Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe
- Size 408KB
- Sample240611-p172kaxdkf
- SHA256 6f33cfd04a0756ca7d29273ad69b2fe7c7f07a16c62f4409abfec18a6669b48c
- MD5 aa2b017c12803aa35333eaeab9789910
- SHA1 c530e51a483df99ceadc315319622996adc83b53
- SHA512 c7b0793014a23f7a601ee37afc3db07b284618c26de53fe1d52d2467fa74e414bc92d35a057c77411149cb189b885854f795c461c48f1a5c41294c9ad2385fd7
- SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGeldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0009000000023427-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f00000002341c-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002342d-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x001000000002341c-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000006eb-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000200000002219f-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000006eb-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000006eb-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-37.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000006eb-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000709-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2} {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}\stubpath = "C:\\Windows\\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe" {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2233B23-FE97-406d-AFE2-2F79D4FEC831} {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1425C9D-3590-475c-957D-59AD07662020} {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1425C9D-3590-475c-957D-59AD07662020}\stubpath = "C:\\Windows\\{E1425C9D-3590-475c-957D-59AD07662020}.exe" {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44}\stubpath = "C:\\Windows\\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe" {E1425C9D-3590-475c-957D-59AD07662020}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}\stubpath = "C:\\Windows\\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe" {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63A81BE7-6127-4ea3-9154-8C8B6814DF68}\stubpath = "C:\\Windows\\{63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe" 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0557349A-0BEB-4f90-83E1-DE4711FA10D5} {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D} {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33A069F5-D89B-4c02-A7FC-A19C45C50818} {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DD19866-4537-4854-BB71-4AE7BF0E09EA}\stubpath = "C:\\Windows\\{3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe" {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44} {E1425C9D-3590-475c-957D-59AD07662020}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64} {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}\stubpath = "C:\\Windows\\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe" {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B} {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33A069F5-D89B-4c02-A7FC-A19C45C50818}\stubpath = "C:\\Windows\\{33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe" {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C384A75-CFA9-4cfe-893A-F2FF13C31905} {235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C384A75-CFA9-4cfe-893A-F2FF13C31905}\stubpath = "C:\\Windows\\{4C384A75-CFA9-4cfe-893A-F2FF13C31905}.exe" {235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63A81BE7-6127-4ea3-9154-8C8B6814DF68} 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}\stubpath = "C:\\Windows\\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe" {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2233B23-FE97-406d-AFE2-2F79D4FEC831}\stubpath = "C:\\Windows\\{F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe" {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DD19866-4537-4854-BB71-4AE7BF0E09EA} {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0557349A-0BEB-4f90-83E1-DE4711FA10D5}\stubpath = "C:\\Windows\\{0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe" {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe - Executes dropped EXE 12 IoCs
pid Process 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 596 {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe 944 {235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe 4492 {4C384A75-CFA9-4cfe-893A-F2FF13C31905}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe File created C:\Windows\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe {E1425C9D-3590-475c-957D-59AD07662020}.exe File created C:\Windows\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe File created C:\Windows\{4C384A75-CFA9-4cfe-893A-F2FF13C31905}.exe {235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe File created C:\Windows\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe File created C:\Windows\{0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe File created C:\Windows\{F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe File created C:\Windows\{33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe File created C:\Windows\{63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe File created C:\Windows\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe File created C:\Windows\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe File created C:\Windows\{E1425C9D-3590-475c-957D-59AD07662020}.exe {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe Token: SeIncBasePriorityPrivilege 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe Token: SeIncBasePriorityPrivilege 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe Token: SeIncBasePriorityPrivilege 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe Token: SeIncBasePriorityPrivilege 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe Token: SeIncBasePriorityPrivilege 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe Token: SeIncBasePriorityPrivilege 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe Token: SeIncBasePriorityPrivilege 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe Token: SeIncBasePriorityPrivilege 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe Token: SeIncBasePriorityPrivilege 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe Token: SeIncBasePriorityPrivilege 596 {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe Token: SeIncBasePriorityPrivilege 944 {235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3380 wrote to memory of 1332 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe 87 PID 3380 wrote to memory of 1332 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe 87 PID 3380 wrote to memory of 1332 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe 87 PID 3380 wrote to memory of 4032 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe 88 PID 3380 wrote to memory of 4032 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe 88 PID 3380 wrote to memory of 4032 3380 2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe 88 PID 1332 wrote to memory of 3188 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 89 PID 1332 wrote to memory of 3188 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 89 PID 1332 wrote to memory of 3188 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 89 PID 1332 wrote to memory of 3688 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 90 PID 1332 wrote to memory of 3688 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 90 PID 1332 wrote to memory of 3688 1332 {63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe 90 PID 3188 wrote to memory of 3024 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 92 PID 3188 wrote to memory of 3024 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 92 PID 3188 wrote to memory of 3024 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 92 PID 3188 wrote to memory of 4692 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 93 PID 3188 wrote to memory of 4692 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 93 PID 3188 wrote to memory of 4692 3188 {42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe 93 PID 3024 wrote to memory of 1556 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 94 PID 3024 wrote to memory of 1556 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 94 PID 3024 wrote to memory of 1556 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 94 PID 3024 wrote to memory of 3236 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 95 PID 3024 wrote to memory of 3236 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 95 PID 3024 wrote to memory of 3236 3024 {6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe 95 PID 1556 wrote to memory of 1960 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 96 PID 1556 wrote to memory of 1960 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 96 PID 1556 wrote to memory of 1960 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 96 PID 1556 wrote to memory of 3624 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 97 PID 1556 wrote to memory of 3624 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 97 PID 1556 wrote to memory of 3624 1556 {0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe 97 PID 1960 wrote to memory of 856 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 98 PID 1960 wrote to memory of 856 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 98 PID 1960 wrote to memory of 856 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 98 PID 1960 wrote to memory of 544 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 99 PID 1960 wrote to memory of 544 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 99 PID 1960 wrote to memory of 544 1960 {C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe 99 PID 856 wrote to memory of 4436 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 100 PID 856 wrote to memory of 4436 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 100 PID 856 wrote to memory of 4436 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 100 PID 856 wrote to memory of 2320 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 101 PID 856 wrote to memory of 2320 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 101 PID 856 wrote to memory of 2320 856 {F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe 101 PID 4436 wrote to memory of 2144 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 102 PID 4436 wrote to memory of 2144 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 102 PID 4436 wrote to memory of 2144 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 102 PID 4436 wrote to memory of 4940 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 103 PID 4436 wrote to memory of 4940 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 103 PID 4436 wrote to memory of 4940 4436 {33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe 103 PID 2144 wrote to memory of 1932 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 104 PID 2144 wrote to memory of 1932 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 104 PID 2144 wrote to memory of 1932 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 104 PID 2144 wrote to memory of 3128 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 105 PID 2144 wrote to memory of 3128 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 105 PID 2144 wrote to memory of 3128 2144 {3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe 105 PID 1932 wrote to memory of 596 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 106 PID 1932 wrote to memory of 596 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 106 PID 1932 wrote to memory of 596 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 106 PID 1932 wrote to memory of 3756 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 107 PID 1932 wrote to memory of 3756 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 107 PID 1932 wrote to memory of 3756 1932 {E1425C9D-3590-475c-957D-59AD07662020}.exe 107 PID 596 wrote to memory of 944 596 {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe 108 PID 596 wrote to memory of 944 596 {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe 108 PID 596 wrote to memory of 944 596 {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe 108 PID 596 wrote to memory of 2184 596 {9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_aa2b017c12803aa35333eaeab9789910_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\{63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exeC:\Windows\{63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exeC:\Windows\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exeC:\Windows\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\{0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exeC:\Windows\{0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exeC:\Windows\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\{F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exeC:\Windows\{F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\{33A069F5-D89B-4c02-A7FC-A19C45C50818}.exeC:\Windows\{33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\{3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exeC:\Windows\{3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\{E1425C9D-3590-475c-957D-59AD07662020}.exeC:\Windows\{E1425C9D-3590-475c-957D-59AD07662020}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exeC:\Windows\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exeC:\Windows\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\{4C384A75-CFA9-4cfe-893A-F2FF13C31905}.exeC:\Windows\{4C384A75-CFA9-4cfe-893A-F2FF13C31905}.exe13⤵
- Executes dropped EXE
PID:4492
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{235C4~1.EXE > nul13⤵PID:3416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92911~1.EXE > nul12⤵PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1425~1.EXE > nul11⤵PID:3756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DD19~1.EXE > nul10⤵PID:3128
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33A06~1.EXE > nul9⤵PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2233~1.EXE > nul8⤵PID:2320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2507~1.EXE > nul7⤵PID:544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05573~1.EXE > nul6⤵PID:3624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FBC8~1.EXE > nul5⤵PID:3236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42E39~1.EXE > nul4⤵PID:4692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63A81~1.EXE > nul3⤵PID:3688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0557349A-0BEB-4f90-83E1-DE4711FA10D5}.exe
- Size 408KB
- SHA256 975d4e42f22bf7c734e01a222e005f795f7e5b57c96b2556c3fd318de7b7060f
- MD5 efd95e4b0cf2c6ff2d4028132bea9e73
- SHA1 adae1152b41c6f7ae6574af374dfef20e22d0d44
- SHA512 104bb51cb16e83bddc40d44996ee804780efe73d4492f9e5ec8e0de693de633f641a0c3ca9ce3f5fa648e959210a8506c179cd0438782ee3d295d9d8145bfa7b
- SSDEEP 3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGcldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{235C4D0C-7400-4ab4-9C60-87B1B7CB5F64}.exe
- Size 408KB
- SHA256 5143767d248ea0062cfbfedbc47b737e0534a131116108b7ce584422c366cf18
- MD5 342fe557568e8e0e627acf3033ca075f
- SHA1 f874a99a2a7bf01bd70995c971b1e2bf1c8fa22d
- SHA512 56691b1f1d3157c190d45a0ab7e6797d35c41b45a0a03e62627951bc0ce1663a26e27a2f4e4495e753efbb7e93e22ad687f93ba32ff751c33997ef8f788d1e25
- SSDEEP 3072:CEGh0oXl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGtldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{33A069F5-D89B-4c02-A7FC-A19C45C50818}.exe
- Size 408KB
- SHA256 9351676d2a678b0658488d4f465f7b77b614bd0d80748d7ee5e8639e313c5f3d
- MD5 2ce3a221b6b75b70911ca719464e137d
- SHA1 4413fd2e96e525776bbffb7913ba2c7e2ce7adf3
- SHA512 801aa91e5f43bc016809ea8ef6761d9b03f78a2703302293d1f817e17c52e78a543eef4a40b4211d8c7e70a63d8046961143082a67c729b9bbb4154ce0e3888b
- SSDEEP 3072:CEGh0oyl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGAldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3DD19866-4537-4854-BB71-4AE7BF0E09EA}.exe
- Size 408KB
- SHA256 a1dc6c8b2a50f932076f76326c24096077db215211a68c338af0235518ed6a7e
- MD5 95a77ed800dfce41b0e27c1a7fa0794b
- SHA1 919ce142cb8fe2a5dd4f113a74f40fe4d589993c
- SHA512 5b18dcd333e32cc694c54c68f9643f5dd9d2dbc347a60aa71c9822869f0da8680f93f9ff312ecd024d33b0150fe118c7b0e2e817596c0e0f4248d701b2a10350
- SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGmldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{42E397AF-BB4B-4b42-BFC1-FA5BC913B2D2}.exe
- Size 408KB
- SHA256 f92884ef4f6937be4aac0053cc33f5fa167309b3d3bfdce47e2fc9af87138a60
- MD5 c39ee4fc4a2832fd62c65152a256ddc9
- SHA1 da65f04f5b9d64a95592fdab5af6c186bef3d1bb
- SHA512 b02d248bcc741e243d584d13151f364eebb97a6aacc7b8e3c6be3123095c1e39f555e84592a713045e001afccef715587ffe507365400ffa3bc406225c5cfc6f
- SSDEEP 3072:CEGh0obl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGdldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4C384A75-CFA9-4cfe-893A-F2FF13C31905}.exe
- Size 408KB
- SHA256 82a9db8d65434918f7dd05abe7ac2e6223d0cebf3ce03fed0a19842a83e7aed7
- MD5 1e7bd560dcc8f7fb6f9ca54d66be72ee
- SHA1 57330c6bd59b29fdd515e7aeaa9a3eaab1b35691
- SHA512 b1921f4a4ded0f12426ff8567cf3dc18117b82a7f1b567fedebcdbb9ff290912fa3f8bf7d249a7f02be7f54cf0a900d32ba43fa2ed6ceb5a7c887322372c773c
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{63A81BE7-6127-4ea3-9154-8C8B6814DF68}.exe
- Size 408KB
- SHA256 b5c5519cbebf7f9face6ca00dbde94b78c612e752505dfb99e9b7d4a71f8cc4d
- MD5 871fa77b1c89790a39ea5f3c85c26e0f
- SHA1 092c5287cbe03caea2dc396b966fa26008339fd4
- SHA512 ceec34ee3ad1792a8470ae43e766ed2a73dc6056bf12d9a9d9a887421ef03dcb7b8b7f03dbf3071d49b2aaa9b70c922ba219a03760cce5f60359edc1acadc3a1
- SSDEEP 3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGnldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6FBC8B00-A35B-4cc6-9CAD-8BCF83CF528B}.exe
- Size 408KB
- SHA256 6186f73e78956be471ff12a0817890935aa7c136529ad8787d7946f723e5347c
- MD5 f26c56433427d486e21866910b38f8ea
- SHA1 68bdac27090b5b1aca0ce53a871df984a9da1559
- SHA512 cc3e8309d7d12fc9e2d2958f7f26ac1ae992059080b735106aaae12189287d084ef7ccacc89ea36bcdcb3d8b631fe9b73febdc2a48053d13f52818c7f724215b
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9291115A-8D3C-4f4a-9E39-68BBDE97CB44}.exe
- Size 408KB
- SHA256 1fd127f23e2f2a52c033cae599b4ba22a6d5d0803c381816d395a09d3a0540f9
- MD5 4b132b8c6f5c1af0506245220753a0db
- SHA1 91a4712afec688fbcdf1d4c69d8d7186535e1177
- SHA512 c8153aaf4328529319d4ddcbc21f7c330bf3ba5e34823b1ccb53ffd85c61cda4f4a14bb5633d78f67d32415b65dd8509e261e647a7919b93e00ac29f8db4c772
- SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGMldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2507C4D-9E66-4e89-9D0C-CB443C6CE21D}.exe
- Size 408KB
- SHA256 429a210f5b3f71d9d834c573e5a8a2cee5dbc34022c6663b2c407bdcc95cf6b8
- MD5 94422aafd6386a98839f7576b3cc39b9
- SHA1 9942555e3bef3e389454c4cc0aa221a3876eb205
- SHA512 1f38ed038a9a0b0569f7cdf5383dc26cdfd693fd28b8375fdde4d1f79356138487ae1ee0b2d396321de6a169244b4473c9533746481b7c7027d73640307d3b43
- SSDEEP 3072:CEGh0ogl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E1425C9D-3590-475c-957D-59AD07662020}.exe
- Size 408KB
- SHA256 4f522b58dd669f9b767bf4ebd0e6c57076cc526dff65ce67c31ca4a5e9f79237
- MD5 7b1f3ceccb870ce75e8464cf584ec2ee
- SHA1 af10233efcdc4bbb7c2990b75923456366d0082c
- SHA512 ec0c23cc53e60843127dd7af1a81c457297e20a3ce5ce6bac3c44088d98a61408119e3d1372aac45a925b4537885cd3e5117ee3ec1938808fc2525342289e52a
- SSDEEP 3072:CEGh0okl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGeldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F2233B23-FE97-406d-AFE2-2F79D4FEC831}.exe
- Size 408KB
- SHA256 fd95a8f627c1d4f90d04fc0cc4e1fe588899e3c513200d42714ae3aec55da11c
- MD5 db1bd4ac0d6762c7837f59a9731aebd4
- SHA1 9d8844b47d9048978b0adea3217836c0112533d2
- SHA512 8222244f5912c29ceda65cc48b018a7a81e95148a916209ae1fcacf35e1af94b7006b5e20e614485c4f321002523c6987053bccbac158967f35e1535faa5ac3d
- SSDEEP 3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGildOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP