Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe
- Size 216KB
- Sample240611-pvvt2sxerr
- SHA256 d8ae5c67f87df4d59ac7405adedf4605f81556efb430a38382b0ec58100378a7
- MD5 70fac9223aa59f5de310182dfa80b7ce
- SHA1 696f6822fa96e9dfa5f7a61a290deee964203270
- SHA512 f054373cfe90cb10f40de47b06889db202cb96fccb44ea42ae89f2a33af93f813e12bd6cc7cd6f3fae6a79d8ad304931bee4840ff8df32de630887ed032b4206
- SSDEEP 3072:jEGh0oQl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGOlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000700000002342f-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023434-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002343a-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023434-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000022118-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0002000000022119-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000022118-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000707-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0003000000000709-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000707-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0004000000000709-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000002f-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3F145E9-4B98-4ecc-85D3-B9F697829A86}\stubpath = "C:\\Windows\\{F3F145E9-4B98-4ecc-85D3-B9F697829A86}.exe" {5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24462537-EC2A-426b-BE79-0A076857949D} 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8640570F-50A3-441f-AAEA-7C7BA7EF6050} {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32} {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE} {322BED09-EE76-4143-8244-F3F7702C2601}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}\stubpath = "C:\\Windows\\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe" {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E13237B0-381B-425a-9573-F5247D10F4A6}\stubpath = "C:\\Windows\\{E13237B0-381B-425a-9573-F5247D10F4A6}.exe" {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27AA30BC-FF6F-4e46-B427-AD3649DED572} {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27AA30BC-FF6F-4e46-B427-AD3649DED572}\stubpath = "C:\\Windows\\{27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe" {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77349D97-CF6E-42d3-9F30-001CF193F23B}\stubpath = "C:\\Windows\\{77349D97-CF6E-42d3-9F30-001CF193F23B}.exe" {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88B20206-06C4-4971-88D8-A0CB194ECABB}\stubpath = "C:\\Windows\\{88B20206-06C4-4971-88D8-A0CB194ECABB}.exe" {E13237B0-381B-425a-9573-F5247D10F4A6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32}\stubpath = "C:\\Windows\\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe" {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77349D97-CF6E-42d3-9F30-001CF193F23B} {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{322BED09-EE76-4143-8244-F3F7702C2601} {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24462537-EC2A-426b-BE79-0A076857949D}\stubpath = "C:\\Windows\\{24462537-EC2A-426b-BE79-0A076857949D}.exe" 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6} {24462537-EC2A-426b-BE79-0A076857949D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E13237B0-381B-425a-9573-F5247D10F4A6} {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88B20206-06C4-4971-88D8-A0CB194ECABB} {E13237B0-381B-425a-9573-F5247D10F4A6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{322BED09-EE76-4143-8244-F3F7702C2601}\stubpath = "C:\\Windows\\{322BED09-EE76-4143-8244-F3F7702C2601}.exe" {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}\stubpath = "C:\\Windows\\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe" {322BED09-EE76-4143-8244-F3F7702C2601}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6}\stubpath = "C:\\Windows\\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe" {24462537-EC2A-426b-BE79-0A076857949D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8640570F-50A3-441f-AAEA-7C7BA7EF6050}\stubpath = "C:\\Windows\\{8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe" {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E} {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3F145E9-4B98-4ecc-85D3-B9F697829A86} {5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe - Executes dropped EXE 12 IoCs
pid Process 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 4512 {322BED09-EE76-4143-8244-F3F7702C2601}.exe 532 {5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe 452 {F3F145E9-4B98-4ecc-85D3-B9F697829A86}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{88B20206-06C4-4971-88D8-A0CB194ECABB}.exe {E13237B0-381B-425a-9573-F5247D10F4A6}.exe File created C:\Windows\{77349D97-CF6E-42d3-9F30-001CF193F23B}.exe {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe File created C:\Windows\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe {322BED09-EE76-4143-8244-F3F7702C2601}.exe File created C:\Windows\{F3F145E9-4B98-4ecc-85D3-B9F697829A86}.exe {5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe File created C:\Windows\{24462537-EC2A-426b-BE79-0A076857949D}.exe 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe File created C:\Windows\{E13237B0-381B-425a-9573-F5247D10F4A6}.exe {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe File created C:\Windows\{8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe File created C:\Windows\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe File created C:\Windows\{27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe File created C:\Windows\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe File created C:\Windows\{322BED09-EE76-4143-8244-F3F7702C2601}.exe {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe File created C:\Windows\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe {24462537-EC2A-426b-BE79-0A076857949D}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe Token: SeIncBasePriorityPrivilege 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe Token: SeIncBasePriorityPrivilege 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe Token: SeIncBasePriorityPrivilege 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe Token: SeIncBasePriorityPrivilege 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe Token: SeIncBasePriorityPrivilege 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe Token: SeIncBasePriorityPrivilege 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe Token: SeIncBasePriorityPrivilege 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe Token: SeIncBasePriorityPrivilege 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe Token: SeIncBasePriorityPrivilege 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe Token: SeIncBasePriorityPrivilege 4512 {322BED09-EE76-4143-8244-F3F7702C2601}.exe Token: SeIncBasePriorityPrivilege 532 {5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1216 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe 90 PID 2028 wrote to memory of 1216 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe 90 PID 2028 wrote to memory of 1216 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe 90 PID 2028 wrote to memory of 3136 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe 91 PID 2028 wrote to memory of 3136 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe 91 PID 2028 wrote to memory of 3136 2028 2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe 91 PID 1216 wrote to memory of 3152 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 92 PID 1216 wrote to memory of 3152 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 92 PID 1216 wrote to memory of 3152 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 92 PID 1216 wrote to memory of 4636 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 93 PID 1216 wrote to memory of 4636 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 93 PID 1216 wrote to memory of 4636 1216 {24462537-EC2A-426b-BE79-0A076857949D}.exe 93 PID 3152 wrote to memory of 3968 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 95 PID 3152 wrote to memory of 3968 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 95 PID 3152 wrote to memory of 3968 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 95 PID 3152 wrote to memory of 3184 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 96 PID 3152 wrote to memory of 3184 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 96 PID 3152 wrote to memory of 3184 3152 {EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe 96 PID 3968 wrote to memory of 3408 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 97 PID 3968 wrote to memory of 3408 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 97 PID 3968 wrote to memory of 3408 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 97 PID 3968 wrote to memory of 1932 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 98 PID 3968 wrote to memory of 1932 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 98 PID 3968 wrote to memory of 1932 3968 {E13237B0-381B-425a-9573-F5247D10F4A6}.exe 98 PID 3408 wrote to memory of 2520 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 99 PID 3408 wrote to memory of 2520 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 99 PID 3408 wrote to memory of 2520 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 99 PID 3408 wrote to memory of 2820 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 100 PID 3408 wrote to memory of 2820 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 100 PID 3408 wrote to memory of 2820 3408 {88B20206-06C4-4971-88D8-A0CB194ECABB}.exe 100 PID 2520 wrote to memory of 1324 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 101 PID 2520 wrote to memory of 1324 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 101 PID 2520 wrote to memory of 1324 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 101 PID 2520 wrote to memory of 3208 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 102 PID 2520 wrote to memory of 3208 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 102 PID 2520 wrote to memory of 3208 2520 {8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe 102 PID 1324 wrote to memory of 4300 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 103 PID 1324 wrote to memory of 4300 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 103 PID 1324 wrote to memory of 4300 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 103 PID 1324 wrote to memory of 5008 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 104 PID 1324 wrote to memory of 5008 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 104 PID 1324 wrote to memory of 5008 1324 {B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe 104 PID 4300 wrote to memory of 3360 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 105 PID 4300 wrote to memory of 3360 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 105 PID 4300 wrote to memory of 3360 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 105 PID 4300 wrote to memory of 2828 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 106 PID 4300 wrote to memory of 2828 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 106 PID 4300 wrote to memory of 2828 4300 {27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe 106 PID 3360 wrote to memory of 4480 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 107 PID 3360 wrote to memory of 4480 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 107 PID 3360 wrote to memory of 4480 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 107 PID 3360 wrote to memory of 4524 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 108 PID 3360 wrote to memory of 4524 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 108 PID 3360 wrote to memory of 4524 3360 {77349D97-CF6E-42d3-9F30-001CF193F23B}.exe 108 PID 4480 wrote to memory of 4512 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 109 PID 4480 wrote to memory of 4512 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 109 PID 4480 wrote to memory of 4512 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 109 PID 4480 wrote to memory of 4296 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 110 PID 4480 wrote to memory of 4296 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 110 PID 4480 wrote to memory of 4296 4480 {4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe 110 PID 4512 wrote to memory of 532 4512 {322BED09-EE76-4143-8244-F3F7702C2601}.exe 111 PID 4512 wrote to memory of 532 4512 {322BED09-EE76-4143-8244-F3F7702C2601}.exe 111 PID 4512 wrote to memory of 532 4512 {322BED09-EE76-4143-8244-F3F7702C2601}.exe 111 PID 4512 wrote to memory of 1628 4512 {322BED09-EE76-4143-8244-F3F7702C2601}.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_70fac9223aa59f5de310182dfa80b7ce_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\{24462537-EC2A-426b-BE79-0A076857949D}.exeC:\Windows\{24462537-EC2A-426b-BE79-0A076857949D}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exeC:\Windows\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\{E13237B0-381B-425a-9573-F5247D10F4A6}.exeC:\Windows\{E13237B0-381B-425a-9573-F5247D10F4A6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\{88B20206-06C4-4971-88D8-A0CB194ECABB}.exeC:\Windows\{88B20206-06C4-4971-88D8-A0CB194ECABB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\{8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exeC:\Windows\{8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exeC:\Windows\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\{27AA30BC-FF6F-4e46-B427-AD3649DED572}.exeC:\Windows\{27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\{77349D97-CF6E-42d3-9F30-001CF193F23B}.exeC:\Windows\{77349D97-CF6E-42d3-9F30-001CF193F23B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exeC:\Windows\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\{322BED09-EE76-4143-8244-F3F7702C2601}.exeC:\Windows\{322BED09-EE76-4143-8244-F3F7702C2601}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exeC:\Windows\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:532 -
C:\Windows\{F3F145E9-4B98-4ecc-85D3-B9F697829A86}.exeC:\Windows\{F3F145E9-4B98-4ecc-85D3-B9F697829A86}.exe13⤵
- Executes dropped EXE
PID:452
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A6F1~1.EXE > nul13⤵PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{322BE~1.EXE > nul12⤵PID:1628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CBFE~1.EXE > nul11⤵PID:4296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77349~1.EXE > nul10⤵PID:4524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27AA3~1.EXE > nul9⤵PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3908~1.EXE > nul8⤵PID:5008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86405~1.EXE > nul7⤵PID:3208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88B20~1.EXE > nul6⤵PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1323~1.EXE > nul5⤵PID:1932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE9DD~1.EXE > nul4⤵PID:3184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24462~1.EXE > nul3⤵PID:4636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{24462537-EC2A-426b-BE79-0A076857949D}.exe
- Size 216KB
- SHA256 e0244acb98e7855ee200b3f13f4ae70be2b52b9130508e52678c137e380ec329
- MD5 4975774a33845c3cd811f765698aa958
- SHA1 c4f79ed094893f746a10c35c332b1011c7e9ad5d
- SHA512 015fcc6a15fe0673db60b43622423fcd78e1b03730f257e7b30a84220acdf501a9fd537476102410e5806f2eaacfc26418009f606fa793772aaf2d4354df8436
- SSDEEP 3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGflEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{27AA30BC-FF6F-4e46-B427-AD3649DED572}.exe
- Size 216KB
- SHA256 58f788129f5da20e21b4e7253597238b52fd302da3405b44b0cd51ae5b5708b0
- MD5 003ed0c20af5ec0b1e599d18286a0c38
- SHA1 3c09f928b98e08a535e7317f868443373d918445
- SHA512 a89f0df69c5b200b2049b9d2fc7181caae9440d169f616074968cf44ed8c9970a9f4dabeecce7294426d3775972fe7f46d0091827f82d67bb5320f1cab50ab7a
- SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGvlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{322BED09-EE76-4143-8244-F3F7702C2601}.exe
- Size 216KB
- SHA256 3ae0d20f83e0f087c9b65165b407f88f17e9b2b1965b9b1d61cb401e84ef78bd
- MD5 06bf5cedde0226f421ff7962bde5e85e
- SHA1 5ca1f686de30f74746b26eedfcd5e4338f375289
- SHA512 4cf7097f4f56f20f513dc34c6a5c5aa664c9c4a23e5e23117aaab88e9037e26f7e528021036a055f8b5e34c3e72d62cc17db51a45d04403674313fe9718cf4c6
- SSDEEP 3072:jEGh0odl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGflEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4CBFEB3F-65C4-4d22-9B4F-E2CD4B62705E}.exe
- Size 216KB
- SHA256 64edeb5a44aa78050bf0eb6a6598359e596e5d281f36b656fbdcdb6caf4f566d
- MD5 346c6d09b9f1895229ce927c31d6754f
- SHA1 5ab2b544390591296ec36a2174b3530c8e5a2225
- SHA512 25af4ed6ba7dca0695594b1b613f56084317835ec2542c485c23155704e0c9f3a322f4bdd2fb154d06bee5ceacd965b568f80d7d90c7a35cea9c90a0c1d0143d
- SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGzlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5A6F11F7-F6B2-4f46-B46C-4BCD0A06C5EE}.exe
- Size 216KB
- SHA256 74b1dbbb2162594caf9e43ee84e7c54691d26e7c33157fbab089f52f55f60080
- MD5 632c6abd5faabb389772676407ccf5a1
- SHA1 480449f812d6cd1f862eefa88642ae694c21eb69
- SHA512 be232f8b0b7da439d66b003d90c9dc9c69ceb596cae6fa4087583791c4f733e0e6dece0e6bad65399968a90b3dbe1c06ec817eb995ced963bea0257dfa88ca69
- SSDEEP 3072:jEGh0ool+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGKlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{77349D97-CF6E-42d3-9F30-001CF193F23B}.exe
- Size 216KB
- SHA256 712092cfd2eb4c9ab572e94086253b34573a762572781347ef9948232d13bb2d
- MD5 873594385d516ebe44fe29adbbbe7328
- SHA1 b7cfeacd7df122c821abba903958f5c182fa0228
- SHA512 bd97346b19762fdae7ca518e419a24246a67c4264495a1019a32feacdf91c444cf27e1f8e3fe3b7c7f83a8c6372e9b7c39e303f1cded3a83470a4e9bc3f84c9d
- SSDEEP 3072:jEGh0onl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGtlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8640570F-50A3-441f-AAEA-7C7BA7EF6050}.exe
- Size 216KB
- SHA256 285b949bb97f3febe21f631b7bf482530542991bbd32d62f047fc2daa0f0faeb
- MD5 96179ce6ef007374ca48225399a3febe
- SHA1 f8a97966c0e26d1451f59baf8e103b29a4189268
- SHA512 3632dc4edf7d13ef704a9b9b431427805ae29ca8011189932a948be7af7b00928e6599b2184d416f7377a1b6540ddc0c5ddd8c54e470a157ea23f0df1162dd75
- SSDEEP 3072:jEGh0ozl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGxlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{88B20206-06C4-4971-88D8-A0CB194ECABB}.exe
- Size 216KB
- SHA256 cadd09c33bac0b36308f75d3ae3154a9feec56ce91ed9c8f55734af25cd4f2be
- MD5 8e1a3d1f134335f9e36be973815f9076
- SHA1 8aa094813d1709339a906fdf12753ee71be5e437
- SHA512 aa64c15d568764934aa16433c54a68028422571e461581a1d07becfbd47f42cedd61b22ed855223dc7ca415eae70fcda7e79607a6d5a28a8a06579347bf75931
- SSDEEP 3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGLlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B3908AA0-2F55-42ad-9FC4-CEB90479DF32}.exe
- Size 216KB
- SHA256 0d6394c85fb9a651acc5ad21a8ce42ff29a0b56ca22e29e144ab4cd37d6de283
- MD5 c0f8827c156de25a733181b690a4ba6a
- SHA1 104153121364647fe8a060077350daca37f029bf
- SHA512 608db9ae52992b0d2e4f29a2c9b2a01ba8b689fbd2969993a39cca257314b12ab008eff4a1ce0cf54d2ba36dbb454df903307deb8596c84869ccb1c2912b1d1a
- SSDEEP 3072:jEGh0oLl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGFlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E13237B0-381B-425a-9573-F5247D10F4A6}.exe
- Size 216KB
- SHA256 1e7465e872ef943610029793cef27cb03ef123f2d8c2f877b7c77577276247cb
- MD5 97f272f761f721e091e432dbdd18d1bc
- SHA1 6b59ebda00a1dee87cca408f7c57c3caa729ad5a
- SHA512 77c7a181551fd719e9f83cea1feac7efaf0dbb86d9aee816beda710eb0e68f966ad09a5d0344af182de76ea68514506cbb65c5906fcc542319766746b72d05c6
- SSDEEP 3072:jEGh0oPl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG5lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EE9DDECC-834C-46b8-A78F-EC0646D48CE6}.exe
- Size 216KB
- SHA256 3e40630fbeec15f2b466cf1e074f009e9306925964922f8836d860cb99ff39ee
- MD5 c1b8d1d8f40cdfdde00ffc0d8a9cb126
- SHA1 de625ec2b53ef2fff49b508e4f6f0b0fa61ecfb6
- SHA512 5fe6d2dc3bbddea449d4e85c9a30effddc51bedf95bb74aacbfaa4ab0a3b049b2c0877f97ee0a1ee1dc6a418023af13b1a05b0406dc6cbf21b837ae63796ebcf
- SSDEEP 3072:jEGh0ogl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGylEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F3F145E9-4B98-4ecc-85D3-B9F697829A86}.exe
- Size 216KB
- SHA256 20cc79ac98ccc59542e554910cc8fe00d669fbe6f8b911fcfea9ecf333f2975e
- MD5 05fd7c385d38a9597831b68144766dfb
- SHA1 792400d3980d4a5a29d69449d26cd2354744fbb6
- SHA512 53696f5f469207784cd66c826302ea549a9b027d3db0275cdb08e617590e8b1a9d6227fb73e25d1030fff847f6b9435596cb991a8b12fa093e3ef02da890c887
- SSDEEP 3072:jEGh0owl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGKlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP