Analysis
- max time kernel
149s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 17:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe
- Size 197KB
- Sample240302-vnpmcafc3z
- SHA256 b24c94338d91bf4e6872ade6530a8c23521ef4d429de504048e1a239e7b9b0cf
- MD5 943a591ccaa613c71bd25608d05f4d58
- SHA1 753ab78fabe1d7eec842c48c21e4aecda1204616
- SHA512 c4afc393a85bcb4c90b5f1aaf52e6ef7608e95461a4e40802746a5baefaa1d2cf1628416304fc4d7216c373ade52c8ef40e6f12b0df34234af226a7c3b35bb36
- SSDEEP 3072:jEGh0oWl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG4lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000900000002322c-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023226-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023235-11.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023147-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023236-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023147-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023236-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023147-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023236-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023147-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023231-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023147-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC4D2955-FD04-4c71-A074-241A1E2F1D12} {A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6} {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CCD8939-B950-46ed-9A7D-EEEF83125440}\stubpath = "C:\\Windows\\{5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe" {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32}\stubpath = "C:\\Windows\\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe" {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}\stubpath = "C:\\Windows\\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe" {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE} {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA} 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C240CBA-1B6A-4133-AED8-96B4203B9276}\stubpath = "C:\\Windows\\{9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe" {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2} {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}\stubpath = "C:\\Windows\\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe" {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC4D2955-FD04-4c71-A074-241A1E2F1D12}\stubpath = "C:\\Windows\\{AC4D2955-FD04-4c71-A074-241A1E2F1D12}.exe" {A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}\stubpath = "C:\\Windows\\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe" {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79A14837-21A3-4822-ABB0-6FA81A14FAB9} {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}\stubpath = "C:\\Windows\\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe" {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}\stubpath = "C:\\Windows\\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe" {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79A14837-21A3-4822-ABB0-6FA81A14FAB9}\stubpath = "C:\\Windows\\{79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe" {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35A26BE2-1310-42d7-A716-DE777C10E32A} {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35A26BE2-1310-42d7-A716-DE777C10E32A}\stubpath = "C:\\Windows\\{35A26BE2-1310-42d7-A716-DE777C10E32A}.exe" {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED} {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}\stubpath = "C:\\Windows\\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe" 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C240CBA-1B6A-4133-AED8-96B4203B9276} {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD} {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CCD8939-B950-46ed-9A7D-EEEF83125440} {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32} {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe - Executes dropped EXE 12 IoCs
pid Process 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 4004 {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe 3088 {A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe 4684 {AC4D2955-FD04-4c71-A074-241A1E2F1D12}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{AC4D2955-FD04-4c71-A074-241A1E2F1D12}.exe {A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe File created C:\Windows\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe File created C:\Windows\{9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe File created C:\Windows\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe File created C:\Windows\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe File created C:\Windows\{5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe File created C:\Windows\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe File created C:\Windows\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe File created C:\Windows\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe File created C:\Windows\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe File created C:\Windows\{79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe File created C:\Windows\{35A26BE2-1310-42d7-A716-DE777C10E32A}.exe {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe Token: SeIncBasePriorityPrivilege 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe Token: SeIncBasePriorityPrivilege 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe Token: SeIncBasePriorityPrivilege 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe Token: SeIncBasePriorityPrivilege 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe Token: SeIncBasePriorityPrivilege 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe Token: SeIncBasePriorityPrivilege 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe Token: SeIncBasePriorityPrivilege 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe Token: SeIncBasePriorityPrivilege 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe Token: SeIncBasePriorityPrivilege 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe Token: SeIncBasePriorityPrivilege 4004 {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe Token: SeIncBasePriorityPrivilege 3088 {A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 4136 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe 95 PID 232 wrote to memory of 4136 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe 95 PID 232 wrote to memory of 4136 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe 95 PID 232 wrote to memory of 4744 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe 96 PID 232 wrote to memory of 4744 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe 96 PID 232 wrote to memory of 4744 232 2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe 96 PID 4136 wrote to memory of 4684 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 97 PID 4136 wrote to memory of 4684 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 97 PID 4136 wrote to memory of 4684 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 97 PID 4136 wrote to memory of 2780 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 98 PID 4136 wrote to memory of 2780 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 98 PID 4136 wrote to memory of 2780 4136 {EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe 98 PID 4684 wrote to memory of 4172 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 101 PID 4684 wrote to memory of 4172 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 101 PID 4684 wrote to memory of 4172 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 101 PID 4684 wrote to memory of 3972 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 102 PID 4684 wrote to memory of 3972 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 102 PID 4684 wrote to memory of 3972 4684 {9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe 102 PID 4172 wrote to memory of 4648 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 106 PID 4172 wrote to memory of 4648 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 106 PID 4172 wrote to memory of 4648 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 106 PID 4172 wrote to memory of 2352 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 107 PID 4172 wrote to memory of 2352 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 107 PID 4172 wrote to memory of 2352 4172 {C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe 107 PID 4648 wrote to memory of 1328 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 108 PID 4648 wrote to memory of 1328 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 108 PID 4648 wrote to memory of 1328 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 108 PID 4648 wrote to memory of 1432 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 109 PID 4648 wrote to memory of 1432 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 109 PID 4648 wrote to memory of 1432 4648 {A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe 109 PID 1328 wrote to memory of 5008 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 110 PID 1328 wrote to memory of 5008 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 110 PID 1328 wrote to memory of 5008 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 110 PID 1328 wrote to memory of 3128 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 111 PID 1328 wrote to memory of 3128 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 111 PID 1328 wrote to memory of 3128 1328 {79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe 111 PID 5008 wrote to memory of 4608 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 112 PID 5008 wrote to memory of 4608 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 112 PID 5008 wrote to memory of 4608 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 112 PID 5008 wrote to memory of 2480 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 113 PID 5008 wrote to memory of 2480 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 113 PID 5008 wrote to memory of 2480 5008 {35A26BE2-1310-42d7-A716-DE777C10E32A}.exe 113 PID 4608 wrote to memory of 2412 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 114 PID 4608 wrote to memory of 2412 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 114 PID 4608 wrote to memory of 2412 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 114 PID 4608 wrote to memory of 3900 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 115 PID 4608 wrote to memory of 3900 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 115 PID 4608 wrote to memory of 3900 4608 {9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe 115 PID 2412 wrote to memory of 4768 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 116 PID 2412 wrote to memory of 4768 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 116 PID 2412 wrote to memory of 4768 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 116 PID 2412 wrote to memory of 1936 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 117 PID 2412 wrote to memory of 1936 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 117 PID 2412 wrote to memory of 1936 2412 {3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe 117 PID 4768 wrote to memory of 4004 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 118 PID 4768 wrote to memory of 4004 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 118 PID 4768 wrote to memory of 4004 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 118 PID 4768 wrote to memory of 4604 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 119 PID 4768 wrote to memory of 4604 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 119 PID 4768 wrote to memory of 4604 4768 {5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe 119 PID 4004 wrote to memory of 3088 4004 {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe 120 PID 4004 wrote to memory of 3088 4004 {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe 120 PID 4004 wrote to memory of 3088 4004 {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe 120 PID 4004 wrote to memory of 940 4004 {583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_943a591ccaa613c71bd25608d05f4d58_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exeC:\Windows\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\{9C240CBA-1B6A-4133-AED8-96B4203B9276}.exeC:\Windows\{9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exeC:\Windows\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exeC:\Windows\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\{79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exeC:\Windows\{79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\{35A26BE2-1310-42d7-A716-DE777C10E32A}.exeC:\Windows\{35A26BE2-1310-42d7-A716-DE777C10E32A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exeC:\Windows\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exeC:\Windows\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\{5CCD8939-B950-46ed-9A7D-EEEF83125440}.exeC:\Windows\{5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exeC:\Windows\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exeC:\Windows\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3088 -
C:\Windows\{AC4D2955-FD04-4c71-A074-241A1E2F1D12}.exeC:\Windows\{AC4D2955-FD04-4c71-A074-241A1E2F1D12}.exe13⤵
- Executes dropped EXE
PID:4684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5F46~1.EXE > nul13⤵PID:4532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{583BA~1.EXE > nul12⤵PID:940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CCD8~1.EXE > nul11⤵PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CFD9~1.EXE > nul10⤵PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AF41~1.EXE > nul9⤵PID:3900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35A26~1.EXE > nul8⤵PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79A14~1.EXE > nul7⤵PID:3128
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2590~1.EXE > nul6⤵PID:1432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3EA5~1.EXE > nul5⤵PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C240~1.EXE > nul4⤵PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDEA3~1.EXE > nul3⤵PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{35A26BE2-1310-42d7-A716-DE777C10E32A}.exe
- Size 197KB
- SHA256 fc29c7bcdac5dc1e1edb6b728e5919662a9e34357caf95034e85706db09cf7c5
- MD5 60323fa5d572098a34c068922ddcb79f
- SHA1 86650842ce500e372ec287d5da8dd1c3f07c049b
- SHA512 dcf922b41a2a953b6d7aeb232a5c6577dccd6dde40ea3c951d102b3105e53241e7d3b81a34b847aab18dd3669982e0480ec6dbeb23ff5cf2562c40e33e2d89f2
- SSDEEP 3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3CFD94B7-779E-45e9-97C9-CA1F29FCC7ED}.exe
- Size 197KB
- SHA256 52f0a83e3ef4aea8a1c01561cd7d1daa2c07554f4667694f0d7a1a655af55c38
- MD5 2d273a952bd2c176e15187004e1d5734
- SHA1 e0f2a840a87364dd6372f2700ccb87b271342cfe
- SHA512 739297173338c581c5485c88ebc19c5396787d4bf87ac441e2ba8253cb72b544da83f1239f1d3cf9b5aabe032c6420d3a1e67042c1155bab49fee1df2f2cf06c
- SSDEEP 3072:jEGh0oxl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGXlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{583BA5E6-A9A9-490b-8B7A-8F0DC9E64AEE}.exe
- Size 197KB
- SHA256 9c05463ff6bcc15c2be3db94a921c9a425f1e48b17561627c1d710a821513093
- MD5 0c7e99c67243a52b332764e80eba9427
- SHA1 e40ea47ee314fc9820ada2f10841e20e6306beed
- SHA512 04d3729f71b798c1ba21e537988974e5ac7b142814928ec972e1f8f0ae67745c9278f91273c821d1086d1d74af79cbdc6092596331783b0a94eda25a5349186c
- SSDEEP 3072:jEGh0oUl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGWlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5CCD8939-B950-46ed-9A7D-EEEF83125440}.exe
- Size 197KB
- SHA256 49f03c52c9b752063f08e472ab6a7b3c151d2c108730f6bfce7a552533c02e0e
- MD5 9a54c65d9f9a70d8d9be00a6db29f7a6
- SHA1 df04880279895708d8fe43c927667c80133e88b7
- SHA512 d4922f75aced3f1c15f6126585520526b5052dae058c2848df78a8810a7d0d2db83192aa5de86b6da85ea38d68a3891e12e948f224bc8e834b10da2dd9ea3319
- SSDEEP 3072:jEGh0o4l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGilEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{79A14837-21A3-4822-ABB0-6FA81A14FAB9}.exe
- Size 197KB
- SHA256 8ea09ed5d502b9d3e0f6ac9c24b2a1203131749425c0e620034555f1d811d4e8
- MD5 dc9c51353208ef3a6821a6b1520d9415
- SHA1 0d202937b525b1aa458d3996fabf28b9202eacce
- SHA512 f4e91916fa93c3ed4b0d2d7e845425a1c7811ff63b3cafb35b891e4bb416f36f88a945c68f0cd4d3f8fc26f9c08a5c490d4d2b15f49abe99c19bcc9c4a9138ad
- SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG6lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9AF419E6-9BDB-4e5b-BC68-C0466E784DF6}.exe
- Size 197KB
- SHA256 d7de49a1e165168afbcae356b8eeb6736fdf72fdea95b01ced7deebd0435dd63
- MD5 0fba0acfc8475b60ea4bb69f5e59dfa9
- SHA1 24e2f8513b11cae2e05327d64f372c5c03fcf6b1
- SHA512 ecfb2e98e3bce97a68195aba73de8636c2c8cadcd595a9a24b2328820ea510865e0b850a99f1e9fc52fff10eb2bbb438d9b13169065a7021e293c75f481c0f35
- SSDEEP 3072:jEGh0oYl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG2lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9C240CBA-1B6A-4133-AED8-96B4203B9276}.exe
- Size 197KB
- SHA256 f67f415fa242758f8de437ce8162ab5ba5490d79805f252e263652e9a278b719
- MD5 3229394c17d546243a605022c43e1cf7
- SHA1 117768f0b6a9e33881312595375265228918b62c
- SHA512 d5561fab705c305322a03104e0eb5a16d02c509de378579574d411fe13ac84cc7d0d65e8de745939cb64d6118362d9fd102c204647a7eb1f8c8f2947f8c0e3cd
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGxlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A2590BF4-4F5E-4f10-8EB1-21B2C376DEB2}.exe
- Size 197KB
- SHA256 34db1ce183ffe04ec19153a95172a8b11611013b072ad395963fbd7a4aec9497
- MD5 0033a65c99287a5725496c2f3d22fa3f
- SHA1 a1ff3346cf3300fe7df5a6b80bae8673ccd2db17
- SHA512 5af15c47988a8a6c4e3107932794aaf3cbd7c76444b1d51a1d1b1389cc5de57c56cd80a5a46061c1f979adaec3c11710e8fba509352e11830e02994f77cd7918
- SSDEEP 3072:jEGh0oJl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGTlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A5F464BB-BD72-435e-AE81-FB7E34BE9E32}.exe
- Size 197KB
- SHA256 0ad46429cd806053b0609d15b0ae4021c783487d023930689fd8c560122f6430
- MD5 254cbd0dc7e6a6df77571dbf6e7f0da5
- SHA1 c8b692f6187731e7c604a0c1db82866f0e17e03b
- SHA512 d0051ad38815f7303cb11fb1d35bff66cdc15ae9b20bf5eb48112adb245b3b969b024b8a464d0d0109c7568ec32438e60bd952d8c92f75786c5c09c507962654
- SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGKlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AC4D2955-FD04-4c71-A074-241A1E2F1D12}.exe
- Size 197KB
- SHA256 8c9929abfdf20fdfa426fcfaaa8eb8db2e56a49c222a84a3c24cb8bd7d14a00c
- MD5 665ff8b57fd3759492fb413f77fcd5b2
- SHA1 8d9f289e2086273c9cd84e6cdcc0bbf1e76ad3dc
- SHA512 dc3712647674888db00ac75a1c9aa5f2fb0ea265b0be57c2a55c465950ae19594bc5e85cca627efda1b71559e3724e246e92a9828f0ced799b33b0324200cc30
- SSDEEP 3072:jEGh0ocl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGKlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C3EA5048-2CC9-44fd-8E96-BDDA04C621CD}.exe
- Size 197KB
- SHA256 2a46a2f9946bca9eaff9332921da13c62acf3c2d026806b74059a93041595bb1
- MD5 e1b4f2f09fec9e1b4214b7533bccb603
- SHA1 63d426fc4ca5091265e96139c7648466ef21aaa3
- SHA512 87d91acf0721d0c5b95234a2f1f3523290aca232f40b55e3ccc868e7506b48105b5f3cce8e3c20d6d203c7a5e75296a46a40ca055389dc54523b33349e8b9e75
- SSDEEP 3072:jEGh0oKl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGQlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EDEA3ECE-314D-4f29-8149-08B0C79F3FBA}.exe
- Size 197KB
- SHA256 20e3933c6208725a6ab74f6c12f1d9cbdbf2f61a602ea566072892917f7840ab
- MD5 857e6bc284be53aa6f1fdc780c8ae3c8
- SHA1 49317e32b0667fec5cc0023180b8819dce7fdd02
- SHA512 f81dbdc71e63b5ae65d9f366ff919bf00bd7c6925b9c14d0c0a53113f648786d6403df0611fd7f86ec705f407e4caf9f3bfd5d953521db8e6bf38a133be83775
- SSDEEP 3072:jEGh0ofl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG1lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP