Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 13:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe
- Size 168KB
- Sample240404-ratglahf8x
- SHA256 76126d246188b3d27be00e5c16553cd6fa3eca8843b7aea3b6569a4ec0b28427
- MD5 f24f39bbe28e4dfa90912dcf91f5deb6
- SHA1 1d9b9a900c1b1040b0f883ff6de6056afd838701
- SHA512 843627447f48a4d93d49fab254254e83fa79341844a661a1dc92556516f67bfb84fe482370febde782035ca89267da43d816637bd279e09c058e34ebb7233361
- SSDEEP 1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00110000000231fd-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000231a5-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023204-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000231a5-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d41-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021d42-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021d41-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072f-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DA350E9-1100-4504-8827-8EFBB26393C8}\stubpath = "C:\\Windows\\{9DA350E9-1100-4504-8827-8EFBB26393C8}.exe" {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61562D53-7B61-48d2-AADD-DB257ABFB9A8} {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61562D53-7B61-48d2-AADD-DB257ABFB9A8}\stubpath = "C:\\Windows\\{61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe" {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716} {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13EAC783-E666-4bf2-AD43-52FBF1CA7652} {DD81728E-0583-4390-9DB5-86706AF4B083}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}\stubpath = "C:\\Windows\\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe" {99753C70-EF82-4572-9D68-1D377746EC6C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DA350E9-1100-4504-8827-8EFBB26393C8} {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F}\stubpath = "C:\\Windows\\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe" {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313} {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}\stubpath = "C:\\Windows\\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe" {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD81728E-0583-4390-9DB5-86706AF4B083}\stubpath = "C:\\Windows\\{DD81728E-0583-4390-9DB5-86706AF4B083}.exe" 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}\stubpath = "C:\\Windows\\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe" {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED} {99753C70-EF82-4572-9D68-1D377746EC6C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4} {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}\stubpath = "C:\\Windows\\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe" {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3} {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}\stubpath = "C:\\Windows\\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe" {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99753C70-EF82-4572-9D68-1D377746EC6C} {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD81728E-0583-4390-9DB5-86706AF4B083} 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13EAC783-E666-4bf2-AD43-52FBF1CA7652}\stubpath = "C:\\Windows\\{13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe" {DD81728E-0583-4390-9DB5-86706AF4B083}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F} {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99753C70-EF82-4572-9D68-1D377746EC6C}\stubpath = "C:\\Windows\\{99753C70-EF82-4572-9D68-1D377746EC6C}.exe" {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47803B43-B380-4d2d-AEC0-4829608C8270} {FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47803B43-B380-4d2d-AEC0-4829608C8270}\stubpath = "C:\\Windows\\{47803B43-B380-4d2d-AEC0-4829608C8270}.exe" {FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe - Executes dropped EXE 12 IoCs
pid Process 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 216 {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe 116 {FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe 1460 {47803B43-B380-4d2d-AEC0-4829608C8270}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe File created C:\Windows\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe File created C:\Windows\{47803B43-B380-4d2d-AEC0-4829608C8270}.exe {FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe File created C:\Windows\{DD81728E-0583-4390-9DB5-86706AF4B083}.exe 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe File created C:\Windows\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe File created C:\Windows\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe File created C:\Windows\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe {99753C70-EF82-4572-9D68-1D377746EC6C}.exe File created C:\Windows\{9DA350E9-1100-4504-8827-8EFBB26393C8}.exe {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe File created C:\Windows\{13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe {DD81728E-0583-4390-9DB5-86706AF4B083}.exe File created C:\Windows\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe File created C:\Windows\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe File created C:\Windows\{99753C70-EF82-4572-9D68-1D377746EC6C}.exe {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe Token: SeIncBasePriorityPrivilege 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe Token: SeIncBasePriorityPrivilege 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe Token: SeIncBasePriorityPrivilege 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe Token: SeIncBasePriorityPrivilege 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe Token: SeIncBasePriorityPrivilege 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe Token: SeIncBasePriorityPrivilege 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe Token: SeIncBasePriorityPrivilege 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe Token: SeIncBasePriorityPrivilege 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe Token: SeIncBasePriorityPrivilege 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe Token: SeIncBasePriorityPrivilege 216 {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe Token: SeIncBasePriorityPrivilege 116 {FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 1904 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 96 PID 3764 wrote to memory of 1904 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 96 PID 3764 wrote to memory of 1904 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 96 PID 3764 wrote to memory of 2768 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 97 PID 3764 wrote to memory of 2768 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 97 PID 3764 wrote to memory of 2768 3764 2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe 97 PID 1904 wrote to memory of 4464 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 98 PID 1904 wrote to memory of 4464 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 98 PID 1904 wrote to memory of 4464 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 98 PID 1904 wrote to memory of 2832 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 99 PID 1904 wrote to memory of 2832 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 99 PID 1904 wrote to memory of 2832 1904 {DD81728E-0583-4390-9DB5-86706AF4B083}.exe 99 PID 4464 wrote to memory of 4004 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 101 PID 4464 wrote to memory of 4004 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 101 PID 4464 wrote to memory of 4004 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 101 PID 4464 wrote to memory of 2528 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 102 PID 4464 wrote to memory of 2528 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 102 PID 4464 wrote to memory of 2528 4464 {13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe 102 PID 4004 wrote to memory of 3964 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 103 PID 4004 wrote to memory of 3964 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 103 PID 4004 wrote to memory of 3964 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 103 PID 4004 wrote to memory of 3220 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 104 PID 4004 wrote to memory of 3220 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 104 PID 4004 wrote to memory of 3220 4004 {D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe 104 PID 3964 wrote to memory of 3660 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 105 PID 3964 wrote to memory of 3660 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 105 PID 3964 wrote to memory of 3660 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 105 PID 3964 wrote to memory of 3440 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 106 PID 3964 wrote to memory of 3440 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 106 PID 3964 wrote to memory of 3440 3964 {0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe 106 PID 3660 wrote to memory of 4856 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 107 PID 3660 wrote to memory of 4856 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 107 PID 3660 wrote to memory of 4856 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 107 PID 3660 wrote to memory of 856 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 108 PID 3660 wrote to memory of 856 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 108 PID 3660 wrote to memory of 856 3660 {B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe 108 PID 4856 wrote to memory of 2376 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 109 PID 4856 wrote to memory of 2376 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 109 PID 4856 wrote to memory of 2376 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 109 PID 4856 wrote to memory of 4108 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 110 PID 4856 wrote to memory of 4108 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 110 PID 4856 wrote to memory of 4108 4856 {DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe 110 PID 2376 wrote to memory of 4344 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 111 PID 2376 wrote to memory of 4344 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 111 PID 2376 wrote to memory of 4344 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 111 PID 2376 wrote to memory of 4512 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 112 PID 2376 wrote to memory of 4512 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 112 PID 2376 wrote to memory of 4512 2376 {99753C70-EF82-4572-9D68-1D377746EC6C}.exe 112 PID 4344 wrote to memory of 1308 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 113 PID 4344 wrote to memory of 1308 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 113 PID 4344 wrote to memory of 1308 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 113 PID 4344 wrote to memory of 1208 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 114 PID 4344 wrote to memory of 1208 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 114 PID 4344 wrote to memory of 1208 4344 {A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe 114 PID 1308 wrote to memory of 216 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 115 PID 1308 wrote to memory of 216 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 115 PID 1308 wrote to memory of 216 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 115 PID 1308 wrote to memory of 4380 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 116 PID 1308 wrote to memory of 4380 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 116 PID 1308 wrote to memory of 4380 1308 {9DA350E9-1100-4504-8827-8EFBB26393C8}.exe 116 PID 216 wrote to memory of 116 216 {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe 117 PID 216 wrote to memory of 116 216 {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe 117 PID 216 wrote to memory of 116 216 {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe 117 PID 216 wrote to memory of 812 216 {61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_f24f39bbe28e4dfa90912dcf91f5deb6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\{DD81728E-0583-4390-9DB5-86706AF4B083}.exeC:\Windows\{DD81728E-0583-4390-9DB5-86706AF4B083}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\{13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exeC:\Windows\{13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exeC:\Windows\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exeC:\Windows\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exeC:\Windows\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exeC:\Windows\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\{99753C70-EF82-4572-9D68-1D377746EC6C}.exeC:\Windows\{99753C70-EF82-4572-9D68-1D377746EC6C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exeC:\Windows\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\{9DA350E9-1100-4504-8827-8EFBB26393C8}.exeC:\Windows\{9DA350E9-1100-4504-8827-8EFBB26393C8}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\{61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exeC:\Windows\{61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exeC:\Windows\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:116 -
C:\Windows\{47803B43-B380-4d2d-AEC0-4829608C8270}.exeC:\Windows\{47803B43-B380-4d2d-AEC0-4829608C8270}.exe13⤵
- Executes dropped EXE
PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB49B~1.EXE > nul13⤵PID:4336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61562~1.EXE > nul12⤵PID:812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DA35~1.EXE > nul11⤵PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6C86~1.EXE > nul10⤵PID:1208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99753~1.EXE > nul9⤵PID:4512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDC6B~1.EXE > nul8⤵PID:4108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6491~1.EXE > nul7⤵PID:856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0080B~1.EXE > nul6⤵PID:3440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0A33~1.EXE > nul5⤵PID:3220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13EAC~1.EXE > nul4⤵PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD817~1.EXE > nul3⤵PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0080BBC1-B61B-4ff2-8FB2-A020E28BBED4}.exe
- Size 168KB
- SHA256 d2f31137dce319af723561704dc5464c011dc90de42f48d56ac63548a086ac6f
- MD5 efa41b15393887ff35f0f552da57093c
- SHA1 7aba863aaaf8290d258467db3ca267ccd296ae34
- SHA512 924a21ec5ec86d0d6fbdcf06bf9ca8b2166aec8c41a3919f916586233a16789a222f0bbf2a628c0f1388b88f38519b25c02c54b0b2f9ae230663dadda6911088
- SSDEEP 1536:1EGh0o5lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o5lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{13EAC783-E666-4bf2-AD43-52FBF1CA7652}.exe
- Size 168KB
- SHA256 30279c34455230c683aedcc0b3963c61a2b37d8ac7236fec8dcb1d7f653b3635
- MD5 62774eaa56203f585727e3dba05e6b80
- SHA1 1a11c4c2d636b64513995473ce1252c9eafe3f0b
- SHA512 3dd5698aeed45199e3858ccbbc13eacc7683d03829a535a43ad1b1432f181f3e76dda35a3f7cc92a56c8af37f2224d376b78475320c8acfe4eecd037ad450328
- SSDEEP 1536:1EGh0o9lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o9lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{47803B43-B380-4d2d-AEC0-4829608C8270}.exe
- Size 168KB
- SHA256 4119a6440bb394abc35bd6fc1e1e09cccbc2c8c2db08a77b732fe849d83a7aa2
- MD5 9c072046b38a986d5ba7060c929fbfb5
- SHA1 425c5a043ba25ae370ac4d9a3f62c5fef7ff6652
- SHA512 1264c08a1bc50994caaee1d338b0d73fae6e33f473cccb39420d052df4d598359482b6ed217cde6f78e27c7482582d7d78bf0fb4c90f0825c411e7d0f9d38464
- SSDEEP 1536:1EGh0oFlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oFlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{61562D53-7B61-48d2-AADD-DB257ABFB9A8}.exe
- Size 168KB
- SHA256 bb5487a1b0df94167e92a874cd96fb3a932df2a2aefbfcbcebe1b66112ed54e3
- MD5 4618174c79427cfcba45a0ba1b1b34c5
- SHA1 d4eb2a8841eab06865cd79c832d447a62da4d2bf
- SHA512 2e41288fe2aca27a67f1a3e8c9a492f1562b9626fcd18cd9c1f9276f79df63fea58bf9429f03b7ea8d65f3da442f5dc711247b298a8a94580eef038875f22de8
- SSDEEP 1536:1EGh0oGlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oGlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{99753C70-EF82-4572-9D68-1D377746EC6C}.exe
- Size 168KB
- SHA256 9dcc9e2ad14ed0a8e67c525c396932d168be8f9b6b61ec9b3ca11b633de02115
- MD5 4cfc8a46d0b24c8ae843e6ba5da5ef49
- SHA1 3ec4e81715efffdee2e93021fd961faa12871192
- SHA512 5f6bf4247b11c6579294af77261c348c01c81efcbaf6a0d02201aad81d6ddd9626f972bc90d16532c0fe669b457f094eb625c7008b549a3bb987c40c83ca20ff
- SSDEEP 1536:1EGh0oGlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oGlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9DA350E9-1100-4504-8827-8EFBB26393C8}.exe
- Size 168KB
- SHA256 fe9af450689a179f30ab7dd086ee58535554ea6ccc954395fc36b0c59130342c
- MD5 dc5c332db6ff8de7a9f96e5f1f15b6fe
- SHA1 921525e79398c101d54031a586377ee7f2a2abae
- SHA512 a7b9e1d8d34908b0a0929c0ac7ee99f3e2e4b8a9f11e699a0c778b8a82c419dcef4ced1d65e5e2320fe78cc5eb8c9c30d0b46c0f6ae4544d3affd05c1b268967
- SSDEEP 1536:1EGh0o0lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o0lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A6C86F45-E32C-42b5-94FC-6C3AAD67B8ED}.exe
- Size 168KB
- SHA256 737582b0cc5d68f6f87e5d9ab4e86f612566fa32b15f5500ae0a093cb08cfac4
- MD5 a95284ebc75571e83ab1a09440a030f5
- SHA1 4db46ee6ab1b848c8f5bd2e87b5ab0472dd0aca3
- SHA512 c7ef17ea4e3693f9d8c580ffebda5231057fcfe389db7470358f9e24337cceaa349761d79376a873cd1656149d8dccf16c69a1092eb8fb086f3607685a89b14b
- SSDEEP 1536:1EGh0o8lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o8lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B6491FBB-CD41-4924-9CDA-CA9D76A81ED3}.exe
- Size 168KB
- SHA256 e249091d27fa45855dfc6f15912f2b00bda27c24dd37028ca5f4df609b45bcd4
- MD5 ce48ae3059319bcf82ab9b6d16c58167
- SHA1 de7081ed38cca96e7ab27f8f5cf57076f5b28d2f
- SHA512 f3846d290f8cb44a1ab6b6c0d30fd38379f45eec52cabd8a3838a2eb9d9915c5a60f40caae1e271f54de9e7db56272a605d550bc5dc04be7d70f53468224e4bf
- SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D0A33C80-44F6-4c87-A50E-C3E92E60E12F}.exe
- Size 168KB
- SHA256 3e7a124cbb7e8d96d482a95fb8936da0e32f83c644b0575ff146131f3438296b
- MD5 27c61defbf3ad52f03a66759b61aad4e
- SHA1 1229abb0c14dd4e8dcbd807660ebc978eb68bb95
- SHA512 0fd0c6767a694c7920b70e320375292af20d2e8937c652604ab3669451f9be47797e5e39b30bce401f4350b46e2f7db75707fbe03dd348b8d3b552e458880d0d
- SSDEEP 1536:1EGh0oLlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oLlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DD81728E-0583-4390-9DB5-86706AF4B083}.exe
- Size 168KB
- SHA256 34acac4c49da1d14740e5d74c2b8b6531df2c741412dc273672d9d95c528dbab
- MD5 a230a3ed5fd33778e72e1ffbe6fdba00
- SHA1 f6ea456bfa8bf261ea3cdd005937efe172335b5f
- SHA512 7b4de6fae016fb40e0f674bf1143926604d49aae3b4a6149adbec8221ed72331a0eb24b0cd396e3c6844011ce30b8e1854b2b1ddd3419b592995cbde89afd0e7
- SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DDC6BD83-DC74-4f0d-8ACB-3A48D73DC313}.exe
- Size 168KB
- SHA256 dcdc8915dbdfc8cce4d10059a3ac68f26f9be28ce9b2225c19587e5eef7e64b3
- MD5 73494f4a421d828e3b2a8b2672b279ce
- SHA1 8c02e3069d115bc1dceb96bffa3a3f7e476f3c91
- SHA512 683e8ebfa7fae641ee0b7503a39468ad65268d88c29dc0d363f5af9208940eda7af4884515f117e18746d7d1fd313dae7b0b660ac01670da78f01024274f8a29
- SSDEEP 1536:1EGh0oXlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oXlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FB49B2FB-5C26-4701-A5D3-FD3CC97B0716}.exe
- Size 168KB
- SHA256 dea131cc1cc5b5782f698794c05d079a9d2b9fe62321af164b3f82b1d8fe9056
- MD5 a5080063872fa26cce0a6596b306da34
- SHA1 763dae9122a13f2a32100662ad3f5961ab65e0aa
- SHA512 f00b25d195107c5a5372334b5058ffb3f940af22bd204ddf677a9361dd993c9710575ed8ea3f97d2f47dab2ff0678decfb6b0b1f6cebe358df85bde576568ecf
- SSDEEP 1536:1EGh0oWlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oWlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP