Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 13:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe
- Size 204KB
- Sample240404-q9dprahf4y
- SHA256 f65ec083984ba540f0f87cc5a11dbca6d74be864d25d028b21084bf76f4d21b2
- MD5 db6501e5cb899357ec9d2807517217ff
- SHA1 33505c88995832ce9b67fc85ed524d17a81cb5dc
- SHA512 78999caec49a29a5116618032381da451f09a2948f7747f3049fc287a4c0780851a1f1d3db87d28c79752905b67ec89b8aa30137d1f9ca3274cfe992f6e278dc
- SSDEEP 1536:1EGh0oDl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oDl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000a000000023330-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023325-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00040000000167e1-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231f8-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00050000000167e1-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000231f8-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00060000000167e1-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d0000000231f8-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000230e5-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000230ea-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000230e5-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023106-45.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E03F1FED-953A-4486-8F29-12891C3B1287} {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5} {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16527D78-2724-4fb2-ACEA-393807579459} {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}\stubpath = "C:\\Windows\\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe" {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49653CF3-0F02-4280-A698-47AF15F1F3BB} {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49653CF3-0F02-4280-A698-47AF15F1F3BB}\stubpath = "C:\\Windows\\{49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe" {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99F94F5A-8806-4a9c-BB3E-1609896927A7} {49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}\stubpath = "C:\\Windows\\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe" {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A} {16527D78-2724-4fb2-ACEA-393807579459}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99F94F5A-8806-4a9c-BB3E-1609896927A7}\stubpath = "C:\\Windows\\{99F94F5A-8806-4a9c-BB3E-1609896927A7}.exe" {49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBB86726-D962-49c1-A82E-6A446FC68E9E}\stubpath = "C:\\Windows\\{CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe" {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702} {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBB86726-D962-49c1-A82E-6A446FC68E9E} {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4843FBD-2561-4db5-A00F-A0CF9395C59E} {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8} {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D} 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E03F1FED-953A-4486-8F29-12891C3B1287}\stubpath = "C:\\Windows\\{E03F1FED-953A-4486-8F29-12891C3B1287}.exe" {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5928463-4E5D-4f82-BB51-24AA5154A416} {E03F1FED-953A-4486-8F29-12891C3B1287}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5928463-4E5D-4f82-BB51-24AA5154A416}\stubpath = "C:\\Windows\\{B5928463-4E5D-4f82-BB51-24AA5154A416}.exe" {E03F1FED-953A-4486-8F29-12891C3B1287}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}\stubpath = "C:\\Windows\\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe" {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16527D78-2724-4fb2-ACEA-393807579459}\stubpath = "C:\\Windows\\{16527D78-2724-4fb2-ACEA-393807579459}.exe" {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}\stubpath = "C:\\Windows\\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe" {16527D78-2724-4fb2-ACEA-393807579459}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4843FBD-2561-4db5-A00F-A0CF9395C59E}\stubpath = "C:\\Windows\\{F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe" {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D}\stubpath = "C:\\Windows\\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe" 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe - Executes dropped EXE 12 IoCs
pid Process 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 3220 {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe 3724 {49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe 1808 {99F94F5A-8806-4a9c-BB3E-1609896927A7}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe File created C:\Windows\{99F94F5A-8806-4a9c-BB3E-1609896927A7}.exe {49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe File created C:\Windows\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe File created C:\Windows\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe File created C:\Windows\{CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe File created C:\Windows\{E03F1FED-953A-4486-8F29-12891C3B1287}.exe {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe File created C:\Windows\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe File created C:\Windows\{B5928463-4E5D-4f82-BB51-24AA5154A416}.exe {E03F1FED-953A-4486-8F29-12891C3B1287}.exe File created C:\Windows\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe File created C:\Windows\{16527D78-2724-4fb2-ACEA-393807579459}.exe {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe File created C:\Windows\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe {16527D78-2724-4fb2-ACEA-393807579459}.exe File created C:\Windows\{F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe Token: SeIncBasePriorityPrivilege 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe Token: SeIncBasePriorityPrivilege 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe Token: SeIncBasePriorityPrivilege 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe Token: SeIncBasePriorityPrivilege 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe Token: SeIncBasePriorityPrivilege 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe Token: SeIncBasePriorityPrivilege 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe Token: SeIncBasePriorityPrivilege 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe Token: SeIncBasePriorityPrivilege 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe Token: SeIncBasePriorityPrivilege 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe Token: SeIncBasePriorityPrivilege 3220 {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe Token: SeIncBasePriorityPrivilege 3724 {49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 1444 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe 107 PID 4132 wrote to memory of 1444 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe 107 PID 4132 wrote to memory of 1444 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe 107 PID 4132 wrote to memory of 1332 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe 108 PID 4132 wrote to memory of 1332 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe 108 PID 4132 wrote to memory of 1332 4132 2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe 108 PID 1444 wrote to memory of 1748 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 109 PID 1444 wrote to memory of 1748 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 109 PID 1444 wrote to memory of 1748 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 109 PID 1444 wrote to memory of 2096 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 110 PID 1444 wrote to memory of 2096 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 110 PID 1444 wrote to memory of 2096 1444 {DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe 110 PID 1748 wrote to memory of 1216 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 113 PID 1748 wrote to memory of 1216 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 113 PID 1748 wrote to memory of 1216 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 113 PID 1748 wrote to memory of 1332 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 114 PID 1748 wrote to memory of 1332 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 114 PID 1748 wrote to memory of 1332 1748 {4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe 114 PID 1216 wrote to memory of 4200 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 116 PID 1216 wrote to memory of 4200 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 116 PID 1216 wrote to memory of 4200 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 116 PID 1216 wrote to memory of 652 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 117 PID 1216 wrote to memory of 652 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 117 PID 1216 wrote to memory of 652 1216 {CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe 117 PID 4200 wrote to memory of 3000 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 118 PID 4200 wrote to memory of 3000 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 118 PID 4200 wrote to memory of 3000 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 118 PID 4200 wrote to memory of 3380 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 119 PID 4200 wrote to memory of 3380 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 119 PID 4200 wrote to memory of 3380 4200 {E03F1FED-953A-4486-8F29-12891C3B1287}.exe 119 PID 3000 wrote to memory of 4712 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 121 PID 3000 wrote to memory of 4712 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 121 PID 3000 wrote to memory of 4712 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 121 PID 3000 wrote to memory of 4132 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 122 PID 3000 wrote to memory of 4132 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 122 PID 3000 wrote to memory of 4132 3000 {B5928463-4E5D-4f82-BB51-24AA5154A416}.exe 122 PID 4712 wrote to memory of 1264 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 123 PID 4712 wrote to memory of 1264 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 123 PID 4712 wrote to memory of 1264 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 123 PID 4712 wrote to memory of 4052 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 124 PID 4712 wrote to memory of 4052 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 124 PID 4712 wrote to memory of 4052 4712 {FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe 124 PID 1264 wrote to memory of 3392 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 125 PID 1264 wrote to memory of 3392 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 125 PID 1264 wrote to memory of 3392 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 125 PID 1264 wrote to memory of 1744 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 126 PID 1264 wrote to memory of 1744 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 126 PID 1264 wrote to memory of 1744 1264 {16527D78-2724-4fb2-ACEA-393807579459}.exe 126 PID 3392 wrote to memory of 2236 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 134 PID 3392 wrote to memory of 2236 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 134 PID 3392 wrote to memory of 2236 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 134 PID 3392 wrote to memory of 4648 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 135 PID 3392 wrote to memory of 4648 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 135 PID 3392 wrote to memory of 4648 3392 {FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe 135 PID 2236 wrote to memory of 3220 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 136 PID 2236 wrote to memory of 3220 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 136 PID 2236 wrote to memory of 3220 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 136 PID 2236 wrote to memory of 4092 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 137 PID 2236 wrote to memory of 4092 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 137 PID 2236 wrote to memory of 4092 2236 {F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe 137 PID 3220 wrote to memory of 3724 3220 {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe 138 PID 3220 wrote to memory of 3724 3220 {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe 138 PID 3220 wrote to memory of 3724 3220 {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe 138 PID 3220 wrote to memory of 3816 3220 {8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_db6501e5cb899357ec9d2807517217ff_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exeC:\Windows\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exeC:\Windows\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\{CBB86726-D962-49c1-A82E-6A446FC68E9E}.exeC:\Windows\{CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\{E03F1FED-953A-4486-8F29-12891C3B1287}.exeC:\Windows\{E03F1FED-953A-4486-8F29-12891C3B1287}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\{B5928463-4E5D-4f82-BB51-24AA5154A416}.exeC:\Windows\{B5928463-4E5D-4f82-BB51-24AA5154A416}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exeC:\Windows\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\{16527D78-2724-4fb2-ACEA-393807579459}.exeC:\Windows\{16527D78-2724-4fb2-ACEA-393807579459}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exeC:\Windows\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\{F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exeC:\Windows\{F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exeC:\Windows\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\{49653CF3-0F02-4280-A698-47AF15F1F3BB}.exeC:\Windows\{49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3724 -
C:\Windows\{99F94F5A-8806-4a9c-BB3E-1609896927A7}.exeC:\Windows\{99F94F5A-8806-4a9c-BB3E-1609896927A7}.exe13⤵
- Executes dropped EXE
PID:1808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49653~1.EXE > nul13⤵PID:3336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F891~1.EXE > nul12⤵PID:3816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4843~1.EXE > nul11⤵PID:4092
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAEDF~1.EXE > nul10⤵PID:4648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16527~1.EXE > nul9⤵PID:1744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB12F~1.EXE > nul8⤵PID:4052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5928~1.EXE > nul7⤵PID:4132
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E03F1~1.EXE > nul6⤵PID:3380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBB86~1.EXE > nul5⤵PID:652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C449~1.EXE > nul4⤵PID:1332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE5DE~1.EXE > nul3⤵PID:2096
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3256 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:81⤵PID:4284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{16527D78-2724-4fb2-ACEA-393807579459}.exe
- Size 204KB
- SHA256 1b34554d475ac01ab5b6499cafb30038674373b9b1cc6ac2e188ecd3e048afab
- MD5 25f795f2060442b70fbd2f935af0c112
- SHA1 fb9b3d1ccb57533d32bd0654897d9b578d5fae7c
- SHA512 2867a17753e797a8f13c87a16c0be0dc9b95e2c52e3e51172d9ecfef93c32e0eb9662495b7281b8f6bc7613f4974ea3355567a864a48ef956f18604f823f6bd6
- SSDEEP 1536:1EGh0o8Ll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oIl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{49653CF3-0F02-4280-A698-47AF15F1F3BB}.exe
- Size 204KB
- SHA256 2abe6b10768dbec5a6f7a35a714dbdebcbeb35fc42be338fa2355aa69ffeb4f2
- MD5 42b22f8baa6e927083cac52a578540f8
- SHA1 880e3f49aa6355fba6fcd14b38da78c69f960432
- SHA512 1e6220f10d1c25301a243cd10edc600e75c872c8c49b0bddce9e248a0f222b04742f7f2e6022c96be26adfb201ebc4b5949a4baec3e9cebdfb931c4375b698f7
- SSDEEP 1536:1EGh0oNl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oNl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4C4493ED-F7FA-44c5-81E6-4A2D6B3E7702}.exe
- Size 204KB
- SHA256 ce57ef3f9a32b4a1b8d215d9a22e0d0fce9c839b669878893904a715e91eec22
- MD5 d50c9c85307ccd5d5a6c6894b5805a6d
- SHA1 664252132b4be200bace36509ab1138acc66eb2d
- SHA512 1be73a9b40f68119bb0ee1e2bd02194accb646e115164cf28ebdcbfd3faff6a75d30861b1deddcc38071c956ae8002405ac599e136a90629cae638ee2950ad7b
- SSDEEP 1536:1EGh0obl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0obl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8F891F2F-2D3D-421c-80B3-2A7EDCFF04C8}.exe
- Size 204KB
- SHA256 f22188a81b02b867c5ff2301d00e530e48184ee32a2ca2c4ee1491a94606b409
- MD5 e0cef92099b9d63e557e9b5413d9ab47
- SHA1 2a33baf170296af3ecceab06269e3bc7fbece6b2
- SHA512 83cb7a60a4c94c21ea68882d71268ea69ed10f4327a83ec9bcc996ae431b8f7b96a1075bf0c1a7c930c5572024d4605712dd550bd298fdad8e11eca90895e290
- SSDEEP 1536:1EGh0ohl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0ohl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{99F94F5A-8806-4a9c-BB3E-1609896927A7}.exe
- Size 204KB
- SHA256 bc1e660a8d0f2b141bcce1fea2cc7333c71e99c43cf75beb5a691e1897bfd96a
- MD5 35af42d20962c492ac13893257cc14bd
- SHA1 82ab42113fd3ae313829ea6e66a6efeb93204647
- SHA512 646495de611d56ac6bf67d4cf69004c3d18d7b5f47456b7d22ebd4f6b4fe0b2a5549b9ae93b3dfee9a568f646e88e30e6125b03a3c6ddcecac1d47db21df6311
- SSDEEP 1536:1EGh0oPl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oPl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B5928463-4E5D-4f82-BB51-24AA5154A416}.exe
- Size 204KB
- SHA256 8c5e9c85b6d7c81d03f0f8313bc2ebdae36d8e745bacefce9f10c7dcee2c20cb
- MD5 74a6768e49cc7c9d4875ead1d4c144c0
- SHA1 3a44ba1dcc285af95e03ba18dc755d3e8f20a744
- SHA512 fec96bd4ba279f00dc27ad5ee66a68191697e53d6f1af5fb876717b410a39cdfa7bccda9ae0ec8bb8fd8c8d5dd130cf76fb5bf6cb623ac71e34b146e6b84af90
- SSDEEP 1536:1EGh0oIpl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oel1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CBB86726-D962-49c1-A82E-6A446FC68E9E}.exe
- Size 204KB
- SHA256 f0f24e5ff3950f7014fac4f6c38dd207c39bfaa2fabee91b66a28d707d3f8a31
- MD5 e3dfa401334e147e9ad6e3efa19c3b4a
- SHA1 e52e7d7cc8c1c2682b893d86b3787fdbcaafc15d
- SHA512 889ebe3c4cb29591ad551c2f5e5512b27209a3a3cb0ee6760d3d138fe21eaf4f64a1bc2f0c9b76613d8365d4cd97cc0cbdc1d6654ff6af19ede4cae026986301
- SSDEEP 1536:1EGh0orl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0orl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DE5DE16C-9F60-4fe7-811B-E9542C678C4D}.exe
- Size 204KB
- SHA256 f41c669c47b58027fc80121b6ad9cc7a6737f6a0bdae46510e8ad43159989590
- MD5 f558d1b5012ac5ea4e1047c628fd1e71
- SHA1 e207b4fd0c453288e40efc64d2a5ffd5dd9e395d
- SHA512 c276932532a0e2f6998767490881bec45155defae72d83bf6ec65b13a8048c1d398cc0d20dd7b78ed7703c5e7a1aca2b8fcca1fa11431bbe5c40082eb9358287
- SSDEEP 1536:1EGh0oal15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oal1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E03F1FED-953A-4486-8F29-12891C3B1287}.exe
- Size 204KB
- SHA256 5dff9ae6cc5c670cdd30e82f09b8d00fc1e670d1795ce2808218c0df147f5143
- MD5 6f59d9e4fe774861c32e223e055ce69e
- SHA1 ef2424bd7a5a72be3340290de92c252b24c9dc27
- SHA512 1c27062f114e8a8b374a41aaf40b3ae791cf23ae1ebe4dfdc911362f84560d01408b68ee5041256a2b402b1b4c6d7d508ea471ffc7a422ff4724f40f6bc03b8d
- SSDEEP 1536:1EGh0oul15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oul1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F4843FBD-2561-4db5-A00F-A0CF9395C59E}.exe
- Size 204KB
- SHA256 d8f4e3f813ec928805aed60a053fd0ddcd2f457bd0fb8101128cda0caa80e3ce
- MD5 f16ab6f8056e8304c8a601eefdd7196f
- SHA1 2d3dc6bb658ec365cbfaa824fc8e00964b8511b2
- SHA512 dc925e8d8a0d27132603abfdac569eda0517d3851257eaa02b663652a0a8a03113d64d70314f98dae106c61a46b0b705491787642c33d1bd98fd774b7b961154
- SSDEEP 1536:1EGh0oll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oll1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FAEDF2BC-81E5-436f-B2CC-9514FB770C3A}.exe
- Size 204KB
- SHA256 fde12078e168dcc86992de2adc7880b358e902c1a04d87c3a2576e56d58adc76
- MD5 460af9ff3e0e70295c76c863fd526a1c
- SHA1 48dcf6e256a84458a73c5d7f8d67461189488bb2
- SHA512 6f52326b098eaccc18a7bdb01b8f2776289a2da2d54d1b6aa3421bb5ab86af5c98ec09561a4abee0479fbf794caa4a0e5ed5633602144a8bd34b80f9469fe9db
- SSDEEP 1536:1EGh0oPl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oPl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FB12FE2E-8C34-4bdc-8AF2-1A0B378CDDD5}.exe
- Size 204KB
- SHA256 5cb6f4087cd950ef41a6e70027cb7a9a8394c12be7c0cc919941b4ba692a948d
- MD5 8c5a0d0791db7a0a5156833116f5af82
- SHA1 42c7b8913db21dd8e0653aa938bbd263dff36635
- SHA512 6119d49fe0e7b404f3df46865a1cceb1b0c3837daf0ca37d4e642ca8ad8b37abb97fa64c5a4f1a2fcafb55b0035533f6f4265185bdd1da6800dabf20f011a259
- SSDEEP 1536:1EGh0okAl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0okAl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP