrote to memory of 4848 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 105 PID 3844 wrote to memory of 2636 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 106 PID 3844 wrote to memory of 2636 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 106 PID 3844 wrote to memory of 2636 3844 {BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe 106 PID 4848 wrote to memory of 636 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 107 PID 4848 wrote to memory of 636 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 107 PID 4848 wrote to memory of 636 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 107 PID 4848 wrote to memory of 5000 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 108 PID 4848 wrote to memory of 5000 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 108 PID 4848 wrote to memory of 5000 4848 {D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe 108 PID 636 wrote to memory of 792 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 109 PID 636 wrote to memory of 792 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 109 PID 636 wrote to memory of 792 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 109 PID 636 wrote to memory of 2572 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 110 PID 636 wrote to memory of 2572 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 110 PID 636 wrote to memory of 2572 636 {2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe 110 PID 792 wrote to memory of 2224 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 111 PID 792 wrote to memory of 2224 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 111 PID 792 wrote to memory of 2224 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 111 PID 792 wrote to memory of 4028 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 112 PID 792 wrote to memory of 4028 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 112 PID 792 wrote to memory of 4028 792 {FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe 112 PID 2224 wrote to memory of 2568 2224 {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe 113 PID 2224 wrote to memory of 2568 2224 {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe 113 PID 2224 wrote to memory of 2568 2224 {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe 113 PID 2224 wrote to memory of 4124 2224 {020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exeC:\Windows\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\{711C2C51-040F-40c2-90B5-823419E89B21}.exeC:\Windows\{711C2C51-040F-40c2-90B5-823419E89B21}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{711C2~1.EXE > nul4⤵PID:1556
-
-
C:\Windows\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exeC:\Windows\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E9A0~1.EXE > nul5⤵PID:3156
-
-
C:\Windows\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exeC:\Windows\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exeC:\Windows\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exeC:\Windows\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exeC:\Windows\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exeC:\Windows\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exeC:\Windows\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exeC:\Windows\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exeC:\Windows\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AAFF~1.EXE > nul13⤵PID:1908
-
-
C:\Windows\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exeC:\Windows\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe13⤵
- Executes dropped EXE
PID:3808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{020F5~1.EXE > nul12⤵PID:4124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD2BC~1.EXE > nul11⤵PID:4028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2167C~1.EXE > nul10⤵PID:2572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6943~1.EXE > nul9⤵PID:5000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB259~1.EXE > nul8⤵PID:2636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED7B0~1.EXE > nul7⤵PID:4608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FFBA~1.EXE > nul6⤵PID:2856
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6963~1.EXE > nul3⤵PID:4428
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:5088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5dda06fb03a766e11e9e9f0559207aa39
SHA1fe408a54a4c3a35f389e8c19471c8dc9a0359377
SHA256929d2d657100073e05731eab831818f8521727c4c8137ada197038bf3f217996
SHA51203ca8970ab74d08101f2c5e805327ecb0effb51fde0db6a55f04dd67ff207c5a9d39a3024535868fd73d36bcb05314afb14abad1d90ff29c6cee61a0c0914321
-
Filesize
180KB
MD5d07a23ec1f1312df74e9dbafe226a14b
SHA1a879032778207a9799d3a4bb8de2f46da26dcba6
SHA2560229d1c8a2b50b379c0ba6c205381ae80a39c994010211c2ba7e8280cbca6e5e
SHA51288a188a6a5cb2858e964d793c2e44c36529f00dfd93a116725e8fa07f0aa08961aa8dcae12a788d7414052c3a49ad6966f1886465739c5f0dda56630e3a66938
-
Filesize
180KB
MD575fc095f8a2bb66e9ad2a206d2416214
SHA18db3e999ffd5ea0b9ab73b173bfff17f49a4911c
SHA256becba5ed422d67dda11a3d3cab3994d3f255eed1eb7ea954500a2928e91cae7a
SHA512ac633dd597bb8dba7799e9050ef74f3f1d41f54394b8e46d9829305d2ed2dee45117e31c808f22286006383f9ed6332e36a51b8145988d0e1c93745d7d3b0bfb
-
Filesize
180KB
MD51604a3b7c05caf021d2ff64838e0b342
SHA1267aa52cec623c1e38f92e97ae80b2525f3d37b8
SHA25604adac248b9f4c945a8eba26f7f7fc7b5a21f2b090a49636e579d48cf9df77fb
SHA5122d4415fad0f5b2f10666e9dd41c187a92f173b829560bb7e2984dc71707d971e08fca6cbc85d669ab93ab712af0081e46d53b265aeced213bb5d372627d16715
-
Filesize
180KB
MD55bb09be2d87d05591925401fd314ad34
SHA1b3bc95a02d548da6767d8edc31aac6803b817416
SHA25684c5f79b1a03affca4c8f5a4b397d9bee698b9ffbacbec098c2bf07329c1e502
SHA512a4fb46fa99951222444709c45f991d8db306aa84a4490e073e46c78e4555df6e40c705a78bd2be0355a1b7d2ee5ae3fee4c6ff0d1c9f44a1b270b525bd71abbf
-
Filesize
180KB
MD5d2a67a0a428a1032b9d0bf7ef0c2cf0d
SHA138c8d344d0c5b55312344dd5e2d5e9680b8ecaf9
SHA256665e4f516604fb81883dd44bf1aa22616a900d722c580c98769c5dd81ffa93a4
SHA5128d027cc442eef916947c6f0c40fc01c3de30225bfe326762fbabcfa54303196a6600e992eb17814287700e9e9cd628cde44db8b148c6ca557df78f17683e78ff
-
Filesize
180KB
MD534324cca096a08d34dded85961e269d8
SHA1131790662ef577e9ca274d2d9c7f371bf57b26b6
SHA2562cb73d3164c749701492e33a9c25a46b2af631bce161d2faafc47a258dfb717a
SHA51231a8f5a752bb38d5c63dd0d3950e43eb21a5fee80394319986b80edc0da5b49990a12a7756465cfd6de1c7af35df1f25d34b5704587b804411b6aea89d7774e9
-
Filesize
180KB
MD510a3cd236bdbb517fd948472ed4107c6
SHA1a4e74326655eaadcf4dd096f1e4c32bed21656a7
SHA25677515efc4299be53ed24b971a3b890a084899cd673a5eb21c1785a4bece254ba
SHA512bffb1c6d75bc87f0ec3fdb47a9c6aa5071f0b5c4beba36604f0bf032094b74c1b7c016909d715784477fdae9c6945f5c4cb2ebf3a77a8ee3e2c76c31a9ecdd80
-
Filesize
180KB
MD55deb3e47b703a080a6cd0b6f1f5f76cc
SHA1fd9eaad6053b92a4ddffaeb3097f281ff0bfd9b4
SHA25698f8f81fa4b5f515ba22e63e4e5e2c2f8e1016f6a0b9870497fe0100d65c1075
SHA512e85c8ea83b2a2bbbf5087d6ac4fda2057b47b37597047440c1e5d0b5f4c2fc1a54c4ce414184f80fe4aa4589764f4cbe543f61f7c3d6ec6d93eeb430f6e3b81c
-
Filesize
180KB
MD5b5ca5dca24b083e8220688af190ab736
SHA128947ed86d5f7a8abc9906d4f1f59f164efa883a
SHA256a80a166172943d5cf84ed6df3ce91a449d4b9922518a6a52bc7c6781dc89eceb
SHA51288c2326cbab4df83c422bce54533c8c466aa8dc1b47fb231b886c9ef15d14dc25aec9acbb8beba0d4c38a3946d9a79a8f3cbb279d774b04122839f44eed1d16c
-
Filesize
180KB
MD51d66a2afb3532887210526e86ad10698
SHA171080192f4637a1ac05b1523f3b88e5fb1b7a144
SHA2561627ddcb71b2d4a7c709111f49acefb03acfd44647485f7bbe560c61e631ce50
SHA512c120cf59f572ce8ade0654b86c4d319e1f9a3f85eee51b0c71798887f6be973648745d0f8abab3eea8947e2a484589e08ba94ea505ff6c5e76e9fcc15d2ec49e
-
Filesize
180KB
MD5be8f59d08905c08a59f2948d1e55df3c
SHA185f4cafeb1a139a965837b3e87396ec13a5faa3c
SHA256f33ac18e0e2ae3c4e294021430adfb45f2c842d062fe47559e9702595d1d64f1
SHA5123af3ee30f8f573a71a9b9f60b30a0074fed8483fe7f3a9167ee6eb9e62f4dbed26e8d5a8eb69d09d9ecbf70607aa2940cee9d12aaffe510f85b11568afaadbeb