Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 04:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe
- Size 180KB
- Sample240610-el34yscd99
- SHA256 ad9bdff18fb06a72d1c8346ce519dfb069560e800c90c32de2f6c315a27def52
- MD5 325be1dd0dd257e1e8dbdefd1bd9b498
- SHA1 03da474a2356710ef86e43cca5af37159d1d8d45
- SHA512 bc73c8aa4f56ab9937cf96f58b2ea7673381d4886fc63f3bf887555e04015c6780567ba556e863c755e21990528e5cc2785076f1730e4a194aaca28e42129b19
- SSDEEP 3072:jEGh0o0lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGCl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000700000002340c-3.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023411-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023417-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023411-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fbd-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000021fbe-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000021fbd-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000717-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB1EEF4-89FB-47be-AF48-F43C778087C6}\stubpath = "C:\\Windows\\{0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe" {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{992DCA7D-ED06-4ed6-9961-4D9053A2282B}\stubpath = "C:\\Windows\\{992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe" {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}\stubpath = "C:\\Windows\\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe" {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5B261C4-7227-4524-97A1-3B671A091B43}\stubpath = "C:\\Windows\\{C5B261C4-7227-4524-97A1-3B671A091B43}.exe" {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32872C29-FCC9-45ef-B2A5-5036C95224EA}\stubpath = "C:\\Windows\\{32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe" {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE}\stubpath = "C:\\Windows\\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE}.exe" {6AF533C5-7D45-468b-B4B9-E584599168CA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{987444F1-4B86-43e4-A6AB-58DCCA73D547}\stubpath = "C:\\Windows\\{987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe" {C5B261C4-7227-4524-97A1-3B671A091B43}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94}\stubpath = "C:\\Windows\\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe" {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6D90F96-8676-4765-8539-912E42DFAAF0} {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AF533C5-7D45-468b-B4B9-E584599168CA}\stubpath = "C:\\Windows\\{6AF533C5-7D45-468b-B4B9-E584599168CA}.exe" {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94} {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B1F3BAE-917C-435e-AAC7-84F965809C1C} {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{711727C9-0FF4-4561-9948-8AFAD4D060B4} 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{711727C9-0FF4-4561-9948-8AFAD4D060B4}\stubpath = "C:\\Windows\\{711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe" 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{992DCA7D-ED06-4ed6-9961-4D9053A2282B} {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92} {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5B261C4-7227-4524-97A1-3B671A091B43} {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32872C29-FCC9-45ef-B2A5-5036C95224EA} {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE} {6AF533C5-7D45-468b-B4B9-E584599168CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB1EEF4-89FB-47be-AF48-F43C778087C6} {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{987444F1-4B86-43e4-A6AB-58DCCA73D547} {C5B261C4-7227-4524-97A1-3B671A091B43}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B1F3BAE-917C-435e-AAC7-84F965809C1C}\stubpath = "C:\\Windows\\{8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe" {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6D90F96-8676-4765-8539-912E42DFAAF0}\stubpath = "C:\\Windows\\{A6D90F96-8676-4765-8539-912E42DFAAF0}.exe" {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AF533C5-7D45-468b-B4B9-E584599168CA} {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe - Executes dropped EXE 12 IoCs
pid Process 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 2760 {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe 4364 {6AF533C5-7D45-468b-B4B9-E584599168CA}.exe 1328 {5613817C-78BD-44ca-9B10-F21DDAE6DCDE}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe File created C:\Windows\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe File created C:\Windows\{A6D90F96-8676-4765-8539-912E42DFAAF0}.exe {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe File created C:\Windows\{711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe File created C:\Windows\{0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe File created C:\Windows\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe File created C:\Windows\{C5B261C4-7227-4524-97A1-3B671A091B43}.exe {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe File created C:\Windows\{987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe {C5B261C4-7227-4524-97A1-3B671A091B43}.exe File created C:\Windows\{32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe File created C:\Windows\{8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe File created C:\Windows\{6AF533C5-7D45-468b-B4B9-E584599168CA}.exe {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe File created C:\Windows\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE}.exe {6AF533C5-7D45-468b-B4B9-E584599168CA}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe Token: SeIncBasePriorityPrivilege 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe Token: SeIncBasePriorityPrivilege 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe Token: SeIncBasePriorityPrivilege 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe Token: SeIncBasePriorityPrivilege 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe Token: SeIncBasePriorityPrivilege 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe Token: SeIncBasePriorityPrivilege 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe Token: SeIncBasePriorityPrivilege 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe Token: SeIncBasePriorityPrivilege 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe Token: SeIncBasePriorityPrivilege 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe Token: SeIncBasePriorityPrivilege 2760 {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe Token: SeIncBasePriorityPrivilege 4364 {6AF533C5-7D45-468b-B4B9-E584599168CA}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 3776 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe 87 PID 388 wrote to memory of 3776 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe 87 PID 388 wrote to memory of 3776 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe 87 PID 388 wrote to memory of 436 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe 88 PID 388 wrote to memory of 436 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe 88 PID 388 wrote to memory of 436 388 2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe 88 PID 3776 wrote to memory of 2076 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 89 PID 3776 wrote to memory of 2076 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 89 PID 3776 wrote to memory of 2076 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 89 PID 3776 wrote to memory of 3032 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 90 PID 3776 wrote to memory of 3032 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 90 PID 3776 wrote to memory of 3032 3776 {711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe 90 PID 2076 wrote to memory of 2228 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 92 PID 2076 wrote to memory of 2228 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 92 PID 2076 wrote to memory of 2228 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 92 PID 2076 wrote to memory of 3060 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 93 PID 2076 wrote to memory of 3060 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 93 PID 2076 wrote to memory of 3060 2076 {0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe 93 PID 2228 wrote to memory of 3384 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 94 PID 2228 wrote to memory of 3384 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 94 PID 2228 wrote to memory of 3384 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 94 PID 2228 wrote to memory of 2288 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 95 PID 2228 wrote to memory of 2288 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 95 PID 2228 wrote to memory of 2288 2228 {992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe 95 PID 3384 wrote to memory of 912 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 96 PID 3384 wrote to memory of 912 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 96 PID 3384 wrote to memory of 912 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 96 PID 3384 wrote to memory of 4504 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 97 PID 3384 wrote to memory of 4504 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 97 PID 3384 wrote to memory of 4504 3384 {E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe 97 PID 912 wrote to memory of 3708 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 98 PID 912 wrote to memory of 3708 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 98 PID 912 wrote to memory of 3708 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 98 PID 912 wrote to memory of 4648 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 99 PID 912 wrote to memory of 4648 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 99 PID 912 wrote to memory of 4648 912 {C5B261C4-7227-4524-97A1-3B671A091B43}.exe 99 PID 3708 wrote to memory of 3596 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 100 PID 3708 wrote to memory of 3596 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 100 PID 3708 wrote to memory of 3596 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 100 PID 3708 wrote to memory of 1552 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 101 PID 3708 wrote to memory of 1552 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 101 PID 3708 wrote to memory of 1552 3708 {987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe 101 PID 3596 wrote to memory of 4956 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 102 PID 3596 wrote to memory of 4956 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 102 PID 3596 wrote to memory of 4956 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 102 PID 3596 wrote to memory of 5000 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 103 PID 3596 wrote to memory of 5000 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 103 PID 3596 wrote to memory of 5000 3596 {32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe 103 PID 4956 wrote to memory of 1592 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 104 PID 4956 wrote to memory of 1592 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 104 PID 4956 wrote to memory of 1592 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 104 PID 4956 wrote to memory of 4040 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 105 PID 4956 wrote to memory of 4040 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 105 PID 4956 wrote to memory of 4040 4956 {EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe 105 PID 1592 wrote to memory of 2760 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 106 PID 1592 wrote to memory of 2760 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 106 PID 1592 wrote to memory of 2760 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 106 PID 1592 wrote to memory of 552 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 107 PID 1592 wrote to memory of 552 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 107 PID 1592 wrote to memory of 552 1592 {8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe 107 PID 2760 wrote to memory of 4364 2760 {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe 108 PID 2760 wrote to memory of 4364 2760 {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe 108 PID 2760 wrote to memory of 4364 2760 {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe 108 PID 2760 wrote to memory of 760 2760 {A6D90F96-8676-4765-8539-912E42DFAAF0}.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_325be1dd0dd257e1e8dbdefd1bd9b498_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\{711727C9-0FF4-4561-9948-8AFAD4D060B4}.exeC:\Windows\{711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\{0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exeC:\Windows\{0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\{992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exeC:\Windows\{992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exeC:\Windows\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\{C5B261C4-7227-4524-97A1-3B671A091B43}.exeC:\Windows\{C5B261C4-7227-4524-97A1-3B671A091B43}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\{987444F1-4B86-43e4-A6AB-58DCCA73D547}.exeC:\Windows\{987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\{32872C29-FCC9-45ef-B2A5-5036C95224EA}.exeC:\Windows\{32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exeC:\Windows\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\{8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exeC:\Windows\{8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\{A6D90F96-8676-4765-8539-912E42DFAAF0}.exeC:\Windows\{A6D90F96-8676-4765-8539-912E42DFAAF0}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\{6AF533C5-7D45-468b-B4B9-E584599168CA}.exeC:\Windows\{6AF533C5-7D45-468b-B4B9-E584599168CA}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE}.exeC:\Windows\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE}.exe13⤵
- Executes dropped EXE
PID:1328
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6AF53~1.EXE > nul13⤵PID:2540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6D90~1.EXE > nul12⤵PID:760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B1F3~1.EXE > nul11⤵PID:552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF767~1.EXE > nul10⤵PID:4040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32872~1.EXE > nul9⤵PID:5000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98744~1.EXE > nul8⤵PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5B26~1.EXE > nul7⤵PID:4648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6B8C~1.EXE > nul6⤵PID:4504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{992DC~1.EXE > nul5⤵PID:2288
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FB1E~1.EXE > nul4⤵PID:3060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71172~1.EXE > nul3⤵PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0FB1EEF4-89FB-47be-AF48-F43C778087C6}.exe
- Size 180KB
- SHA256 dbc954796e6579a3858a7441c931a5208ff9d70c1a7c1c89f1f3f7dba9a1b4b1
- MD5 67c0b0e7bb03937cda99186ad48f7baf
- SHA1 ef6225da379189c51b0f10413c2a9b5d3f0b3a5e
- SHA512 756cd5fb6a2bee06374ce863004592125ec3fd2ecc01a33d6dbf45f8d0748ab3dcc9364050df86d1296ae32900b0bd2a17b1091fd06a757b598cace76f8550ce
- SSDEEP 3072:jEGh0oRlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG/l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{32872C29-FCC9-45ef-B2A5-5036C95224EA}.exe
- Size 180KB
- SHA256 494151dbb839fc5d7952f47ad1d8335e96b4c3ec6cfd09990c6d0e62f5ce15d4
- MD5 53fed1a819f08386fda14a21c122a68c
- SHA1 13963101bdb9ffdc84ad626910a9f27c2ba23611
- SHA512 948a107ce963efe3657b83e3a336fa1a9909cf73393bd1570a53a92706eb486f01972e154504f80e6fd4ade980fc4a2d3fa69a3e8eb4615fdb9daf04055f3c1e
- SSDEEP 3072:jEGh0oElfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGOl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5613817C-78BD-44ca-9B10-F21DDAE6DCDE}.exe
- Size 180KB
- SHA256 def5a4da2db8e0973d57198e8116d63e2f9be9f3dc37ff34f97d04877694e2d2
- MD5 b53a9632edd53e3ab1452bc5bd803389
- SHA1 3bbe1f8ca01ce19d51b3c619020d1dc1ca138c85
- SHA512 f7489ea022b6e23daf77aea29b87cbecc85888e7b00f1e16a983af6a6c77ea7cb50276773aad85cdf411008a11c4ff9b89b2291e9341018644e5426a27529e10
- SSDEEP 3072:jEGh0oGlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGsl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6AF533C5-7D45-468b-B4B9-E584599168CA}.exe
- Size 180KB
- SHA256 9fd4baa26a91ad9a7f4aa52b8485527688516e336ab34bafbb272aa74872f24c
- MD5 7e8c1e11599e66b2d3f06ad5dd20677d
- SHA1 aa4fc36de4dbae00fb8ec018a8418892a2263845
- SHA512 bd3edfc6e4497c3d22be0c5a08be3d8083fa25a1eb430a3785a818c7cedcbfa20ac6413b3dc6f0b9c529787ea7f8a14508ae2d8ece6c47db8ab1880d13eb9339
- SSDEEP 3072:jEGh0ozlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGhl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{711727C9-0FF4-4561-9948-8AFAD4D060B4}.exe
- Size 180KB
- SHA256 b8c72a6b9243a4cabf5c3ab5380ad010008f188ff61b7b3122dd3df6342c49fe
- MD5 e4156a559c8e35d37190a4f043ce2b44
- SHA1 c351bed23b1e99d6a3eab2349df45f24672e878f
- SHA512 6119634a0e05c0c666ef1f43a90116a261e3618ecfe99a2ebe58ac0a4dd5f9da296e3c0d79a6094188bc223796e09b39252e115beb17a4c4e8ad8f8bb64f6bb7
- SSDEEP 3072:jEGh0oplfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGbl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8B1F3BAE-917C-435e-AAC7-84F965809C1C}.exe
- Size 180KB
- SHA256 f8f7002d4d32fbdae47edd82a668c3d8e1c5c9142a2b9bad023aefb5fb18437b
- MD5 92697130345e64393e49ae09803889d5
- SHA1 d5eeadd8534a4a8b16604aa85c5fa54c15a5c860
- SHA512 a71f17fc5e94d15f8458c18dd772d45bfedb235e57f4ab0d93916229f383946fcb70638c1b7722726b4ea13d3409e7c28ba2fb717454c59f883ef19c0360f460
- SSDEEP 3072:jEGh0oxlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGbl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{987444F1-4B86-43e4-A6AB-58DCCA73D547}.exe
- Size 180KB
- SHA256 d8958ed9b453ac24d9a35be42d1e7999d009b2ea477fde3d32e5bff969c9002a
- MD5 54f0fcb66cdef2822698aa25d693864c
- SHA1 fce09da0778e099acc5d5c9a4dda92f94ce42fbc
- SHA512 6058b0e69694363fbda58004a082409008c132bed258a25e674e4075bbb0d8f9aa13ae35f8eebc353b9a73c98865f7e2195076579ae2a7ffc02f664be06cc139
- SSDEEP 3072:jEGh0o3lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{992DCA7D-ED06-4ed6-9961-4D9053A2282B}.exe
- Size 180KB
- SHA256 fb6b3d53a401e581401ab3b4da0771312dca5ed077ab26636cf3812d12db1fc5
- MD5 a70fde9d84779d215ead0ed660034f2a
- SHA1 dee4e73d47cc97c2ae91f086424b43bf0ee2ddcf
- SHA512 b30100c62819a11820c4c063841f643459b545269ba77ab2e0641944e463541d542b0c681753d94b51e1f547d6c5060de016bf5fb5094d8c0ab9b8533a410cb3
- SSDEEP 3072:jEGh0oglfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A6D90F96-8676-4765-8539-912E42DFAAF0}.exe
- Size 180KB
- SHA256 1483c220a25a7711d72abf9677b4363ccb7ae214394067230cebad009c9dc2a9
- MD5 4c5477f405b192659d2516c25792dd43
- SHA1 444f56fb1879ff5c704b95ba8eaf91c973c3332d
- SHA512 7e41c8de2146d4475b61a5738a9ebe12b6cadf480cd55400890053ec9b8eeeb40776c943a8096b7b2a96465b9464ae6230869efaee29763b7d47233483a096a1
- SSDEEP 3072:jEGh0oMlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGel5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C5B261C4-7227-4524-97A1-3B671A091B43}.exe
- Size 180KB
- SHA256 4238a445f9c9c348e98b28c0786d0746fd50343b5951b575a9da0d73e7bc1a03
- MD5 5b77cf3ce426e7a15f4472c022be707a
- SHA1 b7cd0409900419dafd97f27d3c11dd46400f9eb0
- SHA512 8235117a4ff8cfcb7f2bec0afd3133a80b5fb96e34b0913f32180b5daf00e9a4ae590c2cb7e235f93d99e7eb9850abaebf02b2b446d67acc9fb69257155a808c
- SSDEEP 3072:jEGh0oUlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGml5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E6B8CB97-83FD-403c-B7B0-07EB32EF8F92}.exe
- Size 180KB
- SHA256 9c001637c7d99cf2c414b494956a5257fb9620650a73d7e548231814abb83145
- MD5 846f2d1ed8f3d68eaa9e242681754f69
- SHA1 e44ba89b4e50142f5397e9ee7fde57f0202b56c0
- SHA512 82ab9f3334272fcf65abeb90d3e19d8fb2b203817a3c731362e7f07fab6da60eb7a678a5ae50ec8f6ec0893fe60c0852d381f972708f0f7472216f373bf87bd3
- SSDEEP 3072:jEGh0o5lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGLl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF767934-4C8A-40d4-80A0-7A9C6FF67D94}.exe
- Size 180KB
- SHA256 b7519021d02cf879a15c142b89ad3442b2f4b6db21dd0c3d5fb747a8851a962b
- MD5 35ff88ed7555302fb1faa17ea0f4c018
- SHA1 63e4b19d211bf0d453bd304bd058304a090e8816
- SHA512 ccd5000450fcd12950c954d8744b91876f190234125ce53586e8d437ea2fcc740b197401a22abc015791b57787f3bf1c74593277733088d81869c0624c6bf780
- SSDEEP 3072:jEGh0owlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGil5eKcAEc
- MD5 SHA1 SHA512 SSDEEP