Analysis
- max time kernel
162s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe
- Size 408KB
- Sample240404-p3llcagg95
- SHA256 ebc8e44bb3436880476194a2717c3474295ada0140b9bbdd7b31da5b15e2b30b
- MD5 cf185452cce4c01ab48d5aef6562e4fa
- SHA1 103b9f8dabe6fc8df7a8ad06f8c48deb10b63537
- SHA512 b2e7a295114e8551e7f5b7a062589880e3be06e0d023e80bdf7d0c5298ef9af260cae3da6ace0e50d3017d979061e38c84a234dd40a60912ffe3c5eae40c633e
- SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000300000001e806-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023249-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002324a-11.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00160000000006d1-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b00000001e806-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00170000000006d1-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000000037-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00180000000006d1-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000000037-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00190000000006d1-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000000037-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001a0000000006d1-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B} {6CE78EF9-3910-4d96-8661-1048C7573286}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83} 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{748491E3-146B-4c10-AB6C-5F10F79AE4B9} {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7232638F-34C2-4706-A385-AC3691C4F9DF}\stubpath = "C:\\Windows\\{7232638F-34C2-4706-A385-AC3691C4F9DF}.exe" {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022} {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CE78EF9-3910-4d96-8661-1048C7573286}\stubpath = "C:\\Windows\\{6CE78EF9-3910-4d96-8661-1048C7573286}.exe" {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CE78EF9-3910-4d96-8661-1048C7573286} {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D} {A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83}\stubpath = "C:\\Windows\\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe" 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{748491E3-146B-4c10-AB6C-5F10F79AE4B9}\stubpath = "C:\\Windows\\{748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe" {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612} {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384} {15463415-D347-4925-A911-FCF7DF3A9E10}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}\stubpath = "C:\\Windows\\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe" {15463415-D347-4925-A911-FCF7DF3A9E10}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}\stubpath = "C:\\Windows\\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}.exe" {A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7232638F-34C2-4706-A385-AC3691C4F9DF} {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15463415-D347-4925-A911-FCF7DF3A9E10} {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15463415-D347-4925-A911-FCF7DF3A9E10}\stubpath = "C:\\Windows\\{15463415-D347-4925-A911-FCF7DF3A9E10}.exe" {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}\stubpath = "C:\\Windows\\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe" {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB9F829D-8ED6-484d-9F97-B4DF28685B24}\stubpath = "C:\\Windows\\{EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe" {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}\stubpath = "C:\\Windows\\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe" {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB9F829D-8ED6-484d-9F97-B4DF28685B24} {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F77D954-5FC1-4f92-ADEF-1120E7E10000} {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F77D954-5FC1-4f92-ADEF-1120E7E10000}\stubpath = "C:\\Windows\\{6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe" {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}\stubpath = "C:\\Windows\\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe" {6CE78EF9-3910-4d96-8661-1048C7573286}.exe - Executes dropped EXE 12 IoCs
pid Process 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 1936 {6CE78EF9-3910-4d96-8661-1048C7573286}.exe 3696 {A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe 1868 {05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe {6CE78EF9-3910-4d96-8661-1048C7573286}.exe File created C:\Windows\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}.exe {A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe File created C:\Windows\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe File created C:\Windows\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe {15463415-D347-4925-A911-FCF7DF3A9E10}.exe File created C:\Windows\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe File created C:\Windows\{EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe File created C:\Windows\{6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe File created C:\Windows\{6CE78EF9-3910-4d96-8661-1048C7573286}.exe {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe File created C:\Windows\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe File created C:\Windows\{748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe File created C:\Windows\{7232638F-34C2-4706-A385-AC3691C4F9DF}.exe {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe File created C:\Windows\{15463415-D347-4925-A911-FCF7DF3A9E10}.exe {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe Token: SeIncBasePriorityPrivilege 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe Token: SeIncBasePriorityPrivilege 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe Token: SeIncBasePriorityPrivilege 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe Token: SeIncBasePriorityPrivilege 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe Token: SeIncBasePriorityPrivilege 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe Token: SeIncBasePriorityPrivilege 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe Token: SeIncBasePriorityPrivilege 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe Token: SeIncBasePriorityPrivilege 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe Token: SeIncBasePriorityPrivilege 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe Token: SeIncBasePriorityPrivilege 1936 {6CE78EF9-3910-4d96-8661-1048C7573286}.exe Token: SeIncBasePriorityPrivilege 3696 {A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 5076 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 88 PID 1148 wrote to memory of 5076 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 88 PID 1148 wrote to memory of 5076 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 88 PID 1148 wrote to memory of 3148 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 89 PID 1148 wrote to memory of 3148 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 89 PID 1148 wrote to memory of 3148 1148 2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe 89 PID 5076 wrote to memory of 5112 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 98 PID 5076 wrote to memory of 5112 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 98 PID 5076 wrote to memory of 5112 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 98 PID 5076 wrote to memory of 1052 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 99 PID 5076 wrote to memory of 1052 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 99 PID 5076 wrote to memory of 1052 5076 {B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe 99 PID 5112 wrote to memory of 3840 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 100 PID 5112 wrote to memory of 3840 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 100 PID 5112 wrote to memory of 3840 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 100 PID 5112 wrote to memory of 5108 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 101 PID 5112 wrote to memory of 5108 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 101 PID 5112 wrote to memory of 5108 5112 {748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe 101 PID 3840 wrote to memory of 2008 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 102 PID 3840 wrote to memory of 2008 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 102 PID 3840 wrote to memory of 2008 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 102 PID 3840 wrote to memory of 232 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 103 PID 3840 wrote to memory of 232 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 103 PID 3840 wrote to memory of 232 3840 {F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe 103 PID 2008 wrote to memory of 3336 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 104 PID 2008 wrote to memory of 3336 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 104 PID 2008 wrote to memory of 3336 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 104 PID 2008 wrote to memory of 2352 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 105 PID 2008 wrote to memory of 2352 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 105 PID 2008 wrote to memory of 2352 2008 {7232638F-34C2-4706-A385-AC3691C4F9DF}.exe 105 PID 3336 wrote to memory of 1056 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 106 PID 3336 wrote to memory of 1056 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 106 PID 3336 wrote to memory of 1056 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 106 PID 3336 wrote to memory of 3108 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 107 PID 3336 wrote to memory of 3108 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 107 PID 3336 wrote to memory of 3108 3336 {15463415-D347-4925-A911-FCF7DF3A9E10}.exe 107 PID 1056 wrote to memory of 748 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 108 PID 1056 wrote to memory of 748 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 108 PID 1056 wrote to memory of 748 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 108 PID 1056 wrote to memory of 216 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 109 PID 1056 wrote to memory of 216 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 109 PID 1056 wrote to memory of 216 1056 {C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe 109 PID 748 wrote to memory of 1208 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 110 PID 748 wrote to memory of 1208 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 110 PID 748 wrote to memory of 1208 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 110 PID 748 wrote to memory of 1340 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 111 PID 748 wrote to memory of 1340 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 111 PID 748 wrote to memory of 1340 748 {A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe 111 PID 1208 wrote to memory of 3392 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 112 PID 1208 wrote to memory of 3392 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 112 PID 1208 wrote to memory of 3392 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 112 PID 1208 wrote to memory of 4372 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 113 PID 1208 wrote to memory of 4372 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 113 PID 1208 wrote to memory of 4372 1208 {EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe 113 PID 3392 wrote to memory of 1936 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 114 PID 3392 wrote to memory of 1936 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 114 PID 3392 wrote to memory of 1936 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 114 PID 3392 wrote to memory of 1836 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 115 PID 3392 wrote to memory of 1836 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 115 PID 3392 wrote to memory of 1836 3392 {6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe 115 PID 1936 wrote to memory of 3696 1936 {6CE78EF9-3910-4d96-8661-1048C7573286}.exe 116 PID 1936 wrote to memory of 3696 1936 {6CE78EF9-3910-4d96-8661-1048C7573286}.exe 116 PID 1936 wrote to memory of 3696 1936 {6CE78EF9-3910-4d96-8661-1048C7573286}.exe 116 PID 1936 wrote to memory of 1164 1936 {6CE78EF9-3910-4d96-8661-1048C7573286}.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_cf185452cce4c01ab48d5aef6562e4fa_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exeC:\Windows\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\{748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exeC:\Windows\{748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exeC:\Windows\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\{7232638F-34C2-4706-A385-AC3691C4F9DF}.exeC:\Windows\{7232638F-34C2-4706-A385-AC3691C4F9DF}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\{15463415-D347-4925-A911-FCF7DF3A9E10}.exeC:\Windows\{15463415-D347-4925-A911-FCF7DF3A9E10}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exeC:\Windows\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exeC:\Windows\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\{EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exeC:\Windows\{EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\{6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exeC:\Windows\{6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\{6CE78EF9-3910-4d96-8661-1048C7573286}.exeC:\Windows\{6CE78EF9-3910-4d96-8661-1048C7573286}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exeC:\Windows\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3696 -
C:\Windows\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}.exeC:\Windows\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}.exe13⤵
- Executes dropped EXE
PID:1868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5BE2~1.EXE > nul13⤵PID:4652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CE78~1.EXE > nul12⤵PID:1164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F77D~1.EXE > nul11⤵PID:1836
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB9F8~1.EXE > nul10⤵PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A294B~1.EXE > nul9⤵PID:1340
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C78F0~1.EXE > nul8⤵PID:216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15463~1.EXE > nul7⤵PID:3108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72326~1.EXE > nul6⤵PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4C30~1.EXE > nul5⤵PID:232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74849~1.EXE > nul4⤵PID:5108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B549F~1.EXE > nul3⤵PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{05D6B76F-CFDC-4291-B536-DA32A0B7AE9D}.exe
- Size 408KB
- SHA256 739e9a30205a79e91924d4553a4b89c0912a70c15ef56025f3de21e9900edfe1
- MD5 09b37b47363234f20c2e9d53711ca97e
- SHA1 d8859df5358aa24bb703dd4e45fc2a5bfc8c868f
- SHA512 46c4087b8c0c9274dc475514dcf43e5a4228c589f51b57886f4d1faff0bba845a06a887f2b395c54641274647e40f4dcb9e5b649448039e7e8a444957304831d
- SSDEEP 3072:CEGh0o5l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGXldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{15463415-D347-4925-A911-FCF7DF3A9E10}.exe
- Size 408KB
- SHA256 f561203f856696e94dbfb4480fd768ae4d7d56fadf4871ff0d54408c241144e1
- MD5 ff7915dd6e92af792ffb51aa10968758
- SHA1 6c03f3c3391ce1ad19dfb0e521ef9c99289289e2
- SHA512 e98ba005ae80d63c551fdb5dd8016c15742649a5fe960698474ed6e058b4589ea6f8a26b6a6970e30da52b6dd0911d04a90aa46cd76e986e875f1736607e4c71
- SSDEEP 3072:CEGh0oQl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGSldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6CE78EF9-3910-4d96-8661-1048C7573286}.exe
- Size 408KB
- SHA256 b289d36edc1a9090fc8a18b290219379647ad8c19673cbf65cce6f8ca1d41ac7
- MD5 9d0fa496b9ee35184fe518fa9983c3dd
- SHA1 60259d8b2e1250d9070fb4990f656c8d99236f6f
- SHA512 f7203587bbefb94e2cb4f3cb8a3dd9e3eccee56fbe031e63efc1018745ae29049148e8c7f888953b2a46158c130ebc81b96e466a3ee80b4b3f77cceef52ece4a
- SSDEEP 3072:CEGh0oil3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGAldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6F77D954-5FC1-4f92-ADEF-1120E7E10000}.exe
- Size 408KB
- SHA256 04913233d474c37fabd5f7beee8d7d3a11c69a95c474de41c9c3bcc521695309
- MD5 4dbd9f4d42cd9c84d59489b772190782
- SHA1 ae6e881b911dc0277d34ef1b82f53c1ed3ab2664
- SHA512 404c686c19b78eb0d4e9280ad039f7ffd0df667bff2a424ad496ed44e7c966b451bf286b5210a101a452b07fdb61e2f36a8ef4d43c9adc400fce4f37e1cc0484
- SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7232638F-34C2-4706-A385-AC3691C4F9DF}.exe
- Size 408KB
- SHA256 1f9bcd36ef7f827a9d7b9cfad864b616764389c4d1475cfb794f86a100b754fd
- MD5 0a5658a5dffd3e330e3f6d6682aa5cee
- SHA1 d999a94a94a62e213c3e6dec0bdd1035d4721c9a
- SHA512 8be4f21af803e1581ec00265d5a65f80d7af888d428e3fbfd7fe45923896f76215d968f3c713e50f99565c9d8060b05fcce2e785fa9adea8972b2a3776e496ab
- SSDEEP 3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGKldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{748491E3-146B-4c10-AB6C-5F10F79AE4B9}.exe
- Size 408KB
- SHA256 ce30d91e4f1ce8524fa6515bbdfd34fb0b2cb769f03af66ab0c06b976278b659
- MD5 b25ba02bafbe0db7af1cdb064bd97bed
- SHA1 757483c23bb6026b28adba6f984413c495ebee16
- SHA512 4a4c4d80deac1a41f4754cf9ff6e7780cc35375ceee262fafb985306d5b1c36f64ec7442175832413da8a1c297f8ada595065e2d3aa8273e96f0374b4f6d0e0a
- SSDEEP 3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGLldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A294BA32-3BFB-49b5-AAF8-73ED6E1D0022}.exe
- Size 408KB
- SHA256 e6fbaebc40352ca7baeca9520580e66095216d9aff00bc6eb34b46ea55d8621b
- MD5 85e64757269504635b586126d550a271
- SHA1 0fdf3c3106f69cdbe8e3b0c176f5bc8424f00bd2
- SHA512 cf6d552af737ee1f24f03642d7041b27ee9ddc988f3682b0599468e349bcaee29e718136d3b55cee21d0994a0e4d8bcd9ef31e69d4fc4c3bcf6d27aed054395f
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGUldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A5BE2BEC-AB19-4d4b-BC5D-CA20EDCECD9B}.exe
- Size 408KB
- SHA256 bcc261f9fce4e74fc1ba3a84e967c1086272d2fc176d28d39831f975a57de0c0
- MD5 24222973c3c689169c9faeb6f08dabaf
- SHA1 d95d37df1b30549cd6c97081dae7c045eee534f8
- SHA512 647b70168da5731a5a03af06ed36650f12807259de93b61f0685b0f0fbce25035aa2b832d3244cad3747fd7c25086aa9476294203ac2bf314480140e22213a42
- SSDEEP 3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGlldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B549F70F-5AF6-4e56-B6C0-EE02B4550A83}.exe
- Size 408KB
- SHA256 b5fbba5a5aa9af64d836aacfda01504ea8a1613770ff392659d09945d7ddb984
- MD5 2b2baa19526a088f70b953a4187a3a92
- SHA1 8057ab7839f407f3a1dbe75690450c6553e6f3fc
- SHA512 ab81fb729e650b6dc52a30782f3d9f67e831db962d969e79220e9287e0538f80536ff5835bd8523f3b99597f9efe91bcc888eb64a523d4d494c7beb806dc8247
- SSDEEP 3072:CEGh0owl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGaldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C78F0F9E-813B-4e7a-9B88-9A38FDFEE384}.exe
- Size 408KB
- SHA256 3ea0e92710aee8e8ff87d13dc08d3eda74f8e2470dd2410f60231cbebae383b5
- MD5 795cf8516eca1274c2ab9d31d4d31d1f
- SHA1 715f862cc42a5a38ecca9993eaae3da27b6f9b41
- SHA512 0e9d7a775a2f0754ff944af3479c7110ba19c4d0089e1ae6a37b4b0520e29622f27dd07c15234dd25da951ff470f7cdf78794cfc18a039d226de1aa0b7da8985
- SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EB9F829D-8ED6-484d-9F97-B4DF28685B24}.exe
- Size 408KB
- SHA256 d2d8afa8b8765a349dcacf9cf3e615afb8541706e5d9b2a8f1c6e2f18e182786
- MD5 eb8bd4172eae6736383f98ba596176da
- SHA1 381d56e4fad3ceceb3eceab5a637b20ee45cfc43
- SHA512 4e20f856571623041f0720d9ec4915529cdc8b2f99d8a2b52542ce6d883450006b4c4f4dc1644a5d5d5a2586574c7993815c33e8e1633d59d68d32a6f4cae2df
- SSDEEP 3072:CEGh0oyl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F4C304F4-4EA8-4ab0-B5F5-7783AAE58612}.exe
- Size 408KB
- SHA256 c05aac1a0b2031ed7d3c0f69331cd5010cecac9dc2ebaf86fdd16472e54278d8
- MD5 0033d77d490387ba719cec9db2ceeb1b
- SHA1 fdaf87607a7f140459a066ef91dde464d9f6b1d5
- SHA512 2d9580759db2107ff7ee6e8c271c05c090e3fad4f8fe1d49b6fe47a61471e8d3d289ebb8f8c7f35079e1803adb6b2a6122f03c9b11c169f93c828f5be1c98528
- SSDEEP 3072:CEGh0ovl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP