Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 17:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe
- Size 380KB
- Sample240404-vy9ehaeb35
- SHA256 0b5062aab7c8c2918736547560ead5c89add09714551eb4229807dcbe4eca3e2
- MD5 1071f14eba32be3db0119a1ed3b3309e
- SHA1 482abf1b3c77b6d1f5b82f91b6e960768b348b96
- SHA512 56850e251b06143a423c918f8485396fdbdc50432f6c9a4427dcd4b6a2d3d75a67353b6602452a11407f21e064fa8e17b79240c2b505ef9b23da1ce7d2061982
- SSDEEP 3072:mEGh0oklPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG2l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000a00000002332e-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023333-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00040000000167e1-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0013000000023333-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00050000000167e1-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0015000000023333-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00060000000167e1-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0016000000023333-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f0000000230d6-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000230e0-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00100000000230d6-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d0000000230fc-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78} {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{968E3272-09F2-4fb8-8940-FBADE7E8A106} {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{968E3272-09F2-4fb8-8940-FBADE7E8A106}\stubpath = "C:\\Windows\\{968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe" {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FA15197-DF06-4266-917F-D602F41D36F6} {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}\stubpath = "C:\\Windows\\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}.exe" {C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}\stubpath = "C:\\Windows\\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe" 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FA15197-DF06-4266-917F-D602F41D36F6}\stubpath = "C:\\Windows\\{9FA15197-DF06-4266-917F-D602F41D36F6}.exe" {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6}\stubpath = "C:\\Windows\\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe" {9FA15197-DF06-4266-917F-D602F41D36F6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3E901BB-C90A-480c-A485-0C478271F404} {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87} {D3E901BB-C90A-480c-A485-0C478271F404}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B} {C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78}\stubpath = "C:\\Windows\\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe" {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0197AF06-6E6B-4f55-BBE3-3564414B36CB} {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0197AF06-6E6B-4f55-BBE3-3564414B36CB}\stubpath = "C:\\Windows\\{0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe" {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}\stubpath = "C:\\Windows\\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe" {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}\stubpath = "C:\\Windows\\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe" {D3E901BB-C90A-480c-A485-0C478271F404}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6A54769-0E8B-4840-8A24-12F4C8398DF8} {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6A54769-0E8B-4840-8A24-12F4C8398DF8}\stubpath = "C:\\Windows\\{C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe" {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{537BABD4-F0AD-4248-BF81-8DE60F715845}\stubpath = "C:\\Windows\\{537BABD4-F0AD-4248-BF81-8DE60F715845}.exe" {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{537BABD4-F0AD-4248-BF81-8DE60F715845} {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6} {9FA15197-DF06-4266-917F-D602F41D36F6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1} {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3E901BB-C90A-480c-A485-0C478271F404}\stubpath = "C:\\Windows\\{D3E901BB-C90A-480c-A485-0C478271F404}.exe" {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF} 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe - Executes dropped EXE 12 IoCs
pid Process 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 4276 {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe 780 {C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe 5104 {8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe {D3E901BB-C90A-480c-A485-0C478271F404}.exe File created C:\Windows\{C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe File created C:\Windows\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe File created C:\Windows\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe File created C:\Windows\{968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe File created C:\Windows\{537BABD4-F0AD-4248-BF81-8DE60F715845}.exe {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe File created C:\Windows\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe {9FA15197-DF06-4266-917F-D602F41D36F6}.exe File created C:\Windows\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe File created C:\Windows\{0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe File created C:\Windows\{9FA15197-DF06-4266-917F-D602F41D36F6}.exe {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe File created C:\Windows\{D3E901BB-C90A-480c-A485-0C478271F404}.exe {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe File created C:\Windows\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}.exe {C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe Token: SeIncBasePriorityPrivilege 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe Token: SeIncBasePriorityPrivilege 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe Token: SeIncBasePriorityPrivilege 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe Token: SeIncBasePriorityPrivilege 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe Token: SeIncBasePriorityPrivilege 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe Token: SeIncBasePriorityPrivilege 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe Token: SeIncBasePriorityPrivilege 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe Token: SeIncBasePriorityPrivilege 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe Token: SeIncBasePriorityPrivilege 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe Token: SeIncBasePriorityPrivilege 4276 {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe Token: SeIncBasePriorityPrivilege 780 {C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4468 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe 107 PID 1628 wrote to memory of 4468 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe 107 PID 1628 wrote to memory of 4468 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe 107 PID 1628 wrote to memory of 3212 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe 108 PID 1628 wrote to memory of 3212 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe 108 PID 1628 wrote to memory of 3212 1628 2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe 108 PID 4468 wrote to memory of 392 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 109 PID 4468 wrote to memory of 392 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 109 PID 4468 wrote to memory of 392 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 109 PID 4468 wrote to memory of 4316 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 110 PID 4468 wrote to memory of 4316 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 110 PID 4468 wrote to memory of 4316 4468 {F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe 110 PID 392 wrote to memory of 3612 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 113 PID 392 wrote to memory of 3612 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 113 PID 392 wrote to memory of 3612 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 113 PID 392 wrote to memory of 1396 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 114 PID 392 wrote to memory of 1396 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 114 PID 392 wrote to memory of 1396 392 {52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe 114 PID 3612 wrote to memory of 2556 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 116 PID 3612 wrote to memory of 2556 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 116 PID 3612 wrote to memory of 2556 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 116 PID 3612 wrote to memory of 2672 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 117 PID 3612 wrote to memory of 2672 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 117 PID 3612 wrote to memory of 2672 3612 {968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe 117 PID 2556 wrote to memory of 5048 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 118 PID 2556 wrote to memory of 5048 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 118 PID 2556 wrote to memory of 5048 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 118 PID 2556 wrote to memory of 4272 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 119 PID 2556 wrote to memory of 4272 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 119 PID 2556 wrote to memory of 4272 2556 {537BABD4-F0AD-4248-BF81-8DE60F715845}.exe 119 PID 5048 wrote to memory of 4608 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 121 PID 5048 wrote to memory of 4608 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 121 PID 5048 wrote to memory of 4608 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 121 PID 5048 wrote to memory of 3832 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 122 PID 5048 wrote to memory of 3832 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 122 PID 5048 wrote to memory of 3832 5048 {0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe 122 PID 4608 wrote to memory of 4384 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 123 PID 4608 wrote to memory of 4384 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 123 PID 4608 wrote to memory of 4384 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 123 PID 4608 wrote to memory of 3552 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 124 PID 4608 wrote to memory of 3552 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 124 PID 4608 wrote to memory of 3552 4608 {9FA15197-DF06-4266-917F-D602F41D36F6}.exe 124 PID 4384 wrote to memory of 3324 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 125 PID 4384 wrote to memory of 3324 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 125 PID 4384 wrote to memory of 3324 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 125 PID 4384 wrote to memory of 2688 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 126 PID 4384 wrote to memory of 2688 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 126 PID 4384 wrote to memory of 2688 4384 {C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe 126 PID 3324 wrote to memory of 3212 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 135 PID 3324 wrote to memory of 3212 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 135 PID 3324 wrote to memory of 3212 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 135 PID 3324 wrote to memory of 4596 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 136 PID 3324 wrote to memory of 4596 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 136 PID 3324 wrote to memory of 4596 3324 {4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe 136 PID 3212 wrote to memory of 4276 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 137 PID 3212 wrote to memory of 4276 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 137 PID 3212 wrote to memory of 4276 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 137 PID 3212 wrote to memory of 968 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 138 PID 3212 wrote to memory of 968 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 138 PID 3212 wrote to memory of 968 3212 {D3E901BB-C90A-480c-A485-0C478271F404}.exe 138 PID 4276 wrote to memory of 780 4276 {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe 140 PID 4276 wrote to memory of 780 4276 {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe 140 PID 4276 wrote to memory of 780 4276 {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe 140 PID 4276 wrote to memory of 4632 4276 {9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_1071f14eba32be3db0119a1ed3b3309e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exeC:\Windows\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exeC:\Windows\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\{968E3272-09F2-4fb8-8940-FBADE7E8A106}.exeC:\Windows\{968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\{537BABD4-F0AD-4248-BF81-8DE60F715845}.exeC:\Windows\{537BABD4-F0AD-4248-BF81-8DE60F715845}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\{0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exeC:\Windows\{0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\{9FA15197-DF06-4266-917F-D602F41D36F6}.exeC:\Windows\{9FA15197-DF06-4266-917F-D602F41D36F6}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exeC:\Windows\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exeC:\Windows\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\{D3E901BB-C90A-480c-A485-0C478271F404}.exeC:\Windows\{D3E901BB-C90A-480c-A485-0C478271F404}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exeC:\Windows\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\{C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exeC:\Windows\{C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}.exeC:\Windows\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}.exe13⤵
- Executes dropped EXE
PID:5104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6A54~1.EXE > nul13⤵PID:2852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EA97~1.EXE > nul12⤵PID:4632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3E90~1.EXE > nul11⤵PID:968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FC19~1.EXE > nul10⤵PID:4596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C126D~1.EXE > nul9⤵PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FA15~1.EXE > nul8⤵PID:3552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0197A~1.EXE > nul7⤵PID:3832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{537BA~1.EXE > nul6⤵PID:4272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{968E3~1.EXE > nul5⤵PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52A30~1.EXE > nul4⤵PID:1396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2A43~1.EXE > nul3⤵PID:4316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=2232,i,10468259530860544675,2192522633371581869,262144 --variations-seed-version /prefetch:81⤵PID:1852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0197AF06-6E6B-4f55-BBE3-3564414B36CB}.exe
- Size 380KB
- SHA256 f60bba03e0976e1ed157aff77eb458ccb194f59923fad6289765cba539a26736
- MD5 d8738566491bd4c76a8caaec15562d64
- SHA1 dd7e6491ff3f0a96f1e29a0a635a60144a88cd16
- SHA512 da6c1c9dff32fbcac91ad94da005fe91017bb7a26b34b16b0de35952d302d6f3d96cd3aef76791c622b64971f42d06aab4a3c77fa76d770efa7e5605e9f065cc
- SSDEEP 3072:mEGh0oAlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGql7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4FC19197-EA21-4a6a-B1CD-DE2BEF00D7A1}.exe
- Size 380KB
- SHA256 425b0a42bff7aed93a6a41287311266271234997229d039b8091e70dd73f79b9
- MD5 7039d13ce4c848945533e1f421aa9199
- SHA1 3bfc9181f82db1b41d92262bee8f416a5613ca1c
- SHA512 89d5ee522d279e9aaf7388987e59daccbb212571dc26090b9bfd4cf817f15f1fe3d9e5085d07c5d9d7cb4f294f601d377fceb6271652d7b503da497f410d8ff2
- SSDEEP 3072:mEGh0oYlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGql7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{52A30F82-94C8-4b46-9AC4-8188CAAC1A78}.exe
- Size 380KB
- SHA256 923402908ce2683e389be86fb7fc35740d65202552d8068734b28f9048081e6c
- MD5 8fd3853d8343fcafce4ed72a59faaf9e
- SHA1 30e9a91a4ac5904510181b6fd131761119337b21
- SHA512 9a5c842168e763ea261b50f4f4bd1efd124028f4dc15e73be6818bd2df4309a50281793beab2dfcf62aa72e3c463a8dd2f4874f5b48ead856d015b6972880486
- SSDEEP 3072:mEGh0oKlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGcl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{537BABD4-F0AD-4248-BF81-8DE60F715845}.exe
- Size 380KB
- SHA256 9b4e9a6ea61d0dcc52af1f0bb67f53a6516bbec90ba4248922294fc741d2fe7e
- MD5 9e3c8036e2ba812549f4e75ec2375294
- SHA1 70e233c8eca865b79b2870788e3315728462a179
- SHA512 1f0f03bdcc1dab69517979b643e49119edb5585fe90e4c98a982b616bbadb35cc42d8fdcfed5612673c1de1945d03f862057259cd151b138b1cea93cfd3b4849
- SSDEEP 3072:mEGh0o3lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGJl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8DDACC7E-48F7-44a8-8BA5-F9BE8324583B}.exe
- Size 380KB
- SHA256 4cf3757b6d3c39b7cc1eececb308a1d795e52cfd25ddda4b3580aca322ca63a5
- MD5 773b0077c4c123bc5075c5e0c691f93a
- SHA1 eb8345e1f450e1a222cfd07bcb92bb91e9bf5ec6
- SHA512 f1dc610d223bd016992a771bff49251850241cd7c1284593f52fea27881722ae04f67de1ee020166a9c8e089fb39191e7007c6e02ea0f47493ce12178bbcc921
- SSDEEP 3072:mEGh0oglPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGOl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{968E3272-09F2-4fb8-8940-FBADE7E8A106}.exe
- Size 380KB
- SHA256 66cd6f4ef3292d5cbe60dad81d7edc885337da4affb678d423c2ea960d9e7bd1
- MD5 bf036a445dd4cdd2559cadf586e309cd
- SHA1 9009b3a8f626686eebef1d2dd0bb20ed60210521
- SHA512 a6d6a1c1bc5bf83ce2114b71b3916b724354485237c138865af4790f5691601cb92f732c7b23537e5449d37cce0860e3c4cb656930a23790e83f4179616cd480
- SSDEEP 3072:mEGh0oqlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGkl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9EA97D68-BC2C-45da-8A9C-366F5BFBDE87}.exe
- Size 380KB
- SHA256 e833175ec89d78c499d769dfada2c57bba965e82241c3390ba83b417681da2bf
- MD5 ef5f8a668438b10262d81238d584e398
- SHA1 aa0dbdb616951ed486fd62c3e4041ea7d3adcd39
- SHA512 7d1268b829072911d3a5ee6e413cce6182d999ec2982a2329abea96d2178e45988cde9ce7dacda632c76d8ca675f5c61cc1aea85f5ec7d66f46738f9291acc5f
- SSDEEP 3072:mEGh0oqlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9FA15197-DF06-4266-917F-D602F41D36F6}.exe
- Size 380KB
- SHA256 cb07e47ef8048ed703f27d555e435f3bb9e0445d550f79fcb4d75e915779619b
- MD5 28ef7d249afeb944dd8a83ed06383768
- SHA1 2cf19f53925df9134585d9ecd0fd8ccc7a67a709
- SHA512 9398a9e079d22b57fd104083ffe972de8903fcad14172cd9b232141c620312d7b4a25abf1c92a9e6da30ee2049fb34273a8e3df84130a2544662b64373522f06
- SSDEEP 3072:mEGh0oUlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGyl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C126D9C0-54BC-46c2-AD36-E85FB2A915F6}.exe
- Size 380KB
- SHA256 8e57bfffb57e6e3bfde12c974c45e3c0ea52a8cf10bc92441462ec41b3e308ee
- MD5 f934ff20e96172457f1c28081723c96b
- SHA1 12ee5659340e72a7e4cae02591a7afce1cf9f7a5
- SHA512 16b78d6ab7080a2cba763390e3408b87faa1825c9b0be948b4b97f46702a8cdeef40d1716b76e1215b873b4c2b92d666d574ecc7764f30475f08c352e553682c
- SSDEEP 3072:mEGh0oflPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGNl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C6A54769-0E8B-4840-8A24-12F4C8398DF8}.exe
- Size 380KB
- SHA256 7acd81f3bf4a562a047aa385f89a6b63a7af41809c55df3c2ae03b2f8469bfa7
- MD5 26fe5846edf81b9b1721084f4d0375e0
- SHA1 43ab5b41053f23f788da8f422fdb3beb165eb84b
- SHA512 bef45084880073e9cfd9050127511959471958ad6dde2b337780f7d80a506a5311f4054066b18dedee70347fad10748db1baa4720a2126193f74d649182c16cb
- SSDEEP 3072:mEGh0ovlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGxl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D3E901BB-C90A-480c-A485-0C478271F404}.exe
- Size 380KB
- SHA256 d463bad3293012fdac9e78a40969215dc2c3b04769007559cfb5192bc527fc1d
- MD5 b87096b3387697978d6163df965a589c
- SHA1 ea7e9b826644c0d385cca3870fcdb7fa9d717397
- SHA512 b49a2bf0ec0c0d4163ff32c829ecc13d67af4097a2105c005efc84fc88917ad220bd31e0ef4af5e55693ae5959fc58c8dbbcb126e8d63b48969e1ee50bd8ab9a
- SSDEEP 3072:mEGh0oklPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG6l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F2A43058-148A-4525-A7F9-1BCFB1AFC4AF}.exe
- Size 380KB
- SHA256 b35c57a087929f9fc84e1a22fb1802237005781074c6fd61cb0f29017d48424c
- MD5 39d02c7fc2b04cdfccd5d27888a25dd7
- SHA1 d2c735d1fd60f8b96d069302993ffc69b861e98c
- SHA512 b0a0c3a9262eae68bd09c2d58d95deb8fa3f83081adc8355b0f2df6129c78766becf71a3d4151dd8197411900c023711699fa0394da4d213731ab98791a0fee5
- SSDEEP 3072:mEGh0oSlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGMl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP