Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 20:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe
- Size 168KB
- Sample240302-y9x3dshe79
- SHA256 94700e2c2b6e6a3fd45acda66393068c58a6bb75df97b8d9b339134007f2bd78
- MD5 269cefe5381b37fe7246b78e804542e2
- SHA1 9efbedb3eaa2fef98105bdeccffb30f636647fd7
- SHA512 ce2667a3d0ddbf8deeb4f5acc5b77f6983929bd5eb99455e3f6e431ab3ac2260eb76b0537b85c8560121ea3508ed5234ccb1d70bedf0f2ee64ea3d0a4081d768
- SSDEEP 1536:1EGh0oSlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oSlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000231eb-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231e1-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231f3-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f0000000230c3-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000231f3-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00100000000230c3-21.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231f3-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00110000000230c3-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000231f3-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00120000000230c3-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231f0-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00130000000230c3-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80D6394A-0EA3-4390-AF7B-A22C990A34C3}\stubpath = "C:\\Windows\\{80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe" {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E44338FA-6601-44f6-AE91-EACD45E484A0} {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13FA6886-497B-420d-9B6D-11BDF902E0E9}\stubpath = "C:\\Windows\\{13FA6886-497B-420d-9B6D-11BDF902E0E9}.exe" {E44338FA-6601-44f6-AE91-EACD45E484A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D}\stubpath = "C:\\Windows\\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe" 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5} {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}\stubpath = "C:\\Windows\\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe" {58475D4D-B785-432f-BE92-F522E56F8C66}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{217E183C-703A-4928-9F60-F4F01A5B9E9C}\stubpath = "C:\\Windows\\{217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe" {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9FBC246-42CB-4015-840D-AE6B0CE0A842} {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9FBC246-42CB-4015-840D-AE6B0CE0A842}\stubpath = "C:\\Windows\\{D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe" {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80D6394A-0EA3-4390-AF7B-A22C990A34C3} {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D} 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC294917-E640-48e4-B8C0-532B1D7520E5} {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58475D4D-B785-432f-BE92-F522E56F8C66}\stubpath = "C:\\Windows\\{58475D4D-B785-432f-BE92-F522E56F8C66}.exe" {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{930A13C3-F756-44c5-8DDC-D24F7ED63E15} {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{930A13C3-F756-44c5-8DDC-D24F7ED63E15}\stubpath = "C:\\Windows\\{930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe" {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5}\stubpath = "C:\\Windows\\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe" {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58475D4D-B785-432f-BE92-F522E56F8C66} {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}\stubpath = "C:\\Windows\\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe" {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA} {58475D4D-B785-432f-BE92-F522E56F8C66}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{217E183C-703A-4928-9F60-F4F01A5B9E9C} {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E44338FA-6601-44f6-AE91-EACD45E484A0}\stubpath = "C:\\Windows\\{E44338FA-6601-44f6-AE91-EACD45E484A0}.exe" {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13FA6886-497B-420d-9B6D-11BDF902E0E9} {E44338FA-6601-44f6-AE91-EACD45E484A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC294917-E640-48e4-B8C0-532B1D7520E5}\stubpath = "C:\\Windows\\{AC294917-E640-48e4-B8C0-532B1D7520E5}.exe" {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12} {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe - Executes dropped EXE 12 IoCs
pid Process 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 4548 {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe 5092 {E44338FA-6601-44f6-AE91-EACD45E484A0}.exe 2296 {13FA6886-497B-420d-9B6D-11BDF902E0E9}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe File created C:\Windows\{13FA6886-497B-420d-9B6D-11BDF902E0E9}.exe {E44338FA-6601-44f6-AE91-EACD45E484A0}.exe File created C:\Windows\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe File created C:\Windows\{AC294917-E640-48e4-B8C0-532B1D7520E5}.exe {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe File created C:\Windows\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe File created C:\Windows\{58475D4D-B785-432f-BE92-F522E56F8C66}.exe {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe File created C:\Windows\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe {58475D4D-B785-432f-BE92-F522E56F8C66}.exe File created C:\Windows\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe File created C:\Windows\{217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe File created C:\Windows\{D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe File created C:\Windows\{80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe File created C:\Windows\{E44338FA-6601-44f6-AE91-EACD45E484A0}.exe {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe Token: SeIncBasePriorityPrivilege 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe Token: SeIncBasePriorityPrivilege 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe Token: SeIncBasePriorityPrivilege 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe Token: SeIncBasePriorityPrivilege 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe Token: SeIncBasePriorityPrivilege 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe Token: SeIncBasePriorityPrivilege 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe Token: SeIncBasePriorityPrivilege 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe Token: SeIncBasePriorityPrivilege 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe Token: SeIncBasePriorityPrivilege 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe Token: SeIncBasePriorityPrivilege 4548 {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe Token: SeIncBasePriorityPrivilege 5092 {E44338FA-6601-44f6-AE91-EACD45E484A0}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 2616 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe 92 PID 4948 wrote to memory of 2616 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe 92 PID 4948 wrote to memory of 2616 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe 92 PID 4948 wrote to memory of 4336 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe 93 PID 4948 wrote to memory of 4336 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe 93 PID 4948 wrote to memory of 4336 4948 2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe 93 PID 2616 wrote to memory of 3208 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 94 PID 2616 wrote to memory of 3208 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 94 PID 2616 wrote to memory of 3208 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 94 PID 2616 wrote to memory of 1204 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 95 PID 2616 wrote to memory of 1204 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 95 PID 2616 wrote to memory of 1204 2616 {CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe 95 PID 3208 wrote to memory of 1500 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 98 PID 3208 wrote to memory of 1500 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 98 PID 3208 wrote to memory of 1500 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 98 PID 3208 wrote to memory of 4452 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 99 PID 3208 wrote to memory of 4452 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 99 PID 3208 wrote to memory of 4452 3208 {AC294917-E640-48e4-B8C0-532B1D7520E5}.exe 99 PID 1500 wrote to memory of 4264 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 101 PID 1500 wrote to memory of 4264 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 101 PID 1500 wrote to memory of 4264 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 101 PID 1500 wrote to memory of 2436 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 102 PID 1500 wrote to memory of 2436 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 102 PID 1500 wrote to memory of 2436 1500 {D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe 102 PID 4264 wrote to memory of 2668 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 103 PID 4264 wrote to memory of 2668 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 103 PID 4264 wrote to memory of 2668 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 103 PID 4264 wrote to memory of 3852 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 104 PID 4264 wrote to memory of 3852 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 104 PID 4264 wrote to memory of 3852 4264 {A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe 104 PID 2668 wrote to memory of 1292 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 105 PID 2668 wrote to memory of 1292 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 105 PID 2668 wrote to memory of 1292 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 105 PID 2668 wrote to memory of 4664 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 106 PID 2668 wrote to memory of 4664 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 106 PID 2668 wrote to memory of 4664 2668 {58475D4D-B785-432f-BE92-F522E56F8C66}.exe 106 PID 1292 wrote to memory of 2400 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 107 PID 1292 wrote to memory of 2400 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 107 PID 1292 wrote to memory of 2400 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 107 PID 1292 wrote to memory of 2272 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 108 PID 1292 wrote to memory of 2272 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 108 PID 1292 wrote to memory of 2272 1292 {4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe 108 PID 2400 wrote to memory of 4508 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 109 PID 2400 wrote to memory of 4508 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 109 PID 2400 wrote to memory of 4508 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 109 PID 2400 wrote to memory of 4872 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 110 PID 2400 wrote to memory of 4872 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 110 PID 2400 wrote to memory of 4872 2400 {217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe 110 PID 4508 wrote to memory of 4812 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 111 PID 4508 wrote to memory of 4812 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 111 PID 4508 wrote to memory of 4812 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 111 PID 4508 wrote to memory of 4708 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 112 PID 4508 wrote to memory of 4708 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 112 PID 4508 wrote to memory of 4708 4508 {930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe 112 PID 4812 wrote to memory of 4548 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 113 PID 4812 wrote to memory of 4548 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 113 PID 4812 wrote to memory of 4548 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 113 PID 4812 wrote to memory of 904 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 114 PID 4812 wrote to memory of 904 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 114 PID 4812 wrote to memory of 904 4812 {D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe 114 PID 4548 wrote to memory of 5092 4548 {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe 115 PID 4548 wrote to memory of 5092 4548 {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe 115 PID 4548 wrote to memory of 5092 4548 {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe 115 PID 4548 wrote to memory of 5016 4548 {80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-02_269cefe5381b37fe7246b78e804542e2_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exeC:\Windows\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\{AC294917-E640-48e4-B8C0-532B1D7520E5}.exeC:\Windows\{AC294917-E640-48e4-B8C0-532B1D7520E5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exeC:\Windows\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exeC:\Windows\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\{58475D4D-B785-432f-BE92-F522E56F8C66}.exeC:\Windows\{58475D4D-B785-432f-BE92-F522E56F8C66}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exeC:\Windows\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\{217E183C-703A-4928-9F60-F4F01A5B9E9C}.exeC:\Windows\{217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\{930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exeC:\Windows\{930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\{D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exeC:\Windows\{D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\{80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exeC:\Windows\{80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\{E44338FA-6601-44f6-AE91-EACD45E484A0}.exeC:\Windows\{E44338FA-6601-44f6-AE91-EACD45E484A0}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5092 -
C:\Windows\{13FA6886-497B-420d-9B6D-11BDF902E0E9}.exeC:\Windows\{13FA6886-497B-420d-9B6D-11BDF902E0E9}.exe13⤵
- Executes dropped EXE
PID:2296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4433~1.EXE > nul13⤵PID:3320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80D63~1.EXE > nul12⤵PID:5016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9FBC~1.EXE > nul11⤵PID:904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{930A1~1.EXE > nul10⤵PID:4708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{217E1~1.EXE > nul9⤵PID:4872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FB85~1.EXE > nul8⤵PID:2272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58475~1.EXE > nul7⤵PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8307~1.EXE > nul6⤵PID:3852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0F56~1.EXE > nul5⤵PID:2436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC294~1.EXE > nul4⤵PID:4452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEA89~1.EXE > nul3⤵PID:1204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{13FA6886-497B-420d-9B6D-11BDF902E0E9}.exe
- Size 168KB
- SHA256 d8bce5be1bfe4d4955a7a83abe73e98f8264eb50febe040807a8afcd5a29c778
- MD5 5d6afedd0a82dc817c92db898b6882a7
- SHA1 076c196efde23bfee0db96c29fcf337b75fe6dda
- SHA512 37a270b4b6b005312b739793f1af0e30f4c890e3dacb8c4252ab8caf2d4ea9a6510ec8b5dacfe9e4576e316f23207717ca4efba52d5fcf0f40e0bed386d5aeb3
- SSDEEP 1536:1EGh0o5lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o5lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{217E183C-703A-4928-9F60-F4F01A5B9E9C}.exe
- Size 168KB
- SHA256 bc0892770d90af766d0b5f9de2cfea7f996d5ad0495566a83abdf663e60561ab
- MD5 05a0eb53f1c43811d88a93105e8b8cb5
- SHA1 38b379effad9bea8f2c9575c3fafb24d6a3f2242
- SHA512 34e42a22b0644e122e041827620dd22cfec42b34b8d1989476f7f0f8fce317769a2615f9e7deddce27001bb132662434db7204fbb0915902af321fb445cf6f19
- SSDEEP 1536:1EGh0oRlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oRlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4FB85A85-1CD8-4ad7-8E34-C1054035BDEA}.exe
- Size 168KB
- SHA256 87127de80253bd132341c31306b81f647de5ec5f31f6e26fe0823871cd7b4bca
- MD5 2a9cd7f5e2681a021088bda2b441a100
- SHA1 7dd4283318d27ec18543bafbc079dc4dab681911
- SHA512 82174946859e6975d3b549dfc9c37b1b7c6be8cde7fda9ca360ae3f16acf1b55d1452aea7d6a79939ab0027953caf2edaa46ea44246cf5a6334cef08ec2b153a
- SSDEEP 1536:1EGh0ozlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ozlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{58475D4D-B785-432f-BE92-F522E56F8C66}.exe
- Size 168KB
- SHA256 9947ac64ca089062737644067a776b9afd9d1149e957622fceea4c9db90faa25
- MD5 fb5b3b3c9666c3ee50ac408939ef7926
- SHA1 7ed3878fc0fe73fc8645b276cc73b89d65f93d1b
- SHA512 4dc4fc5bca7695be4d0a27d5ba42aaf485be1087207e5b42cced9bcff75c7139fe4a44f2d422f43e19818b8b2292018afb2724b765c76578b09fcc0c180f07c4
- SSDEEP 1536:1EGh0ojlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{80D6394A-0EA3-4390-AF7B-A22C990A34C3}.exe
- Size 168KB
- SHA256 8d3e748d19c080786f980792deb3d0f40bfe101b2083f00982291836809bece3
- MD5 5368432d22c346f3f56a777cdafdd95a
- SHA1 350d9c0b6f46f59ec170a6e13424096e294443ef
- SHA512 d04d0fb9aa04b1039186273d8457a0b5b66a45e8479a8336779a9297a999a1beeab15c30a106f66b2acc325ff9d87c164422975362b46a57bc6490df41cb0358
- SSDEEP 1536:1EGh0oJlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{930A13C3-F756-44c5-8DDC-D24F7ED63E15}.exe
- Size 168KB
- SHA256 1f108090f4cae565a3bfe1721701c5d57ac108bd99cdf6d31b003db34c168bfd
- MD5 45976e4a3f1d5fd4753e5f3736dfdae1
- SHA1 2aa583267a46d05d976ed7451a1c1b7bb4b21cc6
- SHA512 8d1fdc22628c6aeeee405e91ff9186bd86727d645d7ea7355d78e357b2987af11b28a7c09f466fc9f8fba5994569f5ded00c94c7b7de22c8ea07186a120be1e1
- SSDEEP 1536:1EGh0o1lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o1lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A8307F8D-2C93-4e5c-9BC5-18BE451FFB12}.exe
- Size 168KB
- SHA256 cd677517888df4747a281834db1cc90ebd1027057936cf6ea308647ac42e393f
- MD5 4dc5b082804c961335422dd18aa70b36
- SHA1 b931855193d8bb0f8b55a501b9b457266db65988
- SHA512 10a4384619c4e0714c0fdf12cda7ef140de7c99dd43e539bbb3923eb83991f81d208c119120806d0225d26c5bc52d7af292ecd934bf397d553ceceffb3723ab3
- SSDEEP 1536:1EGh0oilq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oilqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AC294917-E640-48e4-B8C0-532B1D7520E5}.exe
- Size 168KB
- SHA256 0da09db5f354b489fd8992ac619c1a1559e8e7538274a106522d13893651a8b4
- MD5 4fac5a23587e44906834bd70ce399dc2
- SHA1 85ab8d822bb8156ec7af60ff097608ca2da63317
- SHA512 8e7497cb46488d448df227448f646929d1610e594f7635ed4a5e00807982bddbbc73099b55e3ec4d722ceffde89e4b8c6df6602ed753a2632ba5dbc24adff226
- SSDEEP 1536:1EGh0oblq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oblqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CEA89EE0-F090-449b-B147-6AB6A04A4C9D}.exe
- Size 168KB
- SHA256 54c60c8d721dddfc969f25181e627c96ce73b2aa3f9a48c9af17316aed871aab
- MD5 3e116039a97b34bc5032e90787e2cb75
- SHA1 54dbda61151b226fc13da194b0dae57c5d49b496
- SHA512 696c901f2bb58f3c43edae473f5a43a497783ca4316a90889e2ec8925e7af587f846756b507b9daa6d4deffbc7c9542d99d2cb60926c112e790794024ba25659
- SSDEEP 1536:1EGh0oqlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oqlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D0F569EF-FE0B-48ca-87C0-2A7426896FB5}.exe
- Size 168KB
- SHA256 ffda58f7e9be2f6fdbc00676edefbc66115a0eadec42601df86dc2646141d7be
- MD5 ff6096302728aa275d0d29ddfb4b017b
- SHA1 709c214459735df1d294a573796168ffd8d0ca21
- SHA512 085cecd66412b00bfa2989e833bf1364b0c1b08fd1e42c32c4902710cbb64b1977289261e7d5583a688bd0d3007f5396f3bcf6be2c88e41796db11b9cdff2ec9
- SSDEEP 1536:1EGh0oLlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oLlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D9FBC246-42CB-4015-840D-AE6B0CE0A842}.exe
- Size 168KB
- SHA256 6e6dce1fba6a2d667680d8ce6e87c80b19fad0f796afccc0ef9772ca1bc08302
- MD5 67a3cd41e71c0679629e1d4277c0735f
- SHA1 2e8fed5b52724d146a38fe4be0ac3d9b15649f52
- SHA512 3bc57ab5509315b6a1e6f6aa846b4d4a18d983f16496de475bff8a4f8418c2649f78053bafc0a1c57a9aa223d9bf82a5c9a721f9f1a3797068075a0287a33eec
- SSDEEP 1536:1EGh0o+elq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0odlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E44338FA-6601-44f6-AE91-EACD45E484A0}.exe
- Size 168KB
- SHA256 376d26f24183ee85b65e5c9bbb1410fe406730707e6dad09293424725dcfd584
- MD5 b80e268df80bd690f25216a1ca8adcec
- SHA1 b0eca1758c97f91b00d2aa4cb4c8ffce1e17c0ed
- SHA512 55347128d0de2b25804f6b552bfaa00d909c72f408db63f508e03c8d75e6e1ff973bd48f72341cad0f1d8c8e05d72eb10332d49fc4ce953b9ac6fdddb074d3e2
- SSDEEP 1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP