Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 18:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe
- Size 380KB
- Sample240603-w2celsef2s
- SHA256 907429c50a8ea2c1b5aaa48b959290bab54e848088574ad46f1e4d74e97269b0
- MD5 9bb99c319f171245f0c2a37e49e2b9b1
- SHA1 dc8bfd5a81586bda077715726894ae112ebc7cfd
- SHA512 71f4afe3a29aa062e8a9b97785160127f468615351564e758e53dfc02f616cf036a1607e6a5ce3d50e60cfd37f3fd52aa283a5a9f026e2f93ec98e705ff51923
- SSDEEP 3072:mEGh0oylPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGIl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000023434-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002342d-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002343a-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002342d-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000021793-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000021797-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000021793-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000705-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000705-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000705-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC} {69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5232015-9020-4ff2-9229-16B625E5767C} {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A8BF434-1C90-47a0-A643-1161C0AC32E3} {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A8BF434-1C90-47a0-A643-1161C0AC32E3}\stubpath = "C:\\Windows\\{0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe" {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}\stubpath = "C:\\Windows\\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe" {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F80AFB1-D11F-4443-93E2-D17DA495B523}\stubpath = "C:\\Windows\\{2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe" {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254}\stubpath = "C:\\Windows\\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe" {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C}\stubpath = "C:\\Windows\\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe" 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5}\stubpath = "C:\\Windows\\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe" {E5232015-9020-4ff2-9229-16B625E5767C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A91C286-ECAE-472a-9864-9738FBB6FA9F} {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F80AFB1-D11F-4443-93E2-D17DA495B523} {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CE51593-83FA-48db-8C75-296DEA45CB54} {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC}\stubpath = "C:\\Windows\\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC}.exe" {69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5232015-9020-4ff2-9229-16B625E5767C}\stubpath = "C:\\Windows\\{E5232015-9020-4ff2-9229-16B625E5767C}.exe" {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5743D34-7F3A-48bb-96F3-0D545D122173} {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC} {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C} {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}\stubpath = "C:\\Windows\\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe" {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CE51593-83FA-48db-8C75-296DEA45CB54}\stubpath = "C:\\Windows\\{7CE51593-83FA-48db-8C75-296DEA45CB54}.exe" {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254} {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C} 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5} {E5232015-9020-4ff2-9229-16B625E5767C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A91C286-ECAE-472a-9864-9738FBB6FA9F}\stubpath = "C:\\Windows\\{2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe" {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5743D34-7F3A-48bb-96F3-0D545D122173}\stubpath = "C:\\Windows\\{E5743D34-7F3A-48bb-96F3-0D545D122173}.exe" {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe - Executes dropped EXE 12 IoCs
pid Process 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 1660 {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe 4176 {69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe 3940 {069CE081-B73F-40d0-8697-AEC8BC3A8AEC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{7CE51593-83FA-48db-8C75-296DEA45CB54}.exe {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe File created C:\Windows\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe File created C:\Windows\{2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe File created C:\Windows\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe File created C:\Windows\{2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe File created C:\Windows\{E5743D34-7F3A-48bb-96F3-0D545D122173}.exe {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe File created C:\Windows\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe File created C:\Windows\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe File created C:\Windows\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC}.exe {69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe File created C:\Windows\{E5232015-9020-4ff2-9229-16B625E5767C}.exe {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe File created C:\Windows\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe {E5232015-9020-4ff2-9229-16B625E5767C}.exe File created C:\Windows\{0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe Token: SeIncBasePriorityPrivilege 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe Token: SeIncBasePriorityPrivilege 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe Token: SeIncBasePriorityPrivilege 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe Token: SeIncBasePriorityPrivilege 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe Token: SeIncBasePriorityPrivilege 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe Token: SeIncBasePriorityPrivilege 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe Token: SeIncBasePriorityPrivilege 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe Token: SeIncBasePriorityPrivilege 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe Token: SeIncBasePriorityPrivilege 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe Token: SeIncBasePriorityPrivilege 1660 {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe Token: SeIncBasePriorityPrivilege 4176 {69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 4484 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe 93 PID 2836 wrote to memory of 4484 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe 93 PID 2836 wrote to memory of 4484 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe 93 PID 2836 wrote to memory of 2640 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe 94 PID 2836 wrote to memory of 2640 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe 94 PID 2836 wrote to memory of 2640 2836 2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe 94 PID 4484 wrote to memory of 4268 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 95 PID 4484 wrote to memory of 4268 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 95 PID 4484 wrote to memory of 4268 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 95 PID 4484 wrote to memory of 2924 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 96 PID 4484 wrote to memory of 2924 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 96 PID 4484 wrote to memory of 2924 4484 {0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe 96 PID 4268 wrote to memory of 5064 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 98 PID 4268 wrote to memory of 5064 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 98 PID 4268 wrote to memory of 5064 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 98 PID 4268 wrote to memory of 1120 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 99 PID 4268 wrote to memory of 1120 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 99 PID 4268 wrote to memory of 1120 4268 {E5232015-9020-4ff2-9229-16B625E5767C}.exe 99 PID 5064 wrote to memory of 2528 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 100 PID 5064 wrote to memory of 2528 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 100 PID 5064 wrote to memory of 2528 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 100 PID 5064 wrote to memory of 4360 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 101 PID 5064 wrote to memory of 4360 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 101 PID 5064 wrote to memory of 4360 5064 {F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe 101 PID 2528 wrote to memory of 3788 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 102 PID 2528 wrote to memory of 3788 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 102 PID 2528 wrote to memory of 3788 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 102 PID 2528 wrote to memory of 1708 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 103 PID 2528 wrote to memory of 1708 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 103 PID 2528 wrote to memory of 1708 2528 {2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe 103 PID 3788 wrote to memory of 3608 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 104 PID 3788 wrote to memory of 3608 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 104 PID 3788 wrote to memory of 3608 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 104 PID 3788 wrote to memory of 3600 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 105 PID 3788 wrote to memory of 3600 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 105 PID 3788 wrote to memory of 3600 3788 {0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe 105 PID 3608 wrote to memory of 3948 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 106 PID 3608 wrote to memory of 3948 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 106 PID 3608 wrote to memory of 3948 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 106 PID 3608 wrote to memory of 1508 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 107 PID 3608 wrote to memory of 1508 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 107 PID 3608 wrote to memory of 1508 3608 {2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe 107 PID 3948 wrote to memory of 2720 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 108 PID 3948 wrote to memory of 2720 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 108 PID 3948 wrote to memory of 2720 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 108 PID 3948 wrote to memory of 4740 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 109 PID 3948 wrote to memory of 4740 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 109 PID 3948 wrote to memory of 4740 3948 {E5743D34-7F3A-48bb-96F3-0D545D122173}.exe 109 PID 2720 wrote to memory of 4456 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 110 PID 2720 wrote to memory of 4456 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 110 PID 2720 wrote to memory of 4456 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 110 PID 2720 wrote to memory of 4276 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 111 PID 2720 wrote to memory of 4276 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 111 PID 2720 wrote to memory of 4276 2720 {D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe 111 PID 4456 wrote to memory of 1660 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 112 PID 4456 wrote to memory of 1660 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 112 PID 4456 wrote to memory of 1660 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 112 PID 4456 wrote to memory of 1512 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 113 PID 4456 wrote to memory of 1512 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 113 PID 4456 wrote to memory of 1512 4456 {92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe 113 PID 1660 wrote to memory of 4176 1660 {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe 114 PID 1660 wrote to memory of 4176 1660 {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe 114 PID 1660 wrote to memory of 4176 1660 {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe 114 PID 1660 wrote to memory of 4996 1660 {7CE51593-83FA-48db-8C75-296DEA45CB54}.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_9bb99c319f171245f0c2a37e49e2b9b1_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exeC:\Windows\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\{E5232015-9020-4ff2-9229-16B625E5767C}.exeC:\Windows\{E5232015-9020-4ff2-9229-16B625E5767C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exeC:\Windows\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\{2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exeC:\Windows\{2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\{0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exeC:\Windows\{0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\{2F80AFB1-D11F-4443-93E2-D17DA495B523}.exeC:\Windows\{2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\{E5743D34-7F3A-48bb-96F3-0D545D122173}.exeC:\Windows\{E5743D34-7F3A-48bb-96F3-0D545D122173}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exeC:\Windows\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exeC:\Windows\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\{7CE51593-83FA-48db-8C75-296DEA45CB54}.exeC:\Windows\{7CE51593-83FA-48db-8C75-296DEA45CB54}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exeC:\Windows\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4176 -
C:\Windows\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC}.exeC:\Windows\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC}.exe13⤵
- Executes dropped EXE
PID:3940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69C80~1.EXE > nul13⤵PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7CE51~1.EXE > nul12⤵PID:4996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92D71~1.EXE > nul11⤵PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D78E9~1.EXE > nul10⤵PID:4276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5743~1.EXE > nul9⤵PID:4740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F80A~1.EXE > nul8⤵PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A8BF~1.EXE > nul7⤵PID:3600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A91C~1.EXE > nul6⤵PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F76F8~1.EXE > nul5⤵PID:4360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5232~1.EXE > nul4⤵PID:1120
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F161~1.EXE > nul3⤵PID:2924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{069CE081-B73F-40d0-8697-AEC8BC3A8AEC}.exe
- Size 380KB
- SHA256 43490d0003c0bed7fa1223ea863601aa93fa8296c9ccedc02f17c6526d318513
- MD5 74a01280d1df02bb60ed530890e0c693
- SHA1 01895889b2054bcdd479fa6f7218daac44eea5b3
- SHA512 aa4f9eb08805f8ca2d3d7803d30dd8ba66c66aed4b9835ffb065b4b991990c4070f71e1a63efbe4098eaccc9eb46c3d605b79d1f6f4d92efefcf3b7167335824
- SSDEEP 3072:mEGh0otlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGXl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{0A8BF434-1C90-47a0-A643-1161C0AC32E3}.exe
- Size 380KB
- SHA256 16ed659651467f1773520346da174174be55d14bc5835bc641f3a103c009ff31
- MD5 8e907ddc3ce21f0701740491305dfc3a
- SHA1 9764b085c4e3ed50b4c22197d4fac3a75a09a73f
- SHA512 b013143bba20f4c8122fd82cffe90e51d1c707cc9088fe895cb8a3d441ed4e9156ca67c9af8aba55923edc0bb62de39d188b5a0d47493540cb04ed96193a9482
- SSDEEP 3072:mEGh0o2lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGAl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{0F161158-BEC8-48b7-A175-C83E7BAE3E5C}.exe
- Size 380KB
- SHA256 7f5d33bd3e8dc5cbcf4946162827854353ac3d59e1574525dded3af75b35e9be
- MD5 fdfebaad6e0391957f3e3466229ed3aa
- SHA1 945bca352fe51f1466075c317f8ba4b0050cef85
- SHA512 a5ccce6a82a5c657021416bb31ef2aab55263f58c7d26176e590980bad87fe456b50d82ce6e18a9f387e376a80c58dc5a33e6ce3525b7e8deaf4a23dd92c4bd4
- SSDEEP 3072:mEGh0oVlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGXl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2A91C286-ECAE-472a-9864-9738FBB6FA9F}.exe
- Size 380KB
- SHA256 3ef46b260403f0f8a8962a243e658ecf4fb36925980fae746554aa1d4a91e89d
- MD5 7f2d8fca1a88c26b690f8ded95700994
- SHA1 36ca9742035134faf39da23287d53639f2962dd9
- SHA512 4f6ea555abba1aae2b4c18a9af0f22cdcebcc938e9c71f0604105792fd34205f06eceb41bf106d3a89d5a4dcfafd49144795f0e67ea68ee92b4187055aa6a90b
- SSDEEP 3072:mEGh0oYlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGOl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2F80AFB1-D11F-4443-93E2-D17DA495B523}.exe
- Size 380KB
- SHA256 3fa70e0d52bd6ed87d5ef9672f93beda470bc197779682074a6cf807c55da602
- MD5 b56d9f68d8f1612f1dcdec42f207bed7
- SHA1 825833c46e10c86fd52374478d30e75227c30fdf
- SHA512 d8de58a278f91731d45103aa1b388912a57cacc81a27b0485e1b10229ab348c230d62e41d0fb30fc72c094300ab7fd5b1733fdbfc814da3c348bfe75731db27a
- SSDEEP 3072:mEGh0ovlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGNl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{69C804A8-FBC7-4ff7-A6D0-44DAF229E254}.exe
- Size 380KB
- SHA256 5938f7ab5ce114b2e1b7384f74464c573d72339bf7d706f693d4f79ec5883596
- MD5 012ae3045bc4de2d2f5951cefc56e1e5
- SHA1 fc94f221e31ede6cde9f6c8ddab7456345db6e64
- SHA512 8032f12a01c790be4dfb7f9e2b04871d0fda4533546fa4d0a18f97748624e18cd5d458b064adee08b93d87eb06294c8ef6e0315bfd17629966544dbdd843beeb
- SSDEEP 3072:mEGh0oFlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGrl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7CE51593-83FA-48db-8C75-296DEA45CB54}.exe
- Size 380KB
- SHA256 f71c915163f24a23d8614d0ad6126bf3b342c573bc0514567acfe1b2a44ca3b5
- MD5 8456cdcdc5e7c3b674714954c7148d42
- SHA1 1471e8266cc3e14d05d642255c5e355b909c5606
- SHA512 7cb80875cb51cff675879c8e46189f15b1e5b6e6b7b7341202ae40406b0e6f619dbfdc37932f6c3dcc0f48263c4c137d76bb6bf68348700d39c3045c214fe834
- SSDEEP 3072:mEGh0o9lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGLl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{92D71BE7-1EE5-4f78-BCF9-FB088B90F41C}.exe
- Size 380KB
- SHA256 ad3c71a9ab247438137d2873c37b84f935a1c1c27104c12ba2cad8cd0bf669c7
- MD5 00d87d7d59f156cffb10ae865778c312
- SHA1 fe97bdc23805f55a6ed12232b4fea01349fe72e8
- SHA512 4581663797a0576fc91d0f75cb8713152747fe20e7830d256429389b8414945399037acc838b71735fccda33d095072354edd4b4615e2dae7c8e26b06b0f8ab2
- SSDEEP 3072:mEGh0oXlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG9l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D78E91B2-DDDD-48b4-AA2D-E021934D3DBC}.exe
- Size 380KB
- SHA256 8766efc39c0c12600af2a4858ca54ffa510a8ee6ead43bc793e1d1485befbeec
- MD5 c81c66fff1b249c6548f00cbf9f170a6
- SHA1 ebbe740d28992341ccc8a936819a9f067735de27
- SHA512 a82c2bc996397f5c11a9f866185ae5e11a3acd73479095530c74e5a1a630fef1d24449eb9130709f3ec166e589f02d92b25296e25b104858284df46e2f6c26d2
- SSDEEP 3072:mEGh0oYlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG+l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E5232015-9020-4ff2-9229-16B625E5767C}.exe
- Size 380KB
- SHA256 ae781653e507a32b598f2384a8e6117777c672c2d4c0a839826fd5f13dddce01
- MD5 6419d087f707253a91c9625e33955f45
- SHA1 32c120168e2309d5c55d229ff9b4a8384fa83ef6
- SHA512 dd61da29d38cf9876a8edf8dadf72d7e97fe0fc9d2ec6b9ae16b410632b963e8bb18d8a3eb6237836a6a50d485ace525f3c7c3c21b43f45431d30a3d9bb74d74
- SSDEEP 3072:mEGh0ozlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGtl7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E5743D34-7F3A-48bb-96F3-0D545D122173}.exe
- Size 380KB
- SHA256 8a32450e46f4ab7a3563cd92a912a1597e0552a89b60aa5587ef3ca7a373725c
- MD5 e2ed08a1bf153d7959526cb9627f2165
- SHA1 9cc06fdfd484ce89707d7f3e0d1f34d278203555
- SHA512 c1b4f0473dda7472c11151fd11aff12a22e7774ea92fa16b950fc5cff13c6e95411d54c7a8cf60acac78476b04df8189bf4170d10023c5c60e9bf32667a2ba1d
- SSDEEP 3072:mEGh0oklPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG2l7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F76F8E73-1CF9-40e6-B65D-FA285FB198D5}.exe
- Size 380KB
- SHA256 506fc2101d3426f39c9eeeb04dfc2dcc04b8159fe9c24fe8c71ebbf9ba6489c5
- MD5 77f5a88260270d041f5b88b338a23d25
- SHA1 45a5fe271e473ad4678130e34963352d434dc5dd
- SHA512 0153456c19d43acfd61beca46d154ab8f23fd8bcb341eeb0479d0f2b200a688dbe01512c5ae7f5c2069d34b167a4d724787f4f2c20f4721aa5836610a069954f
- SSDEEP 3072:mEGh0oklPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGul7Oe2MUVg3v2IneKcAEcARy
- MD5 SHA1 SHA512 SSDEEP