Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 06:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe
- Size 380KB
- Sample240526-hfg63sbb38
- SHA256 06b9e19fbe19794ad1833167c801257bc58ce5d9e383bcd155d076bf0e1e9823
- MD5 8dff0048c43932746c15667d23b9624b
- SHA1 bf1e21fc7875b9ad43c7291100b010209e4b71be
- SHA512 0eeb08f639d1d77a45391e4f7b48112da706457cddd1c2754b826c6c24db0a89208ea20b00ce137e19b6fb79bab3118db7debcf228f08126464e14a9555fba03
- SSDEEP 3072:mEGh0oclPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGql7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000d000000023367-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023368-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000500000001e749-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023368-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000600000001e749-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023368-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000001e749-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233fd-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000001e749-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233fd-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023363-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233fd-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{124FE74F-794F-49ec-8BE6-A1040C08C274}\stubpath = "C:\\Windows\\{124FE74F-794F-49ec-8BE6-A1040C08C274}.exe" {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA6C0BDD-119E-445f-922A-B76684743F75}\stubpath = "C:\\Windows\\{AA6C0BDD-119E-445f-922A-B76684743F75}.exe" {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B986973C-2433-48bb-BAA5-BA9625598A8B} {AA6C0BDD-119E-445f-922A-B76684743F75}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA} {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7} {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F717F3E6-AEBF-4694-BFB5-77063D97FF30} {13CCE6B2-079A-4738-9C55-27D50669819D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670} {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}\stubpath = "C:\\Windows\\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe" {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3} {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3}\stubpath = "C:\\Windows\\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe" {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C926B10-2B94-4949-984B-B25C1C88459A} {9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9} {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9}\stubpath = "C:\\Windows\\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe" {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{124FE74F-794F-49ec-8BE6-A1040C08C274} {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA6C0BDD-119E-445f-922A-B76684743F75} {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486} 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}\stubpath = "C:\\Windows\\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe" {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13CCE6B2-079A-4738-9C55-27D50669819D} {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13CCE6B2-079A-4738-9C55-27D50669819D}\stubpath = "C:\\Windows\\{13CCE6B2-079A-4738-9C55-27D50669819D}.exe" {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B986973C-2433-48bb-BAA5-BA9625598A8B}\stubpath = "C:\\Windows\\{B986973C-2433-48bb-BAA5-BA9625598A8B}.exe" {AA6C0BDD-119E-445f-922A-B76684743F75}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486}\stubpath = "C:\\Windows\\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe" 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F717F3E6-AEBF-4694-BFB5-77063D97FF30}\stubpath = "C:\\Windows\\{F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe" {13CCE6B2-079A-4738-9C55-27D50669819D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA}\stubpath = "C:\\Windows\\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe" {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C926B10-2B94-4949-984B-B25C1C88459A}\stubpath = "C:\\Windows\\{7C926B10-2B94-4949-984B-B25C1C88459A}.exe" {9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe - Executes dropped EXE 12 IoCs
pid Process 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 2800 {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe 1692 {9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe 1892 {7C926B10-2B94-4949-984B-B25C1C88459A}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{124FE74F-794F-49ec-8BE6-A1040C08C274}.exe {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe File created C:\Windows\{AA6C0BDD-119E-445f-922A-B76684743F75}.exe {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe File created C:\Windows\{B986973C-2433-48bb-BAA5-BA9625598A8B}.exe {AA6C0BDD-119E-445f-922A-B76684743F75}.exe File created C:\Windows\{7C926B10-2B94-4949-984B-B25C1C88459A}.exe {9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe File created C:\Windows\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe File created C:\Windows\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe File created C:\Windows\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe File created C:\Windows\{F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe {13CCE6B2-079A-4738-9C55-27D50669819D}.exe File created C:\Windows\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe File created C:\Windows\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe File created C:\Windows\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe File created C:\Windows\{13CCE6B2-079A-4738-9C55-27D50669819D}.exe {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe Token: SeIncBasePriorityPrivilege 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe Token: SeIncBasePriorityPrivilege 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe Token: SeIncBasePriorityPrivilege 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe Token: SeIncBasePriorityPrivilege 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe Token: SeIncBasePriorityPrivilege 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe Token: SeIncBasePriorityPrivilege 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe Token: SeIncBasePriorityPrivilege 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe Token: SeIncBasePriorityPrivilege 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe Token: SeIncBasePriorityPrivilege 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe Token: SeIncBasePriorityPrivilege 2800 {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe Token: SeIncBasePriorityPrivilege 1692 {9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3236 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe 94 PID 2132 wrote to memory of 3236 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe 94 PID 2132 wrote to memory of 3236 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe 94 PID 2132 wrote to memory of 1768 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe 95 PID 2132 wrote to memory of 1768 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe 95 PID 2132 wrote to memory of 1768 2132 2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe 95 PID 3236 wrote to memory of 2148 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 96 PID 3236 wrote to memory of 2148 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 96 PID 3236 wrote to memory of 2148 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 96 PID 3236 wrote to memory of 5116 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 97 PID 3236 wrote to memory of 5116 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 97 PID 3236 wrote to memory of 5116 3236 {7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe 97 PID 2148 wrote to memory of 384 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 101 PID 2148 wrote to memory of 384 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 101 PID 2148 wrote to memory of 384 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 101 PID 2148 wrote to memory of 4708 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 102 PID 2148 wrote to memory of 4708 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 102 PID 2148 wrote to memory of 4708 2148 {75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe 102 PID 384 wrote to memory of 652 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 103 PID 384 wrote to memory of 652 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 103 PID 384 wrote to memory of 652 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 103 PID 384 wrote to memory of 2800 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 104 PID 384 wrote to memory of 2800 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 104 PID 384 wrote to memory of 2800 384 {7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe 104 PID 652 wrote to memory of 1756 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 105 PID 652 wrote to memory of 1756 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 105 PID 652 wrote to memory of 1756 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 105 PID 652 wrote to memory of 1700 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 106 PID 652 wrote to memory of 1700 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 106 PID 652 wrote to memory of 1700 652 {13CCE6B2-079A-4738-9C55-27D50669819D}.exe 106 PID 1756 wrote to memory of 1976 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 108 PID 1756 wrote to memory of 1976 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 108 PID 1756 wrote to memory of 1976 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 108 PID 1756 wrote to memory of 4524 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 109 PID 1756 wrote to memory of 4524 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 109 PID 1756 wrote to memory of 4524 1756 {F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe 109 PID 1976 wrote to memory of 3584 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 110 PID 1976 wrote to memory of 3584 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 110 PID 1976 wrote to memory of 3584 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 110 PID 1976 wrote to memory of 3064 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 111 PID 1976 wrote to memory of 3064 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 111 PID 1976 wrote to memory of 3064 1976 {C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe 111 PID 3584 wrote to memory of 4912 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 118 PID 3584 wrote to memory of 4912 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 118 PID 3584 wrote to memory of 4912 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 118 PID 3584 wrote to memory of 3928 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 119 PID 3584 wrote to memory of 3928 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 119 PID 3584 wrote to memory of 3928 3584 {688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe 119 PID 4912 wrote to memory of 1592 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 120 PID 4912 wrote to memory of 1592 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 120 PID 4912 wrote to memory of 1592 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 120 PID 4912 wrote to memory of 3480 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 121 PID 4912 wrote to memory of 3480 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 121 PID 4912 wrote to memory of 3480 4912 {124FE74F-794F-49ec-8BE6-A1040C08C274}.exe 121 PID 1592 wrote to memory of 2800 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 122 PID 1592 wrote to memory of 2800 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 122 PID 1592 wrote to memory of 2800 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 122 PID 1592 wrote to memory of 1672 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 123 PID 1592 wrote to memory of 1672 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 123 PID 1592 wrote to memory of 1672 1592 {AA6C0BDD-119E-445f-922A-B76684743F75}.exe 123 PID 2800 wrote to memory of 1692 2800 {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe 126 PID 2800 wrote to memory of 1692 2800 {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe 126 PID 2800 wrote to memory of 1692 2800 {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe 126 PID 2800 wrote to memory of 2848 2800 {B986973C-2433-48bb-BAA5-BA9625598A8B}.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_8dff0048c43932746c15667d23b9624b_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exeC:\Windows\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exeC:\Windows\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exeC:\Windows\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\{13CCE6B2-079A-4738-9C55-27D50669819D}.exeC:\Windows\{13CCE6B2-079A-4738-9C55-27D50669819D}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\{F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exeC:\Windows\{F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exeC:\Windows\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exeC:\Windows\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\{124FE74F-794F-49ec-8BE6-A1040C08C274}.exeC:\Windows\{124FE74F-794F-49ec-8BE6-A1040C08C274}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\{AA6C0BDD-119E-445f-922A-B76684743F75}.exeC:\Windows\{AA6C0BDD-119E-445f-922A-B76684743F75}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\{B986973C-2433-48bb-BAA5-BA9625598A8B}.exeC:\Windows\{B986973C-2433-48bb-BAA5-BA9625598A8B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exeC:\Windows\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\{7C926B10-2B94-4949-984B-B25C1C88459A}.exeC:\Windows\{7C926B10-2B94-4949-984B-B25C1C88459A}.exe13⤵
- Executes dropped EXE
PID:1892
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CFA8~1.EXE > nul13⤵PID:2940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9869~1.EXE > nul12⤵PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA6C0~1.EXE > nul11⤵PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{124FE~1.EXE > nul10⤵PID:3480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68892~1.EXE > nul9⤵PID:3928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2B8D~1.EXE > nul8⤵PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F717F~1.EXE > nul7⤵PID:4524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13CCE~1.EXE > nul6⤵PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D196~1.EXE > nul5⤵PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75FCD~1.EXE > nul4⤵PID:4708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F38F~1.EXE > nul3⤵PID:5116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{124FE74F-794F-49ec-8BE6-A1040C08C274}.exe
- Size 380KB
- SHA256 d89146635ffbd1e5f07087b6858d2bece3f2901a40016de193738402d556d8e0
- MD5 f81fc187f158aa1c334752e51bf143f1
- SHA1 34c5596ea4d10877a8191220b1b660c9e20aac93
- SHA512 3e95446f252ad67f6a73ed9fffefe51a76c9bcd3f3576d37ad777fd6130b10229f34c08ccad920b2e9f292836e83f8d4d9bf8684b7a3b0ea7b4f74da8ea216d0
- SSDEEP 3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGQl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{13CCE6B2-079A-4738-9C55-27D50669819D}.exe
- Size 380KB
- SHA256 0f237de6146bb30292f03415b7518a813abf8575067903cc9c66f379397d84d8
- MD5 856cb9e55ed7066ffaa9efb9ceba856e
- SHA1 4b1949639ba99e4faba5f1d3b9cfc08bfa2a7ff2
- SHA512 169bcec6745d057014b0574b2a8c2cb37d041ccbfaeab900e2f582987ce2a0ff20e2f8be9d9f0b534403e23f4a875bbc00aee41568554b9fad46a7762807c725
- SSDEEP 3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG/l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{688929F3-EC5E-4ae4-9F0E-9C1538350FE9}.exe
- Size 380KB
- SHA256 136814648ad075a70e8db5789487ee49a244b1c9b97267faa037db4e2282d9ba
- MD5 85854d5a5cd6c38bc3ee7d25ca30598f
- SHA1 bf4c91f17eb0c26cffecaea675f1392ff92720b5
- SHA512 1f5cfa62a00211354f9dc050b20774e675713bcf91c2e00744fdd455e0423732316f2692bc42d2e8ccbb8a93b08f915c88e970ce8457ba1607b29334f44a3020
- SSDEEP 3072:mEGh0oUlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGyl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{75FCDA6D-E5F6-442e-954B-6BAB72E326F3}.exe
- Size 380KB
- SHA256 4ea1efea49ed2c77c2bb1f45f1dba32b4de176ff701351f8967e21ec890d79fc
- MD5 fac0a2cb092cc405db85059d25336dbe
- SHA1 a63197908cc4fe7f4e5d3cc0bf8632dac6c8aa8d
- SHA512 0338a75f0bc0be92044fe660dc6e0e95ae5062c22a200b65f4fddc3d21ccc5d4ffb246ebc4a8dec1c988b478fa15c305de8e654a9c4f99bc97c0b9e1f5a44880
- SSDEEP 3072:mEGh0oWlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7C926B10-2B94-4949-984B-B25C1C88459A}.exe
- Size 380KB
- SHA256 a270a424e4e538dfd3db9b34032ed57b3562505e71eabe1571a2aad78187babc
- MD5 f076a8dd585a2a114f43d8802499a261
- SHA1 f65b4906c66f70ce856fae61300766b3d78de775
- SHA512 0604f5fac210fd7a92aba269e65ff471928cd91b7d0a6163fd344b163342cd303de565f2ff08c75fa47f71f29f20ccf21f6b8120e30e7b42d8a1d61bc58b1e7c
- SSDEEP 3072:mEGh0o3lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGdl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7D196DAA-3E6C-4d1b-A4DB-6289CBFEFCB7}.exe
- Size 380KB
- SHA256 045dd0ebd102b4d7a47e3408f4850ddd13884077faff157e96d5e8d4e25b0d91
- MD5 6ce90e05fde29b2f889d46cf4b31885a
- SHA1 ddc78d3991c5804de8bd315392a532c426e4e924
- SHA512 c0dd6124734e7a39cbe40e70498bfbe7b2b313e3ce1de4900c837056f00d7b727e8a28e92c770834d63038113dab0eafc33398b6f1e43b6e69ce03921ae6b9cc
- SSDEEP 3072:mEGh0odlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGDl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F38FC44-2F33-436c-AAC4-BC81ED6BA486}.exe
- Size 380KB
- SHA256 79e7b80e775ea0d3b8bb329dc7c7108bec020ee219376d804904284c532906c1
- MD5 93e9713d50d94154a7903dba272e8f2f
- SHA1 cf239b09221ef56f00f611c6376c4fa01c1db53f
- SHA512 8fcd4d1e38f165a6f383cb22445f8bd0a21f231507c4408502121cb514d40378694cf1c8d8e8f5f1a84833731eaf8f76d6aa9fdaa8a2281c32ff9cb31640c96c
- SSDEEP 3072:mEGh0oKlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGYl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9CFA8748-704C-4abc-98FB-B685AE3B2FDA}.exe
- Size 380KB
- SHA256 399cae47365349524fe55a4744ea492d7a9a6ba8f0da703ef7172ab159e00a91
- MD5 f8f408cf797fa044d3c311a5e752a9f3
- SHA1 e58645f65bf26de89445f87baa31a07ed1c28365
- SHA512 73ceded7c448f206a25eeb05c3a8bea91ddc5baf213cb6fb2b83da164737283676850d8cdab6d4c7027debed377ce679e7f428192096f69b08bd41ced19c2be9
- SSDEEP 3072:mEGh0o8lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG+l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AA6C0BDD-119E-445f-922A-B76684743F75}.exe
- Size 380KB
- SHA256 a1acf64d98a64beabebcd43f47ee337df53b364dcba808d6f08b17fb9e17961d
- MD5 3890a246ae860bee54550cbddc074a16
- SHA1 b6c69ca88da98d57cd026971bb76f4c6fc6d1853
- SHA512 5cbb7a5998fe91ea1761b6c3b9a03ce869cacb61412007186aa8921a74f65302d7ad4ada9392333f6f29b76eb2d5232202ca4c4ac857d289fb4eb7e6cc332a2c
- SSDEEP 3072:mEGh0o/lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGtl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B986973C-2433-48bb-BAA5-BA9625598A8B}.exe
- Size 380KB
- SHA256 70dd5d458efa3c6e96fb426b96a22c38b59d353d169edcd6dba83ac8a040dce5
- MD5 19a72ab8426ef1d6f0ef5419634e8429
- SHA1 bf66c493db07d3fdcc466ff26c525194c57c55cf
- SHA512 8c7306f77e3e71df740cdac24f141c1c9a2e1d281d730d3f830a8d471bc83c61dcc9da59abdd8077fd6249fa07e1c48338912e6b2ddb82a2fbb9c6731e8f075c
- SSDEEP 3072:mEGh0oGlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGol7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2B8DBD6-A2F1-46f0-8EC2-7B16FE179670}.exe
- Size 380KB
- SHA256 01fd4fe9a94eac9b91bfa28be500f96954e026848b900f2d14823074bb90cbfd
- MD5 612469e76679ec2c651640c36ff9edea
- SHA1 484573c2d16799f50c6fde3506975c26f5bf3909
- SHA512 63b58c4e5c14eb7dcbd6eeb635c45f75b9a3e35449381d9610eca98288da1135694dfa397856c8d67e5ed958b0f74692376b94d20bcb61fead49e2916b89e0f7
- SSDEEP 3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGUl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F717F3E6-AEBF-4694-BFB5-77063D97FF30}.exe
- Size 380KB
- SHA256 b755570ef23220912b3281e2df847959a8a61a67c13175e8136e08cfc945cc34
- MD5 cf35b207881189d53e48ea7a0a0ea239
- SHA1 5bc078886e647d4cfd06ec333ade0167ce9fe162
- SHA512 e7ba6c0a8a9c69e504a7525deacde9988857a35502448953e4798b7562871c0da31fdb7004542353c53686feaf681b8224c1b908ac1a3f706f8069a33f5c1bcb
- SSDEEP 3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGXl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP