Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe
- Size 180KB
- Sample240611-pxtprsxfnn
- SHA256 8a9b397836c1d52fd8ced4abae184f2bb7c0a313ba399cc5447d0c066cd7c3fc
- MD5 7f82f0004f1a4f3069a1f83d45be082d
- SHA1 c4fb40d9a4e932a099313e16164addc99855a986
- SHA512 2d58fbac05d1e1c719ce2c4de27b5facd7baa27bc5a52c43f346b8626aedd82f67dc964c5c2ead907330b1008f1ada56dfa0cc5b096915669c7d2ea057f0f383
- SSDEEP 3072:jEGh0oplfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGTl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000233b6-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233b7-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233bb-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233be-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233c5-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233be-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233c5-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233be-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233c5-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233be-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233c5-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233be-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}\stubpath = "C:\\Windows\\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe" {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A} {EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}\stubpath = "C:\\Windows\\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}.exe" {EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F} {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1145F2A3-B1D3-4897-9F3C-4F84305541C6} {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1145F2A3-B1D3-4897-9F3C-4F84305541C6}\stubpath = "C:\\Windows\\{1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe" {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E01C95F8-C084-40af-BCEF-2EC34F33002E} {9920A441-0290-419f-A6D7-3DAEE998D925}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6511539F-4251-4e0c-8B4A-D0984EC06A25} {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6511539F-4251-4e0c-8B4A-D0984EC06A25}\stubpath = "C:\\Windows\\{6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe" {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7} {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5225C099-444C-429c-BEB6-B44638F2BBC4} {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}\stubpath = "C:\\Windows\\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe" 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC} {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC}\stubpath = "C:\\Windows\\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe" {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9920A441-0290-419f-A6D7-3DAEE998D925} {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{233B3A21-5EE7-4beb-9765-95E21E0CA80B} {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7}\stubpath = "C:\\Windows\\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe" {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5225C099-444C-429c-BEB6-B44638F2BBC4}\stubpath = "C:\\Windows\\{5225C099-444C-429c-BEB6-B44638F2BBC4}.exe" {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF} 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEB35307-70FC-4766-A2CF-B38D4D2E7608}\stubpath = "C:\\Windows\\{BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe" {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9920A441-0290-419f-A6D7-3DAEE998D925}\stubpath = "C:\\Windows\\{9920A441-0290-419f-A6D7-3DAEE998D925}.exe" {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E01C95F8-C084-40af-BCEF-2EC34F33002E}\stubpath = "C:\\Windows\\{E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe" {9920A441-0290-419f-A6D7-3DAEE998D925}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{233B3A21-5EE7-4beb-9765-95E21E0CA80B}\stubpath = "C:\\Windows\\{233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe" {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEB35307-70FC-4766-A2CF-B38D4D2E7608} {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe - Executes dropped EXE 12 IoCs
pid Process 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 2396 {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe 4992 {EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe 4996 {9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{9920A441-0290-419f-A6D7-3DAEE998D925}.exe {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe File created C:\Windows\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe File created C:\Windows\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe File created C:\Windows\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}.exe {EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe File created C:\Windows\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe File created C:\Windows\{1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe File created C:\Windows\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe File created C:\Windows\{6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe File created C:\Windows\{5225C099-444C-429c-BEB6-B44638F2BBC4}.exe {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe File created C:\Windows\{BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe File created C:\Windows\{E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe {9920A441-0290-419f-A6D7-3DAEE998D925}.exe File created C:\Windows\{233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe Token: SeIncBasePriorityPrivilege 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe Token: SeIncBasePriorityPrivilege 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe Token: SeIncBasePriorityPrivilege 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe Token: SeIncBasePriorityPrivilege 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe Token: SeIncBasePriorityPrivilege 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe Token: SeIncBasePriorityPrivilege 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe Token: SeIncBasePriorityPrivilege 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe Token: SeIncBasePriorityPrivilege 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe Token: SeIncBasePriorityPrivilege 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe Token: SeIncBasePriorityPrivilege 2396 {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe Token: SeIncBasePriorityPrivilege 4992 {EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4392 wrote to memory of 2904 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe 80 PID 4392 wrote to memory of 2904 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe 80 PID 4392 wrote to memory of 2904 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe 80 PID 4392 wrote to memory of 3968 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe 81 PID 4392 wrote to memory of 3968 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe 81 PID 4392 wrote to memory of 3968 4392 2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe 81 PID 2904 wrote to memory of 1120 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 82 PID 2904 wrote to memory of 1120 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 82 PID 2904 wrote to memory of 1120 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 82 PID 2904 wrote to memory of 4644 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 83 PID 2904 wrote to memory of 4644 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 83 PID 2904 wrote to memory of 4644 2904 {077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe 83 PID 1120 wrote to memory of 1168 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 86 PID 1120 wrote to memory of 1168 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 86 PID 1120 wrote to memory of 1168 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 86 PID 1120 wrote to memory of 4904 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 87 PID 1120 wrote to memory of 4904 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 87 PID 1120 wrote to memory of 4904 1120 {1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe 87 PID 1168 wrote to memory of 4988 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 92 PID 1168 wrote to memory of 4988 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 92 PID 1168 wrote to memory of 4988 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 92 PID 1168 wrote to memory of 860 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 93 PID 1168 wrote to memory of 860 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 93 PID 1168 wrote to memory of 860 1168 {BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe 93 PID 4988 wrote to memory of 2900 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 95 PID 4988 wrote to memory of 2900 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 95 PID 4988 wrote to memory of 2900 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 95 PID 4988 wrote to memory of 2084 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 96 PID 4988 wrote to memory of 2084 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 96 PID 4988 wrote to memory of 2084 4988 {A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe 96 PID 2900 wrote to memory of 3708 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 97 PID 2900 wrote to memory of 3708 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 97 PID 2900 wrote to memory of 3708 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 97 PID 2900 wrote to memory of 4920 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 98 PID 2900 wrote to memory of 4920 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 98 PID 2900 wrote to memory of 4920 2900 {9920A441-0290-419f-A6D7-3DAEE998D925}.exe 98 PID 3708 wrote to memory of 2240 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 99 PID 3708 wrote to memory of 2240 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 99 PID 3708 wrote to memory of 2240 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 99 PID 3708 wrote to memory of 4764 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 100 PID 3708 wrote to memory of 4764 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 100 PID 3708 wrote to memory of 4764 3708 {E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe 100 PID 2240 wrote to memory of 1848 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 101 PID 2240 wrote to memory of 1848 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 101 PID 2240 wrote to memory of 1848 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 101 PID 2240 wrote to memory of 3552 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 102 PID 2240 wrote to memory of 3552 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 102 PID 2240 wrote to memory of 3552 2240 {233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe 102 PID 1848 wrote to memory of 3920 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 103 PID 1848 wrote to memory of 3920 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 103 PID 1848 wrote to memory of 3920 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 103 PID 1848 wrote to memory of 3308 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 104 PID 1848 wrote to memory of 3308 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 104 PID 1848 wrote to memory of 3308 1848 {6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe 104 PID 3920 wrote to memory of 2396 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 105 PID 3920 wrote to memory of 2396 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 105 PID 3920 wrote to memory of 2396 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 105 PID 3920 wrote to memory of 2360 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 106 PID 3920 wrote to memory of 2360 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 106 PID 3920 wrote to memory of 2360 3920 {21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe 106 PID 2396 wrote to memory of 4992 2396 {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe 107 PID 2396 wrote to memory of 4992 2396 {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe 107 PID 2396 wrote to memory of 4992 2396 {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe 107 PID 2396 wrote to memory of 2920 2396 {5225C099-444C-429c-BEB6-B44638F2BBC4}.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_7f82f0004f1a4f3069a1f83d45be082d_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exeC:\Windows\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\{1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exeC:\Windows\{1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\{BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exeC:\Windows\{BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exeC:\Windows\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\{9920A441-0290-419f-A6D7-3DAEE998D925}.exeC:\Windows\{9920A441-0290-419f-A6D7-3DAEE998D925}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\{E01C95F8-C084-40af-BCEF-2EC34F33002E}.exeC:\Windows\{E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\{233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exeC:\Windows\{233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\{6511539F-4251-4e0c-8B4A-D0984EC06A25}.exeC:\Windows\{6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exeC:\Windows\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\{5225C099-444C-429c-BEB6-B44638F2BBC4}.exeC:\Windows\{5225C099-444C-429c-BEB6-B44638F2BBC4}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exeC:\Windows\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4992 -
C:\Windows\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}.exeC:\Windows\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}.exe13⤵
- Executes dropped EXE
PID:4996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF4C5~1.EXE > nul13⤵PID:4808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5225C~1.EXE > nul12⤵PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21FC4~1.EXE > nul11⤵PID:2360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65115~1.EXE > nul10⤵PID:3308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{233B3~1.EXE > nul9⤵PID:3552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E01C9~1.EXE > nul8⤵PID:4764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9920A~1.EXE > nul7⤵PID:4920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6373~1.EXE > nul6⤵PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BEB35~1.EXE > nul5⤵PID:860
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1145F~1.EXE > nul4⤵PID:4904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{077D8~1.EXE > nul3⤵PID:4644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{077D8F39-AB54-4b7e-8AEA-CD9B13DFD8FF}.exe
- Size 180KB
- SHA256 c6fd227fdd5f4ed9a192aae158604c2f886e5258c3a2345ac2dd1c8593e722b0
- MD5 9f44708c365c0f35dc1c0f4d80f2218b
- SHA1 f6376eee9a09ccfd797587adf4c2892e0382a0aa
- SHA512 f87b948ed2203b755ee648c00cddd8365b125e1ac0fb15872c6423c6a9c350526b9910bf9dd6b53794ad01da96c6960c5ecdebec3ddebaf97e3bfc21eefba151
- SSDEEP 3072:jEGh0oZlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGDl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1145F2A3-B1D3-4897-9F3C-4F84305541C6}.exe
- Size 180KB
- SHA256 b1b8d0ce9fbd048aecd1fa31ddff9c7846a639d6383b2d26af89568fc8b060a9
- MD5 ca619d51f369fb656fa04b5979e6d2d1
- SHA1 0cec524135c9324a65c755ed6953a75c3a0a6392
- SHA512 f797bda65736a616b25a3fa7e789cf45770d4c673adf0f725c7304ee09ac8e580f5a362aecc396d1cb87fef6904455aeeea871ecbaa58d41e0d32fdfb095c489
- SSDEEP 3072:jEGh0ojlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGll5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{21FC4846-29B1-43dc-8AEC-C37E9EF093B7}.exe
- Size 180KB
- SHA256 fa9f3ae7ccf6de56db6f94623a61f6f9b039a33182a86fdab6b50e80282c9d44
- MD5 3330e02c68954824181caa5f0df86301
- SHA1 61fdd37269b813f6515006964240aa75fd817435
- SHA512 dd1dec5e8403fbc2b6599c54abef810d795456cb8fdbea7e1886d32f8e1fe346065e28ebfe5fd86e6fa023156367bcaf6fc3659e42d7a80a6fce2de157d34bb4
- SSDEEP 3072:jEGh0omlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGkl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{233B3A21-5EE7-4beb-9765-95E21E0CA80B}.exe
- Size 180KB
- SHA256 5b4824f8f34c9cdb1c5b3a4c6b4b9abd89b2aff2c333e2497aa48cb8db5c124f
- MD5 98b0565201f6f5d9a7abd6e9a8de000f
- SHA1 5f54f447c4562b996da45db016871865d2186bed
- SHA512 4720554f577101a3477bf2720b807f1d90af0480a7797336f5a765991c6667f83a3e4aab238962fdcf91ab81fdcb862f16b459f759f04fbc9ee96b84ea755f68
- SSDEEP 3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGql5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5225C099-444C-429c-BEB6-B44638F2BBC4}.exe
- Size 180KB
- SHA256 b0b0eefac6008d9aacb0d85cbde13134bcc0a77ec616433e048d04c347aa01d9
- MD5 8fe9c875f326a306b2a554e437aa9120
- SHA1 e989604f49dec7ef4f8189e577c42fa783c9ad06
- SHA512 d62d0e13736f01aa7255f6586225ba50bb44aa43034ba8a27a49710569c2d82573a8d34d4c69aaaaf8d010307b13b9f67fefec58ee84a2297d2272318214d43a
- SSDEEP 3072:jEGh0oVlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGnl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6511539F-4251-4e0c-8B4A-D0984EC06A25}.exe
- Size 180KB
- SHA256 edf757e709771c50909c90f3295247e2a186097253c2ab23afc5407c1b52a4cd
- MD5 6ec7c3394d8fb7fd6d36ee446c318ac4
- SHA1 458244c3ad2481aa176f72ffbfd4791854a3da28
- SHA512 4d3cab3158e3beb0a34c18f39676189015de1cda1b1cab36b26587c172ccb386e66fedd4fec1222d3f7bee4dab21949a5958388bc7dfec8492bd4a24342c92fa
- SSDEEP 3072:jEGh0o+lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG4l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9920A441-0290-419f-A6D7-3DAEE998D925}.exe
- Size 180KB
- SHA256 cadad4d3a07199528376e03c8066264e9ec79e05600bd6491c1a888e24d2ebf7
- MD5 82828a60a32399f36a4e707aa005924d
- SHA1 e4ccb5630a5a97a1f568a4728309e413d07e3489
- SHA512 060785f8eca53e4d0131a86b35d981102722c3f84a012ca976271806d852837c5ab04f71bf1cb2baf12a5548720dcdb27fe51bc20612ec09efcde10ff137839c
- SSDEEP 3072:jEGh0oRlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGTl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9E1C4A35-A33C-42ab-AF3A-C740FF95FE2A}.exe
- Size 180KB
- SHA256 e8817507708b46f32d8570e47dc4d4f2f6abd7a97ce0318ff971b040f503f536
- MD5 e330c54f57641158690b788d09d0cdd6
- SHA1 ea05928be0334b0aef2ab00e9981658c462ce95e
- SHA512 f2e0f22e2cc066c6a629b662efacdb63262e02bf09d6c2c5da8f33184b15e66cc7f20c6e475e05668bd3ee70a2b3582182cebe1554b9cc51b3a201519f2696f7
- SSDEEP 3072:jEGh0oTlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG1l5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A6373D61-50BF-410f-B1D6-2EB6D260FEEC}.exe
- Size 180KB
- SHA256 222201ad5b333d70059c8b14eca66c2cca97cd8627c5b991d69b4b96e15b0290
- MD5 f5d1dca9ea18f06636baebff81df410b
- SHA1 520b407a425286a9be61f948b4f7b8d69daca82f
- SHA512 841c734fbca43804c135f626567f0a8060214aa773e4bc003efbcfe8a5c82abd691a54eb02ee8caf2333348492f84193e97961496f10f41ee880471c356d06bf
- SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGwl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BEB35307-70FC-4766-A2CF-B38D4D2E7608}.exe
- Size 180KB
- SHA256 52a7564ef29834de620454366e920dbe112f68094f8d0f50dc359ab7a4412072
- MD5 7491b0c24b8aad1df32e45b0b768c77c
- SHA1 0661ff5e4ea377753bbd767b592f6583b1bbf176
- SHA512 698b6cd285f37267d476f697068e7ceca45fde8b06f212b11fbd3a7075c59663f7fd5bb5cb4feae9869077f49569061e9e00dc60d8fa253abedfb50d4e85bf9b
- SSDEEP 3072:jEGh0o/lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGBl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E01C95F8-C084-40af-BCEF-2EC34F33002E}.exe
- Size 180KB
- SHA256 1fdafd694569bdc9110a670c20e4a50b68aa8a895cae2558305436ffce3d7196
- MD5 0790c2319ccc188c8240297feadba89e
- SHA1 df2d776e13a72524142cb0876cc0ac72b0fb198a
- SHA512 3a45b5a79b888cb4973b6446256d25c7c08cee4b12fcb928aa1de0ec2194ac95ac002d2629923a2d496b52443975d8e80c79abbe74b7f1f429ef84c59fc2cf82
- SSDEEP 3072:jEGh0ollfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGjl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF4C5B0C-6D3B-423d-ACCD-8C69158DD39F}.exe
- Size 180KB
- SHA256 6aa30cea941d378c9eb39627b39e02b6e31dee0a66b7eb52996a0675e99de041
- MD5 cc910972600f87d3ea8d2066ae3ae474
- SHA1 6f6368798fcf90f50ea1ff3c590aa7645c0c543e
- SHA512 8a881f2f3794ec67caebb748efe387f8b9e02286a546044d2fdc9435230bb6dbd4ab2352eb00211ad1f4c59a9bb6eff228e6611211773fa22d77caeb0738f6b6
- SSDEEP 3072:jEGh0ohlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGDl5eKcAEc
- MD5 SHA1 SHA512 SSDEEP