Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 16:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe
- Size 408KB
- Sample240404-vb1h3sde32
- SHA256 a5dc0c32cad12a8374a537b15a21800b80183ef63156ca6b813583dbca63add3
- MD5 98f50381b4543fd6f91ac0df23242fa1
- SHA1 c3fbdfe87c8b6075309116ce0b3187fb57ebe260
- SHA512 9aa852466d09670dc50d0ff28981daa7e1ac207811d0e3fa7386b1f2c2f9a780df925cf0f673c84841f90eddcbe22cd3e20b7fcfa865b929e64f8e30962b7198
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGTldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00020000000227ea-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023249-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023250-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023249-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023250-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219e9-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219ea-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070f-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000026-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000500000000070d-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB365129-19B7-405e-B6EC-4D3E8461BED7} {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6860B419-6C5F-46ad-89B1-A5943A737EFB}\stubpath = "C:\\Windows\\{6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe" {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8340D12-B834-42c2-8E73-B5D08093FE85}\stubpath = "C:\\Windows\\{F8340D12-B834-42c2-8E73-B5D08093FE85}.exe" {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E87D8A8-41C5-4852-8F40-EA336AF04B45}\stubpath = "C:\\Windows\\{4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe" {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2A6B51B-6013-4fc6-9C90-1F393D996F29} 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}\stubpath = "C:\\Windows\\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe" {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{706B22F8-6C50-4349-B092-1818AEE041C2}\stubpath = "C:\\Windows\\{706B22F8-6C50-4349-B092-1818AEE041C2}.exe" {4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6860B419-6C5F-46ad-89B1-A5943A737EFB} {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4} {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583} {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}\stubpath = "C:\\Windows\\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe" {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4} {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}\stubpath = "C:\\Windows\\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe" {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1} {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E87D8A8-41C5-4852-8F40-EA336AF04B45} {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB365129-19B7-405e-B6EC-4D3E8461BED7}\stubpath = "C:\\Windows\\{EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe" {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70309CCD-2E1B-4cb8-88F1-185777F0BB32}\stubpath = "C:\\Windows\\{70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe" {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70309CCD-2E1B-4cb8-88F1-185777F0BB32} {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}\stubpath = "C:\\Windows\\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe" {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8340D12-B834-42c2-8E73-B5D08093FE85} {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1}\stubpath = "C:\\Windows\\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe" {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{706B22F8-6C50-4349-B092-1818AEE041C2} {4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2A6B51B-6013-4fc6-9C90-1F393D996F29}\stubpath = "C:\\Windows\\{F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe" 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054} {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe - Executes dropped EXE 12 IoCs
pid Process 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 3700 {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe 4024 {4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe 784 {706B22F8-6C50-4349-B092-1818AEE041C2}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe File created C:\Windows\{EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe File created C:\Windows\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe File created C:\Windows\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe File created C:\Windows\{4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe File created C:\Windows\{F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe File created C:\Windows\{70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe File created C:\Windows\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe File created C:\Windows\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe File created C:\Windows\{6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe File created C:\Windows\{F8340D12-B834-42c2-8E73-B5D08093FE85}.exe {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe File created C:\Windows\{706B22F8-6C50-4349-B092-1818AEE041C2}.exe {4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe Token: SeIncBasePriorityPrivilege 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe Token: SeIncBasePriorityPrivilege 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe Token: SeIncBasePriorityPrivilege 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe Token: SeIncBasePriorityPrivilege 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe Token: SeIncBasePriorityPrivilege 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe Token: SeIncBasePriorityPrivilege 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe Token: SeIncBasePriorityPrivilege 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe Token: SeIncBasePriorityPrivilege 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe Token: SeIncBasePriorityPrivilege 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe Token: SeIncBasePriorityPrivilege 3700 {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe Token: SeIncBasePriorityPrivilege 4024 {4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1156 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe 95 PID 2152 wrote to memory of 1156 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe 95 PID 2152 wrote to memory of 1156 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe 95 PID 2152 wrote to memory of 1728 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe 98 PID 2152 wrote to memory of 1728 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe 98 PID 2152 wrote to memory of 1728 2152 2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe 98 PID 1156 wrote to memory of 2988 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 104 PID 1156 wrote to memory of 2988 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 104 PID 1156 wrote to memory of 2988 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 104 PID 1156 wrote to memory of 3524 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 105 PID 1156 wrote to memory of 3524 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 105 PID 1156 wrote to memory of 3524 1156 {F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe 105 PID 2988 wrote to memory of 4508 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 107 PID 2988 wrote to memory of 4508 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 107 PID 2988 wrote to memory of 4508 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 107 PID 2988 wrote to memory of 2804 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 108 PID 2988 wrote to memory of 2804 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 108 PID 2988 wrote to memory of 2804 2988 {F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe 108 PID 4508 wrote to memory of 3088 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 110 PID 4508 wrote to memory of 3088 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 110 PID 4508 wrote to memory of 3088 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 110 PID 4508 wrote to memory of 4572 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 111 PID 4508 wrote to memory of 4572 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 111 PID 4508 wrote to memory of 4572 4508 {EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe 111 PID 3088 wrote to memory of 4892 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 112 PID 3088 wrote to memory of 4892 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 112 PID 3088 wrote to memory of 4892 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 112 PID 3088 wrote to memory of 3972 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 113 PID 3088 wrote to memory of 3972 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 113 PID 3088 wrote to memory of 3972 3088 {70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe 113 PID 4892 wrote to memory of 3392 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 114 PID 4892 wrote to memory of 3392 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 114 PID 4892 wrote to memory of 3392 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 114 PID 4892 wrote to memory of 2180 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 115 PID 4892 wrote to memory of 2180 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 115 PID 4892 wrote to memory of 2180 4892 {1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe 115 PID 3392 wrote to memory of 3212 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 116 PID 3392 wrote to memory of 3212 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 116 PID 3392 wrote to memory of 3212 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 116 PID 3392 wrote to memory of 3288 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 117 PID 3392 wrote to memory of 3288 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 117 PID 3392 wrote to memory of 3288 3392 {F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe 117 PID 3212 wrote to memory of 3800 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 118 PID 3212 wrote to memory of 3800 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 118 PID 3212 wrote to memory of 3800 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 118 PID 3212 wrote to memory of 1452 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 119 PID 3212 wrote to memory of 1452 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 119 PID 3212 wrote to memory of 1452 3212 {6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe 119 PID 3800 wrote to memory of 3732 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 120 PID 3800 wrote to memory of 3732 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 120 PID 3800 wrote to memory of 3732 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 120 PID 3800 wrote to memory of 3036 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 121 PID 3800 wrote to memory of 3036 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 121 PID 3800 wrote to memory of 3036 3800 {C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe 121 PID 3732 wrote to memory of 3700 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 122 PID 3732 wrote to memory of 3700 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 122 PID 3732 wrote to memory of 3700 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 122 PID 3732 wrote to memory of 2496 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 123 PID 3732 wrote to memory of 2496 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 123 PID 3732 wrote to memory of 2496 3732 {F8340D12-B834-42c2-8E73-B5D08093FE85}.exe 123 PID 3700 wrote to memory of 4024 3700 {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe 124 PID 3700 wrote to memory of 4024 3700 {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe 124 PID 3700 wrote to memory of 4024 3700 {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe 124 PID 3700 wrote to memory of 4440 3700 {CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_98f50381b4543fd6f91ac0df23242fa1_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\{F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exeC:\Windows\{F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exeC:\Windows\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\{EB365129-19B7-405e-B6EC-4D3E8461BED7}.exeC:\Windows\{EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\{70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exeC:\Windows\{70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exeC:\Windows\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exeC:\Windows\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\{6860B419-6C5F-46ad-89B1-A5943A737EFB}.exeC:\Windows\{6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exeC:\Windows\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\{F8340D12-B834-42c2-8E73-B5D08093FE85}.exeC:\Windows\{F8340D12-B834-42c2-8E73-B5D08093FE85}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exeC:\Windows\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\{4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exeC:\Windows\{4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4024 -
C:\Windows\{706B22F8-6C50-4349-B092-1818AEE041C2}.exeC:\Windows\{706B22F8-6C50-4349-B092-1818AEE041C2}.exe13⤵
- Executes dropped EXE
PID:784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E87D~1.EXE > nul13⤵PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAAB8~1.EXE > nul12⤵PID:4440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8340~1.EXE > nul11⤵PID:2496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6326~1.EXE > nul10⤵PID:3036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6860B~1.EXE > nul9⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8E06~1.EXE > nul8⤵PID:3288
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DA7F~1.EXE > nul7⤵PID:2180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70309~1.EXE > nul6⤵PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB365~1.EXE > nul5⤵PID:4572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1C0F~1.EXE > nul4⤵PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2A6B~1.EXE > nul3⤵PID:3524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:2040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1DA7FB23-4F6F-4de6-8CBE-0522CBAF7583}.exe
- Size 408KB
- SHA256 46662c4e569e46cc59399f97bdb04c8e6bfb4fb290206eeac15d5e41eb5dd65e
- MD5 bad955fd6df9441fd7737b44cdea021f
- SHA1 d1fd4704a795c100f0bc9b20d55411ff4a10c916
- SHA512 291bd1445e5cce57b49b57763158acbdbf6668ca98e16046e16c444b0028c648393b6a69ae510e293e09261e9dbebfbbc891b69721a89177286dfd85db732b69
- SSDEEP 3072:CEGh0oTl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGJldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4E87D8A8-41C5-4852-8F40-EA336AF04B45}.exe
- Size 408KB
- SHA256 a674ad5f6339f0a59ab148641d939df80697f0462fd99ef63353d32ab688508e
- MD5 aa5be6531e3cbc1a0dcdbbeaf1c505de
- SHA1 2ef884f13c7c8b664c9c1e038fd777ae4417ffec
- SHA512 0f2a39ce4793e5c03e5f4402d6bc1cbf50e5ba7f4a74d5d4c82257ef985920d00102d1c250862d59915f94f3014ff3dc405c97cb878c888c1d92bee606ab6a8e
- SSDEEP 3072:CEGh0oRl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGrldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6860B419-6C5F-46ad-89B1-A5943A737EFB}.exe
- Size 408KB
- SHA256 aa3a3d505fcd842870468edd1102f74e93bff6599372294c7f45af6c19f2cac6
- MD5 ad3df95457d802e1e8c2b3014300d90b
- SHA1 608f6283fe791de877c498343c2fb15b10a33293
- SHA512 a59e2d7a15743b34c8c2fa9338ad38bf023c56f9473e4a3f1286bdb9568233b66eaee33d53af33ac4a07964c9779642245565ec9d6c6b49a3c334eeb34847cfa
- SSDEEP 3072:CEGh0oul3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGUldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{70309CCD-2E1B-4cb8-88F1-185777F0BB32}.exe
- Size 408KB
- SHA256 9efe7536407a599119120be6513bbdb5bdf57b3e4ce30f18f93c83194be3d211
- MD5 eedf0ffc581871e7c82c1a319bd6b618
- SHA1 273a2c95c420c3e8fece606fa874126a37096280
- SHA512 b9724c8b665ee5576dcf0662f2aa9c2ebf7ec621e95a4fa0a3ad074675bd3dd837494de4ca5b1467e3f7efcd0b1300ab6da49d53aa20719d783e78407dad5716
- SSDEEP 3072:CEGh0oFl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG/ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{706B22F8-6C50-4349-B092-1818AEE041C2}.exe
- Size 408KB
- SHA256 746765fb5764054d82a76e34db06c400723eefa5bc07b1bddf3a7a3aa7b0205d
- MD5 4abf1b74ba77fe56c42a7e70d0eff5c1
- SHA1 30f969aa42829e696743f13bfeec52f0c74e68a9
- SHA512 4130e63d6ccf125717966bafe9dc681151338bec0bb758ab4f2d306768c8a264aa95fd9e531e410f3b59233b2a51227403b85a3fdba5b47a979898381e349c38
- SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGpldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C63265DB-DEBC-45d9-A442-E9FE5D11A9F4}.exe
- Size 408KB
- SHA256 51c2a252f3455bd35e15a7971b2f441dc13d3a99592fb99f2e81717bc77bac50
- MD5 2344244f2fbd7b07477b55aefef2f880
- SHA1 0f5f4e1dbfc87cf3ed51740c2007b9048ac73991
- SHA512 b43bb27a2e784815f30ac9d58b78b00b3612b975dfacd707b999855082bd52de489533ede6444c5c3e5a4bee677589c8ad95a24f76d594da0743b0110e1c55e7
- SSDEEP 3072:CEGh0o0l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGOldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CAAB82C8-3B49-4106-AB69-84081BCBD0A1}.exe
- Size 408KB
- SHA256 9340e821de3f6f6a73c1b01bd4a426e0a1dabe56cc99f883216f58f989538a5d
- MD5 9348b15ab1dde60641429c02c6b5e76b
- SHA1 08a22b72b16b752151f2ec13357ce3d85d9f3785
- SHA512 2e6562c71f287fea9060452a3fc3d297dbb0ad70d0de6d98d31d2b1836b7435fb56ac0f6657ce1e69b3d137643b171299acb2ae87e1c2b9218d681f3642ff49b
- SSDEEP 3072:CEGh0o3l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGlldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EB365129-19B7-405e-B6EC-4D3E8461BED7}.exe
- Size 408KB
- SHA256 a2f9a54785f5652fe8fd97a96b56b2050da7b8ad476721afa2f4ffef4da58b50
- MD5 921284c0a6f6a2cedf820da4aa8224c4
- SHA1 89bb75dbe49bed035be9a2d34be17ef976fe9694
- SHA512 1704b07bee75b2e2b6c9a2721484623357862d0e05fce28d9d209221b210c50b3ac9c7bd74d995d7b52dd98e5bca152f9c515e0c001f5b933a1d356d85c38f6e
- SSDEEP 3072:CEGh0o1l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGHldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F1C0F5A3-A3C7-4391-A9EA-CA81B1B15054}.exe
- Size 408KB
- SHA256 20836f32e8f85a4800da9f53716b893fdb6632575c9d95b7ceacbe6341d368d3
- MD5 0b3b6376e2a9ab17581a29477be6ed39
- SHA1 0a20ea599f8ce0a6402ecb5871ee89b952b0cb2f
- SHA512 e31389d09580ce0a98dfb67f4b519649865e9f2a8444d56c316246c83789481a261447c67c5faf576894f84a99f1f71c6d2bef2b2f19f45df103dbf1252dda12
- SSDEEP 3072:CEGh0opl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGDldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F2A6B51B-6013-4fc6-9C90-1F393D996F29}.exe
- Size 408KB
- SHA256 68014f19bd0151b9414327c6391e5da54d2454f3760afa50a867c59f8ce8767c
- MD5 9a5f706ca4bbdaac00299997b11b96a8
- SHA1 1a13807879921bc9195031fde9ad8d524a4aecb9
- SHA512 caecf34b1de51a89cda91564468a344da7ceda3db83ccd4e639a9ff004c5dece7a45d5aa955a2d00def11149f433e08dde01f94edfc316a8debda9dbd4ab937f
- SSDEEP 3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGgldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F8340D12-B834-42c2-8E73-B5D08093FE85}.exe
- Size 408KB
- SHA256 e14caa4f9cd46b91671297efe1cc6e87a7cb8da4575bca909a197d47d5c8e847
- MD5 b3a2eb64d6a7a593c7d0fd922f25d225
- SHA1 9fa0fd951bfbf023ad01b834109a59f2b95d9723
- SHA512 dcb354ecfbf3bd4e84d30eb82d24c69ab83a179aff0b22a62e35dfb0c036d0f49cbe9b1490569dcb00975eb4f555ac87471e39cc7169b58d1528d2a758b11216
- SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG6ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F8E06AF7-3C4F-408f-B8AA-3A339DFB63E4}.exe
- Size 408KB
- SHA256 845ba1a2a48b0ed0037b1a4957304c205bc4f845eb34a93fec26b170166fb542
- MD5 6f28834c3e9a7f84a39fc58ac204abc1
- SHA1 8fa2569facbf9b7b16577a8c54b9163087a2de82
- SHA512 7872e6949e52710fbaadefa94899e6f5b4184ab0f2390b389cafb5d6a65f2c2434b3f64d2b320e49b48de5002c3dd8240a731e42bccc569ca544ef5e04b3cb8a
- SSDEEP 3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGaldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP