Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe
- Size 380KB
- Sample240404-pmq6wsfg28
- SHA256 4549b9080f1525bdc8d2830bffb8f4189ec98a08edca240066d2a9f92ce1b8d6
- MD5 0c5a62cd30613df6af0c8e4dd4071461
- SHA1 9dae081c6eb17303f892b81441936f216319d718
- SHA512 f495933c0fc87d770b49db5a3ae886873adde5a01a78d5293ef4d22c7b2a57131f5ff433cfcccd29a9d7405ec4dcff83be724164998ec79b9e96588745c0477d
- SSDEEP 3072:mEGh0oqlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG4l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000231e6-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00110000000231ed-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000231f4-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00120000000231ed-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fa2-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fa3-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021fa2-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000703-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000703-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000703-45.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}\stubpath = "C:\\Windows\\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe" {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8CA97D0-E83A-447c-851F-33EA0360B25A} {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BE78D9C-75AD-4092-92F7-24725534B718} {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BE78D9C-75AD-4092-92F7-24725534B718}\stubpath = "C:\\Windows\\{4BE78D9C-75AD-4092-92F7-24725534B718}.exe" {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFE78A09-2772-4fbc-A455-DEDD570736D5}\stubpath = "C:\\Windows\\{AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe" {4BE78D9C-75AD-4092-92F7-24725534B718}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{613C5B24-D07E-40e7-A980-CC16BF95DBD9} {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95D693BA-1122-4437-93F7-D8122D455B88} {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5E03287-7016-4b43-BAB0-103B24E3704B} {FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07CB8756-FE2D-497f-9D7C-FC7B27358B94} {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95D693BA-1122-4437-93F7-D8122D455B88}\stubpath = "C:\\Windows\\{95D693BA-1122-4437-93F7-D8122D455B88}.exe" {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}\stubpath = "C:\\Windows\\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe" 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82F176E6-024B-4d2a-870F-9D6F94B8CF61} {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82F176E6-024B-4d2a-870F-9D6F94B8CF61}\stubpath = "C:\\Windows\\{82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe" {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07CB8756-FE2D-497f-9D7C-FC7B27358B94}\stubpath = "C:\\Windows\\{07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe" {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D} {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D}\stubpath = "C:\\Windows\\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe" {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{613C5B24-D07E-40e7-A980-CC16BF95DBD9}\stubpath = "C:\\Windows\\{613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe" {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}\stubpath = "C:\\Windows\\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe" {95D693BA-1122-4437-93F7-D8122D455B88}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5E03287-7016-4b43-BAB0-103B24E3704B}\stubpath = "C:\\Windows\\{F5E03287-7016-4b43-BAB0-103B24E3704B}.exe" {FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A} 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9} {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8CA97D0-E83A-447c-851F-33EA0360B25A}\stubpath = "C:\\Windows\\{E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe" {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFE78A09-2772-4fbc-A455-DEDD570736D5} {4BE78D9C-75AD-4092-92F7-24725534B718}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0} {95D693BA-1122-4437-93F7-D8122D455B88}.exe - Executes dropped EXE 12 IoCs
pid Process 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 2292 {95D693BA-1122-4437-93F7-D8122D455B88}.exe 2808 {FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe 1564 {F5E03287-7016-4b43-BAB0-103B24E3704B}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe File created C:\Windows\{82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe File created C:\Windows\{E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe File created C:\Windows\{4BE78D9C-75AD-4092-92F7-24725534B718}.exe {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe File created C:\Windows\{AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe {4BE78D9C-75AD-4092-92F7-24725534B718}.exe File created C:\Windows\{07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe File created C:\Windows\{95D693BA-1122-4437-93F7-D8122D455B88}.exe {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe File created C:\Windows\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe {95D693BA-1122-4437-93F7-D8122D455B88}.exe File created C:\Windows\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe File created C:\Windows\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe File created C:\Windows\{613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe File created C:\Windows\{F5E03287-7016-4b43-BAB0-103B24E3704B}.exe {FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe Token: SeIncBasePriorityPrivilege 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe Token: SeIncBasePriorityPrivilege 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe Token: SeIncBasePriorityPrivilege 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe Token: SeIncBasePriorityPrivilege 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe Token: SeIncBasePriorityPrivilege 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe Token: SeIncBasePriorityPrivilege 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe Token: SeIncBasePriorityPrivilege 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe Token: SeIncBasePriorityPrivilege 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe Token: SeIncBasePriorityPrivilege 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe Token: SeIncBasePriorityPrivilege 2292 {95D693BA-1122-4437-93F7-D8122D455B88}.exe Token: SeIncBasePriorityPrivilege 2808 {FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4600 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe 97 PID 3372 wrote to memory of 4600 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe 97 PID 3372 wrote to memory of 4600 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe 97 PID 3372 wrote to memory of 1788 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe 98 PID 3372 wrote to memory of 1788 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe 98 PID 3372 wrote to memory of 1788 3372 2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe 98 PID 4600 wrote to memory of 2812 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 99 PID 4600 wrote to memory of 2812 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 99 PID 4600 wrote to memory of 2812 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 99 PID 4600 wrote to memory of 4652 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 100 PID 4600 wrote to memory of 4652 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 100 PID 4600 wrote to memory of 4652 4600 {DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe 100 PID 2812 wrote to memory of 3668 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 102 PID 2812 wrote to memory of 3668 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 102 PID 2812 wrote to memory of 3668 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 102 PID 2812 wrote to memory of 4044 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 103 PID 2812 wrote to memory of 4044 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 103 PID 2812 wrote to memory of 4044 2812 {82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe 103 PID 3668 wrote to memory of 5084 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 104 PID 3668 wrote to memory of 5084 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 104 PID 3668 wrote to memory of 5084 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 104 PID 3668 wrote to memory of 2184 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 105 PID 3668 wrote to memory of 2184 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 105 PID 3668 wrote to memory of 2184 3668 {2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe 105 PID 5084 wrote to memory of 4960 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 106 PID 5084 wrote to memory of 4960 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 106 PID 5084 wrote to memory of 4960 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 106 PID 5084 wrote to memory of 1700 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 107 PID 5084 wrote to memory of 1700 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 107 PID 5084 wrote to memory of 1700 5084 {E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe 107 PID 4960 wrote to memory of 960 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 108 PID 4960 wrote to memory of 960 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 108 PID 4960 wrote to memory of 960 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 108 PID 4960 wrote to memory of 3628 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 109 PID 4960 wrote to memory of 3628 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 109 PID 4960 wrote to memory of 3628 4960 {4BE78D9C-75AD-4092-92F7-24725534B718}.exe 109 PID 960 wrote to memory of 4432 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 110 PID 960 wrote to memory of 4432 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 110 PID 960 wrote to memory of 4432 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 110 PID 960 wrote to memory of 4488 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 111 PID 960 wrote to memory of 4488 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 111 PID 960 wrote to memory of 4488 960 {AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe 111 PID 4432 wrote to memory of 4512 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 112 PID 4432 wrote to memory of 4512 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 112 PID 4432 wrote to memory of 4512 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 112 PID 4432 wrote to memory of 4992 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 113 PID 4432 wrote to memory of 4992 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 113 PID 4432 wrote to memory of 4992 4432 {07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe 113 PID 4512 wrote to memory of 1824 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 114 PID 4512 wrote to memory of 1824 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 114 PID 4512 wrote to memory of 1824 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 114 PID 4512 wrote to memory of 3140 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 115 PID 4512 wrote to memory of 3140 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 115 PID 4512 wrote to memory of 3140 4512 {C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe 115 PID 1824 wrote to memory of 2292 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 116 PID 1824 wrote to memory of 2292 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 116 PID 1824 wrote to memory of 2292 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 116 PID 1824 wrote to memory of 1044 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 117 PID 1824 wrote to memory of 1044 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 117 PID 1824 wrote to memory of 1044 1824 {613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe 117 PID 2292 wrote to memory of 2808 2292 {95D693BA-1122-4437-93F7-D8122D455B88}.exe 118 PID 2292 wrote to memory of 2808 2292 {95D693BA-1122-4437-93F7-D8122D455B88}.exe 118 PID 2292 wrote to memory of 2808 2292 {95D693BA-1122-4437-93F7-D8122D455B88}.exe 118 PID 2292 wrote to memory of 396 2292 {95D693BA-1122-4437-93F7-D8122D455B88}.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_0c5a62cd30613df6af0c8e4dd4071461_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exeC:\Windows\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\{82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exeC:\Windows\{82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exeC:\Windows\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\{E8CA97D0-E83A-447c-851F-33EA0360B25A}.exeC:\Windows\{E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\{4BE78D9C-75AD-4092-92F7-24725534B718}.exeC:\Windows\{4BE78D9C-75AD-4092-92F7-24725534B718}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\{AFE78A09-2772-4fbc-A455-DEDD570736D5}.exeC:\Windows\{AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\{07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exeC:\Windows\{07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exeC:\Windows\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\{613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exeC:\Windows\{613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\{95D693BA-1122-4437-93F7-D8122D455B88}.exeC:\Windows\{95D693BA-1122-4437-93F7-D8122D455B88}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exeC:\Windows\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\{F5E03287-7016-4b43-BAB0-103B24E3704B}.exeC:\Windows\{F5E03287-7016-4b43-BAB0-103B24E3704B}.exe13⤵
- Executes dropped EXE
PID:1564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCA2C~1.EXE > nul13⤵PID:4600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95D69~1.EXE > nul12⤵PID:396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{613C5~1.EXE > nul11⤵PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5A63~1.EXE > nul10⤵PID:3140
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07CB8~1.EXE > nul9⤵PID:4992
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFE78~1.EXE > nul8⤵PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BE78~1.EXE > nul7⤵PID:3628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8CA9~1.EXE > nul6⤵PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CED7~1.EXE > nul5⤵PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82F17~1.EXE > nul4⤵PID:4044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAC1E~1.EXE > nul3⤵PID:4652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{07CB8756-FE2D-497f-9D7C-FC7B27358B94}.exe
- Size 380KB
- SHA256 96ce1c8a5d8d9631d27527159b084f21515b7274fd711e45282dfedb55677630
- MD5 c72ddbe19f05b020fc31fbf76e63fa84
- SHA1 b7b883861fae7872380ef45fb816e42f47b593b8
- SHA512 7fbe1ec659515b6240319c165d82c15ed30791a5d7e62d6edc8e5c8116cb733461c25bd62c1c148535d1c63fe07cbf9a53300f3f20ce0cd0135b96dbb2cebb8f
- SSDEEP 3072:mEGh0oElPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGGl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2CED7215-8CD0-4bb2-A637-F7515D0B8EB9}.exe
- Size 380KB
- SHA256 e63cefd8a1076cb40aef02e642bbe19bcb98332468ab8a3a4f985ce41d7957ae
- MD5 32715b35984c3b941bfa0e7fe43f4098
- SHA1 9b09c4afc20552e969fd8a2ef239279bf7aa8189
- SHA512 6da81da58a63eb7bf2fbfd0c0ef5e71df7e2e3fbdb172e3c05c331ea8355046d81700f495dffecd1ff7cf80759adb776d8d7d19c64591596b9bc3f0a89506617
- SSDEEP 3072:mEGh0orlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGVl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4BE78D9C-75AD-4092-92F7-24725534B718}.exe
- Size 380KB
- SHA256 dda917c5f78258eb1d08d3512534185da254a1d03cf1d70f96f94bb725628e3b
- MD5 f75eaa1e2ed392c559677279364e50b1
- SHA1 fe06d17d7f9990cc2a0d5df0575e28004b4996f3
- SHA512 ca4d00d9b5541abddb080204e3d2240a512af9ec5f879dec9ce8cb39e05652a3d2711148862106c7139109624b585f215f7ca2a3cc90bf1edcabccb5324104c1
- SSDEEP 3072:mEGh0oslPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGSl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{613C5B24-D07E-40e7-A980-CC16BF95DBD9}.exe
- Size 380KB
- SHA256 c04ae801d742a3cfcdddbf27bdf6ef6427eb06c83a133a1f7da42e8ad31d9cc3
- MD5 e17c3fd049438deb3beaabeb9cba1551
- SHA1 31e960d65989bda0e41dd7e1838f1115c6317815
- SHA512 b6c8da11f05e268e176aa1a384abd58689441a8e68797ee7cf52b39fea8a53376a42f7104e589f3b46d19de853946ae6f923a3fb60611e06aa198657b700b4fe
- SSDEEP 3072:mEGh0oYlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG6l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{82F176E6-024B-4d2a-870F-9D6F94B8CF61}.exe
- Size 380KB
- SHA256 1617e85b34f15775392f70feafe1e920a794326cc4a8fcca803ba8874bcb6b50
- MD5 f239543c490397766a5da41f553fae82
- SHA1 4ccd1bf7b2655db5cc66dcaa156a5307173eef92
- SHA512 510e345b8274e1c96b032f5364e261494e27a86b7be67f4d7eca2a5c21e894542543b846844c5f72022d11697034b055feeea916b7d358b2002589bac9bf1274
- SSDEEP 3072:mEGh0orlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGZl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{95D693BA-1122-4437-93F7-D8122D455B88}.exe
- Size 380KB
- SHA256 f5644825f1ee96d58794af69e1f52b3027786feffa4e56fd486a2a1b95f73071
- MD5 d76916eb1ad0f6e35c42961749548331
- SHA1 311e9c2585113a9a721b5d03094fad73a83614c5
- SHA512 2d1b2db3fb4dbaf31e7daf2aa5fc8d099b020cf0a5b3e96a88ec264aca4fb0dc9046f2902329f5fb23d972cbb854443f6bd028c6c84479e6096ea4029fad28f3
- SSDEEP 3072:mEGh0oVlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGfl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AFE78A09-2772-4fbc-A455-DEDD570736D5}.exe
- Size 380KB
- SHA256 46c6324a00ff95ffd1476092ec71b56516c95dbe87d5bd5b40220cbdb9b2aef2
- MD5 ff855f45944f8a85b6f8e1905c3f78b5
- SHA1 72a95b02b0f889b45ffd05b4a40a081fb8c1ac60
- SHA512 fd3d31b374e78c07a6dca8db96b08dd1c426642086ab1c55508e7366dd06cabdbac108b375d5d323e141106a4a7f446a632780bc88bc45402842cc86e7f01a8f
- SSDEEP 3072:mEGh0oFlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGnl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C5A63FB4-7094-4621-8F2E-DC51FCE9183D}.exe
- Size 380KB
- SHA256 88d8f6bf571ebab8235e4f4e9c504cb9ddf6eddf6e9de894f7b2ce0cb1740377
- MD5 ce0e9f4f2b05bc584186864084be086c
- SHA1 259cd7a0ab7f10d8d7ebf476a2ae6d92847d86da
- SHA512 43cffbeac179928dde274e91cb0b4b836857f12904b242dabbcca4546f0c3c6fdbdf780dd0484a5bdcf4a6aa3925dd2ca9f5826f96870eaed19b8cf4a3f22a97
- SSDEEP 3072:mEGh0oylPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGwl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DAC1EC85-1C93-4394-B62E-A1B9CBB6552A}.exe
- Size 380KB
- SHA256 8f5b230917894d432b1fd3f204634db0ba58ead6d56e4babec3bd93a8dfe3848
- MD5 fdf6df80adf73d21ca5bd1db75397cff
- SHA1 483e472355521355adc17239e5b36586c0620c04
- SHA512 406623cd3da232a1aed693f7eecd86240837e886c24f99c7d0aa452c562f644c89ed2ad777e461fc1086e28484273674d8fdcf785ab63bb86757f49b3276ba93
- SSDEEP 3072:mEGh0oQzlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEct:mEG6l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E8CA97D0-E83A-447c-851F-33EA0360B25A}.exe
- Size 380KB
- SHA256 265e750f49d7a39871dfd4d4f80cd7c25ecf180030afa4fb0c9cc07de80ce842
- MD5 727acb1d3a5dda10229e78b869087ff1
- SHA1 ba4afcbcb0e2fcc268b45dc9e2f65a3196f98879
- SHA512 f71b3d492f7e478e749d3118762e2287bd6646fe6c29609db07e2be0c262d2cca4fd1250a55265605aadcf7dc98b4bf6d1e5a9dd8bf7a30b9e4915f7834716b2
- SSDEEP 3072:mEGh0ohlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGvl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F5E03287-7016-4b43-BAB0-103B24E3704B}.exe
- Size 380KB
- SHA256 95171d31fdecae22affc1420aeddda8fc6d4818f8d89a5e36a9d75a0d62071a7
- MD5 3462c439394ba2bff57d7cdb063cdbed
- SHA1 c5a3eb8a29800b392b87ae2087502524b091e06d
- SHA512 58920acca4e8787657287826753a3d7e7d319d13972cb15dd61bbce2d3f5fb045c53c49d96db30e2552584999919739ab9486f481c72ec8d9c470faad3b7ab40
- SSDEEP 3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGPl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FCA2C568-99E4-4e90-97D9-7DCC16D0DFA0}.exe
- Size 380KB
- SHA256 ecbdd9c45e30050d823fc4439bfb8f65fe1735484733d2053520560da3c910a3
- MD5 ceca9ea6e6b0535af8f4fb0cc41e9ca9
- SHA1 48e2adf03657fb0a7a8acaa2fd54eea17c2e62c9
- SHA512 64bf4b37065c68530f75bd869fd9cab217cb2be82f923470f3df974cd20cd661f7909020c69a1af138308e77dab2c2a284456ba05008216eb51189f840e6a082
- SSDEEP 3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG7l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP