Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 17:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe
- Size 168KB
- Sample240302-vrh9qsfc61
- SHA256 b1557dd8702c432dbe4ad4db4f41684c236660acb7a5e8af47b694a4584c12be
- MD5 a3e32a12990cd45c79fe6311b517b3ca
- SHA1 3ab36bddf55b305f7c429d5e7fe0438606d0a6dc
- SHA512 850062d4057109c8e381b6919cc5d78d34e1354f470b7e79d95664629717d72678012f10be2d0f0a0c0b5ef494294f2c3e71cbd9d60d194afff25cc8e5b0c3c3
- SSDEEP 1536:1EGh0otlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0otlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0005000000022d26-1.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000022ea1-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023257-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023115-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023257-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023115-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023257-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023115-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023257-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023115-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023256-41.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023115-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1A75902-7E4E-4075-B37E-3FE49006E66A} 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}\stubpath = "C:\\Windows\\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe" {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8587D4EC-F547-42d2-BFCD-AFE9B8016146} {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF8221D9-BAD4-42be-8E56-74BACFDABD48} {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED} {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74EA7D13-A672-4ae9-8796-557E2A109B58} {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1A75902-7E4E-4075-B37E-3FE49006E66A}\stubpath = "C:\\Windows\\{C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe" 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A} {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8587D4EC-F547-42d2-BFCD-AFE9B8016146}\stubpath = "C:\\Windows\\{8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe" {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED}\stubpath = "C:\\Windows\\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe" {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70D88AD7-A7AA-4207-B155-F6751AF4DB61} {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E4D799-9AF4-448d-8F4B-0E6094776511}\stubpath = "C:\\Windows\\{F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe" {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A} {F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F28ECF8B-27F3-45c2-AD19-84180633A63E}\stubpath = "C:\\Windows\\{F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe" {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B43ACF2-A344-438c-BDE5-40BB50E27719}\stubpath = "C:\\Windows\\{5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe" {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF8221D9-BAD4-42be-8E56-74BACFDABD48}\stubpath = "C:\\Windows\\{DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe" {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62} {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62}\stubpath = "C:\\Windows\\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe" {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74EA7D13-A672-4ae9-8796-557E2A109B58}\stubpath = "C:\\Windows\\{74EA7D13-A672-4ae9-8796-557E2A109B58}.exe" {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70D88AD7-A7AA-4207-B155-F6751AF4DB61}\stubpath = "C:\\Windows\\{70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe" {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F28ECF8B-27F3-45c2-AD19-84180633A63E} {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B43ACF2-A344-438c-BDE5-40BB50E27719} {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E4D799-9AF4-448d-8F4B-0E6094776511} {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A}\stubpath = "C:\\Windows\\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A}.exe" {F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe - Executes dropped EXE 12 IoCs
pid Process 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 1784 {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe 3248 {F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe 3664 {220C56E2-46F7-4fdd-8376-92BBD8A35C5A}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe File created C:\Windows\{C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe File created C:\Windows\{F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe File created C:\Windows\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe File created C:\Windows\{5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe File created C:\Windows\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe File created C:\Windows\{74EA7D13-A672-4ae9-8796-557E2A109B58}.exe {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe File created C:\Windows\{70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe File created C:\Windows\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A}.exe {F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe File created C:\Windows\{8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe File created C:\Windows\{DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe File created C:\Windows\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe Token: SeIncBasePriorityPrivilege 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe Token: SeIncBasePriorityPrivilege 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe Token: SeIncBasePriorityPrivilege 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe Token: SeIncBasePriorityPrivilege 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe Token: SeIncBasePriorityPrivilege 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe Token: SeIncBasePriorityPrivilege 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe Token: SeIncBasePriorityPrivilege 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe Token: SeIncBasePriorityPrivilege 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe Token: SeIncBasePriorityPrivilege 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe Token: SeIncBasePriorityPrivilege 1784 {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe Token: SeIncBasePriorityPrivilege 3248 {F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1356 wrote to memory of 2424 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe 98 PID 1356 wrote to memory of 2424 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe 98 PID 1356 wrote to memory of 2424 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe 98 PID 1356 wrote to memory of 3172 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe 99 PID 1356 wrote to memory of 3172 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe 99 PID 1356 wrote to memory of 3172 1356 2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe 99 PID 2424 wrote to memory of 4836 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 100 PID 2424 wrote to memory of 4836 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 100 PID 2424 wrote to memory of 4836 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 100 PID 2424 wrote to memory of 4172 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 101 PID 2424 wrote to memory of 4172 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 101 PID 2424 wrote to memory of 4172 2424 {C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe 101 PID 4836 wrote to memory of 3456 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 104 PID 4836 wrote to memory of 3456 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 104 PID 4836 wrote to memory of 3456 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 104 PID 4836 wrote to memory of 4636 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 105 PID 4836 wrote to memory of 4636 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 105 PID 4836 wrote to memory of 4636 4836 {F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe 105 PID 3456 wrote to memory of 680 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 108 PID 3456 wrote to memory of 680 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 108 PID 3456 wrote to memory of 680 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 108 PID 3456 wrote to memory of 2832 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 109 PID 3456 wrote to memory of 2832 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 109 PID 3456 wrote to memory of 2832 3456 {2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe 109 PID 680 wrote to memory of 1332 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 110 PID 680 wrote to memory of 1332 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 110 PID 680 wrote to memory of 1332 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 110 PID 680 wrote to memory of 2728 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 111 PID 680 wrote to memory of 2728 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 111 PID 680 wrote to memory of 2728 680 {8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe 111 PID 1332 wrote to memory of 4104 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 112 PID 1332 wrote to memory of 4104 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 112 PID 1332 wrote to memory of 4104 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 112 PID 1332 wrote to memory of 3000 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 113 PID 1332 wrote to memory of 3000 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 113 PID 1332 wrote to memory of 3000 1332 {5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe 113 PID 4104 wrote to memory of 4584 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 114 PID 4104 wrote to memory of 4584 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 114 PID 4104 wrote to memory of 4584 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 114 PID 4104 wrote to memory of 4456 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 115 PID 4104 wrote to memory of 4456 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 115 PID 4104 wrote to memory of 4456 4104 {DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe 115 PID 4584 wrote to memory of 4540 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 116 PID 4584 wrote to memory of 4540 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 116 PID 4584 wrote to memory of 4540 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 116 PID 4584 wrote to memory of 3448 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 117 PID 4584 wrote to memory of 3448 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 117 PID 4584 wrote to memory of 3448 4584 {B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe 117 PID 4540 wrote to memory of 2312 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 118 PID 4540 wrote to memory of 2312 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 118 PID 4540 wrote to memory of 2312 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 118 PID 4540 wrote to memory of 2784 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 119 PID 4540 wrote to memory of 2784 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 119 PID 4540 wrote to memory of 2784 4540 {04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe 119 PID 2312 wrote to memory of 1784 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 120 PID 2312 wrote to memory of 1784 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 120 PID 2312 wrote to memory of 1784 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 120 PID 2312 wrote to memory of 1776 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 121 PID 2312 wrote to memory of 1776 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 121 PID 2312 wrote to memory of 1776 2312 {74EA7D13-A672-4ae9-8796-557E2A109B58}.exe 121 PID 1784 wrote to memory of 3248 1784 {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe 122 PID 1784 wrote to memory of 3248 1784 {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe 122 PID 1784 wrote to memory of 3248 1784 {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe 122 PID 1784 wrote to memory of 3024 1784 {70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_a3e32a12990cd45c79fe6311b517b3ca_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\{C1A75902-7E4E-4075-B37E-3FE49006E66A}.exeC:\Windows\{C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\{F28ECF8B-27F3-45c2-AD19-84180633A63E}.exeC:\Windows\{F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exeC:\Windows\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\{8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exeC:\Windows\{8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\{5B43ACF2-A344-438c-BDE5-40BB50E27719}.exeC:\Windows\{5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\{DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exeC:\Windows\{DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exeC:\Windows\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exeC:\Windows\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\{74EA7D13-A672-4ae9-8796-557E2A109B58}.exeC:\Windows\{74EA7D13-A672-4ae9-8796-557E2A109B58}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\{70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exeC:\Windows\{70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\{F1E4D799-9AF4-448d-8F4B-0E6094776511}.exeC:\Windows\{F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3248 -
C:\Windows\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A}.exeC:\Windows\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A}.exe13⤵
- Executes dropped EXE
PID:3664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1E4D~1.EXE > nul13⤵PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70D88~1.EXE > nul12⤵PID:3024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74EA7~1.EXE > nul11⤵PID:1776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04F11~1.EXE > nul10⤵PID:2784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4EE1~1.EXE > nul9⤵PID:3448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF822~1.EXE > nul8⤵PID:4456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B43A~1.EXE > nul7⤵PID:3000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8587D~1.EXE > nul6⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B598~1.EXE > nul5⤵PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F28EC~1.EXE > nul4⤵PID:4636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1A75~1.EXE > nul3⤵PID:4172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:3076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{04F11BD7-64FA-494b-A188-A4E9D1BBEEED}.exe
- Size 168KB
- SHA256 60b2afcceadc3a9d9f37b9e5a299ea10ad00d36cef5945ea79587690efb1fc09
- MD5 24add7d487a7940c6630f230136de018
- SHA1 236a3ee015ed69f37cb3e5594153d8c94f8aab35
- SHA512 e6a86f5a457bc9dbff1f2761d607e117218c890f63f83e34db5edf55cc6457de9aff44b5962ba57367e08c4334b64b759e07ec43e7b22570364d4a49ab3594b2
- SSDEEP 1536:1EGh0oxlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oxlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{220C56E2-46F7-4fdd-8376-92BBD8A35C5A}.exe
- Size 168KB
- SHA256 2104ee80b37ce2b4f6e3e3cd286473ac8b928fc2efd80ce2d8babb36c3d53c79
- MD5 73bfd8e78011e384f7cbe6a37916010f
- SHA1 c70efad9b2fc5d9d36c47569e459878e1c6c4455
- SHA512 0ab23e2cc93fbe7993efe447428c75b772656b7a7f050833c77c406ef394f88131558d72369bab9d0661f24492dadf8302b27b7c41bc0ccaca6937c4df87690c
- SSDEEP 1536:1EGh0oolq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oolqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2B598EF3-38D1-4bf0-9BDF-43F62A7FD56A}.exe
- Size 168KB
- SHA256 c68345d9ea6e7ecf709868029afed7b73171c1a36fcf67bacbb1a1ff58f4c9f5
- MD5 1ce80e499e201ba324d43a6e10044802
- SHA1 475f9ac9a213467e1cfc34675320533b4a113758
- SHA512 b6262abd7971006711d26c6af518a2fc946b1e14b8ad9bb9b16e080f23f211742e1c6ee5be6d4c62bd3e33df7ed650467dd2a9c26749b0ffb9e0179b9d88010c
- SSDEEP 1536:1EGh0oRlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oRlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5B43ACF2-A344-438c-BDE5-40BB50E27719}.exe
- Size 168KB
- SHA256 cbd3c85cd03ab5a217f6c4bff7b67bf2f7debe19b6e154510f47cb083e5a4fdb
- MD5 8cbcbacfb9fd2218ead23c77e538e683
- SHA1 b325f43dc7c5fcfba1845c9cbc8cfec1e7943c07
- SHA512 6ca3629e8d5e568d41e36059afc02c032ee7c269489f865c8ec11e19714547289a238fd285513ff2e3598d6f5a4d68c85a457cbcfbfb32b7c6e650f6f3b4432c
- SSDEEP 1536:1EGh0oUelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0onlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{70D88AD7-A7AA-4207-B155-F6751AF4DB61}.exe
- Size 168KB
- SHA256 81d89dd521ff59c04a6166b7115025a2724685128c530c880a4abe8d028ddff3
- MD5 8754f174dfd467f369f76c6a8c23b02f
- SHA1 6b25ab9c2faf0f9eaef5575bb358bed8076ca3c8
- SHA512 ea5cf1704af838cdc572a90397ef904120286107ae7c913b30dd5a11b5c580bd65160a5fdf59aeeea0f95df45e74c6545c52fc4baba45dc646ca27002089cccd
- SSDEEP 1536:1EGh0ohlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{74EA7D13-A672-4ae9-8796-557E2A109B58}.exe
- Size 168KB
- SHA256 2bd1a2088a572e852f8b2bbc909425cdb1b3efef61cbdb8bf2f067065ceadfa7
- MD5 920fa649897ede7c7eefd265ee09823e
- SHA1 83915b29815367216cdc7bc99bc057d35e24d872
- SHA512 adc15a9bdca58b1e22bf11e427fdc18044559ef0193e15a4da29dc2a87162b8e014590a28011a0ebc0cbb8ae2c8b4b31599daf859f4648c9b2b1ce04180bb5a5
- SSDEEP 1536:1EGh0o+lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o+lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8587D4EC-F547-42d2-BFCD-AFE9B8016146}.exe
- Size 168KB
- SHA256 dd53541b99650bd284bc07ea3b9cc2d95c95e6ed71e3a737d24875c9bc2171b8
- MD5 dfb4bb19bff25367371c2722bbf47cfc
- SHA1 6037505c0e606ec621dae3891106415d79b6314b
- SHA512 9785c411f80840180a9866aaee8515b74bddc59e30a0019d596abe6e457df77fb33150cef57b5575314da49d4ec3f6da0a49f2f558254c0c6651c41bb7a05982
- SSDEEP 1536:1EGh0oLlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oLlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B4EE19CC-A2CB-4362-AD44-A56BCA299D62}.exe
- Size 168KB
- SHA256 cf43add662983cf1dcde885bf0c548cb96e910071f7b5f5d7b7503f0b642bd7a
- MD5 732a1dabded30fa10385928fbb37c668
- SHA1 8ab20a1752f2d23d719d02a1ed72d1a9ffc685c7
- SHA512 e633d517e6ad726e8e0fdb5131e6d5a5dea356a9e1c5a5016fceedd438c52eace72c5d66344fcddae1f090561bf3eaf13a49067d18b90356e8264db62c3a1a47
- SSDEEP 1536:1EGh0oplq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oplqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C1A75902-7E4E-4075-B37E-3FE49006E66A}.exe
- Size 168KB
- SHA256 ccfa6414403c06786f2d037f91908bb100847ceb27d73dad489a3e56c50e494d
- MD5 266d10750141d4733eb7ef0aa81ceb4b
- SHA1 f1bad2f5baa0ae9a0150f74ee3ca0cb8b1291443
- SHA512 4ea4618364eeeb6df1ea7496ecbc658b32664cc77f7db13e6693811058d69e27b9de13625bebc71d4a7eef7e23e48233f55b251def686d8b55370521427a8e99
- SSDEEP 1536:1EGh0oElq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oElqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DF8221D9-BAD4-42be-8E56-74BACFDABD48}.exe
- Size 168KB
- SHA256 60388d8d22702da8d479e9bf2d636031af1fc466f6f9b2cae13799303f6a18e1
- MD5 9eea115ea5c5b2300ef6b42587ac772a
- SHA1 030c6eeea8b02a064215f5814e101f4aa5796028
- SHA512 4ff9e17c21431d3d686f8a682679129876101be70681d451313902b94205fda7090cdbcec6e63941347494af914d78fe82697053537fba02cca0a4f4f1d1938b
- SSDEEP 1536:1EGh0ozlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ozlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F1E4D799-9AF4-448d-8F4B-0E6094776511}.exe
- Size 168KB
- SHA256 1b88b1a8b95ee889b1f8987026e9da0856d720bca7082f0b404539f2fbf513a2
- MD5 9d446ad516468dc4d31ff06dca093f72
- SHA1 d2c36385eda94a9ce452fc7284bd8d156b5ed0f1
- SHA512 3f91c13eec8881743237a7b1467c6f2565e8b57ac2ba97e206e7a37d2f92d4747f1122b6a8126fd95826da3514af65ba4fad6bf403895ff053903c095c60a821
- SSDEEP 1536:1EGh0oJlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F28ECF8B-27F3-45c2-AD19-84180633A63E}.exe
- Size 168KB
- SHA256 63412316378fe7e0039bb72094f801f077c58cf5cfe877d4b5a32d8fa4d26eff
- MD5 ed0d47a51a67babf2f6edfc770d4ffdc
- SHA1 37d75c35bed2fe7eafd064e42d43f79beb221a67
- SHA512 2609110d2b0b05e33dec1df00a89a87414acafc661971081e2a5e12f0fe75649c156adeadc64871638a08b37af5cef51e15aa3c61e7834ca68dce8ffbbdf89b8
- SSDEEP 1536:1EGh0oMlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oMlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP