Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 13:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe
- Size 197KB
- Sample240302-qsva6seb34
- SHA256 8bb7270500bdbb9a0c2533379ac8cdfcd050172f9649af4ea915ce832312c5af
- MD5 3cff1bed3c0d60f7d3e5263c0b2c8c02
- SHA1 de4f4b73289502edc9303534b8c29ab042d40457
- SHA512 d286505084f1b063f772b9fff4730d08d66fda42b69bf523d2e17ee252b8089f2f4a8eacb7076ef8ffcfd9be271e7dfee600d98d2d773e5534d0898259d26ec9
- SSDEEP 3072:jEGh0okl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGGlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000800000002333e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023337-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023346-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231f3-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023346-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000231f3-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023346-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231f3-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023346-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000231f3-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023343-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000231f3-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{496037FA-314A-4eac-A200-6EC5952278C4}\stubpath = "C:\\Windows\\{496037FA-314A-4eac-A200-6EC5952278C4}.exe" {32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{115DF13B-BFA7-463f-87BE-3A26DACCD267}\stubpath = "C:\\Windows\\{115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe" 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5100310A-9B60-43a4-9871-E847F948C810}\stubpath = "C:\\Windows\\{5100310A-9B60-43a4-9871-E847F948C810}.exe" {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60}\stubpath = "C:\\Windows\\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe" {5100310A-9B60-43a4-9871-E847F948C810}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC238C75-8F92-4eb9-AFD1-D08612E1539E} {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45B6268D-F318-4708-B1F8-C61E5956F217} {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45B6268D-F318-4708-B1F8-C61E5956F217}\stubpath = "C:\\Windows\\{45B6268D-F318-4708-B1F8-C61E5956F217}.exe" {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}\stubpath = "C:\\Windows\\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe" {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}\stubpath = "C:\\Windows\\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe" {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}\stubpath = "C:\\Windows\\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe" {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC238C75-8F92-4eb9-AFD1-D08612E1539E}\stubpath = "C:\\Windows\\{FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe" {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5100310A-9B60-43a4-9871-E847F948C810} {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60} {5100310A-9B60-43a4-9871-E847F948C810}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{875061BE-8941-4a32-ADF6-4B009C55D00D}\stubpath = "C:\\Windows\\{875061BE-8941-4a32-ADF6-4B009C55D00D}.exe" {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA} {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F} {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67CA7712-0B45-41aa-8245-0E060584F5D1} {45B6268D-F318-4708-B1F8-C61E5956F217}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67CA7712-0B45-41aa-8245-0E060584F5D1}\stubpath = "C:\\Windows\\{67CA7712-0B45-41aa-8245-0E060584F5D1}.exe" {45B6268D-F318-4708-B1F8-C61E5956F217}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274} {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{115DF13B-BFA7-463f-87BE-3A26DACCD267} 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6} {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{875061BE-8941-4a32-ADF6-4B009C55D00D} {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}\stubpath = "C:\\Windows\\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe" {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{496037FA-314A-4eac-A200-6EC5952278C4} {32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe - Executes dropped EXE 12 IoCs
pid Process 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 5016 {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe 4080 {32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe 2448 {496037FA-314A-4eac-A200-6EC5952278C4}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe {5100310A-9B60-43a4-9871-E847F948C810}.exe File created C:\Windows\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe File created C:\Windows\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe File created C:\Windows\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe File created C:\Windows\{67CA7712-0B45-41aa-8245-0E060584F5D1}.exe {45B6268D-F318-4708-B1F8-C61E5956F217}.exe File created C:\Windows\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe File created C:\Windows\{115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe File created C:\Windows\{5100310A-9B60-43a4-9871-E847F948C810}.exe {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe File created C:\Windows\{45B6268D-F318-4708-B1F8-C61E5956F217}.exe {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe File created C:\Windows\{496037FA-314A-4eac-A200-6EC5952278C4}.exe {32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe File created C:\Windows\{875061BE-8941-4a32-ADF6-4B009C55D00D}.exe {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe File created C:\Windows\{FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe Token: SeIncBasePriorityPrivilege 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe Token: SeIncBasePriorityPrivilege 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe Token: SeIncBasePriorityPrivilege 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe Token: SeIncBasePriorityPrivilege 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe Token: SeIncBasePriorityPrivilege 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe Token: SeIncBasePriorityPrivilege 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe Token: SeIncBasePriorityPrivilege 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe Token: SeIncBasePriorityPrivilege 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe Token: SeIncBasePriorityPrivilege 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe Token: SeIncBasePriorityPrivilege 5016 {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe Token: SeIncBasePriorityPrivilege 4080 {32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 4712 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe 97 PID 2376 wrote to memory of 4712 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe 97 PID 2376 wrote to memory of 4712 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe 97 PID 2376 wrote to memory of 4748 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe 98 PID 2376 wrote to memory of 4748 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe 98 PID 2376 wrote to memory of 4748 2376 2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe 98 PID 4712 wrote to memory of 712 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 99 PID 4712 wrote to memory of 712 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 99 PID 4712 wrote to memory of 712 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 99 PID 4712 wrote to memory of 1348 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 100 PID 4712 wrote to memory of 1348 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 100 PID 4712 wrote to memory of 1348 4712 {115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe 100 PID 712 wrote to memory of 2344 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 103 PID 712 wrote to memory of 2344 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 103 PID 712 wrote to memory of 2344 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 103 PID 712 wrote to memory of 2248 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 104 PID 712 wrote to memory of 2248 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 104 PID 712 wrote to memory of 2248 712 {5100310A-9B60-43a4-9871-E847F948C810}.exe 104 PID 2344 wrote to memory of 1376 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 107 PID 2344 wrote to memory of 1376 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 107 PID 2344 wrote to memory of 1376 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 107 PID 2344 wrote to memory of 556 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 108 PID 2344 wrote to memory of 556 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 108 PID 2344 wrote to memory of 556 2344 {83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe 108 PID 1376 wrote to memory of 2136 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 109 PID 1376 wrote to memory of 2136 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 109 PID 1376 wrote to memory of 2136 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 109 PID 1376 wrote to memory of 3656 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 110 PID 1376 wrote to memory of 3656 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 110 PID 1376 wrote to memory of 3656 1376 {5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe 110 PID 2136 wrote to memory of 1496 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 111 PID 2136 wrote to memory of 1496 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 111 PID 2136 wrote to memory of 1496 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 111 PID 2136 wrote to memory of 4172 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 112 PID 2136 wrote to memory of 4172 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 112 PID 2136 wrote to memory of 4172 2136 {875061BE-8941-4a32-ADF6-4B009C55D00D}.exe 112 PID 1496 wrote to memory of 4680 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 113 PID 1496 wrote to memory of 4680 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 113 PID 1496 wrote to memory of 4680 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 113 PID 1496 wrote to memory of 4356 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 114 PID 1496 wrote to memory of 4356 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 114 PID 1496 wrote to memory of 4356 1496 {4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe 114 PID 4680 wrote to memory of 208 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 115 PID 4680 wrote to memory of 208 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 115 PID 4680 wrote to memory of 208 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 115 PID 4680 wrote to memory of 1852 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 116 PID 4680 wrote to memory of 1852 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 116 PID 4680 wrote to memory of 1852 4680 {3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe 116 PID 208 wrote to memory of 4372 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 117 PID 208 wrote to memory of 4372 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 117 PID 208 wrote to memory of 4372 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 117 PID 208 wrote to memory of 4764 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 118 PID 208 wrote to memory of 4764 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 118 PID 208 wrote to memory of 4764 208 {FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe 118 PID 4372 wrote to memory of 5016 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 119 PID 4372 wrote to memory of 5016 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 119 PID 4372 wrote to memory of 5016 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 119 PID 4372 wrote to memory of 4996 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 120 PID 4372 wrote to memory of 4996 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 120 PID 4372 wrote to memory of 4996 4372 {45B6268D-F318-4708-B1F8-C61E5956F217}.exe 120 PID 5016 wrote to memory of 4080 5016 {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe 121 PID 5016 wrote to memory of 4080 5016 {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe 121 PID 5016 wrote to memory of 4080 5016 {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe 121 PID 5016 wrote to memory of 4840 5016 {67CA7712-0B45-41aa-8245-0E060584F5D1}.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_3cff1bed3c0d60f7d3e5263c0b2c8c02_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\{115DF13B-BFA7-463f-87BE-3A26DACCD267}.exeC:\Windows\{115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\{5100310A-9B60-43a4-9871-E847F948C810}.exeC:\Windows\{5100310A-9B60-43a4-9871-E847F948C810}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exeC:\Windows\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exeC:\Windows\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\{875061BE-8941-4a32-ADF6-4B009C55D00D}.exeC:\Windows\{875061BE-8941-4a32-ADF6-4B009C55D00D}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exeC:\Windows\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exeC:\Windows\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\{FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exeC:\Windows\{FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\{45B6268D-F318-4708-B1F8-C61E5956F217}.exeC:\Windows\{45B6268D-F318-4708-B1F8-C61E5956F217}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\{67CA7712-0B45-41aa-8245-0E060584F5D1}.exeC:\Windows\{67CA7712-0B45-41aa-8245-0E060584F5D1}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exeC:\Windows\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4080 -
C:\Windows\{496037FA-314A-4eac-A200-6EC5952278C4}.exeC:\Windows\{496037FA-314A-4eac-A200-6EC5952278C4}.exe13⤵
- Executes dropped EXE
PID:2448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32FD1~1.EXE > nul13⤵PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67CA7~1.EXE > nul12⤵PID:4840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45B62~1.EXE > nul11⤵PID:4996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC238~1.EXE > nul10⤵PID:4764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DE42~1.EXE > nul9⤵PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B77E~1.EXE > nul8⤵PID:4356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87506~1.EXE > nul7⤵PID:4172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A87B~1.EXE > nul6⤵PID:3656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83FB3~1.EXE > nul5⤵PID:556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51003~1.EXE > nul4⤵PID:2248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{115DF~1.EXE > nul3⤵PID:1348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:81⤵PID:1900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{115DF13B-BFA7-463f-87BE-3A26DACCD267}.exe
- Size 197KB
- SHA256 3f0c429851f672d0cc1f909b9009b269689cdbdc8e979d0038ba554579196ba1
- MD5 a607f99d6b4533c96f9613ef0e8e9d05
- SHA1 30511864e194115b499ba018423ce05fb3ff0b5a
- SHA512 8dcca6e6c309fa4a443c6527b897858602f9d292dc3b53f51662446447ddcc41ad41da3eee5171b2e490c308a8758c571e2fccbfb2c308d72bbc922f8fa899c0
- SSDEEP 3072:jEGh0oGl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGglEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{32FD1C59-DC6E-4e12-BDF4-C0918A4D2274}.exe
- Size 197KB
- SHA256 7c5af4e64dc7156c6c8bd782284eb17c2cd18365c8ff6e29092a538a554b90a8
- MD5 a95569e4a53d475e9465b43b1a7a1f02
- SHA1 ec08d56a057d71e310fb8e2125cec9dbe17a7a94
- SHA512 eb298f1fc2fd9df85ed1f6f4a3f60719cc3267feb0bb2f59a78e7663fca51cc4687d52346a84fa6ab458a966135a1ff9372c4aac6f5813e49d1cd27d9de4524c
- SSDEEP 3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG0lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3DE42C6D-4881-4f0a-B201-60FDA2A3AB1F}.exe
- Size 197KB
- SHA256 89600a4074656d82bbfeabad5b1afa37b14b821af65efb361a6c999de1d8d158
- MD5 ff6cc236feb4d62c7741243978b7ea6e
- SHA1 3c14b165f4996d187708b40af85ebc126f29a39c
- SHA512 8292904c059e87ccc2f411cc347e3657f6bfe9a21d7a957f3fcbc173fe7fed3c0efa1d941961c9e73b5baf14658ac4a768794bc843cab2707e21790262efb88b
- SSDEEP 3072:jEGh0oBl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGLlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{45B6268D-F318-4708-B1F8-C61E5956F217}.exe
- Size 197KB
- SHA256 0e33d9d447b4afcd6fc7f88a86691ed740a4a626f327c69c6bc8fe8f66edd396
- MD5 5090543e767b1d08279f8c7569440afb
- SHA1 19deded6fc539e6917753b28fb3d6167044cfb74
- SHA512 86051e8e8bf1fab12f027a1e5c39c9180969b41980d6d6c6129aa561e5a704fbbcb85fe706164f3fa7d085c0462920ee499a2ef361e85ac86d65515382353894
- SSDEEP 3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGFlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{496037FA-314A-4eac-A200-6EC5952278C4}.exe
- Size 197KB
- SHA256 d4ef61f9a8e5064b3c06f19864c166c420b9a59ed3072118bd31af6815c27bf1
- MD5 2ff8cad8cc5a41dbcde6cef874e4fad5
- SHA1 21aa20d7a6b795fa753dcfb0057810f13febc0c7
- SHA512 6c04197d6520c9212d8bd3fda4aafc812bde5c38cb74b9a505a8f81f7e120bf142f0f21fd6e743d48a242949ae677f8963c27bf80ccd189f0660a269f43d6b6d
- SSDEEP 3072:jEGh0oMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4B77E54B-3BD3-4713-A7CB-8877F1C5F5CA}.exe
- Size 197KB
- SHA256 3056dfa783923dee90deacb19feaaaa7dd85ae777442d93854a88385b3fd878b
- MD5 be32e4d7a940ce3b8b5535608f172216
- SHA1 eb642d7aa88f447e3ecdaa954f74059ff08f1d00
- SHA512 5025639223dc27c14eb7c7a423e69b928a196af53f1ff9338821712f1c38c23bdc43c4fc80d8f2330734ed8ca7b571404a3e4dc3d9ceeb709b5345c29327b916
- SSDEEP 3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5100310A-9B60-43a4-9871-E847F948C810}.exe
- Size 197KB
- SHA256 8bf939f334dfdafd0f315543287df813d3a7006f81e339edecddbada48fa2f6b
- MD5 dfdc1461645d150e63ca7cdd353b7e66
- SHA1 1529eb3344e2e0015261647d7ff186d81ecb77f9
- SHA512 9861526760be56bcb5e9460a512155a0c4095bda148c6d307c0e147c916568562e85a67a62b340b0f43a86edb73ea5f87444cd57eda70cd50614c727188ff55e
- SSDEEP 3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGGlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5A87B75E-CB97-44cb-B23C-1CECA0A18AF6}.exe
- Size 197KB
- SHA256 f59e2b2e9bee1cd74fb7c600f907c97100d5ea7880b118a1f9fb152b845e4d38
- MD5 efeb13ae3c382bb553ec4f0e1be66872
- SHA1 7641a251fa6f8bdfb0daa0db8944fe0a3e78d649
- SHA512 91ae012797628740fd676f453a3140d071db81463340473d8c2e1895f0860c96e055eb735ffd5ca6c81f2ece6ef7a3ef3094a90019fa9bbcaba104e29e75ad7b
- SSDEEP 3072:jEGh0oUl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG6lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{67CA7712-0B45-41aa-8245-0E060584F5D1}.exe
- Size 197KB
- SHA256 19e1f61f6a4657e71f36a9a11599829188c2d15904bca339fc1799b394f74407
- MD5 badd89c22e442be7a4e5ec1d9696e039
- SHA1 c72c97462151e1e9cb712d0dd0d9d8902ac92b30
- SHA512 0494b579ecb2e6fc53c90ad4d521dc2636207db2dc6ab42b26f2c382a655a16c695e34367d4907c3d5d432026b0a9624e1e94f3d53f9f9e55026cc9edd3954e7
- SSDEEP 3072:jEGh0ovl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG1lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{83FB3535-2CC1-4057-BEA9-85FA49ED6C60}.exe
- Size 197KB
- SHA256 1ba0157907ac979dbada91154196d33b56ff3e9380844b477d3bc3459feeff6f
- MD5 7a8536d5aaafcb2540c6658298b84224
- SHA1 0d738049bcdf890ec664f5bf428d47410a230ece
- SHA512 72dd85ef573fd8857532958fda23fef7950306594dd81f88383b846024ec86c9c69943b028feed7187293313401b673f71af079f4b04e7d309e8ac283cd32654
- SSDEEP 3072:jEGh0oel+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGclEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{875061BE-8941-4a32-ADF6-4B009C55D00D}.exe
- Size 197KB
- SHA256 4f7cf6cad174abdf7226eff3257e9ac4734f3ff3db1767b39e12c0b9f4317626
- MD5 f5cf849a9a10fcaefbb8c41256e3dc45
- SHA1 607ef4e386e16371377382ebc9cda6e12b962fcd
- SHA512 da9653ae80528924462b085c345e997245a3e7172b3d414b4e8db6758740b9e66dfcc1494ea441c2c470cafc4c2d994ba9ea5cd07d8150ed8aed70c6a26c839e
- SSDEEP 3072:jEGh0oZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGLlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FC238C75-8F92-4eb9-AFD1-D08612E1539E}.exe
- Size 197KB
- SHA256 15edd79f30664e7478c80760870cf7824f4e2a83c44b88a286d4c913000fc4c0
- MD5 4698450dfbb46942804a83cce10b38c3
- SHA1 64a1670169793bca19e731259ef5ef809a45c048
- SHA512 a4314d8c798c4caa39747a9b9c402bb9595b4fe8937e9eeb04f530d8eda2631f3dc161250ec297030f0936de1cd2e51ae49163b06eee5a1c8be40ea77ed9f998
- SSDEEP 3072:jEGh0oVl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGHlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP