Analysis
- max time kernel
149s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 13:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe
- Size 192KB
- Sample240611-p98dpaybkp
- SHA256 745bb691f47d54a2c2f725bf2311d457184ed11204cb12ce38c582178c41e79c
- MD5 f062627cf8cf61573b3e0fd1b8af2c61
- SHA1 da49da8c5a5696d88b5c25700a5c7de0ab5ecc0e
- SHA512 50bbfa196df5cfe4b08be1c8f64a40da99ca8d66f2818d4f6239bded6feedfad9481bf8d630cb00d83f64e33b20c6d12e252272fdb6520a14ffb1379e526f440
- SSDEEP 1536:1EGh0o4l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o4l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000c000000023367-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023368-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233eb-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233f4-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233fa-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233f4-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233fa-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233f4-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233fa-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233f4-37.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233fa-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233f4-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C325B23A-0C6C-482f-9B51-564BB8418E4E}\stubpath = "C:\\Windows\\{C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe" {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C24A8C5-3747-4c78-95E0-AC13C09101AE}\stubpath = "C:\\Windows\\{4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe" {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}\stubpath = "C:\\Windows\\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe" {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2FAFF27-2056-41a5-A958-8A50FB1EE201} 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2FAFF27-2056-41a5-A958-8A50FB1EE201}\stubpath = "C:\\Windows\\{D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe" 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{516A08A3-09E5-418f-AB76-814D7A0D908A}\stubpath = "C:\\Windows\\{516A08A3-09E5-418f-AB76-814D7A0D908A}.exe" {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32} {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C24A8C5-3747-4c78-95E0-AC13C09101AE} {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9} {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C629D07-0094-451f-A621-53E7B13709EB} {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7A3B32E-B5BA-4958-B245-AA29B2D72464}\stubpath = "C:\\Windows\\{B7A3B32E-B5BA-4958-B245-AA29B2D72464}.exe" {5D71BC69-B632-4601-9692-2353F9996D49}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17} {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}\stubpath = "C:\\Windows\\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe" {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}\stubpath = "C:\\Windows\\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe" {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C629D07-0094-451f-A621-53E7B13709EB}\stubpath = "C:\\Windows\\{5C629D07-0094-451f-A621-53E7B13709EB}.exe" {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41003D0B-CDD9-411d-9FF3-16F43EAF5888} {5C629D07-0094-451f-A621-53E7B13709EB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41003D0B-CDD9-411d-9FF3-16F43EAF5888}\stubpath = "C:\\Windows\\{41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe" {5C629D07-0094-451f-A621-53E7B13709EB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA} {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{516A08A3-09E5-418f-AB76-814D7A0D908A} {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32}\stubpath = "C:\\Windows\\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe" {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D71BC69-B632-4601-9692-2353F9996D49}\stubpath = "C:\\Windows\\{5D71BC69-B632-4601-9692-2353F9996D49}.exe" {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7A3B32E-B5BA-4958-B245-AA29B2D72464} {5D71BC69-B632-4601-9692-2353F9996D49}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C325B23A-0C6C-482f-9B51-564BB8418E4E} {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D71BC69-B632-4601-9692-2353F9996D49} {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe - Executes dropped EXE 12 IoCs
pid Process 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 2956 {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe 2704 {5D71BC69-B632-4601-9692-2353F9996D49}.exe 216 {B7A3B32E-B5BA-4958-B245-AA29B2D72464}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{5D71BC69-B632-4601-9692-2353F9996D49}.exe {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe File created C:\Windows\{C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe File created C:\Windows\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe File created C:\Windows\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe File created C:\Windows\{5C629D07-0094-451f-A621-53E7B13709EB}.exe {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe File created C:\Windows\{41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe {5C629D07-0094-451f-A621-53E7B13709EB}.exe File created C:\Windows\{B7A3B32E-B5BA-4958-B245-AA29B2D72464}.exe {5D71BC69-B632-4601-9692-2353F9996D49}.exe File created C:\Windows\{D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe File created C:\Windows\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe File created C:\Windows\{516A08A3-09E5-418f-AB76-814D7A0D908A}.exe {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe File created C:\Windows\{4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe File created C:\Windows\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe Token: SeIncBasePriorityPrivilege 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe Token: SeIncBasePriorityPrivilege 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe Token: SeIncBasePriorityPrivilege 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe Token: SeIncBasePriorityPrivilege 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe Token: SeIncBasePriorityPrivilege 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe Token: SeIncBasePriorityPrivilege 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe Token: SeIncBasePriorityPrivilege 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe Token: SeIncBasePriorityPrivilege 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe Token: SeIncBasePriorityPrivilege 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe Token: SeIncBasePriorityPrivilege 2956 {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe Token: SeIncBasePriorityPrivilege 2704 {5D71BC69-B632-4601-9692-2353F9996D49}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 4948 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe 84 PID 1948 wrote to memory of 4948 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe 84 PID 1948 wrote to memory of 4948 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe 84 PID 1948 wrote to memory of 4224 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe 85 PID 1948 wrote to memory of 4224 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe 85 PID 1948 wrote to memory of 4224 1948 2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe 85 PID 4948 wrote to memory of 2952 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 86 PID 4948 wrote to memory of 2952 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 86 PID 4948 wrote to memory of 2952 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 86 PID 4948 wrote to memory of 1076 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 87 PID 4948 wrote to memory of 1076 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 87 PID 4948 wrote to memory of 1076 4948 {D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe 87 PID 2952 wrote to memory of 1352 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 90 PID 2952 wrote to memory of 1352 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 90 PID 2952 wrote to memory of 1352 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 90 PID 2952 wrote to memory of 2832 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 91 PID 2952 wrote to memory of 2832 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 91 PID 2952 wrote to memory of 2832 2952 {D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe 91 PID 1352 wrote to memory of 4104 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 96 PID 1352 wrote to memory of 4104 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 96 PID 1352 wrote to memory of 4104 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 96 PID 1352 wrote to memory of 4180 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 97 PID 1352 wrote to memory of 4180 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 97 PID 1352 wrote to memory of 4180 1352 {C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe 97 PID 4104 wrote to memory of 652 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 99 PID 4104 wrote to memory of 652 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 99 PID 4104 wrote to memory of 652 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 99 PID 4104 wrote to memory of 1284 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 100 PID 4104 wrote to memory of 1284 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 100 PID 4104 wrote to memory of 1284 4104 {516A08A3-09E5-418f-AB76-814D7A0D908A}.exe 100 PID 652 wrote to memory of 1964 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 101 PID 652 wrote to memory of 1964 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 101 PID 652 wrote to memory of 1964 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 101 PID 652 wrote to memory of 1624 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 102 PID 652 wrote to memory of 1624 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 102 PID 652 wrote to memory of 1624 652 {27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe 102 PID 1964 wrote to memory of 4576 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 103 PID 1964 wrote to memory of 4576 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 103 PID 1964 wrote to memory of 4576 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 103 PID 1964 wrote to memory of 2632 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 104 PID 1964 wrote to memory of 2632 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 104 PID 1964 wrote to memory of 2632 1964 {4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe 104 PID 4576 wrote to memory of 3828 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 105 PID 4576 wrote to memory of 3828 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 105 PID 4576 wrote to memory of 3828 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 105 PID 4576 wrote to memory of 2052 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 106 PID 4576 wrote to memory of 2052 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 106 PID 4576 wrote to memory of 2052 4576 {0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe 106 PID 3828 wrote to memory of 3736 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 107 PID 3828 wrote to memory of 3736 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 107 PID 3828 wrote to memory of 3736 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 107 PID 3828 wrote to memory of 5008 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 108 PID 3828 wrote to memory of 5008 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 108 PID 3828 wrote to memory of 5008 3828 {5C629D07-0094-451f-A621-53E7B13709EB}.exe 108 PID 3736 wrote to memory of 2956 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 109 PID 3736 wrote to memory of 2956 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 109 PID 3736 wrote to memory of 2956 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 109 PID 3736 wrote to memory of 3344 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 110 PID 3736 wrote to memory of 3344 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 110 PID 3736 wrote to memory of 3344 3736 {41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe 110 PID 2956 wrote to memory of 2704 2956 {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe 111 PID 2956 wrote to memory of 2704 2956 {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe 111 PID 2956 wrote to memory of 2704 2956 {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe 111 PID 2956 wrote to memory of 224 2956 {8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_f062627cf8cf61573b3e0fd1b8af2c61_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\{D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exeC:\Windows\{D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exeC:\Windows\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\{C325B23A-0C6C-482f-9B51-564BB8418E4E}.exeC:\Windows\{C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\{516A08A3-09E5-418f-AB76-814D7A0D908A}.exeC:\Windows\{516A08A3-09E5-418f-AB76-814D7A0D908A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exeC:\Windows\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\{4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exeC:\Windows\{4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exeC:\Windows\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\{5C629D07-0094-451f-A621-53E7B13709EB}.exeC:\Windows\{5C629D07-0094-451f-A621-53E7B13709EB}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\{41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exeC:\Windows\{41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exeC:\Windows\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\{5D71BC69-B632-4601-9692-2353F9996D49}.exeC:\Windows\{5D71BC69-B632-4601-9692-2353F9996D49}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\{B7A3B32E-B5BA-4958-B245-AA29B2D72464}.exeC:\Windows\{B7A3B32E-B5BA-4958-B245-AA29B2D72464}.exe13⤵
- Executes dropped EXE
PID:216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D71B~1.EXE > nul13⤵PID:3324
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AA68~1.EXE > nul12⤵PID:224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41003~1.EXE > nul11⤵PID:3344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C629~1.EXE > nul10⤵PID:5008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A3A9~1.EXE > nul9⤵PID:2052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C24A~1.EXE > nul8⤵PID:2632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27E60~1.EXE > nul7⤵PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{516A0~1.EXE > nul6⤵PID:1284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C325B~1.EXE > nul5⤵PID:4180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3A6E~1.EXE > nul4⤵PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2FAF~1.EXE > nul3⤵PID:1076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0A3A9C2C-2526-4c94-8661-16AD7BC3CBE9}.exe
- Size 192KB
- SHA256 278fd5bd7551386685c70fb9a2eebf7ca914d2138ac52f908f31e134c8cdd4cf
- MD5 427593085faeaee9aaf2c81b375d5cf8
- SHA1 52b8358a3360739ab06d44d77392ea18d28b9efd
- SHA512 ae9c6ef940db0d0878a045f77262eb98ca31c61e279ba3e1e8b95978fd3784bbedd592a416b6328caaa0e381087d5e6204f179157a4a172fd014aafbfebda78e
- SSDEEP 1536:1EGh0o6Ll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oOl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{27E60614-55FC-4cde-9DAA-A8C6BCD83B32}.exe
- Size 192KB
- SHA256 6942a1bab9868972da126ab267f151bb77475569260f213f3217defaf36df1a5
- MD5 39fa4ab074b5f5fac792971cebf71914
- SHA1 6e63da55e49a7e1d04462e7e8cafd2adc274f143
- SHA512 1a89f0060aa5d3b6917f75fd3d18a811e12ddb193bbeeebf369c9772edc5bc6d2ffe5d4c531d5c9eaf64312fd664d5408885eb95434a4083ebb3ffa1140bd5f0
- SSDEEP 1536:1EGh0o6l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o6l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{41003D0B-CDD9-411d-9FF3-16F43EAF5888}.exe
- Size 192KB
- SHA256 da839ad74675d342ebfff35e6e2ef825dd8c75fece82ae7cde57f423b8fcdad0
- MD5 06efae4bdd411d0731d0cce983aad78f
- SHA1 04cf886ef04afadd6e5c7105a2d1c5004e9bbdca
- SHA512 ccee011e20651c759e4cf264ae12d04fc368a2d747cc7f0f96381d7b402d843f1a52bc9aa7e8a43e8157c4cc4d604768350097c36f36d54b4bac098e6c986bad
- SSDEEP 1536:1EGh0ofl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ofl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4C24A8C5-3747-4c78-95E0-AC13C09101AE}.exe
- Size 192KB
- SHA256 1d3ed59fcb5776324e7c71860e760f42e9b13d02afaaa1e7eec03a0a7d2eb3bb
- MD5 3e88eaf99ccfbee15115a92be5595598
- SHA1 c0cefc73778f3ee6cf98d6833d1e649caa43d7eb
- SHA512 8228288732d8b0f210a0d0fcfc96e84d2329669c086c174aa65a472d899198d78c154efc46bab8f0a47104d2966422fd1960c454da32eccfc46832d8e82298a9
- SSDEEP 1536:1EGh0oml15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oml1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{516A08A3-09E5-418f-AB76-814D7A0D908A}.exe
- Size 192KB
- SHA256 fc184d35b93df2a476a3c9c1d9012a475dfa2f8f1a18bce561ebfd590f2609a1
- MD5 f750613ca75c4920aca28d181c99f528
- SHA1 1c0304bf092521e5775bec4561ddd30a5fd83dde
- SHA512 0bf59c7f9ab55d64628082515c9f7aa7d87c63f7fcfb3d7101ae83d5bde7f8c296757d087588a8afc71401d47a103bca419ec07dce162343866d44809718944d
- SSDEEP 1536:1EGh0oQl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oQl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5C629D07-0094-451f-A621-53E7B13709EB}.exe
- Size 192KB
- SHA256 eb62b12f7a558c752ecb4f1236efa972c716e9cc1dfdaaf86917ff3fcaf026ab
- MD5 980298c04ec45047bd05ea0a5bac0bf0
- SHA1 f540aa542e0d6a997ce322a515561773bb2f7575
- SHA512 98d40cc6d8982f359d64adb005125fae1fd437abbe53ff2b9d6867b0de3a1b519b0238866e21220b5695f6c3b55b3c1e4866bd91a0618a0db4f6367a90999b2c
- SSDEEP 1536:1EGh0oEl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oEl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5D71BC69-B632-4601-9692-2353F9996D49}.exe
- Size 192KB
- SHA256 87b594703501ac736bf7dc8ed564a9dd35be9644eba0b78f0ea12d4d95083ab8
- MD5 af71a95108932004f23e695fe579f32c
- SHA1 af61d313f08950128992ff75815592d22b2ac5f2
- SHA512 fac2245c0ce9bcfc88799df867a7e8ae86baad34599349d107e197999d73dde40b2a467aebf9064fcb41b71038883676977116bd943dfc9f918bb0a16addf988
- SSDEEP 1536:1EGh0oqLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o+l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8AA68A6D-53F1-403b-8B7C-FF120FFDE2CA}.exe
- Size 192KB
- SHA256 ddcde444d50250369cf7b21a52a21514f64d097ee384966eaf43263dd39a2e74
- MD5 9ea52faecddc37e07d42ed07e1a6078d
- SHA1 a3dfee121f550e848fa6cdeadfc43f6f4b98dc3c
- SHA512 a42a98ca4aa4e2acc533191afd0ae88f5709ec8276bf1e3cd1de233a6092d5085e64ca568ad8c74526fb143761bac33248a772fd7feb7fcf8b315ebc30cbb740
- SSDEEP 1536:1EGh0o0Al15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o0Al1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B7A3B32E-B5BA-4958-B245-AA29B2D72464}.exe
- Size 192KB
- SHA256 d7138da0771efb65c79d3960ad4bda8b65fa887e093c02d80046eec510ada090
- MD5 9fbe10ca60484c58e8000a3001189983
- SHA1 ef86abeaa3041ac724e176828c9c20e28bbc909e
- SHA512 8adbb36c3972e16efa326ec1057195c8119f13c25c98375add7282bef2f6fdaad9e7f4977671f8f8bba4a23781b7c1790a1fba9c65884404e32caac98874d026
- SSDEEP 1536:1EGh0oil15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oil1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C325B23A-0C6C-482f-9B51-564BB8418E4E}.exe
- Size 192KB
- SHA256 48a83d55d8a70fa6780917aeb4ba06121d49afbcf4d3cceb2d23ce50e29bc213
- MD5 a873af41338911f37d655dc56baf3605
- SHA1 09f929e7ccf542d6fdefb3167b5d03116612b8bd
- SHA512 762832435e22c40aeed9c830c3a6a5a9493644769064a70acf1691816a9faf671ddc91c2ef962d96474aa1dde3fcc9bc977493956e091bc9bfb7b3e6087defb3
- SSDEEP 1536:1EGh0oMl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oMl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D2FAFF27-2056-41a5-A958-8A50FB1EE201}.exe
- Size 192KB
- SHA256 db9b7fcb04717b23ed928b5079246850731382dd1e55e45d6740a826c05a7bb7
- MD5 2ffbcf4ec1e60064fbe231a9181b52b4
- SHA1 adfcb8422b781a4b245e5d7c32a2ec933c25470b
- SHA512 c422b2fefe7d56caab12f89d632fd9d1d549223ec788c046b509a2530109d1fc4708b61d26bed2babd9760608ffdedc825af8a5df21cccd3905c37885d295e6c
- SSDEEP 1536:1EGh0oDl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oDl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D3A6E0C8-E05D-4995-8189-A17CB2F3FA17}.exe
- Size 192KB
- SHA256 5b1f50cbcde0b11f8974fc816d61efd43cbe013c7fb12df7e7a730e512c79b69
- MD5 eb7f37f0ad3dd795aafbce8682f19d93
- SHA1 244d70b821e4489223554a7287ef7ed7875af1df
- SHA512 a28f1e3e8417436ece8b9517aa011ef63d0bfb5157f0121136263f73843f067323bfb212b50116971862ce38522f9fd4f9f58f6773cef3b4863e03bfff859fe2
- SSDEEP 1536:1EGh0oMYl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oMYl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP