Analysis
- max time kernel
151s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 23:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe
- Size 197KB
- Sample240302-3p8evaah72
- SHA256 59d71a277048201508dee216abe54f9eda1e2b910761b94a0471d70f84544654
- MD5 ffd2ca11dfc585365e30c00b1cef4972
- SHA1 41d040ed94f6e721c3bcb4cb7d14abb35c907531
- SHA512 7ae175057ce8f14ac588d2671afa9cec7ae2f2e1a75dd82ea03a4ffcf7d01d96211d73534e262bd25832ca05264fea94a84355f2ead25adf3351b2f603a8ef1c
- SSDEEP 3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGolEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0009000000023261-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023254-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002326a-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000022e9f-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002326a-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000022e9f-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002326a-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000022e9f-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002326a-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000022e9f-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023267-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000022e9f-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}\stubpath = "C:\\Windows\\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe" {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{700A7591-ACB5-4fc0-8F0B-3500827C4742} {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8664032E-AC9D-4a9b-BE84-2EF75A11C461} {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87DE8B05-AC7B-442b-8348-54159BAD725B}\stubpath = "C:\\Windows\\{87DE8B05-AC7B-442b-8348-54159BAD725B}.exe" {90BEFD56-2323-4333-B655-D0D399C17FCA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F51780D-E715-455b-AC38-5C89CF1B97AC}\stubpath = "C:\\Windows\\{7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe" {9D46484B-E530-49cd-B409-054B58C94B54}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92} {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}\stubpath = "C:\\Windows\\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe" {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A} {41136AC5-111D-47c7-836B-C399D9940B18}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8664032E-AC9D-4a9b-BE84-2EF75A11C461}\stubpath = "C:\\Windows\\{8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe" {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90BEFD56-2323-4333-B655-D0D399C17FCA} {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87DE8B05-AC7B-442b-8348-54159BAD725B} {90BEFD56-2323-4333-B655-D0D399C17FCA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D46484B-E530-49cd-B409-054B58C94B54} 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D46484B-E530-49cd-B409-054B58C94B54}\stubpath = "C:\\Windows\\{9D46484B-E530-49cd-B409-054B58C94B54}.exe" 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}\stubpath = "C:\\Windows\\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe" {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41136AC5-111D-47c7-836B-C399D9940B18} {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{700A7591-ACB5-4fc0-8F0B-3500827C4742}\stubpath = "C:\\Windows\\{700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe" {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF} {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90BEFD56-2323-4333-B655-D0D399C17FCA}\stubpath = "C:\\Windows\\{90BEFD56-2323-4333-B655-D0D399C17FCA}.exe" {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F51780D-E715-455b-AC38-5C89CF1B97AC} {9D46484B-E530-49cd-B409-054B58C94B54}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E} {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}\stubpath = "C:\\Windows\\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe" {41136AC5-111D-47c7-836B-C399D9940B18}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF}\stubpath = "C:\\Windows\\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe" {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F} {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41136AC5-111D-47c7-836B-C399D9940B18}\stubpath = "C:\\Windows\\{41136AC5-111D-47c7-836B-C399D9940B18}.exe" {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe - Executes dropped EXE 12 IoCs
pid Process 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 2816 {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe 3456 {90BEFD56-2323-4333-B655-D0D399C17FCA}.exe 5072 {87DE8B05-AC7B-442b-8348-54159BAD725B}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe File created C:\Windows\{90BEFD56-2323-4333-B655-D0D399C17FCA}.exe {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe File created C:\Windows\{9D46484B-E530-49cd-B409-054B58C94B54}.exe 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe File created C:\Windows\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe File created C:\Windows\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe File created C:\Windows\{41136AC5-111D-47c7-836B-C399D9940B18}.exe {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe File created C:\Windows\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe {41136AC5-111D-47c7-836B-C399D9940B18}.exe File created C:\Windows\{700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe File created C:\Windows\{87DE8B05-AC7B-442b-8348-54159BAD725B}.exe {90BEFD56-2323-4333-B655-D0D399C17FCA}.exe File created C:\Windows\{7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe {9D46484B-E530-49cd-B409-054B58C94B54}.exe File created C:\Windows\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe File created C:\Windows\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe Token: SeIncBasePriorityPrivilege 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe Token: SeIncBasePriorityPrivilege 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe Token: SeIncBasePriorityPrivilege 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe Token: SeIncBasePriorityPrivilege 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe Token: SeIncBasePriorityPrivilege 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe Token: SeIncBasePriorityPrivilege 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe Token: SeIncBasePriorityPrivilege 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe Token: SeIncBasePriorityPrivilege 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe Token: SeIncBasePriorityPrivilege 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe Token: SeIncBasePriorityPrivilege 2816 {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe Token: SeIncBasePriorityPrivilege 3456 {90BEFD56-2323-4333-B655-D0D399C17FCA}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2456 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 98 PID 1744 wrote to memory of 2456 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 98 PID 1744 wrote to memory of 2456 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 98 PID 1744 wrote to memory of 1856 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 99 PID 1744 wrote to memory of 1856 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 99 PID 1744 wrote to memory of 1856 1744 2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe 99 PID 2456 wrote to memory of 2460 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 100 PID 2456 wrote to memory of 2460 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 100 PID 2456 wrote to memory of 2460 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 100 PID 2456 wrote to memory of 1616 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 101 PID 2456 wrote to memory of 1616 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 101 PID 2456 wrote to memory of 1616 2456 {9D46484B-E530-49cd-B409-054B58C94B54}.exe 101 PID 2460 wrote to memory of 3752 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 104 PID 2460 wrote to memory of 3752 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 104 PID 2460 wrote to memory of 3752 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 104 PID 2460 wrote to memory of 3600 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 105 PID 2460 wrote to memory of 3600 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 105 PID 2460 wrote to memory of 3600 2460 {7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe 105 PID 3752 wrote to memory of 3284 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 108 PID 3752 wrote to memory of 3284 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 108 PID 3752 wrote to memory of 3284 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 108 PID 3752 wrote to memory of 2536 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 109 PID 3752 wrote to memory of 2536 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 109 PID 3752 wrote to memory of 2536 3752 {C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe 109 PID 3284 wrote to memory of 1372 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 110 PID 3284 wrote to memory of 1372 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 110 PID 3284 wrote to memory of 1372 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 110 PID 3284 wrote to memory of 4832 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 111 PID 3284 wrote to memory of 4832 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 111 PID 3284 wrote to memory of 4832 3284 {FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe 111 PID 1372 wrote to memory of 1960 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 112 PID 1372 wrote to memory of 1960 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 112 PID 1372 wrote to memory of 1960 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 112 PID 1372 wrote to memory of 3972 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 113 PID 1372 wrote to memory of 3972 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 113 PID 1372 wrote to memory of 3972 1372 {CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe 113 PID 1960 wrote to memory of 4248 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 114 PID 1960 wrote to memory of 4248 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 114 PID 1960 wrote to memory of 4248 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 114 PID 1960 wrote to memory of 4908 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 115 PID 1960 wrote to memory of 4908 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 115 PID 1960 wrote to memory of 4908 1960 {41136AC5-111D-47c7-836B-C399D9940B18}.exe 115 PID 4248 wrote to memory of 4560 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 116 PID 4248 wrote to memory of 4560 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 116 PID 4248 wrote to memory of 4560 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 116 PID 4248 wrote to memory of 4924 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 117 PID 4248 wrote to memory of 4924 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 117 PID 4248 wrote to memory of 4924 4248 {3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe 117 PID 4560 wrote to memory of 4860 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 118 PID 4560 wrote to memory of 4860 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 118 PID 4560 wrote to memory of 4860 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 118 PID 4560 wrote to memory of 3116 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 119 PID 4560 wrote to memory of 3116 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 119 PID 4560 wrote to memory of 3116 4560 {700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe 119 PID 4860 wrote to memory of 2816 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 120 PID 4860 wrote to memory of 2816 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 120 PID 4860 wrote to memory of 2816 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 120 PID 4860 wrote to memory of 1640 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 121 PID 4860 wrote to memory of 1640 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 121 PID 4860 wrote to memory of 1640 4860 {3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe 121 PID 2816 wrote to memory of 3456 2816 {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe 122 PID 2816 wrote to memory of 3456 2816 {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe 122 PID 2816 wrote to memory of 3456 2816 {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe 122 PID 2816 wrote to memory of 5044 2816 {8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_ffd2ca11dfc585365e30c00b1cef4972_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\{9D46484B-E530-49cd-B409-054B58C94B54}.exeC:\Windows\{9D46484B-E530-49cd-B409-054B58C94B54}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\{7F51780D-E715-455b-AC38-5C89CF1B97AC}.exeC:\Windows\{7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exeC:\Windows\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exeC:\Windows\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exeC:\Windows\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\{41136AC5-111D-47c7-836B-C399D9940B18}.exeC:\Windows\{41136AC5-111D-47c7-836B-C399D9940B18}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exeC:\Windows\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\{700A7591-ACB5-4fc0-8F0B-3500827C4742}.exeC:\Windows\{700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exeC:\Windows\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\{8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exeC:\Windows\{8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\{90BEFD56-2323-4333-B655-D0D399C17FCA}.exeC:\Windows\{90BEFD56-2323-4333-B655-D0D399C17FCA}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3456 -
C:\Windows\{87DE8B05-AC7B-442b-8348-54159BAD725B}.exeC:\Windows\{87DE8B05-AC7B-442b-8348-54159BAD725B}.exe13⤵
- Executes dropped EXE
PID:5072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90BEF~1.EXE > nul13⤵PID:4916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86640~1.EXE > nul12⤵PID:5044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B879~1.EXE > nul11⤵PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{700A7~1.EXE > nul10⤵PID:3116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35843~1.EXE > nul9⤵PID:4924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41136~1.EXE > nul8⤵PID:4908
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD182~1.EXE > nul7⤵PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFE30~1.EXE > nul6⤵PID:4832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3B9B~1.EXE > nul5⤵PID:2536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F517~1.EXE > nul4⤵PID:3600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D464~1.EXE > nul3⤵PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:2468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{3584390B-B8E7-4a1b-A9EC-E4C0CC45F89A}.exe
- Size 197KB
- SHA256 a3bccee5d7ad8c698577953d391b356bf37bf645d2cfaa0c18802f97ad5df797
- MD5 0e91b5cdf61baf3d3fe949873b360a0b
- SHA1 f85db6214877ccbde2deaf188be29db385598655
- SHA512 bb3216a5fab94f1f68fcb91f428805a6e8da227f1b232c0108901b325694ec9d65330856d5b0cc7064cb20294429bf0a8872ce0d2d0f2cb7b6175ff3035205ba
- SSDEEP 3072:jEGh0opl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGLlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3B879320-AE4D-4500-BB6A-93C9AA58DAEF}.exe
- Size 197KB
- SHA256 04cd3d078cbc3c7e9f6b0df47296044d089c633ebf189b19b0ccb143a10ac981
- MD5 840ef3eb61f004a60264593430aae5bd
- SHA1 0eec6f489ee94d48a9f43776fb415886e7721c1e
- SHA512 7d43e1ab7455d0b8756104c08a4947f9b4dd392f9752b2254cf72474633cf01958b7017cc38ba25d59fddff042d3477d0419a3ef7feaa94cc831bb3e357fb113
- SSDEEP 3072:jEGh0onl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGZlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{41136AC5-111D-47c7-836B-C399D9940B18}.exe
- Size 197KB
- SHA256 7b16b6c54768666f115ccd619f1fed9135d4e03c2761cea75037849ae4791abd
- MD5 85492796298bafb44c6f2dcc6328e78a
- SHA1 2e84fc9c653ac2ec1d0306a6cd8eb46dd71765b5
- SHA512 88e623cc478fe3278986f035549fa733690c0eab34f4c38b52cbb98fb82bed44b8ade648203a4975d80f2afcf28188712c0e6303d8142e41cbe5cbf1b33e43c3
- SSDEEP 3072:jEGh0o0l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGalEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{700A7591-ACB5-4fc0-8F0B-3500827C4742}.exe
- Size 197KB
- SHA256 e390af1efdb8a44da55ce623e77128a231fcbd857c7238fcecf313143deed6eb
- MD5 b67909aae3c7c50ca9d5f009028b443b
- SHA1 430ffe0ce49e0dc376086cb38443ed9e7e93b89d
- SHA512 59bfb235a0714b94d3c042586647f271acbf0215c2194ea9ad97057282fccca9c48ecc0d7a4a70e4a3e9360a5b7a9aa27f24c68893b12cb5db2208ec8ea415da
- SSDEEP 3072:jEGh0ozl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGRlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F51780D-E715-455b-AC38-5C89CF1B97AC}.exe
- Size 197KB
- SHA256 04b9ff89c09bd11061313ba7830dc436be6ef445db83fb7d3e96c716e7a48bb2
- MD5 b7bd5a0168ec64507868162c28579697
- SHA1 577bd3518ac8722157a1c3a02379b4d6f89b0bb3
- SHA512 3f593cc04687e17c259a809df531155e12eaa7daba07464ce8cf7da9cd84c2a7a9b6b89ef89c64853db21d292fa7987da34cba2982e3e0061556cca847226db1
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGelEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8664032E-AC9D-4a9b-BE84-2EF75A11C461}.exe
- Size 197KB
- SHA256 a056e0654961af35d1a94f24e62b6a5dfdca134008f748a4c07d42a177a1f990
- MD5 50c4b998718614d97b745506fcd3c27a
- SHA1 bf5ad3629f1fe0c25daeb423143fc3286a811dff
- SHA512 60dd1fcb0125409c2fc1a42adcd2834100cbcf44c68219e9aefbe065c74d28ecd68cabb979e6d2c65d4d210364af5af310bb0c39430272541cafa217c9413d0f
- SSDEEP 3072:jEGh0o6l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG4lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{87DE8B05-AC7B-442b-8348-54159BAD725B}.exe
- Size 197KB
- SHA256 5547afc1855c52998880171a997b274ac2d8defde3f993bc90adf1f845648187
- MD5 b78aaa327ad61eb58aeec5b830586dd8
- SHA1 2d16b7f975ed3055aa45e4e5b2b2541d1d80afd7
- SHA512 3d8d1027cfb7cce0035bd51d017942a2d357e3656b10e71ad90ec7f029a42917699d94dc74fc58d042a146f31c54600e9ac44eb6ee9e3d05883ce586e486facb
- SSDEEP 3072:jEGh0oyZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGQlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{90BEFD56-2323-4333-B655-D0D399C17FCA}.exe
- Size 197KB
- SHA256 a1315e14712555743de0f4c4195c8fba71973e26d9b90c860340086220bbb962
- MD5 e3d31999e008044564c5a228968b30f6
- SHA1 0df775bef86b459a0b9536324de8f3d82b1ab09f
- SHA512 8836b9815859da9f10f3f76a3c1919aebff18273b1ea60a5bbcd57d57dd49412d807214a1a15cb19294e9e9642ca64c21a14b21c90fa2cc3c0d0db1003d0711c
- SSDEEP 3072:jEGh0o0l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGOlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9D46484B-E530-49cd-B409-054B58C94B54}.exe
- Size 197KB
- SHA256 71d447342d201ae1825cb38edd7ad5b9134e27eadab7ef5467dffb6955181c7f
- MD5 ec242117cd22ad172761c85cfeba617b
- SHA1 c0198eef4aba26b1c8ac9fb2abfd7946b7158a59
- SHA512 bc1559f7c7300f2cbc49796cb0464aeb45683fafbcd361c79c14ac232bafcf709c59401b4dade193ea4786aa0db6dc43ba539e6b4475fb74ecd51c520493d52f
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGClEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C3B9B3DB-B42C-4265-95BB-A8BEC50DDC92}.exe
- Size 197KB
- SHA256 1e7e014e247448dcbb032a62d1152b71d679ea45635a6d74d22e80e6773d0950
- MD5 0a5935171db0423bdf7f7940ca72b928
- SHA1 229e90a4e8fb55d486f1db9af6f3f712995c42ef
- SHA512 31dd7f8cbe1634c8d576f1e782bbb79edd37c995fb62d0922b7cc71f0372ce3809914a284be419bd4165fb86f50c7e992dfd3101e7e0262a165d0f66c429ebd9
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGulEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CD182B58-EADF-4e2d-BBC1-43E61F5F9C8F}.exe
- Size 197KB
- SHA256 396276ba3206576424837988d9b20941f86353725bbb233704532edd02c5e243
- MD5 74b38bc837ff2c31e7b81d1d6ab625b9
- SHA1 c10924d0752f69cd4775250822fdd65f648b2cd8
- SHA512 146edcbd3b5e8d43cd16cbafa3ac771eee7ab1b93a835948895c68017be122edca7b80a7955ec3857b69cf4a4d92a52256c827c7788b9c0b62229ce855520ee2
- SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGmlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FFE30B34-C0A6-48f5-8239-1BF1511D8A1E}.exe
- Size 197KB
- SHA256 a8eaf8acdeb9f510de93a0bf969c4947e3ca2fc46cdaf5f6d8b290b2277b6ddb
- MD5 90cbbf866e9438f9e7059dea2c33da59
- SHA1 03382b660a551b6f8eefcbcd387d7b50f4b2dd19
- SHA512 98fa13b2d1eae84633bbd74e53cb0b190f9eb045368b3a2bddbf265513a007cd3d9afa9af387b1cdff23cf57f3b880021ec86bcc39237a505026e65950d622d7
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGSlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP