Analysis
- max time kernel
149s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe
- Size 192KB
- Sample240611-px7lmaxbrh
- SHA256 92d7cdeed1193fe8f36318a5a9641cfea848eaa7483470b0ed645b90b7ae8aa0
- MD5 8273022c61f059fb0026adb6d70e12f0
- SHA1 1ab1c24774d07dc82187c8b6d7c732e2d51ec4d3
- SHA512 9db20de553d64a3d7cc1445778590e5086bd6fba2e37a3297dabf6473d9091b841c13968d9512839b7095f2b1bcc141b25e1c4603d8ba242563fa3bcd25db6f7
- SSDEEP 1536:1EGh0oLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oLl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0007000000022974-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023378-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233fd-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023401-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023406-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023401-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023406-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023401-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023406-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023401-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023406-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023401-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2}\stubpath = "C:\\Windows\\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe" {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1553488-8C67-46f6-BAC7-1177F17A4F7D} {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3259D228-8ED4-46b6-B491-47057953D975}\stubpath = "C:\\Windows\\{3259D228-8ED4-46b6-B491-47057953D975}.exe" {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9} {3259D228-8ED4-46b6-B491-47057953D975}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}\stubpath = "C:\\Windows\\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe" {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{347DBE5A-B476-40f3-B2AF-116DD2C07748}\stubpath = "C:\\Windows\\{347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe" 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E623DC71-FD3B-49a2-B216-3BA15304D56C} {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}\stubpath = "C:\\Windows\\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe" {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86C8E393-2BAF-4741-8DD8-39BB59F1738A} {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86C8E393-2BAF-4741-8DD8-39BB59F1738A}\stubpath = "C:\\Windows\\{86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe" {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D} {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2} {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1553488-8C67-46f6-BAC7-1177F17A4F7D}\stubpath = "C:\\Windows\\{B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe" {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3259D228-8ED4-46b6-B491-47057953D975} {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E623DC71-FD3B-49a2-B216-3BA15304D56C}\stubpath = "C:\\Windows\\{E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe" {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{357796E3-11DB-456f-BB2D-3DF798C9557B}\stubpath = "C:\\Windows\\{357796E3-11DB-456f-BB2D-3DF798C9557B}.exe" {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9C1A406-41CF-49a6-98C3-BBFA26C50835}\stubpath = "C:\\Windows\\{F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe" {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}\stubpath = "C:\\Windows\\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe" {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}\stubpath = "C:\\Windows\\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}.exe" {3259D228-8ED4-46b6-B491-47057953D975}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{347DBE5A-B476-40f3-B2AF-116DD2C07748} 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52} {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{357796E3-11DB-456f-BB2D-3DF798C9557B} {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9C1A406-41CF-49a6-98C3-BBFA26C50835} {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF} {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe - Executes dropped EXE 12 IoCs
pid Process 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 1688 {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe 3964 {3259D228-8ED4-46b6-B491-47057953D975}.exe 3212 {AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{3259D228-8ED4-46b6-B491-47057953D975}.exe {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe File created C:\Windows\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}.exe {3259D228-8ED4-46b6-B491-47057953D975}.exe File created C:\Windows\{E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe File created C:\Windows\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe File created C:\Windows\{357796E3-11DB-456f-BB2D-3DF798C9557B}.exe {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe File created C:\Windows\{F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe File created C:\Windows\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe File created C:\Windows\{B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe File created C:\Windows\{347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe File created C:\Windows\{86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe File created C:\Windows\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe File created C:\Windows\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe Token: SeIncBasePriorityPrivilege 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe Token: SeIncBasePriorityPrivilege 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe Token: SeIncBasePriorityPrivilege 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe Token: SeIncBasePriorityPrivilege 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe Token: SeIncBasePriorityPrivilege 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe Token: SeIncBasePriorityPrivilege 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe Token: SeIncBasePriorityPrivilege 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe Token: SeIncBasePriorityPrivilege 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe Token: SeIncBasePriorityPrivilege 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe Token: SeIncBasePriorityPrivilege 1688 {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe Token: SeIncBasePriorityPrivilege 3964 {3259D228-8ED4-46b6-B491-47057953D975}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 692 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe 85 PID 3692 wrote to memory of 692 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe 85 PID 3692 wrote to memory of 692 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe 85 PID 3692 wrote to memory of 4848 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe 86 PID 3692 wrote to memory of 4848 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe 86 PID 3692 wrote to memory of 4848 3692 2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe 86 PID 692 wrote to memory of 316 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 87 PID 692 wrote to memory of 316 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 87 PID 692 wrote to memory of 316 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 87 PID 692 wrote to memory of 1772 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 88 PID 692 wrote to memory of 1772 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 88 PID 692 wrote to memory of 1772 692 {347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe 88 PID 316 wrote to memory of 4080 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 91 PID 316 wrote to memory of 4080 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 91 PID 316 wrote to memory of 4080 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 91 PID 316 wrote to memory of 1820 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 92 PID 316 wrote to memory of 1820 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 92 PID 316 wrote to memory of 1820 316 {E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe 92 PID 4080 wrote to memory of 792 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 97 PID 4080 wrote to memory of 792 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 97 PID 4080 wrote to memory of 792 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 97 PID 4080 wrote to memory of 3824 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 98 PID 4080 wrote to memory of 3824 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 98 PID 4080 wrote to memory of 3824 4080 {AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe 98 PID 792 wrote to memory of 3032 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 100 PID 792 wrote to memory of 3032 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 100 PID 792 wrote to memory of 3032 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 100 PID 792 wrote to memory of 3384 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 101 PID 792 wrote to memory of 3384 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 101 PID 792 wrote to memory of 3384 792 {86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe 101 PID 3032 wrote to memory of 4072 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 102 PID 3032 wrote to memory of 4072 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 102 PID 3032 wrote to memory of 4072 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 102 PID 3032 wrote to memory of 3192 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 103 PID 3032 wrote to memory of 3192 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 103 PID 3032 wrote to memory of 3192 3032 {357796E3-11DB-456f-BB2D-3DF798C9557B}.exe 103 PID 4072 wrote to memory of 1508 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 104 PID 4072 wrote to memory of 1508 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 104 PID 4072 wrote to memory of 1508 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 104 PID 4072 wrote to memory of 4172 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 105 PID 4072 wrote to memory of 4172 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 105 PID 4072 wrote to memory of 4172 4072 {F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe 105 PID 1508 wrote to memory of 4404 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 106 PID 1508 wrote to memory of 4404 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 106 PID 1508 wrote to memory of 4404 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 106 PID 1508 wrote to memory of 3320 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 107 PID 1508 wrote to memory of 3320 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 107 PID 1508 wrote to memory of 3320 1508 {FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe 107 PID 4404 wrote to memory of 4392 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 108 PID 4404 wrote to memory of 4392 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 108 PID 4404 wrote to memory of 4392 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 108 PID 4404 wrote to memory of 4624 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 109 PID 4404 wrote to memory of 4624 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 109 PID 4404 wrote to memory of 4624 4404 {1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe 109 PID 4392 wrote to memory of 1688 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 110 PID 4392 wrote to memory of 1688 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 110 PID 4392 wrote to memory of 1688 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 110 PID 4392 wrote to memory of 3912 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 111 PID 4392 wrote to memory of 3912 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 111 PID 4392 wrote to memory of 3912 4392 {BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe 111 PID 1688 wrote to memory of 3964 1688 {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe 112 PID 1688 wrote to memory of 3964 1688 {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe 112 PID 1688 wrote to memory of 3964 1688 {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe 112 PID 1688 wrote to memory of 3504 1688 {B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_8273022c61f059fb0026adb6d70e12f0_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\{347DBE5A-B476-40f3-B2AF-116DD2C07748}.exeC:\Windows\{347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\{E623DC71-FD3B-49a2-B216-3BA15304D56C}.exeC:\Windows\{E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exeC:\Windows\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\{86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exeC:\Windows\{86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\{357796E3-11DB-456f-BB2D-3DF798C9557B}.exeC:\Windows\{357796E3-11DB-456f-BB2D-3DF798C9557B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\{F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exeC:\Windows\{F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exeC:\Windows\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exeC:\Windows\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exeC:\Windows\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\{B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exeC:\Windows\{B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\{3259D228-8ED4-46b6-B491-47057953D975}.exeC:\Windows\{3259D228-8ED4-46b6-B491-47057953D975}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}.exeC:\Windows\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}.exe13⤵
- Executes dropped EXE
PID:3212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3259D~1.EXE > nul13⤵PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1553~1.EXE > nul12⤵PID:3504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD2FA~1.EXE > nul11⤵PID:3912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B4F5~1.EXE > nul10⤵PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFE79~1.EXE > nul9⤵PID:3320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9C1A~1.EXE > nul8⤵PID:4172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35779~1.EXE > nul7⤵PID:3192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86C8E~1.EXE > nul6⤵PID:3384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD54A~1.EXE > nul5⤵PID:3824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E623D~1.EXE > nul4⤵PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{347DB~1.EXE > nul3⤵PID:1772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1B4F5EC9-45B8-4442-9CB1-E267579F15D2}.exe
- Size 192KB
- SHA256 460936ccdd19dbd97c071df825ecd7c06d7fbfde4dc00c6ef4947189bd1efe88
- MD5 1a952184539b64025e408280039d6185
- SHA1 67ca0310af3acaa1550cdbf37f3826139048665e
- SHA512 3d2c7747a3d5f22215a2a4947e398b1ef49db8ec783a2356dc7594a356b41fc2ce02e588dde1ea3857b16a62dc70c4e303651d0bd8fd166f9fb19803a2015bb9
- SSDEEP 1536:1EGh0oEl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oEl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3259D228-8ED4-46b6-B491-47057953D975}.exe
- Size 192KB
- SHA256 dccfe60e10f5d0a8dc2b0782d7b53b3030994af7bcfd280769a101650da39320
- MD5 0e645a0fa3d91c1b037f790f8ff03e75
- SHA1 c564ee32e0e8c14250af27c59a7cd4d734811f22
- SHA512 d0bcec5e38abce99ecb511f5b2eec3c05572050aec5607ed17ade02474b4b901268ff28de1aa35a15638b65105240cb258f75da39ad12c589d4f41ac5de12168
- SSDEEP 1536:1EGh0o1l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o1l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{347DBE5A-B476-40f3-B2AF-116DD2C07748}.exe
- Size 192KB
- SHA256 37f039572ecfb9d3a5a43098798d280c88ac58889880fdf3dfbe77657c1767b7
- MD5 3b56ce5e28c27192eeef2cbd703fc059
- SHA1 f3685971feb4de4adefc4115d53541b999a096eb
- SHA512 373b3c3683fbcb4ad1279d0cfbf0be67c0096be41fdb6b0ccb2b65f7833deb84601394823ae32982fe5628d3a8fd30965e8d0990847fe27ced4718c4527e3cb7
- SSDEEP 1536:1EGh0onl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0onl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{357796E3-11DB-456f-BB2D-3DF798C9557B}.exe
- Size 192KB
- SHA256 a3c8ff175cf2bed331282ce8fa1a5082223b6a2e4fc8b9d3f5642d646c255ead
- MD5 a7d7cddebd4c7a2886c4201edce481c6
- SHA1 40ae2ccea1ca73f05ff382a59545655ffed8308b
- SHA512 27989c8d8883bb2f970ca23e479fe79decde99584b22a5f52910914ed245c6dfcf25b6e6d405e709ceca09dadaf496461d5ae595afaf81b2fe75b74900f7780b
- SSDEEP 1536:1EGh0o4l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o4l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{86C8E393-2BAF-4741-8DD8-39BB59F1738A}.exe
- Size 192KB
- SHA256 37d216edd03bc9bb1b18d8da345442be92a12e7c6bda15cdda92157edf154096
- MD5 846d1efce39246403707b015426f1d68
- SHA1 ef93cf7265b44a4a2da3f7a2f9930da2cc392d7c
- SHA512 05192b2b43dc629303d5af0b1c4af501856200bdc958944467a3ef70097a4ca9c80ef838ba90785e30c38a94993caae666bf8d590c32b859791754ab6606a030
- SSDEEP 1536:1EGh0oOl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oOl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AD4E25F0-9539-41f8-BF7D-6A7F1994E7B9}.exe
- Size 192KB
- SHA256 f92dc6492623f2fb1a83d7e63bd0fdbff079d5b76d04183c5b6c3adfb539146f
- MD5 ed320a1304941da7ace3059491260ea8
- SHA1 e6bf4a4beed0d13d37f47090fc986dd1aede0eac
- SHA512 fc64c729fb3af7c957bcbe5a886719845589d60597133f99c09580e5f7a3f88c4bd64fdf588a914ea3565f197fe53263bb6fc7d3088cc8b53350e896ea423b76
- SSDEEP 1536:1EGh0oVLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o5l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AD54A153-FDEB-4b75-8A8F-CAB2A9DB5A52}.exe
- Size 192KB
- SHA256 ba17cae0cbd77188d235fb4a435bee0356a787e0c4156bfdd9a29252422abee4
- MD5 2c0107d7550bc7f2a04a0cb910c83666
- SHA1 58f0b146d8b12d9dbf92c1c7374f1757abd3385b
- SHA512 6c4dab7c6039bcd8999e5d7eb049811fc33c634a558a2396f7a6fe7907cfbe5b9d4811a869734ca77d7ce818bf42805a4732a8b885961f8ac769e7d69b80c71f
- SSDEEP 1536:1EGh0oVl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oVl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B1553488-8C67-46f6-BAC7-1177F17A4F7D}.exe
- Size 192KB
- SHA256 7acbe1cd3bb66c098eff215753370124731b40a809cff9ad98403a7a01df39f8
- MD5 25d5af3f6cd420af3b5e816a3dbc2ae3
- SHA1 7c669017eab8252f86f4ee640d3c1cee75bcaa81
- SHA512 fbf0424d810a8df9bdfc784c444c0644e6ac4744507fb6093b9d3ec8da633b63f9575277476bb420aaebaac5b8b7726fcc076a0645e66660dc35931713f8b23e
- SSDEEP 1536:1EGh0oFl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oFl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BD2FA1C2-B625-45ad-8FF7-A3DFBE9B86CF}.exe
- Size 192KB
- SHA256 dafcc84db46b362a8bed05fdf8f8a6eb2e4a80dadee594dae20f357a4e5fc449
- MD5 6c7c4bfad38b1271ba2c013f6278f2f7
- SHA1 c8d45b7f8a7a67be35d6142f8ccd3bf984e242a2
- SHA512 ae5c409aa1e6b9d8af6ce1232bacc1b7b65a6b0d77a909807af0dd67d36fda7c1902db55eaaf9988a84e1955739e5f4ceda1e3b12ed553f30ba421650e64ece8
- SSDEEP 1536:1EGh0oWl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oWl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E623DC71-FD3B-49a2-B216-3BA15304D56C}.exe
- Size 192KB
- SHA256 d91539b363349619365078aae21f6213e1a242b38fb7f244ce2d15421454f032
- MD5 28b1e243e3651daa6ef5974951557a8a
- SHA1 5b62ba648a840a866fa28347cbe02902d66bf8cf
- SHA512 875867902d903b6120b6366fcdf9011f68a4f7aea025732e671f8b119101362af03f39fc846d43757e30fd7184e9f545ec84a305534c79cf3aa111fec8f84c24
- SSDEEP 1536:1EGh0oQl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oQl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F9C1A406-41CF-49a6-98C3-BBFA26C50835}.exe
- Size 192KB
- SHA256 8b0435ef6447b73b37b06901a7e4d763228bc6ee546bfd6f4fe207a1bba70942
- MD5 d6738db67b405e35c671fe8f3663757b
- SHA1 21e2838ddebda2d8e6868547bb6a2a65b70ab433
- SHA512 4925e4c221309fce0f7eb49a5044edd10078256298dc860ec8c3e527cb83f555920122f91a93de3f888b2115d1af6991af643a8af375d441065e51764e083b4f
- SSDEEP 1536:1EGh0oil15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oil1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FFE79A4E-DD7C-49dc-9CD9-8EEA4CAF0A6D}.exe
- Size 192KB
- SHA256 ae6ec3092af6d25fb8ba7531bc388f234895cae2b98e806fc8a28728e69f11b0
- MD5 826fa67218a38aeb7fa701cfbc70f7e5
- SHA1 aa58dc7eddb895d26ee07fbcf2f4f337712c992c
- SHA512 f8483bcbc52386724e835cb15e3fdbcb598bbc4b4d6a44d919f6f55b33e9da5987bb7a92152c075078528ca240479ea29c040958df215b21cf89ffc84cd71f99
- SSDEEP 1536:1EGh0ool15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ool1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP