Analysis
- max time kernel
151s - max time network
128s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/03/2024, 13:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe
- Size 408KB
- Sample240302-qvwa9adh21
- SHA256 7fdf03dad9fad6ee62bfd06a26aa03a70731be9e4b9e5ee5769c0e7ba644aef5
- MD5 5f3f94e980cf8ba21845b7267b45bc45
- SHA1 c997313db6935f045f133a2e82fb3d7f87197995
- SHA512 8a2c96de892b54b5e0a44dd5b38b1bf9f1c5ca5f88d4d54e85bb547e653cf06e90ec5fc141cd452b4ae2658b38d1e9d3e6325cd918b357308f0e5e967f3e8d54
- SSDEEP 3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral1/files/0x000b000000012267-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000800000001227e-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000300000000b1f3-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000400000000b1f3-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0005000000004ed7-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000500000000b1f3-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0006000000004ed7-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000600000000b1f3-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000004ed7-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000700000000b1f3-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0008000000004ed7-82.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A18543F5-F69F-46c8-9DC6-AE0B0612F650} {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D} {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D}\stubpath = "C:\\Windows\\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe" {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C} {026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDFB1911-2440-40b6-9F29-33AD5831098E} 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7} {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C} {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{026A0E93-4BD1-4949-AB03-E76C0693EDED} {83303758-D6E7-4d13-9F29-244014EF4D81}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}\stubpath = "C:\\Windows\\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe" {026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C398937B-1ADD-4a1d-BCF1-08D28065592C} {A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C398937B-1ADD-4a1d-BCF1-08D28065592C}\stubpath = "C:\\Windows\\{C398937B-1ADD-4a1d-BCF1-08D28065592C}.exe" {A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEA91A70-BBD3-4040-9B35-96AD9F808D63} {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEA91A70-BBD3-4040-9B35-96AD9F808D63}\stubpath = "C:\\Windows\\{CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe" {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D55F0272-E106-42c0-84E1-0D0060C0C0C7} {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{026A0E93-4BD1-4949-AB03-E76C0693EDED}\stubpath = "C:\\Windows\\{026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe" {83303758-D6E7-4d13-9F29-244014EF4D81}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C}\stubpath = "C:\\Windows\\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe" {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7}\stubpath = "C:\\Windows\\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe" {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1276CCC-9C95-418d-8D12-DB6A0955C433}\stubpath = "C:\\Windows\\{C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe" {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D55F0272-E106-42c0-84E1-0D0060C0C0C7}\stubpath = "C:\\Windows\\{D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe" {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A18543F5-F69F-46c8-9DC6-AE0B0612F650}\stubpath = "C:\\Windows\\{A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe" {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{83303758-D6E7-4d13-9F29-244014EF4D81} {E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{83303758-D6E7-4d13-9F29-244014EF4D81}\stubpath = "C:\\Windows\\{83303758-D6E7-4d13-9F29-244014EF4D81}.exe" {E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDFB1911-2440-40b6-9F29-33AD5831098E}\stubpath = "C:\\Windows\\{DDFB1911-2440-40b6-9F29-33AD5831098E}.exe" 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1276CCC-9C95-418d-8D12-DB6A0955C433} {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe - Deletes itself 1 IoCs
pid Process 2956 cmd.exe - Executes dropped EXE 12 IoCs
pid Process 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 1484 {E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe 1220 {83303758-D6E7-4d13-9F29-244014EF4D81}.exe 2236 {026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe 2252 {A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe 1044 {C398937B-1ADD-4a1d-BCF1-08D28065592C}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe File created C:\Windows\{D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe File created C:\Windows\{A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe File created C:\Windows\{83303758-D6E7-4d13-9F29-244014EF4D81}.exe {E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe File created C:\Windows\{026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe {83303758-D6E7-4d13-9F29-244014EF4D81}.exe File created C:\Windows\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe {026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe File created C:\Windows\{DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe File created C:\Windows\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe File created C:\Windows\{C398937B-1ADD-4a1d-BCF1-08D28065592C}.exe {A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe File created C:\Windows\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe File created C:\Windows\{CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe File created C:\Windows\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe Token: SeIncBasePriorityPrivilege 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe Token: SeIncBasePriorityPrivilege 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe Token: SeIncBasePriorityPrivilege 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe Token: SeIncBasePriorityPrivilege 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe Token: SeIncBasePriorityPrivilege 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe Token: SeIncBasePriorityPrivilege 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe Token: SeIncBasePriorityPrivilege 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe Token: SeIncBasePriorityPrivilege 1484 {E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe Token: SeIncBasePriorityPrivilege 1220 {83303758-D6E7-4d13-9F29-244014EF4D81}.exe Token: SeIncBasePriorityPrivilege 2236 {026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe Token: SeIncBasePriorityPrivilege 2252 {A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2896 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 28 PID 2108 wrote to memory of 2896 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 28 PID 2108 wrote to memory of 2896 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 28 PID 2108 wrote to memory of 2896 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 28 PID 2108 wrote to memory of 2956 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 29 PID 2108 wrote to memory of 2956 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 29 PID 2108 wrote to memory of 2956 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 29 PID 2108 wrote to memory of 2956 2108 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 29 PID 2896 wrote to memory of 2592 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 30 PID 2896 wrote to memory of 2592 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 30 PID 2896 wrote to memory of 2592 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 30 PID 2896 wrote to memory of 2592 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 30 PID 2896 wrote to memory of 2632 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 31 PID 2896 wrote to memory of 2632 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 31 PID 2896 wrote to memory of 2632 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 31 PID 2896 wrote to memory of 2632 2896 {DDFB1911-2440-40b6-9F29-33AD5831098E}.exe 31 PID 2592 wrote to memory of 2556 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 34 PID 2592 wrote to memory of 2556 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 34 PID 2592 wrote to memory of 2556 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 34 PID 2592 wrote to memory of 2556 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 34 PID 2592 wrote to memory of 2392 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 35 PID 2592 wrote to memory of 2392 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 35 PID 2592 wrote to memory of 2392 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 35 PID 2592 wrote to memory of 2392 2592 {CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe 35 PID 2556 wrote to memory of 2932 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 36 PID 2556 wrote to memory of 2932 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 36 PID 2556 wrote to memory of 2932 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 36 PID 2556 wrote to memory of 2932 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 36 PID 2556 wrote to memory of 1944 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 37 PID 2556 wrote to memory of 1944 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 37 PID 2556 wrote to memory of 1944 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 37 PID 2556 wrote to memory of 1944 2556 {C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe 37 PID 2932 wrote to memory of 2724 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 38 PID 2932 wrote to memory of 2724 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 38 PID 2932 wrote to memory of 2724 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 38 PID 2932 wrote to memory of 2724 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 38 PID 2932 wrote to memory of 2444 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 39 PID 2932 wrote to memory of 2444 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 39 PID 2932 wrote to memory of 2444 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 39 PID 2932 wrote to memory of 2444 2932 {F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe 39 PID 2724 wrote to memory of 2280 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 40 PID 2724 wrote to memory of 2280 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 40 PID 2724 wrote to memory of 2280 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 40 PID 2724 wrote to memory of 2280 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 40 PID 2724 wrote to memory of 2764 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 41 PID 2724 wrote to memory of 2764 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 41 PID 2724 wrote to memory of 2764 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 41 PID 2724 wrote to memory of 2764 2724 {C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe 41 PID 2280 wrote to memory of 1256 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 42 PID 2280 wrote to memory of 1256 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 42 PID 2280 wrote to memory of 1256 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 42 PID 2280 wrote to memory of 1256 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 42 PID 2280 wrote to memory of 524 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 43 PID 2280 wrote to memory of 524 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 43 PID 2280 wrote to memory of 524 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 43 PID 2280 wrote to memory of 524 2280 {D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe 43 PID 1256 wrote to memory of 1484 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 44 PID 1256 wrote to memory of 1484 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 44 PID 1256 wrote to memory of 1484 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 44 PID 1256 wrote to memory of 1484 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 44 PID 1256 wrote to memory of 2720 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 45 PID 1256 wrote to memory of 2720 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 45 PID 1256 wrote to memory of 2720 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 45 PID 1256 wrote to memory of 2720 1256 {A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\{DDFB1911-2440-40b6-9F29-33AD5831098E}.exeC:\Windows\{DDFB1911-2440-40b6-9F29-33AD5831098E}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\{CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exeC:\Windows\{CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exeC:\Windows\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exeC:\Windows\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\{C1276CCC-9C95-418d-8D12-DB6A0955C433}.exeC:\Windows\{C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\{D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exeC:\Windows\{D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\{A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exeC:\Windows\{A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exeC:\Windows\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\{83303758-D6E7-4d13-9F29-244014EF4D81}.exeC:\Windows\{83303758-D6E7-4d13-9F29-244014EF4D81}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\{026A0E93-4BD1-4949-AB03-E76C0693EDED}.exeC:\Windows\{026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2236 -
C:\Windows\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exeC:\Windows\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\{C398937B-1ADD-4a1d-BCF1-08D28065592C}.exeC:\Windows\{C398937B-1ADD-4a1d-BCF1-08D28065592C}.exe13⤵
- Executes dropped EXE
PID:1044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9240~1.EXE > nul13⤵PID:2860
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{026A0~1.EXE > nul12⤵PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83303~1.EXE > nul11⤵PID:2256
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6490~1.EXE > nul10⤵PID:1752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1854~1.EXE > nul9⤵PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D55F0~1.EXE > nul8⤵PID:524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1276~1.EXE > nul7⤵PID:2764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F308A~1.EXE > nul6⤵PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4D57~1.EXE > nul5⤵PID:1944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEA91~1.EXE > nul4⤵PID:2392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDFB1~1.EXE > nul3⤵PID:2632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{026A0E93-4BD1-4949-AB03-E76C0693EDED}.exe
- Size 408KB
- SHA256 d2a400a6feecdee876d1c12ed8ac9daa53ac72fc79644cb9e513d919e1a0d1e2
- MD5 7d7e79babda1310a7e7a96d50755b85d
- SHA1 ff47148e8971d969a3668370082b4be5a3f48f07
- SHA512 29ddb0c10412487fe8fed5febd492bd74ade6703abdaa405f0ea945f00e72cf068a48bf1f33d9a9f94371e12cacdd9fe3a972011041fb43ff785e71b388467c2
- SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGYldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{83303758-D6E7-4d13-9F29-244014EF4D81}.exe
- Size 408KB
- SHA256 ea76ade1539e4e160682272d544b9a760075654ca2b089b18e147e781573a7e7
- MD5 3644298aa00d911e18bef9e4f4b8331a
- SHA1 b11001c0611ff0b36cb690d7fc5a5221e4775fa2
- SHA512 8973605e9b737b2fd573abddc4d7aa1bad8569eba4671a2e33187767ad313cb5655d4620f610c6e10ad5f473c4081d104c309301e1016e21d714597106c374bb
- SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGWldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A18543F5-F69F-46c8-9DC6-AE0B0612F650}.exe
- Size 408KB
- SHA256 9034fd97fdd8853d3efcd5a5dfbd445487384ab1e518e87fecf289b246f4c3b9
- MD5 879c40f85dd5b949b2e2af63e93b3e31
- SHA1 c578cf06a040a7314d5fe476b0af0d69082053b2
- SHA512 aba414104fc1039aa518fbd51e6fc0c5f9b1c7e64be314c7ba036fce4920b4fe6f2cc01b1c371f65020f460c94e6922b5fdfb93703295104703d8f0003981189
- SSDEEP 3072:CEGh0oxl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGHldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A9240DE8-FC3D-4d5b-B88F-A10D8846B32C}.exe
- Size 408KB
- SHA256 43259d34599414f4e9e805e76c85aeb328969feff1d9174a2bfcb0eadb2273aa
- MD5 7882f988a4edab9f6c52b3b43d89544e
- SHA1 cb1d137a00aceeee969f2ba8f9447d4ce90929e1
- SHA512 3df70a9aa3808d45d647ab38f96debd9bdd7e3656f2a51d53053fa6852b5aa1c93d4b49579f5c3cc8a2d792176db80e210a41a1d0ff1cc40b11250ebc7f7797e
- SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C1276CCC-9C95-418d-8D12-DB6A0955C433}.exe
- Size 408KB
- SHA256 e3b9388a19e9ebc013a91f9666672cd506a7515e3a74cec6ea857bd8f4122c61
- MD5 7625b02d68eb7797621deca85032ab56
- SHA1 3dd9237f433565210f08c519e16dfe40232c584b
- SHA512 5abae4d8812d1309bdfc227221309c3fc29954db2826350b43d96c09a0f5d0ec3197f573a03491b4543d3aa6a969e5e0a9b1fc6c91b2c2ea78dc051df22a3569
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGjldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C398937B-1ADD-4a1d-BCF1-08D28065592C}.exe
- Size 408KB
- SHA256 dae97e531dad8c160b6496c88b3a5654a8929a539b98842a01b1a31e07fd827e
- MD5 7c59e7fcc5d3e0053eb856570c7dae24
- SHA1 d18a749b2f86c896e47ab6a5d3ead0036d436004
- SHA512 b708b14f5865adf27965c764b818307c6e24717b0f006b48a4df1b290e77ffe7ca054187dfaf1d114119088d4e34a798829c42ab8b9bfe37503cd5ec050b55fa
- SSDEEP 3072:CEGh0okl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGCldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C4D57C6D-29B8-4ffc-AE08-66A474F5437C}.exe
- Size 408KB
- SHA256 39f5af51e97653fe98184475641d8c898f0647d8332a0dce8c193f99dd7a0c28
- MD5 a240adfe4946a04097035ae83ca84c58
- SHA1 6e8fe7f5db3f9e311a73336166025bc066e75688
- SHA512 1fcd72601f42f41209bbdfc5438052e77b629a160be86e934d50109354b3e519ab239f114ac7dbfd0854a33291220f5a97dc7d68efa219c44559458a1702dfe4
- SSDEEP 3072:CEGh0owl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGGldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CEA91A70-BBD3-4040-9B35-96AD9F808D63}.exe
- Size 408KB
- SHA256 e3a1e4e1b336482d334affaaa31e94ea0a3b23db6f7d375a8210d13e69123dcb
- MD5 04978aa8fa31b11dc21a4f9f35a329f8
- SHA1 d438a5c89d87aa242159d6971c7e3eeb58e744db
- SHA512 575782d6ced3eb4fa2661f8d0ba2662256c780204aa233705a7391c3b649e14d5be1b734db07d4437afba2649c10c599f264cd85d7f95e18e4e9de32523de593
- SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D55F0272-E106-42c0-84E1-0D0060C0C0C7}.exe
- Size 408KB
- SHA256 6a6b9b7e4e878c444476df873190cd98755568b0468dbe2a2230f7ebb26551ce
- MD5 834e07d2bf7aac520baa53168f812a21
- SHA1 24b93c5261c3e968e381457effe4f414d430f3bb
- SHA512 4b4157457c756c1bcf61329ed8cc8653928402ff3e167a46164380805ba0b577683b39014897092ccc18124fab74f26a1079bdb2f08ddcf948bf028663224476
- SSDEEP 3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DDFB1911-2440-40b6-9F29-33AD5831098E}.exe
- Size 408KB
- SHA256 a3bcf40566bf9137344e7a145d46ac28de84309ad133f129c76d7a0bbeedd158
- MD5 45a17268dde21f7bfd32ea026d903893
- SHA1 80c987671fa97b6a80660fc61eb8c521e74df359
- SHA512 31ee055d4ca950639ec106a1fbc6562ff2c95c9e47ac37ad817e4554b6e00f6882e19aacdc50df1258c3a81fcd843258569d5bc701b64ea6fdf15c8a1f1bbba9
- SSDEEP 3072:CEGh0ool3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E64906DD-FE91-474b-91A2-E4E6AFA89A3D}.exe
- Size 408KB
- SHA256 80cc64817a99f32df294837ad98be2e4d043d09c84ba99d07469217665c237bb
- MD5 fb04598894f9f03da3b9deb884871132
- SHA1 9139f43b52eb233b66a5cf5a8ae8cdc5d533a5f7
- SHA512 b894b159e2d8f9c1bf133ba63d9138b78b4989a1814cd78fe2317c1b0faf7cc0b7c801e8881189e89a21923354b24a981ee095136c8bca0972e47dca8bbe0852
- SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGaldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F308A1F1-A71C-4a71-87A3-B5D9000A24D7}.exe
- Size 408KB
- SHA256 8752f7992c9805118dc339e6719f1acec7e547dbf1a4de9fb939dcdbc6d6f142
- MD5 1573e93d0ca915cd8f799a11c2cc2f21
- SHA1 a672ae7ceb911b1f9d888039bf749ffdc20f9b6e
- SHA512 6dc3a91aa9d6441dbc7580ebea6dab83e116f39dba7e14e9c7f51cbd53b8490976c0347407f7b195bac48d6c5b249445d5f3b54bfba64cbeab0621bae668b912
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP