Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/03/2024, 14:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe
- Size 372KB
- Sample240313-ry2g4sfc8y
- SHA256 1d298cf614f64dbfe46a1a06d93f6bf04ba89f1128f2aab6236c42804e472c20
- MD5 2eb1ba466f9d4d1bf50b770b9f239cec
- SHA1 c48e39e7025ee5a3624fd7fafdfac123c4c7f498
- SHA512 bc59597f0ec010cfa788f0cdb86ec346eb5527b8d84b05dd8738202c3ad5097ba655a5ab6e5c482f9ebb23c7d1583e745f461e1bdc78a34ed6b82903d9748580
- SSDEEP 3072:CEGh0oTmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG4l/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000023205-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023304-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002330f-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023304-13.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023378-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023304-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002339d-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002349f-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00160000000006dd-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023107-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000002314f-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023107-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6B2178A-2476-406e-B81C-B55D51C7EB96} {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6374896C-C364-45e7-ABE0-1E3F874103AA}\stubpath = "C:\\Windows\\{6374896C-C364-45e7-ABE0-1E3F874103AA}.exe" {B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69F9586C-C14E-4607-99DC-0F39FF0D4716}\stubpath = "C:\\Windows\\{69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe" 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{353AEA37-5887-4308-BA92-AEECC16C4954}\stubpath = "C:\\Windows\\{353AEA37-5887-4308-BA92-AEECC16C4954}.exe" {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195}\stubpath = "C:\\Windows\\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe" {353AEA37-5887-4308-BA92-AEECC16C4954}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F7BCF3E-710E-491c-A6FD-C100D9589443} {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD440D5F-8F52-45fb-A467-D99FAAC926EF} {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6754353-52B2-4f28-A84B-9C54B880AE0B} {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6754353-52B2-4f28-A84B-9C54B880AE0B}\stubpath = "C:\\Windows\\{E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe" {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}\stubpath = "C:\\Windows\\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe" {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBA480B-54EA-40d1-A553-7EC38639D559} {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A} {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{961A84D1-FF46-42b5-9041-4529C027B7BF}\stubpath = "C:\\Windows\\{961A84D1-FF46-42b5-9041-4529C027B7BF}.exe" {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6B2178A-2476-406e-B81C-B55D51C7EB96}\stubpath = "C:\\Windows\\{B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe" {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{353AEA37-5887-4308-BA92-AEECC16C4954} {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6374896C-C364-45e7-ABE0-1E3F874103AA} {B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBA480B-54EA-40d1-A553-7EC38639D559}\stubpath = "C:\\Windows\\{0BBA480B-54EA-40d1-A553-7EC38639D559}.exe" {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{961A84D1-FF46-42b5-9041-4529C027B7BF} {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F7BCF3E-710E-491c-A6FD-C100D9589443}\stubpath = "C:\\Windows\\{2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe" {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD440D5F-8F52-45fb-A467-D99FAAC926EF}\stubpath = "C:\\Windows\\{BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe" {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9} {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69F9586C-C14E-4607-99DC-0F39FF0D4716} 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}\stubpath = "C:\\Windows\\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe" {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195} {353AEA37-5887-4308-BA92-AEECC16C4954}.exe - Executes dropped EXE 12 IoCs
pid Process 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 2608 {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe 3756 {B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe 772 {6374896C-C364-45e7-ABE0-1E3F874103AA}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{353AEA37-5887-4308-BA92-AEECC16C4954}.exe {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe File created C:\Windows\{B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe File created C:\Windows\{6374896C-C364-45e7-ABE0-1E3F874103AA}.exe {B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe File created C:\Windows\{961A84D1-FF46-42b5-9041-4529C027B7BF}.exe {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe File created C:\Windows\{2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe File created C:\Windows\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe File created C:\Windows\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe {353AEA37-5887-4308-BA92-AEECC16C4954}.exe File created C:\Windows\{BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe File created C:\Windows\{E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe File created C:\Windows\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe File created C:\Windows\{69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe File created C:\Windows\{0BBA480B-54EA-40d1-A553-7EC38639D559}.exe {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe Token: SeIncBasePriorityPrivilege 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe Token: SeIncBasePriorityPrivilege 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe Token: SeIncBasePriorityPrivilege 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe Token: SeIncBasePriorityPrivilege 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe Token: SeIncBasePriorityPrivilege 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe Token: SeIncBasePriorityPrivilege 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe Token: SeIncBasePriorityPrivilege 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe Token: SeIncBasePriorityPrivilege 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe Token: SeIncBasePriorityPrivilege 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe Token: SeIncBasePriorityPrivilege 2608 {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe Token: SeIncBasePriorityPrivilege 3756 {B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1068 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe 99 PID 3292 wrote to memory of 1068 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe 99 PID 3292 wrote to memory of 1068 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe 99 PID 3292 wrote to memory of 4756 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe 100 PID 3292 wrote to memory of 4756 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe 100 PID 3292 wrote to memory of 4756 3292 2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe 100 PID 1068 wrote to memory of 5072 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 104 PID 1068 wrote to memory of 5072 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 104 PID 1068 wrote to memory of 5072 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 104 PID 1068 wrote to memory of 3264 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 105 PID 1068 wrote to memory of 3264 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 105 PID 1068 wrote to memory of 3264 1068 {69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe 105 PID 5072 wrote to memory of 4680 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 108 PID 5072 wrote to memory of 4680 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 108 PID 5072 wrote to memory of 4680 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 108 PID 5072 wrote to memory of 868 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 109 PID 5072 wrote to memory of 868 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 109 PID 5072 wrote to memory of 868 5072 {0BBA480B-54EA-40d1-A553-7EC38639D559}.exe 109 PID 4680 wrote to memory of 3436 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 110 PID 4680 wrote to memory of 3436 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 110 PID 4680 wrote to memory of 3436 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 110 PID 4680 wrote to memory of 2924 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 111 PID 4680 wrote to memory of 2924 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 111 PID 4680 wrote to memory of 2924 4680 {A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe 111 PID 3436 wrote to memory of 3608 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 112 PID 3436 wrote to memory of 3608 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 112 PID 3436 wrote to memory of 3608 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 112 PID 3436 wrote to memory of 324 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 113 PID 3436 wrote to memory of 324 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 113 PID 3436 wrote to memory of 324 3436 {961A84D1-FF46-42b5-9041-4529C027B7BF}.exe 113 PID 3608 wrote to memory of 556 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 115 PID 3608 wrote to memory of 556 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 115 PID 3608 wrote to memory of 556 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 115 PID 3608 wrote to memory of 2656 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 116 PID 3608 wrote to memory of 2656 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 116 PID 3608 wrote to memory of 2656 3608 {2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe 116 PID 556 wrote to memory of 3436 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 117 PID 556 wrote to memory of 3436 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 117 PID 556 wrote to memory of 3436 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 117 PID 556 wrote to memory of 4756 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 118 PID 556 wrote to memory of 4756 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 118 PID 556 wrote to memory of 4756 556 {353AEA37-5887-4308-BA92-AEECC16C4954}.exe 118 PID 3436 wrote to memory of 388 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 121 PID 3436 wrote to memory of 388 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 121 PID 3436 wrote to memory of 388 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 121 PID 3436 wrote to memory of 4460 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 122 PID 3436 wrote to memory of 4460 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 122 PID 3436 wrote to memory of 4460 3436 {B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe 122 PID 388 wrote to memory of 4156 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 129 PID 388 wrote to memory of 4156 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 129 PID 388 wrote to memory of 4156 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 129 PID 388 wrote to memory of 5084 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 130 PID 388 wrote to memory of 5084 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 130 PID 388 wrote to memory of 5084 388 {BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe 130 PID 4156 wrote to memory of 2608 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 131 PID 4156 wrote to memory of 2608 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 131 PID 4156 wrote to memory of 2608 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 131 PID 4156 wrote to memory of 3436 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 132 PID 4156 wrote to memory of 3436 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 132 PID 4156 wrote to memory of 3436 4156 {E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe 132 PID 2608 wrote to memory of 3756 2608 {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe 136 PID 2608 wrote to memory of 3756 2608 {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe 136 PID 2608 wrote to memory of 3756 2608 {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe 136 PID 2608 wrote to memory of 392 2608 {2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_2eb1ba466f9d4d1bf50b770b9f239cec_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\{69F9586C-C14E-4607-99DC-0F39FF0D4716}.exeC:\Windows\{69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\{0BBA480B-54EA-40d1-A553-7EC38639D559}.exeC:\Windows\{0BBA480B-54EA-40d1-A553-7EC38639D559}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exeC:\Windows\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\{961A84D1-FF46-42b5-9041-4529C027B7BF}.exeC:\Windows\{961A84D1-FF46-42b5-9041-4529C027B7BF}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\{2F7BCF3E-710E-491c-A6FD-C100D9589443}.exeC:\Windows\{2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\{353AEA37-5887-4308-BA92-AEECC16C4954}.exeC:\Windows\{353AEA37-5887-4308-BA92-AEECC16C4954}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exeC:\Windows\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\{BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exeC:\Windows\{BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\{E6754353-52B2-4f28-A84B-9C54B880AE0B}.exeC:\Windows\{E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exeC:\Windows\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\{B6B2178A-2476-406e-B81C-B55D51C7EB96}.exeC:\Windows\{B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3756 -
C:\Windows\{6374896C-C364-45e7-ABE0-1E3F874103AA}.exeC:\Windows\{6374896C-C364-45e7-ABE0-1E3F874103AA}.exe13⤵
- Executes dropped EXE
PID:772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6B21~1.EXE > nul13⤵PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FB7E~1.EXE > nul12⤵PID:392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6754~1.EXE > nul11⤵PID:3436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD440~1.EXE > nul10⤵PID:5084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B35CF~1.EXE > nul9⤵PID:4460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{353AE~1.EXE > nul8⤵PID:4756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F7BC~1.EXE > nul7⤵PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{961A8~1.EXE > nul6⤵PID:324
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A112E~1.EXE > nul5⤵PID:2924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BBA4~1.EXE > nul4⤵PID:868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69F95~1.EXE > nul3⤵PID:3264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0BBA480B-54EA-40d1-A553-7EC38639D559}.exe
- Size 372KB
- SHA256 a96ea7c7d3cd01b9260a02f493a0df941d0731205bc4f8e809da81737382e455
- MD5 efaa5bc6c63fbaf63a40ef19bd673848
- SHA1 be4d0b6b885ccce27b3f7e2f01a911afbbac6f29
- SHA512 96a6097a683ff5f1e22fb3acdbb7ed498836c67926d37ba549749f2a850c52069c75c1d885869ce014f55f9496b3a63b6252f0e86954740ca5017fce897706b8
- SSDEEP 3072:CEGh0opmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGal/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2F7BCF3E-710E-491c-A6FD-C100D9589443}.exe
- Size 372KB
- SHA256 7941fb78dbbcd1daa296fd7ec78bc38089bb69b4e1aa420caa777b5c4b528a6e
- MD5 bb9711f97e2cd59420b9d2a2e6191b5a
- SHA1 f356ca1c5ef0939be5d4bdd140e70ddfa22e74fa
- SHA512 2dab410dcfe0cef580bb809bfa56776319ea6c481aa106035ca5166062bef7221f8b1786d45e7c390040b62334bad71d48af6cca0867aef2b434f8e0886ba863
- SSDEEP 3072:CEGh0oQmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG3l/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2FB7E38B-73C0-4a26-8F7F-74240B35D3D9}.exe
- Size 372KB
- SHA256 da47dd9b7f660b05a303a0a872c9fe9bff620236294b6ff8026d70bcb5d1f97a
- MD5 a917eea7c439bc8bfc7c66d096caaad6
- SHA1 7f84e62252e197324b9003f5c72407ec1a0551b8
- SHA512 6408e1374d9e40db7bb86663e0e8443a88354c78905429e670b1dcb542d4e65d406dfdc4c2d0724f6ab162a3ba9156a1897756269d6363672dc02e37ffb95ddb
- SSDEEP 3072:CEGh0oWmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGll/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{353AEA37-5887-4308-BA92-AEECC16C4954}.exe
- Size 372KB
- SHA256 64fa65e4b9635d2608483308f703e0c321b4e142b2fd330a9fef1b661d77c56d
- MD5 bd4240d66e58a14e8f3c66a12c07096f
- SHA1 187af1b6fb3538f2ce66daee19de2d2137da1b25
- SHA512 eeea63f71eb7897e0466b3e394c927091a415de076da2d0bcadf69c48caeaff92ac953b07b6652c219e14120deb59fdd15d241f42e3236c25e1304bff444a33d
- SSDEEP 3072:CEGh0oVmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGCl/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6374896C-C364-45e7-ABE0-1E3F874103AA}.exe
- Size 372KB
- SHA256 7673c2e7eaeda7ab65977074f9fa79c556e1adf8ad5b99be564b902e794cd329
- MD5 225b25fd6a8188a472f2e0e00913313d
- SHA1 80cc4fbc33dc09ef321900c9da08e40630255035
- SHA512 1d8096bcf080773eaed41f0124b738670e380c73dad1088916f10e4b00d4db589aa79960ee223ff3fce3ff9143ccb02835ce431fce7099adc241e0cdabd56f7d
- SSDEEP 3072:CEGh0oomlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG7l/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{69F9586C-C14E-4607-99DC-0F39FF0D4716}.exe
- Size 372KB
- SHA256 41687c764a21714a1d4ffbc5dc9a9a1ec4177968d82d35d0b0f4ee19fef3fde9
- MD5 df951293ef80d2d68f1c9031998b41f2
- SHA1 799cec8c6e46c343c22941c0055b0dfb0fb9a029
- SHA512 9b11ba7ac538b6044fd8fe26df0a96bfab1cbeffded1875124a38d3930df12fed9976ce8b03e2efc202253fb6dbb79abf30425691ead74ec95140b9ce6a33f5c
- SSDEEP 3072:CEGh0o6mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGdl/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{961A84D1-FF46-42b5-9041-4529C027B7BF}.exe
- Size 372KB
- SHA256 1984767e08fe004d4bcc7f17fcdc4ddb048d285e9d47543ccda218a57f9f9d8a
- MD5 2c866db0fb2890d54c500eac0996585d
- SHA1 a87ac99d9c965f20803fd0ca12722167db77c8c1
- SHA512 4ab327d81d44caf8917fb9d0db1fab11494f124b340dc0842caa18be7c76898fb1c09f95abaa3e6c45afb849cd1ce53c457d256a465b01765a5e5a6ed773638c
- SSDEEP 3072:CEGh0olmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGql/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A112E345-B29B-4b06-A9FC-6CDC3FD1D03A}.exe
- Size 372KB
- SHA256 67a9abc6c7f4cd04714bde68c7de7e06231ae514c8155a5e0cb9e80e2d5a8778
- MD5 d2872033fd182bf893bfa30ca4e7d031
- SHA1 3c243c2054e1675ee63a50898fd7a74aadfca8e5
- SHA512 d6b7fbaa54bdc43c99ae8d5135c967abb4adceaeda3a5944fedbd5402b56b8eaebd60c9ef35cbac65c8de22d9703816fec324b25c73da7fa26b8bc9593367339
- SSDEEP 3072:CEGh0oZmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGCl/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B35CF06A-8861-4268-9E2C-A9A8B4FA1195}.exe
- Size 372KB
- SHA256 237d4f13947e8cb80b4521cc7412354276d18c4684323d1e9b5c77c7ad4f1bf7
- MD5 b2da4a76199d0c972d67bc0880a40441
- SHA1 e1ebe078ea0d532decccf4d5daf83adadd991f94
- SHA512 1823df4340ee8f25ba4841ae321a06a4b3f193c71e5683e7d91894d2b489efa2711a6644f90a49042eb44f9a8e4b7b6150e82b5cf20bd34644ed2bb3743d050f
- SSDEEP 3072:CEGh0o1mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG6l/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B6B2178A-2476-406e-B81C-B55D51C7EB96}.exe
- Size 372KB
- SHA256 e5d13190826d8e23f70ec69a4dbff068f6ac54720a4caff0bf80c53efecc453e
- MD5 a5ed8fa2c32ac2dfe5e4bc4e3d31e173
- SHA1 40d93f3bf98d2ab51a570fda800b2e4ce422cc89
- SHA512 bff03867f3a747b5316fa39bb7559fef2adbed77e6e804796408440369690d10d3eca76be46f7d0bd8e2355af7c8c8685c77823358b0004672d77b4f957a61d9
- SSDEEP 3072:CEGh0o2mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGxl/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BD440D5F-8F52-45fb-A467-D99FAAC926EF}.exe
- Size 372KB
- SHA256 908410497ee885aa63b42b091bdb7b0f61a71ed4cc7544ba267b7257a642a058
- MD5 22ea2aa42b04663614d9fcbfef59d4e7
- SHA1 25b519477af2d0ee4968e2bfab34a7be2a1b61d9
- SHA512 765a9abb02d109f94004be75337bf09dd096253e1148e304b0540f5f95b63f1a061d45c3bcea1bfe8f58bfa26dbae58cb19006fd73055a3ff545c2233078ae37
- SSDEEP 3072:CEGh0o7mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGUl/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E6754353-52B2-4f28-A84B-9C54B880AE0B}.exe
- Size 372KB
- SHA256 30cfacc86b8e2051ea31bf4d2223cba5d48f06c911f1678e486a1086d1d343fd
- MD5 ddf7b296f0ed3568859c1c477ba98492
- SHA1 37fb093e3d9ad91cb74485062d6f91977feffd11
- SHA512 46c439e6c6ca99b61dfe1e2c12ed7059bb899f9e3c4c9b7ab56a8bd45cfdf7e5f93c3b3f6867d6f5390c093b2cea41ed75ff4f41dbf68ff6d33951418029521a
- SSDEEP 3072:CEGh0oumlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGNl/Oe2MUVg3vTeKcAEciTBqr3
- MD5 SHA1 SHA512 SSDEEP