Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe
- Size 344KB
- Sample240613-dfjyfssbke
- SHA256 3af09f49881d1e39015b9142ba31bad5803982fffa8c8beb6cfeefe3128df46f
- MD5 940a0f511b3a7b377694a9a6703a645e
- SHA1 d1857722fadf883ea5a6fb499026d7cf052d99d6
- SHA512 d145333f1f7564946588ba2cb1dcfabb3b25b6fdaf445f380013c986105da07a66a1342707b2f253134f33cea6889092d4b7cb466e798884296df853be70dab5
- SSDEEP 3072:mEGh0oqlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGAlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000233c2-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233c3-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233c7-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233ca-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233d1-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233ca-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233d1-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233ca-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233d1-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233ca-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233d1-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233ca-45.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F12C34C4-6145-4876-A5A8-B6FDBC06A855} 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91490427-0B2C-4310-80C9-5F2BCD6FACE5} {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A8EB465-7530-465d-AAE5-FCDC308531CA}\stubpath = "C:\\Windows\\{1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe" {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}\stubpath = "C:\\Windows\\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe" {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38092E1D-234E-4dea-8793-9C9528EC3B7B} {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28CB8670-7571-4de0-9679-F5564EB441F4} {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28CB8670-7571-4de0-9679-F5564EB441F4}\stubpath = "C:\\Windows\\{28CB8670-7571-4de0-9679-F5564EB441F4}.exe" {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1}\stubpath = "C:\\Windows\\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe" {28CB8670-7571-4de0-9679-F5564EB441F4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}\stubpath = "C:\\Windows\\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe" {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA} {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}\stubpath = "C:\\Windows\\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe" {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38092E1D-234E-4dea-8793-9C9528EC3B7B}\stubpath = "C:\\Windows\\{38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe" {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F12C34C4-6145-4876-A5A8-B6FDBC06A855}\stubpath = "C:\\Windows\\{F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe" 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA} {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}\stubpath = "C:\\Windows\\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe" {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A8EB465-7530-465d-AAE5-FCDC308531CA} {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5} {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA1A6227-0762-4b19-A251-7E389B5ECD92}\stubpath = "C:\\Windows\\{CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe" {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F76EFF1F-B18F-40c8-8292-955C2214ED15}\stubpath = "C:\\Windows\\{F76EFF1F-B18F-40c8-8292-955C2214ED15}.exe" {58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91490427-0B2C-4310-80C9-5F2BCD6FACE5}\stubpath = "C:\\Windows\\{91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe" {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895} {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA1A6227-0762-4b19-A251-7E389B5ECD92} {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1} {28CB8670-7571-4de0-9679-F5564EB441F4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F76EFF1F-B18F-40c8-8292-955C2214ED15} {58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe - Executes dropped EXE 12 IoCs
pid Process 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 4584 {28CB8670-7571-4de0-9679-F5564EB441F4}.exe 2576 {58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe 64 {F76EFF1F-B18F-40c8-8292-955C2214ED15}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe File created C:\Windows\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe File created C:\Windows\{1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe File created C:\Windows\{38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe File created C:\Windows\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe File created C:\Windows\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe File created C:\Windows\{28CB8670-7571-4de0-9679-F5564EB441F4}.exe {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe File created C:\Windows\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe {28CB8670-7571-4de0-9679-F5564EB441F4}.exe File created C:\Windows\{F76EFF1F-B18F-40c8-8292-955C2214ED15}.exe {58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe File created C:\Windows\{F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe File created C:\Windows\{91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe File created C:\Windows\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe Token: SeIncBasePriorityPrivilege 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe Token: SeIncBasePriorityPrivilege 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe Token: SeIncBasePriorityPrivilege 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe Token: SeIncBasePriorityPrivilege 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe Token: SeIncBasePriorityPrivilege 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe Token: SeIncBasePriorityPrivilege 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe Token: SeIncBasePriorityPrivilege 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe Token: SeIncBasePriorityPrivilege 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe Token: SeIncBasePriorityPrivilege 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe Token: SeIncBasePriorityPrivilege 4584 {28CB8670-7571-4de0-9679-F5564EB441F4}.exe Token: SeIncBasePriorityPrivilege 2576 {58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2128 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe 82 PID 1976 wrote to memory of 2128 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe 82 PID 1976 wrote to memory of 2128 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe 82 PID 1976 wrote to memory of 3124 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe 83 PID 1976 wrote to memory of 3124 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe 83 PID 1976 wrote to memory of 3124 1976 2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe 83 PID 2128 wrote to memory of 1368 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 84 PID 2128 wrote to memory of 1368 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 84 PID 2128 wrote to memory of 1368 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 84 PID 2128 wrote to memory of 1292 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 85 PID 2128 wrote to memory of 1292 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 85 PID 2128 wrote to memory of 1292 2128 {F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe 85 PID 1368 wrote to memory of 412 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 88 PID 1368 wrote to memory of 412 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 88 PID 1368 wrote to memory of 412 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 88 PID 1368 wrote to memory of 3388 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 89 PID 1368 wrote to memory of 3388 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 89 PID 1368 wrote to memory of 3388 1368 {91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe 89 PID 412 wrote to memory of 3960 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 94 PID 412 wrote to memory of 3960 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 94 PID 412 wrote to memory of 3960 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 94 PID 412 wrote to memory of 2124 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 95 PID 412 wrote to memory of 2124 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 95 PID 412 wrote to memory of 2124 412 {DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe 95 PID 3960 wrote to memory of 2568 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 97 PID 3960 wrote to memory of 2568 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 97 PID 3960 wrote to memory of 2568 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 97 PID 3960 wrote to memory of 968 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 98 PID 3960 wrote to memory of 968 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 98 PID 3960 wrote to memory of 968 3960 {DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe 98 PID 2568 wrote to memory of 5064 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 99 PID 2568 wrote to memory of 5064 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 99 PID 2568 wrote to memory of 5064 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 99 PID 2568 wrote to memory of 4644 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 100 PID 2568 wrote to memory of 4644 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 100 PID 2568 wrote to memory of 4644 2568 {1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe 100 PID 5064 wrote to memory of 2848 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 101 PID 5064 wrote to memory of 2848 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 101 PID 5064 wrote to memory of 2848 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 101 PID 5064 wrote to memory of 2004 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 102 PID 5064 wrote to memory of 2004 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 102 PID 5064 wrote to memory of 2004 5064 {13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe 102 PID 2848 wrote to memory of 4804 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 103 PID 2848 wrote to memory of 4804 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 103 PID 2848 wrote to memory of 4804 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 103 PID 2848 wrote to memory of 4040 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 104 PID 2848 wrote to memory of 4040 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 104 PID 2848 wrote to memory of 4040 2848 {E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe 104 PID 4804 wrote to memory of 1400 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 105 PID 4804 wrote to memory of 1400 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 105 PID 4804 wrote to memory of 1400 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 105 PID 4804 wrote to memory of 1596 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 106 PID 4804 wrote to memory of 1596 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 106 PID 4804 wrote to memory of 1596 4804 {38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe 106 PID 1400 wrote to memory of 4584 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 107 PID 1400 wrote to memory of 4584 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 107 PID 1400 wrote to memory of 4584 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 107 PID 1400 wrote to memory of 1624 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 108 PID 1400 wrote to memory of 1624 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 108 PID 1400 wrote to memory of 1624 1400 {CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe 108 PID 4584 wrote to memory of 2576 4584 {28CB8670-7571-4de0-9679-F5564EB441F4}.exe 109 PID 4584 wrote to memory of 2576 4584 {28CB8670-7571-4de0-9679-F5564EB441F4}.exe 109 PID 4584 wrote to memory of 2576 4584 {28CB8670-7571-4de0-9679-F5564EB441F4}.exe 109 PID 4584 wrote to memory of 4064 4584 {28CB8670-7571-4de0-9679-F5564EB441F4}.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_940a0f511b3a7b377694a9a6703a645e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\{F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exeC:\Windows\{F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\{91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exeC:\Windows\{91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exeC:\Windows\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exeC:\Windows\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\{1A8EB465-7530-465d-AAE5-FCDC308531CA}.exeC:\Windows\{1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exeC:\Windows\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exeC:\Windows\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\{38092E1D-234E-4dea-8793-9C9528EC3B7B}.exeC:\Windows\{38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\{CA1A6227-0762-4b19-A251-7E389B5ECD92}.exeC:\Windows\{CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\{28CB8670-7571-4de0-9679-F5564EB441F4}.exeC:\Windows\{28CB8670-7571-4de0-9679-F5564EB441F4}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exeC:\Windows\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Windows\{F76EFF1F-B18F-40c8-8292-955C2214ED15}.exeC:\Windows\{F76EFF1F-B18F-40c8-8292-955C2214ED15}.exe13⤵
- Executes dropped EXE
PID:64
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58E79~1.EXE > nul13⤵PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28CB8~1.EXE > nul12⤵PID:4064
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA1A6~1.EXE > nul11⤵PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38092~1.EXE > nul10⤵PID:1596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E30F8~1.EXE > nul9⤵PID:4040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13D66~1.EXE > nul8⤵PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A8EB~1.EXE > nul7⤵PID:4644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA649~1.EXE > nul6⤵PID:968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEA05~1.EXE > nul5⤵PID:2124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91490~1.EXE > nul4⤵PID:3388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F12C3~1.EXE > nul3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{13D666ED-3D7D-44fd-B0C6-34164A7DA7DA}.exe
- Size 344KB
- SHA256 49761831ea058bcaeda2f1f1de6c2730bf070ca1244656cd91983286b147a88d
- MD5 6cbb07f962d8284e5e5cf204b0bdb1a9
- SHA1 0b965a3c243f7ccf27126d74b55e1b8d89ff804a
- SHA512 b96fa5f5ae320116f398597b17b197ac8cb7e48af55945a5ec0938b43448819e307f8026b8d8e8073d73ef46528dd975d89235e2e011d7cb4b95575473aef20d
- SSDEEP 3072:mEGh0odlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG/lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1A8EB465-7530-465d-AAE5-FCDC308531CA}.exe
- Size 344KB
- SHA256 54ab59687caaf07410985e464c2f0aba3af32e5280ad88d6063f9275482ddf86
- MD5 98f79f3e37308f5b81e7db19b6c89ce6
- SHA1 cff98d301fd6bf815aa26b416c28a5408c394b86
- SHA512 c33db3db3cdc48020deb5b1bbd1f2d5937fba4455db75b7fee0537203ef8b7c28d64f8c766aa99eaed22b012e55fd70b2534d2ae7ea07f1d9868fddfe209fa09
- SSDEEP 3072:mEGh0oKlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGYlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{28CB8670-7571-4de0-9679-F5564EB441F4}.exe
- Size 344KB
- SHA256 e83574425a84b68ae4c7bed71d04ae41e4482068cf572cab91af39565a6e5655
- MD5 f58f3c5fe4b56104b59364531df9a91a
- SHA1 be3b968b2e7f5eefaef0919ae907ca283effdd15
- SHA512 01c8a01a8baf5b1ebca1edc6d01edbdedea866dcea2d205809f4d3e7ec679b47f05e5126a8ed866f3018a0009feb7aec7e0c31de57c01e3a0aa59e4f0eb97f5d
- SSDEEP 3072:mEGh0oklEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{38092E1D-234E-4dea-8793-9C9528EC3B7B}.exe
- Size 344KB
- SHA256 47ff88e3109d1b2a920fff54e9dc12b4951fbf9ef371d8f28923152c9bd7a076
- MD5 6d19f03b7d31076961992086c01dd989
- SHA1 6dc7dfab7b510bfaf0c6cbe1bd5e4af0c79e9095
- SHA512 72693ad9cc963d6119ea2d52ac952646a91a10112d5a7ffa243a2b67d0f66f60601370a58bb9c0605c278d6c15925e9d1405ed410b358a6aa357ad45da8b384f
- SSDEEP 3072:mEGh0oDlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGRlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{58E793E9-D2AB-4824-A33B-87BA1E05D7E1}.exe
- Size 344KB
- SHA256 fd9cbd0bf3ff7935040a5c8de8d2f660c8f47746a0b1d70828e7d4d31da740b3
- MD5 4df8d9edbbff8533c9e01acedf6597ae
- SHA1 3d0d416ce61d64541610b2639669c1f8d716b41a
- SHA512 47a0d706b9f4383ddc5dae81a16d27a02654db6624116d1a4e218b822f56e42b17a38a4a012446a193b739396f2e9ca0398d0da87ab8716dbde0c31120a76be9
- SSDEEP 3072:mEGh0o1lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGTlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{91490427-0B2C-4310-80C9-5F2BCD6FACE5}.exe
- Size 344KB
- SHA256 7aa09be2bd2f5f6779854514fd59d2a121b30fcb3e03b6e838f6e3ed3472efee
- MD5 0b99f8e5cd2592bbe445219929ca80d3
- SHA1 26033ef0c700bddfde97286d444092f59e520edb
- SHA512 ad818bd479291b4dae6a49879c88c3f1051c86929add74422634b6bd64fecc2e78b7c6d77a4f4e97244106d464ee36e4f79a6a5fd02559456f796f20736f992c
- SSDEEP 3072:mEGh0oplEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGblqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CA1A6227-0762-4b19-A251-7E389B5ECD92}.exe
- Size 344KB
- SHA256 0405bc2e8764b3b0e364b3adaa6e32881f9ea7375f05c3f9bd63a10f50a01258
- MD5 703dc692a4e224b459593a1b8d892153
- SHA1 bcd80f183b37192aa9991ea405d745a2854c9607
- SHA512 25e4e6080bdd52eb0e42bb79b992c988bf73192be45b6f92eeb35a3c228935bedc2b172aedfe172ddaf02460f2033dad48ddb052685ce562f6303396f8bb133c
- SSDEEP 3072:mEGh0ollEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGjlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DA64946E-EA5D-4f7c-82A0-2C4A9CD97895}.exe
- Size 344KB
- SHA256 967b33566b95258bda9ba9e4254aaedd1e4e53819154a6f6c1ed1be39bc7c005
- MD5 9753fbcaf43a057f8f191665e636eada
- SHA1 348eba090b294f7e67525671feaa61c0bb2f467a
- SHA512 02ee958aa884d7ff7b37df1a3cbae5eced3cbb6b68dda3fdd8c300138879649664da3d7c23fc431433eae79ca338ce1bfac1db6cdac1f18c0a3ddd838da74592
- SSDEEP 3072:mEGh0oNlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DEA05739-1578-4ec8-91CD-78C4FAD0A6FA}.exe
- Size 344KB
- SHA256 cfdf0ebbfa43d81ad5c995a9f95d0911c61743da56120e11c60e5a7b16d5cbdc
- MD5 b8aa28103157feaa9ae01cec51374a8b
- SHA1 1245cc00b0168df809d856bb5f1e4589a03e6d52
- SHA512 ed329c78432aff4206ae2a0e37a4ba63caca948fe49b5e0d357fb02ada6b2988b8346ee46d551e6a0a2a0b88fe2f650b9aefe6424e7049459fa6855c0daa8c9a
- SSDEEP 3072:mEGh0oblEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGNlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E30F817D-4B66-4eff-ADAA-9D5F7D493CC5}.exe
- Size 344KB
- SHA256 efae65c40ca42d8632181c5b4a14094ef572758090e20500b298df56c1b5d831
- MD5 fe3807cc63f4ce83ec4295c4e7be6a87
- SHA1 05b072dea042f534bbbd71ab3d88e388f3802807
- SHA512 2c28fc9d85380d4ad2cf5f9b96e03ec044b977f16999abeda5e107df6aeba4aa41351045886186084d73312a44d5415396b0df2edd170656ab4b7bd06577c2d6
- SSDEEP 3072:mEGh0oSlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG4lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F12C34C4-6145-4876-A5A8-B6FDBC06A855}.exe
- Size 344KB
- SHA256 6177a245a2143e19caa14b1fac77a9735e14391bd440ced8d8010b6e4a41ca86
- MD5 464363b11dbc34e566045f67b3a662e2
- SHA1 bf97111402db2fe5e425ecaa9351a6154f30162c
- SHA512 0cc34917f498eb469ef77691e2c412fc0266652b952ca3d37258af25d4942c874daaa10fb1fb2a2a1d819e9c22fe83e0df4f7c57a055037cb0f06257ef484564
- SSDEEP 3072:mEGh0oglEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGKlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F76EFF1F-B18F-40c8-8292-955C2214ED15}.exe
- Size 344KB
- SHA256 f2a308246580609254067d33b3385a37e8a8525d0188335a37e1e72b140dc3fd
- MD5 40b347cd1be7d767467ed616ddf346d4
- SHA1 f5433f6cc91ab46db3544ef8ddef49429eefcf20
- SHA512 2bdd7aa0357a4ff1766520a33f4904439d579605f4e054fed7ce9402dfa9e7389f1cbc7f0124930e6979a72bfd46d0ff61f87fe0e5bd6864a81cf03ec6d74585
- SSDEEP 3072:mEGh0o0lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGelqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP