Analysis
- max time kernel
149s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 03:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe
- Size 380KB
- Sample240525-eeeg1sdf89
- SHA256 cbf5f60362698d8c6507a567881aa51bed1399f1a7c759d2997d598484c00055
- MD5 5b79abfdf45bb4e61ff9b4565a7bf49c
- SHA1 240e3602235c109335264ba5464ce86df8535f6c
- SHA512 6bdb3e749da5a98a724c8d1a3e9dd68d6ee400a4e1ec2f5655203fb14988b036b1f9bc78ef80c2c1acf4e3856c05d96d169e94437899b5457e85bf476b325fc5
- SSDEEP 3072:mEGh0odlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGPl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00070000000233e7-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233e3-5.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023352-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233e3-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023352-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233e3-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023352-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000022ac3-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000022ac7-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000022ac3-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000022ac6-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000022ac3-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF8529F7-1E94-4214-B602-FA88BACD005A}\stubpath = "C:\\Windows\\{EF8529F7-1E94-4214-B602-FA88BACD005A}.exe" {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE10E8BD-DB3A-4770-8417-430DDB4D080E} 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB0697E8-7CF4-4771-A1CB-40FD61865648}\stubpath = "C:\\Windows\\{AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe" {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F91ED788-E6EA-4139-9CD3-38B34C23E936} {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F91ED788-E6EA-4139-9CD3-38B34C23E936}\stubpath = "C:\\Windows\\{F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe" {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}\stubpath = "C:\\Windows\\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe" {8C1BA73F-7795-4568-80F6-19620384F739}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{153D4236-9F03-4d5d-AEB0-A32F97473EDF} {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{153D4236-9F03-4d5d-AEB0-A32F97473EDF}\stubpath = "C:\\Windows\\{153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe" {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}\stubpath = "C:\\Windows\\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe" {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB0697E8-7CF4-4771-A1CB-40FD61865648} {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48} {8C1BA73F-7795-4568-80F6-19620384F739}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FED8337C-42C0-4fcd-A986-7412A53582B7} {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9}\stubpath = "C:\\Windows\\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9}.exe" {1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7} {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C1BA73F-7795-4568-80F6-19620384F739} {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C1BA73F-7795-4568-80F6-19620384F739}\stubpath = "C:\\Windows\\{8C1BA73F-7795-4568-80F6-19620384F739}.exe" {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FED8337C-42C0-4fcd-A986-7412A53582B7}\stubpath = "C:\\Windows\\{FED8337C-42C0-4fcd-A986-7412A53582B7}.exe" {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}\stubpath = "C:\\Windows\\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe" {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1035A3B2-00AC-4b43-ACA0-49150D962DAB} {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1035A3B2-00AC-4b43-ACA0-49150D962DAB}\stubpath = "C:\\Windows\\{1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe" {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE10E8BD-DB3A-4770-8417-430DDB4D080E}\stubpath = "C:\\Windows\\{EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe" 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF8529F7-1E94-4214-B602-FA88BACD005A} {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971} {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9} {1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe - Executes dropped EXE 12 IoCs
pid Process 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 1664 {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe 2668 {1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe 3944 {A0DCE2EC-B7D6-4a00-8998-9A76403067F9}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9}.exe {1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe File created C:\Windows\{AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe File created C:\Windows\{F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe File created C:\Windows\{153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe File created C:\Windows\{EF8529F7-1E94-4214-B602-FA88BACD005A}.exe {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe File created C:\Windows\{FED8337C-42C0-4fcd-A986-7412A53582B7}.exe {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe File created C:\Windows\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe File created C:\Windows\{1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe File created C:\Windows\{EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe File created C:\Windows\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe File created C:\Windows\{8C1BA73F-7795-4568-80F6-19620384F739}.exe {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe File created C:\Windows\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe {8C1BA73F-7795-4568-80F6-19620384F739}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe Token: SeIncBasePriorityPrivilege 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe Token: SeIncBasePriorityPrivilege 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe Token: SeIncBasePriorityPrivilege 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe Token: SeIncBasePriorityPrivilege 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe Token: SeIncBasePriorityPrivilege 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe Token: SeIncBasePriorityPrivilege 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe Token: SeIncBasePriorityPrivilege 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe Token: SeIncBasePriorityPrivilege 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe Token: SeIncBasePriorityPrivilege 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe Token: SeIncBasePriorityPrivilege 1664 {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe Token: SeIncBasePriorityPrivilege 2668 {1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 4900 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe 93 PID 1252 wrote to memory of 4900 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe 93 PID 1252 wrote to memory of 4900 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe 93 PID 1252 wrote to memory of 2088 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe 94 PID 1252 wrote to memory of 2088 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe 94 PID 1252 wrote to memory of 2088 1252 2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe 94 PID 4900 wrote to memory of 1752 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 95 PID 4900 wrote to memory of 1752 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 95 PID 4900 wrote to memory of 1752 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 95 PID 4900 wrote to memory of 3668 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 96 PID 4900 wrote to memory of 3668 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 96 PID 4900 wrote to memory of 3668 4900 {EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe 96 PID 1752 wrote to memory of 2484 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 100 PID 1752 wrote to memory of 2484 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 100 PID 1752 wrote to memory of 2484 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 100 PID 1752 wrote to memory of 4944 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 101 PID 1752 wrote to memory of 4944 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 101 PID 1752 wrote to memory of 4944 1752 {6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe 101 PID 2484 wrote to memory of 216 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 102 PID 2484 wrote to memory of 216 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 102 PID 2484 wrote to memory of 216 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 102 PID 2484 wrote to memory of 1004 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 103 PID 2484 wrote to memory of 1004 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 103 PID 2484 wrote to memory of 1004 2484 {AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe 103 PID 216 wrote to memory of 2232 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 104 PID 216 wrote to memory of 2232 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 104 PID 216 wrote to memory of 2232 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 104 PID 216 wrote to memory of 2044 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 105 PID 216 wrote to memory of 2044 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 105 PID 216 wrote to memory of 2044 216 {F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe 105 PID 2232 wrote to memory of 3588 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 107 PID 2232 wrote to memory of 3588 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 107 PID 2232 wrote to memory of 3588 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 107 PID 2232 wrote to memory of 1332 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 108 PID 2232 wrote to memory of 1332 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 108 PID 2232 wrote to memory of 1332 2232 {8C1BA73F-7795-4568-80F6-19620384F739}.exe 108 PID 3588 wrote to memory of 2684 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 109 PID 3588 wrote to memory of 2684 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 109 PID 3588 wrote to memory of 2684 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 109 PID 3588 wrote to memory of 2720 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 110 PID 3588 wrote to memory of 2720 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 110 PID 3588 wrote to memory of 2720 3588 {5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe 110 PID 2684 wrote to memory of 3396 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 118 PID 2684 wrote to memory of 3396 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 118 PID 2684 wrote to memory of 3396 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 118 PID 2684 wrote to memory of 1204 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 119 PID 2684 wrote to memory of 1204 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 119 PID 2684 wrote to memory of 1204 2684 {153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe 119 PID 3396 wrote to memory of 4340 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 120 PID 3396 wrote to memory of 4340 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 120 PID 3396 wrote to memory of 4340 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 120 PID 3396 wrote to memory of 4380 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 121 PID 3396 wrote to memory of 4380 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 121 PID 3396 wrote to memory of 4380 3396 {EF8529F7-1E94-4214-B602-FA88BACD005A}.exe 121 PID 4340 wrote to memory of 1664 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 122 PID 4340 wrote to memory of 1664 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 122 PID 4340 wrote to memory of 1664 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 122 PID 4340 wrote to memory of 3152 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 123 PID 4340 wrote to memory of 3152 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 123 PID 4340 wrote to memory of 3152 4340 {FED8337C-42C0-4fcd-A986-7412A53582B7}.exe 123 PID 1664 wrote to memory of 2668 1664 {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe 127 PID 1664 wrote to memory of 2668 1664 {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe 127 PID 1664 wrote to memory of 2668 1664 {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe 127 PID 1664 wrote to memory of 2612 1664 {9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_5b79abfdf45bb4e61ff9b4565a7bf49c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\{EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exeC:\Windows\{EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exeC:\Windows\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\{AB0697E8-7CF4-4771-A1CB-40FD61865648}.exeC:\Windows\{AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\{F91ED788-E6EA-4139-9CD3-38B34C23E936}.exeC:\Windows\{F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\{8C1BA73F-7795-4568-80F6-19620384F739}.exeC:\Windows\{8C1BA73F-7795-4568-80F6-19620384F739}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exeC:\Windows\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\{153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exeC:\Windows\{153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\{EF8529F7-1E94-4214-B602-FA88BACD005A}.exeC:\Windows\{EF8529F7-1E94-4214-B602-FA88BACD005A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\{FED8337C-42C0-4fcd-A986-7412A53582B7}.exeC:\Windows\{FED8337C-42C0-4fcd-A986-7412A53582B7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exeC:\Windows\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\{1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exeC:\Windows\{1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9}.exeC:\Windows\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9}.exe13⤵
- Executes dropped EXE
PID:3944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1035A~1.EXE > nul13⤵PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B0C1~1.EXE > nul12⤵PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FED83~1.EXE > nul11⤵PID:3152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF852~1.EXE > nul10⤵PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{153D4~1.EXE > nul9⤵PID:1204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B3A7~1.EXE > nul8⤵PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C1BA~1.EXE > nul7⤵PID:1332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F91ED~1.EXE > nul6⤵PID:2044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB069~1.EXE > nul5⤵PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E3F9~1.EXE > nul4⤵PID:4944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE10E~1.EXE > nul3⤵PID:3668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1035A3B2-00AC-4b43-ACA0-49150D962DAB}.exe
- Size 380KB
- SHA256 92dfd16f3413764903485ee417302cdcfc3cdfec8397a46551070ef811016635
- MD5 c43b853fa041fe24fdb8c982164c34ed
- SHA1 4af7abd7cd54f1c1aac2fe6a79597a847ca6948b
- SHA512 d01e1b8859925ba3f0254e42ed697bf5aaa6e4110cdd7d12fc9f78cd66a6c83ea85f46ae1403b323a7762f21d2623b3d2cf07f18535151339c4faca81c5bca63
- SSDEEP 3072:mEGh0oslPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGul7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{153D4236-9F03-4d5d-AEB0-A32F97473EDF}.exe
- Size 380KB
- SHA256 a79b7d57f8b49ced883e87191a8a07f6487d3988bf0a7a32da6524efd32f05c3
- MD5 667a0b90d7f546d125f2cabca1a00a82
- SHA1 26de5992b7fdfd119313a65a28108085708e949e
- SHA512 3ce9d5cac543c8094c546448f81a8984dd85aa70c6242bac4327055f2d2989b1ba7c1301f775e32751f111800f9aed5675b7cca0a7954b12942208bc69db1b43
- SSDEEP 3072:mEGh0oIlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG+l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5B3A72D9-8BD6-49eb-A33B-59E0D275DE48}.exe
- Size 380KB
- SHA256 db560cdd4b74be13720efd94c4013175976210640a55013e333c27d1f96cf2ae
- MD5 93ca785ee7dcecde25b5aba3e87d0b2b
- SHA1 59607d1f24ea64a328440215fb9ad1bc07a02524
- SHA512 d26e91e39a69d0c170155011a4af3436905058de96e32ea29d6b6c385569bfcfe9bed00c6f6468b994bd5a4808804399d5a001b6473e6fd9e56a689f57d4de88
- SSDEEP 3072:mEGh0oGlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGMl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6E3F99C7-2C2F-4e38-AE9B-B4E365A2BBD7}.exe
- Size 380KB
- SHA256 5f82efc4bca94afbc5a36457b5a0c844bd00c05619b6953b4fc937c6e1a39453
- MD5 1288e5a934df029f01823634067b6efa
- SHA1 18de169fc4b56ac17d2bd934827445725dd4259a
- SHA512 b2ceb70965e7e3d581044e1bdf079727575620a227e15eb1a2811883952de9998b5176460b46ee05de125f694c1ed39f02c08573006256b98811c0b0e5f52d94
- SSDEEP 3072:mEGh0ojlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGJl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8C1BA73F-7795-4568-80F6-19620384F739}.exe
- Size 380KB
- SHA256 be4a3bca27c93f1c79a4d087a10574ae55434197b73c41ca7c9a21dc75ed1055
- MD5 af896faa5ab13bdf21a21756e18b5bfc
- SHA1 85b63b433ad23cd641f82d601b8a3e70c1572fbd
- SHA512 31a774c9370c312c9bcbcb45d4d5c8ea20b08dc256709217b44973c06ef081c16625e6efedbb4c5b0826e9a3c9de52758fb08f6e572c2d15833a6476e794bde5
- SSDEEP 3072:mEGh0oUlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGCl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9B0C1A6C-AB18-4c52-AE17-45C55ADD3971}.exe
- Size 380KB
- SHA256 bcd568920610df481082a023999581af7170c3533b191b08fa12dfb6775aa07a
- MD5 cd67ad0b84982f4f5cb0ccbb87482552
- SHA1 449e380774b31adfad550844f8077d1f6669d413
- SHA512 85ead81491f93661df1aec1d3d8e7fd3768470d3aef093efab4218b5a7906aae461e9540fad3d3998f188912436b78b6592d3bccc35a3ea9b69e5b53ec107418
- SSDEEP 3072:mEGh0oqlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGsl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A0DCE2EC-B7D6-4a00-8998-9A76403067F9}.exe
- Size 380KB
- SHA256 9a9ec9116c59e1ee4022c08cbf1a6a1d8943dcde1441512450636abf0be1dab1
- MD5 39ba2f092d9661dd17ee51fe529c3872
- SHA1 f145b63a13dc363ee4c1ca0275c71622bac3a89e
- SHA512 fe2aafe41d1b1a4139c6a3e80c7cd15e3a3d768384451b8c25c81e07a0f3026065151f8f4c129a385745ef103f5895f824c3a6ffaf3700ff809d6839405e29a8
- SSDEEP 3072:mEGh0ovlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGtl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AB0697E8-7CF4-4771-A1CB-40FD61865648}.exe
- Size 380KB
- SHA256 2258ba987a27b0f8a6bee8903b295de824dfd9a84bdda9d86dbaecb90402ab30
- MD5 c896219b7de1b9618e182617ccb43ffb
- SHA1 75ea48342356b108c8bd5ff4fea9ba91a003e76b
- SHA512 dd4320861989759f0b7229fe65d4d712d000fdf4ce297ce25d9c43f060dfb0b63bd0c12f8a033a92fbf278e16910da5ec8ca6982a63eda31c1de1b58352ca9c1
- SSDEEP 3072:mEGh0oclPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGSl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EE10E8BD-DB3A-4770-8417-430DDB4D080E}.exe
- Size 380KB
- SHA256 588c7a9ce3c91dfb4d0d1b356f481d866222b766c8abd5e095bacdac1eaf250e
- MD5 fd10cf3c3210595216e1a30eb9a0d38e
- SHA1 95e55e9070aa8bf4cdaaea0833a9008717bf7e35
- SHA512 019984dd12544454ff94b373172103cdf0af91738cb2bb03fb2ce82662bd0e5d1182e6a0f341650e8f666b80c2a4a2a1ffc962d644cb062cc6fc37a12102207f
- SSDEEP 3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF8529F7-1E94-4214-B602-FA88BACD005A}.exe
- Size 380KB
- SHA256 96f25603037ab62d228132d258981e733a2421ac7e5f0aa562a12d0d9c397fe7
- MD5 6be18e8ff005be1ea01e977be9a50387
- SHA1 013af9ae1cae7c9a97c4d1398c546abac6cb79e6
- SHA512 f444f520ed72f6007522786013d65d75ae04d0c145186f2ac088a2f930fd37573aa9681abbb0594bbe2b5dc5c78fe3f7d82b79eee1b0126bde9702b7257b2885
- SSDEEP 3072:mEGh0oTlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG9l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F91ED788-E6EA-4139-9CD3-38B34C23E936}.exe
- Size 380KB
- SHA256 634289b11b21559407444a7c02f35232c43a4b63e7ff8b13727da60a244d542e
- MD5 bbf74e3724565e4d736d68f2ea42a7a4
- SHA1 8d709d538a90529f42238e9d2e0d01ee36e37399
- SHA512 ed1ad2831f1972ac62e5a0bd5ff743f745391aa5b1e92a1f854b89e6a00a73e4d20e415babeda08c5be58328a89e7b81f41ae092afa86239376962694d1ff5b0
- SSDEEP 3072:mEGh0oWlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG0l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FED8337C-42C0-4fcd-A986-7412A53582B7}.exe
- Size 380KB
- SHA256 d4518ddd6832fd399f5b41f37ec7ff203537e25543ebdc751913d0860bc451e4
- MD5 afc70d4d8f908f22b7fa03bed6357177
- SHA1 131a52667c7d3e4431a7509eb9e7270ca2d4484c
- SHA512 ef7c442556f0d874e5727c61aa568279addcd661d88a4fe7173b0baae8fce0217de3d1b7486fff3f14ee0ea3f8c3400f9dbce96b6889e29a5982bbd844a0bf92
- SSDEEP 3072:mEGh0oGlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG8l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP