Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe
-
Size
180KB
-
MD5
6c95a31298c2f30c2ebd563aa054f496
-
SHA1
70c2ae1b4d89a6a27aa08ebd07cda5e77390f20c
-
SHA256
9cd5791ec2b1578dd2c882a4c74e660649b60416780ca921984bbb2de16b69e6
-
SHA512
6a3b3bbbe87e2f121c3e4ca6943ccbf67ac0fb4939594a3f369151cb23dda4b50823b8fa9fabbbfb61ebe131236b1f624f5058f421c3de4ffeaa04cbd29b2cd4
-
SSDEEP
3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGKl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
Processes:
resource yara_rule C:\Windows\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{6174FB9E-CB83-4465-9489-08472BA40567}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe GoldenEyeRansomware_Dropper_MalformedZoomit C:\Windows\{13ED7576-4433-49f4-80FD-5F2056810AFE}.exe GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 22 IoCs
Processes:
{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe{6174FB9E-CB83-4465-9489-08472BA40567}.exe{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6174FB9E-CB83-4465-9489-08472BA40567}\stubpath = "C:\\Windows\\{6174FB9E-CB83-4465-9489-08472BA40567}.exe" {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6} {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}\stubpath = "C:\\Windows\\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe" {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6174FB9E-CB83-4465-9489-08472BA40567} {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}\stubpath = "C:\\Windows\\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe" 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}\stubpath = "C:\\Windows\\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe" {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE} {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{01BC055E-8F46-48e1-8FDF-48E86E7B7459} {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413} {01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}\stubpath = "C:\\Windows\\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe" {01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04} 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}\stubpath = "C:\\Windows\\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe" {6174FB9E-CB83-4465-9489-08472BA40567}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E} {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}\stubpath = "C:\\Windows\\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe" {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13ED7576-4433-49f4-80FD-5F2056810AFE}\stubpath = "C:\\Windows\\{13ED7576-4433-49f4-80FD-5F2056810AFE}.exe" {EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4A8DDE0-FB5B-4328-94B9-50E95123E368} {6174FB9E-CB83-4465-9489-08472BA40567}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D653817-7E1E-4daf-965B-813D3FD283E3}\stubpath = "C:\\Windows\\{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe" {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC} {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}\stubpath = "C:\\Windows\\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe" {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}\stubpath = "C:\\Windows\\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe" {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13ED7576-4433-49f4-80FD-5F2056810AFE} {EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D653817-7E1E-4daf-965B-813D3FD283E3} {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2680 cmd.exe -
Executes dropped EXE 11 IoCs
Processes:
{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe{6174FB9E-CB83-4465-9489-08472BA40567}.exe{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe{13ED7576-4433-49f4-80FD-5F2056810AFE}.exepid process 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe 2640 {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe 1644 {01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe 1712 {EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe 1660 {13ED7576-4433-49f4-80FD-5F2056810AFE}.exe -
Drops file in Windows directory 11 IoCs
Processes:
{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe{6174FB9E-CB83-4465-9489-08472BA40567}.exe{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe{7D653817-7E1E-4daf-965B-813D3FD283E3}.exedescription ioc process File created C:\Windows\{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe File created C:\Windows\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe File created C:\Windows\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe File created C:\Windows\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe {01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe File created C:\Windows\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe File created C:\Windows\{13ED7576-4433-49f4-80FD-5F2056810AFE}.exe {EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe File created C:\Windows\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe File created C:\Windows\{6174FB9E-CB83-4465-9489-08472BA40567}.exe {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe File created C:\Windows\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe {6174FB9E-CB83-4465-9489-08472BA40567}.exe File created C:\Windows\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe File created C:\Windows\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe{6174FB9E-CB83-4465-9489-08472BA40567}.exe{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exedescription pid process Token: SeIncBasePriorityPrivilege 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe Token: SeIncBasePriorityPrivilege 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe Token: SeIncBasePriorityPrivilege 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe Token: SeIncBasePriorityPrivilege 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe Token: SeIncBasePriorityPrivilege 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe Token: SeIncBasePriorityPrivilege 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe Token: SeIncBasePriorityPrivilege 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe Token: SeIncBasePriorityPrivilege 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe Token: SeIncBasePriorityPrivilege 2640 {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe Token: SeIncBasePriorityPrivilege 1644 {01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe Token: SeIncBasePriorityPrivilege 1712 {EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe{6174FB9E-CB83-4465-9489-08472BA40567}.exe{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exedescription pid process target process PID 2216 wrote to memory of 1552 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe PID 2216 wrote to memory of 1552 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe PID 2216 wrote to memory of 1552 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe PID 2216 wrote to memory of 1552 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe PID 2216 wrote to memory of 2680 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe cmd.exe PID 2216 wrote to memory of 2680 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe cmd.exe PID 2216 wrote to memory of 2680 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe cmd.exe PID 2216 wrote to memory of 2680 2216 2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe cmd.exe PID 1552 wrote to memory of 2560 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe {6174FB9E-CB83-4465-9489-08472BA40567}.exe PID 1552 wrote to memory of 2560 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe {6174FB9E-CB83-4465-9489-08472BA40567}.exe PID 1552 wrote to memory of 2560 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe {6174FB9E-CB83-4465-9489-08472BA40567}.exe PID 1552 wrote to memory of 2560 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe {6174FB9E-CB83-4465-9489-08472BA40567}.exe PID 1552 wrote to memory of 2668 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe cmd.exe PID 1552 wrote to memory of 2668 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe cmd.exe PID 1552 wrote to memory of 2668 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe cmd.exe PID 1552 wrote to memory of 2668 1552 {61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe cmd.exe PID 2560 wrote to memory of 2688 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe PID 2560 wrote to memory of 2688 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe PID 2560 wrote to memory of 2688 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe PID 2560 wrote to memory of 2688 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe PID 2560 wrote to memory of 2616 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe cmd.exe PID 2560 wrote to memory of 2616 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe cmd.exe PID 2560 wrote to memory of 2616 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe cmd.exe PID 2560 wrote to memory of 2616 2560 {6174FB9E-CB83-4465-9489-08472BA40567}.exe cmd.exe PID 2688 wrote to memory of 2100 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe PID 2688 wrote to memory of 2100 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe PID 2688 wrote to memory of 2100 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe PID 2688 wrote to memory of 2100 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe PID 2688 wrote to memory of 2904 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe cmd.exe PID 2688 wrote to memory of 2904 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe cmd.exe PID 2688 wrote to memory of 2904 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe cmd.exe PID 2688 wrote to memory of 2904 2688 {B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe cmd.exe PID 2100 wrote to memory of 2980 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe PID 2100 wrote to memory of 2980 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe PID 2100 wrote to memory of 2980 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe PID 2100 wrote to memory of 2980 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe PID 2100 wrote to memory of 2992 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe cmd.exe PID 2100 wrote to memory of 2992 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe cmd.exe PID 2100 wrote to memory of 2992 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe cmd.exe PID 2100 wrote to memory of 2992 2100 {DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe cmd.exe PID 2980 wrote to memory of 1620 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe PID 2980 wrote to memory of 1620 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe PID 2980 wrote to memory of 1620 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe PID 2980 wrote to memory of 1620 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe PID 2980 wrote to memory of 364 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe cmd.exe PID 2980 wrote to memory of 364 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe cmd.exe PID 2980 wrote to memory of 364 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe cmd.exe PID 2980 wrote to memory of 364 2980 {7D653817-7E1E-4daf-965B-813D3FD283E3}.exe cmd.exe PID 1620 wrote to memory of 308 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe PID 1620 wrote to memory of 308 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe PID 1620 wrote to memory of 308 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe PID 1620 wrote to memory of 308 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe PID 1620 wrote to memory of 1332 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe cmd.exe PID 1620 wrote to memory of 1332 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe cmd.exe PID 1620 wrote to memory of 1332 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe cmd.exe PID 1620 wrote to memory of 1332 1620 {637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe cmd.exe PID 308 wrote to memory of 2640 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe PID 308 wrote to memory of 2640 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe PID 308 wrote to memory of 2640 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe PID 308 wrote to memory of 2640 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe {177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe PID 308 wrote to memory of 700 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe cmd.exe PID 308 wrote to memory of 700 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe cmd.exe PID 308 wrote to memory of 700 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe cmd.exe PID 308 wrote to memory of 700 308 {12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exeC:\Windows\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6174FB9E-CB83-4465-9489-08472BA40567}.exeC:\Windows\{6174FB9E-CB83-4465-9489-08472BA40567}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exeC:\Windows\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exeC:\Windows\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D653817-7E1E-4daf-965B-813D3FD283E3}.exeC:\Windows\{7D653817-7E1E-4daf-965B-813D3FD283E3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exeC:\Windows\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exeC:\Windows\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exeC:\Windows\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exeC:\Windows\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exeC:\Windows\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{13ED7576-4433-49f4-80FD-5F2056810AFE}.exeC:\Windows\{13ED7576-4433-49f4-80FD-5F2056810AFE}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA7B1~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01BC0~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{177E9~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12F70~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63757~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D653~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB490~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4A8D~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6174F~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61DED~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\{01BC055E-8F46-48e1-8FDF-48E86E7B7459}.exeFilesize
180KB
MD50c02429dd65543ba6f879fb97757719c
SHA114971590f6f895b5c0d4ae3e64cc8981e192dbcd
SHA256c65f845f4ebaf81f08c4c313999126ed0a2af59990a9fb7dfce74254f22fc18b
SHA512c9899c557763b1688f65acfa30983941968f2b846d22a0b15d23c3b5b5ed0c82a4b5a3a7d30f9522fd9c86e67f7acf156f266f94af8f6651cb0bd3f1c0992667
-
C:\Windows\{12F708C2-9075-4bf4-8E8F-BA6D4C3193FE}.exeFilesize
180KB
MD568233ee4c131fc17a08f77d28da0c511
SHA14528a61b0a75957895a3b7bd41f055050ed2c92a
SHA25628239513fa8491b517a38328e1deb3cdadc9ef19bed9ade07797a976f5b8caa4
SHA51296a755ecf8ff8d485b41dddc7055658f5288d83d5598987703f9783c8f2c073516f7fa8836a7b15bfa1e81461fcfa741ed984635f3da49de99f0b8e7d171af5e
-
C:\Windows\{13ED7576-4433-49f4-80FD-5F2056810AFE}.exeFilesize
180KB
MD5cc21ad6fe7b2e8e6593fa2703a82cf6d
SHA17e06ec4aaa53df925a3ce9a6ce8fdd068b767440
SHA2569f70ad8346691f2ca594c39ab0ca852ad8fdde923e29c2dc1cbf1f131aea625c
SHA512a12116d05a848d92a6e539f7db038a6e6c26c51f7e4c9ea3535da0eee5b956881f59a5522284e8fda0d2660a5a308951666875627f73f071a3e151f9468e209d
-
C:\Windows\{177E915B-C9D2-4949-8E08-7F2FB04DA0AC}.exeFilesize
180KB
MD50a1e9449d623dce573e6b6e3635bf959
SHA1d0bb0ad8bf8a983bab4d2eea4273fe7e2e102622
SHA256d1b6471b82280342d6366914bd2517512dbef37d7950ea0f51b24adb71e5ca04
SHA51272da5214795eea4dd3edcb10b61fa9285559dc28412a89dc915dbce79068712dec1d03032b02fd828b180501e795db8865291807ec39cb0f6f1136ec95239393
-
C:\Windows\{6174FB9E-CB83-4465-9489-08472BA40567}.exeFilesize
180KB
MD5f5e9ed1ac346aebc3301b2cc4880896a
SHA1f127d8e4e81d3c080dab6a4b8fe120369993dda2
SHA25664bff70826337d21bef8f4fc1cb94e93357b91b2dcd6844a9b833a3be716e4ff
SHA512682986cf47bc60b726377c39b414273f44cf18364b73f4e5f6411a53e558c76e1b65111becd8701ede0e79abe79bf819fa59e6dad2b20c34435465ec652d5f6c
-
C:\Windows\{61DED4D5-8183-45dd-91B6-C4BEEDD96F04}.exeFilesize
180KB
MD501b2343edd9c3059e6d682e3ecb90c29
SHA173950015655f1b6218ba239772387d41c23abbf6
SHA25632b6d92be6ad2557bd3c95967f6f7a9f71ac84f6c8030d69b5f0e13316d2858f
SHA512c467b3cf59189015ce3182b1e9b73a13507d3b42d2184b104675c71947da37adc1086f30db00f348c5a09fe0b91f9b89651e3f94d24bd080eda0cc2b80ba68e5
-
C:\Windows\{637572DC-BAC8-4b95-8A21-E68DA3B2D49E}.exeFilesize
180KB
MD5f2242f0636b7537e41a5ebf9cfc540d6
SHA12a81fe529e2c70ada231a3c0df281fe1c7173be6
SHA2561fabdb9b06e6dd6a5938eaa0ded5d85c40edca177b86e63d1cfbfc89a9872042
SHA51241e5a6b7042bc8280913e4442f20432714623e34b181e29f3f0d7fdfe5335e1a3c0ceda092069ddea090b57b66365116ea51316f7eff999fde7daa60689369e8
-
C:\Windows\{7D653817-7E1E-4daf-965B-813D3FD283E3}.exeFilesize
180KB
MD5ce49b60bb67211d84ff815711c911818
SHA129128b89b39970b091231984cf3387155d0fc7e7
SHA25694ce035cf2dea8a12b318ada87af1356476dc0f6a91396fa39f2c992a0493164
SHA51274bf95be1438cd6cc3efdd3e81114be00a20493b9bcb28ff412fb058cff111f212c4024e805208ebccd2d8f9e8b652a5c00c4873145d1788a582ffc5063a8461
-
C:\Windows\{B4A8DDE0-FB5B-4328-94B9-50E95123E368}.exeFilesize
180KB
MD5d440e6eab1c793fd9b9531f621fa7775
SHA162f7939718b85571b611c108bcd633f39b5a5b5f
SHA2565b51269ecfe646e11bdb93b942dec944ea5dacd604cf8fde3bd8e71bca0a7c8a
SHA512e6693bb325e9129b7b686d63829b5f3073027336468a02eb2b151178c46131e1a6a152f6e621cba6c1843802b74fe64b5f5f30287083812a90985502f9f6a935
-
C:\Windows\{DB4905E8-08FE-43c3-B44C-DE7C813A75D6}.exeFilesize
180KB
MD5c22185648d7dcda6974fae7747d2d4ca
SHA1e92dca61afe80f16ae39b9b04dab33f2049107bf
SHA256fa5eef88901a6403095229100daafbc85e61a0db184d36cacfc1fbd2b5635ebd
SHA51269f776937dcf19a0874f1a824df2b4c9c3d2f08756f12c46dea3f27e041f412bab81afcb7b818f635e9f36f74c3b220a3b1cd92864e3065693c3c6998317a2c4
-
C:\Windows\{EA7B1D57-FCEF-47f3-BEE8-607EC052D413}.exeFilesize
180KB
MD5f0717803f4d8b79950e3b65e356ed786
SHA10c187531dd26c8132404b61ee1ec2de4f8a4e101
SHA256007a3385d1310c602930b26f57761a52db9d4c3eb58d6d2bc03b9f1fa70fd457
SHA5124edc25405812d8c9f385ddad828878da3445a90ef5038a107dc9deb27561e3140e0a5b11ae1db89aa9f27964149207011952e1f69e9582e803e99717a0891ce8