Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe
- Size 408KB
- Sample240404-py3n3agf22
- SHA256 e2f138b2f7b9ae34b9f3211738d94ce064429ca3d1b74dc94924a57696887dbd
- MD5 9773f07c6fef4418e415f616aa6c10b2
- SHA1 28b1c29fe8016e69ab4bc0a7e7be986464180b4d
- SHA512 ae6bba825f5ce89657d9af13c333e9406b5b2c4a6cdc18f1a55c1e6b45100ba91fb3787359c87e833169766a85f28be5cbbd13f175d1b2ce492be02f618071dd
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000600000002322e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023235-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002323c-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000001e804-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021f82-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000001e804-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021f82-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000705-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B18D4C9-744A-48a1-A4EC-888A84826B1B} {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}\stubpath = "C:\\Windows\\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}.exe" {9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42} {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}\stubpath = "C:\\Windows\\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe" {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{476A0770-7871-4215-BBC6-60E144443EC8} {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C96900AC-F698-4c62-9C99-7C887C1AD118} {476A0770-7871-4215-BBC6-60E144443EC8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16502764-86A1-44a9-B9FD-06E1EB4D8589} {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16502764-86A1-44a9-B9FD-06E1EB4D8589}\stubpath = "C:\\Windows\\{16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe" {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B18D4C9-744A-48a1-A4EC-888A84826B1B}\stubpath = "C:\\Windows\\{9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe" {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74373959-1979-46fd-B48E-5D8DCA56E1CD} 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A}\stubpath = "C:\\Windows\\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe" {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A} {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}\stubpath = "C:\\Windows\\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe" {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{476A0770-7871-4215-BBC6-60E144443EC8}\stubpath = "C:\\Windows\\{476A0770-7871-4215-BBC6-60E144443EC8}.exe" {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AEB551F-DE74-4da6-B36A-33D3288F0861} {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AEB551F-DE74-4da6-B36A-33D3288F0861}\stubpath = "C:\\Windows\\{8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe" {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C} {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74373959-1979-46fd-B48E-5D8DCA56E1CD}\stubpath = "C:\\Windows\\{74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe" 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A} {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F24F335-5484-408d-978A-B0DC13D7AAB6} {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F24F335-5484-408d-978A-B0DC13D7AAB6}\stubpath = "C:\\Windows\\{7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe" {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C96900AC-F698-4c62-9C99-7C887C1AD118}\stubpath = "C:\\Windows\\{C96900AC-F698-4c62-9C99-7C887C1AD118}.exe" {476A0770-7871-4215-BBC6-60E144443EC8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C}\stubpath = "C:\\Windows\\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe" {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE} {9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe - Executes dropped EXE 12 IoCs
pid Process 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 3076 {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe 1660 {9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe 3948 {F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe File created C:\Windows\{74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe File created C:\Windows\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe File created C:\Windows\{7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe File created C:\Windows\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe File created C:\Windows\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe File created C:\Windows\{9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe File created C:\Windows\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}.exe {9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe File created C:\Windows\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe File created C:\Windows\{476A0770-7871-4215-BBC6-60E144443EC8}.exe {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe File created C:\Windows\{C96900AC-F698-4c62-9C99-7C887C1AD118}.exe {476A0770-7871-4215-BBC6-60E144443EC8}.exe File created C:\Windows\{8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe Token: SeIncBasePriorityPrivilege 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe Token: SeIncBasePriorityPrivilege 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe Token: SeIncBasePriorityPrivilege 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe Token: SeIncBasePriorityPrivilege 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe Token: SeIncBasePriorityPrivilege 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe Token: SeIncBasePriorityPrivilege 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe Token: SeIncBasePriorityPrivilege 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe Token: SeIncBasePriorityPrivilege 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe Token: SeIncBasePriorityPrivilege 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe Token: SeIncBasePriorityPrivilege 3076 {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe Token: SeIncBasePriorityPrivilege 1660 {9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 3764 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 92 PID 1620 wrote to memory of 3764 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 92 PID 1620 wrote to memory of 3764 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 92 PID 1620 wrote to memory of 3488 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 93 PID 1620 wrote to memory of 3488 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 93 PID 1620 wrote to memory of 3488 1620 2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe 93 PID 3764 wrote to memory of 3512 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 94 PID 3764 wrote to memory of 3512 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 94 PID 3764 wrote to memory of 3512 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 94 PID 3764 wrote to memory of 4900 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 95 PID 3764 wrote to memory of 4900 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 95 PID 3764 wrote to memory of 4900 3764 {74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe 95 PID 3512 wrote to memory of 4528 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 97 PID 3512 wrote to memory of 4528 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 97 PID 3512 wrote to memory of 4528 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 97 PID 3512 wrote to memory of 3276 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 98 PID 3512 wrote to memory of 3276 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 98 PID 3512 wrote to memory of 3276 3512 {C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe 98 PID 4528 wrote to memory of 2084 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 99 PID 4528 wrote to memory of 2084 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 99 PID 4528 wrote to memory of 2084 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 99 PID 4528 wrote to memory of 2800 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 100 PID 4528 wrote to memory of 2800 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 100 PID 4528 wrote to memory of 2800 4528 {ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe 100 PID 2084 wrote to memory of 4792 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 101 PID 2084 wrote to memory of 4792 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 101 PID 2084 wrote to memory of 4792 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 101 PID 2084 wrote to memory of 4556 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 102 PID 2084 wrote to memory of 4556 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 102 PID 2084 wrote to memory of 4556 2084 {7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe 102 PID 4792 wrote to memory of 4056 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 103 PID 4792 wrote to memory of 4056 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 103 PID 4792 wrote to memory of 4056 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 103 PID 4792 wrote to memory of 3956 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 104 PID 4792 wrote to memory of 3956 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 104 PID 4792 wrote to memory of 3956 4792 {2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe 104 PID 4056 wrote to memory of 4220 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 105 PID 4056 wrote to memory of 4220 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 105 PID 4056 wrote to memory of 4220 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 105 PID 4056 wrote to memory of 3876 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 106 PID 4056 wrote to memory of 3876 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 106 PID 4056 wrote to memory of 3876 4056 {476A0770-7871-4215-BBC6-60E144443EC8}.exe 106 PID 4220 wrote to memory of 1724 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 107 PID 4220 wrote to memory of 1724 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 107 PID 4220 wrote to memory of 1724 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 107 PID 4220 wrote to memory of 3548 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 108 PID 4220 wrote to memory of 3548 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 108 PID 4220 wrote to memory of 3548 4220 {C96900AC-F698-4c62-9C99-7C887C1AD118}.exe 108 PID 1724 wrote to memory of 2300 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 109 PID 1724 wrote to memory of 2300 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 109 PID 1724 wrote to memory of 2300 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 109 PID 1724 wrote to memory of 4300 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 110 PID 1724 wrote to memory of 4300 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 110 PID 1724 wrote to memory of 4300 1724 {16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe 110 PID 2300 wrote to memory of 3076 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 111 PID 2300 wrote to memory of 3076 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 111 PID 2300 wrote to memory of 3076 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 111 PID 2300 wrote to memory of 4308 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 112 PID 2300 wrote to memory of 4308 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 112 PID 2300 wrote to memory of 4308 2300 {8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe 112 PID 3076 wrote to memory of 1660 3076 {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe 113 PID 3076 wrote to memory of 1660 3076 {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe 113 PID 3076 wrote to memory of 1660 3076 {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe 113 PID 3076 wrote to memory of 1752 3076 {7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_9773f07c6fef4418e415f616aa6c10b2_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\{74373959-1979-46fd-B48E-5D8DCA56E1CD}.exeC:\Windows\{74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exeC:\Windows\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exeC:\Windows\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\{7F24F335-5484-408d-978A-B0DC13D7AAB6}.exeC:\Windows\{7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exeC:\Windows\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\{476A0770-7871-4215-BBC6-60E144443EC8}.exeC:\Windows\{476A0770-7871-4215-BBC6-60E144443EC8}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\{C96900AC-F698-4c62-9C99-7C887C1AD118}.exeC:\Windows\{C96900AC-F698-4c62-9C99-7C887C1AD118}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\{16502764-86A1-44a9-B9FD-06E1EB4D8589}.exeC:\Windows\{16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\{8AEB551F-DE74-4da6-B36A-33D3288F0861}.exeC:\Windows\{8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exeC:\Windows\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\{9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exeC:\Windows\{9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}.exeC:\Windows\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}.exe13⤵
- Executes dropped EXE
PID:3948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B18D~1.EXE > nul13⤵PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7342B~1.EXE > nul12⤵PID:1752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AEB5~1.EXE > nul11⤵PID:4308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16502~1.EXE > nul10⤵PID:4300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9690~1.EXE > nul9⤵PID:3548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{476A0~1.EXE > nul8⤵PID:3876
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C266~1.EXE > nul7⤵PID:3956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F24F~1.EXE > nul6⤵PID:4556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECED7~1.EXE > nul5⤵PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C14E6~1.EXE > nul4⤵PID:3276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74373~1.EXE > nul3⤵PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{16502764-86A1-44a9-B9FD-06E1EB4D8589}.exe
- Size 408KB
- SHA256 19a605f56d84aad51984a6bf8f7ae5af667015707d7e2cb130f57fa1dff5d504
- MD5 4c2e9971ef858a9a88b028f1d00fa0a5
- SHA1 ccd95146ab63b33b3ce4cf39e8f4197b4412377b
- SHA512 b7a8cf00ded5324405ef4bad66a5f2eb88ecfc1b18e5db89645c569a1ae8b213e94ffe95614e81b67fcd041434e342935066c0560bbef16724469ee758d9c176
- SSDEEP 3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGdldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2C2669F9-3A17-49f1-9E66-AB0AB9AE3C42}.exe
- Size 408KB
- SHA256 52d172549322e3925fa728d98055d89463db63bf012e3464fc64411352e6125e
- MD5 1bc9a7a66cb485dcdc523ac8c9fb96e6
- SHA1 0b8bd240fea6324ce671c073d09aa47a85baac59
- SHA512 a642eefac8323664e52e4d88ba81bbb9b4ebed78601afc8b4562a25410db03351864392c822bddc5b7c839331600c90d834f4e2a88c968e0c73faa134307e765
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{476A0770-7871-4215-BBC6-60E144443EC8}.exe
- Size 408KB
- SHA256 7a8571aa1dd9e9b47501c57a4c4c60bee2fcae2653be3db7f3d47cc25a40b6ad
- MD5 e7c4fbca3053bdf9057d36881566a118
- SHA1 31282a7073897ee221a4518c46e43f4ff00ace83
- SHA512 9c58fc81a600afc3ed87bb349a65431f817d625772aed7c933ce518c9289509d0986e33bb2f5720e45151317279729144a498d3c3433ba2339157ff4c59e383f
- SSDEEP 3072:CEGh0oDl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG5ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7342B589-AD73-41fc-B0A4-FC778EDFFE0C}.exe
- Size 408KB
- SHA256 04b441bd0b57ab5f64966aa7f89f057bdef10a4089a2e174ab350023df81d386
- MD5 7e4c7260f12f0483cb318f32bcd88cf6
- SHA1 9e638d8452d447172a248ebb2ee7e933dd207f38
- SHA512 a88bc7fbed5798efc94de8f98d2220471e661c92b5f4eb77a31136af629ae39d7e6203b07e98b0f1125fc0c49f65dbe7534dc74c154535eb87ad1ffa7d9b5ce8
- SSDEEP 3072:CEGh0o3Al3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf:CEGeldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{74373959-1979-46fd-B48E-5D8DCA56E1CD}.exe
- Size 408KB
- SHA256 c83b2aeb3aa0386f79b5744e2c5b7747091ca081d887623cbacae73cff4e58b6
- MD5 d68af4605c1ba6f9483c3a6f76e36d62
- SHA1 1cb9b6960c0d1e36ac13daa02d8daea477d1e7b0
- SHA512 6756d4cf222ae3b420f643b6ee58c91ac10bd6f170d9cc57fd0021cf787fd407c516ee34797634e180244d58d6989e5f06bf82ee1c3624541e1bef5bc7836192
- SSDEEP 3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGXldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F24F335-5484-408d-978A-B0DC13D7AAB6}.exe
- Size 408KB
- SHA256 6e5a79965f3e1459e15bf1c0d6c8489e6ad5d6903722cb2702a46a0d278344b5
- MD5 08832f5876aba9f9ee037e8cb96a4e1f
- SHA1 02355989e1e4109c5f3473c067d4a0e777d62c24
- SHA512 4a6ac31d552849c886103dc0a861b87eb19e5b61c63a756a8c6207339f5e63dfdc406953513ce1ddcccb314ca910162139744b1eaf9fe40b92be705f4c27abbc
- SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGuldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8AEB551F-DE74-4da6-B36A-33D3288F0861}.exe
- Size 408KB
- SHA256 41d2d6eeccececbcb18e9ac5426078876079c45efbb0dc42f7e9d2b03fd3f299
- MD5 4c6d4ea136dffc606de7a79437161321
- SHA1 52579009c31f25528c6959d2e2130422f238c0fa
- SHA512 a79f4dc852502d8bd23de6970fd707bb2a41ac0192bebd413247c73332fa82be7355af261c4e400e5075dc1c2a66fcc378eb4fc03ff0fbbac85ddcf3dea1f099
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9B18D4C9-744A-48a1-A4EC-888A84826B1B}.exe
- Size 408KB
- SHA256 5b9ec3e05c2a76e39745d09a10265ed6af07efde0c43a64da41411496db563da
- MD5 b51fe76a06109d448b8b3def98dc28c1
- SHA1 694d1d603afac270ff7f870e65e947c60966da4e
- SHA512 554f2de319b56c3275ff8b3f53713c478f04bc0ad8b5a757e95c2583326916d72ba093832f3701f1ac285c6f782a63ca2d1cb77f9c89c4e1c68ebb61ff2ee616
- SSDEEP 3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGTldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C14E6FC7-D469-4e3c-B811-D6110C27FE8A}.exe
- Size 408KB
- SHA256 66ca8209f72fa32557edcf68e23afe695e1e552f04bc7bf5a527b761ea8bf407
- MD5 b6d1aa023feeaf6bc3f020de99890baa
- SHA1 49e764c6a4dcb5630cba58700910d66620c6fd6f
- SHA512 4bc51ab29c8d8c8c9d38483edee7a842a208d92029886a3f8a307fbed740f732e0d2abb11b91615b22f31145c62d630d4d17480dd76dd09477b56375e688839e
- SSDEEP 3072:CEGh0o3l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C96900AC-F698-4c62-9C99-7C887C1AD118}.exe
- Size 408KB
- SHA256 2562d4e96c089b4f2fcc508bfdf5023b96b2418ba1f8a50ce3b11149a830a2cc
- MD5 aa4c6de03161802e211fe67baea13f78
- SHA1 1ecadf29895abdb90d814587f7d93c8de3b76ee4
- SHA512 43423bb99a311b510c6dee6740e58f0d1d3b0aafe0819161c387aff6f170588e803071c07763acb6ef27011268cb25c211f2acdf1336a5c62c467dbda6f1ade8
- SSDEEP 3072:CEGh0oFl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG/ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ECED720E-FB1C-4b6f-A1E0-CCD0AF3BCD5A}.exe
- Size 408KB
- SHA256 4d81eafb89966a2cd807efb3274e03846fd4b340e2adfeb30b6d19793e6e48ea
- MD5 ee1153d2febcfff315c6071cce361d89
- SHA1 f826f51dd04c2256fd15de217afa1b66cc91f106
- SHA512 145dd1efc91b082b073d79d9f370a64b5d3c1cb115272601c350295434211a6d338b5cedcc1752c6fff0ad139cae98495355e15c1b92c5f7d1a4d1389f0e9253
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F1E6CA37-7A4F-49a1-A5CF-D8CA8DAFC6BE}.exe
- Size 408KB
- SHA256 10a390563ab6d3a590a7efdb1ee833821187b7e898c502213f1c89150afc2c79
- MD5 8b0c955711bf3dffc84d6d738f35a42a
- SHA1 264b1981141ac8989c66e4937337d99d37266955
- SHA512 dcc76bcf8c72123b814ac9e90cbba201a7cac3fd2db25d9457492905bca9c19ff7378ee11167ec1e343e460c329a985adc7c2b51e8bc084e3d554b503416f71e
- SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGXldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP