Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe
-
Size
372KB
-
MD5
b4b10455c9eb49fe08f381434dd21aa4
-
SHA1
0a49d1c636bb34f4aa8f69adb780d015efd7e182
-
SHA256
040508e690e69d3890762983516d053b0351b0d776c5d813664d803e78e00828
-
SHA512
47910407316ed36729bf9cab57632f9aa982400a62973aa92222e707372582ddd4fe8862b6c5488ce3099b917a8e2417f0522b74e378b1593e8aa33d07bfa1ae
-
SSDEEP
3072:CEGh0otlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGHlkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000231ff-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023206-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002320d-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023206-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fa2-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fa3-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021fa2-25.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000703-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000703-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000072b-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F89F48F0-4155-4052-B554-CB1BB2F2BF65} {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}\stubpath = "C:\\Windows\\{489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe" {3698882C-A36E-4157-9D53-BC6911B7178E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D} {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DB62BD1-AC34-4d00-8059-FCB3915A048A} {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DB62BD1-AC34-4d00-8059-FCB3915A048A}\stubpath = "C:\\Windows\\{1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe" {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D3B8D93-5F85-4168-A2CE-7809917236F9}\stubpath = "C:\\Windows\\{6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe" {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{260ED722-4E7E-414f-AAC6-92FF18BB2B37}\stubpath = "C:\\Windows\\{260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe" {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F89F48F0-4155-4052-B554-CB1BB2F2BF65}\stubpath = "C:\\Windows\\{F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe" {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9} {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{155B19DC-D872-4f47-949A-8E0A58876EBD} 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{489940D8-BF7E-4f82-BAB9-2D91AEEFB17A} {3698882C-A36E-4157-9D53-BC6911B7178E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D3B8D93-5F85-4168-A2CE-7809917236F9} {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}\stubpath = "C:\\Windows\\{BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe" {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B56F2EF1-2DA6-42c7-8230-03BF057107EF} {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FE9A847-FE35-4226-98B6-90929DBAD2A9} {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{155B19DC-D872-4f47-949A-8E0A58876EBD}\stubpath = "C:\\Windows\\{155B19DC-D872-4f47-949A-8E0A58876EBD}.exe" 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3698882C-A36E-4157-9D53-BC6911B7178E} {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}\stubpath = "C:\\Windows\\{A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe" {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B56F2EF1-2DA6-42c7-8230-03BF057107EF}\stubpath = "C:\\Windows\\{B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe" {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FE9A847-FE35-4226-98B6-90929DBAD2A9}\stubpath = "C:\\Windows\\{1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe" {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B00734A0-5D02-48a0-A980-3B33E4C9BC29} {1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B00734A0-5D02-48a0-A980-3B33E4C9BC29}\stubpath = "C:\\Windows\\{B00734A0-5D02-48a0-A980-3B33E4C9BC29}.exe" {1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3698882C-A36E-4157-9D53-BC6911B7178E}\stubpath = "C:\\Windows\\{3698882C-A36E-4157-9D53-BC6911B7178E}.exe" {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{260ED722-4E7E-414f-AAC6-92FF18BB2B37} {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe -
Executes dropped EXE 12 IoCs
pid Process 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 4748 {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe 2068 {1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe 3908 {B00734A0-5D02-48a0-A980-3B33E4C9BC29}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe File created C:\Windows\{1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe File created C:\Windows\{6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe File created C:\Windows\{260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe File created C:\Windows\{F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe File created C:\Windows\{A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe File created C:\Windows\{B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe File created C:\Windows\{3698882C-A36E-4157-9D53-BC6911B7178E}.exe {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe File created C:\Windows\{489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe {3698882C-A36E-4157-9D53-BC6911B7178E}.exe File created C:\Windows\{BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe File created C:\Windows\{1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe File created C:\Windows\{B00734A0-5D02-48a0-A980-3B33E4C9BC29}.exe {1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe Token: SeIncBasePriorityPrivilege 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe Token: SeIncBasePriorityPrivilege 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe Token: SeIncBasePriorityPrivilege 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe Token: SeIncBasePriorityPrivilege 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe Token: SeIncBasePriorityPrivilege 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe Token: SeIncBasePriorityPrivilege 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe Token: SeIncBasePriorityPrivilege 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe Token: SeIncBasePriorityPrivilege 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe Token: SeIncBasePriorityPrivilege 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe Token: SeIncBasePriorityPrivilege 4748 {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe Token: SeIncBasePriorityPrivilege 2068 {1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 4172 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe 97 PID 2640 wrote to memory of 4172 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe 97 PID 2640 wrote to memory of 4172 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe 97 PID 2640 wrote to memory of 800 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe 98 PID 2640 wrote to memory of 800 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe 98 PID 2640 wrote to memory of 800 2640 2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe 98 PID 4172 wrote to memory of 4444 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 99 PID 4172 wrote to memory of 4444 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 99 PID 4172 wrote to memory of 4444 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 99 PID 4172 wrote to memory of 4696 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 100 PID 4172 wrote to memory of 4696 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 100 PID 4172 wrote to memory of 4696 4172 {155B19DC-D872-4f47-949A-8E0A58876EBD}.exe 100 PID 4444 wrote to memory of 4816 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 102 PID 4444 wrote to memory of 4816 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 102 PID 4444 wrote to memory of 4816 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 102 PID 4444 wrote to memory of 5032 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 103 PID 4444 wrote to memory of 5032 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 103 PID 4444 wrote to memory of 5032 4444 {3698882C-A36E-4157-9D53-BC6911B7178E}.exe 103 PID 4816 wrote to memory of 2892 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 104 PID 4816 wrote to memory of 2892 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 104 PID 4816 wrote to memory of 2892 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 104 PID 4816 wrote to memory of 3960 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 105 PID 4816 wrote to memory of 3960 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 105 PID 4816 wrote to memory of 3960 4816 {489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe 105 PID 2892 wrote to memory of 1636 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 106 PID 2892 wrote to memory of 1636 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 106 PID 2892 wrote to memory of 1636 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 106 PID 2892 wrote to memory of 2968 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 107 PID 2892 wrote to memory of 2968 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 107 PID 2892 wrote to memory of 2968 2892 {1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe 107 PID 1636 wrote to memory of 2072 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 108 PID 1636 wrote to memory of 2072 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 108 PID 1636 wrote to memory of 2072 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 108 PID 1636 wrote to memory of 4480 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 109 PID 1636 wrote to memory of 4480 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 109 PID 1636 wrote to memory of 4480 1636 {6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe 109 PID 2072 wrote to memory of 3156 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 110 PID 2072 wrote to memory of 3156 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 110 PID 2072 wrote to memory of 3156 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 110 PID 2072 wrote to memory of 2164 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 111 PID 2072 wrote to memory of 2164 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 111 PID 2072 wrote to memory of 2164 2072 {260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe 111 PID 3156 wrote to memory of 1464 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 112 PID 3156 wrote to memory of 1464 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 112 PID 3156 wrote to memory of 1464 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 112 PID 3156 wrote to memory of 1244 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 113 PID 3156 wrote to memory of 1244 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 113 PID 3156 wrote to memory of 1244 3156 {BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe 113 PID 1464 wrote to memory of 1216 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 114 PID 1464 wrote to memory of 1216 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 114 PID 1464 wrote to memory of 1216 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 114 PID 1464 wrote to memory of 4440 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 115 PID 1464 wrote to memory of 4440 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 115 PID 1464 wrote to memory of 4440 1464 {F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe 115 PID 1216 wrote to memory of 4748 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 116 PID 1216 wrote to memory of 4748 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 116 PID 1216 wrote to memory of 4748 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 116 PID 1216 wrote to memory of 1952 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 117 PID 1216 wrote to memory of 1952 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 117 PID 1216 wrote to memory of 1952 1216 {A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe 117 PID 4748 wrote to memory of 2068 4748 {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe 118 PID 4748 wrote to memory of 2068 4748 {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe 118 PID 4748 wrote to memory of 2068 4748 {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe 118 PID 4748 wrote to memory of 4584 4748 {B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_b4b10455c9eb49fe08f381434dd21aa4_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\{155B19DC-D872-4f47-949A-8E0A58876EBD}.exeC:\Windows\{155B19DC-D872-4f47-949A-8E0A58876EBD}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\{3698882C-A36E-4157-9D53-BC6911B7178E}.exeC:\Windows\{3698882C-A36E-4157-9D53-BC6911B7178E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\{489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exeC:\Windows\{489940D8-BF7E-4f82-BAB9-2D91AEEFB17A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\{1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exeC:\Windows\{1DB62BD1-AC34-4d00-8059-FCB3915A048A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\{6D3B8D93-5F85-4168-A2CE-7809917236F9}.exeC:\Windows\{6D3B8D93-5F85-4168-A2CE-7809917236F9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\{260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exeC:\Windows\{260ED722-4E7E-414f-AAC6-92FF18BB2B37}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\{BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exeC:\Windows\{BE832D2B-1BF7-4cfd-AFD2-02B09DB3188D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\{F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exeC:\Windows\{F89F48F0-4155-4052-B554-CB1BB2F2BF65}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\{A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exeC:\Windows\{A8E3D1E1-3AEB-4b8a-AE69-A921828D15E9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\{B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exeC:\Windows\{B56F2EF1-2DA6-42c7-8230-03BF057107EF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\{1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exeC:\Windows\{1FE9A847-FE35-4226-98B6-90929DBAD2A9}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Windows\{B00734A0-5D02-48a0-A980-3B33E4C9BC29}.exeC:\Windows\{B00734A0-5D02-48a0-A980-3B33E4C9BC29}.exe13⤵
- Executes dropped EXE
PID:3908
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FE9A~1.EXE > nul13⤵PID:3504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B56F2~1.EXE > nul12⤵PID:4584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8E3D~1.EXE > nul11⤵PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F89F4~1.EXE > nul10⤵PID:4440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE832~1.EXE > nul9⤵PID:1244
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{260ED~1.EXE > nul8⤵PID:2164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D3B8~1.EXE > nul7⤵PID:4480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DB62~1.EXE > nul6⤵PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48994~1.EXE > nul5⤵PID:3960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36988~1.EXE > nul4⤵PID:5032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{155B1~1.EXE > nul3⤵PID:4696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5c48b516fb774e72df01ce232cabececc
SHA1a9f6fa4dc3bf12508a8067f30c0a4b0b40d5f6db
SHA256577805f2ea430aeb2dfd408ab6c8fcdd276cbe9a3c2714424f51102523340d71
SHA51271c3d9f72d07329e4ef5f99a342c23e8da28c60acb3898d0f2541a13fd7ec38be5a592b17d6bd7b8e512fc6223aca43a1e215adb5df4dd24b6865f07e302e988
-
Filesize
372KB
MD5ac7db063ca3c78373026c82e3ee5e8de
SHA1c1fa8766d2c21f2d1a3602a9ab4faf031654d6e0
SHA2567b78b417829a79d49141c5e223ff5672ead915cee7bee1375f80d7a58e535aaf
SHA512266444bbf504b769a72973a6b6e622ee453efb1aa2306821a7fe33f8da62cb8da4daa69cb521dc9a1a8a4dbc7be13dd3a1f769af66245ce3b79c08145d61592c
-
Filesize
372KB
MD565bb8217ba482363fc61121f8cc90733
SHA11cea1c0d6ca5f9e25d7a00ff3e5b1103ccbd3c87
SHA256b92d14a62a4a043b947c854b3d7db5cb72bb99f88689d4c0c54650b6e69cf5cb
SHA5124047d46d0840990ac58b7197d0d361113266e1486275ca3c69f6dbadb2ec124a82f2266135cd7942b1ef3707edec2fc5d852268084fda17e0fff020179b20624
-
Filesize
372KB
MD528205ecf2499d82237dd2f542f42cfbd
SHA158340979b4372d156dc9c07e17ac46d529632078
SHA256ab6054cbe83b03c615c1777c13f80a4d927386bae328fc51a95a4cd2974c6a01
SHA5126723f6b675dd1324a2da72a6ce355c1301fdf3d8f1ab56d4b27e850e1c3e76813a28add0786e407180e64ff4f09abd6ded83aece68dbcc20f03c552ed6b0611e
-
Filesize
372KB
MD5975f57702fa1f207cc0bedfba1f07742
SHA1ea032e78a4103620957f5661e0be3e15cf91ae84
SHA256634ad99118daf83392faa57cdeba3582a04f1e51dc7d7f0fcd362ae3ec419acf
SHA512f2be9a0c6e6d590685030569da69f1698e7ec4f1f79aaa370adbbf33f106313610247cfd8b930f1d03e56a2f2c2dfa02992154f7ab70d545433ad9d80c1d7c31
-
Filesize
372KB
MD5c96f0784009ae356afafb6a8c3f425e4
SHA19e78c148f4b9f54fbdaef155fe5ed00b015361aa
SHA25652be995ac68e76ee5c681f3f79fe57beef9da24d83231c5c44bd67d27299a891
SHA5124c804fcfe041d8448f756f564d363e443d5c72a87708c40257acfad2fca1ff945435e2137edc9c29d963bc2b3a718345989581576bacb5cfeca1aa443756fa49
-
Filesize
372KB
MD55582b09e8acf99e53e563a6ec1e08422
SHA128a9bf188dec17b649d5356bbfe0ca5388a704ef
SHA2563245c415c3202508fad3d1f2315b5dcc68cb8fa2cf34b602c6d2fdd4614c8707
SHA512328eb30f944656c765ae0f9213340517264afd008d20be15c96ce5595bac699da385806da444999cc9c993f4eeae44e2d30d15a0d4e6b385d049c8a12b6181f6
-
Filesize
372KB
MD527654f0ba3ad14ffc08f69f7b169c83a
SHA18b41d37c08cf346c36764c56387a9266859f3bce
SHA25646cdff660edd85ff6b403cfd8c90fb5faa88b0d96f047bd610255301d4a46d5a
SHA512d13e9a63431cd1878895f20d53b92a2283fe560606da39693ea11a16b7809dcddd30dfedd3925c88ac4e6f87524b612728aeed7029b7586b84422f19007a6857
-
Filesize
372KB
MD5f45e00665130f5e55b92a68189e1efd4
SHA14085fae59b945f2a2f5dbc913565c96cc1a8f025
SHA256d6a33a5ac546f60aa02a36b65b49749841281f1159325cf9f9905129d736c203
SHA512591244f15bdf9fe2587e94030592a1a09b074718b13dd5d98b750a7e5183fd0231cdc40cc15fd26fd7ca2b7b979272aa944e8173ba22ed7d20e1c90b013d3ed4
-
Filesize
372KB
MD573897d99a999798bea0180032465c9f0
SHA173b2b6fc44c9a20c8463820e9ce5d9204b39960c
SHA256ce70ee41d45f9dfc337d48614144dc2eb6b4b858234b0c5556b984f1c0779604
SHA512ef4c5e2979ab5e9402de6011d352da7587149a28d6c0f9906ecd591a916a8ce43a2b66297ebc927490985fed74856307a88e6d42223d50924040d4859d626a36
-
Filesize
372KB
MD5ee67e060e3c171e7a7a1bb4ecd2e03f7
SHA1894d5a2eaa25845dcb4cfc0dd69ae8d86d7fb983
SHA256374bf95dd8228f23ed464a447a6e485f590d2fc6ac68f5e0ac68040baf4e8f44
SHA512b005433c180b89d1976cfe7b277143f4bece453be43585f4a5da301a8fa428218bec32cee1217eee9e885dcccc762c4d9a89c6a509b7d2721ac7dd9a75437610
-
Filesize
372KB
MD5209c7b4df7a91433dd2861d3fffbdefe
SHA1752fb64d549065f50d98802d96838bc40132fdbd
SHA256bdf4dcc8fdbdf96f4dc82e0858ef8c647dff7e0b1916b8d3223af40df6b7e701
SHA512e96ff8d934c522d5feb4d01e4a74ba3a1e0ab8495f1d9a13819b31039fcf419fa4f1a7b6853aa0d99c7e953ba9d9345de5dcfb53ce86e12bb724832a9e93d860