Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 23:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe
- Size 408KB
- Sample240404-3gf1maec24
- SHA256 0584d487ec03b812d5ad2db8435ed70b92fdf64e009ad91bdb6dfc6712fd1dba
- MD5 3d7cbf5790c8cedb0005de3fde2909d1
- SHA1 afff39cb3b619e208cecbe9709cb616e07374d1f
- SHA512 573512649d7612784eba6f4753d516842d70d9ec9da5886ab2cdf5892260e2a244759daadc227e760edea2347cc9b9163b158543a7a72a7e26f46f68f0c32240
- SSDEEP 3072:CEGh0oZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00070000000231f6-1.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00120000000231ed-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231fd-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00130000000231ed-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d41-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d42-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021d41-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-37.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072f-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}\stubpath = "C:\\Windows\\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe" {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD}\stubpath = "C:\\Windows\\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD}.exe" {E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74BA4098-E094-4b28-987B-954725A179A0} 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74BA4098-E094-4b28-987B-954725A179A0}\stubpath = "C:\\Windows\\{74BA4098-E094-4b28-987B-954725A179A0}.exe" 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC942F19-6964-48ad-B334-50B8494AE93B}\stubpath = "C:\\Windows\\{AC942F19-6964-48ad-B334-50B8494AE93B}.exe" {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}\stubpath = "C:\\Windows\\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe" {AC942F19-6964-48ad-B334-50B8494AE93B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F15885B-551C-401f-94AF-097AE531E03E} {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F15885B-551C-401f-94AF-097AE531E03E}\stubpath = "C:\\Windows\\{6F15885B-551C-401f-94AF-097AE531E03E}.exe" {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5728CD6-11FB-4231-8081-4E467B0B9464}\stubpath = "C:\\Windows\\{E5728CD6-11FB-4231-8081-4E467B0B9464}.exe" {6F15885B-551C-401f-94AF-097AE531E03E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F6690AB-EDCF-4034-AD92-067B8456618D}\stubpath = "C:\\Windows\\{6F6690AB-EDCF-4034-AD92-067B8456618D}.exe" {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413} {74BA4098-E094-4b28-987B-954725A179A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}\stubpath = "C:\\Windows\\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe" {74BA4098-E094-4b28-987B-954725A179A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC942F19-6964-48ad-B334-50B8494AE93B} {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5} {AC942F19-6964-48ad-B334-50B8494AE93B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212} {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{527B6D6B-1897-4803-BBD8-3409000B9B6E} {1712830E-86B4-4904-9E45-2CC83169D07C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{527B6D6B-1897-4803-BBD8-3409000B9B6E}\stubpath = "C:\\Windows\\{527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe" {1712830E-86B4-4904-9E45-2CC83169D07C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD} {E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7} {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}\stubpath = "C:\\Windows\\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe" {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5728CD6-11FB-4231-8081-4E467B0B9464} {6F15885B-551C-401f-94AF-097AE531E03E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F6690AB-EDCF-4034-AD92-067B8456618D} {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1712830E-86B4-4904-9E45-2CC83169D07C} {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1712830E-86B4-4904-9E45-2CC83169D07C}\stubpath = "C:\\Windows\\{1712830E-86B4-4904-9E45-2CC83169D07C}.exe" {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe - Executes dropped EXE 12 IoCs
pid Process 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 936 {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe 1632 {E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe 4500 {0993AF6C-3636-4e3e-BE1D-BB7933598ADD}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{74BA4098-E094-4b28-987B-954725A179A0}.exe 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe File created C:\Windows\{AC942F19-6964-48ad-B334-50B8494AE93B}.exe {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe File created C:\Windows\{E5728CD6-11FB-4231-8081-4E467B0B9464}.exe {6F15885B-551C-401f-94AF-097AE531E03E}.exe File created C:\Windows\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe File created C:\Windows\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD}.exe {E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe File created C:\Windows\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe {74BA4098-E094-4b28-987B-954725A179A0}.exe File created C:\Windows\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe {AC942F19-6964-48ad-B334-50B8494AE93B}.exe File created C:\Windows\{6F15885B-551C-401f-94AF-097AE531E03E}.exe {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe File created C:\Windows\{6F6690AB-EDCF-4034-AD92-067B8456618D}.exe {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe File created C:\Windows\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe File created C:\Windows\{1712830E-86B4-4904-9E45-2CC83169D07C}.exe {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe File created C:\Windows\{527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe {1712830E-86B4-4904-9E45-2CC83169D07C}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe Token: SeIncBasePriorityPrivilege 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe Token: SeIncBasePriorityPrivilege 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe Token: SeIncBasePriorityPrivilege 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe Token: SeIncBasePriorityPrivilege 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe Token: SeIncBasePriorityPrivilege 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe Token: SeIncBasePriorityPrivilege 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe Token: SeIncBasePriorityPrivilege 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe Token: SeIncBasePriorityPrivilege 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe Token: SeIncBasePriorityPrivilege 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe Token: SeIncBasePriorityPrivilege 936 {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe Token: SeIncBasePriorityPrivilege 1632 {E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1516 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 96 PID 2856 wrote to memory of 1516 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 96 PID 2856 wrote to memory of 1516 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 96 PID 2856 wrote to memory of 1144 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 97 PID 2856 wrote to memory of 1144 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 97 PID 2856 wrote to memory of 1144 2856 2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe 97 PID 1516 wrote to memory of 1724 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 98 PID 1516 wrote to memory of 1724 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 98 PID 1516 wrote to memory of 1724 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 98 PID 1516 wrote to memory of 2976 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 99 PID 1516 wrote to memory of 2976 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 99 PID 1516 wrote to memory of 2976 1516 {74BA4098-E094-4b28-987B-954725A179A0}.exe 99 PID 1724 wrote to memory of 2528 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 101 PID 1724 wrote to memory of 2528 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 101 PID 1724 wrote to memory of 2528 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 101 PID 1724 wrote to memory of 3868 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 102 PID 1724 wrote to memory of 3868 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 102 PID 1724 wrote to memory of 3868 1724 {BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe 102 PID 2528 wrote to memory of 1800 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 103 PID 2528 wrote to memory of 1800 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 103 PID 2528 wrote to memory of 1800 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 103 PID 2528 wrote to memory of 2392 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 104 PID 2528 wrote to memory of 2392 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 104 PID 2528 wrote to memory of 2392 2528 {AC942F19-6964-48ad-B334-50B8494AE93B}.exe 104 PID 1800 wrote to memory of 904 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 105 PID 1800 wrote to memory of 904 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 105 PID 1800 wrote to memory of 904 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 105 PID 1800 wrote to memory of 2588 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 106 PID 1800 wrote to memory of 2588 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 106 PID 1800 wrote to memory of 2588 1800 {7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe 106 PID 904 wrote to memory of 1744 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 107 PID 904 wrote to memory of 1744 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 107 PID 904 wrote to memory of 1744 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 107 PID 904 wrote to memory of 1656 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 108 PID 904 wrote to memory of 1656 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 108 PID 904 wrote to memory of 1656 904 {6F15885B-551C-401f-94AF-097AE531E03E}.exe 108 PID 1744 wrote to memory of 1028 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 109 PID 1744 wrote to memory of 1028 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 109 PID 1744 wrote to memory of 1028 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 109 PID 1744 wrote to memory of 720 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 110 PID 1744 wrote to memory of 720 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 110 PID 1744 wrote to memory of 720 1744 {E5728CD6-11FB-4231-8081-4E467B0B9464}.exe 110 PID 1028 wrote to memory of 652 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 111 PID 1028 wrote to memory of 652 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 111 PID 1028 wrote to memory of 652 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 111 PID 1028 wrote to memory of 2924 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 112 PID 1028 wrote to memory of 2924 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 112 PID 1028 wrote to memory of 2924 1028 {6F6690AB-EDCF-4034-AD92-067B8456618D}.exe 112 PID 652 wrote to memory of 2024 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 113 PID 652 wrote to memory of 2024 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 113 PID 652 wrote to memory of 2024 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 113 PID 652 wrote to memory of 1108 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 114 PID 652 wrote to memory of 1108 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 114 PID 652 wrote to memory of 1108 652 {D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe 114 PID 2024 wrote to memory of 936 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 115 PID 2024 wrote to memory of 936 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 115 PID 2024 wrote to memory of 936 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 115 PID 2024 wrote to memory of 4980 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 116 PID 2024 wrote to memory of 4980 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 116 PID 2024 wrote to memory of 4980 2024 {1712830E-86B4-4904-9E45-2CC83169D07C}.exe 116 PID 936 wrote to memory of 1632 936 {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe 117 PID 936 wrote to memory of 1632 936 {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe 117 PID 936 wrote to memory of 1632 936 {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe 117 PID 936 wrote to memory of 1120 936 {527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_3d7cbf5790c8cedb0005de3fde2909d1_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\{74BA4098-E094-4b28-987B-954725A179A0}.exeC:\Windows\{74BA4098-E094-4b28-987B-954725A179A0}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exeC:\Windows\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\{AC942F19-6964-48ad-B334-50B8494AE93B}.exeC:\Windows\{AC942F19-6964-48ad-B334-50B8494AE93B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exeC:\Windows\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\{6F15885B-551C-401f-94AF-097AE531E03E}.exeC:\Windows\{6F15885B-551C-401f-94AF-097AE531E03E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\{E5728CD6-11FB-4231-8081-4E467B0B9464}.exeC:\Windows\{E5728CD6-11FB-4231-8081-4E467B0B9464}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\{6F6690AB-EDCF-4034-AD92-067B8456618D}.exeC:\Windows\{6F6690AB-EDCF-4034-AD92-067B8456618D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exeC:\Windows\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\{1712830E-86B4-4904-9E45-2CC83169D07C}.exeC:\Windows\{1712830E-86B4-4904-9E45-2CC83169D07C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\{527B6D6B-1897-4803-BBD8-3409000B9B6E}.exeC:\Windows\{527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exeC:\Windows\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Windows\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD}.exeC:\Windows\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD}.exe13⤵
- Executes dropped EXE
PID:4500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3FB5~1.EXE > nul13⤵PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{527B6~1.EXE > nul12⤵PID:1120
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17128~1.EXE > nul11⤵PID:4980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9974~1.EXE > nul10⤵PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F669~1.EXE > nul9⤵PID:2924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5728~1.EXE > nul8⤵PID:720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F158~1.EXE > nul7⤵PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D0D5~1.EXE > nul6⤵PID:2588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC942~1.EXE > nul5⤵PID:2392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBEE1~1.EXE > nul4⤵PID:3868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74BA4~1.EXE > nul3⤵PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0993AF6C-3636-4e3e-BE1D-BB7933598ADD}.exe
- Size 408KB
- SHA256 76218a7f9a1e6f3c07930fddb7bfac55affa40e669afd9fa1d56c924cd8cefb5
- MD5 eb1efff8d9df5322a9537f77bea83316
- SHA1 4bf3e5bbe457803068ab8f3f0b02a5137a45cd25
- SHA512 2973cfa240d2091b01dcf2dcd5bebf7a3b448ee1ed3aaf06fb6507fd71daf504f8c19d9742085e187b09a6c85ffb8581433586305ef412ea064a886e2ed4e3f5
- SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGxldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1712830E-86B4-4904-9E45-2CC83169D07C}.exe
- Size 408KB
- SHA256 f78088047f02b0dd202aa54fe728c569f6974c11540eb67c2caca20138363463
- MD5 3d77677ad70ed25dd44fd503223fdff0
- SHA1 b19a260cd74db40789b7d5d3e311523033de030d
- SHA512 3b8098c98c455b87c4b4a6573a6905f95e2bd1e4cc051a98247f383fc0e03a2465d2d79adc88c3ec8b9b9898c2f7909d7ce3ab1f37f7a9b135356c2b17fa72cb
- SSDEEP 3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{527B6D6B-1897-4803-BBD8-3409000B9B6E}.exe
- Size 408KB
- SHA256 5b5204b6478d8e5acbcaef3c8dfd826ee4a552a7c534bd6b12880208805f3aaf
- MD5 178eea13d076535f36109833805532f4
- SHA1 6e4a68c38936b996569de239af0185149b1d8e4d
- SHA512 071e6449e54c4a1db06013e6a3f5f9ed71428fa579b5a5377b08fb09833ca09375b9c08f3e9a6e876f75e06177461d9fad3f65548415e3c7f1f83671f38e692d
- SSDEEP 3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGGldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6F15885B-551C-401f-94AF-097AE531E03E}.exe
- Size 408KB
- SHA256 7cc750ed1f55a63f9b7b9a57f916d898baf3ad16f239df298cebd97d12eb7999
- MD5 214c2befbf50a364e6e2d2978b7d9542
- SHA1 c9e140aa4c59d4be8e805efdc0bdd5fdf2f90552
- SHA512 14060d0bdd7c3ecdf5a34cdc8585b7e0a54a8db5598a5d5a38c0119ba71021932cd990716d0eb3596f7b6d91f1511ae7a176e27649460a4b058da48508e06123
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6F6690AB-EDCF-4034-AD92-067B8456618D}.exe
- Size 408KB
- SHA256 db88f6951b69dc976de51f81805722e1cebbd0ef15ed5a939d8b1d8c5c1644aa
- MD5 4ec9380633044343f12001f5d1fe7278
- SHA1 70c5f1356c89cab2c8ffcd7d82b447d648684344
- SHA512 c282ea74201fc054ed8e043a104f4c32594105f193d9f8fb8073763d1abd88b762469db72016615ceb40c316848778a46f6977bfe72d826b9369803374e9af99
- SSDEEP 3072:CEGh0oQl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{74BA4098-E094-4b28-987B-954725A179A0}.exe
- Size 408KB
- SHA256 fc257ab81ccdc161a3921b16ad48a7319d0fd27126c20a0bd98de5ffc29c0197
- MD5 75cc528a89da3d68e118329dbb13519f
- SHA1 08dd841972f15a3228d83875a6ad23568c86e783
- SHA512 4c731f9b2d8fa3325d4ba997bb80920742cba6623175cbf89823e5e02735b77f72f6bda67b8dc98c457d80e833417877003a9fe3dd05ff79815ea2fa0028f116
- SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGildOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7D0D5F61-72BD-48f2-9456-8D8B00ACA0D5}.exe
- Size 408KB
- SHA256 87651a2565c9c2211d27d9bbb9bd8637862430cc53ea4b195d2b9944c56decfa
- MD5 bcccf31df7984d6851b47b368af1ed7d
- SHA1 056c78335bba7065eeff6cfdbdc908afd6a2aadb
- SHA512 2943e7b53ba5f96e3b53d1c7f58afba111074d1a8411d79dac40ff00f6869e8bd8a40e74bb2d848f1d078f39f7c544030cb49aba402261e777ad366fd32a0545
- SSDEEP 3072:CEGh0ool3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGyldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AC942F19-6964-48ad-B334-50B8494AE93B}.exe
- Size 408KB
- SHA256 7c27f2b485f2767facf471533d48533fa874aef5394fb9ec86241561a4974575
- MD5 493553d596fdddf5f925a66bcc98a204
- SHA1 15480ddf63f0349ea924cce1c0f1d30e74012a91
- SHA512 38d6a5929c7bbc2038688f3babd559713fe38efe8e8a0adecbeab0ab61fcc4b69bc02dbfdb57c02cc3869b93b702b20b6f5d69057f1f41073a2fe03b1e4b9019
- SSDEEP 3072:CEGh0oDl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BBEE1816-2C2D-4ed4-9D28-EF5DE282F413}.exe
- Size 408KB
- SHA256 647c74c58d9ce0bb516f47d6377d8782520f9709168708507c0af2e742739878
- MD5 00e10bb52a44b77a3096a0205be0c80d
- SHA1 ee7acad8d4d6a3c255c2ebe363b3ab979c5f2830
- SHA512 0f8a9c89d4eb78d0dd14f8e427802bf6d2efc63c49326fb0e6d569da1a1acf20c5e877d7d2b4f21261e0fdaf195f89a0313220688c1312f8fc7a7c4d2c242ccb
- SSDEEP 3072:CEGh0oal3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGIldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D99741E7-9F52-4b6d-B6B9-2FDDE8D5D212}.exe
- Size 408KB
- SHA256 ec7cc94a27ee04a7c56bb79a00275904e47443daf69953d9bebbfb1f09b4e5e3
- MD5 fb1f16e7f575a9b6b781c080f360d43a
- SHA1 56ffb10cc4b0c576eaef4a67abbbbf70bf525ced
- SHA512 3cdb33bf75771a058d0ee0121df3c90b2ba1a6522caa36330838224d9441fd5314aa0a686f0124386c6b4b86305f3a975981d5c548a1bd6f856af567b90ac071
- SSDEEP 3072:CEGh0oSl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGcldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E3FB5D93-CDC2-49bc-A8E8-63D418B8A5D7}.exe
- Size 408KB
- SHA256 fd3b2cd0e09bd1da735088937990b34989053d12966a578a626ab8fb176ae5d5
- MD5 8e9cae8df4354114dae19d1201aa54f6
- SHA1 ee117a7112c581c7a55fb4d7878ea2b952385c71
- SHA512 65fe2471de6c6957632da66ef86e948038a481c373f51632d1b2aa0cebd428e1fdebc3d55692d8315669cdf183512f95d79df64a1b95d1862121886968d748a1
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGgldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E5728CD6-11FB-4231-8081-4E467B0B9464}.exe
- Size 408KB
- SHA256 553eb8922ec8b87941d6caf93715b7a39f71fd39239c43287cc9e2f72c8f8b0f
- MD5 e9c99668356229e31e603e668d59e8d7
- SHA1 3a0d9e24058c73d97a9ee40071b5ddb388e532c6
- SHA512 ba1847e0173ea1d41c2d0ee08a83b56107615acfb8444a0c56056e6cb22b3efcb15fae3ec912d92b1f3f0aabed783d840d5286b9a41bd857f449820c76e84d0b
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP