Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 20:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe
-
Size
180KB
-
MD5
65d6d992173d27b5d51a5933ccb33880
-
SHA1
0f48beb4b646b587ec17bd9a0f149fc386f3f330
-
SHA256
4627456033a36415855be1571abd60d8d252d93833616a6ba6a6094ae6604018
-
SHA512
c83241380aed6ba277924f9a3b0ea8eb5c1b9c05fe3350d58ea95b0448f3ab9f76f3c36d14472fcd1529cdb0591fd5b90ea76a733699847c006705d03aa49818
-
SSDEEP
3072:jEGh0oflfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGdl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
Processes:
resource yara_rule C:\Windows\{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{BB84A230-234D-498c-914C-F29BFAF98E23}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exe GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 24 IoCs
Processes:
{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe{BB84A230-234D-498c-914C-F29BFAF98E23}.exe{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}\stubpath = "C:\\Windows\\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exe" {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}\stubpath = "C:\\Windows\\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe" {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}\stubpath = "C:\\Windows\\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe" {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A1C1585-6FAE-436d-834C-24FB2E0FC118} {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}\stubpath = "C:\\Windows\\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe" {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB84A230-234D-498c-914C-F29BFAF98E23} {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D919D95-5FC8-48aa-B8CC-463A235C8604} 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D919D95-5FC8-48aa-B8CC-463A235C8604}\stubpath = "C:\\Windows\\{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe" 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD} {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79C48190-C15E-4a45-9C23-708450D5CEAE}\stubpath = "C:\\Windows\\{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe" {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE} {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79C48190-C15E-4a45-9C23-708450D5CEAE} {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B} {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35632287-9DFB-4d74-969C-5A512A53C3C4} {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF} {BB84A230-234D-498c-914C-F29BFAF98E23}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}\stubpath = "C:\\Windows\\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe" {BB84A230-234D-498c-914C-F29BFAF98E23}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12DA1EBB-4BB9-4717-848C-041270C9F144} {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12DA1EBB-4BB9-4717-848C-041270C9F144}\stubpath = "C:\\Windows\\{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe" {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35} {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}\stubpath = "C:\\Windows\\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe" {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C} {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}\stubpath = "C:\\Windows\\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe" {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35632287-9DFB-4d74-969C-5A512A53C3C4}\stubpath = "C:\\Windows\\{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe" {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB84A230-234D-498c-914C-F29BFAF98E23}\stubpath = "C:\\Windows\\{BB84A230-234D-498c-914C-F29BFAF98E23}.exe" {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe -
Executes dropped EXE 12 IoCs
Processes:
{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe{BB84A230-234D-498c-914C-F29BFAF98E23}.exe{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exepid process 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe 3452 {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe 5040 {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe 3212 {70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exe -
Drops file in Windows directory 12 IoCs
Processes:
{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe{BB84A230-234D-498c-914C-F29BFAF98E23}.exedescription ioc process File created C:\Windows\{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe File created C:\Windows\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exe {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe File created C:\Windows\{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe File created C:\Windows\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe File created C:\Windows\{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe File created C:\Windows\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe File created C:\Windows\{BB84A230-234D-498c-914C-F29BFAF98E23}.exe {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe File created C:\Windows\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe File created C:\Windows\{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe File created C:\Windows\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe File created C:\Windows\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe File created C:\Windows\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe {BB84A230-234D-498c-914C-F29BFAF98E23}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe{BB84A230-234D-498c-914C-F29BFAF98E23}.exe{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe{12DA1EBB-4BB9-4717-848C-041270C9F144}.exedescription pid process Token: SeIncBasePriorityPrivilege 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe Token: SeIncBasePriorityPrivilege 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe Token: SeIncBasePriorityPrivilege 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe Token: SeIncBasePriorityPrivilege 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe Token: SeIncBasePriorityPrivilege 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe Token: SeIncBasePriorityPrivilege 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe Token: SeIncBasePriorityPrivilege 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe Token: SeIncBasePriorityPrivilege 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe Token: SeIncBasePriorityPrivilege 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe Token: SeIncBasePriorityPrivilege 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe Token: SeIncBasePriorityPrivilege 3452 {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe Token: SeIncBasePriorityPrivilege 5040 {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe{BB84A230-234D-498c-914C-F29BFAF98E23}.exe{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exedescription pid process target process PID 436 wrote to memory of 2348 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe PID 436 wrote to memory of 2348 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe PID 436 wrote to memory of 2348 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe PID 436 wrote to memory of 3236 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe cmd.exe PID 436 wrote to memory of 3236 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe cmd.exe PID 436 wrote to memory of 3236 436 2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe cmd.exe PID 2348 wrote to memory of 1680 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe PID 2348 wrote to memory of 1680 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe PID 2348 wrote to memory of 1680 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe PID 2348 wrote to memory of 4308 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe cmd.exe PID 2348 wrote to memory of 4308 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe cmd.exe PID 2348 wrote to memory of 4308 2348 {9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe cmd.exe PID 1680 wrote to memory of 3008 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe PID 1680 wrote to memory of 3008 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe PID 1680 wrote to memory of 3008 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe PID 1680 wrote to memory of 4588 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe cmd.exe PID 1680 wrote to memory of 4588 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe cmd.exe PID 1680 wrote to memory of 4588 1680 {52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe cmd.exe PID 3008 wrote to memory of 3784 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe PID 3008 wrote to memory of 3784 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe PID 3008 wrote to memory of 3784 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe PID 3008 wrote to memory of 3476 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe cmd.exe PID 3008 wrote to memory of 3476 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe cmd.exe PID 3008 wrote to memory of 3476 3008 {79C48190-C15E-4a45-9C23-708450D5CEAE}.exe cmd.exe PID 3784 wrote to memory of 404 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe PID 3784 wrote to memory of 404 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe PID 3784 wrote to memory of 404 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe PID 3784 wrote to memory of 1808 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe cmd.exe PID 3784 wrote to memory of 1808 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe cmd.exe PID 3784 wrote to memory of 1808 3784 {9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe cmd.exe PID 404 wrote to memory of 4844 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe PID 404 wrote to memory of 4844 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe PID 404 wrote to memory of 4844 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe PID 404 wrote to memory of 4292 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe cmd.exe PID 404 wrote to memory of 4292 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe cmd.exe PID 404 wrote to memory of 4292 404 {AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe cmd.exe PID 4844 wrote to memory of 1360 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe PID 4844 wrote to memory of 1360 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe PID 4844 wrote to memory of 1360 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe PID 4844 wrote to memory of 1252 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe cmd.exe PID 4844 wrote to memory of 1252 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe cmd.exe PID 4844 wrote to memory of 1252 4844 {5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe cmd.exe PID 1360 wrote to memory of 3260 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe PID 1360 wrote to memory of 3260 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe PID 1360 wrote to memory of 3260 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe PID 1360 wrote to memory of 3964 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe cmd.exe PID 1360 wrote to memory of 3964 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe cmd.exe PID 1360 wrote to memory of 3964 1360 {35632287-9DFB-4d74-969C-5A512A53C3C4}.exe cmd.exe PID 3260 wrote to memory of 2392 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe {BB84A230-234D-498c-914C-F29BFAF98E23}.exe PID 3260 wrote to memory of 2392 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe {BB84A230-234D-498c-914C-F29BFAF98E23}.exe PID 3260 wrote to memory of 2392 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe {BB84A230-234D-498c-914C-F29BFAF98E23}.exe PID 3260 wrote to memory of 4684 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe cmd.exe PID 3260 wrote to memory of 4684 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe cmd.exe PID 3260 wrote to memory of 4684 3260 {FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe cmd.exe PID 2392 wrote to memory of 3452 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe PID 2392 wrote to memory of 3452 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe PID 2392 wrote to memory of 3452 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe PID 2392 wrote to memory of 2980 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe cmd.exe PID 2392 wrote to memory of 2980 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe cmd.exe PID 2392 wrote to memory of 2980 2392 {BB84A230-234D-498c-914C-F29BFAF98E23}.exe cmd.exe PID 3452 wrote to memory of 5040 3452 {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe PID 3452 wrote to memory of 5040 3452 {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe PID 3452 wrote to memory of 5040 3452 {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe {12DA1EBB-4BB9-4717-848C-041270C9F144}.exe PID 3452 wrote to memory of 3092 3452 {3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_65d6d992173d27b5d51a5933ccb33880_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exeC:\Windows\{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exeC:\Windows\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52E30~1.EXE > nul4⤵
-
C:\Windows\{79C48190-C15E-4a45-9C23-708450D5CEAE}.exeC:\Windows\{79C48190-C15E-4a45-9C23-708450D5CEAE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exeC:\Windows\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exeC:\Windows\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exeC:\Windows\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35632287-9DFB-4d74-969C-5A512A53C3C4}.exeC:\Windows\{35632287-9DFB-4d74-969C-5A512A53C3C4}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exeC:\Windows\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB84A230-234D-498c-914C-F29BFAF98E23}.exeC:\Windows\{BB84A230-234D-498c-914C-F29BFAF98E23}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exeC:\Windows\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12DA1EBB-4BB9-4717-848C-041270C9F144}.exeC:\Windows\{12DA1EBB-4BB9-4717-848C-041270C9F144}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exeC:\Windows\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12DA1~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E228~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB84A~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA04B~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35632~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A1C1~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD7B4~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C782~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79C48~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D919~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\{12DA1EBB-4BB9-4717-848C-041270C9F144}.exeFilesize
180KB
MD533dd107650ce1c2654621d02f256e736
SHA17ec0910c56b045d00379651d082a436a3b7aa46f
SHA256fb56cf0d8f7631d9a8e17eb3e82cdb9e88de79a9835862ed8976d9258e38bfad
SHA512fc8eeda4bac1b7bac314921f1750ecaa00ace35a9dbe89d43ea28e989b21468d778592fc4b679c4880a49fc960e9268cad2231f98852c321e28f9e34911a4e06
-
C:\Windows\{35632287-9DFB-4d74-969C-5A512A53C3C4}.exeFilesize
180KB
MD515c072d4319f77f8e69320b8df55a62a
SHA11fe52ebf2cfa25301ab17fe409a5eaa1d4ddfc2c
SHA2562d70ac1d46d2782a2ed3951435a0f6455d4dc194165b3dfc639f00d313ad08e0
SHA51220f0197890d8a2ab3f7676055dea7b486671e6046f178a84643577040321910b520afb598fbdd6c611bbcc8686292c52e4b9550a3e08514665dbc51bbe08db5b
-
C:\Windows\{3E2282B1-24A6-4cb2-BFB0-3A9C2D3DD6EF}.exeFilesize
180KB
MD5a4c63d7620606a97fe372942d494c2d1
SHA1fea024e8c3d2be6d4d1733c7c00eaa2d7a616b43
SHA256ea428aead7f50ddd4a28e5df620405aaee64000e6437e7413563ddd6222caff8
SHA5125048ccc12d300cf385809d67194f92d45d7520dd64900c18f48f44fbf18660a8be38ef2745b924dd87aef4ddf55d993bc659f4f578a5aa134cb829c345b4d32b
-
C:\Windows\{52E30F2C-0EF3-4925-BBFE-ED0BA36B42DD}.exeFilesize
180KB
MD571b76487afb6ad8de2f2cb52dd679a7d
SHA164b8f03515e9e3dbd8e69c165d3aa464a74bf54f
SHA25675013be34b1d02a530f1ed68250d6964a53370faad2d5a9d8ea13627428d790d
SHA512b652e7cb92565ab1f090b94401fb76266bdceb38582fa3f11c381d496f6ecbb60dad9bcf7f07031528905b6e0abff07aeb985ad8aa1b2d072cec8ef49e575d40
-
C:\Windows\{5A1C1585-6FAE-436d-834C-24FB2E0FC118}.exeFilesize
180KB
MD594b08bfdec4dfa6c569954cb898f3b34
SHA1962a7399db8b7e9f5dd7f8c3f636c0ed82113502
SHA2561695dbb0d163bb530247e5bb1cb27b3a6f30ab56799e7ab2174ec63939ed2e7d
SHA512a4022494c2fdf4b797149d884a84370b342bfb28db281cf9ec93d69205ff03dcc66e1e309c3a9d732d02465ad0dfb90520da86487fb452b7879e6e685e5a0c76
-
C:\Windows\{70BCBF59-FB49-4fa4-9F5B-00BF443F3E35}.exeFilesize
180KB
MD53f25ecd194e1d76b72c998dc1730b18c
SHA112d1733ee1fc80df64899177a2994e5065dcf2fa
SHA256b330e75f3bb7dd0415248052926b6cfa5bdb0052c9aadc86bca8f9c3f5ef9efa
SHA5122ca66dc63c1359ece4db66c400f1ad35a4e5587c3208f87a17ae5ae0f2db5a5d793b5b152705e1df3f6a864cf3dc5f80651c51d2c52377d35100df96c059c25d
-
C:\Windows\{79C48190-C15E-4a45-9C23-708450D5CEAE}.exeFilesize
180KB
MD5315cd6c75ef6e64c20e501d49b69eb5b
SHA198030739cd5933a4fac86ac19b5e2813d7e74b93
SHA256fa6c8745d24fc9f27290cd9c376ea6cd077369854651f397820eeeb8d181eadd
SHA51214d9488bb7c47eb342b0138f50ad3c1a2e6fc1966ee372ef2e1561751602250f57a1b65fd8aa7f017aba40ef671aab011105386636aa74ca85dc09417bdad7ab
-
C:\Windows\{9C78216E-40A6-48cd-A3DF-F04F8BD34E1C}.exeFilesize
180KB
MD56ce54b86d6864541e67ee0a43f41fc63
SHA17f484ff1f39177ca5ab6a0ef828b43d5dbec9597
SHA256da719adb2686e2e7531beaccc560e9057a6bac95ca81e8350df1ec4b80972c7c
SHA512f77dcbcec0beb60b8fddf31c280ce1466f5d43d0ba7bf98d918582945360a61363e0dd149f5ae1ebe4e0d66bd9d9a0c740fb075f9e00b54ffa85e15c0c52a7a3
-
C:\Windows\{9D919D95-5FC8-48aa-B8CC-463A235C8604}.exeFilesize
180KB
MD535eb7811e74f26342c7347875a43f8b6
SHA1011194bc4385e5ad286e99d54eb6480cd120fbdb
SHA256b9c463e7ea242b7253704e33059935a5e12b0c78759a396e8e28372400113cc1
SHA512c57aab1266baee59dc67fbfa4ab0dbd049b3d2409e191f52fdbdf0685d0d47ba35bce2ed41df1a607ed41b612544c9a223857183e113b60b57e06f22fc0d8610
-
C:\Windows\{AD7B4B37-2EBC-4a6f-801F-1FED1808DE2B}.exeFilesize
180KB
MD505541e502d4c18cd59b548d00999844c
SHA16b2b59e10985653f88dad656e0b0e5f2cee21562
SHA256640ccb1d9d572fde8906665a07ab9385f54b8d0e759fa0994a7007962714d482
SHA5129d9e08f4fd2c90ed96c2421abb0f9437b79c1dda732b4471ae6dbc8fa9d9cc3d71a6ccbe7492cd68dcb9e9b0861264a53731cbcd987223bf855c2fa4cd57c69b
-
C:\Windows\{BB84A230-234D-498c-914C-F29BFAF98E23}.exeFilesize
180KB
MD5f905c10e5c15916ce6bcea99bff6c051
SHA19371fd4ea39283f007ea04200990aa6a05994a54
SHA2562fa59e96246f57e66068383bce86cec6be0c71c73125c91e09b9097c9e7f80d3
SHA512b537c1eb14e0dbe2642a5ef23f025543f9c377adf450d886ad7e2a6c7384d67cccb7b81fbee2e11e76c81768da1fdb5f330579af592651bb2e7ed050ee4ce7e0
-
C:\Windows\{FA04BCFD-9B06-4936-9F1E-86DE05F330FE}.exeFilesize
180KB
MD59135642de76350e50d38462851ed3f26
SHA17dbae5a5dd51a2e490ad962d3b02e2190a2c5778
SHA2562e97298735e78bf55a2efaad82d55ae7b5b4b54d2b1999bf7a7148ee26dc5016
SHA512e83591071bb1d47403da44e67267cc883cc25bea5299f3f37ddd1215f5e772e4b164f94584dc58e18bc3c32074028e84167bc296c5bc4c962b5146c1e7f3693b