Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 13:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe
- Size 408KB
- Sample240302-qvwa9adh21
- SHA256 7fdf03dad9fad6ee62bfd06a26aa03a70731be9e4b9e5ee5769c0e7ba644aef5
- MD5 5f3f94e980cf8ba21845b7267b45bc45
- SHA1 c997313db6935f045f133a2e82fb3d7f87197995
- SHA512 8a2c96de892b54b5e0a44dd5b38b1bf9f1c5ca5f88d4d54e85bb547e653cf06e90ec5fc141cd452b4ae2658b38d1e9d3e6325cd918b357308f0e5e967f3e8d54
- SSDEEP 3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000a000000023131-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023136-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002320b-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023136-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002320b-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023136-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002320b-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000016930-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000002320b-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000016930-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002313a-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000016930-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D22FF9D-6808-4a90-B615-F6C34186A8E9} 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B} {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD232918-770F-470e-AC63-8D6BB9D9CE8B}\stubpath = "C:\\Windows\\{DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe" {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD} {F7F05110-1528-45fe-B873-F93745634470}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}\stubpath = "C:\\Windows\\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe" {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6372BB01-B37A-41d8-89CF-0F94526718E1} {A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42166FE4-39E4-457f-94BA-BDF3E681866B} {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD232918-770F-470e-AC63-8D6BB9D9CE8B} {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE} {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCB9C78F-8712-4c68-9159-96DE50A00026} {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7F05110-1528-45fe-B873-F93745634470} {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42166FE4-39E4-457f-94BA-BDF3E681866B}\stubpath = "C:\\Windows\\{42166FE4-39E4-457f-94BA-BDF3E681866B}.exe" {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA} {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCB9C78F-8712-4c68-9159-96DE50A00026}\stubpath = "C:\\Windows\\{BCB9C78F-8712-4c68-9159-96DE50A00026}.exe" {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3F4B272-62B1-49aa-81E1-B510CD0CB975} {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3F4B272-62B1-49aa-81E1-B510CD0CB975}\stubpath = "C:\\Windows\\{A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe" {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6372BB01-B37A-41d8-89CF-0F94526718E1}\stubpath = "C:\\Windows\\{6372BB01-B37A-41d8-89CF-0F94526718E1}.exe" {A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D22FF9D-6808-4a90-B615-F6C34186A8E9}\stubpath = "C:\\Windows\\{9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe" 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}\stubpath = "C:\\Windows\\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe" {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE}\stubpath = "C:\\Windows\\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe" {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}\stubpath = "C:\\Windows\\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe" {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7F05110-1528-45fe-B873-F93745634470}\stubpath = "C:\\Windows\\{F7F05110-1528-45fe-B873-F93745634470}.exe" {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}\stubpath = "C:\\Windows\\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe" {F7F05110-1528-45fe-B873-F93745634470}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C} {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe - Executes dropped EXE 12 IoCs
pid Process 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 3196 {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe 4056 {A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe 1220 {6372BB01-B37A-41d8-89CF-0F94526718E1}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe File created C:\Windows\{6372BB01-B37A-41d8-89CF-0F94526718E1}.exe {A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe File created C:\Windows\{9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe File created C:\Windows\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe File created C:\Windows\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe File created C:\Windows\{BCB9C78F-8712-4c68-9159-96DE50A00026}.exe {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe File created C:\Windows\{F7F05110-1528-45fe-B873-F93745634470}.exe {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe File created C:\Windows\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe {F7F05110-1528-45fe-B873-F93745634470}.exe File created C:\Windows\{A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe File created C:\Windows\{42166FE4-39E4-457f-94BA-BDF3E681866B}.exe {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe File created C:\Windows\{DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe File created C:\Windows\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe Token: SeIncBasePriorityPrivilege 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe Token: SeIncBasePriorityPrivilege 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe Token: SeIncBasePriorityPrivilege 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe Token: SeIncBasePriorityPrivilege 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe Token: SeIncBasePriorityPrivilege 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe Token: SeIncBasePriorityPrivilege 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe Token: SeIncBasePriorityPrivilege 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe Token: SeIncBasePriorityPrivilege 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe Token: SeIncBasePriorityPrivilege 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe Token: SeIncBasePriorityPrivilege 3196 {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe Token: SeIncBasePriorityPrivilege 4056 {A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 1836 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 92 PID 5064 wrote to memory of 1836 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 92 PID 5064 wrote to memory of 1836 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 92 PID 5064 wrote to memory of 2280 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 93 PID 5064 wrote to memory of 2280 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 93 PID 5064 wrote to memory of 2280 5064 2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe 93 PID 1836 wrote to memory of 2224 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 94 PID 1836 wrote to memory of 2224 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 94 PID 1836 wrote to memory of 2224 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 94 PID 1836 wrote to memory of 1236 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 95 PID 1836 wrote to memory of 1236 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 95 PID 1836 wrote to memory of 1236 1836 {9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe 95 PID 2224 wrote to memory of 528 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 99 PID 2224 wrote to memory of 528 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 99 PID 2224 wrote to memory of 528 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 99 PID 2224 wrote to memory of 4436 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 100 PID 2224 wrote to memory of 4436 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 100 PID 2224 wrote to memory of 4436 2224 {42166FE4-39E4-457f-94BA-BDF3E681866B}.exe 100 PID 528 wrote to memory of 3400 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 101 PID 528 wrote to memory of 3400 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 101 PID 528 wrote to memory of 3400 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 101 PID 528 wrote to memory of 1336 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 102 PID 528 wrote to memory of 1336 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 102 PID 528 wrote to memory of 1336 528 {5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe 102 PID 3400 wrote to memory of 3380 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 103 PID 3400 wrote to memory of 3380 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 103 PID 3400 wrote to memory of 3380 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 103 PID 3400 wrote to memory of 4548 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 104 PID 3400 wrote to memory of 4548 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 104 PID 3400 wrote to memory of 4548 3400 {DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe 104 PID 3380 wrote to memory of 2100 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 105 PID 3380 wrote to memory of 2100 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 105 PID 3380 wrote to memory of 2100 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 105 PID 3380 wrote to memory of 3944 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 106 PID 3380 wrote to memory of 3944 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 106 PID 3380 wrote to memory of 3944 3380 {F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe 106 PID 2100 wrote to memory of 3624 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 107 PID 2100 wrote to memory of 3624 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 107 PID 2100 wrote to memory of 3624 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 107 PID 2100 wrote to memory of 4608 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 108 PID 2100 wrote to memory of 4608 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 108 PID 2100 wrote to memory of 4608 2100 {DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe 108 PID 3624 wrote to memory of 2816 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 112 PID 3624 wrote to memory of 2816 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 112 PID 3624 wrote to memory of 2816 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 112 PID 3624 wrote to memory of 4364 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 113 PID 3624 wrote to memory of 4364 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 113 PID 3624 wrote to memory of 4364 3624 {BCB9C78F-8712-4c68-9159-96DE50A00026}.exe 113 PID 2816 wrote to memory of 4308 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 114 PID 2816 wrote to memory of 4308 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 114 PID 2816 wrote to memory of 4308 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 114 PID 2816 wrote to memory of 1124 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 115 PID 2816 wrote to memory of 1124 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 115 PID 2816 wrote to memory of 1124 2816 {F7F05110-1528-45fe-B873-F93745634470}.exe 115 PID 4308 wrote to memory of 3196 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 116 PID 4308 wrote to memory of 3196 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 116 PID 4308 wrote to memory of 3196 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 116 PID 4308 wrote to memory of 1236 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 117 PID 4308 wrote to memory of 1236 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 117 PID 4308 wrote to memory of 1236 4308 {52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe 117 PID 3196 wrote to memory of 4056 3196 {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe 118 PID 3196 wrote to memory of 4056 3196 {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe 118 PID 3196 wrote to memory of 4056 3196 {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe 118 PID 3196 wrote to memory of 4728 3196 {A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_5f3f94e980cf8ba21845b7267b45bc45_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\{9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exeC:\Windows\{9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\{42166FE4-39E4-457f-94BA-BDF3E681866B}.exeC:\Windows\{42166FE4-39E4-457f-94BA-BDF3E681866B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exeC:\Windows\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\{DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exeC:\Windows\{DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exeC:\Windows\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exeC:\Windows\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\{BCB9C78F-8712-4c68-9159-96DE50A00026}.exeC:\Windows\{BCB9C78F-8712-4c68-9159-96DE50A00026}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\{F7F05110-1528-45fe-B873-F93745634470}.exeC:\Windows\{F7F05110-1528-45fe-B873-F93745634470}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exeC:\Windows\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\{A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exeC:\Windows\{A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exeC:\Windows\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\{6372BB01-B37A-41d8-89CF-0F94526718E1}.exeC:\Windows\{6372BB01-B37A-41d8-89CF-0F94526718E1}.exe13⤵
- Executes dropped EXE
PID:1220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6E6F~1.EXE > nul13⤵PID:4540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3F4B~1.EXE > nul12⤵PID:4728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52751~1.EXE > nul11⤵PID:1236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7F05~1.EXE > nul10⤵PID:1124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCB9C~1.EXE > nul9⤵PID:4364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC58C~1.EXE > nul8⤵PID:4608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6796~1.EXE > nul7⤵PID:3944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD232~1.EXE > nul6⤵PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C629~1.EXE > nul5⤵PID:1336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42166~1.EXE > nul4⤵PID:4436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D22F~1.EXE > nul3⤵PID:1236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{42166FE4-39E4-457f-94BA-BDF3E681866B}.exe
- Size 408KB
- SHA256 27185a146967106503901acad2b80e362efc2912c40ed5cd4b27705210108780
- MD5 87512db1c85143fa8661cb0fb5d4807b
- SHA1 50361fe0a3cb626534689994460d1469f257e4eb
- SHA512 2039dd6f35fca8274bb48343fa273936a4121b921c57c50d60247b888209c56fb62f2bcee506203c39713512c0575bcbeb7c3e996354d118f9656287ec6db561
- SSDEEP 3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGaldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{52751F0E-F8E6-40e4-A8AD-025B9DD54AAD}.exe
- Size 408KB
- SHA256 68f119df244c047d93e394047a2b74da8535dabc1ecc979882b68a7bbed26e20
- MD5 dd5a8cb0881294c505fa9225a2b52538
- SHA1 2549bbe6ee6648387a1fa677ba729b9e9defffa7
- SHA512 bb7c669f4185857ed5729703e4b500fb9acdd45412484dfbd0cda7f98b5ce9d8c1a95449dca875910d9772dfe63f4676674445eeaf493090695e2d7d2f3015da
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGYldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5C629ADA-F811-4e0c-9628-BCA0C0A7F92B}.exe
- Size 408KB
- SHA256 0712a04320a6131ae139b4b49919a6d14adefbbafa9a1e0326516a271a562b1f
- MD5 97a652d9af446ebef865ee59882a2636
- SHA1 a2b6e921f851ada8b525f9744e7afd7408dbec2e
- SHA512 c7bbb29e3da8a012c1254156e2906f2ffc6cd75abb5d61f0dd4bd358b0365260548af4575ecbd2d09e6ebab695c1a18b9f78eb6f4f763fb4ef1ac118a6d5a2b7
- SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6372BB01-B37A-41d8-89CF-0F94526718E1}.exe
- Size 408KB
- SHA256 0dcac379ccbac5feb9758c80f9b22f008fe81ea6e77def180a38265f5c594965
- MD5 5faa881d2975cc0bfcd09d79cbf323ad
- SHA1 5ea4a6aff2f974da5701c4049a62aa3ea8cd1982
- SHA512 545b504a8df891c23479686e1493ee466104a6270212c1db4a32088da85fa76b980dd8fbec4775c18a2c96e2fecbc3d9bde6b58c5867687ea1fc5a99d35b2051
- SSDEEP 3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9D22FF9D-6808-4a90-B615-F6C34186A8E9}.exe
- Size 408KB
- SHA256 0afef6631603ca7e68d8ff507c08737c81928fc5f88cbe2790de3786fc54f418
- MD5 36c07f0c9a62086ba6a3b621b22080ce
- SHA1 6039648b5b0672e98954d9e9b75fed1ce4ee9fc2
- SHA512 a7c83ce98b5ac1a28216adafefc15394f8ee00e5fa63f46aded1438059a01744574b5cd72778c371d0b0189d44fe209c72338f556d110ca4dd9d0e32070780c5
- SSDEEP 3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A3F4B272-62B1-49aa-81E1-B510CD0CB975}.exe
- Size 408KB
- SHA256 9c7269d32cdfd50e76ad8dec1f9e450fbada30bb3f1b04ab7529338f54f3eabc
- MD5 86bd63312c9ef20a26085fa9507b19c0
- SHA1 2ceb2905268212139280904c01214ebc73500c57
- SHA512 afd4dd5461ea59000d46edf6e8c97c89a274d6735bd6df47e0439dcecbd12c16b76b4173add51e74f4ac47e1910d590f12673e2adfd4148f5758f5e2b9b93485
- SSDEEP 3072:CEGh0oRl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A6E6F76C-2149-4a27-A6E9-09DC1A84CE7C}.exe
- Size 408KB
- SHA256 ed196f9f1221aa6ec8ca168c030daeea64991557c7631b4e5580553a5d42d336
- MD5 48eb204e97af551afcea4522fb80e53f
- SHA1 d16e2103a5ff661ad272f794893b55b767668cac
- SHA512 7cad2dfc5a3f36c01a82c8420812449b091027ae2fc859d7595f6543ab575b2bfa2264264c8e68039f35f4949c42b9bbb480943ad8469282bd8cfa393b25cbd3
- SSDEEP 3072:CEGh0obl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG5ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BCB9C78F-8712-4c68-9159-96DE50A00026}.exe
- Size 408KB
- SHA256 b998ad5a3b196f228dbc5d31aa4bcc84ba0c5e77a6630cc493c8e92b93eb56b8
- MD5 f366512945dcf497eba0fc79fc06a975
- SHA1 fdcc011ba65013acf007caa22726d98e87a49985
- SHA512 2d943abbeca1d2a0717b73398ce2d951d99b92e4ce0b7f75d9ae58f945fa843d83c6f59943f23b1523e5dc8183c8fbc20cc2289702a506c16cbd0e28660d0c3e
- SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGJldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DC58C4EB-D1C0-41b8-A8E4-7D7E18B009CA}.exe
- Size 408KB
- SHA256 231f5f48b1f22a8b22f4462d77d34afba79785704208583e189db7cbf8e9208f
- MD5 bacefea36ef80128d6453f74d18f879c
- SHA1 204e7d3e0306bf81bce15405fc483b25b70686be
- SHA512 6f1f22fe859959894736c565b8ca5601bf80770e00135881ebcc8f887ced69100a438d299c3411b5512de7bae6ea9a571ba1e75eb07843f8c0adcc4ce4094c23
- SSDEEP 3072:CEGh0ool3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGqldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DD232918-770F-470e-AC63-8D6BB9D9CE8B}.exe
- Size 408KB
- SHA256 83d2ec9b69017a6123520a3d66a09ba06057e8756891700d1995a2d80b29a1a4
- MD5 2d4c935662443efaf75af8d7c9d73e3e
- SHA1 65e07448e01e686892998887b27f640ad20c044a
- SHA512 05b4b0ef632ba0a55dfc0abbe7f705702f2e678d93784746f872c0e710ed0b55138a0946f2ee2b8a084eb06dfa18a8f49eb83263aea5a2891d4f10a8fc3a586b
- SSDEEP 3072:CEGh0oal3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F6796F5D-677B-4b50-A852-86BCFB2FF7CE}.exe
- Size 408KB
- SHA256 b071664757f5ae88a4f619b15e00c8f2c71e2eb2a430bf3211d6cab7d581c597
- MD5 873d96c5ec9aec283c03fd73c1969126
- SHA1 f8d580e840cfa329faa82e8d41e9e09d02c8b3ef
- SHA512 ce6fe691eb993b09d695c94e293f6ad7751ba3b63087828ed2932ad3ee1ebc86e02cbe2923aa7616077210f4b96d8dee73b65240acfb32555bba92784858e58f
- SSDEEP 3072:CEGh0oal3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGUldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F7F05110-1528-45fe-B873-F93745634470}.exe
- Size 408KB
- SHA256 adf7dfad4da436cdb5d4679d9dd7d1b379d8bf381fa6ac7ddeccc29840c0cc0d
- MD5 ebe4f453a7542fe4781b9a6995e7e20f
- SHA1 3c3c0691c17edc44cce548f8a7463e2f925c1b0a
- SHA512 a7c70c1b92bd5638c8619d28bdd96e4c797f1b6ff61ca7f7b0e2872a588af7a19b16f9f07c11b634df1907f00c89544828ec558251847e988d85c52a89f8d65c
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGAldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP