Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe
- Size 197KB
- Sample240404-p4dxwsgc5v
- SHA256 4e11584d73f4457e0469d3804fc71c9b0ecffac4ebb65f51a43d3931f961f693
- MD5 d91f2969ec0d2b5c4bab7b79e806356d
- SHA1 5ef6ddc4c7f104ca93cd5f6202dc3d6dd128d247
- SHA512 9bed79667198ec19ef7c5fe84d36a7d02923f487646f340209e4e128796554773d9cd66efd2691da4a210ac95882b0d40d95571a9c281b952910670248622ce7
- SSDEEP 3072:jEGh0ool+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGWlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00110000000231db-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231bd-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231e2-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000231bd-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d41-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d42-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021d41-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000707-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9} 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65881B2C-FB02-464f-B70E-1F1B6AB35E11} {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE} {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}\stubpath = "C:\\Windows\\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe" {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4008A6CD-14F9-447b-9EC3-C107688D6427} {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D90403B-CC99-4be5-BF7A-AD4A9890665B}\stubpath = "C:\\Windows\\{0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe" {35A889AF-BD62-4a89-853A-91037D9195C7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8} {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96F0D786-875A-4776-BCFF-E7483461EC55} {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32872EE2-21EA-4ca9-94E7-39E3EE524055} {96F0D786-875A-4776-BCFF-E7483461EC55}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61919A7A-15E4-4c2a-B401-C7340CEB6C09} {3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9}\stubpath = "C:\\Windows\\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe" 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96F0D786-875A-4776-BCFF-E7483461EC55}\stubpath = "C:\\Windows\\{96F0D786-875A-4776-BCFF-E7483461EC55}.exe" {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32872EE2-21EA-4ca9-94E7-39E3EE524055}\stubpath = "C:\\Windows\\{32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe" {96F0D786-875A-4776-BCFF-E7483461EC55}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35A889AF-BD62-4a89-853A-91037D9195C7} {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35A889AF-BD62-4a89-853A-91037D9195C7}\stubpath = "C:\\Windows\\{35A889AF-BD62-4a89-853A-91037D9195C7}.exe" {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61919A7A-15E4-4c2a-B401-C7340CEB6C09}\stubpath = "C:\\Windows\\{61919A7A-15E4-4c2a-B401-C7340CEB6C09}.exe" {3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65881B2C-FB02-464f-B70E-1F1B6AB35E11}\stubpath = "C:\\Windows\\{65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe" {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}\stubpath = "C:\\Windows\\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe" {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6DCA6E8-B55D-43ed-B581-23A1849B651D} {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6DCA6E8-B55D-43ed-B581-23A1849B651D}\stubpath = "C:\\Windows\\{B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe" {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4008A6CD-14F9-447b-9EC3-C107688D6427}\stubpath = "C:\\Windows\\{4008A6CD-14F9-447b-9EC3-C107688D6427}.exe" {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D90403B-CC99-4be5-BF7A-AD4A9890665B} {35A889AF-BD62-4a89-853A-91037D9195C7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF} {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF}\stubpath = "C:\\Windows\\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe" {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe - Executes dropped EXE 12 IoCs
pid Process 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 2592 {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe 3232 {3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe 540 {61919A7A-15E4-4c2a-B401-C7340CEB6C09}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{35A889AF-BD62-4a89-853A-91037D9195C7}.exe {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe File created C:\Windows\{0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe {35A889AF-BD62-4a89-853A-91037D9195C7}.exe File created C:\Windows\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe File created C:\Windows\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe File created C:\Windows\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe File created C:\Windows\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe File created C:\Windows\{B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe File created C:\Windows\{4008A6CD-14F9-447b-9EC3-C107688D6427}.exe {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe File created C:\Windows\{61919A7A-15E4-4c2a-B401-C7340CEB6C09}.exe {3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe File created C:\Windows\{65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe File created C:\Windows\{96F0D786-875A-4776-BCFF-E7483461EC55}.exe {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe File created C:\Windows\{32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe {96F0D786-875A-4776-BCFF-E7483461EC55}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe Token: SeIncBasePriorityPrivilege 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe Token: SeIncBasePriorityPrivilege 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe Token: SeIncBasePriorityPrivilege 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe Token: SeIncBasePriorityPrivilege 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe Token: SeIncBasePriorityPrivilege 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe Token: SeIncBasePriorityPrivilege 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe Token: SeIncBasePriorityPrivilege 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe Token: SeIncBasePriorityPrivilege 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe Token: SeIncBasePriorityPrivilege 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe Token: SeIncBasePriorityPrivilege 2592 {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe Token: SeIncBasePriorityPrivilege 3232 {3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4536 wrote to memory of 1316 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe 97 PID 4536 wrote to memory of 1316 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe 97 PID 4536 wrote to memory of 1316 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe 97 PID 4536 wrote to memory of 4956 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe 98 PID 4536 wrote to memory of 4956 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe 98 PID 4536 wrote to memory of 4956 4536 2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe 98 PID 1316 wrote to memory of 1756 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 99 PID 1316 wrote to memory of 1756 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 99 PID 1316 wrote to memory of 1756 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 99 PID 1316 wrote to memory of 1084 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 100 PID 1316 wrote to memory of 1084 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 100 PID 1316 wrote to memory of 1084 1316 {E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe 100 PID 1756 wrote to memory of 4128 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 102 PID 1756 wrote to memory of 4128 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 102 PID 1756 wrote to memory of 4128 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 102 PID 1756 wrote to memory of 4892 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 103 PID 1756 wrote to memory of 4892 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 103 PID 1756 wrote to memory of 4892 1756 {65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe 103 PID 4128 wrote to memory of 2752 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 104 PID 4128 wrote to memory of 2752 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 104 PID 4128 wrote to memory of 2752 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 104 PID 4128 wrote to memory of 1108 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 105 PID 4128 wrote to memory of 1108 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 105 PID 4128 wrote to memory of 1108 4128 {8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe 105 PID 2752 wrote to memory of 3744 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 106 PID 2752 wrote to memory of 3744 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 106 PID 2752 wrote to memory of 3744 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 106 PID 2752 wrote to memory of 3456 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 107 PID 2752 wrote to memory of 3456 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 107 PID 2752 wrote to memory of 3456 2752 {FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe 107 PID 3744 wrote to memory of 2276 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 108 PID 3744 wrote to memory of 2276 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 108 PID 3744 wrote to memory of 2276 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 108 PID 3744 wrote to memory of 4848 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 109 PID 3744 wrote to memory of 4848 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 109 PID 3744 wrote to memory of 4848 3744 {B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe 109 PID 2276 wrote to memory of 1452 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 110 PID 2276 wrote to memory of 1452 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 110 PID 2276 wrote to memory of 1452 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 110 PID 2276 wrote to memory of 1612 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 111 PID 2276 wrote to memory of 1612 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 111 PID 2276 wrote to memory of 1612 2276 {96F0D786-875A-4776-BCFF-E7483461EC55}.exe 111 PID 1452 wrote to memory of 2384 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 112 PID 1452 wrote to memory of 2384 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 112 PID 1452 wrote to memory of 2384 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 112 PID 1452 wrote to memory of 2288 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 113 PID 1452 wrote to memory of 2288 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 113 PID 1452 wrote to memory of 2288 1452 {32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe 113 PID 2384 wrote to memory of 5112 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 114 PID 2384 wrote to memory of 5112 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 114 PID 2384 wrote to memory of 5112 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 114 PID 2384 wrote to memory of 1904 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 115 PID 2384 wrote to memory of 1904 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 115 PID 2384 wrote to memory of 1904 2384 {4008A6CD-14F9-447b-9EC3-C107688D6427}.exe 115 PID 5112 wrote to memory of 2592 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 116 PID 5112 wrote to memory of 2592 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 116 PID 5112 wrote to memory of 2592 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 116 PID 5112 wrote to memory of 2060 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 117 PID 5112 wrote to memory of 2060 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 117 PID 5112 wrote to memory of 2060 5112 {35A889AF-BD62-4a89-853A-91037D9195C7}.exe 117 PID 2592 wrote to memory of 3232 2592 {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe 118 PID 2592 wrote to memory of 3232 2592 {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe 118 PID 2592 wrote to memory of 3232 2592 {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe 118 PID 2592 wrote to memory of 944 2592 {0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_d91f2969ec0d2b5c4bab7b79e806356d_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exeC:\Windows\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\{65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exeC:\Windows\{65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exeC:\Windows\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exeC:\Windows\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\{B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exeC:\Windows\{B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\{96F0D786-875A-4776-BCFF-E7483461EC55}.exeC:\Windows\{96F0D786-875A-4776-BCFF-E7483461EC55}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\{32872EE2-21EA-4ca9-94E7-39E3EE524055}.exeC:\Windows\{32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\{4008A6CD-14F9-447b-9EC3-C107688D6427}.exeC:\Windows\{4008A6CD-14F9-447b-9EC3-C107688D6427}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\{35A889AF-BD62-4a89-853A-91037D9195C7}.exeC:\Windows\{35A889AF-BD62-4a89-853A-91037D9195C7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\{0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exeC:\Windows\{0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exeC:\Windows\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3232 -
C:\Windows\{61919A7A-15E4-4c2a-B401-C7340CEB6C09}.exeC:\Windows\{61919A7A-15E4-4c2a-B401-C7340CEB6C09}.exe13⤵
- Executes dropped EXE
PID:540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D622~1.EXE > nul13⤵PID:4812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D904~1.EXE > nul12⤵PID:944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35A88~1.EXE > nul11⤵PID:2060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4008A~1.EXE > nul10⤵PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32872~1.EXE > nul9⤵PID:2288
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96F0D~1.EXE > nul8⤵PID:1612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6DCA~1.EXE > nul7⤵PID:4848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDAB1~1.EXE > nul6⤵PID:3456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8567F~1.EXE > nul5⤵PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65881~1.EXE > nul4⤵PID:4892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E71A1~1.EXE > nul3⤵PID:1084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0D90403B-CC99-4be5-BF7A-AD4A9890665B}.exe
- Size 197KB
- SHA256 24a1d79735c98c20db608d804b5666326e774f3c1584c6bb8d2e26673a7daddc
- MD5 4e408fc0b5159d176060abc8cc0928c5
- SHA1 1fe6f57653d8ffdfb4e3f5d4d71cf0f8169ab8e1
- SHA512 ef29afaa317005b9497730168cfe9d5c61878ce4d06660028f1e39831b61dc32d42fc8d67fccb63b84b56dc02fb7e93d48f35fb7d7f41c675b242c8aea282c4d
- SSDEEP 3072:jEGh0oHZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGrlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{32872EE2-21EA-4ca9-94E7-39E3EE524055}.exe
- Size 197KB
- SHA256 e9ef72132f0f670124babd470cede9f773d3dc5e7eddb8c065020c3e57ba31b2
- MD5 c88e04f583464614daaf3c25682d2966
- SHA1 dbf8ca4345b627af1a804636acf0a82409d56123
- SHA512 8ed374c0a051dc2d962af6bd13e707e075665caafeb1d370478b8542fb9af8f781d74a272f2b6a4b3b5a1019be65df4bd1c3e4ec42c89ee353ee42a57fa7638c
- SSDEEP 3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGklEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{35A889AF-BD62-4a89-853A-91037D9195C7}.exe
- Size 197KB
- SHA256 838702ceffc36435fd9ae66ac1eba81af1d437dc355ee764c4c564623eaddb56
- MD5 0598e61a293c3da32752aecdd8065518
- SHA1 7fe5e43b35b2468a00d536bf2250f987744f0d9a
- SHA512 4b4f2c93c60b62fb773cb7eb88d471ae6f6c4038f524f3f1a11aa8ea4b74f117796bbd6829c7b36f8c41a9ef1306613ce694253b413b6421d849e7c71f5a1bbc
- SSDEEP 3072:jEGh0oml+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGElEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3D6220A4-F46B-4f9a-8EE7-59B3543027DF}.exe
- Size 197KB
- SHA256 20a4a22c59803c8b7d0360c75ae8d2540f04252ed5de81c3adbb31eb526014e5
- MD5 afe222b894c04e086ce2b6d7ffc38ff3
- SHA1 ff83acef8be3537aacbe5e37b563135d6063022a
- SHA512 65c846202171c44b5f83219be8efdbfc4cb985fe895e92426082135583a4ee1ce938d466ffacb75a8423fda6d29fa2ef5ea4087da955dd2556bb2d1a9526509b
- SSDEEP 3072:jEGh0oxl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG7lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4008A6CD-14F9-447b-9EC3-C107688D6427}.exe
- Size 197KB
- SHA256 6fb6b5ec74557f0fefdbcc348ac8f54d449ff90b71a12c9577a6a05d2bb858ec
- MD5 8d0096cdeeca24ef8e529cef0460ec67
- SHA1 a418ff544b25116815e836eae6e1bf230965cf87
- SHA512 8eebb8d7431e105a1a440470aca89d4415b27df9873bc6346011b0e861423453de2d38e458bd813b2d9191570c62b791d92f9916e91e5db377a486ab4bf126fe
- SSDEEP 3072:jEGh0ofl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGxlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{61919A7A-15E4-4c2a-B401-C7340CEB6C09}.exe
- Size 197KB
- SHA256 b12dd948c6a5908507825542da3ab7ee14a6c0ab0ea95e1da69ed8235cecd3e7
- MD5 4bb33947ecb414bda460eb6501ff3887
- SHA1 2d840bea6f04adc55a5a3915817ee69d555608ea
- SHA512 6401036808cc4f283712efd2832ed035c428cd534b3e9997f946197a38f0b55f21e2194be19196af2bdc193b8a1c64b64d0ffe09e85b5cfef56aa30e9b019e1d
- SSDEEP 3072:jEGh0oql+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGolEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{65881B2C-FB02-464f-B70E-1F1B6AB35E11}.exe
- Size 197KB
- SHA256 c67db3754ea889e9ba2e9c302f1b77acc9b54e0f8361889076b809658ee420ec
- MD5 251b17e20161eface03d151faf79b0ea
- SHA1 ffee76ee84cdf44e192720773a9d50fc4a1b647c
- SHA512 274e8a4be2a0202766ceda757f033951d2f41edb5d56b71cb21efa5e5d47c67fca37b56b90929591bbfff33d4f03add2ad3791b138e5806d46dca70d532e6788
- SSDEEP 3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGzlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8567F9A8-CACA-4ac8-9D59-EF3CE553E8CE}.exe
- Size 197KB
- SHA256 b1b21f037cfb5922c77aa5dc05325350bcfcf96fcfa9f57b6f5c343e786b4aed
- MD5 b7d7e9c4bdc4ecfc1ea9d0bde69b53e8
- SHA1 c3f05cf5afbf32571c464da01c9af93c93a3ea87
- SHA512 fa66ac7d0f17f41948f55649edc0cafa297a95e9280e57e8420c89988738d436d397d03297993a3a5939b89c9a1af31ae824cabb843b1ac4c22a2af43e3119f0
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG9lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{96F0D786-875A-4776-BCFF-E7483461EC55}.exe
- Size 197KB
- SHA256 124164d5ba59341354eb1e42707b65d2eeb89a16062aa70c6c9dd87e15f2b421
- MD5 0c4b4cf65bbd07c426a05471e306af12
- SHA1 bcbce3ee0381d1a41bae46f91df5410f0e107540
- SHA512 5d568b12a0b67bb4a13fec03301e585b79b3870dda998d379b24f8a24f490a320825ad593f7c2db0b7b528eb4d6b7b9e032f9ea9a82e50b2f328b804f3073540
- SSDEEP 3072:jEGh0oUl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGClEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B6DCA6E8-B55D-43ed-B581-23A1849B651D}.exe
- Size 197KB
- SHA256 91df2656fe5dee6a97eb89983a9a214ecabb5283e82f3f969df8b3724ca75a03
- MD5 58751e0e42a22e93f6a4c701a30868e7
- SHA1 8f147a22125a4961f50a353fd83b6fb98bd25203
- SHA512 773e1ea4a88b63eb1dc50ee0e3fca4edeceedb29929070886c1dfc7fe330cdb7003655210bdd7a689476fd3424c7c2a8507de614c14f1d25aaa9c481a04f0951
- SSDEEP 3072:jEGh0o/l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGhlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E71A1EFB-9C31-409c-97B5-A07297A7FDA9}.exe
- Size 197KB
- SHA256 6137aa377158bfba68783e6c859aef515108b64304ee54f6496ea86c2df71164
- MD5 95ada7945bf84e7f0fbfedbaa7c2b14b
- SHA1 9285c80694060c72873415e9929fdffda18f34be
- SHA512 d9002e8b34c64a2759efd2a7d72e9ecf952d665ce26125d6e9d31bf17fd6969ff654f44175ac9cec0f06f81f0ec65cdac155465e0f1311e5615c407e3c3d9b75
- SSDEEP 3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGVlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FDAB111D-B05B-4b66-9DF2-BE08ABAF67A8}.exe
- Size 197KB
- SHA256 1642efc96ebb1104dbd10a93bd38addfb8f3ff0d51d265a25b6d015c006e6ff4
- MD5 660c2ece38f927482a484950767ac8b7
- SHA1 01e057a7f4687807356321883118f71e7d0956b2
- SHA512 ca831d5ebecf38db9cc448900cf74448442aa9f52e1ca415ebe4bd454bfe6360441efde87f80adb59fd33d2e700097ceb8d27f1881ea28d69d65839b17788b46
- SSDEEP 3072:jEGh0o/l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGFlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP