Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 10:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe
- Size 408KB
- Sample240303-mftmbshb2v
- SHA256 40417e2e6b9aeedb388819b14582490b29577c136670864e7f41b398d3067ecd
- MD5 0a552a25b844e99aab552bd2fca8582b
- SHA1 64642a35d7ab7f8d0a2b6a962f1c9bb10facb241
- SHA512 fcd90b78481dae172c26f748fb8f2246fa2806ed1f5a85443eb97dbaaa67d9893478bdbde27c572091c80f166dda3e562babac3b080a1e76dd8fddadf60ea2fc
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG4ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000b0000000231f4-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000006cf-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002320b-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000006cf-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002320b-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000006cf-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002320b-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000600000002304e-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000002320b-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002304e-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023206-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002304e-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}\stubpath = "C:\\Windows\\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe" 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CDC3243-4478-44b6-B75B-7D95D968CCBF} {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CDC3243-4478-44b6-B75B-7D95D968CCBF}\stubpath = "C:\\Windows\\{5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe" {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06486588-1998-490b-8952-15FCA330115F} {9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06486588-1998-490b-8952-15FCA330115F}\stubpath = "C:\\Windows\\{06486588-1998-490b-8952-15FCA330115F}.exe" {9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0} 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}\stubpath = "C:\\Windows\\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe" {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{966EB559-8904-4c04-935A-4DF51D887030} {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A1F3611-E20D-499d-AE1F-ACBBA547031D} {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}\stubpath = "C:\\Windows\\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe" {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53} {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{966EB559-8904-4c04-935A-4DF51D887030}\stubpath = "C:\\Windows\\{966EB559-8904-4c04-935A-4DF51D887030}.exe" {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C83F201-442D-40f0-81C9-42C8F474A5AD}\stubpath = "C:\\Windows\\{1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe" {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E77604B-825C-40a4-A9E2-9A525B6B34E7} {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E77604B-825C-40a4-A9E2-9A525B6B34E7}\stubpath = "C:\\Windows\\{3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe" {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0} {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE}\stubpath = "C:\\Windows\\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe" {172D0E90-D73E-4731-8C66-815398A1D17C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A1F3611-E20D-499d-AE1F-ACBBA547031D}\stubpath = "C:\\Windows\\{9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe" {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6} {966EB559-8904-4c04-935A-4DF51D887030}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6}\stubpath = "C:\\Windows\\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe" {966EB559-8904-4c04-935A-4DF51D887030}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C83F201-442D-40f0-81C9-42C8F474A5AD} {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{172D0E90-D73E-4731-8C66-815398A1D17C} {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{172D0E90-D73E-4731-8C66-815398A1D17C}\stubpath = "C:\\Windows\\{172D0E90-D73E-4731-8C66-815398A1D17C}.exe" {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE} {172D0E90-D73E-4731-8C66-815398A1D17C}.exe - Executes dropped EXE 12 IoCs
pid Process 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 2500 {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe 1416 {9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe 4276 {06486588-1998-490b-8952-15FCA330115F}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe File created C:\Windows\{1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe File created C:\Windows\{3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe File created C:\Windows\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe File created C:\Windows\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe {172D0E90-D73E-4731-8C66-815398A1D17C}.exe File created C:\Windows\{9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe File created C:\Windows\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe File created C:\Windows\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe File created C:\Windows\{966EB559-8904-4c04-935A-4DF51D887030}.exe {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe File created C:\Windows\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe {966EB559-8904-4c04-935A-4DF51D887030}.exe File created C:\Windows\{172D0E90-D73E-4731-8C66-815398A1D17C}.exe {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe File created C:\Windows\{06486588-1998-490b-8952-15FCA330115F}.exe {9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe Token: SeIncBasePriorityPrivilege 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe Token: SeIncBasePriorityPrivilege 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe Token: SeIncBasePriorityPrivilege 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe Token: SeIncBasePriorityPrivilege 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe Token: SeIncBasePriorityPrivilege 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe Token: SeIncBasePriorityPrivilege 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe Token: SeIncBasePriorityPrivilege 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe Token: SeIncBasePriorityPrivilege 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe Token: SeIncBasePriorityPrivilege 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe Token: SeIncBasePriorityPrivilege 2500 {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe Token: SeIncBasePriorityPrivilege 1416 {9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 880 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe 95 PID 2308 wrote to memory of 880 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe 95 PID 2308 wrote to memory of 880 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe 95 PID 2308 wrote to memory of 1204 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe 96 PID 2308 wrote to memory of 1204 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe 96 PID 2308 wrote to memory of 1204 2308 2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe 96 PID 880 wrote to memory of 4224 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 97 PID 880 wrote to memory of 4224 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 97 PID 880 wrote to memory of 4224 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 97 PID 880 wrote to memory of 4880 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 98 PID 880 wrote to memory of 4880 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 98 PID 880 wrote to memory of 4880 880 {771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe 98 PID 4224 wrote to memory of 5012 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 102 PID 4224 wrote to memory of 5012 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 102 PID 4224 wrote to memory of 5012 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 102 PID 4224 wrote to memory of 2868 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 103 PID 4224 wrote to memory of 2868 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 103 PID 4224 wrote to memory of 2868 4224 {5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe 103 PID 5012 wrote to memory of 4140 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 104 PID 5012 wrote to memory of 4140 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 104 PID 5012 wrote to memory of 4140 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 104 PID 5012 wrote to memory of 636 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 105 PID 5012 wrote to memory of 636 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 105 PID 5012 wrote to memory of 636 5012 {0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe 105 PID 4140 wrote to memory of 4216 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 106 PID 4140 wrote to memory of 4216 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 106 PID 4140 wrote to memory of 4216 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 106 PID 4140 wrote to memory of 4736 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 107 PID 4140 wrote to memory of 4736 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 107 PID 4140 wrote to memory of 4736 4140 {966EB559-8904-4c04-935A-4DF51D887030}.exe 107 PID 4216 wrote to memory of 1020 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 108 PID 4216 wrote to memory of 1020 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 108 PID 4216 wrote to memory of 1020 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 108 PID 4216 wrote to memory of 4360 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 109 PID 4216 wrote to memory of 4360 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 109 PID 4216 wrote to memory of 4360 4216 {58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe 109 PID 1020 wrote to memory of 2468 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 110 PID 1020 wrote to memory of 2468 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 110 PID 1020 wrote to memory of 2468 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 110 PID 1020 wrote to memory of 1836 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 111 PID 1020 wrote to memory of 1836 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 111 PID 1020 wrote to memory of 1836 1020 {1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe 111 PID 2468 wrote to memory of 4160 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 114 PID 2468 wrote to memory of 4160 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 114 PID 2468 wrote to memory of 4160 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 114 PID 2468 wrote to memory of 1796 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 115 PID 2468 wrote to memory of 1796 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 115 PID 2468 wrote to memory of 1796 2468 {3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe 115 PID 4160 wrote to memory of 4728 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 116 PID 4160 wrote to memory of 4728 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 116 PID 4160 wrote to memory of 4728 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 116 PID 4160 wrote to memory of 444 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 117 PID 4160 wrote to memory of 444 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 117 PID 4160 wrote to memory of 444 4160 {BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe 117 PID 4728 wrote to memory of 2500 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 118 PID 4728 wrote to memory of 2500 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 118 PID 4728 wrote to memory of 2500 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 118 PID 4728 wrote to memory of 960 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 119 PID 4728 wrote to memory of 960 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 119 PID 4728 wrote to memory of 960 4728 {172D0E90-D73E-4731-8C66-815398A1D17C}.exe 119 PID 2500 wrote to memory of 1416 2500 {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe 120 PID 2500 wrote to memory of 1416 2500 {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe 120 PID 2500 wrote to memory of 1416 2500 {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe 120 PID 2500 wrote to memory of 1032 2500 {86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-03_0a552a25b844e99aab552bd2fca8582b_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exeC:\Windows\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\{5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exeC:\Windows\{5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exeC:\Windows\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\{966EB559-8904-4c04-935A-4DF51D887030}.exeC:\Windows\{966EB559-8904-4c04-935A-4DF51D887030}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exeC:\Windows\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\{1C83F201-442D-40f0-81C9-42C8F474A5AD}.exeC:\Windows\{1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\{3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exeC:\Windows\{3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exeC:\Windows\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\{172D0E90-D73E-4731-8C66-815398A1D17C}.exeC:\Windows\{172D0E90-D73E-4731-8C66-815398A1D17C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exeC:\Windows\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\{9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exeC:\Windows\{9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\{06486588-1998-490b-8952-15FCA330115F}.exeC:\Windows\{06486588-1998-490b-8952-15FCA330115F}.exe13⤵
- Executes dropped EXE
PID:4276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A1F3~1.EXE > nul13⤵PID:4536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86184~1.EXE > nul12⤵PID:1032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{172D0~1.EXE > nul11⤵PID:960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB6A4~1.EXE > nul10⤵PID:444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E776~1.EXE > nul9⤵PID:1796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C83F~1.EXE > nul8⤵PID:1836
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58B6D~1.EXE > nul7⤵PID:4360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{966EB~1.EXE > nul6⤵PID:4736
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E722~1.EXE > nul5⤵PID:636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CDC3~1.EXE > nul4⤵PID:2868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{771ED~1.EXE > nul3⤵PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{06486588-1998-490b-8952-15FCA330115F}.exe
- Size 408KB
- SHA256 6f9edf68706e5890d9458abd8750524db92a5d81078360f7e25b1c99bb966760
- MD5 a6946527493de3e6c61d3c6c93d454ab
- SHA1 bcaec0585cedb70f0526d95526f364ee9ed53722
- SHA512 555ee4f41692ed1f2e027ab8ae2c6908c7cfed884b3d21f1a357a4290aba8a56a8d88d2ff1afe0086f96d42b645d51ad02f402d1e982f3f8db583186a0245ff7
- SSDEEP 3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGoldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{0E722B07-9088-4e6d-A1F5-7EDDDBEDCC53}.exe
- Size 408KB
- SHA256 ea8616cee81941b4a08ae401349a42025449c4b912b347c607d5ed05b1b768a3
- MD5 1606b402daddbc932bd8eb284929f52f
- SHA1 58cc974fc4319fa810e343300a94e3bc84a79bc5
- SHA512 a9f74bc5a7f48d845628575a023791043affa697c39df8c0f3ee0c8bb0422acc754cf07cf50e55b9a7c300c2fe6e0ebc5338929361bfd737eaab074409dbffad
- SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGnldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{172D0E90-D73E-4731-8C66-815398A1D17C}.exe
- Size 408KB
- SHA256 a10c844190a2b56508780ff6a3c260682ffe5898f9d58a1c5ea34bf194965328
- MD5 ce4d5f9bfc4cef4cf03495fe8225e404
- SHA1 3e911f7cbf075fddc6199f7958d00f7a5fd4316e
- SHA512 1583dae182258b08be3ecc2e6048401c8e9cc6793dcd7ebd1bd00ba4995d7f27646f3aca5626546d821516548969cdc743166a94ea4bb360e68cff6701f1e344
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG8ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1C83F201-442D-40f0-81C9-42C8F474A5AD}.exe
- Size 408KB
- SHA256 277039a22d3d4b229192a7e4d05453af433ea635472ac466aba97b0d2d5c53ec
- MD5 250d09da0c6f380de52bdb5dce506c29
- SHA1 7881d90ea17c70c79a62537e76a1e4b95da30f8d
- SHA512 246b3472ec0e9f50cd8612563a4a278233af2dadb3497448d2f8dd7ac301dee79509453ad45db562cdbe3957960383c7db92e7d30f8edec90473672b539e3e50
- SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3E77604B-825C-40a4-A9E2-9A525B6B34E7}.exe
- Size 408KB
- SHA256 a5ec98b1e4328e05068017893e89a08d96744790d259ea88882584ebb3bea147
- MD5 918d5b40cc5021a377b2d3396d967dee
- SHA1 f343e7d797d59f65985f2c1443dab15be8dbf7fc
- SHA512 a1acb53ba22cc0005f6959bc18d489c787fc2d277509038aa8ae1b43b2801efa420210bfa87f22df7a5b4eb02a7167df446dca22737e7ad005e6b60fa7b0fc11
- SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGxldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{58B6D2FF-AB02-474f-998E-E98E7EC00CB6}.exe
- Size 408KB
- SHA256 08f5ad1c2f0d932fbca556e14cb1dda8c7e82ece70e2a91d37b49a91e71c81eb
- MD5 4fb0e297347f5eba06fe41121409afe7
- SHA1 0e6a8f3156e32e54e00ba34451fd0938cf10dcbb
- SHA512 ff4727c95eb3de3d3d28b7463947540eb200933c69bc9b5c3709818be66c948dc8570fa8a9c49f7811391df0811cb0fe1c89d307a0847ccd6d25c695a67287db
- SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGxldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5CDC3243-4478-44b6-B75B-7D95D968CCBF}.exe
- Size 408KB
- SHA256 81a8aee6ad68642f3647052a1f5ffccfda9d8ef84820dcbcb17f7aa5d794008d
- MD5 2796f54872f3bd0706d3aedb51240524
- SHA1 efefe0a38d4a8df346f2e0b235ca5e1777746e5f
- SHA512 7b9b3a4fcd31ee2cd489c9e2d3fbd7a92796e9d0799dc0d5750dd08821c7e801a0242a80457442af588e124170bd6a066e7c3d517f3aad95af25e442c936946a
- SSDEEP 3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGKldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{771ED58B-E6EE-47f7-9797-7B0A79DB0CD0}.exe
- Size 408KB
- SHA256 968f9d1c6da77bbbeec23810528c477af16007da6d922d49a64fc6c30ba52bb4
- MD5 c3ec5535695cfdac347159ece51fb78d
- SHA1 b9c103bd92c1371e4d5f0fa3f43d6203cda209da
- SHA512 0ec34bfc01a60db0dd60aa15daf3aeb2c4f473464897e333ea70dc7ef8e6704341aac022c5abe13652781059aeb79af4ebb733fd47a8fe9c160f83895c560311
- SSDEEP 3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG7ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{86184457-3789-4eb8-9C0D-E8C4EFAD16AE}.exe
- Size 408KB
- SHA256 c34e879e00bcfe71e418b220da17abc1bd9bfb3b472d2a0182c1172c4e28f85f
- MD5 f013991c681996e715d74aca1cdb115a
- SHA1 f7b56ae72aee0ad3729aa25ee0691390053d8f4f
- SHA512 d68bc94e30f636fea5217e9eb07e8b1bf3f115a0366a9692f74e8f9acf228f7b48782ba2237fcd4bf7b32c6e635b15bf640884c9f859600199ac5dc87b3338ff
- SSDEEP 3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGYldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{966EB559-8904-4c04-935A-4DF51D887030}.exe
- Size 408KB
- SHA256 a49b1157fac80df206f4a89f542a4eb0003d12025975ed8485876ce55da013e7
- MD5 73f7680ffc563cb5a46f50ba08859aa8
- SHA1 8f67b002ed49bdb15762194dff94bbed6f4da2d7
- SHA512 462db8b4d52f533fbc9e724e6483cdbcaf5594eeace39a45086220cef65d8a9994378793b084a649e38f453b7ff89a075279dab10405c3a68223dd3ca2b251f3
- SSDEEP 3072:CEGh0obl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGhldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9A1F3611-E20D-499d-AE1F-ACBBA547031D}.exe
- Size 408KB
- SHA256 aa4dfd58892d3cc7c8ba30a9ee0e673936a4f489227c1e9943dc3ec3158e8ae9
- MD5 15ded02c3ca3b7b37502a852e6756a2a
- SHA1 01ee228616459c602c304eaabec0e12e6aca94e6
- SHA512 56f91af50971b90fb6e378d41a885f5adfbb14b612a2e2e89dc00868dc967fafd41728e0b10ea6bd4503e57cfd3d381ba35b957175b604f0f492c8473f013c8c
- SSDEEP 3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGLldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BB6A453E-0CFA-4e7a-91F5-FFFFEF3077A0}.exe
- Size 408KB
- SHA256 f5fc9351b8c307fd5968994204538a7f60ba32bdc05cbfad7d87ffe2d955ed9c
- MD5 431fa21c7bf3bac856a838bf5f1f0f0a
- SHA1 f438bd9fb9dfd291ff2ffc174df9f48bd001d72c
- SHA512 92cd76a460daa05a4682ac84c584f5a5114d2a577319598b404580af51ac0a642ab7f36761cef70b101b67704d73d3f3132ea1a86de7dbe48c366dfbbcd99ff2
- SSDEEP 3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGRldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP