Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
06/04/2024, 06:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe
- Size 204KB
- Sample240406-hdrbzadd64
- SHA256 37d5aee290e98cb6a7ec61c77f0199da9d4f12690c249d6f8f7854fa3bb62f3d
- MD5 7edb1af838a5167e11b6e88e8952556b
- SHA1 c9e679e967a28f36ad1428b42bae68c7cd9374f5
- SHA512 85f688a6306f797a608ad6414cd76519d56be5b5c2795c4b2044ab6fea0fb10628fa5a415d6a4bc72be375f04e3da517358fc315c607f76eb74a98c498160400
- SSDEEP 1536:1EGh0oEl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oEl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000023213-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001000000002320d-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002321a-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001100000002320d-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021cfa-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021cfb-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021cfa-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000707-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}\stubpath = "C:\\Windows\\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe" {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B} {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}\stubpath = "C:\\Windows\\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe" {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E99212A-0E8F-40d7-A0A7-6622EE590502}\stubpath = "C:\\Windows\\{3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe" {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33FCC4EC-A2DD-4bc1-A323-786629B83801} {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33FCC4EC-A2DD-4bc1-A323-786629B83801}\stubpath = "C:\\Windows\\{33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe" {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}\stubpath = "C:\\Windows\\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe" {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07} {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}\stubpath = "C:\\Windows\\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe" 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49} {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E99212A-0E8F-40d7-A0A7-6622EE590502} {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30} {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{059128B5-FF75-4e17-9FF1-BF251052A046}\stubpath = "C:\\Windows\\{059128B5-FF75-4e17-9FF1-BF251052A046}.exe" {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5584808F-0969-457e-B470-6A9F1B8C3102} {059128B5-FF75-4e17-9FF1-BF251052A046}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5584808F-0969-457e-B470-6A9F1B8C3102}\stubpath = "C:\\Windows\\{5584808F-0969-457e-B470-6A9F1B8C3102}.exe" {059128B5-FF75-4e17-9FF1-BF251052A046}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962} 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26FFEBBD-500C-46b8-BB43-AE88F35C8865} {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F} {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}\stubpath = "C:\\Windows\\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe" {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{059128B5-FF75-4e17-9FF1-BF251052A046} {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D} {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D}\stubpath = "C:\\Windows\\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe" {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26FFEBBD-500C-46b8-BB43-AE88F35C8865}\stubpath = "C:\\Windows\\{26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe" {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}\stubpath = "C:\\Windows\\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe" {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe - Executes dropped EXE 12 IoCs
pid Process 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 3844 {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe 3332 {059128B5-FF75-4e17-9FF1-BF251052A046}.exe 4556 {5584808F-0969-457e-B470-6A9F1B8C3102}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe File created C:\Windows\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe File created C:\Windows\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe File created C:\Windows\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe File created C:\Windows\{33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe File created C:\Windows\{3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe File created C:\Windows\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe File created C:\Windows\{059128B5-FF75-4e17-9FF1-BF251052A046}.exe {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe File created C:\Windows\{5584808F-0969-457e-B470-6A9F1B8C3102}.exe {059128B5-FF75-4e17-9FF1-BF251052A046}.exe File created C:\Windows\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe File created C:\Windows\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe File created C:\Windows\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe Token: SeIncBasePriorityPrivilege 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe Token: SeIncBasePriorityPrivilege 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe Token: SeIncBasePriorityPrivilege 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe Token: SeIncBasePriorityPrivilege 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe Token: SeIncBasePriorityPrivilege 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe Token: SeIncBasePriorityPrivilege 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe Token: SeIncBasePriorityPrivilege 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe Token: SeIncBasePriorityPrivilege 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe Token: SeIncBasePriorityPrivilege 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe Token: SeIncBasePriorityPrivilege 3844 {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe Token: SeIncBasePriorityPrivilege 3332 {059128B5-FF75-4e17-9FF1-BF251052A046}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 1972 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe 95 PID 5016 wrote to memory of 1972 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe 95 PID 5016 wrote to memory of 1972 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe 95 PID 5016 wrote to memory of 1980 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe 96 PID 5016 wrote to memory of 1980 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe 96 PID 5016 wrote to memory of 1980 5016 2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe 96 PID 1972 wrote to memory of 2432 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 97 PID 1972 wrote to memory of 2432 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 97 PID 1972 wrote to memory of 2432 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 97 PID 1972 wrote to memory of 2808 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 98 PID 1972 wrote to memory of 2808 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 98 PID 1972 wrote to memory of 2808 1972 {C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe 98 PID 2432 wrote to memory of 2408 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 100 PID 2432 wrote to memory of 2408 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 100 PID 2432 wrote to memory of 2408 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 100 PID 2432 wrote to memory of 2840 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 101 PID 2432 wrote to memory of 2840 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 101 PID 2432 wrote to memory of 2840 2432 {3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe 101 PID 2408 wrote to memory of 4684 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 102 PID 2408 wrote to memory of 4684 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 102 PID 2408 wrote to memory of 4684 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 102 PID 2408 wrote to memory of 1560 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 103 PID 2408 wrote to memory of 1560 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 103 PID 2408 wrote to memory of 1560 2408 {7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe 103 PID 4684 wrote to memory of 3600 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 104 PID 4684 wrote to memory of 3600 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 104 PID 4684 wrote to memory of 3600 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 104 PID 4684 wrote to memory of 3852 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 105 PID 4684 wrote to memory of 3852 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 105 PID 4684 wrote to memory of 3852 4684 {38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe 105 PID 3600 wrote to memory of 4972 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 106 PID 3600 wrote to memory of 4972 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 106 PID 3600 wrote to memory of 4972 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 106 PID 3600 wrote to memory of 2264 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 107 PID 3600 wrote to memory of 2264 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 107 PID 3600 wrote to memory of 2264 3600 {3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe 107 PID 4972 wrote to memory of 4476 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 108 PID 4972 wrote to memory of 4476 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 108 PID 4972 wrote to memory of 4476 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 108 PID 4972 wrote to memory of 3364 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 109 PID 4972 wrote to memory of 3364 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 109 PID 4972 wrote to memory of 3364 4972 {56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe 109 PID 4476 wrote to memory of 4896 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 110 PID 4476 wrote to memory of 4896 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 110 PID 4476 wrote to memory of 4896 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 110 PID 4476 wrote to memory of 884 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 111 PID 4476 wrote to memory of 884 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 111 PID 4476 wrote to memory of 884 4476 {33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe 111 PID 4896 wrote to memory of 3644 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 112 PID 4896 wrote to memory of 3644 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 112 PID 4896 wrote to memory of 3644 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 112 PID 4896 wrote to memory of 4428 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 113 PID 4896 wrote to memory of 4428 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 113 PID 4896 wrote to memory of 4428 4896 {26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe 113 PID 3644 wrote to memory of 3844 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 114 PID 3644 wrote to memory of 3844 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 114 PID 3644 wrote to memory of 3844 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 114 PID 3644 wrote to memory of 632 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 115 PID 3644 wrote to memory of 632 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 115 PID 3644 wrote to memory of 632 3644 {169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe 115 PID 3844 wrote to memory of 3332 3844 {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe 116 PID 3844 wrote to memory of 3332 3844 {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe 116 PID 3844 wrote to memory of 3332 3844 {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe 116 PID 3844 wrote to memory of 2308 3844 {7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_7edb1af838a5167e11b6e88e8952556b_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exeC:\Windows\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exeC:\Windows\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exeC:\Windows\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exeC:\Windows\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\{3E99212A-0E8F-40d7-A0A7-6622EE590502}.exeC:\Windows\{3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exeC:\Windows\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\{33FCC4EC-A2DD-4bc1-A323-786629B83801}.exeC:\Windows\{33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\{26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exeC:\Windows\{26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exeC:\Windows\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exeC:\Windows\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\{059128B5-FF75-4e17-9FF1-BF251052A046}.exeC:\Windows\{059128B5-FF75-4e17-9FF1-BF251052A046}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3332 -
C:\Windows\{5584808F-0969-457e-B470-6A9F1B8C3102}.exeC:\Windows\{5584808F-0969-457e-B470-6A9F1B8C3102}.exe13⤵
- Executes dropped EXE
PID:4556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05912~1.EXE > nul13⤵PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A8DC~1.EXE > nul12⤵PID:2308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{169D7~1.EXE > nul11⤵PID:632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26FFE~1.EXE > nul10⤵PID:4428
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33FCC~1.EXE > nul9⤵PID:884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56A0A~1.EXE > nul8⤵PID:3364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E992~1.EXE > nul7⤵PID:2264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38E8D~1.EXE > nul6⤵PID:3852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A501~1.EXE > nul5⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B7FC~1.EXE > nul4⤵PID:2840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1DAC~1.EXE > nul3⤵PID:2808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{059128B5-FF75-4e17-9FF1-BF251052A046}.exe
- Size 204KB
- SHA256 d5001014d98cf2a22212d2cee4b0db9c7f86608aa7a48a5457991a6f24031df3
- MD5 49e63340f2e949937681e75f90d4d6ca
- SHA1 a1fbd82245e851e88e121d6096bf077e432fe0fb
- SHA512 073d80f959ccb817563bb5a20377dc50dcc977c528669491ce7dcc94df9966e9f65754cff089f11d5471782b500f9a9393a6e590361a9f49f653cfc18a8192f5
- SSDEEP 1536:1EGh0obl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0obl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{169D7F8A-4DDD-406e-ACD9-4B8FC4CEDF30}.exe
- Size 204KB
- SHA256 f8a33ce9dbf98eb2d439b50e826bbe9159829f6344e36c2ef6764d55f8ab3841
- MD5 42af494e8850fb5b7d0417b031987179
- SHA1 bf358cf09529cf88d3c88c2991aef3b4e88c72f0
- SHA512 c0354b53d98eba2c9dfcb0159d54f574356fcc884cdd275e7840ef485210b188d7f57e54a6b4a0d8e343e4d0e106f68a7fabec5290cb872af7174c8c71679c27
- SSDEEP 1536:1EGh0oUl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oUl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{26FFEBBD-500C-46b8-BB43-AE88F35C8865}.exe
- Size 204KB
- SHA256 366066fdd772ea15989df781e4051b4088c91bc03507002d6c48916f36de2de1
- MD5 89b67173486e6f84deb0a5c9949d930f
- SHA1 9578c64faff865257622d6789f93763932e20752
- SHA512 aa9bfb7b1b8f2213bbe0eac17eb081c8ed6ed3e0ac1862fecdd2c423732bcebeca6be2f90bba4ee7f05cab8172fdcf9bcf3baa60b16f909b676f13044051268b
- SSDEEP 1536:1EGh0osl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0osl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{33FCC4EC-A2DD-4bc1-A323-786629B83801}.exe
- Size 204KB
- SHA256 5f181339de40597f754bc38e47efdac1ad13511b0df8a5d3db27ea0d2b4f5b3e
- MD5 6c3c817ab34b071be7b23e30d0285a5e
- SHA1 e391f1ad4b97793913d40e84b7db450f2b6c3efb
- SHA512 aa6adaae351aa58ad602377581e1768392c1d7c627656dd703be877fb1b92d1421cc2d016e211ce6e41d0709e3b65beedfe1ee174204dc651ed37871e34205a2
- SSDEEP 1536:1EGh0oyl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oyl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{38E8D452-D29C-4a80-B7AC-D2B2C1B49D49}.exe
- Size 204KB
- SHA256 40018db0668baeb1a9af833a31b1a728ecdf34742635399c097f401d1c15ac23
- MD5 8c9cff9be834fb02f15adee94200985e
- SHA1 26ed2624cdb8bb4a437143f89d06ecbb51ada113
- SHA512 49b3e56de1bb1592783fe5896df4a17588844cb895b7362c9f1a66acb778b9c4e2f123fe7ed3a38651949d329546ca505a3419a04ef224a28c9ed09accb784f3
- SSDEEP 1536:1EGh0o3Ll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0obl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3B7FC5A7-1BA0-452f-91B5-72BC4C888C07}.exe
- Size 204KB
- SHA256 290a534105d47db79fefc78b986bea9a0f61c47b33600c2efbcd89870f7ba3c7
- MD5 08fcf13d81846fceec6a2d343fa27dcc
- SHA1 c71862bef3409ba8071857c5fe15362298ec67f6
- SHA512 61db44f1c94e3e0a5c1e1b9c2f972ad8e8f3e2c469855ed5c8eba5ce756d7507b6068000a3c45d578cbe85c9922ed9a0db29074fc97684ae7a70a7b3159444c4
- SSDEEP 1536:1EGh0og0l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0og0l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3E99212A-0E8F-40d7-A0A7-6622EE590502}.exe
- Size 204KB
- SHA256 b5d5b392a859eaa72745b844a7dca631c1fc0216cac671cbd9231483e641823b
- MD5 ee994f6539c6b24f658110be5a04e043
- SHA1 edb9e879fc5e8d2fde2ce5cbaaa93c0358807de7
- SHA512 a2154b3616d722eca22a0ba7ef245cc1c92699e418de1070538856285f96600b91e60c3630c95c2660eed009836bd82d5216bf137ff11b6b3dd6d0024bb06130
- SSDEEP 1536:1EGh0oUl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oUl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5584808F-0969-457e-B470-6A9F1B8C3102}.exe
- Size 204KB
- SHA256 390d44b9b0bf5cd35354657a8f5543261df356056d6feeba43634bb8cebb5088
- MD5 841dff29fb5fa310eb49dc61b2132fb3
- SHA1 9b8142323fc838bd039c2ec6f695b62e91c102c2
- SHA512 874a183e86c8f5417ad86af008a5d1f4639327f092a01e6013ca8585cf675cf7048c457f04d10174b8c2fb61cfb10b4a091db309ed67c5a8edc32da5bc0ee7dc
- SSDEEP 1536:1EGh0oil15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oil1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{56A0AB8F-97AB-4fa9-8689-6EC6B639404D}.exe
- Size 204KB
- SHA256 eddcb48ba302300adb3ee0f82f3597af46f175800bce33337345a08fca4e73b6
- MD5 a6304768b13dff13f4d11949ad1da99f
- SHA1 cf2bd89b65866efec840c2ada303de7673560c60
- SHA512 6eaa7a22f719c48f72b1d71644135b24efe6e1865c6d16e6fb641d1a044a4312be92a94b6827141b04bd6f2f1baf9abb24bfcc9fe893a28b6bf5b416e8ff8d28
- SSDEEP 1536:1EGh0oxl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oxl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7A501B2C-CCB1-4096-A1D9-D14C3EDFDB4B}.exe
- Size 204KB
- SHA256 3a9fc374bfa7274e8d4e6f184bf513c5176626a0faa7c8ee9aa88bb3a4dcb164
- MD5 7ad89f9e307e625ace22085f68ea02ae
- SHA1 0540094da76540074d6c39891e9d0ccf1b20c423
- SHA512 6f04f0725958efbd867862e47f99cbe1a7687e826cdd9eccf05dfca111429dfc7be9f127128dd07da06fd52cbbfb413a8923913210159675678604ac3a59dd3a
- SSDEEP 1536:1EGh0oil15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oil1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7A8DC853-732D-4cf9-BF23-2C6E21E97E0F}.exe
- Size 204KB
- SHA256 9079fd55cc1b212123bbb5e59c27398196c20383ca733b71f1561529cee2614f
- MD5 11f91c320cd6283d2b8bd1cad3b0021e
- SHA1 801034c973cc0efaf6078883870807aa1a9ed8a7
- SHA512 ce88361d2c2e3003655816c24de8e62bb51809300d1bd43f0fa1d41d2fa90306d4a307abfdcb6a2d734dde2f108d628ef296d66c40825c88d67cc87267927c35
- SSDEEP 1536:1EGh0oNl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oNl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C1DAC3A2-97D6-4ce3-A69F-B3FF9B5D2962}.exe
- Size 204KB
- SHA256 caeebb4e0ac12266e1cda1a0d09c350f6bca5fb7159bd267d44c41df0c3cde64
- MD5 97dff68319230d17bb310daa79e4d294
- SHA1 77de1338f53e26c60c8b25761a400e7ce257522a
- SHA512 38ac50c049b3ca4e5d17d8603dd92e04769dfea060dc8845c57ac68a9acb236e57f18b5d05fe7ce2f75774841f65201b54b71cd81fe63fa2793321731d64ec0e
- SSDEEP 1536:1EGh0oBl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oBl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP