Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe
- Size 216KB
- Sample240611-p43k9axeke
- SHA256 e14f7e51e5c7c39e20bd6effc71b73091ecf2aeab2dd3fc9527fff80eecb9c12
- MD5 c11a13f0723881eda58ce3c1a183d810
- SHA1 115d46d29ddcaa9bbdfeab71348df16ea6c3b18c
- SHA512 a8c6e87f248a5d2109d13784cea66a1fc372be29f3d3aa990902eed4f3c83f433e92b726e692d8472ede42a99f2cdfc45753dea7d643ec1407553269bb22f5f7
- SSDEEP 3072:jEGh0otl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGblEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 13 IoCs
resource yara_rule behavioral2/files/0x0005000000022abb-1.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000022ac3-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023420-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023424-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002342a-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023424-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002342a-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023424-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002342a-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023424-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002342a-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023424-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023424-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFD2C920-913C-4b7e-93A4-653794A590BF} 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE} {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE}\stubpath = "C:\\Windows\\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe" {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F} {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15358EE5-F954-476e-8C0C-79B2A0D253AD} {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15358EE5-F954-476e-8C0C-79B2A0D253AD}\stubpath = "C:\\Windows\\{15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe" {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFD2C920-913C-4b7e-93A4-653794A590BF}\stubpath = "C:\\Windows\\{EFD2C920-913C-4b7e-93A4-653794A590BF}.exe" 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3CF5EBE-5389-4f8f-B83C-D273DE707605} {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}\stubpath = "C:\\Windows\\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe" {E3272AA0-E146-4890-8B2D-549D4A746722}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB6E210B-4942-4a40-900D-E0BF0FB532D6}\stubpath = "C:\\Windows\\{CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe" {95580994-D270-4c67-A0E3-7A46B068395C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3272AA0-E146-4890-8B2D-549D4A746722}\stubpath = "C:\\Windows\\{E3272AA0-E146-4890-8B2D-549D4A746722}.exe" {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77} {E3272AA0-E146-4890-8B2D-549D4A746722}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95580994-D270-4c67-A0E3-7A46B068395C}\stubpath = "C:\\Windows\\{95580994-D270-4c67-A0E3-7A46B068395C}.exe" {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}\stubpath = "C:\\Windows\\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe" {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AC8AE8A-37AF-494d-AB46-F366F61F1363} {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AC8AE8A-37AF-494d-AB46-F366F61F1363}\stubpath = "C:\\Windows\\{9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe" {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4192A901-EB51-46ce-9823-3F373109006A} {9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F}\stubpath = "C:\\Windows\\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe" {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3CF5EBE-5389-4f8f-B83C-D273DE707605}\stubpath = "C:\\Windows\\{C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe" {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3272AA0-E146-4890-8B2D-549D4A746722} {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95580994-D270-4c67-A0E3-7A46B068395C} {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB6E210B-4942-4a40-900D-E0BF0FB532D6} {95580994-D270-4c67-A0E3-7A46B068395C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5} {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4192A901-EB51-46ce-9823-3F373109006A}\stubpath = "C:\\Windows\\{4192A901-EB51-46ce-9823-3F373109006A}.exe" {9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe - Executes dropped EXE 11 IoCs
pid Process 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 3560 {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe 2672 {9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe File created C:\Windows\{4192A901-EB51-46ce-9823-3F373109006A}.exe {9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe File created C:\Windows\{EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe File created C:\Windows\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe File created C:\Windows\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe File created C:\Windows\{E3272AA0-E146-4890-8B2D-549D4A746722}.exe {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe File created C:\Windows\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe {E3272AA0-E146-4890-8B2D-549D4A746722}.exe File created C:\Windows\{C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe File created C:\Windows\{95580994-D270-4c67-A0E3-7A46B068395C}.exe {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe File created C:\Windows\{CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe {95580994-D270-4c67-A0E3-7A46B068395C}.exe File created C:\Windows\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe File created C:\Windows\{9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe Token: SeIncBasePriorityPrivilege 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe Token: SeIncBasePriorityPrivilege 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe Token: SeIncBasePriorityPrivilege 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe Token: SeIncBasePriorityPrivilege 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe Token: SeIncBasePriorityPrivilege 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe Token: SeIncBasePriorityPrivilege 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe Token: SeIncBasePriorityPrivilege 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe Token: SeIncBasePriorityPrivilege 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe Token: SeIncBasePriorityPrivilege 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe Token: SeIncBasePriorityPrivilege 3560 {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3824 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe 86 PID 4912 wrote to memory of 3824 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe 86 PID 4912 wrote to memory of 3824 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe 86 PID 4912 wrote to memory of 2092 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe 87 PID 4912 wrote to memory of 2092 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe 87 PID 4912 wrote to memory of 2092 4912 2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe 87 PID 3824 wrote to memory of 5112 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 88 PID 3824 wrote to memory of 5112 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 88 PID 3824 wrote to memory of 5112 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 88 PID 3824 wrote to memory of 1756 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 89 PID 3824 wrote to memory of 1756 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 89 PID 3824 wrote to memory of 1756 3824 {EFD2C920-913C-4b7e-93A4-653794A590BF}.exe 89 PID 5112 wrote to memory of 1108 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 92 PID 5112 wrote to memory of 1108 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 92 PID 5112 wrote to memory of 1108 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 92 PID 5112 wrote to memory of 4524 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 93 PID 5112 wrote to memory of 4524 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 93 PID 5112 wrote to memory of 4524 5112 {86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe 93 PID 1108 wrote to memory of 2460 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 98 PID 1108 wrote to memory of 2460 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 98 PID 1108 wrote to memory of 2460 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 98 PID 1108 wrote to memory of 4808 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 99 PID 1108 wrote to memory of 4808 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 99 PID 1108 wrote to memory of 4808 1108 {53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe 99 PID 2460 wrote to memory of 3980 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 101 PID 2460 wrote to memory of 3980 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 101 PID 2460 wrote to memory of 3980 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 101 PID 2460 wrote to memory of 1544 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 102 PID 2460 wrote to memory of 1544 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 102 PID 2460 wrote to memory of 1544 2460 {C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe 102 PID 3980 wrote to memory of 3916 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 103 PID 3980 wrote to memory of 3916 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 103 PID 3980 wrote to memory of 3916 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 103 PID 3980 wrote to memory of 4940 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 104 PID 3980 wrote to memory of 4940 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 104 PID 3980 wrote to memory of 4940 3980 {E3272AA0-E146-4890-8B2D-549D4A746722}.exe 104 PID 3916 wrote to memory of 4332 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 105 PID 3916 wrote to memory of 4332 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 105 PID 3916 wrote to memory of 4332 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 105 PID 3916 wrote to memory of 3448 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 106 PID 3916 wrote to memory of 3448 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 106 PID 3916 wrote to memory of 3448 3916 {E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe 106 PID 4332 wrote to memory of 4588 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 107 PID 4332 wrote to memory of 4588 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 107 PID 4332 wrote to memory of 4588 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 107 PID 4332 wrote to memory of 4908 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 108 PID 4332 wrote to memory of 4908 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 108 PID 4332 wrote to memory of 4908 4332 {95580994-D270-4c67-A0E3-7A46B068395C}.exe 108 PID 4588 wrote to memory of 4508 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 109 PID 4588 wrote to memory of 4508 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 109 PID 4588 wrote to memory of 4508 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 109 PID 4588 wrote to memory of 64 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 110 PID 4588 wrote to memory of 64 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 110 PID 4588 wrote to memory of 64 4588 {CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe 110 PID 4508 wrote to memory of 3560 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 111 PID 4508 wrote to memory of 3560 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 111 PID 4508 wrote to memory of 3560 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 111 PID 4508 wrote to memory of 4488 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 112 PID 4508 wrote to memory of 4488 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 112 PID 4508 wrote to memory of 4488 4508 {C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe 112 PID 3560 wrote to memory of 2672 3560 {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe 113 PID 3560 wrote to memory of 2672 3560 {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe 113 PID 3560 wrote to memory of 2672 3560 {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe 113 PID 3560 wrote to memory of 2776 3560 {15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_c11a13f0723881eda58ce3c1a183d810_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\{EFD2C920-913C-4b7e-93A4-653794A590BF}.exeC:\Windows\{EFD2C920-913C-4b7e-93A4-653794A590BF}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exeC:\Windows\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exeC:\Windows\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\{C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exeC:\Windows\{C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\{E3272AA0-E146-4890-8B2D-549D4A746722}.exeC:\Windows\{E3272AA0-E146-4890-8B2D-549D4A746722}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exeC:\Windows\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\{95580994-D270-4c67-A0E3-7A46B068395C}.exeC:\Windows\{95580994-D270-4c67-A0E3-7A46B068395C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\{CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exeC:\Windows\{CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exeC:\Windows\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\{15358EE5-F954-476e-8C0C-79B2A0D253AD}.exeC:\Windows\{15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\{9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exeC:\Windows\{9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
PID:2672 -
C:\Windows\{4192A901-EB51-46ce-9823-3F373109006A}.exeC:\Windows\{4192A901-EB51-46ce-9823-3F373109006A}.exe13⤵PID:2092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AC8A~1.EXE > nul13⤵PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15358~1.EXE > nul12⤵PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3D22~1.EXE > nul11⤵PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB6E2~1.EXE > nul10⤵PID:64
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95580~1.EXE > nul9⤵PID:4908
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E89B5~1.EXE > nul8⤵PID:3448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3272~1.EXE > nul7⤵PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3CF5~1.EXE > nul6⤵PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53803~1.EXE > nul5⤵PID:4808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86F6D~1.EXE > nul4⤵PID:4524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFD2C~1.EXE > nul3⤵PID:1756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{15358EE5-F954-476e-8C0C-79B2A0D253AD}.exe
- Size 216KB
- SHA256 b5b7722929a2f7429604cea8167786c3e3573af560303b2e791741351a4f285a
- MD5 b9270f3d9f00912424b79a43937d2b6b
- SHA1 016058e355e3afa74fb41487078de3146931cee0
- SHA512 6a8bac55db93c0941f8b7e3a8ccfdeca483a2a77c6382023cc26c916e08a29e08eef834467b21160d029b9fca62ef08a123625cc3ea9bc7967c105e9fcee7a88
- SSDEEP 3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG3lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4192A901-EB51-46ce-9823-3F373109006A}.exe
- Size 186KB
- SHA256 c0fdc4ff7bf06674376ae29eb4aa73e1db7b2abc5efc334a97f0bf1e1322d6cf
- MD5 fe2a1d06a727bdbef5e72fc16bd7dc8e
- SHA1 a8507794c65ee01913037749e1e3e616017bd4e8
- SHA512 ff4ca8c0c02d85cd4a7f23a7eca53c0aafa09bc61de52c2e68c2fe6cd97b85438eefd2323c1cce585a3090e76c5d84b55d158819f12d827c2b6ecef9cbbd3c9e
- SSDEEP 3072:jEGh0oXl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr8:jEGdlEeKcAEcO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4192A901-EB51-46ce-9823-3F373109006A}.exe
- Size 120KB
- SHA256 3a3dfa2e0277309afd8b4d77b7de71ddd67f9ec5801c2fb01b5af43cbd4a96b5
- MD5 40521e99b0c994da166884565cf46bec
- SHA1 521cb431a6c33769c589aeb925c27c382ace6c35
- SHA512 e653772fcd7e7382be9fd97b3c9ff37275a09b1414b32b195d1f0705ac4084caf79bcd03aa55e96947fe9e2590bb583cd9eac08094f205e9afb6e2eec3342e16
- SSDEEP 768:Dvw9816vhKQLroX4/wQrf5DAXYq/JTvlK8OI3BpgI6adWiNKkc5ya8ebnend4kt2:jEGh0oXl+5IRVhLc5n5o7iew
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{53803649-56DB-4d13-B84B-BD6AC7C6FB0F}.exe
- Size 216KB
- SHA256 56ee4d0bb7d1b60b2953f3e6bff6bc28bb07e6a1b62428619049252353f122de
- MD5 e6b720bbf7650b4de47389ea36bbb469
- SHA1 6626e1b206a95ab35ce21be02bc338ff007b8e17
- SHA512 274d508a45f74fb5b117b2b479c9c5b88bf765b997232cff476e3fec0f7f34feacfbdc65ff5656581df8a5ae18dc79050c3b0ba72c786955086ba59479505a98
- SSDEEP 3072:jEGh0oXl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGxlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{86F6D664-4E8B-48a2-9C26-65B3819BDAFE}.exe
- Size 216KB
- SHA256 2476d363fb877ae7ac9c0087db4e9cabe4f8eae9aa865b0f326e16cb216cc393
- MD5 823d7f623ba52619c703256d446c5b87
- SHA1 0174af31dbc8489e0a150b3512c94f1c2f6ce106
- SHA512 31a10e1db521a96d4690d9b5ae59c728f5c8510379275b23423c7b3dcef9a3967bb40e05bc79746af255894b41175b9aba3ad0da2ddd0793d0726f23bce55e0e
- SSDEEP 3072:jEGh0ocl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGOlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{95580994-D270-4c67-A0E3-7A46B068395C}.exe
- Size 216KB
- SHA256 b0dc4187f8dd94368e8796242edecbb0210bcf4003839f4ec7c6d5164bd25bd4
- MD5 e56ba16807987a8b4ef983c58d8d5cb7
- SHA1 2f8d5c98bd00240b22e02ee5d41b911cbac6d58e
- SHA512 bdee53ba13ccd6c71133beb73c764ff8fcbda36ee3d3a18d3486cb0a4453070fb37c7c1e45d85b954152a3fcf7950382cfe32e8f1c4fe3b4ac8cfe6e29adc72d
- SSDEEP 3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG/lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9AC8AE8A-37AF-494d-AB46-F366F61F1363}.exe
- Size 216KB
- SHA256 86060a9846116f37298c143c043c311b788e20ed832b41fa07e4c111dd26a921
- MD5 e375b868199841568be8c5dda6d86b46
- SHA1 e09efb33fc8dd387e9ae0027fb6e34e3b25d5eb7
- SHA512 a62b03ddd041ec0d443b5112aebb38420f4a08dee254fbb39c75ef5f83a24c43cd2570dd3a41a8ec05f947f77f628e5b047da8225863038b3f12bfe0f4960d26
- SSDEEP 3072:jEGh0oXKl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG4lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C3CF5EBE-5389-4f8f-B83C-D273DE707605}.exe
- Size 216KB
- SHA256 a4dfb51b040f74cc8659550f2b0a29187e1db25faf59cec337e03b83d84f25b4
- MD5 8a9037a3055756f0113aa1500574d915
- SHA1 0780e75f46498c7a2a41c777727fd4263c7309d5
- SHA512 0df9b43b4d53ef20198c7c35410a34a91b04697105b1cb1d2ad781cde328d395ec720e28ea5c92148d28d89c446e87c811550ebcbf601a8bab7d80f52dc8e060
- SSDEEP 3072:jEGh0oLl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG9lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C3D224F0-7617-4d7d-8F97-DBE148BD3EF5}.exe
- Size 216KB
- SHA256 a0d7d89fc252fdec458f0fcc39a395f150099001e1769cb9607b420baa959c3d
- MD5 0715f8a6c4a0612f9ff6ab74f74ce881
- SHA1 3693df29ef1b6c6df27579df9000dfc0fc757ce7
- SHA512 5ec6746eb334959dde35723720c20aab3d6e4df95e4c9bcb4cbfaa90a6f2687c2aab32105d1da2bf71f4c014a5c3b66a2af2d01f06121bd7d4f737ff07aceb13
- SSDEEP 3072:jEGh0oFl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGXlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CB6E210B-4942-4a40-900D-E0BF0FB532D6}.exe
- Size 216KB
- SHA256 f393c13cde2cd451788ae6a929cf64d5db9836640d74a0cdc13e1b0f5e1ada75
- MD5 0dd46648c39da1321ecd471b5404ebb2
- SHA1 866022f7d29ebbedba66c2820fab55c9d75c0147
- SHA512 496c8330c92e4b842355882be03e4f953fd66020ab6ee592785f1503be39bac45649edd707854be732cd8ce6f03d5fde6049401d74b3245e829473b06bbf0e61
- SSDEEP 3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGrlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E3272AA0-E146-4890-8B2D-549D4A746722}.exe
- Size 216KB
- SHA256 e1933175f91916d4127d5011edaf9de022a4de5b9635800e03c9e6a01cc29c23
- MD5 92ccd25f087c541c1a756f93dff9564e
- SHA1 d763809ef5b2b4ec9a6dbcb363857b2d98a26107
- SHA512 99f8cb99128bbf00c36971bda0f75f395dd883bc169b2c17cddd434b55e590140646e23cc7dc089bea024a041b0581696b4d04321ee6c8f616bfa58b6d6c10e1
- SSDEEP 3072:jEGh0oFl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGrlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E89B50A3-6FC0-41a9-90A5-5EA4C1DCCA77}.exe
- Size 216KB
- SHA256 374d51944dcb777a901312660be3f4200baf3881e71272dccce3357b5d36f0c9
- MD5 a7248c461fb130e9dceef672b0222b9b
- SHA1 4b07006eaf51bf6e97e7e96872d5d79757a89dc8
- SHA512 1a5db81117cbf68a22d4afd8a12f814872e1aca377face7e6da0f2783c87251d2c55a5a9cbc181c8707e3f4e63c101504756fa180af38b36eee18daffa35d596
- SSDEEP 3072:jEGh0o4l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGelEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EFD2C920-913C-4b7e-93A4-653794A590BF}.exe
- Size 216KB
- SHA256 7c2d55a1d16428d568f48a4b437def8ae961498c321f65cca49719d686126070
- MD5 beec4b675e4f52f2db98be4ff71be0b7
- SHA1 6aa2312f047bc100b5d380c83debc03b6aa7c472
- SHA512 c02771aafbe68e1db0904f22d6057cb198086a3356ae566ecd46bb78e8cb2ab5d3fe8a69728c1e4e5794ed199eea8ed35f3dc1f95de203e78ff41b4958a7388d
- SSDEEP 3072:jEGh0oLl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGhlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP