Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 00:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe
- Size 408KB
- Sample240303-apv6asaf21
- SHA256 557b8da4e1aca5577aa7cb4f0f9269ba9444b07d31240ae360970c42f5c10c8b
- MD5 0769cc3e825e6b2a43cac3f38b3cf5da
- SHA1 6e075dca26c262af291919e82f1c2c9503cce506
- SHA512 b33c36e0ecb4f98e671e7fac56796033b99a146902f0e47ee7c7a141d637eb3c9247bde9609c0e75dcd9382bed541b258f877300b0434675bbf2e7a04e84b433
- SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGPldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0004000000022ea1-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023231-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023239-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000230ff-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023239-17.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000230ff-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023239-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000022f70-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023239-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000022f70-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023239-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000022f70-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7C49CD9-A972-4ee6-9C53-116A653B75F6}\stubpath = "C:\\Windows\\{C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe" {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAE6AE29-9630-424f-B2FC-31EFA698F800}\stubpath = "C:\\Windows\\{AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe" {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5656FAC6-C423-4464-BB21-DE818876A06C}\stubpath = "C:\\Windows\\{5656FAC6-C423-4464-BB21-DE818876A06C}.exe" {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7C49CD9-A972-4ee6-9C53-116A653B75F6} {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB5AD403-B4B1-40c8-BFE2-C8060893180F} {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E} {5656FAC6-C423-4464-BB21-DE818876A06C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56CA20F3-B450-42f5-AD10-7720D29BD0B6} 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB5AD403-B4B1-40c8-BFE2-C8060893180F}\stubpath = "C:\\Windows\\{AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe" {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD} {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EAF320B-F724-47ed-B6E7-81F756F44978}\stubpath = "C:\\Windows\\{6EAF320B-F724-47ed-B6E7-81F756F44978}.exe" {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}\stubpath = "C:\\Windows\\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe" {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{883CFBD2-EB8E-469f-8899-49A7DA9B3385} {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56CA20F3-B450-42f5-AD10-7720D29BD0B6}\stubpath = "C:\\Windows\\{56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe" 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F27A505-21A3-424e-92CF-EEFA8572A3DA} {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F27A505-21A3-424e-92CF-EEFA8572A3DA}\stubpath = "C:\\Windows\\{0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe" {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0} {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}\stubpath = "C:\\Windows\\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe" {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAE6AE29-9630-424f-B2FC-31EFA698F800} {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{883CFBD2-EB8E-469f-8899-49A7DA9B3385}\stubpath = "C:\\Windows\\{883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe" {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5656FAC6-C423-4464-BB21-DE818876A06C} {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}\stubpath = "C:\\Windows\\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe" {5656FAC6-C423-4464-BB21-DE818876A06C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EAF320B-F724-47ed-B6E7-81F756F44978} {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D817F2D-99F7-4b58-9D4A-21774B071EEB} {6EAF320B-F724-47ed-B6E7-81F756F44978}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D817F2D-99F7-4b58-9D4A-21774B071EEB}\stubpath = "C:\\Windows\\{2D817F2D-99F7-4b58-9D4A-21774B071EEB}.exe" {6EAF320B-F724-47ed-B6E7-81F756F44978}.exe - Executes dropped EXE 12 IoCs
pid Process 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 212 {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe 4732 {6EAF320B-F724-47ed-B6E7-81F756F44978}.exe 3064 {2D817F2D-99F7-4b58-9D4A-21774B071EEB}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{5656FAC6-C423-4464-BB21-DE818876A06C}.exe {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe File created C:\Windows\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe {5656FAC6-C423-4464-BB21-DE818876A06C}.exe File created C:\Windows\{6EAF320B-F724-47ed-B6E7-81F756F44978}.exe {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe File created C:\Windows\{0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe File created C:\Windows\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe File created C:\Windows\{C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe File created C:\Windows\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe File created C:\Windows\{883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe File created C:\Windows\{56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe File created C:\Windows\{AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe File created C:\Windows\{AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe File created C:\Windows\{2D817F2D-99F7-4b58-9D4A-21774B071EEB}.exe {6EAF320B-F724-47ed-B6E7-81F756F44978}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe Token: SeIncBasePriorityPrivilege 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe Token: SeIncBasePriorityPrivilege 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe Token: SeIncBasePriorityPrivilege 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe Token: SeIncBasePriorityPrivilege 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe Token: SeIncBasePriorityPrivilege 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe Token: SeIncBasePriorityPrivilege 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe Token: SeIncBasePriorityPrivilege 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe Token: SeIncBasePriorityPrivilege 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe Token: SeIncBasePriorityPrivilege 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe Token: SeIncBasePriorityPrivilege 212 {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe Token: SeIncBasePriorityPrivilege 4732 {6EAF320B-F724-47ed-B6E7-81F756F44978}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 760 wrote to memory of 2528 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe 95 PID 760 wrote to memory of 2528 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe 95 PID 760 wrote to memory of 2528 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe 95 PID 760 wrote to memory of 1552 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe 96 PID 760 wrote to memory of 1552 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe 96 PID 760 wrote to memory of 1552 760 2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe 96 PID 2528 wrote to memory of 872 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 97 PID 2528 wrote to memory of 872 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 97 PID 2528 wrote to memory of 872 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 97 PID 2528 wrote to memory of 1852 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 98 PID 2528 wrote to memory of 1852 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 98 PID 2528 wrote to memory of 1852 2528 {56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe 98 PID 872 wrote to memory of 4080 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 101 PID 872 wrote to memory of 4080 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 101 PID 872 wrote to memory of 4080 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 101 PID 872 wrote to memory of 3484 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 102 PID 872 wrote to memory of 3484 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 102 PID 872 wrote to memory of 3484 872 {0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe 102 PID 4080 wrote to memory of 3340 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 105 PID 4080 wrote to memory of 3340 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 105 PID 4080 wrote to memory of 3340 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 105 PID 4080 wrote to memory of 3616 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 106 PID 4080 wrote to memory of 3616 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 106 PID 4080 wrote to memory of 3616 4080 {E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe 106 PID 3340 wrote to memory of 2788 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 107 PID 3340 wrote to memory of 2788 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 107 PID 3340 wrote to memory of 2788 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 107 PID 3340 wrote to memory of 1132 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 108 PID 3340 wrote to memory of 1132 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 108 PID 3340 wrote to memory of 1132 3340 {C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe 108 PID 2788 wrote to memory of 1708 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 109 PID 2788 wrote to memory of 1708 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 109 PID 2788 wrote to memory of 1708 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 109 PID 2788 wrote to memory of 964 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 110 PID 2788 wrote to memory of 964 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 110 PID 2788 wrote to memory of 964 2788 {AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe 110 PID 1708 wrote to memory of 4336 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 111 PID 1708 wrote to memory of 4336 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 111 PID 1708 wrote to memory of 4336 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 111 PID 1708 wrote to memory of 3376 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 112 PID 1708 wrote to memory of 3376 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 112 PID 1708 wrote to memory of 3376 1708 {AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe 112 PID 4336 wrote to memory of 4952 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 113 PID 4336 wrote to memory of 4952 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 113 PID 4336 wrote to memory of 4952 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 113 PID 4336 wrote to memory of 5052 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 114 PID 4336 wrote to memory of 5052 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 114 PID 4336 wrote to memory of 5052 4336 {D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe 114 PID 4952 wrote to memory of 3272 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 115 PID 4952 wrote to memory of 3272 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 115 PID 4952 wrote to memory of 3272 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 115 PID 4952 wrote to memory of 2392 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 116 PID 4952 wrote to memory of 2392 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 116 PID 4952 wrote to memory of 2392 4952 {883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe 116 PID 3272 wrote to memory of 212 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 117 PID 3272 wrote to memory of 212 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 117 PID 3272 wrote to memory of 212 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 117 PID 3272 wrote to memory of 3484 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 118 PID 3272 wrote to memory of 3484 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 118 PID 3272 wrote to memory of 3484 3272 {5656FAC6-C423-4464-BB21-DE818876A06C}.exe 118 PID 212 wrote to memory of 4732 212 {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe 119 PID 212 wrote to memory of 4732 212 {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe 119 PID 212 wrote to memory of 4732 212 {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe 119 PID 212 wrote to memory of 4072 212 {148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-03_0769cc3e825e6b2a43cac3f38b3cf5da_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\{56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exeC:\Windows\{56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\{0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exeC:\Windows\{0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exeC:\Windows\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\{C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exeC:\Windows\{C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\{AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exeC:\Windows\{AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\{AAE6AE29-9630-424f-B2FC-31EFA698F800}.exeC:\Windows\{AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exeC:\Windows\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\{883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exeC:\Windows\{883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\{5656FAC6-C423-4464-BB21-DE818876A06C}.exeC:\Windows\{5656FAC6-C423-4464-BB21-DE818876A06C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exeC:\Windows\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\{6EAF320B-F724-47ed-B6E7-81F756F44978}.exeC:\Windows\{6EAF320B-F724-47ed-B6E7-81F756F44978}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4732 -
C:\Windows\{2D817F2D-99F7-4b58-9D4A-21774B071EEB}.exeC:\Windows\{2D817F2D-99F7-4b58-9D4A-21774B071EEB}.exe13⤵
- Executes dropped EXE
PID:3064
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EAF3~1.EXE > nul13⤵PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{148F1~1.EXE > nul12⤵PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5656F~1.EXE > nul11⤵PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{883CF~1.EXE > nul10⤵PID:2392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4D53~1.EXE > nul9⤵PID:5052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAE6A~1.EXE > nul8⤵PID:3376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB5AD~1.EXE > nul7⤵PID:964
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7C49~1.EXE > nul6⤵PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8BFA~1.EXE > nul5⤵PID:3616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F27A~1.EXE > nul4⤵PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56CA2~1.EXE > nul3⤵PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:2232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0F27A505-21A3-424e-92CF-EEFA8572A3DA}.exe
- Size 408KB
- SHA256 ac1e682e11650bf074c56043aca1621a8f8ae891316eddc3975d8ddcce3bc799
- MD5 0ae530d3bf81933e002a3ab73990b74e
- SHA1 be3b0119f478114bc87f0ef73e80d464d248c169
- SHA512 0a45394b2cd1194b63f095b1c598d84928bd3def8fdd0e93a9e2722d701a0d41def9c21b2ace81ed045582f492ac23aafb49b452aa27e26924b3ced383410063
- SSDEEP 3072:CEGh0okl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{148F1CF0-F02F-46f6-9ECC-17DF11CC6F5E}.exe
- Size 408KB
- SHA256 d4fc969cf5262daee23f04d1052029bee55a2cd3f604251f0b496db656bea14d
- MD5 e6ad70f1bc1279b747e6f76f1191a8a3
- SHA1 34af28cc33f639ebe5af92077278734363dd95bf
- SHA512 2bff74e691bef5da020e61d4c861f52c03a95c60f03197711e96174af4be27e0a08fc72f13143267cba765918b26a89cf9149485a64b7eeb13e794b93f9b80aa
- SSDEEP 3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2D817F2D-99F7-4b58-9D4A-21774B071EEB}.exe
- Size 408KB
- SHA256 36c06e70221386af5bfa26ff6f660d349fcdc502f1d6f7eed7282eb3a7747e1d
- MD5 06070898afecc8f8ca82584540ec4290
- SHA1 7894747899aeaee0ac3a4c340087c01ec2aae9f4
- SHA512 602bda0e065f259c9e5efcb8ba6e0e807de450da4aac7a30e1750a62c7d1cefc5422585d8d1900afc19425a15feca8ec5dac559448fefefb2428d0ffbeb32fdc
- SSDEEP 3072:CEGh0oVl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG/ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5656FAC6-C423-4464-BB21-DE818876A06C}.exe
- Size 408KB
- SHA256 76695553f5848ea8ae8f610af7f7a7e6580a815ad2457f667128646ec23904e5
- MD5 52ac582d01a6985e0bd1e88a6896f456
- SHA1 51123b39b5e8d8c71c30de4c44aa16aef6b28666
- SHA512 b05d707b21924318075a13b135f6c3dc4c53bc81f30ac0a6636e683287419999b53baf598fd3b5a5dd8698f418d3dabdf7abc4857664a8280473a02332f2e277
- SSDEEP 3072:CEGh0ogl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{56CA20F3-B450-42f5-AD10-7720D29BD0B6}.exe
- Size 408KB
- SHA256 1b76fb7e5618943c757ff2144962588df6873869b170c66133fb4bd3d65238d4
- MD5 0b9a1dbd778294f8acb7c919344c7358
- SHA1 423f76fa0a75015390be546431b9c788139539e6
- SHA512 51050b2573676f6b8233628c30ad4b2401c8114320aefb3c79bffb19385dde34c806dcdda54efa0466c87daa3b68a5159476f4401ea381062737013df02e21cc
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6EAF320B-F724-47ed-B6E7-81F756F44978}.exe
- Size 408KB
- SHA256 c93b18507aa98ce3ff0bb0e8b5ad4a2bff5bf49b3bc11833b175884bf33125cd
- MD5 6aa29ba854ebe71b3828ead9135159ea
- SHA1 5d66525e87697fff26b395d0873734ec9b7a964b
- SHA512 0f366aa6ee7a4c34a57141f81ba9982f66a7a91c617cd43c872a1c49477b9bf5d64896e6d36d7a1e508c6e297a45fcce413e0b38189754f6371d869fe49dc0df
- SSDEEP 3072:CEGh0o/l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGpldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{883CFBD2-EB8E-469f-8899-49A7DA9B3385}.exe
- Size 408KB
- SHA256 7599e5f1f689c44cadae979b68f08bd9f8bdcfc682a08a65b75404deff1656e7
- MD5 fc6029993083476f0d07c466903fe1f6
- SHA1 38e0cfc9a0bfca3b5193ec51eab78717e8fb69c5
- SHA512 025cddf17b047df4b9f0b57b2d4b429b97201dd3a49742da6ad890a4b09b3b9e00bbcced3ffcd2d42ae304bd536bea6ddea03d1c40709e1f913bc0eb9fbbf84f
- SSDEEP 3072:CEGh0odl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGjldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AAE6AE29-9630-424f-B2FC-31EFA698F800}.exe
- Size 408KB
- SHA256 0ad52357f64bd6286fcfe0969c0834e27b9ad9ff1f3c2c9ac415545385451aab
- MD5 33a760b6685bf1e2d016dda4346211a4
- SHA1 bfdc2d018b6c56e837c73eef5c5b6c417849f72c
- SHA512 65bf90a6453d554e306bcd597e958c7f227892585c9d47d14d60263739fd636e2329177cffcf0759569266968a055fcf3328935beadcad5833d3756cd24d6dbd
- SSDEEP 3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGcldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AB5AD403-B4B1-40c8-BFE2-C8060893180F}.exe
- Size 408KB
- SHA256 7bfa1aa8c670ad6f6b53866898809bfd2398253ef8cc810c7fbd26dece1ea121
- MD5 4337e2fa52badea98423f230ec9d2af4
- SHA1 e0903e3544a9be4d4e66dd71f55e54afed0f2de3
- SHA512 866992c06cb1191b36f76c163fe0e7d2c3015f515c48f088699ce52961c75edbf818b0db370539cad6ae17b516903e827a78dfe11d544eca741db7e1eb8c459e
- SSDEEP 3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGrldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C7C49CD9-A972-4ee6-9C53-116A653B75F6}.exe
- Size 408KB
- SHA256 93a0115486c0ed2529a49cfd1eeb60a7ffc0f42e6eaf1eca6ec06cb5c7ef2aa5
- MD5 1fb8364ae59a5f77ac4f13f0927a5d3b
- SHA1 ba8104bb6899852b9df106c23f6c2257e74d319a
- SHA512 b6140bcf5a63f10567c956869bcbfdeaf928c76af88f1ce189a8e39d3fe29cf0ba83a2c9d8738d3b91a79902b389c1d48e96fa794616c2d8c192a6272f609394
- SSDEEP 3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGMldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D4D537FA-1EE3-44b6-AA73-8CDF0617A8DD}.exe
- Size 408KB
- SHA256 e1b57133ad6ccd809e73a027571ab87faeac7ece8657c7fac13630745be6d79f
- MD5 37c92a5f1d34518d8007e29f0eb3b820
- SHA1 062dacf20fdb46e939eaf4c34fab3ab69d44a413
- SHA512 1e15ee84d61bbb619ddae90251212b4c11d1fc6a37ab24a95c5a7a8a86c641b830cb10af6b683aaff25dbdf89376dc1d3d1cc28685c1727600fc0107ff625457
- SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGaldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E8BFA1A5-74B3-477f-8274-BB4686E0CAE0}.exe
- Size 408KB
- SHA256 a1040c3600db231ecc3cc362526d1c66e359c799f75d79be888d1b3f4b092936
- MD5 6c3ad5c430cddcd4c9bff78b1a4bb600
- SHA1 02e2952d4992c97c6e08a03fcda8a61f0f5e80f5
- SHA512 8071a649397051104f3041260be864a57973762fbb405a97bb3ae6d9043602af52b2e36a00882c0a7d2562e0fd9f10385a1eaa3a8facdb5ea4047e39f072c6b5
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP