Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 16:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe
- Size 168KB
- Sample240302-vgjshsfb6s
- SHA256 f915481185995349e3309cba5a5f50e0ed0f48905a4d39cb31025b55ae239cc2
- MD5 73555cfa62811c199f8d176bf7845598
- SHA1 cc853856f2824b7818a10035000e60839094d8e4
- SHA512 d43111e6652e37e1e624011e94558a1b9b1b7b2ed43eb1ecde84b639088687514fc13057b78f9067e383a2eb7f6a10efb5494d887fb0dde1fab0adc5e24e75e5
- SSDEEP 1536:1EGh0oglq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oglqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000800000002321e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002320e-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023226-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002320e-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023226-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002320e-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023226-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002320e-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023226-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000002320e-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023223-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d00000002320e-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B96863A-C220-4b60-A778-7EF88BF08966}\stubpath = "C:\\Windows\\{3B96863A-C220-4b60-A778-7EF88BF08966}.exe" {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{055573E3-76D4-43de-A309-992314695787}\stubpath = "C:\\Windows\\{055573E3-76D4-43de-A309-992314695787}.exe" {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F462484-2D35-4785-9EB7-F3C58B0D5B36}\stubpath = "C:\\Windows\\{0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe" {055573E3-76D4-43de-A309-992314695787}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}\stubpath = "C:\\Windows\\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe" {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B96863A-C220-4b60-A778-7EF88BF08966} {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF} {3B96863A-C220-4b60-A778-7EF88BF08966}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66499F45-70C7-4717-AB03-D2EDC1E73416} {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFDDB2FA-53FC-4046-985F-4021CC19FB36} 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}\stubpath = "C:\\Windows\\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe" {3B96863A-C220-4b60-A778-7EF88BF08966}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22776EBC-78A8-45c9-B9AF-959D91EC6611} {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0} {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC} {400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C} {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFDDB2FA-53FC-4046-985F-4021CC19FB36}\stubpath = "C:\\Windows\\{AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe" 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22776EBC-78A8-45c9-B9AF-959D91EC6611}\stubpath = "C:\\Windows\\{22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe" {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{055573E3-76D4-43de-A309-992314695787} {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F462484-2D35-4785-9EB7-F3C58B0D5B36} {055573E3-76D4-43de-A309-992314695787}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{884B4796-1EE2-4bf2-AE0B-FDB19A917931} {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{884B4796-1EE2-4bf2-AE0B-FDB19A917931}\stubpath = "C:\\Windows\\{884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe" {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66499F45-70C7-4717-AB03-D2EDC1E73416}\stubpath = "C:\\Windows\\{66499F45-70C7-4717-AB03-D2EDC1E73416}.exe" {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}\stubpath = "C:\\Windows\\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe" {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8} {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8}\stubpath = "C:\\Windows\\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe" {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}\stubpath = "C:\\Windows\\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}.exe" {400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe - Executes dropped EXE 12 IoCs
pid Process 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 3664 {055573E3-76D4-43de-A309-992314695787}.exe 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 4848 {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe 4660 {400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe 1404 {22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe File created C:\Windows\{AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe File created C:\Windows\{3B96863A-C220-4b60-A778-7EF88BF08966}.exe {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe File created C:\Windows\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe {3B96863A-C220-4b60-A778-7EF88BF08966}.exe File created C:\Windows\{055573E3-76D4-43de-A309-992314695787}.exe {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe File created C:\Windows\{884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe File created C:\Windows\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}.exe {400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe File created C:\Windows\{22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe File created C:\Windows\{0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe {055573E3-76D4-43de-A309-992314695787}.exe File created C:\Windows\{66499F45-70C7-4717-AB03-D2EDC1E73416}.exe {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe File created C:\Windows\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe File created C:\Windows\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe Token: SeIncBasePriorityPrivilege 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe Token: SeIncBasePriorityPrivilege 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe Token: SeIncBasePriorityPrivilege 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe Token: SeIncBasePriorityPrivilege 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe Token: SeIncBasePriorityPrivilege 3664 {055573E3-76D4-43de-A309-992314695787}.exe Token: SeIncBasePriorityPrivilege 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe Token: SeIncBasePriorityPrivilege 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe Token: SeIncBasePriorityPrivilege 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe Token: SeIncBasePriorityPrivilege 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe Token: SeIncBasePriorityPrivilege 4848 {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe Token: SeIncBasePriorityPrivilege 4660 {400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 3156 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe 93 PID 4240 wrote to memory of 3156 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe 93 PID 4240 wrote to memory of 3156 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe 93 PID 4240 wrote to memory of 4524 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe 94 PID 4240 wrote to memory of 4524 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe 94 PID 4240 wrote to memory of 4524 4240 2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe 94 PID 3156 wrote to memory of 1136 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 95 PID 3156 wrote to memory of 1136 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 95 PID 3156 wrote to memory of 1136 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 95 PID 3156 wrote to memory of 2916 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 96 PID 3156 wrote to memory of 2916 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 96 PID 3156 wrote to memory of 2916 3156 {AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe 96 PID 1136 wrote to memory of 1472 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 100 PID 1136 wrote to memory of 1472 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 100 PID 1136 wrote to memory of 1472 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 100 PID 1136 wrote to memory of 2728 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 101 PID 1136 wrote to memory of 2728 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 101 PID 1136 wrote to memory of 2728 1136 {3B96863A-C220-4b60-A778-7EF88BF08966}.exe 101 PID 1472 wrote to memory of 5008 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 102 PID 1472 wrote to memory of 5008 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 102 PID 1472 wrote to memory of 5008 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 102 PID 1472 wrote to memory of 2444 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 103 PID 1472 wrote to memory of 2444 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 103 PID 1472 wrote to memory of 2444 1472 {DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe 103 PID 5008 wrote to memory of 3664 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 104 PID 5008 wrote to memory of 3664 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 104 PID 5008 wrote to memory of 3664 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 104 PID 5008 wrote to memory of 624 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 105 PID 5008 wrote to memory of 624 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 105 PID 5008 wrote to memory of 624 5008 {22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe 105 PID 3664 wrote to memory of 4340 3664 {055573E3-76D4-43de-A309-992314695787}.exe 106 PID 3664 wrote to memory of 4340 3664 {055573E3-76D4-43de-A309-992314695787}.exe 106 PID 3664 wrote to memory of 4340 3664 {055573E3-76D4-43de-A309-992314695787}.exe 106 PID 3664 wrote to memory of 1312 3664 {055573E3-76D4-43de-A309-992314695787}.exe 107 PID 3664 wrote to memory of 1312 3664 {055573E3-76D4-43de-A309-992314695787}.exe 107 PID 3664 wrote to memory of 1312 3664 {055573E3-76D4-43de-A309-992314695787}.exe 107 PID 4340 wrote to memory of 860 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 108 PID 4340 wrote to memory of 860 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 108 PID 4340 wrote to memory of 860 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 108 PID 4340 wrote to memory of 3240 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 109 PID 4340 wrote to memory of 3240 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 109 PID 4340 wrote to memory of 3240 4340 {0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe 109 PID 860 wrote to memory of 3624 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 110 PID 860 wrote to memory of 3624 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 110 PID 860 wrote to memory of 3624 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 110 PID 860 wrote to memory of 4376 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 111 PID 860 wrote to memory of 4376 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 111 PID 860 wrote to memory of 4376 860 {884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe 111 PID 3624 wrote to memory of 3540 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 112 PID 3624 wrote to memory of 3540 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 112 PID 3624 wrote to memory of 3540 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 112 PID 3624 wrote to memory of 3544 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 113 PID 3624 wrote to memory of 3544 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 113 PID 3624 wrote to memory of 3544 3624 {66499F45-70C7-4717-AB03-D2EDC1E73416}.exe 113 PID 3540 wrote to memory of 4848 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 114 PID 3540 wrote to memory of 4848 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 114 PID 3540 wrote to memory of 4848 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 114 PID 3540 wrote to memory of 232 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 115 PID 3540 wrote to memory of 232 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 115 PID 3540 wrote to memory of 232 3540 {1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe 115 PID 4848 wrote to memory of 4660 4848 {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe 116 PID 4848 wrote to memory of 4660 4848 {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe 116 PID 4848 wrote to memory of 4660 4848 {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe 116 PID 4848 wrote to memory of 2780 4848 {F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_73555cfa62811c199f8d176bf7845598_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\{AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exeC:\Windows\{AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\{3B96863A-C220-4b60-A778-7EF88BF08966}.exeC:\Windows\{3B96863A-C220-4b60-A778-7EF88BF08966}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exeC:\Windows\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\{22776EBC-78A8-45c9-B9AF-959D91EC6611}.exeC:\Windows\{22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\{055573E3-76D4-43de-A309-992314695787}.exeC:\Windows\{055573E3-76D4-43de-A309-992314695787}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\{0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exeC:\Windows\{0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\{884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exeC:\Windows\{884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\{66499F45-70C7-4717-AB03-D2EDC1E73416}.exeC:\Windows\{66499F45-70C7-4717-AB03-D2EDC1E73416}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exeC:\Windows\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exeC:\Windows\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exeC:\Windows\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4660 -
C:\Windows\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}.exeC:\Windows\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}.exe13⤵
- Executes dropped EXE
PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{400CB~1.EXE > nul13⤵PID:4188
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5BDB~1.EXE > nul12⤵PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1127A~1.EXE > nul11⤵PID:232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66499~1.EXE > nul10⤵PID:3544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{884B4~1.EXE > nul9⤵PID:4376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F462~1.EXE > nul8⤵PID:3240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05557~1.EXE > nul7⤵PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22776~1.EXE > nul6⤵PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDF05~1.EXE > nul5⤵PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B968~1.EXE > nul4⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFDDB~1.EXE > nul3⤵PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{055573E3-76D4-43de-A309-992314695787}.exe
- Size 168KB
- SHA256 0e8b5d1495a853e3ae6990467a2f85acc65c2b3bd50c4c1116ea34db3eec532f
- MD5 b9ae5a5375b9bb19cd52a2a12f74d57a
- SHA1 0780d0582e6c9c05e85274c41e68d099ec29834e
- SHA512 3c35406aed088510306e2980f110181e9b1a26f515ab9179b43121d1b3d2633c1000e102d5cf699e38f15703dfe472c4c9a9ec75bfa5d264813c656d1b56f2f7
- SSDEEP 1536:1EGh0oWlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oWlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{0F462484-2D35-4785-9EB7-F3C58B0D5B36}.exe
- Size 168KB
- SHA256 4ec41b459901c43b18e45c821613a720409722a5dc83699df13f23c7c41a747f
- MD5 a8939af4612f2a1a70476a67a220df3c
- SHA1 43ab5d1645af22c2a49ebe760506d14bab6d7640
- SHA512 06a1631110884de5b77beea3aefddf7286060d51eeb1feead9338e66de97a3e1461d27479380ffad8cc3991b59c9bea5b98fcfeaffe6c79738c126bd1bf0780f
- SSDEEP 1536:1EGh0ollq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ollqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1127AEE0-48FF-4d8e-A725-3BC6ACA85B5C}.exe
- Size 168KB
- SHA256 d64a6ca05aab07bc904d19a73b104e6d90560936e729d156c1ede4247cb58f16
- MD5 01407333b7fa42627463e9f7665b6233
- SHA1 84bad3721d922fd5218c32a55f65c03de7751295
- SHA512 33e3fea4cc4b14d753b1c439eab80f13bebce0fad84a57a746eb597e16c8203941b21940310dbe1426db09962c2ba6f63f65cc52f1779c07187f89e54b17658f
- SSDEEP 1536:1EGh0onlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0onlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{22776EBC-78A8-45c9-B9AF-959D91EC6611}.exe
- Size 168KB
- SHA256 d34e3f0af3e0999392c5562f0d2c457bcc58bda0ec9269745ddf8392e63b4e28
- MD5 f2354cfa7adfbc28f71cd7079b833bbd
- SHA1 fbf99f4065a00a84fcfea2e1bf44a981eb2b3dbe
- SHA512 2722c29807ef9c9a8b5115d59fcd132cea80eb02f19f4eab4022f42feb2df3e8e1b1fd50741242f1c2648e93e97086ba89c6529c3ffadd469c029d5ab90e99aa
- SSDEEP 1536:1EGh0oflq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oflqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{22944E6E-D9E9-4d4d-8B86-F9DA2C5F3AFC}.exe
- Size 168KB
- SHA256 4a9f58f1edf327260194de8dab070d2803f23ab1fee4f4dd41ea0366d6828264
- MD5 53fdce6682fa9b73f3dba1f5559c33c2
- SHA1 4dfcb9788071383d83f9e636b5c7524979743b15
- SHA512 558cef7e5a7afafd20d9f88a75331f5637dcf39b2acab2ba934105bd272c61abb1290f43008769f644471c39cdf02b936ac29e2c6ba649382b84887d61021a8c
- SSDEEP 1536:1EGh0oslq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oslqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3B96863A-C220-4b60-A778-7EF88BF08966}.exe
- Size 168KB
- SHA256 77edc04cc0af5c1a3e8c2d5429b920a9937f09473aaea1ffedfd6bf59d0ca4a4
- MD5 e5d8843676c5e62b2d31fa3ac77657df
- SHA1 30d7e9435e56bc2f268cb0d8f6f89e285eb8fd21
- SHA512 b4591b62878e91c8d295efdd08adedea21aaaacd2d89d48d6ef8aeaa78aa74fa293204c47ec3f9319bdb7fffc648cc58a725232516205ddf3e9f154a9b769d97
- SSDEEP 1536:1EGh0oQlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oQlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{400CB7FF-689C-4294-ABAA-5BD2F3B624C8}.exe
- Size 168KB
- SHA256 61c93fa9ef6934a0a955bce1757b9164f30201591fbdb9d3e6da5ac7b981e554
- MD5 be9de11ae300479126b388b3ad642c99
- SHA1 1bae135039fa6039540c5f2d6a82b1c914d3ede1
- SHA512 38fa73edb7d943e3cbcdd1c049e473870e4e8e46f1a061448ef95c59f4936cbef3b96122ce5bc7f9e4d84fc255b494afe0880e6bcdf768b06596cf1f7586a005
- SSDEEP 1536:1EGh0o0llq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o0llqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{66499F45-70C7-4717-AB03-D2EDC1E73416}.exe
- Size 168KB
- SHA256 654557ebcc71929093e2b98e9dfc776bb531805a281c4549924ae2b5bdb3a76f
- MD5 5347b5cef612b90432c7a48a47c78dd6
- SHA1 b1cb0b37b76d0ab58cd97737fb9c095fcb8d4aca
- SHA512 15c99f900b3dbb8106e93aeffda6750d50637dfeb20a5de4e7d04c593906827a308cf984b2361bf245d486ceb74b00e81017beaca77b86f2c74484f7c85cc00f
- SSDEEP 1536:1EGh0oXlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oXlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{884B4796-1EE2-4bf2-AE0B-FDB19A917931}.exe
- Size 168KB
- SHA256 7d5be015709b5b9a410e5520cd4fb6e81950fd69a9e422d5565104bb03cf9b1c
- MD5 e7702c6699557764c9cb67466e156a28
- SHA1 c9839fd171092cf8d215e7131bc3f2b8b379c869
- SHA512 f1f76a6afd9d9069ce5e1ac5c3beedff0208c5c97941aa7ad6ac276ff3529e141ea4aff53428e0df7b68a29b8db2bb17f9e84ebf763d5203b478236a93c7664a
- SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AFDDB2FA-53FC-4046-985F-4021CC19FB36}.exe
- Size 168KB
- SHA256 e4c30ec4d239a7666092d8e0ea59f71cbde16a46d940620e527e740f722c31d3
- MD5 09fc0bc2cd6aca61e759b4a7e18fc7af
- SHA1 0e605289333261a80ba4bc84ddd8ec8248cd1b53
- SHA512 d7c4651de75e9a3a2b936b0b8b45eeecd00d9d0ba16e7c7d36ffa41be68f721e979e49a62b66b3e52a27141d002d83fe7c344aa89d3276a291a18030b249e35c
- SSDEEP 1536:1EGh0oelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oelqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DDF05E9D-E428-46e7-A366-E1FF44AD6DEF}.exe
- Size 168KB
- SHA256 33ed8d05d458e9fb5c069ca1b59ae8215f93103befbbfbf529251ab891819f48
- MD5 a69311045d3808edd36403b0ca8b98b7
- SHA1 6a62708257adfcab75856c4dce36d230ffe97c6b
- SHA512 5c40ebbbd1e2b627edd62bd5d00ba99ef4c84f81338971cdddaf72d0c7eddfae8a24274f9071fccf05e8018603c7931ad9f8c441807197c6a23d48c7e9fc392f
- SSDEEP 1536:1EGh0ojlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F5BDBDE8-AF6F-4bb3-9779-0D8E2149ECD0}.exe
- Size 168KB
- SHA256 14e6e978e74e159737397bf652c8baf5ae0f7b1977ae922883aa2af260b5b1ce
- MD5 3548525c65fc6d263a173707be4a05d0
- SHA1 489912f7141731832caeb70198834dc33b9df54d
- SHA512 870d3df76662a582ce5d5e18fa6d5149260faeccbd8f5868af230ec0a15e4fc5ac9eef456e7cb7d4ec7311c907c1d8630d96e8bf4d14602c69896552d4d45558
- SSDEEP 1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP