Analysis
- max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 23:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe
- Size 197KB
- Sample240302-3ljbjsad61
- SHA256 6d85c75ec957e84294047451919a69ede4b8d93bbd5a95854b3e3418ef9451a3
- MD5 b6d3e1d5b3c6fff497c71d04ef12d89d
- SHA1 f4d286b2a74eb32604d681647aa45e4ca8994a26
- SHA512 9e6dc37e6cb6f85df228b86d66dac82cd0934423329a5cfbdeeadb6e2b7abadfb9789b32611a5dfeb8eb102cb52d6f4a6fc7e52e5f124f23e1efa67fbc65347f
- SSDEEP 3072:jEGh0oYl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG6lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00090000000231ed-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231e6-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023204-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023202-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023204-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023202-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023204-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023202-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023204-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231ff-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023202-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000231ff-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB076224-052A-44aa-9EF4-45D6A5172B4C}\stubpath = "C:\\Windows\\{CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe" {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A85594F1-C86D-4c37-BD38-AB898C684287} {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}\stubpath = "C:\\Windows\\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe" {A85594F1-C86D-4c37-BD38-AB898C684287}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D2047BA-C9E3-4bbd-83CD-C83479423495} {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2296F27-D612-42eb-B6C5-425081603187}\stubpath = "C:\\Windows\\{C2296F27-D612-42eb-B6C5-425081603187}.exe" {983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E19282FA-B866-4d62-B355-AA6518CF6E1C}\stubpath = "C:\\Windows\\{E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe" 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29763956-1B3A-40cd-90B8-1E8D2E812DCE}\stubpath = "C:\\Windows\\{29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe" {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB076224-052A-44aa-9EF4-45D6A5172B4C} {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794}\stubpath = "C:\\Windows\\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe" {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7} {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A85594F1-C86D-4c37-BD38-AB898C684287}\stubpath = "C:\\Windows\\{A85594F1-C86D-4c37-BD38-AB898C684287}.exe" {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D2047BA-C9E3-4bbd-83CD-C83479423495}\stubpath = "C:\\Windows\\{9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe" {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B46826E9-5DF5-40d7-9EED-577158A37A7F} {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B46826E9-5DF5-40d7-9EED-577158A37A7F}\stubpath = "C:\\Windows\\{B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe" {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2296F27-D612-42eb-B6C5-425081603187} {983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAC60A84-108D-4fe7-A374-DDB7157AB23A} {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAC60A84-108D-4fe7-A374-DDB7157AB23A}\stubpath = "C:\\Windows\\{DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe" {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F} {A85594F1-C86D-4c37-BD38-AB898C684287}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29763956-1B3A-40cd-90B8-1E8D2E812DCE} {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794} {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}\stubpath = "C:\\Windows\\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe" {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E19282FA-B866-4d62-B355-AA6518CF6E1C} 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98} {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}\stubpath = "C:\\Windows\\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe" {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe - Executes dropped EXE 12 IoCs
pid Process 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 5024 {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe 3956 {983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe 3252 {C2296F27-D612-42eb-B6C5-425081603187}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe File created C:\Windows\{DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe File created C:\Windows\{CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe File created C:\Windows\{A85594F1-C86D-4c37-BD38-AB898C684287}.exe {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe File created C:\Windows\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe {A85594F1-C86D-4c37-BD38-AB898C684287}.exe File created C:\Windows\{B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe File created C:\Windows\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe File created C:\Windows\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe File created C:\Windows\{C2296F27-D612-42eb-B6C5-425081603187}.exe {983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe File created C:\Windows\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe File created C:\Windows\{29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe File created C:\Windows\{9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe Token: SeIncBasePriorityPrivilege 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe Token: SeIncBasePriorityPrivilege 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe Token: SeIncBasePriorityPrivilege 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe Token: SeIncBasePriorityPrivilege 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe Token: SeIncBasePriorityPrivilege 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe Token: SeIncBasePriorityPrivilege 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe Token: SeIncBasePriorityPrivilege 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe Token: SeIncBasePriorityPrivilege 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe Token: SeIncBasePriorityPrivilege 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe Token: SeIncBasePriorityPrivilege 5024 {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe Token: SeIncBasePriorityPrivilege 3956 {983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 4068 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe 91 PID 3252 wrote to memory of 4068 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe 91 PID 3252 wrote to memory of 4068 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe 91 PID 3252 wrote to memory of 4868 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe 92 PID 3252 wrote to memory of 4868 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe 92 PID 3252 wrote to memory of 4868 3252 2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe 92 PID 4068 wrote to memory of 1624 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 93 PID 4068 wrote to memory of 1624 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 93 PID 4068 wrote to memory of 1624 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 93 PID 4068 wrote to memory of 1928 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 94 PID 4068 wrote to memory of 1928 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 94 PID 4068 wrote to memory of 1928 4068 {E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe 94 PID 1624 wrote to memory of 3728 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 97 PID 1624 wrote to memory of 3728 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 97 PID 1624 wrote to memory of 3728 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 97 PID 1624 wrote to memory of 2488 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 98 PID 1624 wrote to memory of 2488 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 98 PID 1624 wrote to memory of 2488 1624 {C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe 98 PID 3728 wrote to memory of 1448 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 100 PID 3728 wrote to memory of 1448 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 100 PID 3728 wrote to memory of 1448 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 100 PID 3728 wrote to memory of 4700 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 101 PID 3728 wrote to memory of 4700 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 101 PID 3728 wrote to memory of 4700 3728 {29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe 101 PID 1448 wrote to memory of 1964 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 102 PID 1448 wrote to memory of 1964 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 102 PID 1448 wrote to memory of 1964 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 102 PID 1448 wrote to memory of 2508 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 103 PID 1448 wrote to memory of 2508 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 103 PID 1448 wrote to memory of 2508 1448 {DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe 103 PID 1964 wrote to memory of 3112 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 104 PID 1964 wrote to memory of 3112 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 104 PID 1964 wrote to memory of 3112 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 104 PID 1964 wrote to memory of 3140 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 105 PID 1964 wrote to memory of 3140 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 105 PID 1964 wrote to memory of 3140 1964 {CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe 105 PID 3112 wrote to memory of 4424 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 106 PID 3112 wrote to memory of 4424 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 106 PID 3112 wrote to memory of 4424 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 106 PID 3112 wrote to memory of 1792 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 107 PID 3112 wrote to memory of 1792 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 107 PID 3112 wrote to memory of 1792 3112 {A85594F1-C86D-4c37-BD38-AB898C684287}.exe 107 PID 4424 wrote to memory of 2844 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 108 PID 4424 wrote to memory of 2844 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 108 PID 4424 wrote to memory of 2844 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 108 PID 4424 wrote to memory of 2604 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 109 PID 4424 wrote to memory of 2604 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 109 PID 4424 wrote to memory of 2604 4424 {2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe 109 PID 2844 wrote to memory of 2348 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 110 PID 2844 wrote to memory of 2348 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 110 PID 2844 wrote to memory of 2348 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 110 PID 2844 wrote to memory of 2528 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 111 PID 2844 wrote to memory of 2528 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 111 PID 2844 wrote to memory of 2528 2844 {9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe 111 PID 2348 wrote to memory of 5024 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 112 PID 2348 wrote to memory of 5024 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 112 PID 2348 wrote to memory of 5024 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 112 PID 2348 wrote to memory of 1404 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 113 PID 2348 wrote to memory of 1404 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 113 PID 2348 wrote to memory of 1404 2348 {B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe 113 PID 5024 wrote to memory of 3956 5024 {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe 114 PID 5024 wrote to memory of 3956 5024 {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe 114 PID 5024 wrote to memory of 3956 5024 {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe 114 PID 5024 wrote to memory of 116 5024 {A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_b6d3e1d5b3c6fff497c71d04ef12d89d_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\{E19282FA-B866-4d62-B355-AA6518CF6E1C}.exeC:\Windows\{E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exeC:\Windows\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\{29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exeC:\Windows\{29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\{DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exeC:\Windows\{DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\{CB076224-052A-44aa-9EF4-45D6A5172B4C}.exeC:\Windows\{CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\{A85594F1-C86D-4c37-BD38-AB898C684287}.exeC:\Windows\{A85594F1-C86D-4c37-BD38-AB898C684287}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exeC:\Windows\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\{9D2047BA-C9E3-4bbd-83CD-C83479423495}.exeC:\Windows\{9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\{B46826E9-5DF5-40d7-9EED-577158A37A7F}.exeC:\Windows\{B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exeC:\Windows\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exeC:\Windows\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3956 -
C:\Windows\{C2296F27-D612-42eb-B6C5-425081603187}.exeC:\Windows\{C2296F27-D612-42eb-B6C5-425081603187}.exe13⤵
- Executes dropped EXE
PID:3252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98343~1.EXE > nul13⤵PID:3316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0CF1~1.EXE > nul12⤵PID:116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4682~1.EXE > nul11⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D204~1.EXE > nul10⤵PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A848~1.EXE > nul9⤵PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8559~1.EXE > nul8⤵PID:1792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB076~1.EXE > nul7⤵PID:3140
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAC60~1.EXE > nul6⤵PID:2508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29763~1.EXE > nul5⤵PID:4700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0AFC~1.EXE > nul4⤵PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1928~1.EXE > nul3⤵PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{29763956-1B3A-40cd-90B8-1E8D2E812DCE}.exe
- Size 197KB
- SHA256 1d93b042b4a3fd54f945429d2943bb94b3208b841758fa419c6b99e836360bf0
- MD5 c1ba858ef452e322d622a781b5ee29d5
- SHA1 f79f5dd452f7bddf015e8396330fabc6b3bf8876
- SHA512 c84a34a9fb742cc464ec3488d4e245a0fd36a9833439f8dbff4da0a295aa1bce91ecf521f2b584fc9efbd97709e5dd6aaead19860b5f7f7b5d6b05fae813c7a5
- SSDEEP 3072:jEGh0o4l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGmlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2A848C3E-1BA0-4ede-B5E9-5A90C85DED5F}.exe
- Size 197KB
- SHA256 e6c59734b75aa10b77524c444a10af6bb646efc0fd7e406b0780000f9320bf08
- MD5 90a8e945b71574245c4527c9bfd98a56
- SHA1 19880f26bdcb7aa3a8e1f674f31c29c5c0844f4e
- SHA512 ac194ddb053198c0ed85978172d5545c8b0275d9de397cd951d5b5340e7478a6c956a683be535da3b6cc17cc8c92f2ee10719d6d945b98c032d749a6c964b4d9
- SSDEEP 3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG0lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{983438F9-734D-4d4a-B7AD-F8BE8A51E1F7}.exe
- Size 197KB
- SHA256 e9c3a94caf7c420b32345ec22abd5a2e17aafb9b241cd9af7c2fc3ddc30eba14
- MD5 002b728f6a15d031b5cc1127d9abb71e
- SHA1 534669ceae167c7b4f34284dc5dca1f877d111d9
- SHA512 226361a299c013c2d3ac43c4bf5853db0bd8dad5c66270266a29f7589a3e752335f750eea5031bd9910c8feb477b46c11c2f60760cb6c1d1a6803886a11b52b7
- SSDEEP 3072:jEGh0o6l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG8lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9D2047BA-C9E3-4bbd-83CD-C83479423495}.exe
- Size 197KB
- SHA256 e1dd5afda3ec4da808235774945b07ff4a7d5ce0f979d8fd0bca83adbf4ebce8
- MD5 c89bf2ecd82a09733aa49199a4a8f41a
- SHA1 d03bd41b691584722423fbce301badefc52799a7
- SHA512 1c17bf330cc4b0792bfbdd1f4ba2a4f64aa174387ed6914a08432d6e3fcb3619fb5d25bb26f1b5da869355efef8a7b7f1faaab4e8bfa62f93fd0291b8525d899
- SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGelEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A0CF1800-DDB4-4376-BAC2-74D03A0FC794}.exe
- Size 197KB
- SHA256 767d4a995b9de4cc95c81e0974da4135efdbc634a8777bbfc784f9636dcbe927
- MD5 4ed019f082437eadf4ccb783184c9a22
- SHA1 77febde25cec122a3ec8bc47b9bf4f95ef5c2799
- SHA512 b49e7a5f5cab0551f8d121d4a1644da9564b9acbc47907bd5abc5f6b73e0f27ad6f61e8f5a3f994c75058c153dcf9c8bfef7b73a4ec1b733a602c47166d816eb
- SSDEEP 3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGjlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A85594F1-C86D-4c37-BD38-AB898C684287}.exe
- Size 197KB
- SHA256 1cbd2dafff685aa53df29a1299d133831a2fe6d98724edf96ba2010b5174616e
- MD5 c674967e59084c5e1f571f5a9eec56c5
- SHA1 31f162f44996232a5321afb7e9e594b56c13ed8f
- SHA512 b3588bd59e83752dd833c3d70e30c3955c895f8f4e0d0d339bf86a2b2153a89c5845f6ca7264516ce92185ab6e79a1f6ea4b1254e51b03542368f822456f7e16
- SSDEEP 3072:jEGh0o2l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGYlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B46826E9-5DF5-40d7-9EED-577158A37A7F}.exe
- Size 197KB
- SHA256 b441e00b2cfac8a436893dd21f55ed1e7da9114c6743f36fc2e8360544aa3567
- MD5 48a636a71db85636e4d25fa1ec75d7d2
- SHA1 13a2b461186985c44d27d5df29a5826bf29e62ad
- SHA512 85cbb5aad0163d57ed134ff3d67a91b707a9087fc619546bcc25deb84b50080b93fe3e7c9a1ae6b58b5f313437f936b16fb8f5b23c71fa4f1de5688705049baf
- SSDEEP 3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C0AFC9B0-C45F-45e2-A6C5-BC44CB302C98}.exe
- Size 197KB
- SHA256 3ea379637c142314e50193c46b255c8b1eac896f7b6ea9bde8817115b1cade19
- MD5 1a35ecc4dc78d3cd07b3cfb49ffceb59
- SHA1 cfe39a8d3243b5ac3ec9639d21dad46a905ea984
- SHA512 f72309fd892868305d801c81abdea82eda2019638a6dc87f271f28197bed291176ce674d582a4d3650a819f447cd41f345d813d294e297886c024feb072db593
- SSDEEP 3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG0lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2296F27-D612-42eb-B6C5-425081603187}.exe
- Size 197KB
- SHA256 6142f0cd633906147f374cbed5af1a337a7dfdb26d945a2e53e644f47716823d
- MD5 cd80470eb38fc510bc57283ce0732daa
- SHA1 0b13b71f2fde82d9624580798a6006a260e509b6
- SHA512 356843a562e0f05b22200752053407ed70427db201c5aa2edb5434a1b8b504018a2d8c958e32001925c1f943c28925edf7a9d43301a737dc91f703a5f7ef5885
- SSDEEP 3072:jEGh0oQl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGulEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CB076224-052A-44aa-9EF4-45D6A5172B4C}.exe
- Size 197KB
- SHA256 7f6acbe619f81cd2a93af71ff6e918b19f76587834e3d3cca71577be18bbe74a
- MD5 58bfe1293ce0da5c0b3d359bd1f0a185
- SHA1 6b7db6f5a656a6b5c977abf3f3621e096afdc442
- SHA512 413cab831af3592afbd61298b0d3d949dfba3b4af3d4062e6591604417643218a40eb18ea71b91c41e8002ae50019cee47601dfef0a5123ec071fb1289ebd24f
- SSDEEP 3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG4lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DAC60A84-108D-4fe7-A374-DDB7157AB23A}.exe
- Size 197KB
- SHA256 25bb61f39c05230cdef063ab5225fe1678e7c11520d435f8a063f291eec406a4
- MD5 a5da061a83196d75fc925a2e569a4b5e
- SHA1 4e3b89dc96005bc0343276b2d8ea11928a07a47b
- SHA512 c5d8ff9721b8d8b7e3f6ec60afba3012c622c138d4658d9f3773844ec26c6f79b087a5cd8d58b019c1e8dec2bde2f5cd0177c2a2702ae0c591ceb243a6f6412f
- SSDEEP 3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E19282FA-B866-4d62-B355-AA6518CF6E1C}.exe
- Size 197KB
- SHA256 d125ccefa635e5c9b597c4d0a5708581c4304234cbec067f8b14e0b9784e22fe
- MD5 363a99f23f04ce7ea1ffa223e19cb89d
- SHA1 49efd80576cfb668d907fcf8fddc23205e743951
- SHA512 55ef8a25a4bd8f1878fde8310fdbcbe6ff63d4249dc57f9125e85e166c4e12a050d1786a87052883577c4a1a04e9e1172d6433b54f550e2ec5af4c6bb284a487
- SSDEEP 3072:jEGh0oFl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGnlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP