Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
-
Size
408KB
-
MD5
7e107f0862a535d54cd39f599a3b6b65
-
SHA1
c0c578fb73ed28a69be9260a08c493569a63972a
-
SHA256
71cece2a13efc8762f2c239258842d63ef37ea8320e8db5e31f38f71e55bd9b9
-
SHA512
6e9b69139bab418c5f6ef427d12fac08790b2f09bf6dfeeb7c469918a6fa2c620ee85b85860b070b9bce194e2825d2f210df4e03b2cf25dff3f0afb75705410d
-
SSDEEP
3072:CEGh0oZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGvldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000233ed-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233ee-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233f6-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023354-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233f6-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023354-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233f6-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023354-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233f6-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023354-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233f2-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023354-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit -
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{844A6CBA-EAA0-4071-B668-3E3E5360FC21} {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}\stubpath = "C:\\Windows\\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe" {D2F9DB37-7593-4308-897D-475FC629C08F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}\stubpath = "C:\\Windows\\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe" {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}\stubpath = "C:\\Windows\\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe" {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{458B6765-5598-40fc-92F1-9A760BFAE7D0} 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{458B6765-5598-40fc-92F1-9A760BFAE7D0}\stubpath = "C:\\Windows\\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe" 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF} {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2F9DB37-7593-4308-897D-475FC629C08F} {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}\stubpath = "C:\\Windows\\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe" {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}\stubpath = "C:\\Windows\\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe" {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8DA02C3-6643-4747-B224-314AD65F6F24}\stubpath = "C:\\Windows\\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe" {DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}\stubpath = "C:\\Windows\\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe" {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}\stubpath = "C:\\Windows\\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe" {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636} {D2F9DB37-7593-4308-897D-475FC629C08F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769} {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D} {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF} {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8DA02C3-6643-4747-B224-314AD65F6F24} {DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592} {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}\stubpath = "C:\\Windows\\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe" {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2F9DB37-7593-4308-897D-475FC629C08F}\stubpath = "C:\\Windows\\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe" {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96} {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}\stubpath = "C:\\Windows\\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe" {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A} {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe -
Executes dropped EXE 12 IoCs
pid Process 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 3264 {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe 1548 {DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe 3772 {A8DA02C3-6643-4747-B224-314AD65F6F24}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe File created C:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe File created C:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe File created C:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe File created C:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe {DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe File created C:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe File created C:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe File created C:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe File created C:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe File created C:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe File created C:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe File created C:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe {D2F9DB37-7593-4308-897D-475FC629C08F}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe Token: SeIncBasePriorityPrivilege 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe Token: SeIncBasePriorityPrivilege 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe Token: SeIncBasePriorityPrivilege 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe Token: SeIncBasePriorityPrivilege 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe Token: SeIncBasePriorityPrivilege 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe Token: SeIncBasePriorityPrivilege 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe Token: SeIncBasePriorityPrivilege 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe Token: SeIncBasePriorityPrivilege 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe Token: SeIncBasePriorityPrivilege 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe Token: SeIncBasePriorityPrivilege 3264 {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe Token: SeIncBasePriorityPrivilege 1548 {DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 980 wrote to memory of 3248 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe 91 PID 980 wrote to memory of 3248 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe 91 PID 980 wrote to memory of 3248 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe 91 PID 980 wrote to memory of 1988 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe 92 PID 980 wrote to memory of 1988 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe 92 PID 980 wrote to memory of 1988 980 2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe 92 PID 3248 wrote to memory of 4748 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 93 PID 3248 wrote to memory of 4748 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 93 PID 3248 wrote to memory of 4748 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 93 PID 3248 wrote to memory of 624 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 94 PID 3248 wrote to memory of 624 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 94 PID 3248 wrote to memory of 624 3248 {458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe 94 PID 4748 wrote to memory of 4536 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 97 PID 4748 wrote to memory of 4536 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 97 PID 4748 wrote to memory of 4536 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 97 PID 4748 wrote to memory of 2612 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 98 PID 4748 wrote to memory of 2612 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 98 PID 4748 wrote to memory of 2612 4748 {6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe 98 PID 4536 wrote to memory of 4316 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 100 PID 4536 wrote to memory of 4316 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 100 PID 4536 wrote to memory of 4316 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 100 PID 4536 wrote to memory of 4520 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 101 PID 4536 wrote to memory of 4520 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 101 PID 4536 wrote to memory of 4520 4536 {844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe 101 PID 4316 wrote to memory of 2640 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 102 PID 4316 wrote to memory of 2640 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 102 PID 4316 wrote to memory of 2640 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 102 PID 4316 wrote to memory of 332 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 103 PID 4316 wrote to memory of 332 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 103 PID 4316 wrote to memory of 332 4316 {13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe 103 PID 2640 wrote to memory of 4584 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 104 PID 2640 wrote to memory of 4584 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 104 PID 2640 wrote to memory of 4584 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 104 PID 2640 wrote to memory of 2528 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 105 PID 2640 wrote to memory of 2528 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 105 PID 2640 wrote to memory of 2528 2640 {D2F9DB37-7593-4308-897D-475FC629C08F}.exe 105 PID 4584 wrote to memory of 2320 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 106 PID 4584 wrote to memory of 2320 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 106 PID 4584 wrote to memory of 2320 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 106 PID 4584 wrote to memory of 2768 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 107 PID 4584 wrote to memory of 2768 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 107 PID 4584 wrote to memory of 2768 4584 {3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe 107 PID 2320 wrote to memory of 4912 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 108 PID 2320 wrote to memory of 4912 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 108 PID 2320 wrote to memory of 4912 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 108 PID 2320 wrote to memory of 4176 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 109 PID 2320 wrote to memory of 4176 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 109 PID 2320 wrote to memory of 4176 2320 {AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe 109 PID 4912 wrote to memory of 4744 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 110 PID 4912 wrote to memory of 4744 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 110 PID 4912 wrote to memory of 4744 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 110 PID 4912 wrote to memory of 2412 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 111 PID 4912 wrote to memory of 2412 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 111 PID 4912 wrote to memory of 2412 4912 {B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe 111 PID 4744 wrote to memory of 3264 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 112 PID 4744 wrote to memory of 3264 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 112 PID 4744 wrote to memory of 3264 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 112 PID 4744 wrote to memory of 2864 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 113 PID 4744 wrote to memory of 2864 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 113 PID 4744 wrote to memory of 2864 4744 {CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe 113 PID 3264 wrote to memory of 1548 3264 {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe 114 PID 3264 wrote to memory of 1548 3264 {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe 114 PID 3264 wrote to memory of 1548 3264 {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe 114 PID 3264 wrote to memory of 1180 3264 {C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exeC:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exeC:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exeC:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exeC:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exeC:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exeC:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exeC:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exeC:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exeC:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exeC:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exeC:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exeC:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe13⤵
- Executes dropped EXE
PID:3772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB1E6~1.EXE > nul13⤵PID:64
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5DC1~1.EXE > nul12⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBA52~1.EXE > nul11⤵PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4967~1.EXE > nul10⤵PID:2412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA756~1.EXE > nul9⤵PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3995F~1.EXE > nul8⤵PID:2768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2F9D~1.EXE > nul7⤵PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13C92~1.EXE > nul6⤵PID:332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{844A6~1.EXE > nul5⤵PID:4520
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CE0E~1.EXE > nul4⤵PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{458B6~1.EXE > nul3⤵PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD541be3dfd551e016341d911ce0c8a0288
SHA1f1eba11500aa1360a562e8ab310da3503c8df3e9
SHA256c1b425f7359965d2edc7f4f59017e81e0f9834026b01c2da1b2eb03e9b9e046a
SHA512bcadcdf1b5f449b661ce3f4fd120e0c3d014c7210f866b2ab153bf1a7ed9be3e729d076b2ef06c5b2a0a4f9cea80be2f5fe4e71ce9e40d48873f2cd54e08bc27
-
Filesize
408KB
MD5ee92b0392a323ccf8a8519fbde417bab
SHA1bfa3e78097f4844a8bbfe15a164634d5867c6bae
SHA256e54047207104513d8886a23d350a1db25ba7d848ae4dd304220c9b453d47d108
SHA512ef8118f7121a16227b571b4c7449e5b8c7cbed68c912fadef25e653271bfd89688d971de96a29aad52cc36a98be541d4049f806fd2ab3994f24966966ae8c8aa
-
Filesize
408KB
MD57fb2bb628556ff1d9dcc564d38dbf2fb
SHA1cce8e81fbab2828c47e29d8b345f451f4f2733e4
SHA256f48f1b60a64e1914872f6e5029055eb3ee79ab49fbced44414dc3fc2f9bbf269
SHA512c2e066620f24e205e2e0ac847f0627cbcfc200138af4ef5b064c8928b47b1140e5e62770a51e804bc550827d981b849aa071bc074c2280c7e7b9884496030869
-
Filesize
408KB
MD50946a047355a5c297f57f2126a6da988
SHA18f4aaa77230216820f37a6f360df8e2957e7015c
SHA256519486fbad72ab54463f54981af81bc6f653ea00fe6cc24a05f50bb03dc321c2
SHA51223514ba6d608197fb5407362c96454bc81af26724fccb3f4926a87d720a2e30bc1d9d3b9fb2caae1df6c85d79b216f19d14eec1cab85607ec9540fbcc88f6293
-
Filesize
408KB
MD5204a7a5d187bafbf56ff28fdf7d7f7a5
SHA162a478190c355ad006a38a7daf43ad4f4d2d4ba9
SHA256175d32eae2f211c859aeee654a2e0b69d0cacf9089c59a9c6b5cb7a110af1cb0
SHA51292c97aa7de3c6a01817ac28aaa34801cdf4f237637f668e8fc556a8987f7ded00723086e18ad59cac7d10fdd4e14d017ab14aae7e45dadd6d13e7ed7486023b9
-
Filesize
408KB
MD5ff3c8b8ca08c3cd5455bf2f60d0b7403
SHA157c57722d22635a49479356292b2b26ec09d8fa9
SHA25652af0259088541f44ccb02c1390f34124fe4d90f087d5bd51aa60148833cd935
SHA512c58614a42db047b6a9857394bde199880fbce838491d69515e8dd560e77132fb4251d23d60b28c1ef63caa15278a99b5c7b4778928af2fca1cb6078253faf9c7
-
Filesize
408KB
MD53aa7951b47014fe7be3c240deb71ff17
SHA1803a7e11c497a5d27cf7ff23c146094e0f8abdb1
SHA256014583d1e7daf8e2daa8845305f4ab65027b271ac736737e23961b5c8af28d9c
SHA512dbe00169317c2e38e4add7fdd062dc88fbad004fe63a95551ab48b0fe7ecb3eae75db8fb092533799b723a767724c55eb76053519303398caeee5a8cb19c101b
-
Filesize
408KB
MD50853097067159c07150ba93d2bb7c5a5
SHA11f5889f984bfa59f2d5a6276f7aa89164042a6a5
SHA25663dc3886c43149d98c5ef3cb51d4d7ace5611a265b844172228ca017a51d825d
SHA5129c7a16f390a6fb21351f986d0bbae67c5654d718e0cce62c167745e09ba3acae738846f8507f6a7048166928619e76685ed0df9a73b63e1b8d884386b57f91ca
-
Filesize
408KB
MD5e48019b7f1bac265a86a04e148aa3fef
SHA1ff89eba4fa0c9bddf57d57759d217606af683c76
SHA256ed53306232b1d836667197c8881ee903f5d1b64250d1e5b16a3c64b0c39bbb21
SHA512b1439dc8b821ff575d81f97f3caad4deb8d480af02c72f5ad6cb433350e247be21a9ea8c6e974eb00497bca47b072ef4613ec5de72ff35586a0ab8ef5c01dc78
-
Filesize
408KB
MD55b1ad44501cd1f51161de80db1d2a534
SHA17154bbe0ac961f429742cd8715e1b4fb070753d4
SHA256fbb2c1c519d35ade340f415d00bcbeb9b515e840ec96df60606353d736f6ece1
SHA51223eb4cf1295220f7613ab20cf0560658f9fd08f319266da1cf5d67b6e1fa6c1dfbe896024a8213cbcf219cd01287d72c0c1c12ac7054a2df1a98d47db190a7b8
-
Filesize
408KB
MD5d219c5bd699c95c3b96e7d910b855fab
SHA169b2bac1335b595b1cb63d3bcf19693ab3997b8b
SHA256961701e8bc62d1c532b72bc8903a00de24bc7e8bd85c29238ea48a7a25f64562
SHA5127bc1bede9d2e74715e4f3c57ab11dc57a754908bbf1caddac9c3d90a981ae3e3312d3f4c72985bb29dacdd4a1aabf2200f3e5b2d96121178317c1d9dd9402bd8
-
Filesize
408KB
MD5b39c4c6e7265c551625339bb708b39ad
SHA1be1337b72c9b582223e9c3f2d383a0a53088840a
SHA25630e4f44df91e4d6c64964cd4c49c68b24e261e394514649be021ffb05ef67add
SHA512c9bd6a7aa0753e0d89d8b43c6a59c7f4eac04b942923782947dd49d110e71d029b188b240f22ea84bc766187fbad411f4e818db90247a1f2024683e37c510f4e