Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 13:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe
- Size 204KB
- Sample240302-qn7eyaea78
- SHA256 e0ab3d6df505460f4a6fc03fd1a83abd3fdf05ec78ef2e3ae8d960ab5acc7599
- MD5 0bac239812fe0307e5a7a0367e3b5bed
- SHA1 8d67accbe5b0274d344faa3893e3f40f5cca4fe5
- SHA512 20c173a8e4abf12eed26197c5f614f061777cd314a1a6bec86b226acdf487363cc4be4d54c8e281094185e09684db6ba727ad38094a2c2b07d4d72874c7e6573
- SSDEEP 1536:1EGh0oil15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oil1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000800000002322b-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023220-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023233-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023130-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023233-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023130-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023233-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023130-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023233-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023130-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023230-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023130-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F8BF416-B7C0-4d28-833B-1318DB812C3D} {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C6B439A-FC17-494e-B004-5E51F72CA333}\stubpath = "C:\\Windows\\{8C6B439A-FC17-494e-B004-5E51F72CA333}.exe" {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D} {E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594AC115-A307-4154-9B5C-43E81D9E3D6A}\stubpath = "C:\\Windows\\{594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe" 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51942694-0C81-445d-A3BA-D1CDF16794D3} {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51942694-0C81-445d-A3BA-D1CDF16794D3}\stubpath = "C:\\Windows\\{51942694-0C81-445d-A3BA-D1CDF16794D3}.exe" {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B038CEC-D4EF-4d65-B390-9B4BD338907B}\stubpath = "C:\\Windows\\{7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe" {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}\stubpath = "C:\\Windows\\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe" {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D}\stubpath = "C:\\Windows\\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D}.exe" {E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{246196B3-02A8-4738-8572-A7F52E65D5A9} {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{246196B3-02A8-4738-8572-A7F52E65D5A9}\stubpath = "C:\\Windows\\{246196B3-02A8-4738-8572-A7F52E65D5A9}.exe" {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50} {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B038CEC-D4EF-4d65-B390-9B4BD338907B} {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2} {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75}\stubpath = "C:\\Windows\\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe" {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E67688CB-3C64-4f97-A7FA-44850ABEB05E} {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F8BF416-B7C0-4d28-833B-1318DB812C3D}\stubpath = "C:\\Windows\\{1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe" {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C6B439A-FC17-494e-B004-5E51F72CA333} {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}\stubpath = "C:\\Windows\\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe" {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594AC115-A307-4154-9B5C-43E81D9E3D6A} 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75} {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E67688CB-3C64-4f97-A7FA-44850ABEB05E}\stubpath = "C:\\Windows\\{E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe" {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}\stubpath = "C:\\Windows\\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe" {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4} {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe - Executes dropped EXE 12 IoCs
pid Process 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 3184 {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe 5080 {E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe 4468 {95B4A238-0347-4bfb-BCC8-8D9B46DC085D}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe File created C:\Windows\{51942694-0C81-445d-A3BA-D1CDF16794D3}.exe {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe File created C:\Windows\{E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe File created C:\Windows\{246196B3-02A8-4738-8572-A7F52E65D5A9}.exe {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe File created C:\Windows\{7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe File created C:\Windows\{1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe File created C:\Windows\{8C6B439A-FC17-494e-B004-5E51F72CA333}.exe {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe File created C:\Windows\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe File created C:\Windows\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe File created C:\Windows\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe File created C:\Windows\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe File created C:\Windows\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D}.exe {E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe Token: SeIncBasePriorityPrivilege 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe Token: SeIncBasePriorityPrivilege 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe Token: SeIncBasePriorityPrivilege 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe Token: SeIncBasePriorityPrivilege 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe Token: SeIncBasePriorityPrivilege 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe Token: SeIncBasePriorityPrivilege 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe Token: SeIncBasePriorityPrivilege 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe Token: SeIncBasePriorityPrivilege 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe Token: SeIncBasePriorityPrivilege 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe Token: SeIncBasePriorityPrivilege 3184 {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe Token: SeIncBasePriorityPrivilege 5080 {E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3080 wrote to memory of 4468 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe 91 PID 3080 wrote to memory of 4468 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe 91 PID 3080 wrote to memory of 4468 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe 91 PID 3080 wrote to memory of 3836 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe 92 PID 3080 wrote to memory of 3836 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe 92 PID 3080 wrote to memory of 3836 3080 2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe 92 PID 4468 wrote to memory of 3708 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 93 PID 4468 wrote to memory of 3708 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 93 PID 4468 wrote to memory of 3708 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 93 PID 4468 wrote to memory of 4892 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 94 PID 4468 wrote to memory of 4892 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 94 PID 4468 wrote to memory of 4892 4468 {594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe 94 PID 3708 wrote to memory of 968 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 97 PID 3708 wrote to memory of 968 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 97 PID 3708 wrote to memory of 968 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 97 PID 3708 wrote to memory of 4428 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 98 PID 3708 wrote to memory of 4428 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 98 PID 3708 wrote to memory of 4428 3708 {C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe 98 PID 968 wrote to memory of 4792 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 100 PID 968 wrote to memory of 4792 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 100 PID 968 wrote to memory of 4792 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 100 PID 968 wrote to memory of 4516 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 101 PID 968 wrote to memory of 4516 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 101 PID 968 wrote to memory of 4516 968 {51942694-0C81-445d-A3BA-D1CDF16794D3}.exe 101 PID 4792 wrote to memory of 468 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 102 PID 4792 wrote to memory of 468 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 102 PID 4792 wrote to memory of 468 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 102 PID 4792 wrote to memory of 392 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 103 PID 4792 wrote to memory of 392 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 103 PID 4792 wrote to memory of 392 4792 {E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe 103 PID 468 wrote to memory of 3620 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 104 PID 468 wrote to memory of 3620 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 104 PID 468 wrote to memory of 3620 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 104 PID 468 wrote to memory of 1912 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 105 PID 468 wrote to memory of 1912 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 105 PID 468 wrote to memory of 1912 468 {246196B3-02A8-4738-8572-A7F52E65D5A9}.exe 105 PID 3620 wrote to memory of 1792 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 106 PID 3620 wrote to memory of 1792 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 106 PID 3620 wrote to memory of 1792 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 106 PID 3620 wrote to memory of 3800 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 107 PID 3620 wrote to memory of 3800 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 107 PID 3620 wrote to memory of 3800 3620 {5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe 107 PID 1792 wrote to memory of 4308 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 108 PID 1792 wrote to memory of 4308 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 108 PID 1792 wrote to memory of 4308 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 108 PID 1792 wrote to memory of 4340 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 109 PID 1792 wrote to memory of 4340 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 109 PID 1792 wrote to memory of 4340 1792 {7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe 109 PID 4308 wrote to memory of 4324 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 110 PID 4308 wrote to memory of 4324 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 110 PID 4308 wrote to memory of 4324 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 110 PID 4308 wrote to memory of 4912 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 111 PID 4308 wrote to memory of 4912 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 111 PID 4308 wrote to memory of 4912 4308 {BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe 111 PID 4324 wrote to memory of 3184 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 112 PID 4324 wrote to memory of 3184 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 112 PID 4324 wrote to memory of 3184 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 112 PID 4324 wrote to memory of 4304 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 113 PID 4324 wrote to memory of 4304 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 113 PID 4324 wrote to memory of 4304 4324 {1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe 113 PID 3184 wrote to memory of 5080 3184 {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe 114 PID 3184 wrote to memory of 5080 3184 {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe 114 PID 3184 wrote to memory of 5080 3184 {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe 114 PID 3184 wrote to memory of 1000 3184 {8C6B439A-FC17-494e-B004-5E51F72CA333}.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_0bac239812fe0307e5a7a0367e3b5bed_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\{594AC115-A307-4154-9B5C-43E81D9E3D6A}.exeC:\Windows\{594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exeC:\Windows\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\{51942694-0C81-445d-A3BA-D1CDF16794D3}.exeC:\Windows\{51942694-0C81-445d-A3BA-D1CDF16794D3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\{E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exeC:\Windows\{E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\{246196B3-02A8-4738-8572-A7F52E65D5A9}.exeC:\Windows\{246196B3-02A8-4738-8572-A7F52E65D5A9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exeC:\Windows\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\{7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exeC:\Windows\{7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exeC:\Windows\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\{1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exeC:\Windows\{1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\{8C6B439A-FC17-494e-B004-5E51F72CA333}.exeC:\Windows\{8C6B439A-FC17-494e-B004-5E51F72CA333}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exeC:\Windows\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5080 -
C:\Windows\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D}.exeC:\Windows\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D}.exe13⤵
- Executes dropped EXE
PID:4468
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E074A~1.EXE > nul13⤵PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C6B4~1.EXE > nul12⤵PID:1000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F8BF~1.EXE > nul11⤵PID:4304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBCEF~1.EXE > nul10⤵PID:4912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B038~1.EXE > nul9⤵PID:4340
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FDC9~1.EXE > nul8⤵PID:3800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24619~1.EXE > nul7⤵PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6768~1.EXE > nul6⤵PID:392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51942~1.EXE > nul5⤵PID:4516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6E4B~1.EXE > nul4⤵PID:4428
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{594AC~1.EXE > nul3⤵PID:4892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1F8BF416-B7C0-4d28-833B-1318DB812C3D}.exe
- Size 204KB
- SHA256 b64ea53bd24e7078b0fc7f37a27c1d1233d2f70526670ef20429f0a7fa10abbd
- MD5 0e4a69d2d6b3cefe2b6e98e82e4a0550
- SHA1 16403e540d85aecc7336980fd6d8c32a563dad77
- SHA512 1a5db518c40c95e824a19daeb69d2d2440d44102cdc650cc96daf72c0f3c85b2dcc8ae68884e373a3a631e0ec7fd7a37e1fe58b91547b176640bd9fe54200eb2
- SSDEEP 1536:1EGh0okl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0okl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{246196B3-02A8-4738-8572-A7F52E65D5A9}.exe
- Size 204KB
- SHA256 f11885e2e399215220848ec14ea23d9b3b5ccf84866313837fad16d8e1af6610
- MD5 f7af19e99d2b5589c1ee1a868f9e921d
- SHA1 55d59cdd07cfe03e50145a3d9645038fb8d29569
- SHA512 ec64aeee30bcdd0781ff70e0d6b2309fd5947c88ea4fa472515938fa4ec8efcd472a1fa8208654b2720388232b191d9e2b6fd08b1549d0521bc8d99b8851fdb5
- SSDEEP 1536:1EGh0oMLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oYl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{51942694-0C81-445d-A3BA-D1CDF16794D3}.exe
- Size 204KB
- SHA256 766ddc33bcb6e748264ba798236ca6a633abf31bbcb10413f488a9df846121f2
- MD5 02c61b79746f02a4ab4f1f67c79428c6
- SHA1 883348e205b15024f403039b8ad5dd89f0d1fa3f
- SHA512 8018d6acf17f9c02e721c33979b2c1fd06dc79e726dc830d4642de9bedeea622e7d3ad81b545889e4e4b8a8223c98c332b22109d2cb0e4922cc541229d95e28e
- SSDEEP 1536:1EGh0oCl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oCl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{594AC115-A307-4154-9B5C-43E81D9E3D6A}.exe
- Size 204KB
- SHA256 b0b76b5bd8554309a2468e4249ea771c0e3deeeff22f30ce1df7e41f53af5c2f
- MD5 4d5759dda98386e0241825b17d559afa
- SHA1 a45d7794a9da73ac5df5b2a4595f4ec0fde7bfb5
- SHA512 b55b1fa6bb55775467617ff562fcaafb517c73d4c22095ea4a3ae6a09426e2f2412bbbd946b0a67e552d562f1781fb815620a114158b940a795442ecd58b06e2
- SSDEEP 1536:1EGh0o8l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o8l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5FDC9E30-A9DF-457e-9788-E9AE6DFFFB50}.exe
- Size 204KB
- SHA256 247b2e00e476807958888ef45f1820adbb4b2d407187e8b089eb35494138c4cc
- MD5 38d50ef6c3fa71d06bb53736a89a0f56
- SHA1 253aa061940df4dd860a67c90be3acf20e2370c0
- SHA512 604f41755b4f5049d8650e7d1f0f21daaa2cf4f0c6d9d1f2da0976e64292edbde568ad30f33459f8eeb7044abfab29ace34e35ff0236425b5266e4c7efdce6eb
- SSDEEP 1536:1EGh0orl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0orl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7B038CEC-D4EF-4d65-B390-9B4BD338907B}.exe
- Size 204KB
- SHA256 37ec9d7217bfe00ef4a5c9035b79845b6982d60b83b64d50d40757fc43f82049
- MD5 a1389af9295cbb15d340a1ff8a0bf964
- SHA1 b3591ab171e0f0577eee8987b91a60e6b9c8180c
- SHA512 a374353fef2deb23417120dce431eab2ed0de077d216eb1fbe49030a97f90ca64f2e6c5b0f17522a6b96a9aec685230549ebcb9e4b1d66a91bf3eabff265e6e3
- SSDEEP 1536:1EGh0oml15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oml1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8C6B439A-FC17-494e-B004-5E51F72CA333}.exe
- Size 204KB
- SHA256 39d6caee27e4592ff84d3ccdd8de828152016a701755c45fcc79b00848eb3c61
- MD5 af67dede634b79045f4df6375cad4026
- SHA1 be586adc4d902f6737d20a6de8e6563c1abeb2dc
- SHA512 6da89e71c5e0a5a6b3271bd9a9bab596fc3c3b248b88168f1918d4fc3e389d0e53581cbdcf3dca16ba5a335415b96432d0c2b4a5bb22df8b4c8a0454cd195c9b
- SSDEEP 1536:1EGh0oQGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oQGl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{95B4A238-0347-4bfb-BCC8-8D9B46DC085D}.exe
- Size 204KB
- SHA256 177ed8be051d91526bc5010e177d81cda64cb05fc11ac0c0c622b7948a74bcf4
- MD5 3ee5d50139b88b65eb08e2a63fa13db0
- SHA1 30c8f5336d8352de0eb7a642ea6ca78a6debaed0
- SHA512 5bfb14d16207a05e74afd7bb132141307213713d0b3d3bff9e49ad545a2b3d438e92ff5cc2967b624f05f6ffc80a374f7a44ce4cd4099377bbf9dba274493168
- SSDEEP 1536:1EGh0orl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0orl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BBCEF0CB-1027-4aba-9C38-F0EC5B1DB0B4}.exe
- Size 204KB
- SHA256 3803e2fb7e695f3bdfe8c4a05b0f2fa5ab420fe4e1a555695775e0f36f89abbb
- MD5 d0f67301384e5c47e2e7739ecef5e127
- SHA1 b695cc1690fdd37311e26fe04b9321b9861c0f1d
- SHA512 188ff21f2fdcdada65aab6707d491f6b76384b83929dbbd60efc1dddc451892930269d76a8d461198d3ad10dc18ff37aaa3b58cc953b114f2ae59be43bc9b766
- SSDEEP 1536:1EGh0oUl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oUl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C6E4B0A7-79F4-4e92-95C1-C7B301231D75}.exe
- Size 204KB
- SHA256 8048f0d944d4f3c986fbe0026a1f2518f62593ef13709e074fc5219b0bfef2c5
- MD5 e775f86e94cc9a654db98c2fa11dec8d
- SHA1 0992a0d5aaf58946f5cdc394b7d0e1a03974ca20
- SHA512 75167bb41081aada7dc318b680c6e4c27b32094b9ab13442b7ab268cd025cc07a5227af970385628399d93ea61e64e1af5e583c77637c2b3910a11cab92ffc54
- SSDEEP 1536:1EGh0oQl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oQl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E074AF2F-32BB-4bee-A5AD-F5A15E89B2B2}.exe
- Size 204KB
- SHA256 45bf5f8e3d06adb5dfe29a898dc503b76da9b31eeb95c166d9d49cf097bef04e
- MD5 08c01fbdcb6c3bfbaf2244af0943a465
- SHA1 8cc781faad1d1081b54b3ab7da5e656a7d665736
- SHA512 26513da4a0dac5420d802010e3487d630fe20fc28347719656a02addb0bc3fa573c1d505fdf05552656c1c843d1ca135db1ba2966dcda98311be3239c692507f
- SSDEEP 1536:1EGh0odl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0odl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E67688CB-3C64-4f97-A7FA-44850ABEB05E}.exe
- Size 204KB
- SHA256 81d5e5d74f87e0a0e8eb8eacff03380035f7ef5fbddd8a58754ed71e4ed87101
- MD5 41fa6067b740e70b5aeec800acf63570
- SHA1 b6126c2690d866e92e729ad4e771429943d2107f
- SHA512 b82e725e68519185b4120f15bd87f349ba19c27d00785756858817699875838e18e11b499fb820cf6a57e6d6ec895261898e042d05d5b5dda60817af3d7c49b2
- SSDEEP 1536:1EGh0oPl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oPl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP