Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 15:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe
- Size 408KB
- Sample240302-s4vgesfa73
- SHA256 d79ff54a385e5fa2a76ef1f619ce631c671324f035b388f68a2b2d4367d44c7a
- MD5 4d4583ea71533928c0ed7c4358723e76
- SHA1 97e79d86fb261fd83077579a9f6f77b4d053681a
- SHA512 125be5de78f9788a862d2f0c0a6013ef3e6042afd98a8a01cf84d8eb510b847a6cb1d8d392aa792d1d6a820707782059a9201131736092877896c573a1eaaefd
- SSDEEP 3072:CEGh0oxl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGzldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000a00000002324f-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023250-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023258-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00030000000227e7-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000022e9f-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00040000000227e7-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000022e9f-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00050000000227e7-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000022e9f-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00060000000227e7-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000022e9f-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000227e7-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1} {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF093121-32EA-45fc-B8DA-B52ECB87BA03}\stubpath = "C:\\Windows\\{EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe" {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{034E332D-0412-4935-8C41-6AA50F3CCBFD} {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44AA0CAB-77C4-4740-966F-C8C82A580C3F}\stubpath = "C:\\Windows\\{44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe" {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F532496-CAF6-4f95-B140-B7825801538D} {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F532496-CAF6-4f95-B140-B7825801538D}\stubpath = "C:\\Windows\\{6F532496-CAF6-4f95-B140-B7825801538D}.exe" {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{865F7F54-3C5E-4769-83D5-7CAC075D5164} 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF093121-32EA-45fc-B8DA-B52ECB87BA03} {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07} {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A} {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}\stubpath = "C:\\Windows\\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe" {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECBDB31E-7782-4991-9A50-5E69FC8F268B} {6F532496-CAF6-4f95-B140-B7825801538D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1} {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{034E332D-0412-4935-8C41-6AA50F3CCBFD}\stubpath = "C:\\Windows\\{034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe" {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44AA0CAB-77C4-4740-966F-C8C82A580C3F} {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{865F7F54-3C5E-4769-83D5-7CAC075D5164}\stubpath = "C:\\Windows\\{865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe" 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}\stubpath = "C:\\Windows\\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe" {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}\stubpath = "C:\\Windows\\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe" {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7213B05B-A6CC-47c3-AC31-7871053B57F4} {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7213B05B-A6CC-47c3-AC31-7871053B57F4}\stubpath = "C:\\Windows\\{7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe" {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E} {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}\stubpath = "C:\\Windows\\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe" {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A}\stubpath = "C:\\Windows\\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe" {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECBDB31E-7782-4991-9A50-5E69FC8F268B}\stubpath = "C:\\Windows\\{ECBDB31E-7782-4991-9A50-5E69FC8F268B}.exe" {6F532496-CAF6-4f95-B140-B7825801538D}.exe - Executes dropped EXE 12 IoCs
pid Process 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 4592 {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe 1004 {6F532496-CAF6-4f95-B140-B7825801538D}.exe 2860 {ECBDB31E-7782-4991-9A50-5E69FC8F268B}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe File created C:\Windows\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe File created C:\Windows\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe File created C:\Windows\{7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe File created C:\Windows\{44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe File created C:\Windows\{865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe File created C:\Windows\{EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe File created C:\Windows\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe File created C:\Windows\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe File created C:\Windows\{034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe File created C:\Windows\{6F532496-CAF6-4f95-B140-B7825801538D}.exe {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe File created C:\Windows\{ECBDB31E-7782-4991-9A50-5E69FC8F268B}.exe {6F532496-CAF6-4f95-B140-B7825801538D}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe Token: SeIncBasePriorityPrivilege 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe Token: SeIncBasePriorityPrivilege 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe Token: SeIncBasePriorityPrivilege 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe Token: SeIncBasePriorityPrivilege 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe Token: SeIncBasePriorityPrivilege 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe Token: SeIncBasePriorityPrivilege 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe Token: SeIncBasePriorityPrivilege 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe Token: SeIncBasePriorityPrivilege 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe Token: SeIncBasePriorityPrivilege 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe Token: SeIncBasePriorityPrivilege 4592 {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe Token: SeIncBasePriorityPrivilege 1004 {6F532496-CAF6-4f95-B140-B7825801538D}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1960 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe 98 PID 1096 wrote to memory of 1960 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe 98 PID 1096 wrote to memory of 1960 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe 98 PID 1096 wrote to memory of 1844 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe 99 PID 1096 wrote to memory of 1844 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe 99 PID 1096 wrote to memory of 1844 1096 2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe 99 PID 1960 wrote to memory of 64 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 100 PID 1960 wrote to memory of 64 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 100 PID 1960 wrote to memory of 64 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 100 PID 1960 wrote to memory of 4172 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 101 PID 1960 wrote to memory of 4172 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 101 PID 1960 wrote to memory of 4172 1960 {865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe 101 PID 64 wrote to memory of 1368 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 104 PID 64 wrote to memory of 1368 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 104 PID 64 wrote to memory of 1368 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 104 PID 64 wrote to memory of 548 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 105 PID 64 wrote to memory of 548 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 105 PID 64 wrote to memory of 548 64 {BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe 105 PID 1368 wrote to memory of 2112 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 108 PID 1368 wrote to memory of 2112 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 108 PID 1368 wrote to memory of 2112 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 108 PID 1368 wrote to memory of 4056 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 109 PID 1368 wrote to memory of 4056 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 109 PID 1368 wrote to memory of 4056 1368 {EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe 109 PID 2112 wrote to memory of 5056 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 110 PID 2112 wrote to memory of 5056 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 110 PID 2112 wrote to memory of 5056 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 110 PID 2112 wrote to memory of 1920 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 111 PID 2112 wrote to memory of 1920 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 111 PID 2112 wrote to memory of 1920 2112 {A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe 111 PID 5056 wrote to memory of 316 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 112 PID 5056 wrote to memory of 316 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 112 PID 5056 wrote to memory of 316 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 112 PID 5056 wrote to memory of 3552 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 113 PID 5056 wrote to memory of 3552 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 113 PID 5056 wrote to memory of 3552 5056 {5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe 113 PID 316 wrote to memory of 3688 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 114 PID 316 wrote to memory of 3688 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 114 PID 316 wrote to memory of 3688 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 114 PID 316 wrote to memory of 4364 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 115 PID 316 wrote to memory of 4364 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 115 PID 316 wrote to memory of 4364 316 {E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe 115 PID 3688 wrote to memory of 3512 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 116 PID 3688 wrote to memory of 3512 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 116 PID 3688 wrote to memory of 3512 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 116 PID 3688 wrote to memory of 2088 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 117 PID 3688 wrote to memory of 2088 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 117 PID 3688 wrote to memory of 2088 3688 {7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe 117 PID 3512 wrote to memory of 5112 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 118 PID 3512 wrote to memory of 5112 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 118 PID 3512 wrote to memory of 5112 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 118 PID 3512 wrote to memory of 64 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 119 PID 3512 wrote to memory of 64 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 119 PID 3512 wrote to memory of 64 3512 {8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe 119 PID 5112 wrote to memory of 4592 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 120 PID 5112 wrote to memory of 4592 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 120 PID 5112 wrote to memory of 4592 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 120 PID 5112 wrote to memory of 3836 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 121 PID 5112 wrote to memory of 3836 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 121 PID 5112 wrote to memory of 3836 5112 {034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe 121 PID 4592 wrote to memory of 1004 4592 {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe 122 PID 4592 wrote to memory of 1004 4592 {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe 122 PID 4592 wrote to memory of 1004 4592 {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe 122 PID 4592 wrote to memory of 4584 4592 {44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_4d4583ea71533928c0ed7c4358723e76_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\{865F7F54-3C5E-4769-83D5-7CAC075D5164}.exeC:\Windows\{865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exeC:\Windows\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\{EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exeC:\Windows\{EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exeC:\Windows\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exeC:\Windows\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exeC:\Windows\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\{7213B05B-A6CC-47c3-AC31-7871053B57F4}.exeC:\Windows\{7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exeC:\Windows\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\{034E332D-0412-4935-8C41-6AA50F3CCBFD}.exeC:\Windows\{034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\{44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exeC:\Windows\{44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\{6F532496-CAF6-4f95-B140-B7825801538D}.exeC:\Windows\{6F532496-CAF6-4f95-B140-B7825801538D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1004 -
C:\Windows\{ECBDB31E-7782-4991-9A50-5E69FC8F268B}.exeC:\Windows\{ECBDB31E-7782-4991-9A50-5E69FC8F268B}.exe13⤵
- Executes dropped EXE
PID:2860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F532~1.EXE > nul13⤵PID:3192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44AA0~1.EXE > nul12⤵PID:4584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{034E3~1.EXE > nul11⤵PID:3836
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FEC9~1.EXE > nul10⤵PID:64
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7213B~1.EXE > nul9⤵PID:2088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E555C~1.EXE > nul8⤵PID:4364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5898D~1.EXE > nul7⤵PID:3552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0BB6~1.EXE > nul6⤵PID:1920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF093~1.EXE > nul5⤵PID:4056
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDDE2~1.EXE > nul4⤵PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{865F7~1.EXE > nul3⤵PID:4172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:1716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{034E332D-0412-4935-8C41-6AA50F3CCBFD}.exe
- Size 408KB
- SHA256 830eddf61418d39bdd59e8668fd163847d0feec3e9592cc4ae5913e0580a0127
- MD5 80a50b08ca8c80cae5346cba080df9f6
- SHA1 ea9b22c27dbf7acd2ad38c0b3ad07b126d0b747d
- SHA512 173e410df801a7aeb0a22f0bb0f01c98821fca826938e10c1e0b0b6497fe135fe45739115d87e413c69da58b15e7d793596992e1e90fd5759324468c8d6ab8ba
- SSDEEP 3072:CEGh0o0l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGSldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{44AA0CAB-77C4-4740-966F-C8C82A580C3F}.exe
- Size 408KB
- SHA256 6d6bfc4111a289f5a4082482aaed91b863599b1a93ffef04a6ce78f637ca1c92
- MD5 4e5250feaeca6d617c182aa6c089d491
- SHA1 f38631a2ee0783e2be6881ba3a876ffbdcdb3b21
- SHA512 077fe534e2b42838291a71c4a42372266afae5f0f2bf068802ed06002bf341c2ddc33e6eec64cdf36c27e86e3362b6e20d5ccd6fda0b9507fb756358bd1df6d1
- SSDEEP 3072:CEGh0oXl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGhldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5898D6D0-4CEF-4fab-80F2-89F879EB9B5E}.exe
- Size 408KB
- SHA256 d27b070d0661006e29e1c7e4e6cfd547d1ee85b48e76fcde4cbeae4ca6057792
- MD5 00c217a90d209df91d2b1a3cee097675
- SHA1 7ee892ed78922fa87caa40d78ca1e604ee37fe35
- SHA512 dc1e1913c6bb6139630780f40ff861c86922269e13b38013ef5dfb31bcdaa92e99146222d9924300285332f790c343353dad59835122607b248bc9716af54a55
- SSDEEP 3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGildOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6F532496-CAF6-4f95-B140-B7825801538D}.exe
- Size 408KB
- SHA256 c1c875cd1561e0fdff615cb602f7823427db571cba7ab4fff0ee6f1932c951fd
- MD5 1ecbeb5c820f70132a54e83c93edf963
- SHA1 e7cace3418f23ee4c4b64f9f4548330db24e23b5
- SHA512 25fad48d04445cf6442a03fc94152ee48550de9e0fa964159c33bee82dcb43bc57e7c0d447d208616af019fa8390af5ed367603a9081b0fbaeb3634427749c47
- SSDEEP 3072:CEGh0o9Dl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTB1:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7213B05B-A6CC-47c3-AC31-7871053B57F4}.exe
- Size 408KB
- SHA256 551767228df284e7f8f937fdfa5564bd054335de6f685bae2bab771662e1bece
- MD5 f2688775c6d1784499b3636549f8fd96
- SHA1 8765b7c1d0b3d6262e98129d2638c8e5d32036c7
- SHA512 d83326592126a591c3021d6682452ea460065f0737cca2eb53817680991cf328ab707c631e1e1ea213301994ec30e6d951f436911b1831a6625c5bbdf164c47a
- SSDEEP 3072:CEGh0orl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGVldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{865F7F54-3C5E-4769-83D5-7CAC075D5164}.exe
- Size 408KB
- SHA256 5b6be602592d12a25186f17fc2e28b6c4e91a0f3d4bd59794d4a26ac8ad62af9
- MD5 6dd72cfc2b346057eb66a98134a63f97
- SHA1 07628a87f205202a639d635a4ffff9edd7a5683f
- SHA512 0445b7478bf1c81a7ef23ed4f164175fcbeeeeed93c1abfbdda36bbb98c46af99d4b013cebc546db1b22f169a97354bec1659f9e669f61c57872bb75daa21264
- SSDEEP 3072:CEGh0otl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGrldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8FEC9553-D2F3-4e80-B7E8-338986AEDBC1}.exe
- Size 408KB
- SHA256 bd406060109a1a0ec99c58138822545a1718be69098574814fa565c50eb71b37
- MD5 37712e196adf5665e58e83634fb523da
- SHA1 4f94a387d4eb6a8528a200e8c3e98b01f48be3f7
- SHA512 970d18346b2462d411a4492eb10a2cc616978bb394c8dc88fdccb80a04344faddb809ee1e50d4da729cbd4492e157fbd1b58a55e034831280864cac7f6b82aff
- SSDEEP 3072:CEGh0otl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGfldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A0BB66A3-CF55-4f0c-BAD3-2E2A3B04FB07}.exe
- Size 408KB
- SHA256 f4bbbce301c506e6cf4065093be8a1e51a2e183c8375fa6dc18b6069b2d6da94
- MD5 62821ae91fa6c9d71bbd911b6a618159
- SHA1 9926c33a8325d442a0217344a95579f6e5c033cc
- SHA512 ebf6c3321c368fc718d452c1bf30ffd9503c7d807736cf4c459a053c0a733229d90701da291ab1f6bc5e19d5f4ed6bf616aad66cd01ab931ad668c8b38e52fd7
- SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGNldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BDDE29DF-29A0-40fa-A75F-FA067C0DFFF1}.exe
- Size 408KB
- SHA256 d1a7e4780be65fa973a6d6399fc1d3b412f4223ed726de9ab3ab66835782b122
- MD5 944fd1b20c2883d46e97f61415be7b58
- SHA1 9f4673a37290b8e1ba5d1ecc6e0ae1a441d9db0e
- SHA512 31d8dbf405681be8aa95d7dab0d5ab852b24885071af7623b36683ba02c380dcb98547212d614fe131e85fd83f8fb1f928fbd4cae88616f6fb110bf35dd2bd8c
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG6ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E555C15F-5B24-4c8b-A8E0-EAAF4386125A}.exe
- Size 408KB
- SHA256 936636ec88c0d3a698adfd3cc3c2ffa1c2c4502cfdc9de623846c9808aaf5b33
- MD5 ad8a48bcc4508fab472e61ca2bb3b6b6
- SHA1 b0390907e51e077234159bc6f5ffd9567989114b
- SHA512 ec6f2663aa48a51d4b3a7b152dc0954652f5bcb3e5da648a10fe1893667e6d90756c491630c161f095408f0f5f967a7a8ae7eb278d791b5885c2d26081237175
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGIldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ECBDB31E-7782-4991-9A50-5E69FC8F268B}.exe
- Size 408KB
- SHA256 8be25d4d402f401f98f8b8031a20cb03b14aeb288e03c98e63f777766df6b77b
- MD5 55d55d1a28a816f7166360a938a35ddd
- SHA1 b9a2e29769661ee034e802d25b02932e5509fc9c
- SHA512 6081ef362d6310a080bccc26a426aba479eb9e92c8710bf1851f697db486b5b6d9c37e1a64afb119eac43da645c94963f80d3838eae9a1d52120a46252c15dca
- SSDEEP 3072:CEGh0oHl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGVldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF093121-32EA-45fc-B8DA-B52ECB87BA03}.exe
- Size 408KB
- SHA256 71fe90bcd7c862f192bc10ace88eca93d172f630da0e8df241d675ec6a2ac100
- MD5 510efff6acf440202a48561a1a69d32d
- SHA1 aa0b5bec2294178fe1e9ef42c09ae2e3c77035ab
- SHA512 a1bb4dacfceeeaa1696372c0ffbcad24eebb0e12b31f9a07e53cd0a89946a9f22600541e7f4dd1b9f986b9b4767d2497d41bf5933d096f49d43aa3951f053ab1
- SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGlldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP