Analysis
- max time kernel
150s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 16:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe
- Size 197KB
- Sample240404-vc629ach5w
- SHA256 a9b7a3c7ea8649d84d702dac8376e41fd2068250169380f146bc544964af9e2a
- MD5 a5563ba3d7e7cb2fa42e1fcbfc7c6a89
- SHA1 cd06ee9346f6f716923e1f2f438276663d8436d8
- SHA512 c61bd69900f2c831e150e13b585523e14b07abc879e03b895227a556b204f25a057e8e4833a3f8d546bf23906932962ceb94cf704a3a0a19e9f17369bc28fd18
- SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGKlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000900000001db0b-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023200-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023207-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023200-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000021524-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000021526-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000021524-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000037-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000037-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000000037-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A422BB17-8B66-4a7f-8523-BD5671B69B28}\stubpath = "C:\\Windows\\{A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe" {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6599C16A-7102-4773-A5D1-A14C91DE2DF9}\stubpath = "C:\\Windows\\{6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe" {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063} {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5DD5A6C-026C-402e-8F82-127977CF5327} {A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2} 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}\stubpath = "C:\\Windows\\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe" 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AED756D-27DA-4a05-921C-4F4979788D0A} {56BC133D-75EE-4b06-85B0-B239313833B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44A83ADB-05DA-46da-8F78-A6EF53FB5875} {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44A83ADB-05DA-46da-8F78-A6EF53FB5875}\stubpath = "C:\\Windows\\{44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe" {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD83DC9-2739-4291-9584-1A1C31A771BC} {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD83DC9-2739-4291-9584-1A1C31A771BC}\stubpath = "C:\\Windows\\{3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe" {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56BC133D-75EE-4b06-85B0-B239313833B8} {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7175087-57B8-47af-9AFE-B9F159866E1F}\stubpath = "C:\\Windows\\{F7175087-57B8-47af-9AFE-B9F159866E1F}.exe" {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00844573-C005-4e18-8DD2-54D5424BC4FF}\stubpath = "C:\\Windows\\{00844573-C005-4e18-8DD2-54D5424BC4FF}.exe" {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5DD5A6C-026C-402e-8F82-127977CF5327}\stubpath = "C:\\Windows\\{E5DD5A6C-026C-402e-8F82-127977CF5327}.exe" {A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56BC133D-75EE-4b06-85B0-B239313833B8}\stubpath = "C:\\Windows\\{56BC133D-75EE-4b06-85B0-B239313833B8}.exe" {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AED756D-27DA-4a05-921C-4F4979788D0A}\stubpath = "C:\\Windows\\{7AED756D-27DA-4a05-921C-4F4979788D0A}.exe" {56BC133D-75EE-4b06-85B0-B239313833B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7175087-57B8-47af-9AFE-B9F159866E1F} {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A422BB17-8B66-4a7f-8523-BD5671B69B28} {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}\stubpath = "C:\\Windows\\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe" {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8} {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}\stubpath = "C:\\Windows\\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe" {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6599C16A-7102-4773-A5D1-A14C91DE2DF9} {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00844573-C005-4e18-8DD2-54D5424BC4FF} {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe - Executes dropped EXE 12 IoCs
pid Process 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 4248 {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe 2784 {A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe 2304 {E5DD5A6C-026C-402e-8F82-127977CF5327}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe File created C:\Windows\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe File created C:\Windows\{F7175087-57B8-47af-9AFE-B9F159866E1F}.exe {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe File created C:\Windows\{A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe File created C:\Windows\{6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe File created C:\Windows\{00844573-C005-4e18-8DD2-54D5424BC4FF}.exe {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe File created C:\Windows\{3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe File created C:\Windows\{56BC133D-75EE-4b06-85B0-B239313833B8}.exe {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe File created C:\Windows\{7AED756D-27DA-4a05-921C-4F4979788D0A}.exe {56BC133D-75EE-4b06-85B0-B239313833B8}.exe File created C:\Windows\{44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe File created C:\Windows\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe File created C:\Windows\{E5DD5A6C-026C-402e-8F82-127977CF5327}.exe {A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe Token: SeIncBasePriorityPrivilege 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe Token: SeIncBasePriorityPrivilege 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe Token: SeIncBasePriorityPrivilege 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe Token: SeIncBasePriorityPrivilege 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe Token: SeIncBasePriorityPrivilege 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe Token: SeIncBasePriorityPrivilege 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe Token: SeIncBasePriorityPrivilege 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe Token: SeIncBasePriorityPrivilege 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe Token: SeIncBasePriorityPrivilege 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe Token: SeIncBasePriorityPrivilege 4248 {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe Token: SeIncBasePriorityPrivilege 2784 {A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 680 wrote to memory of 1232 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe 96 PID 680 wrote to memory of 1232 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe 96 PID 680 wrote to memory of 1232 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe 96 PID 680 wrote to memory of 1080 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe 97 PID 680 wrote to memory of 1080 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe 97 PID 680 wrote to memory of 1080 680 2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe 97 PID 1232 wrote to memory of 1636 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 98 PID 1232 wrote to memory of 1636 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 98 PID 1232 wrote to memory of 1636 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 98 PID 1232 wrote to memory of 2712 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 99 PID 1232 wrote to memory of 2712 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 99 PID 1232 wrote to memory of 2712 1232 {9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe 99 PID 1636 wrote to memory of 400 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 101 PID 1636 wrote to memory of 400 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 101 PID 1636 wrote to memory of 400 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 101 PID 1636 wrote to memory of 548 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 102 PID 1636 wrote to memory of 548 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 102 PID 1636 wrote to memory of 548 1636 {3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe 102 PID 400 wrote to memory of 2280 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 103 PID 400 wrote to memory of 2280 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 103 PID 400 wrote to memory of 2280 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 103 PID 400 wrote to memory of 3716 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 104 PID 400 wrote to memory of 3716 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 104 PID 400 wrote to memory of 3716 400 {56BC133D-75EE-4b06-85B0-B239313833B8}.exe 104 PID 2280 wrote to memory of 3584 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 105 PID 2280 wrote to memory of 3584 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 105 PID 2280 wrote to memory of 3584 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 105 PID 2280 wrote to memory of 2520 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 106 PID 2280 wrote to memory of 2520 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 106 PID 2280 wrote to memory of 2520 2280 {7AED756D-27DA-4a05-921C-4F4979788D0A}.exe 106 PID 3584 wrote to memory of 2432 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 107 PID 3584 wrote to memory of 2432 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 107 PID 3584 wrote to memory of 2432 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 107 PID 3584 wrote to memory of 1528 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 108 PID 3584 wrote to memory of 1528 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 108 PID 3584 wrote to memory of 1528 3584 {C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe 108 PID 2432 wrote to memory of 4276 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 109 PID 2432 wrote to memory of 4276 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 109 PID 2432 wrote to memory of 4276 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 109 PID 2432 wrote to memory of 4316 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 110 PID 2432 wrote to memory of 4316 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 110 PID 2432 wrote to memory of 4316 2432 {F7175087-57B8-47af-9AFE-B9F159866E1F}.exe 110 PID 4276 wrote to memory of 1076 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 111 PID 4276 wrote to memory of 1076 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 111 PID 4276 wrote to memory of 1076 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 111 PID 4276 wrote to memory of 1692 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 112 PID 4276 wrote to memory of 1692 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 112 PID 4276 wrote to memory of 1692 4276 {44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe 112 PID 1076 wrote to memory of 556 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 113 PID 1076 wrote to memory of 556 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 113 PID 1076 wrote to memory of 556 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 113 PID 1076 wrote to memory of 1380 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 114 PID 1076 wrote to memory of 1380 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 114 PID 1076 wrote to memory of 1380 1076 {A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe 114 PID 556 wrote to memory of 4248 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 115 PID 556 wrote to memory of 4248 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 115 PID 556 wrote to memory of 4248 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 115 PID 556 wrote to memory of 2780 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 116 PID 556 wrote to memory of 2780 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 116 PID 556 wrote to memory of 2780 556 {6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe 116 PID 4248 wrote to memory of 2784 4248 {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe 117 PID 4248 wrote to memory of 2784 4248 {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe 117 PID 4248 wrote to memory of 2784 4248 {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe 117 PID 4248 wrote to memory of 4656 4248 {00844573-C005-4e18-8DD2-54D5424BC4FF}.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_a5563ba3d7e7cb2fa42e1fcbfc7c6a89_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exeC:\Windows\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\{3BD83DC9-2739-4291-9584-1A1C31A771BC}.exeC:\Windows\{3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\{56BC133D-75EE-4b06-85B0-B239313833B8}.exeC:\Windows\{56BC133D-75EE-4b06-85B0-B239313833B8}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\{7AED756D-27DA-4a05-921C-4F4979788D0A}.exeC:\Windows\{7AED756D-27DA-4a05-921C-4F4979788D0A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exeC:\Windows\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\{F7175087-57B8-47af-9AFE-B9F159866E1F}.exeC:\Windows\{F7175087-57B8-47af-9AFE-B9F159866E1F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\{44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exeC:\Windows\{44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\{A422BB17-8B66-4a7f-8523-BD5671B69B28}.exeC:\Windows\{A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\{6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exeC:\Windows\{6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\{00844573-C005-4e18-8DD2-54D5424BC4FF}.exeC:\Windows\{00844573-C005-4e18-8DD2-54D5424BC4FF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exeC:\Windows\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\{E5DD5A6C-026C-402e-8F82-127977CF5327}.exeC:\Windows\{E5DD5A6C-026C-402e-8F82-127977CF5327}.exe13⤵
- Executes dropped EXE
PID:2304
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4BF4~1.EXE > nul13⤵PID:436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00844~1.EXE > nul12⤵PID:4656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6599C~1.EXE > nul11⤵PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A422B~1.EXE > nul10⤵PID:1380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44A83~1.EXE > nul9⤵PID:1692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7175~1.EXE > nul8⤵PID:4316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5C8F~1.EXE > nul7⤵PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AED7~1.EXE > nul6⤵PID:2520
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56BC1~1.EXE > nul5⤵PID:3716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BD83~1.EXE > nul4⤵PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F83C~1.EXE > nul3⤵PID:2712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{00844573-C005-4e18-8DD2-54D5424BC4FF}.exe
- Size 197KB
- SHA256 4c09968f09437c3d0ec58a9bcc23e5c7242dc6dbea810b73f3a62ee105497faf
- MD5 d97d208e892f07f13398f11128e4a88c
- SHA1 194e26fbd11ac20584a7a58d201b8a6448be1f16
- SHA512 ade6ed26a1ac087369fd9a9498e4b9c6bb92ecec46f871fd1756e28f83368b4861facebd7a530260df8e9e54fb1b6200750bac0fe169fb76ff9cabb09e40a315
- SSDEEP 3072:jEGh0oSl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGclEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3BD83DC9-2739-4291-9584-1A1C31A771BC}.exe
- Size 197KB
- SHA256 eee71dc9869a73343dba5e1776186aa2baed23273675acd063d8d2c48270abaf
- MD5 346fe83360d239532fa7c61ba2ef284d
- SHA1 68f2d8d9c47c2ef312ae68d2ee5ad9970bf4db39
- SHA512 7dd16a2770431c15b83725f0cb6abb49ec13e4718ff49ce2889181de3d6d8bb9d022d767468459b71046f014ea0e8df5421ac359e77974c0ca4672417e699eb5
- SSDEEP 3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGolEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{44A83ADB-05DA-46da-8F78-A6EF53FB5875}.exe
- Size 197KB
- SHA256 60b1c36b5dfc810abd2fc2174708a3615818a0f3e943eff6860942db8a673850
- MD5 3a59e914bd879aee48be060be00bba0a
- SHA1 229fcd6aded5dfbd1c2d1df06286bd50e1b95397
- SHA512 8ddaa1b4c7f12c786606fa132a69249cdd5899c8fdafa93993c9c9cd9f255fbe087d7b0e429583796119716ae4c63f32b63cb49417e099175b5d7f059e1cf540
- SSDEEP 3072:jEGh0oul+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGYlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{56BC133D-75EE-4b06-85B0-B239313833B8}.exe
- Size 197KB
- SHA256 efaee6aeb9b3f9508256b350d8b201197685c0f99aaddd98f2d97c25a1f5a7e1
- MD5 d92d015907f6948f2e4f24b340e36ae9
- SHA1 d67b55286db02ee20b1576f89773012ae85b37e5
- SHA512 b1f28da9fde6aa5549fd23a17d58cbca8d427bc70157158b2b10cb3af9eee4645dbcbede8fbf9d5cb8429d90b2411c9078a2ca7222cc84cd3eb30b2cfd86f9dc
- SSDEEP 3072:jEGh0oZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGLlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6599C16A-7102-4773-A5D1-A14C91DE2DF9}.exe
- Size 197KB
- SHA256 435aef700d24166753794d1f5e30d23d7201e74b9f2ea1dbf2e0007b4d401f67
- MD5 de997e8fadedc636b30dc902ac4f03dd
- SHA1 8c4b69c40c0bf2b01b5c76c7f2c4e00c129cc2ef
- SHA512 b78304f9624e8a7c07700dbb3c3e3a365fe542e4bf896e553857b87f42b69494d20ca72fa8e4817c179272ab38448fb5deaee76a92ae790bc7fc692be5e6e205
- SSDEEP 3072:jEGh0otl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGflEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7AED756D-27DA-4a05-921C-4F4979788D0A}.exe
- Size 197KB
- SHA256 a6bbd0763ac0e0750386482f6dfc9916ea12584394389e5c7c45367679c7a5d0
- MD5 58c3785bb9a8e51a5ce41baf7ded0b86
- SHA1 c01b32b787868349eac3b2507e6aa8b399c71e31
- SHA512 0a1835b63f77fb8635a1ad50ded2a246577e834994b8670146accaa48193ea27f33e0aee1f5d568baf9005615bc169fad53bcd4e6df87ed08de7ee051da460e0
- SSDEEP 3072:jEGh0oHl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGdlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9F83C6BD-8BFB-43aa-86AB-B0BE092DA0C2}.exe
- Size 197KB
- SHA256 5f337ad158cff47471ead1c88b9bd09f24c0f81c4e4b67c67514d4cdff368d52
- MD5 dfd7d0e7e9745d1a96312e119344cf5b
- SHA1 d671629dba16871e118e89f9ee07c83eebdeab11
- SHA512 77928e399dedd429fd7e61c01a495c128e0b96d6b1f3b3ca8ad786a421ee083aa902b692be4c0d8b37cf9d1e1e78656bd743874c00570c05551ba0df6d924440
- SSDEEP 3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGjlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A422BB17-8B66-4a7f-8523-BD5671B69B28}.exe
- Size 197KB
- SHA256 5e88f4006053584880c4395158f819551f6beb8347304dff190ecaa14aa25309
- MD5 9463fb24f4f0867e33920a24624201ca
- SHA1 0bce704544ea7085c2cf8c7fb072216e809a35e4
- SHA512 422635083bc545207f0bb9bc293c5f985baccc3aef8d2307a61eb81ed38fc84ec5390e880374b4dbdf60c0597b81dd299eb2d600468e3e3af28bb702d58f2a69
- SSDEEP 3072:jEGh0oZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGblEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A4BF4ECE-3BC0-4f60-A97C-2DEF0A30E063}.exe
- Size 197KB
- SHA256 7628b780b6a69dd2932b1ad0db93e0cc5e9c21ae1db3ae572c1875408784dca7
- MD5 192d9d9c217c29a40799d58333910e86
- SHA1 9505142f40b9747a1341ae789fdc87f81db8908a
- SHA512 e913d316bda34776ffe13c1707856cf70e2c6b75fb867b8ff98928ddf6e5d78bbb06bd41e72718b3f31b488e138b76b293fea9c1bc224c62a34decb612784445
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGllEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C5C8FBC3-B49B-4602-8A85-A25F6D59A0C8}.exe
- Size 197KB
- SHA256 d7454e97f754649f67058668313bba8327f066d40519acd608f5fbc02989d1f6
- MD5 80053cd86736969309dd932295bb52cb
- SHA1 3d53cf4a6e5dd686036d43f2982e010ab32e0e74
- SHA512 6850549136195160c8589297d438f7229d99a54e2b15e03ad2b7ecfbd86c1683f7070c21dcb446b60f7e0d94d14c2ab4cfc64a8a366fd22e01496272c5b98716
- SSDEEP 3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGMlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E5DD5A6C-026C-402e-8F82-127977CF5327}.exe
- Size 197KB
- SHA256 7f5a73a6ed5037f34b39840cf3a9ba505e911a1d89887e8eb3b2a20a4dc45cad
- MD5 2ab73889b5261bbe7c17865a1e336338
- SHA1 25859bd9a617416107221eb8a667772ad0d296a6
- SHA512 c7dcc416e6ec6dbf755f5929027eeaf42d795c619fdabfbf6070c54550f758315ffb34d4c435d4fbd9622bffbd207c56a6112a7d4220b589ca0268f72c9886e4
- SSDEEP 3072:jEGh0okl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGOlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F7175087-57B8-47af-9AFE-B9F159866E1F}.exe
- Size 197KB
- SHA256 7d86f9559702f3ac334388c32b8b10788475f26767c47bbf4199db83577a8c98
- MD5 49e445bfbb33f6f689e992aed2761b01
- SHA1 a8be1cdc1486b7b898136253816a475379e6d8f4
- SHA512 1be400fa23b280eaa16adbd143ce8eeeaa9328f6e49472a6a522fdf15b93dcfab1ec7dae8124091af70488f28d3a76ad31755a9e272ea2e34b2206a17d600b38
- SSDEEP 3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG4lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP