Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/03/2024, 19:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
- Size 408KB
- Sample240310-ym4xesah48
- SHA256 12578c30957b7c8aafa19086d05ab94875eb937219b9702b938edf11a84b70a5
- MD5 bea06b806d2df322bbe61ea0b5124726
- SHA1 432af0f0e61177c175117e2e41ead19568012aeb
- SHA512 f27ca686af760c8bd5c2dd74f455597382b4332c2f0694ef932b9817f51752313cab541860b7afb9ac04cf4d16be9983b916a733b6e7223dbe957d3ad677d32f
- SSDEEP 3072:CEGh0o5l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGPldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000023210-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000006cf-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023315-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000001db54-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023396-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023492-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023396-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023495-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023396-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023495-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023396-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002319b-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C758565-7C30-400c-A07A-3A92B5F74BDF} {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C758565-7C30-400c-A07A-3A92B5F74BDF}\stubpath = "C:\\Windows\\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe" {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}\stubpath = "C:\\Windows\\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe" 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59761BBD-3ABA-4738-9C06-E7802B8E8629} {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F7E0654-D82C-4500-BAF0-C5059392DF63} {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F7E0654-D82C-4500-BAF0-C5059392DF63}\stubpath = "C:\\Windows\\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe" {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22} {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF1783B1-7DF6-4834-92D3-DDCC119691E0} {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C290ED1-E136-402c-A12F-1C9722714837}\stubpath = "C:\\Windows\\{6C290ED1-E136-402c-A12F-1C9722714837}.exe" {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}\stubpath = "C:\\Windows\\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe" {6C290ED1-E136-402c-A12F-1C9722714837}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}\stubpath = "C:\\Windows\\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe" {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5} {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF} {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C290ED1-E136-402c-A12F-1C9722714837} {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}\stubpath = "C:\\Windows\\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe" {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDA533B7-161C-4493-96C3-821A998821C7} {7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDA533B7-161C-4493-96C3-821A998821C7}\stubpath = "C:\\Windows\\{DDA533B7-161C-4493-96C3-821A998821C7}.exe" {7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}\stubpath = "C:\\Windows\\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe" {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7} 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A} {6C290ED1-E136-402c-A12F-1C9722714837}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59761BBD-3ABA-4738-9C06-E7802B8E8629}\stubpath = "C:\\Windows\\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe" {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}\stubpath = "C:\\Windows\\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe" {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233} {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}\stubpath = "C:\\Windows\\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe" {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe - Executes dropped EXE 12 IoCs
pid Process 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 4308 {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe 644 {7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe 1412 {DDA533B7-161C-4493-96C3-821A998821C7}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe File created C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe File created C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe File created C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe File created C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe File created C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe File created C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe File created C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe {7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe File created C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe File created C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe {6C290ED1-E136-402c-A12F-1C9722714837}.exe File created C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe File created C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe Token: SeIncBasePriorityPrivilege 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe Token: SeIncBasePriorityPrivilege 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe Token: SeIncBasePriorityPrivilege 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe Token: SeIncBasePriorityPrivilege 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe Token: SeIncBasePriorityPrivilege 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe Token: SeIncBasePriorityPrivilege 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe Token: SeIncBasePriorityPrivilege 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe Token: SeIncBasePriorityPrivilege 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe Token: SeIncBasePriorityPrivilege 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe Token: SeIncBasePriorityPrivilege 4308 {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe Token: SeIncBasePriorityPrivilege 644 {7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3144 wrote to memory of 5044 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe 102 PID 3144 wrote to memory of 5044 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe 102 PID 3144 wrote to memory of 5044 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe 102 PID 3144 wrote to memory of 1492 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe 103 PID 3144 wrote to memory of 1492 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe 103 PID 3144 wrote to memory of 1492 3144 2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe 103 PID 5044 wrote to memory of 4928 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 104 PID 5044 wrote to memory of 4928 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 104 PID 5044 wrote to memory of 4928 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 104 PID 5044 wrote to memory of 2180 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 105 PID 5044 wrote to memory of 2180 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 105 PID 5044 wrote to memory of 2180 5044 {35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe 105 PID 4928 wrote to memory of 4964 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 108 PID 4928 wrote to memory of 4964 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 108 PID 4928 wrote to memory of 4964 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 108 PID 4928 wrote to memory of 1404 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 109 PID 4928 wrote to memory of 1404 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 109 PID 4928 wrote to memory of 1404 4928 {6C290ED1-E136-402c-A12F-1C9722714837}.exe 109 PID 4964 wrote to memory of 4900 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 110 PID 4964 wrote to memory of 4900 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 110 PID 4964 wrote to memory of 4900 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 110 PID 4964 wrote to memory of 3724 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 111 PID 4964 wrote to memory of 3724 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 111 PID 4964 wrote to memory of 3724 4964 {42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe 111 PID 4900 wrote to memory of 4960 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 112 PID 4900 wrote to memory of 4960 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 112 PID 4900 wrote to memory of 4960 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 112 PID 4900 wrote to memory of 1668 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 113 PID 4900 wrote to memory of 1668 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 113 PID 4900 wrote to memory of 1668 4900 {59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe 113 PID 4960 wrote to memory of 5064 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 115 PID 4960 wrote to memory of 5064 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 115 PID 4960 wrote to memory of 5064 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 115 PID 4960 wrote to memory of 4236 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 116 PID 4960 wrote to memory of 4236 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 116 PID 4960 wrote to memory of 4236 4960 {7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe 116 PID 5064 wrote to memory of 4100 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 117 PID 5064 wrote to memory of 4100 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 117 PID 5064 wrote to memory of 4100 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 117 PID 5064 wrote to memory of 3144 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 118 PID 5064 wrote to memory of 3144 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 118 PID 5064 wrote to memory of 3144 5064 {C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe 118 PID 4100 wrote to memory of 1864 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 123 PID 4100 wrote to memory of 1864 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 123 PID 4100 wrote to memory of 1864 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 123 PID 4100 wrote to memory of 3576 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 124 PID 4100 wrote to memory of 3576 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 124 PID 4100 wrote to memory of 3576 4100 {00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe 124 PID 1864 wrote to memory of 4552 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 125 PID 1864 wrote to memory of 4552 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 125 PID 1864 wrote to memory of 4552 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 125 PID 1864 wrote to memory of 1724 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 126 PID 1864 wrote to memory of 1724 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 126 PID 1864 wrote to memory of 1724 1864 {FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe 126 PID 4552 wrote to memory of 4308 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 127 PID 4552 wrote to memory of 4308 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 127 PID 4552 wrote to memory of 4308 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 127 PID 4552 wrote to memory of 1192 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 128 PID 4552 wrote to memory of 1192 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 128 PID 4552 wrote to memory of 1192 4552 {D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe 128 PID 4308 wrote to memory of 644 4308 {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe 129 PID 4308 wrote to memory of 644 4308 {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe 129 PID 4308 wrote to memory of 644 4308 {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe 129 PID 4308 wrote to memory of 2000 4308 {BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exeC:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exeC:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exeC:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exeC:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exeC:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exeC:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exeC:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exeC:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exeC:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exeC:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exeC:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:644 -
C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exeC:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe13⤵
- Executes dropped EXE
PID:1412
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C758~1.EXE > nul13⤵PID:552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF178~1.EXE > nul12⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8F21~1.EXE > nul11⤵PID:1192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBAF7~1.EXE > nul10⤵PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00A2B~1.EXE > nul9⤵PID:3576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2277~1.EXE > nul8⤵PID:3144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F7E0~1.EXE > nul7⤵PID:4236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59761~1.EXE > nul6⤵PID:1668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42AA8~1.EXE > nul5⤵PID:3724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C290~1.EXE > nul4⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35D17~1.EXE > nul3⤵PID:2180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
- Size 408KB
- SHA256 8ed0607f1e2871e4c2dc48401b417674dd83d5c25268ec2f7ba4fe3c59a1887f
- MD5 c57a4e5c55f0bb8ad241e48294e4591a
- SHA1 aafe291fb738e8052d7e693ac1ee5699af12afae
- SHA512 82fbf97fdf13a3eb0f220dd09e62c8dff58a5a6d02160d1071da662deabbac1716e4b65bf18db3f8e055d4d7a0e5ed3dc6ba706ae2660032e97feec552c31c15
- SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGtldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
- Size 408KB
- SHA256 6527cb758f245415e6aeaaa06747d4a34debaf67ed6c4c31677f613926622043
- MD5 6ab888b90e492cf187a7c725e2053e65
- SHA1 5bbae43a644e52cbdc56b6567a319393f134fd39
- SHA512 a5043ab96eaf4b8b4246ab42647a6f74dba9b67a26a466c5c2ddd3fac71cffbb287a4c3a9440cecb6217d0e8316946f6ae0fc2c87798bd4b153a515e367e67f4
- SSDEEP 3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGnldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
- Size 408KB
- SHA256 42d2e2eea05a9bf72d14f2d83bac07f57a1e2e0aab66c4fec55b846060ba95ee
- MD5 cb9f4850b9e56f3a6c8eab96e5c12aec
- SHA1 216413cca0a7223ddaf9ec76fc085f76b81a5f99
- SHA512 35f0a4d4b6832a5af140e0c0be7f8c96f660fe33224486cc68aac53231529b316b500b37d27d65a1e397a57755d83448f3b4657b7c78d19eb332195691483ecf
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGoldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
- Size 408KB
- SHA256 ba963eecc3c8dfdfb68b652c95c989151055a92d288633bef892702e9a42a3f7
- MD5 29e1fc4cbaaffcc3e025d288a205327a
- SHA1 8f11898b9e5f03523bc1fb65a40c0e5a6a4cdfcd
- SHA512 720abc7bd14e60488910bd38e77f5b5dcfab1eec655ed215be6be441ce8311714b631388cf33fe10270f3766bd558580ba62638e50c50847661aa0228cf649ce
- SSDEEP 3072:CEGh0oxl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGzldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe
- Size 408KB
- SHA256 b9e3e2adaff05dfe31c6ebaa69f2513adf1861ba998d4d15f8f9c7c0ed2caaa9
- MD5 d1af86740d324bff4753b1d9f87a478f
- SHA1 51ba266b7a485b8b20a96ff2624bc93adc5657b5
- SHA512 51fc2f8b7f676d7cde2a411fa839f988c1c1a16680eb82bc7e2b671959ca1baf1af53763544dec97c8aaf4ec365eb476ad277026582e2c515f162872f9a4c0d3
- SSDEEP 3072:CEGh0oul3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGMldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
- Size 408KB
- SHA256 1518b6f6b7e5553c6351f540c26b54c32626d7e2587a6770612dbfd1519de0d8
- MD5 8d71de44f50816cd2de176a04cdf64dd
- SHA1 b78b2bc0f8aea56bef0aeaaa374cb9b7167d77b2
- SHA512 590cfe7feaa4ba0585d470889665f5db1232a3c517f0f9a1de05003bdba611f2c072c0e14547bb78c62971775a23d0e0a5c8cad4a95c7c5837126fe21a47c988
- SSDEEP 3072:CEGh0oil3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGYldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
- Size 408KB
- SHA256 378399d49a017eec1cc15098b1b0b3448ddaa77d130876dc9e198662dac4bd45
- MD5 278b3c888fd5db8fa25b751ebae5c329
- SHA1 1d512094cfc2a7cf1666d0f4bb378ced6b6b6fa0
- SHA512 0e4906bd8232df97b3e06025634319da8763900794d9aba16a2ab700fb10f949009e25cc737474498cce1e71e684754a32590a5100a9b313953c163af9f53428
- SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGcldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
- Size 408KB
- SHA256 952d3434f07a50e76ef5bd74f96a152c8c38e4162b44d3f3dcfbcca35514e554
- MD5 5fbde14c29d6cfb3e8b7b27401c33b83
- SHA1 d31dbeac0a02e26215fc09d59f9044f037c7f32d
- SHA512 e22f86bbbe66df935b0aa7a3d3d4774e307be1dd8c453762b7b6dd38c7a6c9b218ed2166e01816abeefc70060c40c2c2e7c657ace41e0f93dfe2cc13b7e0223b
- SSDEEP 3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGMldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
- Size 408KB
- SHA256 37f85c788efadbf919553e4761e8e5df6e3997cb95880b7dc83b853c976364b2
- MD5 ac01aefd4e0fd2e429ebd93080d45c11
- SHA1 fe04386eaf85787a68d7a9ba20fc96e34b05ec0f
- SHA512 feb6a19bdbb9b5797d2ad6c1125ea6cee4052ff883d9b2ba06c0410e4bbefa89f01d80f2bd442e591d64b899b4fc84d383703f01bd72d04ce82809ba80af438f
- SSDEEP 3072:CEGh0oil3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGQldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
- Size 408KB
- SHA256 126d89d4dc83ec0986edcdfb6e794429dce4b0419735b230865f18e30898c411
- MD5 dfa8016b941b51e11d0c0a85f052b206
- SHA1 4a702622e2635df2ca421b03184ee32189124cc2
- SHA512 688e90ebecb051a8541ae1e88eb622977d45acd22d45c93edbcaad46a0870818d048bcc0a968bd84f7c82251a843bf05d13cafdcc8a1e3d53adbd1e3ebc1f1f2
- SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe
- Size 408KB
- SHA256 3d618e2ba68398656a54b0ac4ec9e674de4b7bc5e2bf4ab180a4db264448d6ac
- MD5 b8389bd340215fac7ba859cfff598c1f
- SHA1 cb025cbe213b74be721e9d85bb508202d2bdbf66
- SHA512 19bd6d9fcd3396ed06be82df71013ea8bf464497e51e2f64c43abcabbbbe267048a1bc686e702856b3e70f7ffd3944f9eb0ce2351eb38ae81abee9d4536a8f14
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
- Size 408KB
- SHA256 2d59598eabc6691d7d0c80f8e9fe4235f26ca8d8ddd0b4bf7ede2eaa3c94a2f5
- MD5 6ebc778d219aa19fd7a83d9ddd299784
- SHA1 06fc9f826eb128f4d40641a0bcd0c6f5fc78e261
- SHA512 d6be5734d6faebda0edf712ababb23df6705ec7dad15d5065731f3ee887fd89710c0d79853e558dc911655d2134c0cff79c143fc353770186f6b5a3ec9f44996
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGEldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP