Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 16:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe
- Size 408KB
- Sample240404-tynmcsda94
- SHA256 61ece873dd8ae22bfc5ca3036ceb67b583d772cf97d91d623c140d1cf014cf30
- MD5 10403d2080bd85476926eac68852ad24
- SHA1 38b19b84068d216c2a4ac1ed13c839e99143d925
- SHA512 cb81401052189bf59022ba15d707017bb0eb45336ab9b0a1623345580674cab2c22079a32869d754147eeb99536f3db1ef929fb0034abad8efbddeee28c5bbdb
- SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000023233-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023234-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002323b-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023234-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fa2-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fa3-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021fa2-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000703-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000703-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000703-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1499615E-9EC7-4f1d-A4EA-90EA30E87197} {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36FFF616-4343-443e-B956-0B672C25DCCA} {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E1F4443-A018-43f1-98DE-75A0F1F09427} {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E1F4443-A018-43f1-98DE-75A0F1F09427}\stubpath = "C:\\Windows\\{1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe" {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13F21524-FB33-4703-B8C4-C69FD36EC481}\stubpath = "C:\\Windows\\{13F21524-FB33-4703-B8C4-C69FD36EC481}.exe" 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B} {FC448BC8-5671-40a4-9A26-0168C7579638}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}\stubpath = "C:\\Windows\\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe" {FC448BC8-5671-40a4-9A26-0168C7579638}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00} {36FFF616-4343-443e-B956-0B672C25DCCA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{403DFEFB-8E41-40fe-9371-3C7C71A3690E} {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E} {1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}\stubpath = "C:\\Windows\\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}.exe" {1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F222044F-FC78-4f04-B98F-C73AE3FE73A6} {2B4BF1C3-EB74-4363-918A-231E86986009}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B4BF1C3-EB74-4363-918A-231E86986009}\stubpath = "C:\\Windows\\{2B4BF1C3-EB74-4363-918A-231E86986009}.exe" {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{708E361E-EF18-4d6c-B509-FDFEC8075A7F} {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1499615E-9EC7-4f1d-A4EA-90EA30E87197}\stubpath = "C:\\Windows\\{1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe" {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC448BC8-5671-40a4-9A26-0168C7579638} {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC448BC8-5671-40a4-9A26-0168C7579638}\stubpath = "C:\\Windows\\{FC448BC8-5671-40a4-9A26-0168C7579638}.exe" {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{403DFEFB-8E41-40fe-9371-3C7C71A3690E}\stubpath = "C:\\Windows\\{403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe" {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13F21524-FB33-4703-B8C4-C69FD36EC481} 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F222044F-FC78-4f04-B98F-C73AE3FE73A6}\stubpath = "C:\\Windows\\{F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe" {2B4BF1C3-EB74-4363-918A-231E86986009}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{708E361E-EF18-4d6c-B509-FDFEC8075A7F}\stubpath = "C:\\Windows\\{708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe" {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36FFF616-4343-443e-B956-0B672C25DCCA}\stubpath = "C:\\Windows\\{36FFF616-4343-443e-B956-0B672C25DCCA}.exe" {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}\stubpath = "C:\\Windows\\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe" {36FFF616-4343-443e-B956-0B672C25DCCA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B4BF1C3-EB74-4363-918A-231E86986009} {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe - Executes dropped EXE 12 IoCs
pid Process 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 2380 {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe 1604 {1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe 2032 {9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe {36FFF616-4343-443e-B956-0B672C25DCCA}.exe File created C:\Windows\{403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe File created C:\Windows\{1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe File created C:\Windows\{13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe File created C:\Windows\{2B4BF1C3-EB74-4363-918A-231E86986009}.exe {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe File created C:\Windows\{708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe File created C:\Windows\{FC448BC8-5671-40a4-9A26-0168C7579638}.exe {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe File created C:\Windows\{36FFF616-4343-443e-B956-0B672C25DCCA}.exe {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe File created C:\Windows\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}.exe {1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe File created C:\Windows\{F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe {2B4BF1C3-EB74-4363-918A-231E86986009}.exe File created C:\Windows\{1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe File created C:\Windows\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe {FC448BC8-5671-40a4-9A26-0168C7579638}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe Token: SeIncBasePriorityPrivilege 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe Token: SeIncBasePriorityPrivilege 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe Token: SeIncBasePriorityPrivilege 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe Token: SeIncBasePriorityPrivilege 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe Token: SeIncBasePriorityPrivilege 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe Token: SeIncBasePriorityPrivilege 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe Token: SeIncBasePriorityPrivilege 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe Token: SeIncBasePriorityPrivilege 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe Token: SeIncBasePriorityPrivilege 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe Token: SeIncBasePriorityPrivilege 2380 {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe Token: SeIncBasePriorityPrivilege 1604 {1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 5080 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe 95 PID 3576 wrote to memory of 5080 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe 95 PID 3576 wrote to memory of 5080 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe 95 PID 3576 wrote to memory of 512 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe 96 PID 3576 wrote to memory of 512 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe 96 PID 3576 wrote to memory of 512 3576 2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe 96 PID 5080 wrote to memory of 4992 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 97 PID 5080 wrote to memory of 4992 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 97 PID 5080 wrote to memory of 4992 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 97 PID 5080 wrote to memory of 5020 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 98 PID 5080 wrote to memory of 5020 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 98 PID 5080 wrote to memory of 5020 5080 {13F21524-FB33-4703-B8C4-C69FD36EC481}.exe 98 PID 4992 wrote to memory of 3364 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 100 PID 4992 wrote to memory of 3364 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 100 PID 4992 wrote to memory of 3364 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 100 PID 4992 wrote to memory of 2916 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 101 PID 4992 wrote to memory of 2916 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 101 PID 4992 wrote to memory of 2916 4992 {2B4BF1C3-EB74-4363-918A-231E86986009}.exe 101 PID 3364 wrote to memory of 4240 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 102 PID 3364 wrote to memory of 4240 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 102 PID 3364 wrote to memory of 4240 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 102 PID 3364 wrote to memory of 4120 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 103 PID 3364 wrote to memory of 4120 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 103 PID 3364 wrote to memory of 4120 3364 {F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe 103 PID 4240 wrote to memory of 2400 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 104 PID 4240 wrote to memory of 2400 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 104 PID 4240 wrote to memory of 2400 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 104 PID 4240 wrote to memory of 888 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 105 PID 4240 wrote to memory of 888 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 105 PID 4240 wrote to memory of 888 4240 {708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe 105 PID 2400 wrote to memory of 2784 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 106 PID 2400 wrote to memory of 2784 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 106 PID 2400 wrote to memory of 2784 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 106 PID 2400 wrote to memory of 2024 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 107 PID 2400 wrote to memory of 2024 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 107 PID 2400 wrote to memory of 2024 2400 {1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe 107 PID 2784 wrote to memory of 3152 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 108 PID 2784 wrote to memory of 3152 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 108 PID 2784 wrote to memory of 3152 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 108 PID 2784 wrote to memory of 2012 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 109 PID 2784 wrote to memory of 2012 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 109 PID 2784 wrote to memory of 2012 2784 {FC448BC8-5671-40a4-9A26-0168C7579638}.exe 109 PID 3152 wrote to memory of 1484 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 110 PID 3152 wrote to memory of 1484 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 110 PID 3152 wrote to memory of 1484 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 110 PID 3152 wrote to memory of 3712 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 111 PID 3152 wrote to memory of 3712 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 111 PID 3152 wrote to memory of 3712 3152 {DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe 111 PID 1484 wrote to memory of 1576 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 112 PID 1484 wrote to memory of 1576 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 112 PID 1484 wrote to memory of 1576 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 112 PID 1484 wrote to memory of 3500 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 113 PID 1484 wrote to memory of 3500 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 113 PID 1484 wrote to memory of 3500 1484 {36FFF616-4343-443e-B956-0B672C25DCCA}.exe 113 PID 1576 wrote to memory of 2380 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 114 PID 1576 wrote to memory of 2380 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 114 PID 1576 wrote to memory of 2380 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 114 PID 1576 wrote to memory of 2580 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 115 PID 1576 wrote to memory of 2580 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 115 PID 1576 wrote to memory of 2580 1576 {273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe 115 PID 2380 wrote to memory of 1604 2380 {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe 116 PID 2380 wrote to memory of 1604 2380 {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe 116 PID 2380 wrote to memory of 1604 2380 {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe 116 PID 2380 wrote to memory of 780 2380 {403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_10403d2080bd85476926eac68852ad24_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\{13F21524-FB33-4703-B8C4-C69FD36EC481}.exeC:\Windows\{13F21524-FB33-4703-B8C4-C69FD36EC481}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\{2B4BF1C3-EB74-4363-918A-231E86986009}.exeC:\Windows\{2B4BF1C3-EB74-4363-918A-231E86986009}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\{F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exeC:\Windows\{F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\{708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exeC:\Windows\{708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\{1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exeC:\Windows\{1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\{FC448BC8-5671-40a4-9A26-0168C7579638}.exeC:\Windows\{FC448BC8-5671-40a4-9A26-0168C7579638}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exeC:\Windows\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\{36FFF616-4343-443e-B956-0B672C25DCCA}.exeC:\Windows\{36FFF616-4343-443e-B956-0B672C25DCCA}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exeC:\Windows\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\{403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exeC:\Windows\{403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\{1E1F4443-A018-43f1-98DE-75A0F1F09427}.exeC:\Windows\{1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Windows\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}.exeC:\Windows\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}.exe13⤵
- Executes dropped EXE
PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E1F4~1.EXE > nul13⤵PID:768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{403DF~1.EXE > nul12⤵PID:780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{273D1~1.EXE > nul11⤵PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36FFF~1.EXE > nul10⤵PID:3500
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAF0C~1.EXE > nul9⤵PID:3712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC448~1.EXE > nul8⤵PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14996~1.EXE > nul7⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{708E3~1.EXE > nul6⤵PID:888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2220~1.EXE > nul5⤵PID:4120
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B4BF~1.EXE > nul4⤵PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13F21~1.EXE > nul3⤵PID:5020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{13F21524-FB33-4703-B8C4-C69FD36EC481}.exe
- Size 408KB
- SHA256 95f211b972bf704811fc820bdc7264dd4bf30e92078280ade9d79d48eb601114
- MD5 ec2263c0cf5a632c37f68d1f9b401cea
- SHA1 83e25b5edf2c52db8cfef2acef21ec16c3382c27
- SHA512 c2b00068512d94ff4b59dabf2aebf75676b74bc19202a89dd6296a96a5d8bf7f2df459067951ab862da0967ee8fa91d92e94bcd061bf96ba8984a895cf064efa
- SSDEEP 3072:CEGh0o/l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGNldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1499615E-9EC7-4f1d-A4EA-90EA30E87197}.exe
- Size 408KB
- SHA256 f98bd33fa41d7284cd83f83e718b1a16f1ce78ff704a862a2459c100fc368f9e
- MD5 d82c95ccbbd503948136e78950815c07
- SHA1 2d44b78019ba30baafe20afed7c77329c40c118d
- SHA512 f09a58c72cfff6b351c6116116008568baa28065627a8d1a78be7e30d9832c8ba57e1b7c3eb4057311a1a580864ee20643670c8bffbd47fd71c6a9ff9f29531a
- SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGFldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1E1F4443-A018-43f1-98DE-75A0F1F09427}.exe
- Size 408KB
- SHA256 978c416a0ef5ad500d35ca9633ed073a07b51a31e6ebf1b38a436c6dd7bdca0c
- MD5 5de2e05df98a374f248a261ec8e18b40
- SHA1 97d360cf899283b90de94ef925470d50ffecb667
- SHA512 04f8a784a7a199138fbc1d49fc11c4acf36526b9a7662d35bc6c3cdfa834c20f88f72783d1f72046eec019c53e051e1dd135c28a234646e733b2d2a805e871aa
- SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGCldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{273D1A4A-6EA9-4607-B61B-5CAD2E5A1A00}.exe
- Size 408KB
- SHA256 652d858c44dfc4a753f0523b34b247411402fdb9cf80df4c7b2d12a03d0364d1
- MD5 86207c128dedda86a543fd26ca2efcf8
- SHA1 82dfd697a9875c0daa0470422d7b773ddf693a11
- SHA512 a20c645a502ad7424411c1a4340821957e4f9dfd168cff4549c246cd86a5491a05e01ce55f5a04e05f4534efd0a367e7b313fd5c691672ff72cce7545a358b14
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGWldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2B4BF1C3-EB74-4363-918A-231E86986009}.exe
- Size 408KB
- SHA256 99c511a32d01e348859b7e12b1f4ba1fda9a3c5dde89974f4b9f103612b5f975
- MD5 80ba97d46bf1f5fd984097b83f560796
- SHA1 0a7c6cc577e2f1a35019a2d6c89d4a405f6584e0
- SHA512 dbe628b1757f17798818195f666e2145b13016a8f1ca57d79c75e99bacfc231b0ba07c3d78dedd8f27e3c936b94b4a2b8318b12b3e10525c2c2dc7dfd40b22ff
- SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{36FFF616-4343-443e-B956-0B672C25DCCA}.exe
- Size 408KB
- SHA256 4496097e331f14bdd33a0cb225fc540edf831a0c55f4eccffbbcaee13a196e1e
- MD5 dbf6e33d5acddebb1c439bd90b854ec0
- SHA1 e5ee951dc0aee682fdede7bf06c45ebcaaa5846f
- SHA512 6db719c1e2119f4e3b6e6bc59fcec1ea4356df5dd0f5aedae003250995db7b1cd994168f24550d7623eafaa738512dea63c3f0ae6f06ac1075de7b974caafe91
- SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGSldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{403DFEFB-8E41-40fe-9371-3C7C71A3690E}.exe
- Size 408KB
- SHA256 890daf8a999b1cf12998216b5109c7ebb8a11ba2cc0b297e68b21749c30d6439
- MD5 e463e293e1477f3d511bd67c8e9c5e6e
- SHA1 70925a8914fa4b34905d4d2aabeba7ee453b1876
- SHA512 868531afcb0f29b654a3afe46a358e9b5f8d647fdedea24db002cb6c64265bb1b96eede019c7939399796afb3712d01f2d55d1a6eda3edeaccf66968812c3f3f
- SSDEEP 3072:CEGh0o5l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGXldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{708E361E-EF18-4d6c-B509-FDFEC8075A7F}.exe
- Size 408KB
- SHA256 640f88cf58ed6e8b4ebd01691f5379acd3bcc1164f5d465ba26447630cb326ff
- MD5 7f0687f412617089d45a83ddda967edf
- SHA1 b1888c342287793f2c6c86c15d28e26314885120
- SHA512 ac8b93650011c8a219a5ed1b0380dce8d4ddaf0f1d917336c50872086db05401cdef90552c35ed748df9f74aac6ded23e3159aedd042db0c793ad50269b47e74
- SSDEEP 3072:CEGh0okl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9C1F5ABD-7E63-4bb0-901A-DF556E6E887E}.exe
- Size 408KB
- SHA256 b93c2c74fd7f24393bf2fc33f6c685c98eddc36290b1f47c9dfe1bf7159300dd
- MD5 31bbfd2741e6bd078ded16650fc97f7a
- SHA1 a69c3d1d22a6e63561a5208fb110127017e70a8c
- SHA512 c97e275586badb40c44096fbc0e7bea3c0e9e3284bad6254d62057861452b6ae68992a7a29ce059ff30050b8996320f3e24221c911d5838aa4106959ce8438e5
- SSDEEP 3072:CEGh0oTl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGBldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DAF0CD51-7E81-45a4-B5A5-7E1A5B9F970B}.exe
- Size 408KB
- SHA256 f350462f909d4872312b155f02d5b79c49e276fa6050e350b699656981e7bbce
- MD5 ebb22f457194561b6c712e1df1b8f37b
- SHA1 94860e94d1eca1fc69fc873363c1f37872344896
- SHA512 47e61386223c2c5920d0d3c6b9e80434ee8935cc53583f36a17eedf7e9dc6c4fc24fde0e9b21433bb9edc59bfa6494eee48c0e0f1b36e60eb900b951f0fe651f
- SSDEEP 3072:CEGh0oQl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGCldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F222044F-FC78-4f04-B98F-C73AE3FE73A6}.exe
- Size 408KB
- SHA256 cc1d2f69e3d6600c34db75b22a847e617939dbe2972f6922478f4d8b315e99bf
- MD5 128b864113a51690fefdf87dc8b02fb4
- SHA1 6aefb5e3d4ed4d9bea9a2c435fb770cfef26cc8a
- SHA512 15a56e5e0042fac21b84f4f01e6e70e179b5b40289d7a00ff96b43e1cfe4da62da3b295d76985e1e9ee93e44f497de05791d31c03b017cd1d1e29645fd70199d
- SSDEEP 3072:CEGh0oTl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGdldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FC448BC8-5671-40a4-9A26-0168C7579638}.exe
- Size 408KB
- SHA256 571c62ba08f20e4c0dacc9794ce0002fc2faeae3ed2e804af7134dfedd95bb18
- MD5 8812dbd0a4382475f5daf54ffd4d96b1
- SHA1 cf973b7b562f3f48fedfc19f7ffe3375a563a2e7
- SHA512 03becc157dd00faea904b6e396d7735a70144cc70c22b04795f75d095dea597e93c195a455f8bc32f7cb10ae4521fa61271f19280d0b53fd1156ab60240851a7
- SSDEEP 3072:CEGh0o/l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGFldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP