Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 13:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe
- Size 344KB
- Sample240302-q91vaaec92
- SHA256 3656eb1ecbc17e0c7f3e82ea0ebf6b6da85d46248bb4fe67463096d542856680
- MD5 e9f70dd6e02072a09ec899efa1df6584
- SHA1 477f6be8f6adb0aebe834075331933c3a6caeeda
- SHA512 62377073bb9f125711c5a353b41e661c8ddcc0ed08d0cef9ea6ec24cd51167b796f1cb52950194cd5fdbb6742528e915072ca1510283e84c49589066bafa0a5e
- SSDEEP 3072:mEGh0oClEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGQlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0004000000022ea1-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023231-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002323b-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000230ff-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023239-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000230ff-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023239-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000022f70-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023239-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000022f70-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023239-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000022f70-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DED74EA0-89F0-4b47-8600-EAFD7249391C} {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}\stubpath = "C:\\Windows\\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe" {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F632CE57-C824-4f6f-90B4-C674B5BD7A64} {E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A769745B-F899-4fdb-BB97-004D49349A0C} {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A769745B-F899-4fdb-BB97-004D49349A0C}\stubpath = "C:\\Windows\\{A769745B-F899-4fdb-BB97-004D49349A0C}.exe" {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D} {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67140DB6-631F-4520-A2E0-C6A1B8244D55}\stubpath = "C:\\Windows\\{67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe" {487130CD-E93B-4e5f-A587-C60033941118}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F632CE57-C824-4f6f-90B4-C674B5BD7A64}\stubpath = "C:\\Windows\\{F632CE57-C824-4f6f-90B4-C674B5BD7A64}.exe" {E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}\stubpath = "C:\\Windows\\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe" {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B0EC27C-334D-4611-832E-6FC82FB26D70} {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{487130CD-E93B-4e5f-A587-C60033941118} {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6}\stubpath = "C:\\Windows\\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe" {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DED74EA0-89F0-4b47-8600-EAFD7249391C}\stubpath = "C:\\Windows\\{DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe" {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B0EC27C-334D-4611-832E-6FC82FB26D70}\stubpath = "C:\\Windows\\{2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe" {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67140DB6-631F-4520-A2E0-C6A1B8244D55} {487130CD-E93B-4e5f-A587-C60033941118}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF} {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{385772AA-38FA-4c1c-847E-71F41FF9D17F} 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0EF262E-C50C-4db5-8FFA-987A6BD95120}\stubpath = "C:\\Windows\\{C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe" {A769745B-F899-4fdb-BB97-004D49349A0C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78363E5E-2A07-4530-9A2F-8DAB18C116C5}\stubpath = "C:\\Windows\\{78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe" {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6} {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{487130CD-E93B-4e5f-A587-C60033941118}\stubpath = "C:\\Windows\\{487130CD-E93B-4e5f-A587-C60033941118}.exe" {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{385772AA-38FA-4c1c-847E-71F41FF9D17F}\stubpath = "C:\\Windows\\{385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe" 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0EF262E-C50C-4db5-8FFA-987A6BD95120} {A769745B-F899-4fdb-BB97-004D49349A0C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78363E5E-2A07-4530-9A2F-8DAB18C116C5} {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe - Executes dropped EXE 12 IoCs
pid Process 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 2264 {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe 1796 {E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe 3888 {F632CE57-C824-4f6f-90B4-C674B5BD7A64}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{A769745B-F899-4fdb-BB97-004D49349A0C}.exe {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe File created C:\Windows\{C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe {A769745B-F899-4fdb-BB97-004D49349A0C}.exe File created C:\Windows\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe File created C:\Windows\{DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe File created C:\Windows\{2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe File created C:\Windows\{487130CD-E93B-4e5f-A587-C60033941118}.exe {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe File created C:\Windows\{385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe File created C:\Windows\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe File created C:\Windows\{67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe {487130CD-E93B-4e5f-A587-C60033941118}.exe File created C:\Windows\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe File created C:\Windows\{F632CE57-C824-4f6f-90B4-C674B5BD7A64}.exe {E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe File created C:\Windows\{78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe Token: SeIncBasePriorityPrivilege 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe Token: SeIncBasePriorityPrivilege 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe Token: SeIncBasePriorityPrivilege 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe Token: SeIncBasePriorityPrivilege 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe Token: SeIncBasePriorityPrivilege 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe Token: SeIncBasePriorityPrivilege 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe Token: SeIncBasePriorityPrivilege 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe Token: SeIncBasePriorityPrivilege 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe Token: SeIncBasePriorityPrivilege 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe Token: SeIncBasePriorityPrivilege 2264 {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe Token: SeIncBasePriorityPrivilege 1796 {E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1652 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe 96 PID 1964 wrote to memory of 1652 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe 96 PID 1964 wrote to memory of 1652 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe 96 PID 1964 wrote to memory of 5048 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe 97 PID 1964 wrote to memory of 5048 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe 97 PID 1964 wrote to memory of 5048 1964 2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe 97 PID 1652 wrote to memory of 3164 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 98 PID 1652 wrote to memory of 3164 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 98 PID 1652 wrote to memory of 3164 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 98 PID 1652 wrote to memory of 4548 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 99 PID 1652 wrote to memory of 4548 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 99 PID 1652 wrote to memory of 4548 1652 {385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe 99 PID 3164 wrote to memory of 212 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 102 PID 3164 wrote to memory of 212 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 102 PID 3164 wrote to memory of 212 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 102 PID 3164 wrote to memory of 4400 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 103 PID 3164 wrote to memory of 4400 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 103 PID 3164 wrote to memory of 4400 3164 {A769745B-F899-4fdb-BB97-004D49349A0C}.exe 103 PID 212 wrote to memory of 4436 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 106 PID 212 wrote to memory of 4436 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 106 PID 212 wrote to memory of 4436 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 106 PID 212 wrote to memory of 4480 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 107 PID 212 wrote to memory of 4480 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 107 PID 212 wrote to memory of 4480 212 {C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe 107 PID 4436 wrote to memory of 2464 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 108 PID 4436 wrote to memory of 2464 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 108 PID 4436 wrote to memory of 2464 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 108 PID 4436 wrote to memory of 2904 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 109 PID 4436 wrote to memory of 2904 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 109 PID 4436 wrote to memory of 2904 4436 {FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe 109 PID 2464 wrote to memory of 484 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 110 PID 2464 wrote to memory of 484 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 110 PID 2464 wrote to memory of 484 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 110 PID 2464 wrote to memory of 3372 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 111 PID 2464 wrote to memory of 3372 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 111 PID 2464 wrote to memory of 3372 2464 {78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe 111 PID 484 wrote to memory of 2664 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 112 PID 484 wrote to memory of 2664 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 112 PID 484 wrote to memory of 2664 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 112 PID 484 wrote to memory of 3264 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 113 PID 484 wrote to memory of 3264 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 113 PID 484 wrote to memory of 3264 484 {12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe 113 PID 2664 wrote to memory of 3956 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 114 PID 2664 wrote to memory of 3956 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 114 PID 2664 wrote to memory of 3956 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 114 PID 2664 wrote to memory of 4792 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 115 PID 2664 wrote to memory of 4792 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 115 PID 2664 wrote to memory of 4792 2664 {DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe 115 PID 3956 wrote to memory of 4556 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 116 PID 3956 wrote to memory of 4556 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 116 PID 3956 wrote to memory of 4556 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 116 PID 3956 wrote to memory of 2228 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 117 PID 3956 wrote to memory of 2228 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 117 PID 3956 wrote to memory of 2228 3956 {2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe 117 PID 4556 wrote to memory of 2264 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 118 PID 4556 wrote to memory of 2264 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 118 PID 4556 wrote to memory of 2264 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 118 PID 4556 wrote to memory of 1096 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 119 PID 4556 wrote to memory of 1096 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 119 PID 4556 wrote to memory of 1096 4556 {487130CD-E93B-4e5f-A587-C60033941118}.exe 119 PID 2264 wrote to memory of 1796 2264 {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe 120 PID 2264 wrote to memory of 1796 2264 {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe 120 PID 2264 wrote to memory of 1796 2264 {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe 120 PID 2264 wrote to memory of 408 2264 {67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_e9f70dd6e02072a09ec899efa1df6584_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\{385772AA-38FA-4c1c-847E-71F41FF9D17F}.exeC:\Windows\{385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\{A769745B-F899-4fdb-BB97-004D49349A0C}.exeC:\Windows\{A769745B-F899-4fdb-BB97-004D49349A0C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\{C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exeC:\Windows\{C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exeC:\Windows\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\{78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exeC:\Windows\{78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exeC:\Windows\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\{DED74EA0-89F0-4b47-8600-EAFD7249391C}.exeC:\Windows\{DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\{2B0EC27C-334D-4611-832E-6FC82FB26D70}.exeC:\Windows\{2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\{487130CD-E93B-4e5f-A587-C60033941118}.exeC:\Windows\{487130CD-E93B-4e5f-A587-C60033941118}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\{67140DB6-631F-4520-A2E0-C6A1B8244D55}.exeC:\Windows\{67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exeC:\Windows\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Windows\{F632CE57-C824-4f6f-90B4-C674B5BD7A64}.exeC:\Windows\{F632CE57-C824-4f6f-90B4-C674B5BD7A64}.exe13⤵
- Executes dropped EXE
PID:3888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E38BE~1.EXE > nul13⤵PID:4564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67140~1.EXE > nul12⤵PID:408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48713~1.EXE > nul11⤵PID:1096
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B0EC~1.EXE > nul10⤵PID:2228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DED74~1.EXE > nul9⤵PID:4792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12B37~1.EXE > nul8⤵PID:3264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78363~1.EXE > nul7⤵PID:3372
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB627~1.EXE > nul6⤵PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0EF2~1.EXE > nul5⤵PID:4480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7697~1.EXE > nul4⤵PID:4400
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38577~1.EXE > nul3⤵PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:4804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{12B37C3F-07C2-4b08-AEB7-3964BA7155A6}.exe
- Size 344KB
- SHA256 1ed7c977bacc3f36cb75561b60ef44b758651fed657bc53a3b0998dd7d4e6482
- MD5 f901068fda032cb72353b3f7b4880c39
- SHA1 11580cf315cb0b09d9b6103fb555b266c2698a56
- SHA512 f51240526baf809cf23d983f7c37e77fc7cff9b414d091431de32910747ba7ce705375fc12f0cb88f84f161050527d770c92eb9f5207fb6b326dacebffcfd7fe
- SSDEEP 3072:mEGh0oglEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGClqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2B0EC27C-334D-4611-832E-6FC82FB26D70}.exe
- Size 344KB
- SHA256 d2333d137746f5ef04e0b8af889471941e84c6ee684b3e9b37c54637af0f19ba
- MD5 0307b176c0528cffb893f2ef2594e6e8
- SHA1 1df2b26e20597b9d42cc2c1f4c06a853deb56415
- SHA512 4bc1d3f331b7ec4ad47ed05071b35a63cc53668b61e6270c525bb3b16e4dad3643f65c197c3751c9a59220d9fe282e697f6598abf50a176d4af7c95159338499
- SSDEEP 3072:mEGh0oAlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGClqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{385772AA-38FA-4c1c-847E-71F41FF9D17F}.exe
- Size 344KB
- SHA256 76e4e0fd214416be05375f90eb5b895cde980ccf81465c8746276dcdc2bd7f7d
- MD5 6e33aecbdd8c30069bda098ee2a6bb99
- SHA1 e94f952a1b69337d35085f280db5c76bddecb7ed
- SHA512 29775d7c151eaa009c66b64f747a395cdd68f3346909d2dcd24aa24e0e8af84f132dffdee4772348e197ffa81416d382b10f5f4e63f624596656e2b84a05746e
- SSDEEP 3072:mEGh0oLlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGJlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{487130CD-E93B-4e5f-A587-C60033941118}.exe
- Size 344KB
- SHA256 1062f18dceb259c87d66b686397850fea36813fed61f110591397182c6b9ff6a
- MD5 f8809206403e2f35b92e1ceb3c5e5779
- SHA1 c075012a68629ee7dd8de7db866530c426126043
- SHA512 b7b5d2cd3d64bb01f27693fc665a0082f9a26e26eaef57e1340f30bae0802bf8ea0586492210652074e4f14cbeecce6bd35abd309bd49adcc96029eec1e3d396
- SSDEEP 3072:mEGh0oTlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGRlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{67140DB6-631F-4520-A2E0-C6A1B8244D55}.exe
- Size 344KB
- SHA256 3a49ac7e7f0c86119bcf5137cc0172965153c54b342559713892242728786deb
- MD5 32b82906330cfcec8d496388cd9f3ee4
- SHA1 3777be0000a90a58710e57583e4bc42be8e2565e
- SHA512 11069ef5a89b8a6c36ab1e6e7df95f9aa92608818fba59a579ea10e48648e382c9b37b835946719a58334ae799f10e8a204272cce4114e68c8bf0dbd9cd1b13d
- SSDEEP 3072:mEGh0oMlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGalqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{78363E5E-2A07-4530-9A2F-8DAB18C116C5}.exe
- Size 344KB
- SHA256 583e208f0dac68f45702e454443cb0aae8f8f9c0d33432d1f167025fc4f43878
- MD5 8c7a3c4771289292789ee4a11046194f
- SHA1 381b785bb9adb2e268d0765b222476567578f202
- SHA512 ab507c346abb09e263613913d7dccc299ff47e89d80c414a81d2c7b19c5425905d1bcbf89e6ec0dfc89fea78736dd94a921c36dd37497da219ece4e2ac45b29f
- SSDEEP 3072:mEGh0o9lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGDlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A769745B-F899-4fdb-BB97-004D49349A0C}.exe
- Size 344KB
- SHA256 7869e6256d2cc633001fdf524a3bb786f10164955f232e697c2a0c67cf088438
- MD5 a4e899988b1262d115f2253f0edb89bd
- SHA1 b8f38a71a86e22b3cf5147c403ab7dfeedf80e09
- SHA512 a39e77e3b9ee7c9e7a8cea6d0bcb938bc4332000e69ebe4019907830424dc92ffbe165779ecb5d4e93f49601bbf080a19ef5bd8e54cf74a576ea9a0afc77d5fb
- SSDEEP 3072:mEGh0oalEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG8lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C0EF262E-C50C-4db5-8FFA-987A6BD95120}.exe
- Size 344KB
- SHA256 5de253e7ce031a7f35e3756ae9e0d4c3667fc9e1cfe417e1ea98119241cfced0
- MD5 2fa97226d7ad69168cf69da6af5805f1
- SHA1 f5a266ed065ae8c9ae25f40039d475b5cde247e3
- SHA512 14c7e0cf43acecc567d129fb905288b04a2fb7f475b174c142157c99f1cf068d3a9b2a3f8b4f2fd207cd6351693265af6b06f12e3127abd2ec51d85a2e426396
- SSDEEP 3072:mEGh0owlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGqlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DED74EA0-89F0-4b47-8600-EAFD7249391C}.exe
- Size 344KB
- SHA256 57d22e6e2b23f9da12abea4da5514284d7f7d0d7fcca3812d588dcaa97af90c2
- MD5 d730991f94496b5a4d7329fd9f6b5e74
- SHA1 860ec00fe72b1a067862495210f1d56fb673ff3a
- SHA512 19bef9b25d20830f3a283b401703afe3bc7459ef378d61fdd1125889a26b001f97b03dbceb23a43d155417caef67dc22739af6ac19196595c45412480571fa21
- SSDEEP 3072:mEGh0oclEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGGlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E38BEB53-B5B8-41ad-829B-355E8DB1C9EF}.exe
- Size 344KB
- SHA256 e08219a468b61e6ec06f72dbfa7a1594330bfcd7961482875793259d26812a27
- MD5 6e5987d42c577ba10130b11305288a1e
- SHA1 cf054d4d5a57184f75300f15edfcbdbc8cef00f3
- SHA512 9fe0d362920c8fc179a425d7db2663beb637f71b82e99ed7bb8de35bf068ee0e22dd81d4259d063f62360653aca482a705064ecfb93730147ddfd1c5d25fd69c
- SSDEEP 3072:mEGh0o3lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGZlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F632CE57-C824-4f6f-90B4-C674B5BD7A64}.exe
- Size 344KB
- SHA256 e5db644f8861111f6100e0e9496af97da0f6c89092b517c8d61a896fddd90c46
- MD5 a85e0532c9f335ea89875292f65ef78e
- SHA1 eb4a8f91047f8ef3375ac4b954620e4e48388e7f
- SHA512 4b6ae7bc9d7035e61679c21a219d3c1f2b37eba7a634984c1b5e0d2b51347f5f7703c3d2623d75f5b027a6daf2a32820b07b2c9a392e9f92a0b60dd33bde8ff1
- SSDEEP 3072:mEGh0oilEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGolqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FB6277FD-690D-4fb3-B443-4ADB0B5CD32D}.exe
- Size 344KB
- SHA256 15c6256914f374b3a08b22fc42dc02e85a7c622a619b60be5706671d212916ab
- MD5 ff293c4ccf721712dcae6dd760d20a55
- SHA1 7a0d46a078382d629758a6069c98e2e6e38355c4
- SHA512 8a6cfcecc9a7a24eb49b67c515b7abee9dff39c497da60eec50f9a7a7f42bc4b29f2675988dae3b364b9c1eacf51f278243b10cd6350105f3bd1a475df4fe1e8
- SSDEEP 3072:mEGh0oxlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG7lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP