Analysis
- max time kernel
149s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 04:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe
- Size 204KB
- Sample240610-fbqljscb8y
- SHA256 57f3cc2068f3bb00119519b7a9951581f37b3de4e3d252239bcd6d64827fb404
- MD5 97887f9ef77d7dea990cd57dc06a2839
- SHA1 d24b1f54cd7f2bd278695d924591c92983b51819
- SHA512 315e184d725787f1873a742feb25a294da72e2413e5633bbc8f7a19806522920a5f617e737030cc9ee7aa020f1aeea30a08cf3a8211c7a163b57dc6207ba2ece
- SSDEEP 1536:1EGh0oMl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oMl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000700000002342b-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023426-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023431-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023426-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023431-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023426-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023431-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000731-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000733-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000731-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000733-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000731-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08F195E1-A69B-4f70-A1A9-192C99326250} {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08F195E1-A69B-4f70-A1A9-192C99326250}\stubpath = "C:\\Windows\\{08F195E1-A69B-4f70-A1A9-192C99326250}.exe" {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E07965A5-CEDD-46de-A72D-07FDD2F345A7}\stubpath = "C:\\Windows\\{E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe" {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E}\stubpath = "C:\\Windows\\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe" {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83D648CD-0962-4316-BD83-9BFC08D1CEB6}\stubpath = "C:\\Windows\\{83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe" {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{177219FB-9300-44e9-BA66-A827706C4A5B}\stubpath = "C:\\Windows\\{177219FB-9300-44e9-BA66-A827706C4A5B}.exe" {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D} {177219FB-9300-44e9-BA66-A827706C4A5B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8} {17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE57BC6B-A663-4f4a-808A-9192631ABCB1}\stubpath = "C:\\Windows\\{DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe" 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FF90593-7716-48af-BA0F-417CF5FE8B34}\stubpath = "C:\\Windows\\{7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe" {08F195E1-A69B-4f70-A1A9-192C99326250}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CF045AD-0231-4e91-883D-6588DB5D7063}\stubpath = "C:\\Windows\\{5CF045AD-0231-4e91-883D-6588DB5D7063}.exe" {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}\stubpath = "C:\\Windows\\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe" {177219FB-9300-44e9-BA66-A827706C4A5B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE57BC6B-A663-4f4a-808A-9192631ABCB1} 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FF90593-7716-48af-BA0F-417CF5FE8B34} {08F195E1-A69B-4f70-A1A9-192C99326250}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0} {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72F93458-962C-4afa-AAB1-EE8C329A628F} {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72F93458-962C-4afa-AAB1-EE8C329A628F}\stubpath = "C:\\Windows\\{72F93458-962C-4afa-AAB1-EE8C329A628F}.exe" {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{177219FB-9300-44e9-BA66-A827706C4A5B} {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E07965A5-CEDD-46de-A72D-07FDD2F345A7} {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CF045AD-0231-4e91-883D-6588DB5D7063} {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}\stubpath = "C:\\Windows\\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe" {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E} {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83D648CD-0962-4316-BD83-9BFC08D1CEB6} {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}\stubpath = "C:\\Windows\\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}.exe" {17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe - Executes dropped EXE 12 IoCs
pid Process 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 3620 {177219FB-9300-44e9-BA66-A827706C4A5B}.exe 1044 {17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe 2152 {8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{5CF045AD-0231-4e91-883D-6588DB5D7063}.exe {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe File created C:\Windows\{72F93458-962C-4afa-AAB1-EE8C329A628F}.exe {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe File created C:\Windows\{83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe File created C:\Windows\{177219FB-9300-44e9-BA66-A827706C4A5B}.exe {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe File created C:\Windows\{DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe File created C:\Windows\{E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe File created C:\Windows\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe File created C:\Windows\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe File created C:\Windows\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe {177219FB-9300-44e9-BA66-A827706C4A5B}.exe File created C:\Windows\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}.exe {17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe File created C:\Windows\{08F195E1-A69B-4f70-A1A9-192C99326250}.exe {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe File created C:\Windows\{7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe {08F195E1-A69B-4f70-A1A9-192C99326250}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe Token: SeIncBasePriorityPrivilege 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe Token: SeIncBasePriorityPrivilege 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe Token: SeIncBasePriorityPrivilege 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe Token: SeIncBasePriorityPrivilege 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe Token: SeIncBasePriorityPrivilege 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe Token: SeIncBasePriorityPrivilege 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe Token: SeIncBasePriorityPrivilege 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe Token: SeIncBasePriorityPrivilege 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe Token: SeIncBasePriorityPrivilege 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe Token: SeIncBasePriorityPrivilege 3620 {177219FB-9300-44e9-BA66-A827706C4A5B}.exe Token: SeIncBasePriorityPrivilege 1044 {17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 3324 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe 93 PID 3124 wrote to memory of 3324 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe 93 PID 3124 wrote to memory of 3324 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe 93 PID 3124 wrote to memory of 2196 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe 94 PID 3124 wrote to memory of 2196 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe 94 PID 3124 wrote to memory of 2196 3124 2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe 94 PID 3324 wrote to memory of 2800 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 95 PID 3324 wrote to memory of 2800 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 95 PID 3324 wrote to memory of 2800 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 95 PID 3324 wrote to memory of 4492 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 96 PID 3324 wrote to memory of 4492 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 96 PID 3324 wrote to memory of 4492 3324 {DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe 96 PID 2800 wrote to memory of 3048 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 98 PID 2800 wrote to memory of 3048 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 98 PID 2800 wrote to memory of 3048 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 98 PID 2800 wrote to memory of 4832 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 99 PID 2800 wrote to memory of 4832 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 99 PID 2800 wrote to memory of 4832 2800 {08F195E1-A69B-4f70-A1A9-192C99326250}.exe 99 PID 3048 wrote to memory of 4340 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 100 PID 3048 wrote to memory of 4340 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 100 PID 3048 wrote to memory of 4340 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 100 PID 3048 wrote to memory of 4020 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 101 PID 3048 wrote to memory of 4020 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 101 PID 3048 wrote to memory of 4020 3048 {7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe 101 PID 4340 wrote to memory of 884 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 102 PID 4340 wrote to memory of 884 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 102 PID 4340 wrote to memory of 884 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 102 PID 4340 wrote to memory of 4796 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 103 PID 4340 wrote to memory of 4796 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 103 PID 4340 wrote to memory of 4796 4340 {E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe 103 PID 884 wrote to memory of 3184 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 104 PID 884 wrote to memory of 3184 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 104 PID 884 wrote to memory of 3184 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 104 PID 884 wrote to memory of 1684 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 105 PID 884 wrote to memory of 1684 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 105 PID 884 wrote to memory of 1684 884 {5CF045AD-0231-4e91-883D-6588DB5D7063}.exe 105 PID 3184 wrote to memory of 808 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 106 PID 3184 wrote to memory of 808 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 106 PID 3184 wrote to memory of 808 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 106 PID 3184 wrote to memory of 2120 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 107 PID 3184 wrote to memory of 2120 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 107 PID 3184 wrote to memory of 2120 3184 {1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe 107 PID 808 wrote to memory of 1640 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 108 PID 808 wrote to memory of 1640 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 108 PID 808 wrote to memory of 1640 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 108 PID 808 wrote to memory of 1776 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 109 PID 808 wrote to memory of 1776 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 109 PID 808 wrote to memory of 1776 808 {72F93458-962C-4afa-AAB1-EE8C329A628F}.exe 109 PID 1640 wrote to memory of 4916 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 110 PID 1640 wrote to memory of 4916 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 110 PID 1640 wrote to memory of 4916 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 110 PID 1640 wrote to memory of 548 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 111 PID 1640 wrote to memory of 548 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 111 PID 1640 wrote to memory of 548 1640 {90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe 111 PID 4916 wrote to memory of 3620 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 112 PID 4916 wrote to memory of 3620 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 112 PID 4916 wrote to memory of 3620 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 112 PID 4916 wrote to memory of 5104 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 113 PID 4916 wrote to memory of 5104 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 113 PID 4916 wrote to memory of 5104 4916 {83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe 113 PID 3620 wrote to memory of 1044 3620 {177219FB-9300-44e9-BA66-A827706C4A5B}.exe 114 PID 3620 wrote to memory of 1044 3620 {177219FB-9300-44e9-BA66-A827706C4A5B}.exe 114 PID 3620 wrote to memory of 1044 3620 {177219FB-9300-44e9-BA66-A827706C4A5B}.exe 114 PID 3620 wrote to memory of 4276 3620 {177219FB-9300-44e9-BA66-A827706C4A5B}.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_97887f9ef77d7dea990cd57dc06a2839_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\{DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exeC:\Windows\{DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\{08F195E1-A69B-4f70-A1A9-192C99326250}.exeC:\Windows\{08F195E1-A69B-4f70-A1A9-192C99326250}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\{7FF90593-7716-48af-BA0F-417CF5FE8B34}.exeC:\Windows\{7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\{E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exeC:\Windows\{E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\{5CF045AD-0231-4e91-883D-6588DB5D7063}.exeC:\Windows\{5CF045AD-0231-4e91-883D-6588DB5D7063}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exeC:\Windows\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\{72F93458-962C-4afa-AAB1-EE8C329A628F}.exeC:\Windows\{72F93458-962C-4afa-AAB1-EE8C329A628F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exeC:\Windows\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\{83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exeC:\Windows\{83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\{177219FB-9300-44e9-BA66-A827706C4A5B}.exeC:\Windows\{177219FB-9300-44e9-BA66-A827706C4A5B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exeC:\Windows\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1044 -
C:\Windows\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}.exeC:\Windows\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}.exe13⤵
- Executes dropped EXE
PID:2152
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17E3C~1.EXE > nul13⤵PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17721~1.EXE > nul12⤵PID:4276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83D64~1.EXE > nul11⤵PID:5104
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90E41~1.EXE > nul10⤵PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72F93~1.EXE > nul9⤵PID:1776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E8FA~1.EXE > nul8⤵PID:2120
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CF04~1.EXE > nul7⤵PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0796~1.EXE > nul6⤵PID:4796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FF90~1.EXE > nul5⤵PID:4020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08F19~1.EXE > nul4⤵PID:4832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE57B~1.EXE > nul3⤵PID:4492
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{08F195E1-A69B-4f70-A1A9-192C99326250}.exe
- Size 204KB
- SHA256 9c1b3526e40bd71650fd4bf6fd915de168ac32e0659016e818c3445b1d2f6db9
- MD5 6d40e4aff1c036c3fdd7047239f5c4fb
- SHA1 ead10f9bac1120efad2380126c9ea855aa7660d7
- SHA512 f9b02dc1b8eb407f9566cbd979d57a8d61a637469cc9f8d03aa13f9a74934d8e7445f69ac14108c2160337ffaa85f5a4cf2b76d24db8fa9fa3a599a3e1f08ac1
- SSDEEP 1536:1EGh0oHl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oHl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{177219FB-9300-44e9-BA66-A827706C4A5B}.exe
- Size 204KB
- SHA256 9168fb76e1b0ad9d6dba08e2f97ba73f569f374a07b50feb0a537fb6d772bba8
- MD5 109ead166a57b06dfaa355cd39423915
- SHA1 17995801938869978b7461a6572614f7c404cc97
- SHA512 22e49d15ba0749b2ec6d60398973fccb8e442446b46714d26f2f61c7d1ba661bab42d83ea1721024f0f417a27773cbfebf731b2cdc53f4f197eae62516197452
- SSDEEP 1536:1EGh0oCZl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oCZl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{17E3C082-F06A-4ce2-BCF5-EC11BD413A2D}.exe
- Size 204KB
- SHA256 514b862b01055d3a9cb3175df8b2c45c8aaf8e22775028d17f79694c0b185e2e
- MD5 ed72140710cefe3dd23a423a51e2cb29
- SHA1 c2366b121e8c372cf5702091773b8c3ed6e914e3
- SHA512 2fa295aa960520cc243a3f3aaae3b3039a181aee4d0f1dafb6980b49a19771025a26c0ddd93f42ffde597063442b03d2042d230f261f8e8a6221447795fb91d7
- SSDEEP 1536:1EGh0onZl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0onZl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1E8FA8D8-9F69-492b-B1FF-558AEBDD44A0}.exe
- Size 204KB
- SHA256 ad7f246c2d329d97bc4336df3e9fcc76531bcd9dfe75f4e96ca78df0febe79c1
- MD5 d751da6e7d553f91da1bf928461b0f9f
- SHA1 c0c7a334b52c79d33ced7e752953c30c07915d4b
- SHA512 e58c51bbfc1bb91d1c3277e5bd7d13dec960b8e96f17a67ff749b2c506fd7945c51f76f4809dfadf3b67b4da00802f4d893305e2440a99adcf3c6469c787d7ce
- SSDEEP 1536:1EGh0oGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oGl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5CF045AD-0231-4e91-883D-6588DB5D7063}.exe
- Size 204KB
- SHA256 9241e115df75c9a5180ca651bad13be250f0bd3c6d0683213af192206230e7cd
- MD5 db1e49169c21102d557ae5041e1db88b
- SHA1 6175b621e7ef5986a040124a7b53941ef15ef8a2
- SHA512 9420d698392f3287ca87bf653c0ec2d6ad48edb5e9f9d6138cf45a9f4e0dcd183cc266f4ce7c80d72900c20d4ee5617c4595c8667c5037e0693daf6bc4aa4dc2
- SSDEEP 1536:1EGh0oql15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oql1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{72F93458-962C-4afa-AAB1-EE8C329A628F}.exe
- Size 204KB
- SHA256 52221427af53555dc914c2c2e9673a04d6890cbcbe9453120ada801fec1f9a36
- MD5 a6f3e3c6b581160cd94899b8af88eb8c
- SHA1 375b998ca80683704c630f21e6acd42063618704
- SHA512 a0cdbfcced6ee29db6a8a73c9729e75816082ff7771f01713eea5dcef9c7e239913edd40b56fa54b04976ab1cc7dda03b8a0e7f7190c65fcfebea71c099a5008
- SSDEEP 1536:1EGh0oHl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oHl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7FF90593-7716-48af-BA0F-417CF5FE8B34}.exe
- Size 204KB
- SHA256 96a78e534282647d1da639535f02356364c2fcc6ce6ba03379d5c7a005832f56
- MD5 37dff5e3935e13448886213fa021cfa4
- SHA1 4e90a0067b61afdbc0c4d35ee7afe0c71487e10b
- SHA512 81cb5febd0f3595ccc290206fd96faf2bdd9abe4b999491a19d6bd68152c579255b469c0d9ffe4ea3269a19d062ce1c6a841100ba92ac9034aaf669c1b6ac1d0
- SSDEEP 1536:1EGh0ocl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0ocl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{83D648CD-0962-4316-BD83-9BFC08D1CEB6}.exe
- Size 204KB
- SHA256 61a1642c726ae1bc100a771f3ea6034dee0ca3a959bc838cc6d9b612b190db96
- MD5 586a98c9145c8df5553df6e5c35a67a6
- SHA1 545c737e4204d6fc4e65be7328b3e78db18d3532
- SHA512 10bf6e21a73df8d385c697549e6bc4d55fb722096103b4674a7ec45065760adc853da38b5463854a1aec642d8a3a0cc033a73ffb155238baa9f8a934b9fd0b9a
- SSDEEP 1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o5l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8BDAE8F7-6BED-49e2-A007-2DD7D707D0E8}.exe
- Size 204KB
- SHA256 3a4bd3572604effcc321ca4b77043a23c082d883e76b64ac0e2b44603279df6c
- MD5 719deb71c919ed9db2499486f8e57af0
- SHA1 b97a6a3fa0a0d1fff9e5aa0889f88ad8d58bd526
- SHA512 7cb666f0667cddab73ccc33e7e46753a075c1746ab4fa76b50b7bce2fa06dfe70c3359f947f0811ce87f0c512c4090bdbd0afa8a41da3b715af71146c5eeed68
- SSDEEP 1536:1EGh0owl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0owl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{90E416AB-3D22-43ca-A9CD-2C60C135CC7E}.exe
- Size 204KB
- SHA256 2bdd05c55ded36e9de65657aee53c4b71544e3be83180545f59a7b0d6a4cf050
- MD5 1dff635cb0d82cf187c1de9727343171
- SHA1 472fae721c700133b3ae1fa90d79f608fad7010f
- SHA512 128614db2f4ef7a79a5cb51350350d3dcb823662f68948e9e9f3ff9bb535505edd977dcb675a48b92a2d6632f51effa851eae15845277938d300b9ed8c5a9ca0
- SSDEEP 1536:1EGh0o+l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o+l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DE57BC6B-A663-4f4a-808A-9192631ABCB1}.exe
- Size 204KB
- SHA256 5cf48f9020abdefde68b0064f650cc673b4dcfd0dabc9d02d181e96b5ee65be2
- MD5 1bbecc4a082ed6b3f27b71f74a8bc0cb
- SHA1 9b0b8ad6575ad0c8b556a4f2b47fb55cf47b4079
- SHA512 8b077f29d0596c0bdbd765ac1808cc9ac222599bc975216437de90abf6f04b88a65cc59942e5ad1fbdbdd491c846408244e50f7787554d2291f3b9f779ac90bb
- SSDEEP 1536:1EGh0o4l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o4l1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E07965A5-CEDD-46de-A72D-07FDD2F345A7}.exe
- Size 204KB
- SHA256 d18746a124e4e3c0254b5cf3a48ccbb983828f094864b8a446679a2c050f2381
- MD5 362f367bbbd21a6198b6a5c630c5f224
- SHA1 4ec530063d98498b518bd78e73643f466db2baac
- SHA512 fc5cfb7f411b96ec8fdbe16dfb6fc1e0ecb3389f1864d4b42feb0b3561998368f543119a5d6647f8e21d0446535f16cd81a2d01c249e1e4b8f6becc2bebb1605
- SSDEEP 1536:1EGh0oSl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oSl1OPOe2MUVg3Ve+rXfMUy
- MD5 SHA1 SHA512 SSDEEP