Analysis
- max time kernel
149s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
19/04/2024, 12:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe
- Size 408KB
- Sample240419-py7b9acg33
- SHA256 ccbe9a1cab649735edaae27a33b858141490ce1c82fd8deca5296c37fdd90fbe
- MD5 b636fc13bcd6e740973a4fa97e84ce21
- SHA1 d02564007059e80ba0181c07f9f92da4f5a501ae
- SHA512 b1aae93691b050f7dc511149b040d0c5d90fdb42f6ca6ca8d45d535d91feef91adf98917b8be9124488fbda502040d52dbda2d8c4e76ab38e5d4a7c47f0e9985
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000233f6-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233f7-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e00000002335d-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233f7-13.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f00000002335d-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d0000000233f7-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001000000002335d-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002340c-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000022e5a-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023353-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000022e5a-41.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000002335f-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA9885D0-C2A0-4084-BE6E-34085B6A780F} {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}\stubpath = "C:\\Windows\\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe" {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBC9539-9D0A-4af4-9846-A518E78942BE} {339AE30F-D920-401f-A14C-897F323326D9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}\stubpath = "C:\\Windows\\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe" {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A} {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79} {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981} 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07} {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}\stubpath = "C:\\Windows\\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe" {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}\stubpath = "C:\\Windows\\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe" {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E21507E5-7A4F-4482-8186-47863A72D9B7}\stubpath = "C:\\Windows\\{E21507E5-7A4F-4482-8186-47863A72D9B7}.exe" {4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}\stubpath = "C:\\Windows\\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe" 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A0F40DC-0A45-4bdd-8094-887625D2B99F} {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}\stubpath = "C:\\Windows\\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe" {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBC9539-9D0A-4af4-9846-A518E78942BE}\stubpath = "C:\\Windows\\{0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe" {339AE30F-D920-401f-A14C-897F323326D9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C} {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B} {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}\stubpath = "C:\\Windows\\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe" {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA9885D0-C2A0-4084-BE6E-34085B6A780F}\stubpath = "C:\\Windows\\{AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe" {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A0F40DC-0A45-4bdd-8094-887625D2B99F}\stubpath = "C:\\Windows\\{5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe" {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{339AE30F-D920-401f-A14C-897F323326D9} {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{339AE30F-D920-401f-A14C-897F323326D9}\stubpath = "C:\\Windows\\{339AE30F-D920-401f-A14C-897F323326D9}.exe" {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18} {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E21507E5-7A4F-4482-8186-47863A72D9B7} {4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe - Executes dropped EXE 12 IoCs
pid Process 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 4740 {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe 4832 {4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe 2876 {E21507E5-7A4F-4482-8186-47863A72D9B7}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe File created C:\Windows\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe File created C:\Windows\{E21507E5-7A4F-4482-8186-47863A72D9B7}.exe {4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe File created C:\Windows\{5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe File created C:\Windows\{0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe {339AE30F-D920-401f-A14C-897F323326D9}.exe File created C:\Windows\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe File created C:\Windows\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe File created C:\Windows\{AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe File created C:\Windows\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe File created C:\Windows\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe File created C:\Windows\{339AE30F-D920-401f-A14C-897F323326D9}.exe {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe File created C:\Windows\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe Token: SeIncBasePriorityPrivilege 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe Token: SeIncBasePriorityPrivilege 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe Token: SeIncBasePriorityPrivilege 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe Token: SeIncBasePriorityPrivilege 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe Token: SeIncBasePriorityPrivilege 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe Token: SeIncBasePriorityPrivilege 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe Token: SeIncBasePriorityPrivilege 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe Token: SeIncBasePriorityPrivilege 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe Token: SeIncBasePriorityPrivilege 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe Token: SeIncBasePriorityPrivilege 4740 {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe Token: SeIncBasePriorityPrivilege 4832 {4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 4192 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe 92 PID 2084 wrote to memory of 4192 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe 92 PID 2084 wrote to memory of 4192 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe 92 PID 2084 wrote to memory of 3960 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe 93 PID 2084 wrote to memory of 3960 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe 93 PID 2084 wrote to memory of 3960 2084 2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe 93 PID 4192 wrote to memory of 728 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 94 PID 4192 wrote to memory of 728 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 94 PID 4192 wrote to memory of 728 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 94 PID 4192 wrote to memory of 4632 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 95 PID 4192 wrote to memory of 4632 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 95 PID 4192 wrote to memory of 4632 4192 {10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe 95 PID 728 wrote to memory of 1488 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 99 PID 728 wrote to memory of 1488 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 99 PID 728 wrote to memory of 1488 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 99 PID 728 wrote to memory of 4516 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 100 PID 728 wrote to memory of 4516 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 100 PID 728 wrote to memory of 4516 728 {5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe 100 PID 1488 wrote to memory of 3044 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 101 PID 1488 wrote to memory of 3044 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 101 PID 1488 wrote to memory of 3044 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 101 PID 1488 wrote to memory of 2920 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 102 PID 1488 wrote to memory of 2920 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 102 PID 1488 wrote to memory of 2920 1488 {D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe 102 PID 3044 wrote to memory of 3356 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 103 PID 3044 wrote to memory of 3356 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 103 PID 3044 wrote to memory of 3356 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 103 PID 3044 wrote to memory of 548 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 104 PID 3044 wrote to memory of 548 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 104 PID 3044 wrote to memory of 548 3044 {339AE30F-D920-401f-A14C-897F323326D9}.exe 104 PID 3356 wrote to memory of 3916 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 106 PID 3356 wrote to memory of 3916 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 106 PID 3356 wrote to memory of 3916 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 106 PID 3356 wrote to memory of 216 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 107 PID 3356 wrote to memory of 216 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 107 PID 3356 wrote to memory of 216 3356 {0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe 107 PID 3916 wrote to memory of 4324 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 108 PID 3916 wrote to memory of 4324 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 108 PID 3916 wrote to memory of 4324 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 108 PID 3916 wrote to memory of 2844 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 109 PID 3916 wrote to memory of 2844 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 109 PID 3916 wrote to memory of 2844 3916 {BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe 109 PID 4324 wrote to memory of 4520 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 113 PID 4324 wrote to memory of 4520 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 113 PID 4324 wrote to memory of 4520 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 113 PID 4324 wrote to memory of 2476 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 114 PID 4324 wrote to memory of 2476 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 114 PID 4324 wrote to memory of 2476 4324 {F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe 114 PID 4520 wrote to memory of 1456 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 119 PID 4520 wrote to memory of 1456 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 119 PID 4520 wrote to memory of 1456 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 119 PID 4520 wrote to memory of 3164 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 120 PID 4520 wrote to memory of 3164 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 120 PID 4520 wrote to memory of 3164 4520 {E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe 120 PID 1456 wrote to memory of 4740 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 121 PID 1456 wrote to memory of 4740 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 121 PID 1456 wrote to memory of 4740 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 121 PID 1456 wrote to memory of 2920 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 122 PID 1456 wrote to memory of 2920 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 122 PID 1456 wrote to memory of 2920 1456 {AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe 122 PID 4740 wrote to memory of 4832 4740 {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe 123 PID 4740 wrote to memory of 4832 4740 {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe 123 PID 4740 wrote to memory of 4832 4740 {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe 123 PID 4740 wrote to memory of 1528 4740 {1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_b636fc13bcd6e740973a4fa97e84ce21_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exeC:\Windows\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\{5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exeC:\Windows\{5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exeC:\Windows\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\{339AE30F-D920-401f-A14C-897F323326D9}.exeC:\Windows\{339AE30F-D920-401f-A14C-897F323326D9}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\{0BBC9539-9D0A-4af4-9846-A518E78942BE}.exeC:\Windows\{0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exeC:\Windows\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exeC:\Windows\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exeC:\Windows\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\{AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exeC:\Windows\{AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exeC:\Windows\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exeC:\Windows\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4832 -
C:\Windows\{E21507E5-7A4F-4482-8186-47863A72D9B7}.exeC:\Windows\{E21507E5-7A4F-4482-8186-47863A72D9B7}.exe13⤵
- Executes dropped EXE
PID:2876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AEA9~1.EXE > nul13⤵PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FB9E~1.EXE > nul12⤵PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA988~1.EXE > nul11⤵PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E95E6~1.EXE > nul10⤵PID:3164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3D39~1.EXE > nul9⤵PID:2476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCF07~1.EXE > nul8⤵PID:2844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BBC9~1.EXE > nul7⤵PID:216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{339AE~1.EXE > nul6⤵PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6449~1.EXE > nul5⤵PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A0F4~1.EXE > nul4⤵PID:4516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10E2C~1.EXE > nul3⤵PID:4632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0BBC9539-9D0A-4af4-9846-A518E78942BE}.exe
- Size 408KB
- SHA256 400bb0a1f76ff993fbe64f24457efb1c60ea0f07ab4d5aa75a4c6acaec45e013
- MD5 ad48a11e0420a728016c8e203c30cf4b
- SHA1 67b3d79cfe21c1b1ac156e6383630e64acb00f54
- SHA512 bbf86256ab77ab62243b35ba68ae748a2216459b4d55442a9e6035c391b1e77084b00159d02470344b39e1b28d3c2cdaf7389a9bc2578a5b24430188f466ba50
- SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGGldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{10E2CBC0-5079-4be9-A3AA-3C8CC5E5D981}.exe
- Size 408KB
- SHA256 47f301ee2b0fd83903f48800e692d04238267af3227fd10886c18e5048dc25cb
- MD5 6ad3eac12e7e40e520eb10fb62fdbf22
- SHA1 80ed9ffb95310ac83c2a07b399725d7287d35a88
- SHA512 febd453fb14992f1e03663dc8840815acf553a68142248b1ea27b1375d0b6e5a8236a18c5354cf191a2391035825e1329e61d0e9e7996cedae24e5c5eb1b5371
- SSDEEP 3072:CEGh0oSl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGUldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1FB9EAF9-BE67-4144-84E3-B80E4A76AC18}.exe
- Size 408KB
- SHA256 a4669e5e58c2e21191549adf1f44dce21b786bfdbe412ac06df2a9fac9dddc8b
- MD5 6fee8989bc62205331a54d01e1adfb4c
- SHA1 8c655a47ac022343768f16330b5f2020a9d3182e
- SHA512 61b00fc2a296db831d0f2b50035bf8f33191aea199ee6ba2bf1bfcd5f1662787ef31f12ad8bf549b09ea08e6d4a965588316f3ae924d98f719e57e1b4c00ab14
- SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGildOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{339AE30F-D920-401f-A14C-897F323326D9}.exe
- Size 408KB
- SHA256 adcca4f8f8ab8e9bedfdaf639969f29bbc96670d8e7b959cffcb9bfb32ae70f3
- MD5 2578f591c2591d0f1c7b86d8da5c1b3c
- SHA1 563a2dec0eb93490d3026a51261bd7da354ecef1
- SHA512 d6d9f68e2694830def465085288f3406e668f159995c764d437005a90db4022ebcbc28fceb8cb5699a7f7ee1a58c78ac43c4d805cbed17c8c6bbde4ed72093c1
- SSDEEP 3072:CEGh0oxl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGDldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4AEA91B5-E9A4-4f4b-951D-76BD6EEB4B79}.exe
- Size 408KB
- SHA256 83de2c2fd82fa57552c93cab943589702f50939e4772c7a3df71c071776d866c
- MD5 3dbb9aeaaf4ebc6062c207c139752557
- SHA1 542ed355408d45439614d9062499e5ef2a6c7eda
- SHA512 d90a9e885d1fa4efce2621a600fe9528fb1d6ea7c4965f50801281fac70f46051190e47f32f8c1c63e70127c01b55047c9a8b4623e7d6f102a1a8a3270724d43
- SSDEEP 3072:CEGh0oFl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGDldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5A0F40DC-0A45-4bdd-8094-887625D2B99F}.exe
- Size 408KB
- SHA256 716889badedf7c0139a2872ccc3cda63052bbc93f4889f859f38af5019474a94
- MD5 46910ca21546c95a4541994118111f06
- SHA1 78e73d9543739f94978b503bbcf8a04a310179c7
- SHA512 b3def9f3d44ac68950996d9b6a591bd40ffce9049ba5431242fc582fa0e7772b12d6b3429cd8698134e26640e3a68ae6e54f6a82985e79aeec25209b99ebef23
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGQldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AA9885D0-C2A0-4084-BE6E-34085B6A780F}.exe
- Size 408KB
- SHA256 c2377edaafb4b3ae37eeaaa309e53f478fd09190165f8197356aae5ebdebae0a
- MD5 459599a6ea15bd847ad0e9a93055c495
- SHA1 96270961dde1dec11c963135da6a347c30f670d3
- SHA512 bea12818cfd908fb570ec41892b719f349e1349fd1ff3e7277c6b6555b1c0401aeea8007c0dcd9b58ef69988400443612596da2c88f7d8b8a5d08ada354db2a7
- SSDEEP 3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGwldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BCF07BC2-BDF5-402c-8A05-4F72EEB90E9C}.exe
- Size 408KB
- SHA256 bf34b6e9f09e8b3197073cc8c5b40be726f47d9e3993bdaaff34b0d7d24b35dc
- MD5 b411e06e311dcf10ae9f2fd6a6a3ebaf
- SHA1 3910c7e90a309a22bf4616523918b23f60fcdcfa
- SHA512 227b9bba3f3dcded0ed1492d12d0c12b2c2b644d009770cfcf4b62b6304e4aa64da23ea02ee4d915a877a0eba9d8fe330e05ef777b4e34cfbe39d4091ef90c61
- SSDEEP 3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGMldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D64490F3-70B3-4a35-BEAF-CFFDF83D6C07}.exe
- Size 408KB
- SHA256 ba19a210a88a1d514f7e459bda5a24d2a2bd7486a79de2de8be65a6d485179c6
- MD5 242973b62e3d83abf3defc1221fb3b86
- SHA1 e7f97b818c1a3a7adb0c42bc6dbb731e26fcb6cd
- SHA512 1d456ac63c393f1e5ce07d624812325bb5f6952b839245be419ba8ef4804b54491c27df59bb1479136d5d3c3757dc555d3fcac32c4af41083e1db6ed832f974e
- SSDEEP 3072:CEGh0ohl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG7ldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E21507E5-7A4F-4482-8186-47863A72D9B7}.exe
- Size 408KB
- SHA256 e7cf4924c26e85e6c5dbf034f8725e5d6e54cb2a7d4fbb343156d7c4e1a37a86
- MD5 d0099cf1a5e76b9c6ac8f1e1fced0fcb
- SHA1 190656ce9f11a36c178cf6d805cec5db0dcc537b
- SHA512 cdd9f37a68a7c9e3d710bf625a9eee1273ac04cee5c53f52dd3bcd48b7b560c16f7de75ad3c595b885a3c170fbc9154f79b1431e6dcbb0ed506ff81ba64c767c
- SSDEEP 3072:CEGh0oHl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGJldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E95E6FF0-655A-4d0f-AC4F-BFAD471D984B}.exe
- Size 408KB
- SHA256 666c8596118c5dfb7d28c764b072fe14cca8384757db7403b46bba76fdfedd78
- MD5 1925b0e657201064a8e0744aba027b1c
- SHA1 3338f927a0d300c82f60bb709ae590b3a4b45581
- SHA512 3385e9a65ad30d0c859f69e2aeb8a831f3c83dd9579863ccf4b89620f8a7fd11d37364510f85e859f8f152bfcd8ac861cb667759cb362bfddb087951b78dd4a2
- SSDEEP 3072:CEGh0opl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGrldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F3D392C1-888B-4bb5-85D9-4F2DB3E5CD1A}.exe
- Size 408KB
- SHA256 63af92a834b9a257f5d261598a8b224bf9748c5ceca8c20467f51805091fa31b
- MD5 c2ad3b9d8d9c0712b88e36516434cccd
- SHA1 013cf750707a0151d96a3230b695c610fdcaf6ad
- SHA512 1861ed94a20c2c85e373803f282c810b6659e2e0fdc1fce33afca06d196db0f319853240469b3b8f210aa62083fb3cb1eac38ed1ba9c7c354bf6f2a56d9e0c1e
- SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGcldOe2MUVg3vTeKcAEciTBqr3jy9
- MD5 SHA1 SHA512 SSDEEP