Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 16:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe
- Size 168KB
- Sample240302-vfvtdsff33
- SHA256 0d7d4bee91eb3dfc43900f1d30439341b1507e29f7d7152e6ac5ab559b1d2e6d
- MD5 6fa33dffb21d10d14095528cdbe34b19
- SHA1 a8e41e03baae5406b72c426d27bb3097dcb88ce3
- SHA512 7b4bec81ae39baa6a907bef2f926281765828f0f36db13a0d4ee66573f3ff9d76958a80aef452cd4cf37c8adf213bd3d5a6bbf6a341d4d17e0bc23f56642f5f8
- SSDEEP 1536:1EGh0oilq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oilqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0008000000023204-3.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231f4-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002320c-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023122-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002320c-17.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023122-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002320c-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023122-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002320c-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023122-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023209-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023122-45.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1} 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80E53BD1-226D-4c06-AD74-376DEDC31069} {2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80E53BD1-226D-4c06-AD74-376DEDC31069}\stubpath = "C:\\Windows\\{80E53BD1-226D-4c06-AD74-376DEDC31069}.exe" {2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CEBE9B0-5AB0-41d2-9272-B87650119D75} {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CEBE9B0-5AB0-41d2-9272-B87650119D75}\stubpath = "C:\\Windows\\{7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe" {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3}\stubpath = "C:\\Windows\\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe" {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A69AC95-0958-493b-8CCF-E8677B78644E} {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{245985A7-0489-4f2f-8DCB-829BA6314A4F} {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{468392F1-5AA8-48eb-A40C-7AF181397E44} {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{468392F1-5AA8-48eb-A40C-7AF181397E44}\stubpath = "C:\\Windows\\{468392F1-5AA8-48eb-A40C-7AF181397E44}.exe" {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B} {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}\stubpath = "C:\\Windows\\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe" {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3} {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}\stubpath = "C:\\Windows\\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe" {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{245985A7-0489-4f2f-8DCB-829BA6314A4F}\stubpath = "C:\\Windows\\{245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe" {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}\stubpath = "C:\\Windows\\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe" {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}\stubpath = "C:\\Windows\\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe" 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B} {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}\stubpath = "C:\\Windows\\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe" {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A69AC95-0958-493b-8CCF-E8677B78644E}\stubpath = "C:\\Windows\\{2A69AC95-0958-493b-8CCF-E8677B78644E}.exe" {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D} {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26} {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8} {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8}\stubpath = "C:\\Windows\\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe" {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe - Executes dropped EXE 12 IoCs
pid Process 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 3384 {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe 4640 {2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe 4928 {80E53BD1-226D-4c06-AD74-376DEDC31069}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe File created C:\Windows\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe File created C:\Windows\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe File created C:\Windows\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe File created C:\Windows\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe File created C:\Windows\{468392F1-5AA8-48eb-A40C-7AF181397E44}.exe {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe File created C:\Windows\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe File created C:\Windows\{80E53BD1-226D-4c06-AD74-376DEDC31069}.exe {2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe File created C:\Windows\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe File created C:\Windows\{7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe File created C:\Windows\{2A69AC95-0958-493b-8CCF-E8677B78644E}.exe {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe File created C:\Windows\{245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe Token: SeIncBasePriorityPrivilege 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe Token: SeIncBasePriorityPrivilege 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe Token: SeIncBasePriorityPrivilege 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe Token: SeIncBasePriorityPrivilege 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe Token: SeIncBasePriorityPrivilege 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe Token: SeIncBasePriorityPrivilege 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe Token: SeIncBasePriorityPrivilege 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe Token: SeIncBasePriorityPrivilege 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe Token: SeIncBasePriorityPrivilege 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe Token: SeIncBasePriorityPrivilege 3384 {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe Token: SeIncBasePriorityPrivilege 4640 {2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 2088 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe 94 PID 4584 wrote to memory of 2088 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe 94 PID 4584 wrote to memory of 2088 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe 94 PID 4584 wrote to memory of 1612 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe 95 PID 4584 wrote to memory of 1612 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe 95 PID 4584 wrote to memory of 1612 4584 2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe 95 PID 2088 wrote to memory of 2172 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 96 PID 2088 wrote to memory of 2172 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 96 PID 2088 wrote to memory of 2172 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 96 PID 2088 wrote to memory of 8 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 97 PID 2088 wrote to memory of 8 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 97 PID 2088 wrote to memory of 8 2088 {45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe 97 PID 2172 wrote to memory of 2324 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 100 PID 2172 wrote to memory of 2324 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 100 PID 2172 wrote to memory of 2324 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 100 PID 2172 wrote to memory of 4960 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 101 PID 2172 wrote to memory of 4960 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 101 PID 2172 wrote to memory of 4960 2172 {7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe 101 PID 2324 wrote to memory of 3844 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 103 PID 2324 wrote to memory of 3844 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 103 PID 2324 wrote to memory of 3844 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 103 PID 2324 wrote to memory of 3592 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 104 PID 2324 wrote to memory of 3592 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 104 PID 2324 wrote to memory of 3592 2324 {ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe 104 PID 3844 wrote to memory of 4376 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 105 PID 3844 wrote to memory of 4376 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 105 PID 3844 wrote to memory of 4376 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 105 PID 3844 wrote to memory of 4176 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 106 PID 3844 wrote to memory of 4176 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 106 PID 3844 wrote to memory of 4176 3844 {4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe 106 PID 4376 wrote to memory of 4052 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 107 PID 4376 wrote to memory of 4052 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 107 PID 4376 wrote to memory of 4052 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 107 PID 4376 wrote to memory of 648 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 108 PID 4376 wrote to memory of 648 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 108 PID 4376 wrote to memory of 648 4376 {A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe 108 PID 4052 wrote to memory of 1152 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 109 PID 4052 wrote to memory of 1152 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 109 PID 4052 wrote to memory of 1152 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 109 PID 4052 wrote to memory of 4716 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 110 PID 4052 wrote to memory of 4716 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 110 PID 4052 wrote to memory of 4716 4052 {2A69AC95-0958-493b-8CCF-E8677B78644E}.exe 110 PID 1152 wrote to memory of 1864 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 111 PID 1152 wrote to memory of 1864 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 111 PID 1152 wrote to memory of 1864 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 111 PID 1152 wrote to memory of 1060 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 112 PID 1152 wrote to memory of 1060 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 112 PID 1152 wrote to memory of 1060 1152 {2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe 112 PID 1864 wrote to memory of 3496 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 113 PID 1864 wrote to memory of 3496 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 113 PID 1864 wrote to memory of 3496 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 113 PID 1864 wrote to memory of 3924 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 114 PID 1864 wrote to memory of 3924 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 114 PID 1864 wrote to memory of 3924 1864 {245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe 114 PID 3496 wrote to memory of 3384 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 115 PID 3496 wrote to memory of 3384 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 115 PID 3496 wrote to memory of 3384 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 115 PID 3496 wrote to memory of 3176 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 116 PID 3496 wrote to memory of 3176 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 116 PID 3496 wrote to memory of 3176 3496 {468392F1-5AA8-48eb-A40C-7AF181397E44}.exe 116 PID 3384 wrote to memory of 4640 3384 {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe 117 PID 3384 wrote to memory of 4640 3384 {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe 117 PID 3384 wrote to memory of 4640 3384 {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe 117 PID 3384 wrote to memory of 4980 3384 {F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_6fa33dffb21d10d14095528cdbe34b19_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exeC:\Windows\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\{7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exeC:\Windows\{7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exeC:\Windows\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exeC:\Windows\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exeC:\Windows\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\{2A69AC95-0958-493b-8CCF-E8677B78644E}.exeC:\Windows\{2A69AC95-0958-493b-8CCF-E8677B78644E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exeC:\Windows\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\{245985A7-0489-4f2f-8DCB-829BA6314A4F}.exeC:\Windows\{245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\{468392F1-5AA8-48eb-A40C-7AF181397E44}.exeC:\Windows\{468392F1-5AA8-48eb-A40C-7AF181397E44}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exeC:\Windows\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exeC:\Windows\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4640 -
C:\Windows\{80E53BD1-226D-4c06-AD74-376DEDC31069}.exeC:\Windows\{80E53BD1-226D-4c06-AD74-376DEDC31069}.exe13⤵
- Executes dropped EXE
PID:4928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F167~1.EXE > nul13⤵PID:4544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F37DA~1.EXE > nul12⤵PID:4980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46839~1.EXE > nul11⤵PID:3176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24598~1.EXE > nul10⤵PID:3924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FEF0~1.EXE > nul9⤵PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A69A~1.EXE > nul8⤵PID:4716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A32C2~1.EXE > nul7⤵PID:648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BCDC~1.EXE > nul6⤵PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED1A6~1.EXE > nul5⤵PID:3592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7CEBE~1.EXE > nul4⤵PID:4960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45EEE~1.EXE > nul3⤵PID:8
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{245985A7-0489-4f2f-8DCB-829BA6314A4F}.exe
- Size 168KB
- SHA256 ef5ed86cb2a636904c7ab7b785e387d4f3d6a9905295aa6a00db885ce811a766
- MD5 9281adfb334c5190ad304dfb3cd91863
- SHA1 e9209e5537ead9e068cf8b892e69bb63776af840
- SHA512 b8343700714a399c74f57e7d7217623a02ec964356ddf2bbe90214f478a87a65f0d22bf9ec18f437dd8efff2a5c0546c691922846b4507e7a8819c138d368a92
- SSDEEP 1536:1EGh0onlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0onlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2A69AC95-0958-493b-8CCF-E8677B78644E}.exe
- Size 168KB
- SHA256 9f8387b4f56f8e5fb6bb848b5662af1b5e5bba652456391da599d20962c8337b
- MD5 2c31f96a260e2b07dc96e432ef85a862
- SHA1 ea1c162a777f39a9ad6921f565e25295dcc66ecc
- SHA512 0aa3a78d5a10e2beee760c5c61804cf85f8fc5e2036b9f104e0ac653f0bb10dd549b22446f6a312ac600dec1e90ab94f51534e184c27c06c7a2828b078de730b
- SSDEEP 1536:1EGh0oKlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oKlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2F167C51-3EC3-41ec-8628-1EBEEB714AE8}.exe
- Size 168KB
- SHA256 e7c3f1017cc605383d862383a28b865699ab88f041c3396d8882681928cf0b9a
- MD5 9ef93d5da0a07f6319af8f47de5d9e63
- SHA1 83aed60f87e8c60f6fef5c69bdaa3dda8f45809a
- SHA512 eb18ad7871f33b9ca2a2a3761e34eda71bab76b060142f9666656d2c4506281c2bb8af256ea18216c8b67caa8d9369ddaeace1b5dfc296f3e8407c4b96c248e3
- SSDEEP 1536:1EGh0oDlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oDlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2FEF0BED-2A3A-4fc0-867B-D9741DE4F03D}.exe
- Size 168KB
- SHA256 d22d13d5d8b7bce90a6bbc676892c1a430fc699b17481f8c8040013ee2f3bf30
- MD5 fa6d1e3adf4bc45e3c2a7a35b273533a
- SHA1 3170a75ba2437d2fad9525d2b78292a633aedd64
- SHA512 804b49d2ac7ac8e7301740c16c023eb17545be8aa4eff2c0281ded51cb1ecc29fbbabd9ede4a4c565e07c31c92d8a43b8f9a1be15450a0b5e830aae8e38ff4c6
- SSDEEP 1536:1EGh0ollq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ollqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{45EEEB8A-04F0-4ae2-8CC9-9C7D61322DC1}.exe
- Size 168KB
- SHA256 d557fd204a685b0969a466803cfbc8e641e1cd6525e3c7bffeec6cb8fb1cdbe2
- MD5 fca35b293367fce6638b9941064a80bc
- SHA1 87420cd9d4c8a4f482994ec5d684f2ce03f40cba
- SHA512 e0be06c58e34fe8bc18ff29be5ea053534ae605cc958c84967c3485d546401818183f027c9a7de9836f6cbc1643853cb84d3869ab9e440ef609f764540f19e3e
- SSDEEP 1536:1EGh0oslq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oslqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{468392F1-5AA8-48eb-A40C-7AF181397E44}.exe
- Size 168KB
- SHA256 e09b0f10c82d5459e4d4fa708750c953fcff5eed0bf278dbbcfd269bafaf6fef
- MD5 fc197d6ecd64fdb27a68f6448a4ee027
- SHA1 43e88e5685071483d9184ec521b57c589b990429
- SHA512 cced01ff3494a7bbd8d55c9631d2c0ea16eb707539174a766403064cd02fcad606f2ed2e2d4d063783d28547bb43e3f2e0ef0eb1e2bd0683529e4ff70a81de99
- SSDEEP 1536:1EGh0oQlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oQlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4BCDC713-D772-46d9-A5C3-2F6403F18DE3}.exe
- Size 168KB
- SHA256 2ff85a1039ea5c58de65625221e9cd780dc00f65d9fbd84cbb315fef782d09cc
- MD5 52e761e3eacd6f079da1ad1760e6bcec
- SHA1 3125e56c9ef82c34241048e6666c717d14d432b3
- SHA512 b1126b70114529466d12f86526551ebf640eaeb623ba7c6f1fde3919f85110e732c35d00a4e21abaad5eab0b50439d7bb5a685fdd03c81fb7501d4a4808e1686
- SSDEEP 1536:1EGh0o7lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7CEBE9B0-5AB0-41d2-9272-B87650119D75}.exe
- Size 168KB
- SHA256 d5d2ce78c2bc98ca566630cb5ba0a6e6d5f83ba2cee2c20ac1d203171dc545d9
- MD5 ba02cbcb6dbef8904aea6b88e94349c7
- SHA1 d7ba6e968b3086abcbda4468d70576ed1f1292af
- SHA512 f250bb8c6b8f2325697dc54da5f1405ef2b4a3d7cddf7f8f46f1d17bf13e0da8376b8b02fb1f00aa44e16b378477e402e6f0806bbd4190c29fb09ea1f40ea81c
- SSDEEP 1536:1EGh0oGlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oGlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{80E53BD1-226D-4c06-AD74-376DEDC31069}.exe
- Size 168KB
- SHA256 5fd25cd5bec212a6fdc956f2a97e85a6621f080f45b31342762b537c8cdae405
- MD5 aae9943f4dda6c22fbf2555a185a2681
- SHA1 6cb21882c7165c9b9aad26e6f58c65c2db32460c
- SHA512 0c6487f705605b37af65727cb648ded7e2f7697e27402c9766ef9482a545f6191e38db8e3cc8c0342ce4b797befe0603ed7a6867f90d5d9bbe85a2148ba53cf2
- SSDEEP 1536:1EGh0oDlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oDlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A32C2CCC-C784-4a3e-8639-E6AA6CC5BE9B}.exe
- Size 168KB
- SHA256 b61440de6ce9586a2ec63b45df29ffbb1620c8d88ab7ddd1a096f7b5573d781e
- MD5 2adaf2bff79c3a7d480108afe6abd9cb
- SHA1 a76d6388f8862cfbe2f02da34d98a8b4a65127cd
- SHA512 b33fd641fef8dcc1e6f2463aa6c63a4134c91f2759f1845b7cd33aee7a3de52a7e6174cd2f917daeaa95d00238d0ff33afe86ffb0f578a47d9dcbf5d8312370c
- SSDEEP 1536:1EGh0oglq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oglqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ED1A6A4A-326C-4488-8BBE-AEC52FAAB31B}.exe
- Size 168KB
- SHA256 31d3bc5d8e0764b5ebc58745b226594de9f5300413b7c38e007ad7f25d84291a
- MD5 82648eda9dbf0ee281a5f446cfd7d174
- SHA1 e9bc1b041c36611d75f0188c21b22caf318edda9
- SHA512 fba5282d21989ddc76dbeed132c3d12664cbe0a37611db8e7124e5323b07767dc56ef084f42fa9188f533725e00ca680440bf87bdeefe988d175292f80d74789
- SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F37DA0B6-33A6-4f09-A22F-3BBEFD9CDB26}.exe
- Size 168KB
- SHA256 3a3c08131cad069581cafa32d5f17f2d12fe8c500670b3f6799a7eb3b02a2cf5
- MD5 035cdd2c43de7eb8570a47efb76c79bf
- SHA1 4316a2cecfe55408be0c549c392f3ece6b210192
- SHA512 525cfc9154732e74c80c59b5024222b0bc0de97f043e7ad4af252f751c6ed3253d51d8592cf807775bd26533ef0655eeb31952dd765588baed917378564392b2
- SSDEEP 1536:1EGh0o9lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o9lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP