Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe
- Size 168KB
- Sample240404-ptdjdagc39
- SHA256 ea111e987f05eafdbe28fd42777ed5c29dd9bc692526656257546fa8295d0737
- MD5 5c982ec9af28da155a2ab51d64df4b0c
- SHA1 aea22028fe47ff886c27a4243aa9a37eb83af639
- SHA512 70f12788122a9883f80135911cc9fa6ab3d6d28c0c780b25376be9b1b9034e51de39403d684cdd5292c09eec3635503559b14df7352f3a4e571beb389f30c630
- SSDEEP 1536:1EGh0ovli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ovliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000200000001e6ae-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023208-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002320e-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023208-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021f82-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021f83-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021f82-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000705-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32} 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}\stubpath = "C:\\Windows\\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe" {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11119DED-AC1B-4c06-A85F-B7010A94829A} {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11119DED-AC1B-4c06-A85F-B7010A94829A}\stubpath = "C:\\Windows\\{11119DED-AC1B-4c06-A85F-B7010A94829A}.exe" {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95} {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32}\stubpath = "C:\\Windows\\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe" 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40BA9714-6752-45eb-85CB-346DBE2D6D13}\stubpath = "C:\\Windows\\{40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe" {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05FEC6BB-1CB5-4687-8AE5-5B875202A668} {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1ECF315-6217-4412-B122-1D5B9D60DECF}\stubpath = "C:\\Windows\\{A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe" {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}\stubpath = "C:\\Windows\\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}.exe" {A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40BA9714-6752-45eb-85CB-346DBE2D6D13} {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D} {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CCBAA00-1036-4b17-AF37-B80F115087B8} {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71} {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC} {A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71}\stubpath = "C:\\Windows\\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe" {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05FEC6BB-1CB5-4687-8AE5-5B875202A668}\stubpath = "C:\\Windows\\{05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe" {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95}\stubpath = "C:\\Windows\\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe" {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CCBAA00-1036-4b17-AF37-B80F115087B8}\stubpath = "C:\\Windows\\{2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe" {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED} {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED}\stubpath = "C:\\Windows\\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe" {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F179D767-D1A2-4fae-87C7-2667A91C8717} {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F179D767-D1A2-4fae-87C7-2667A91C8717}\stubpath = "C:\\Windows\\{F179D767-D1A2-4fae-87C7-2667A91C8717}.exe" {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1ECF315-6217-4412-B122-1D5B9D60DECF} {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe - Executes dropped EXE 12 IoCs
pid Process 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 2324 {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe 1360 {A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe 2404 {FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe File created C:\Windows\{A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe File created C:\Windows\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}.exe {A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe File created C:\Windows\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe File created C:\Windows\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe File created C:\Windows\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe File created C:\Windows\{F179D767-D1A2-4fae-87C7-2667A91C8717}.exe {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe File created C:\Windows\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe File created C:\Windows\{40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe File created C:\Windows\{2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe File created C:\Windows\{11119DED-AC1B-4c06-A85F-B7010A94829A}.exe {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe File created C:\Windows\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe Token: SeIncBasePriorityPrivilege 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe Token: SeIncBasePriorityPrivilege 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe Token: SeIncBasePriorityPrivilege 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe Token: SeIncBasePriorityPrivilege 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe Token: SeIncBasePriorityPrivilege 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe Token: SeIncBasePriorityPrivilege 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe Token: SeIncBasePriorityPrivilege 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe Token: SeIncBasePriorityPrivilege 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe Token: SeIncBasePriorityPrivilege 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe Token: SeIncBasePriorityPrivilege 2324 {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe Token: SeIncBasePriorityPrivilege 1360 {A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 3796 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 91 PID 2428 wrote to memory of 3796 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 91 PID 2428 wrote to memory of 3796 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 91 PID 2428 wrote to memory of 3924 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 92 PID 2428 wrote to memory of 3924 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 92 PID 2428 wrote to memory of 3924 2428 2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe 92 PID 3796 wrote to memory of 1456 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 96 PID 3796 wrote to memory of 1456 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 96 PID 3796 wrote to memory of 1456 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 96 PID 3796 wrote to memory of 4600 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 97 PID 3796 wrote to memory of 4600 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 97 PID 3796 wrote to memory of 4600 3796 {6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe 97 PID 1456 wrote to memory of 3300 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 99 PID 1456 wrote to memory of 3300 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 99 PID 1456 wrote to memory of 3300 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 99 PID 1456 wrote to memory of 1316 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 100 PID 1456 wrote to memory of 1316 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 100 PID 1456 wrote to memory of 1316 1456 {40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe 100 PID 3300 wrote to memory of 3616 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 101 PID 3300 wrote to memory of 3616 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 101 PID 3300 wrote to memory of 3616 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 101 PID 3300 wrote to memory of 3540 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 102 PID 3300 wrote to memory of 3540 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 102 PID 3300 wrote to memory of 3540 3300 {8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe 102 PID 3616 wrote to memory of 3484 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 103 PID 3616 wrote to memory of 3484 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 103 PID 3616 wrote to memory of 3484 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 103 PID 3616 wrote to memory of 2564 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 104 PID 3616 wrote to memory of 2564 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 104 PID 3616 wrote to memory of 2564 3616 {2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe 104 PID 3484 wrote to memory of 3856 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 105 PID 3484 wrote to memory of 3856 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 105 PID 3484 wrote to memory of 3856 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 105 PID 3484 wrote to memory of 3636 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 106 PID 3484 wrote to memory of 3636 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 106 PID 3484 wrote to memory of 3636 3484 {CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe 106 PID 3856 wrote to memory of 4392 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 107 PID 3856 wrote to memory of 4392 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 107 PID 3856 wrote to memory of 4392 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 107 PID 3856 wrote to memory of 4476 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 108 PID 3856 wrote to memory of 4476 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 108 PID 3856 wrote to memory of 4476 3856 {11119DED-AC1B-4c06-A85F-B7010A94829A}.exe 108 PID 4392 wrote to memory of 1884 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 109 PID 4392 wrote to memory of 1884 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 109 PID 4392 wrote to memory of 1884 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 109 PID 4392 wrote to memory of 3536 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 110 PID 4392 wrote to memory of 3536 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 110 PID 4392 wrote to memory of 3536 4392 {F179D767-D1A2-4fae-87C7-2667A91C8717}.exe 110 PID 1884 wrote to memory of 4576 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 111 PID 1884 wrote to memory of 4576 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 111 PID 1884 wrote to memory of 4576 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 111 PID 1884 wrote to memory of 2356 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 112 PID 1884 wrote to memory of 2356 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 112 PID 1884 wrote to memory of 2356 1884 {6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe 112 PID 4576 wrote to memory of 2324 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 113 PID 4576 wrote to memory of 2324 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 113 PID 4576 wrote to memory of 2324 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 113 PID 4576 wrote to memory of 436 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 114 PID 4576 wrote to memory of 436 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 114 PID 4576 wrote to memory of 436 4576 {05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe 114 PID 2324 wrote to memory of 1360 2324 {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe 115 PID 2324 wrote to memory of 1360 2324 {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe 115 PID 2324 wrote to memory of 1360 2324 {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe 115 PID 2324 wrote to memory of 2776 2324 {CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_5c982ec9af28da155a2ab51d64df4b0c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exeC:\Windows\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\{40BA9714-6752-45eb-85CB-346DBE2D6D13}.exeC:\Windows\{40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exeC:\Windows\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\{2CCBAA00-1036-4b17-AF37-B80F115087B8}.exeC:\Windows\{2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exeC:\Windows\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\{11119DED-AC1B-4c06-A85F-B7010A94829A}.exeC:\Windows\{11119DED-AC1B-4c06-A85F-B7010A94829A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\{F179D767-D1A2-4fae-87C7-2667A91C8717}.exeC:\Windows\{F179D767-D1A2-4fae-87C7-2667A91C8717}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exeC:\Windows\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\{05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exeC:\Windows\{05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exeC:\Windows\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\{A1ECF315-6217-4412-B122-1D5B9D60DECF}.exeC:\Windows\{A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1360 -
C:\Windows\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}.exeC:\Windows\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}.exe13⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1ECF~1.EXE > nul13⤵PID:5024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC120~1.EXE > nul12⤵PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05FEC~1.EXE > nul11⤵PID:436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A446~1.EXE > nul10⤵PID:2356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F179D~1.EXE > nul9⤵PID:3536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11119~1.EXE > nul8⤵PID:4476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB190~1.EXE > nul7⤵PID:3636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CCBA~1.EXE > nul6⤵PID:2564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A39E~1.EXE > nul5⤵PID:3540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40BA9~1.EXE > nul4⤵PID:1316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F409~1.EXE > nul3⤵PID:4600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{05FEC6BB-1CB5-4687-8AE5-5B875202A668}.exe
- Size 168KB
- SHA256 f75b4bfbf28bfb5418eb1a9424c8180cf536541c92dcdd715dc1fd4233020b48
- MD5 85f24555d256048d1f133d1ca4f508dd
- SHA1 e737dbdd461afcda0c0d54d9dd194e9f6233b2ed
- SHA512 fa180a8a30d746f2d69051d5390a54a3f3135c18072ca2e240ceeb5df43b730efe33323d8659b4d4dee5106855c152f98b2792c25f54be45f354c1c19d00a658
- SSDEEP 1536:1EGh0oali5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oaliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{11119DED-AC1B-4c06-A85F-B7010A94829A}.exe
- Size 168KB
- SHA256 9ed5a06695b4efdab50031b9e7b23803e85b71a3c0724620e96d8536c012a108
- MD5 91a16f1e48e1fa27328107a142e627be
- SHA1 f06191868c88e11888a912e4718c7740d7e0a5d5
- SHA512 340f6328f326edd7f55f59dbaf6cef87267f3ad7eaa1e05e52fb15eb074c866d2e5c397da6ef5365667faa2726649d2f1058801038c9922aa4372ee4749f5c45
- SSDEEP 1536:1EGh0o+li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o+liOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2CCBAA00-1036-4b17-AF37-B80F115087B8}.exe
- Size 168KB
- SHA256 10b4be76283d33835aee800800823d33eda79f3d316f8d0d621eebbabd85e951
- MD5 f6e78fb8dc1d28a4fa9469bcc4a78849
- SHA1 8fbdb5cc0327a2189eb67a1a8025a9fa65217160
- SHA512 23fb4a22927f1897f07fc9a992945c733622310ae47d56b8de106a19d1844e7a68ff3a5b330868eed670d6d8a183d76c74f666a000cf75e0819068bab0e7708a
- SSDEEP 1536:1EGh0orli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0orliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{40BA9714-6752-45eb-85CB-346DBE2D6D13}.exe
- Size 168KB
- SHA256 0be90469f36245b407085db9213c5cc5216339cf576cab16fc8c48b9924637bf
- MD5 d0cc0cdc8c795fdb14710cb7d6dec9bd
- SHA1 afcc20c766fa9888d70fb526c11e370a71a79309
- SHA512 413f8daa3d716b1d49059ae74be34d094ce53f4b8bf26b87f9700e248f3461c66b4f84539b64270b87ce20673e13975ecf94e065edc2d6ad711311960f9d20e4
- SSDEEP 1536:1EGh0omli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0omliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6A446456-5CA1-43b5-8C77-B62CDA5AFF71}.exe
- Size 168KB
- SHA256 ea9794b0013ee5c9d757dfe699fa61f7e7853f255b310e3b3aa6933a1550f141
- MD5 0f5e7f41bef4793fe8e2bcf059491d1a
- SHA1 2561514982f0c5877d3d77b6cbd67f328181597e
- SHA512 7052b5bd341d3ae3e10dc4ab7136c69d499ce431491f0470ece499d267b7c2c60e642e353f00e9fe120fa86733da53e8deb4c3c4ebc93b010173001d9ccfcc3a
- SSDEEP 1536:1EGh0o/li5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o/liOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6F409C6E-DAEA-42b9-B97C-20554EDFEA32}.exe
- Size 168KB
- SHA256 893e5d73c44ddebc5ae89fc52fb0f4b8b0b568433abd48a38b71c493b606cfd5
- MD5 720ace48f009dcd4765fa74751d478ea
- SHA1 1d851a447034e0afad60d31978c2e9a945d81e11
- SHA512 ec7731b6c0fa304b7478c475be22f1662943c0ddf8ed7752a02a60535bcae5c314229b0cd279d267546d7370a8aadfea63b73c5e3d0474b82db561bf8994c42e
- SSDEEP 1536:1EGh0oOli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8A39E4CA-FC7A-46f1-8A1E-458EA46C445D}.exe
- Size 168KB
- SHA256 2f172083b7303355ed9ee419053a80975a5055002a6b0b73c14490551e52dd7b
- MD5 d5660b4f0e72a893ea23c196a06e73bf
- SHA1 fdfd5d69a87127c33f85898f9e14f7f561217302
- SHA512 827f4982e8e22b77fcc712872675f2d910e496c81d1e2df8f155b8eacbf0cf7d84dc8c091b440fbfb3bff4e1265723aec9edc9c701be0d4b49d838a1a195be76
- SSDEEP 1536:1EGh0okli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0okliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A1ECF315-6217-4412-B122-1D5B9D60DECF}.exe
- Size 168KB
- SHA256 07ec1726222215f26ab27aec6987644bf582247b53c9755026d1492065b5b6e5
- MD5 77bd6033a008110ba2ed31b88ff9f5a0
- SHA1 c11c6b0ce294281eb84a3749b59702ea44a07c6e
- SHA512 4db74bd2fd120f32aa50dc0a6542ac2cfc81a04d1b0b4326c4249b2ac55037db48c8ac07cd88ee2593987e1916fe1afed4f144372c89f36740359744e8546f95
- SSDEEP 1536:1EGh0osli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0osliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CB19064E-F3FC-426b-B0A6-6DBD4A695DED}.exe
- Size 168KB
- SHA256 ee5ff115fba6e83ef16fa4bac2abdb4752068cd5c6f744b05cb21c1b3778cf94
- MD5 58236f4e466bc84e42cfbc9d1b4af6e1
- SHA1 26055bcb34be12354541edd22e260ba333e2d1c2
- SHA512 2763837f505e98f2ceb7668445d3331c0fdd0e44aaa9581437da568139b80d72f606bd6f51e3bbf43ef2d74370bdf69c51e0e07a2a1f1d308fd8f0e65e47740b
- SSDEEP 1536:1EGh0ojli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CC1201C9-E3CE-450f-8FB2-AE12CE762E95}.exe
- Size 168KB
- SHA256 071c5c35938c2b8da827c1c6630741fc3b737de4722ae21de7dc7e784f9ce274
- MD5 0abdb97579fb8e3994b9366b4ec4fd89
- SHA1 0e9d41e161360dc0bfadee58179851c04a9c25ef
- SHA512 60586c08c37f2434495392f6786a4c48516ba4928803abf07fb9c7a8ccca41edd8c334d19b9a202901f463e8e8598dad24dd1b69396c67ea145143c493087270
- SSDEEP 1536:1EGh0ouli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ouliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F179D767-D1A2-4fae-87C7-2667A91C8717}.exe
- Size 168KB
- SHA256 54d11ff27c72387e17cc286b4375b010482ef7d1c505f388068637bf04c6d130
- MD5 f41e2ba680a3e341834fe43d74144744
- SHA1 e844395ea1720ecda61f15c406585ccade190edf
- SHA512 9030fd3fd6061c6d7c0f667ef6e0dc29e0576268b82e7879c4caf5d88502047a923f0dc6cdab6411ff617adbfcc5612ac7f186a14e675f362a1cb35549d9270d
- SSDEEP 1536:1EGh0oWli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oWliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FA6D4439-BDEE-48a6-8CD3-6CA3561838FC}.exe
- Size 168KB
- SHA256 eb43679087fbc3f60979aa10ad5b350997c4a3534226f6fcc206e8666b30fb00
- MD5 af975603a06f1f6c3247a5618e1c3d3c
- SHA1 ac5d83ce00b852e972bd8ef0da14d569528e92d3
- SHA512 2c307ffb62f6a2a4f348f86531e8198620af3fbac81f7f329f699be916eaf66beffb03030ebe1f00e3321654c85cef1a94789935101a86da5590180da8e5ad89
- SSDEEP 1536:1EGh0orli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0orliOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP