Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe
- Size 408KB
- Sample240404-pntneafh33
- SHA256 19d4b0565ebe1e1b4baee4ccdb225ad4126e634a0972d11bc05e26bc8e42fad7
- MD5 1da47309ff33b74117babfe2fd09f649
- SHA1 28769aac464c35dcde7f021b96da52cdcc1c164d
- SHA512 50a9cbe66a1d2ecf94a26747020999c890d7ca74623fce8bd0b893c877a57f4523e586fefd48fb1bcb205adaa5162ce97038ffcec05e5795eab06db342aa3556
- SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGIldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000a00000002315d-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001500000002304c-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023247-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001600000002304c-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d05-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d06-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021d05-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072d-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36573346-9B5B-4138-8730-AA8D94B110CC}\stubpath = "C:\\Windows\\{36573346-9B5B-4138-8730-AA8D94B110CC}.exe" {0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}\stubpath = "C:\\Windows\\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe" {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36573346-9B5B-4138-8730-AA8D94B110CC} {0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F309659E-19F2-4e11-95A9-5CE0059DD32B}\stubpath = "C:\\Windows\\{F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe" {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{779F5F82-018F-4953-A23D-4E3357F3B80C}\stubpath = "C:\\Windows\\{779F5F82-018F-4953-A23D-4E3357F3B80C}.exe" {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A458210E-70B2-4d03-91B6-CE49E9E410B4} {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9} {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F309659E-19F2-4e11-95A9-5CE0059DD32B} {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AB1CED7-2727-4289-BF63-984937774715}\stubpath = "C:\\Windows\\{2AB1CED7-2727-4289-BF63-984937774715}.exe" {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EF8CFC8-4245-4325-842D-999F41BE64E6} {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05135CFC-3663-4085-8B93-87E730D1DAF6} {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B} {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05135CFC-3663-4085-8B93-87E730D1DAF6}\stubpath = "C:\\Windows\\{05135CFC-3663-4085-8B93-87E730D1DAF6}.exe" {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797} {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}\stubpath = "C:\\Windows\\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe" {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A458210E-70B2-4d03-91B6-CE49E9E410B4}\stubpath = "C:\\Windows\\{A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe" {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}\stubpath = "C:\\Windows\\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe" {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{779F5F82-018F-4953-A23D-4E3357F3B80C} {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662} 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}\stubpath = "C:\\Windows\\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe" 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557}\stubpath = "C:\\Windows\\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe" {2AB1CED7-2727-4289-BF63-984937774715}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EF8CFC8-4245-4325-842D-999F41BE64E6}\stubpath = "C:\\Windows\\{0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe" {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AB1CED7-2727-4289-BF63-984937774715} {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557} {2AB1CED7-2727-4289-BF63-984937774715}.exe - Executes dropped EXE 12 IoCs
pid Process 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 4076 {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe 2184 {0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe 1692 {36573346-9B5B-4138-8730-AA8D94B110CC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{779F5F82-018F-4953-A23D-4E3357F3B80C}.exe {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe File created C:\Windows\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe {2AB1CED7-2727-4289-BF63-984937774715}.exe File created C:\Windows\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe File created C:\Windows\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe File created C:\Windows\{F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe File created C:\Windows\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe File created C:\Windows\{2AB1CED7-2727-4289-BF63-984937774715}.exe {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe File created C:\Windows\{0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe File created C:\Windows\{36573346-9B5B-4138-8730-AA8D94B110CC}.exe {0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe File created C:\Windows\{05135CFC-3663-4085-8B93-87E730D1DAF6}.exe {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe File created C:\Windows\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe File created C:\Windows\{A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe Token: SeIncBasePriorityPrivilege 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe Token: SeIncBasePriorityPrivilege 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe Token: SeIncBasePriorityPrivilege 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe Token: SeIncBasePriorityPrivilege 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe Token: SeIncBasePriorityPrivilege 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe Token: SeIncBasePriorityPrivilege 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe Token: SeIncBasePriorityPrivilege 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe Token: SeIncBasePriorityPrivilege 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe Token: SeIncBasePriorityPrivilege 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe Token: SeIncBasePriorityPrivilege 4076 {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe Token: SeIncBasePriorityPrivilege 2184 {0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 460 wrote to memory of 3940 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe 95 PID 460 wrote to memory of 3940 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe 95 PID 460 wrote to memory of 3940 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe 95 PID 460 wrote to memory of 2820 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe 96 PID 460 wrote to memory of 2820 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe 96 PID 460 wrote to memory of 2820 460 2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe 96 PID 3940 wrote to memory of 3912 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 99 PID 3940 wrote to memory of 3912 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 99 PID 3940 wrote to memory of 3912 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 99 PID 3940 wrote to memory of 3688 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 100 PID 3940 wrote to memory of 3688 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 100 PID 3940 wrote to memory of 3688 3940 {9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe 100 PID 3912 wrote to memory of 1932 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 102 PID 3912 wrote to memory of 1932 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 102 PID 3912 wrote to memory of 1932 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 102 PID 3912 wrote to memory of 3956 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 103 PID 3912 wrote to memory of 3956 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 103 PID 3912 wrote to memory of 3956 3912 {05135CFC-3663-4085-8B93-87E730D1DAF6}.exe 103 PID 1932 wrote to memory of 2988 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 104 PID 1932 wrote to memory of 2988 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 104 PID 1932 wrote to memory of 2988 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 104 PID 1932 wrote to memory of 1240 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 105 PID 1932 wrote to memory of 1240 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 105 PID 1932 wrote to memory of 1240 1932 {A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe 105 PID 2988 wrote to memory of 3052 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 106 PID 2988 wrote to memory of 3052 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 106 PID 2988 wrote to memory of 3052 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 106 PID 2988 wrote to memory of 2844 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 107 PID 2988 wrote to memory of 2844 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 107 PID 2988 wrote to memory of 2844 2988 {A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe 107 PID 3052 wrote to memory of 3248 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 108 PID 3052 wrote to memory of 3248 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 108 PID 3052 wrote to memory of 3248 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 108 PID 3052 wrote to memory of 4300 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 109 PID 3052 wrote to memory of 4300 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 109 PID 3052 wrote to memory of 4300 3052 {DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe 109 PID 3248 wrote to memory of 1172 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 110 PID 3248 wrote to memory of 1172 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 110 PID 3248 wrote to memory of 1172 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 110 PID 3248 wrote to memory of 1176 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 111 PID 3248 wrote to memory of 1176 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 111 PID 3248 wrote to memory of 1176 3248 {6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe 111 PID 1172 wrote to memory of 5044 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 112 PID 1172 wrote to memory of 5044 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 112 PID 1172 wrote to memory of 5044 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 112 PID 1172 wrote to memory of 4768 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 113 PID 1172 wrote to memory of 4768 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 113 PID 1172 wrote to memory of 4768 1172 {F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe 113 PID 5044 wrote to memory of 4940 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 114 PID 5044 wrote to memory of 4940 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 114 PID 5044 wrote to memory of 4940 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 114 PID 5044 wrote to memory of 4736 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 115 PID 5044 wrote to memory of 4736 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 115 PID 5044 wrote to memory of 4736 5044 {779F5F82-018F-4953-A23D-4E3357F3B80C}.exe 115 PID 4940 wrote to memory of 4076 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 116 PID 4940 wrote to memory of 4076 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 116 PID 4940 wrote to memory of 4076 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 116 PID 4940 wrote to memory of 2268 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 117 PID 4940 wrote to memory of 2268 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 117 PID 4940 wrote to memory of 2268 4940 {2AB1CED7-2727-4289-BF63-984937774715}.exe 117 PID 4076 wrote to memory of 2184 4076 {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe 118 PID 4076 wrote to memory of 2184 4076 {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe 118 PID 4076 wrote to memory of 2184 4076 {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe 118 PID 4076 wrote to memory of 376 4076 {D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_1da47309ff33b74117babfe2fd09f649_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exeC:\Windows\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\{05135CFC-3663-4085-8B93-87E730D1DAF6}.exeC:\Windows\{05135CFC-3663-4085-8B93-87E730D1DAF6}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exeC:\Windows\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\{A458210E-70B2-4d03-91B6-CE49E9E410B4}.exeC:\Windows\{A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exeC:\Windows\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exeC:\Windows\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\{F309659E-19F2-4e11-95A9-5CE0059DD32B}.exeC:\Windows\{F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\{779F5F82-018F-4953-A23D-4E3357F3B80C}.exeC:\Windows\{779F5F82-018F-4953-A23D-4E3357F3B80C}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\{2AB1CED7-2727-4289-BF63-984937774715}.exeC:\Windows\{2AB1CED7-2727-4289-BF63-984937774715}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exeC:\Windows\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\{0EF8CFC8-4245-4325-842D-999F41BE64E6}.exeC:\Windows\{0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\Windows\{36573346-9B5B-4138-8730-AA8D94B110CC}.exeC:\Windows\{36573346-9B5B-4138-8730-AA8D94B110CC}.exe13⤵
- Executes dropped EXE
PID:1692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EF8C~1.EXE > nul13⤵PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D11B6~1.EXE > nul12⤵PID:376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2AB1C~1.EXE > nul11⤵PID:2268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{779F5~1.EXE > nul10⤵PID:4736
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3096~1.EXE > nul9⤵PID:4768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DD2F~1.EXE > nul8⤵PID:1176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA9CF~1.EXE > nul7⤵PID:4300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4582~1.EXE > nul6⤵PID:2844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8FB5~1.EXE > nul5⤵PID:1240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05135~1.EXE > nul4⤵PID:3956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9225E~1.EXE > nul3⤵PID:3688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{05135CFC-3663-4085-8B93-87E730D1DAF6}.exe
- Size 408KB
- SHA256 ec50915cf3b4edf8a3ecb86b80b3fd6b7b5cdd1885658aae2e26dbcb00ad8597
- MD5 d3e7fba7c3f4dd4a94bb2394d413da97
- SHA1 54a6510a220e8749520ca5850a2c985dbe50067c
- SHA512 d621bb580396f6ac20b6b8cbb8f628c883ac336de01e0404cab06fcdb674149ec668d02af2c8ea895183fb217ca12b3f4026f4a090933055a677864dd7f37574
- SSDEEP 3072:CEGh0oJl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGrldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{0EF8CFC8-4245-4325-842D-999F41BE64E6}.exe
- Size 408KB
- SHA256 f6da056c13ddac1d9ad4d7a713c9bda25adffb826adf84edd360320c170394aa
- MD5 851432c1134b34624b733dbc41c828d1
- SHA1 4e352191ca1707c8202a233eefd05eb61fae8272
- SHA512 16f981ef67e6eced12ef18f51d98f229dcf833acf312e5590c1ba4153d40fb2840dfc958b02c50dd0f9dfb08a7d4bb3bfbfd76839a9c38c0afc1f53db77b136d
- SSDEEP 3072:CEGh0oul3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2AB1CED7-2727-4289-BF63-984937774715}.exe
- Size 408KB
- SHA256 c8aec2e54880a0180313f09dcff00ad434c93daca5ceb23216b65f822debaebe
- MD5 4ad6600edb5943dcfad8f0e30c3baba2
- SHA1 9b9e077e235cf7672d8a665081edd856732be89f
- SHA512 4ee728b093f3a3be7fda8d6f6ca3dfc7fe5e89202678f05d7ec827d843c55a2dd3176f3fabdf7a011651473712590dfb16190abc70ef3e48e9adbfa1f003efee
- SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGoldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{36573346-9B5B-4138-8730-AA8D94B110CC}.exe
- Size 408KB
- SHA256 a5a1691f6e2a6b22c60e524cfa12c6a62ddf25b1e5b5c4bbc2f8f8572c8214b5
- MD5 a2fad02353a7749f513ea67149ba0e72
- SHA1 7e25f221125eadb48bb5088397583e69ccf2a56c
- SHA512 b842eecfc77a87fc2efc79585bb1b7b7de671f33a86b45391e4658b8f952d396523c64560d76f2f91b1856af338b8ce6bb8d2b8e75fd0e01305622bd8c9b268e
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGildOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6DD2F7B2-43E8-4688-BBED-5C223B0EC91B}.exe
- Size 408KB
- SHA256 c16b8777677a2ad2d6d0645f733bc5eb27fb5a50bed9107ce03c160c2b1a300f
- MD5 a7ae98164748154f7da1c5a5ddc66278
- SHA1 5ffd5fd7bd87d6c185686df56858e83f94db8315
- SHA512 0609f7ad1d530071b5b6a01500d8614f7b1cac12cef603fd89ec95b1ef7b5cc91b997aea62ab1374a71a266d0b9c04121faeae64ba85927e04584918f52ca4f7
- SSDEEP 3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGZldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{779F5F82-018F-4953-A23D-4E3357F3B80C}.exe
- Size 408KB
- SHA256 68dcedfb29f2ff35f5ae1da8a3f72a96cb095418de2befc2f0aa11fc0d32735f
- MD5 1c366d7497d8efb2a4f3832d24b771ab
- SHA1 b42c35f205aef0e8ef69b46bc106516b849d86c9
- SHA512 aed0d97209350ef50311a3eaaac4b859e901db33e9a07164b49cbf0b8943c687520a913b257060bededb5953c7e1ccb6a61b79919fcbeefe8ca83a1667889603
- SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGXldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9225E8AD-AA6A-44b1-8C00-F6BDCCD15662}.exe
- Size 408KB
- SHA256 51b4918ae6d1ebf663aaabf0790287282e0b6d974e594fa6bad1677a7f1d3bf8
- MD5 ae453737a87bdb03c67ee7987cd8b9bf
- SHA1 65c037d08831ac92d57211178a02d5224caeb706
- SHA512 a79f948846cecd902665e86a521e761633de7c2a10ed36e641c70b4110c2e8f57a6b7a6986abb406ad7acd46440a70f5e81fa0403079871672840f12fb82fd48
- SSDEEP 3072:CEGh0oJl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGzldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A458210E-70B2-4d03-91B6-CE49E9E410B4}.exe
- Size 408KB
- SHA256 6524a31114e0922d7e89836d0045816c49691153fb20cfefe8a23661b7984eae
- MD5 b68d1f2f4eff7586a4c962e776c44dc8
- SHA1 e67fe6be4cd7e221674400e571adcb033202d9ff
- SHA512 448aaf7e4c85919f24ee40ab28272d7305cd7dfea93251fa0ef610909f452783201ecb2a87a54e88d8678947a13ebd9b4a1f59aefa04e6640f897bced7c09ae4
- SSDEEP 3072:CEGh0o3l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGhldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A8FB5ED7-F3E8-479e-890C-5C6D0A2C1797}.exe
- Size 408KB
- SHA256 71c3b39079068aafcc713ac88ee53ea65de66584573b676a95e893ca37a656aa
- MD5 c7c7926fc3231f5f47ab8aefbfac6fd2
- SHA1 bed54752632c0928f8dc06a45cb6b13e4458732d
- SHA512 26b16bb174ed904999f2be0edc90fdbe9490421246f3da199e48287c22e57f87059a7412e6cb78c770611c9dfd96b18c9934ba5ceaac0f7fb686113596937d6d
- SSDEEP 3072:CEGh0oPl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG5ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D11B6E76-5555-43be-8D1D-2FFB3B1F9557}.exe
- Size 408KB
- SHA256 9f42041890243062232c1c62409972f8e1da91ab490b987cbcd0964f87888490
- MD5 05418c647bc9cdd4398afbf05cdb60ed
- SHA1 4192d4e8cad846fa73dc8d6ae5e1e1464b775f8c
- SHA512 be3aadece71951b4378a806531449392747abd29e1d73f302a793e9b7a33a286a08f4fdcc8500ea052be708a94f221fe34730420e5dcf7184ae62e820c958446
- SSDEEP 3072:CEGh0oTl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGhldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DA9CFB8A-EA7F-4856-A3D8-E7A3FBA5F8C9}.exe
- Size 408KB
- SHA256 18116fa3661bf88ba11503f661532fa03d5f736d8f2c28bc9e0e977df246206c
- MD5 a23dcf93a7ddc14e1dc3c9bc5ab14b77
- SHA1 947c1c851064758624bd0d4dfb30e84132f2954e
- SHA512 1fa9835a284aa10b2f2f027c354ac51751ba3d0c762f433f369d2ab3b4747bb85f9ce30afc709dd017b2ffd3c9f0554a04feda56ffaf1170a3a5a3a0b403ae9b
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F309659E-19F2-4e11-95A9-5CE0059DD32B}.exe
- Size 408KB
- SHA256 5ea69105da7b0e41db251de5fbf8144f38b48a0755684a331cab15b3989d94cd
- MD5 cef72190a7777416c4ef1467ce5e64d9
- SHA1 0b9338a6defd37c25e5d594d378f41b43464d8f1
- SHA512 ee6295fec8ee3e1f5781d008c67a8e25b99b68bf7c241d08c4edd3f00934b143c33603816909f75c82b0a7523cdb3db70d1ca2e81130341aa831c088ef60590d
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP