Analysis
- max time kernel
151s - max time network
126s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/03/2024, 23:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe
- Size 197KB
- Sample240302-3p8evaah72
- SHA256 59d71a277048201508dee216abe54f9eda1e2b910761b94a0471d70f84544654
- MD5 ffd2ca11dfc585365e30c00b1cef4972
- SHA1 41d040ed94f6e721c3bcb4cb7d14abb35c907531
- SHA512 7ae175057ce8f14ac588d2671afa9cec7ae2f2e1a75dd82ea03a4ffcf7d01d96211d73534e262bd25832ca05264fea94a84355f2ead25adf3351b2f603a8ef1c
- SSDEEP 3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGolEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral1/files/0x000c00000001222a-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d000000016cc9-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002500000000b1f4-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed8-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002600000000b1f4-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed8-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002700000000b1f4-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed8-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002800000000b1f4-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed8-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x002900000000b1f4-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000004ed8-82.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B1B88954-6AAB-4da0-B98D-1FA79181135C}\stubpath = "C:\\Windows\\{B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe" {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}\stubpath = "C:\\Windows\\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe" {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6} {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}\stubpath = "C:\\Windows\\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe" {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55E79E20-1364-48a6-B7D4-0E42907D1159}\stubpath = "C:\\Windows\\{55E79E20-1364-48a6-B7D4-0E42907D1159}.exe" {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4} 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B1B88954-6AAB-4da0-B98D-1FA79181135C} {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEEEF4FE-C92B-498d-8449-501F4287BE91} {62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEEEF4FE-C92B-498d-8449-501F4287BE91}\stubpath = "C:\\Windows\\{DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe" {62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1748916-3154-43bb-86D6-BBBF93F76B3D} {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5382BCC6-3ECB-478f-81FF-053AB029670D}\stubpath = "C:\\Windows\\{5382BCC6-3ECB-478f-81FF-053AB029670D}.exe" {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1} {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55E79E20-1364-48a6-B7D4-0E42907D1159} {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5382BCC6-3ECB-478f-81FF-053AB029670D} {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248} {5382BCC6-3ECB-478f-81FF-053AB029670D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09} {7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}\stubpath = "C:\\Windows\\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe" {7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}\stubpath = "C:\\Windows\\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe" 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD} {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{881838D6-2E70-4201-998A-F437CBDF8FDA}\stubpath = "C:\\Windows\\{881838D6-2E70-4201-998A-F437CBDF8FDA}.exe" {DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}\stubpath = "C:\\Windows\\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe" {5382BCC6-3ECB-478f-81FF-053AB029670D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{881838D6-2E70-4201-998A-F437CBDF8FDA} {DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1748916-3154-43bb-86D6-BBBF93F76B3D}\stubpath = "C:\\Windows\\{D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe" {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}\stubpath = "C:\\Windows\\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe" {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe - Deletes itself 1 IoCs
pid Process 2704 cmd.exe - Executes dropped EXE 12 IoCs
pid Process 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 1868 {5382BCC6-3ECB-478f-81FF-053AB029670D}.exe 2516 {7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe 2172 {62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe 552 {DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe 1892 {881838D6-2E70-4201-998A-F437CBDF8FDA}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{881838D6-2E70-4201-998A-F437CBDF8FDA}.exe {DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe File created C:\Windows\{D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe File created C:\Windows\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe File created C:\Windows\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe File created C:\Windows\{5382BCC6-3ECB-478f-81FF-053AB029670D}.exe {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe File created C:\Windows\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe {5382BCC6-3ECB-478f-81FF-053AB029670D}.exe File created C:\Windows\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe {7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe File created C:\Windows\{DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe {62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe File created C:\Windows\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe File created C:\Windows\{B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe File created C:\Windows\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe File created C:\Windows\{55E79E20-1364-48a6-B7D4-0E42907D1159}.exe {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe Token: SeIncBasePriorityPrivilege 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe Token: SeIncBasePriorityPrivilege 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe Token: SeIncBasePriorityPrivilege 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe Token: SeIncBasePriorityPrivilege 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe Token: SeIncBasePriorityPrivilege 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe Token: SeIncBasePriorityPrivilege 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe Token: SeIncBasePriorityPrivilege 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe Token: SeIncBasePriorityPrivilege 1868 {5382BCC6-3ECB-478f-81FF-053AB029670D}.exe Token: SeIncBasePriorityPrivilege 2516 {7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe Token: SeIncBasePriorityPrivilege 2172 {62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe Token: SeIncBasePriorityPrivilege 552 {DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2676 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 28 PID 2512 wrote to memory of 2676 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 28 PID 2512 wrote to memory of 2676 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 28 PID 2512 wrote to memory of 2676 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 28 PID 2512 wrote to memory of 2704 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 29 PID 2512 wrote to memory of 2704 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 29 PID 2512 wrote to memory of 2704 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 29 PID 2512 wrote to memory of 2704 2512 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 29 PID 2676 wrote to memory of 2456 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 30 PID 2676 wrote to memory of 2456 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 30 PID 2676 wrote to memory of 2456 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 30 PID 2676 wrote to memory of 2456 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 30 PID 2676 wrote to memory of 2848 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 31 PID 2676 wrote to memory of 2848 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 31 PID 2676 wrote to memory of 2848 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 31 PID 2676 wrote to memory of 2848 2676 {342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe 31 PID 2456 wrote to memory of 2028 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 34 PID 2456 wrote to memory of 2028 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 34 PID 2456 wrote to memory of 2028 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 34 PID 2456 wrote to memory of 2028 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 34 PID 2456 wrote to memory of 1940 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 35 PID 2456 wrote to memory of 1940 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 35 PID 2456 wrote to memory of 1940 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 35 PID 2456 wrote to memory of 1940 2456 {B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe 35 PID 2028 wrote to memory of 1160 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 36 PID 2028 wrote to memory of 1160 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 36 PID 2028 wrote to memory of 1160 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 36 PID 2028 wrote to memory of 1160 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 36 PID 2028 wrote to memory of 580 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 37 PID 2028 wrote to memory of 580 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 37 PID 2028 wrote to memory of 580 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 37 PID 2028 wrote to memory of 580 2028 {D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe 37 PID 1160 wrote to memory of 2828 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 38 PID 1160 wrote to memory of 2828 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 38 PID 1160 wrote to memory of 2828 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 38 PID 1160 wrote to memory of 2828 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 38 PID 1160 wrote to memory of 2608 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 39 PID 1160 wrote to memory of 2608 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 39 PID 1160 wrote to memory of 2608 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 39 PID 1160 wrote to memory of 2608 1160 {B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe 39 PID 2828 wrote to memory of 2408 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 40 PID 2828 wrote to memory of 2408 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 40 PID 2828 wrote to memory of 2408 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 40 PID 2828 wrote to memory of 2408 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 40 PID 2828 wrote to memory of 1948 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 41 PID 2828 wrote to memory of 1948 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 41 PID 2828 wrote to memory of 1948 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 41 PID 2828 wrote to memory of 1948 2828 {EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe 41 PID 2408 wrote to memory of 2480 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 42 PID 2408 wrote to memory of 2480 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 42 PID 2408 wrote to memory of 2480 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 42 PID 2408 wrote to memory of 2480 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 42 PID 2408 wrote to memory of 1944 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 43 PID 2408 wrote to memory of 1944 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 43 PID 2408 wrote to memory of 1944 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 43 PID 2408 wrote to memory of 1944 2408 {E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe 43 PID 2480 wrote to memory of 1868 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 44 PID 2480 wrote to memory of 1868 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 44 PID 2480 wrote to memory of 1868 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 44 PID 2480 wrote to memory of 1868 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 44 PID 2480 wrote to memory of 1540 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 45 PID 2480 wrote to memory of 1540 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 45 PID 2480 wrote to memory of 1540 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 45 PID 2480 wrote to memory of 1540 2480 {55E79E20-1364-48a6-B7D4-0E42907D1159}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exeC:\Windows\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\{B1B88954-6AAB-4da0-B98D-1FA79181135C}.exeC:\Windows\{B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\{D1748916-3154-43bb-86D6-BBBF93F76B3D}.exeC:\Windows\{D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exeC:\Windows\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exeC:\Windows\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exeC:\Windows\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\{55E79E20-1364-48a6-B7D4-0E42907D1159}.exeC:\Windows\{55E79E20-1364-48a6-B7D4-0E42907D1159}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\{5382BCC6-3ECB-478f-81FF-053AB029670D}.exeC:\Windows\{5382BCC6-3ECB-478f-81FF-053AB029670D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exeC:\Windows\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Windows\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exeC:\Windows\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\{DEEEF4FE-C92B-498d-8449-501F4287BE91}.exeC:\Windows\{DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:552 -
C:\Windows\{881838D6-2E70-4201-998A-F437CBDF8FDA}.exeC:\Windows\{881838D6-2E70-4201-998A-F437CBDF8FDA}.exe13⤵
- Executes dropped EXE
PID:1892
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEEEF~1.EXE > nul13⤵PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62F7F~1.EXE > nul12⤵PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F48C~1.EXE > nul11⤵PID:2268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5382B~1.EXE > nul10⤵PID:2100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55E79~1.EXE > nul9⤵PID:1540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6A8C~1.EXE > nul8⤵PID:1944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA67F~1.EXE > nul7⤵PID:1948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4FED~1.EXE > nul6⤵PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1748~1.EXE > nul5⤵PID:580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1B88~1.EXE > nul4⤵PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{342F2~1.EXE > nul3⤵PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{342F2F65-6B81-4a33-8DFC-A359C7F5F6C4}.exe
- Size 197KB
- SHA256 1219e3bc1be973049042b2d30d766c795d7fca4d6bddf705917b8867379bd982
- MD5 0b467997753fba9b61fc7f7557fa4cc8
- SHA1 eeb1c5542c1b16931d1a25b3b6ec67a84283a836
- SHA512 08250e8142d4324fb0455222f0de5cc9bf890bee40d66bd419339f3a183b2dfca864213174f748a9d05311ebec8f4b3002865dc032799f0125fded43e5825525
- SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGflEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5382BCC6-3ECB-478f-81FF-053AB029670D}.exe
- Size 197KB
- SHA256 829738e55f6df5b84ea87d804564467519c75c92baab46f0e5a3fb3ca844bb59
- MD5 3c2a9b0bf09327f57069b60c1dccf29b
- SHA1 53b0b4ba2dde1b3ab049a737b5cdff1b775d4206
- SHA512 c083ac8d043efe55f11c4363315b80e9a02293fe9a735509027db3e7ae56356df85a1b8c660cc318e59c4627c759f9fd0e40e7b21345d39bc2b29d3b613fe7c6
- SSDEEP 3072:jEGh0oQl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGOlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{55E79E20-1364-48a6-B7D4-0E42907D1159}.exe
- Size 197KB
- SHA256 d4b3041fceafaa38b0c89107f116541cbeb699ed08f7b59e436c429ee274a858
- MD5 ace03106a6e98b53af9f87381cd9e848
- SHA1 04c8ed346c2a976acbd67c04f9ff00e36c7528a0
- SHA512 876a37e194bd4a5b51939292632538e969a29d482697344702025b0523e3e08047fc68db0c36e30582d42a1d1779d63effbfe978ff73fc0464764950c09acbfa
- SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG/lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{62F7F9A6-4A45-4fbc-893F-40BCC26B3B09}.exe
- Size 197KB
- SHA256 f9bdfe9105419b96626707342fdbf07162e7c9b8c6c420ea9891087b95a039c1
- MD5 3680ad52e14e8f4404f18fa6e0f5cbe5
- SHA1 cb8f740eda437e6125cb3774e176dbb717156c43
- SHA512 bc1bf5d00b05a06283e7c86b43ee4c39e252d4c6729cc6deff858ee9f7cfc28a65e4d66a38a5f1182a597952cb2d58b3a9a09d9149a7c52bed63b899bc997e9a
- SSDEEP 3072:jEGh0o8l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F48CF9B-07A6-4a1c-8FFC-F458EEA78248}.exe
- Size 197KB
- SHA256 95216ff3c1f0d28583e5d1add295af143b4df252d0a2e725ed85217b3546f546
- MD5 c6b2620898623e9db0a05636bc3e3199
- SHA1 878667245ee4c4d50cf8c42b774d0cdcce6c76e4
- SHA512 bb7e60690244cc58e739de4a2e508e38e3d8c647f3a5ea236d0c7948877ec16f6188350b4978c8cb1c62b08e68760b9bdb1c3601045c0758d244224aa890b4a4
- SSDEEP 3072:jEGh0oQl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{881838D6-2E70-4201-998A-F437CBDF8FDA}.exe
- Size 197KB
- SHA256 2a227b01a2f26a9ba409f9b019d043aa43fea265c56acfd809f235cefe09a881
- MD5 0b49e25c658aee664004bc7dfc85ddc5
- SHA1 6f6ee525d0505c3bc2fb3bcbbaab5cb9e3f6cc12
- SHA512 47d7402424062aa1a4a6d2d3e688fafdf87617e755794bcefd9eea5a4ba727be73aba6349d1bb3e5b6675bda54caa18b89fb8a61d45ec2971078f0f85cb2bc54
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGilEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B1B88954-6AAB-4da0-B98D-1FA79181135C}.exe
- Size 197KB
- SHA256 2653657a919c514a66edd286315805814b0fcae8a62d20118e9da3664d43fe1e
- MD5 360b3363eecf81def9c3ca2f08774eb1
- SHA1 1d5e4caadc6a92b489c3ef1a0a1003c9cd158bb5
- SHA512 5f11615fcb1211cae55b7a7b6011fd5587a5a5d528046080a52256a4ede85315bdfc020f13f10b006f2eff20d617f1cd893d9ad50661e16878423be2057f0d08
- SSDEEP 3072:jEGh0orl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGFlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B4FEDC1B-6AB5-4800-BA0D-43AC0652C3CD}.exe
- Size 197KB
- SHA256 b761d0fd8ed24a0b210c1cf7a91fe94f2f706bc1431792aadac828406140d647
- MD5 2539c56c4e76d2891e165e40e504a6be
- SHA1 676a3d48f41af06e1f69091a94e259b8d4ca3632
- SHA512 a78b4936b5adc619cf271653a1289996c3d197fad0bb77131f9721943fd2884d827f2af913ef6109b936ab4dae8cdfb2f7d535011476c69b87b0a1ca0730f2b3
- SSDEEP 3072:jEGh0o3l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGVlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D1748916-3154-43bb-86D6-BBBF93F76B3D}.exe
- Size 197KB
- SHA256 268b36e2488615166d7d0e85ed3f6e8c896106cf1511f0ac27b8a8c04ab19e71
- MD5 6ff383b41c5e35245ff2d21f4bb3e914
- SHA1 35de249d8153510b08ad7ec96a2f91dd844691f5
- SHA512 6586b018e932d7e6a6cf8058b0ba8b7302b303ba6c7124d75b0c2f1b7f9b94f82855ff5fbfdf713f3505ec1684395ba807656cbd5878c95d97db77bed16e1942
- SSDEEP 3072:jEGh0oUl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGalEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DEEEF4FE-C92B-498d-8449-501F4287BE91}.exe
- Size 197KB
- SHA256 830f39448abf0c202a64e8bd3c9d048df5699dacb02111121b8a05f9e7bf0a50
- MD5 0d01fd25176d13875db597b431637cd1
- SHA1 d238343ecb1dbcb82f92ea121f4876c2c8ed2939
- SHA512 be8329d8359c080a653168ecadf7ba6dff18683f79a2f739ff76499bb266966df32f53ca2c52df1d6fc4e4866a4f017e950a94a0c1cd98121b497e188ecd5444
- SSDEEP 3072:jEGh0ool+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG6lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E6A8C7D2-5858-4581-88F8-56E5AAF5E4C6}.exe
- Size 197KB
- SHA256 de6d06908efcc4abf6a7dc2c20aa093d3794d893861860bb0e89bb89db539716
- MD5 17e13ea8b0a50ab1c920a2afbb5efb95
- SHA1 2ee19209efe5656e1ec16a9c500b2b2b10a4cbb0
- SHA512 8b9c35f7d49eb4983981e98744a33bcd1a21c3247a524621a05029446f30a240eb296e802ea1072d00521055d1df1e4d178456fcc5170487227620a56715fa46
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGGlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EA67FBEA-D8C2-43dc-BEA8-9B0C042722D1}.exe
- Size 197KB
- SHA256 87ce813c859b3daac3f70361320efcdcec0fdaaeef4706d8b24fa37d65583d86
- MD5 94166c48574bf01d6fb61ddaa78835b5
- SHA1 300c6092515c7f61bb2722e6edd6e5996d0561ab
- SHA512 257e1b07ac1f4eda3edeb0d30492bd7aa24bb6b5399020fda706bbcd4ef89c39644ed288abdbd5655a2e2846c7cad58927eb722c7650a9545331070fc1ee6f04
- SSDEEP 3072:jEGh0oYl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGylEeKcAEca
- MD5 SHA1 SHA512 SSDEEP