Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 13:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe
- Size 344KB
- Sample240302-q63jpsec66
- SHA256 331c46cf48a8fdd6d111ac9b76e73a9cb493065cba66b2d23ca011818dc74ff4
- MD5 ce21b9f08b9b91b022d94fcecc204d88
- SHA1 e376868e3959dd4c50e09720dbb80253d78ac649
- SHA512 c6de050bd1d8d664bf5e0dc28fb1b7f837f47f89943a842a6c2d43726fbf69f8ffaf692d76313f1a725d22abf2f8a82e93a529c643a8458761a70eca039f3fdc
- SSDEEP 3072:mEGh0oHlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGFlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000900000002327e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023280-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023288-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000022e9f-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023277-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000022e9f-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000001e3d2-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000022e9f-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000001e3d2-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000022e9f-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d00000002309a-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000022e9f-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}\stubpath = "C:\\Windows\\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe" {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F628047-D4E4-4337-9420-0FB61930DC5F}\stubpath = "C:\\Windows\\{9F628047-D4E4-4337-9420-0FB61930DC5F}.exe" {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434} {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22724128-233B-412a-A46C-4C11B6438CF1} {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6} {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7}\stubpath = "C:\\Windows\\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe" {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F628047-D4E4-4337-9420-0FB61930DC5F} {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{297E7692-3FC7-4b0c-B825-6C7E445596E0} {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC}\stubpath = "C:\\Windows\\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe" {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A} {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC} {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7} {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{297E7692-3FC7-4b0c-B825-6C7E445596E0}\stubpath = "C:\\Windows\\{297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe" {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}\stubpath = "C:\\Windows\\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe" {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22724128-233B-412a-A46C-4C11B6438CF1}\stubpath = "C:\\Windows\\{22724128-233B-412a-A46C-4C11B6438CF1}.exe" {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2C8C25F-8332-4ad2-955E-A57524FE2837} {22724128-233B-412a-A46C-4C11B6438CF1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF} {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E36A988-F953-4200-BD60-87C23E5C265B}\stubpath = "C:\\Windows\\{9E36A988-F953-4200-BD60-87C23E5C265B}.exe" {F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09}\stubpath = "C:\\Windows\\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe" 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF}\stubpath = "C:\\Windows\\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe" {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}\stubpath = "C:\\Windows\\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe" {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2C8C25F-8332-4ad2-955E-A57524FE2837}\stubpath = "C:\\Windows\\{F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe" {22724128-233B-412a-A46C-4C11B6438CF1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E36A988-F953-4200-BD60-87C23E5C265B} {F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09} 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe - Executes dropped EXE 12 IoCs
pid Process 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 4240 {22724128-233B-412a-A46C-4C11B6438CF1}.exe 5084 {F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe 4208 {9E36A988-F953-4200-BD60-87C23E5C265B}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe File created C:\Windows\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe File created C:\Windows\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe File created C:\Windows\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe File created C:\Windows\{9F628047-D4E4-4337-9420-0FB61930DC5F}.exe {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe File created C:\Windows\{22724128-233B-412a-A46C-4C11B6438CF1}.exe {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe File created C:\Windows\{F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe {22724128-233B-412a-A46C-4C11B6438CF1}.exe File created C:\Windows\{9E36A988-F953-4200-BD60-87C23E5C265B}.exe {F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe File created C:\Windows\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe File created C:\Windows\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe File created C:\Windows\{297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe File created C:\Windows\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe Token: SeIncBasePriorityPrivilege 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe Token: SeIncBasePriorityPrivilege 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe Token: SeIncBasePriorityPrivilege 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe Token: SeIncBasePriorityPrivilege 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe Token: SeIncBasePriorityPrivilege 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe Token: SeIncBasePriorityPrivilege 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe Token: SeIncBasePriorityPrivilege 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe Token: SeIncBasePriorityPrivilege 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe Token: SeIncBasePriorityPrivilege 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe Token: SeIncBasePriorityPrivilege 4240 {22724128-233B-412a-A46C-4C11B6438CF1}.exe Token: SeIncBasePriorityPrivilege 5084 {F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1844 wrote to memory of 224 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe 97 PID 1844 wrote to memory of 224 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe 97 PID 1844 wrote to memory of 224 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe 97 PID 1844 wrote to memory of 4644 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe 98 PID 1844 wrote to memory of 4644 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe 98 PID 1844 wrote to memory of 4644 1844 2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe 98 PID 224 wrote to memory of 1144 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 99 PID 224 wrote to memory of 1144 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 99 PID 224 wrote to memory of 1144 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 99 PID 224 wrote to memory of 3564 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 100 PID 224 wrote to memory of 3564 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 100 PID 224 wrote to memory of 3564 224 {1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe 100 PID 1144 wrote to memory of 3152 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 103 PID 1144 wrote to memory of 3152 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 103 PID 1144 wrote to memory of 3152 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 103 PID 1144 wrote to memory of 4828 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 104 PID 1144 wrote to memory of 4828 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 104 PID 1144 wrote to memory of 4828 1144 {A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe 104 PID 3152 wrote to memory of 1484 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 107 PID 3152 wrote to memory of 1484 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 107 PID 3152 wrote to memory of 1484 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 107 PID 3152 wrote to memory of 1960 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 108 PID 3152 wrote to memory of 1960 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 108 PID 3152 wrote to memory of 1960 3152 {BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe 108 PID 1484 wrote to memory of 1996 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 109 PID 1484 wrote to memory of 1996 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 109 PID 1484 wrote to memory of 1996 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 109 PID 1484 wrote to memory of 2152 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 110 PID 1484 wrote to memory of 2152 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 110 PID 1484 wrote to memory of 2152 1484 {E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe 110 PID 1996 wrote to memory of 1616 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 111 PID 1996 wrote to memory of 1616 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 111 PID 1996 wrote to memory of 1616 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 111 PID 1996 wrote to memory of 4156 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 112 PID 1996 wrote to memory of 4156 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 112 PID 1996 wrote to memory of 4156 1996 {5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe 112 PID 1616 wrote to memory of 1844 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 113 PID 1616 wrote to memory of 1844 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 113 PID 1616 wrote to memory of 1844 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 113 PID 1616 wrote to memory of 4444 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 114 PID 1616 wrote to memory of 4444 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 114 PID 1616 wrote to memory of 4444 1616 {EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe 114 PID 1844 wrote to memory of 2656 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 115 PID 1844 wrote to memory of 2656 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 115 PID 1844 wrote to memory of 2656 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 115 PID 1844 wrote to memory of 3980 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 116 PID 1844 wrote to memory of 3980 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 116 PID 1844 wrote to memory of 3980 1844 {9F628047-D4E4-4337-9420-0FB61930DC5F}.exe 116 PID 2656 wrote to memory of 552 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 117 PID 2656 wrote to memory of 552 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 117 PID 2656 wrote to memory of 552 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 117 PID 2656 wrote to memory of 824 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 118 PID 2656 wrote to memory of 824 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 118 PID 2656 wrote to memory of 824 2656 {297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe 118 PID 552 wrote to memory of 4240 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 119 PID 552 wrote to memory of 4240 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 119 PID 552 wrote to memory of 4240 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 119 PID 552 wrote to memory of 4068 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 120 PID 552 wrote to memory of 4068 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 120 PID 552 wrote to memory of 4068 552 {E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe 120 PID 4240 wrote to memory of 5084 4240 {22724128-233B-412a-A46C-4C11B6438CF1}.exe 121 PID 4240 wrote to memory of 5084 4240 {22724128-233B-412a-A46C-4C11B6438CF1}.exe 121 PID 4240 wrote to memory of 5084 4240 {22724128-233B-412a-A46C-4C11B6438CF1}.exe 121 PID 4240 wrote to memory of 4488 4240 {22724128-233B-412a-A46C-4C11B6438CF1}.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_ce21b9f08b9b91b022d94fcecc204d88_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exeC:\Windows\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exeC:\Windows\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exeC:\Windows\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exeC:\Windows\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exeC:\Windows\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exeC:\Windows\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\{9F628047-D4E4-4337-9420-0FB61930DC5F}.exeC:\Windows\{9F628047-D4E4-4337-9420-0FB61930DC5F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\{297E7692-3FC7-4b0c-B825-6C7E445596E0}.exeC:\Windows\{297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exeC:\Windows\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\{22724128-233B-412a-A46C-4C11B6438CF1}.exeC:\Windows\{22724128-233B-412a-A46C-4C11B6438CF1}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\{F2C8C25F-8332-4ad2-955E-A57524FE2837}.exeC:\Windows\{F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5084 -
C:\Windows\{9E36A988-F953-4200-BD60-87C23E5C265B}.exeC:\Windows\{9E36A988-F953-4200-BD60-87C23E5C265B}.exe13⤵
- Executes dropped EXE
PID:4208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2C8C~1.EXE > nul13⤵PID:3440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22724~1.EXE > nul12⤵PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E64F3~1.EXE > nul11⤵PID:4068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{297E7~1.EXE > nul10⤵PID:824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F628~1.EXE > nul9⤵PID:3980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB3D0~1.EXE > nul8⤵PID:4444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5113F~1.EXE > nul7⤵PID:4156
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2CEE~1.EXE > nul6⤵PID:2152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA794~1.EXE > nul5⤵PID:1960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2780~1.EXE > nul4⤵PID:4828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A2C8~1.EXE > nul3⤵PID:3564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:4860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1A2C85F8-A78B-4eca-A76C-18240F3BEB09}.exe
- Size 344KB
- SHA256 fe462af8fc3ac5c4cf368a28daef6aadada3f77626c726acf1e75e84a6729f7f
- MD5 ff6054b7e638dd36cc868f55e26b29db
- SHA1 89354f8a8f5d86430a322788c6a96f2d1c84fb37
- SHA512 931e18f0e0364683c319593817669d0356922c084f4632497fa9153180faae8d50bb5bc01a3912c3721c4349c744dcc641468f2d38f821f82424850c5424f2a5
- SSDEEP 3072:mEGh0o0lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG+lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{22724128-233B-412a-A46C-4C11B6438CF1}.exe
- Size 344KB
- SHA256 216f6f11ad0e7f1887eafb4d6aaf57af0a73e833fc002bd59308d0a712efb319
- MD5 98940854f68fbd10928172d325dbcc85
- SHA1 8d20d23703d1c065d6852fccf9c33ed0c708fd12
- SHA512 4bb36cde5131e49d2dcc16f9047284b9adae8df0bf9c0a6d1c4641001801d3ef2e235bd2128e8daefc6f7bb3f30a4abe8668e23d3a3590d545687a3a7ecbeb2e
- SSDEEP 3072:mEGh0o8lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGulqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{297E7692-3FC7-4b0c-B825-6C7E445596E0}.exe
- Size 344KB
- SHA256 f0a51043e21463ff13bb312f3c598f6bd52e8f09308b6b0539ba123adbe6ace6
- MD5 c3af04cf9b25c4295f56148a26bd8997
- SHA1 8feb37142da3000a4080775de042bd5a0a92097f
- SHA512 181025940d0b6d156e72c3411ffa8b5e93517e9175b1e42da6f33a84067bc922b03f621610fa8d76ac4c2130f25f1e3dde2f2845c0d1514f06d234371f3d6d8d
- SSDEEP 3072:mEGh0oJlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG/lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5113F77B-4F38-4a9f-9E32-CDC28899E8FC}.exe
- Size 344KB
- SHA256 0e838dab15b58f4d7ae0901ce0daebb653cbaaef80002a8dcc3216af36dde846
- MD5 3ef98439d3f45e54aaf14e2d157a92a3
- SHA1 8bd41b62a66b3a77d296b5406fd38199f575f15f
- SHA512 c381b7460162b3377142ebd6a0478c091180bd645b407cdef403b643957af7a98474ea1f159deab57bc21cc0676cba9ea8345262487bf32512dd0295682a56a1
- SSDEEP 3072:mEGh0oglEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGulqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9E36A988-F953-4200-BD60-87C23E5C265B}.exe
- Size 344KB
- SHA256 493c30e60091637ec4c668c528c4821bb6016dd535253ea09bcc14c4029d21cd
- MD5 5772d556ef37d63ca5ab7611220235aa
- SHA1 d0df211d03e32bb087189771ef65bb796f28324e
- SHA512 0f8efe84275f199cee552968e4cd7c4947609d702f7a956e47409d7dabff0f877eb121ed100d5fd4bc3392c44a099f44c18dedea7c4b8c578912ad8c34640c83
- SSDEEP 3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGXlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9F628047-D4E4-4337-9420-0FB61930DC5F}.exe
- Size 344KB
- SHA256 8d28bdecace428c4677ce6356af6c20347da5e0943087c9af45939fd7ca6a9ec
- MD5 bb0703f448ffe59ffd5e505bd059467e
- SHA1 4ac033b0d253fb99e545538a2d9dae95dfa6dad1
- SHA512 9aa9fb8fc7bf1d30a3b612e6ff41727f3fc1c188c02fb2aa1eea46ad61a347c9240fff7025be57456ffbf82eb7d879330b6509dda004591f755381e068e8f33a
- SSDEEP 3072:mEGh0oOlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGolqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A2780302-EF02-4c76-A3B5-7A77FF20C1DF}.exe
- Size 344KB
- SHA256 864af16e5b52c95df822c8941b8bd31ae7cf5db1917b34edd071b36edab8fa72
- MD5 53fd8c233427b44358a6028b2561e8ad
- SHA1 ff9ef3c53f3174d197c950ebcca2f71eac27b162
- SHA512 2600affc7ce04fc62a301583ae5b82c4062ff1fe11450ec544af7f9172205e18857aae2899288b5eb75b4e28a29a0c558f36d388e929e55ad64b736662ce3179
- SSDEEP 3072:mEGh0ojlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGRlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BA7943F3-6C83-4c21-AB06-6F4BFF798DD6}.exe
- Size 344KB
- SHA256 3d5fe2e04bd7861fbe51aa04566ee76e867022c6ec2a4083eb10d94718e15773
- MD5 19c4c583c9d82a18bd88c1ce6687649e
- SHA1 63afb9a3fd35766058d47f6b30d1854c2a6f9c8e
- SHA512 4aba024ce5f2a5e3c0b78c9c7ee5575119e8e612d9889c25c15cba98e2a4acc12c8aa81a9f7028c88452dadb81e616757290fa35bde9f063e853b5cd3c49c1a7
- SSDEEP 3072:mEGh0oOlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGslqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E2CEE46A-FD44-44b8-B314-FE2B569B7C0A}.exe
- Size 344KB
- SHA256 ac4ba3e1652e5cb7bc4d2536e85193562b79cd2b352ba95f0505d97260764740
- MD5 ecfe37bc4b11a37ba65297542077ca7e
- SHA1 85c77e77a3c6de4ed62252257e5a0f8d948b71f9
- SHA512 95faf098597ca1b2d118a8f7626d24011fba5fe304bdedf69d44729e586622182b9741f3fae13c8cbf4bc62f06261a1e056c03e477375dc55c536f9992579774
- SSDEEP 3072:mEGh0orlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGVlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E64F38BF-C0F2-43a5-963B-8D9E9CCAD434}.exe
- Size 344KB
- SHA256 023629890830db6cde3e44198d2ca11310dd8dc3cf136409517b7594df995ccc
- MD5 54bdfb8b61615ca0c86404cad69b178b
- SHA1 10b68ff4b2871e7486de05ed2a3e003b130bc8b1
- SHA512 e535458147868fe8aaffc7dc55908a901b61529d29551c62247defaa216b0a0169e13a567e04505136dc5ae0ab036236a7357a977450b2425417c282f22fc4fe
- SSDEEP 3072:mEGh0o1lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG7lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EB3D0085-07F4-4621-9E6D-EC6F51D684A7}.exe
- Size 344KB
- SHA256 402122c94e796d5e972463cd3d70152e4c61b130cc4d653bbba40f408ddf4bb7
- MD5 a93eab4a3d052416d034a3f19ac7e2ff
- SHA1 d87f2ef57da82f36f584c480b81a80551ad64d2f
- SHA512 b8acefa21a259152aa4bbb94ea4669d2fafbec724d913d971dfb8f1bee68231ad5e1d7533bf1db09a46892ef9c8518a9d5e889c8fa767ab852b0d50e552fa7ae
- SSDEEP 3072:mEGh0ojlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGVlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F2C8C25F-8332-4ad2-955E-A57524FE2837}.exe
- Size 344KB
- SHA256 07e714c4219a3842aecd94b4eb0b4ce6672a651719c53657d9a614b697ba367d
- MD5 ec3650f23a8441e884a35e559d14323a
- SHA1 0502a7f890a1f22ba7942c1afffae39f5b77cd05
- SHA512 fab0fc5086bbbcd703412735cadb132e66ed27fa4de5209fb720b757c63815f6c88a152925cf1aaa64490f585c7bf1bf6fbfa142f2a85f90ded09194cfb5e5b0
- SSDEEP 3072:mEGh0orlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG9lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP