Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe
- Size 197KB
- Sample240613-dgnysswamn
- SHA256 f9738adc7c4192099c2b6f71d1e418f0454a91e495b4e191a429d0b6e33db30b
- MD5 a931f967e8db0c3bd0a224afcf3aab42
- SHA1 37ecfa4f4be3eab0511b30fc8692d43b6f153749
- SHA512 4e927057b75fc20676e9b4825b1695f3769c547733b981ec428e723704ee47d9043c6969c78eb59468cc4062828b53002af344763dd12e547618a488d8f0ec7e
- SSDEEP 3072:jEGh0o0l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG2lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000600000001e52a-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023393-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233bd-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023393-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d0000000233bd-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023393-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e0000000233bd-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023393-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f0000000233bd-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023393-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00100000000233bd-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023393-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}\stubpath = "C:\\Windows\\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe" {58C45481-53BE-435e-A8AC-32E437CDA743}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74C260AE-9474-4ab5-84BD-3D63AD17CC20} {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}\stubpath = "C:\\Windows\\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe" {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A} 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C73C53D9-5EE9-4506-B17C-11AEEEF41477}\stubpath = "C:\\Windows\\{C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe" {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}\stubpath = "C:\\Windows\\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe" {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{006E2F90-B989-4291-A49C-E1EBF58CEFCC} {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{006E2F90-B989-4291-A49C-E1EBF58CEFCC}\stubpath = "C:\\Windows\\{006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe" {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F87608F-8F99-4189-B750-F6F4444D77CC} {198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{198CDCAF-F434-4575-B716-B7AB834BD0A1} {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}\stubpath = "C:\\Windows\\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe" 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070}\stubpath = "C:\\Windows\\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe" {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D10975F-6623-4288-81BA-BD3BC45D50D3} {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D10975F-6623-4288-81BA-BD3BC45D50D3}\stubpath = "C:\\Windows\\{8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe" {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3} {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C73C53D9-5EE9-4506-B17C-11AEEEF41477} {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C45481-53BE-435e-A8AC-32E437CDA743} {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C45481-53BE-435e-A8AC-32E437CDA743}\stubpath = "C:\\Windows\\{58C45481-53BE-435e-A8AC-32E437CDA743}.exe" {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{198CDCAF-F434-4575-B716-B7AB834BD0A1}\stubpath = "C:\\Windows\\{198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe" {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070} {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2} {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559} {58C45481-53BE-435e-A8AC-32E437CDA743}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74C260AE-9474-4ab5-84BD-3D63AD17CC20}\stubpath = "C:\\Windows\\{74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe" {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F87608F-8F99-4189-B750-F6F4444D77CC}\stubpath = "C:\\Windows\\{7F87608F-8F99-4189-B750-F6F4444D77CC}.exe" {198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe - Executes dropped EXE 12 IoCs
pid Process 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 4124 {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe 2116 {198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe 1952 {7F87608F-8F99-4189-B750-F6F4444D77CC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{7F87608F-8F99-4189-B750-F6F4444D77CC}.exe {198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe File created C:\Windows\{C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe File created C:\Windows\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe File created C:\Windows\{006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe File created C:\Windows\{58C45481-53BE-435e-A8AC-32E437CDA743}.exe {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe File created C:\Windows\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe {58C45481-53BE-435e-A8AC-32E437CDA743}.exe File created C:\Windows\{74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe File created C:\Windows\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe File created C:\Windows\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe File created C:\Windows\{8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe File created C:\Windows\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe File created C:\Windows\{198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe Token: SeIncBasePriorityPrivilege 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe Token: SeIncBasePriorityPrivilege 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe Token: SeIncBasePriorityPrivilege 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe Token: SeIncBasePriorityPrivilege 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe Token: SeIncBasePriorityPrivilege 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe Token: SeIncBasePriorityPrivilege 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe Token: SeIncBasePriorityPrivilege 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe Token: SeIncBasePriorityPrivilege 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe Token: SeIncBasePriorityPrivilege 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe Token: SeIncBasePriorityPrivilege 4124 {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe Token: SeIncBasePriorityPrivilege 2116 {198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3540 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe 88 PID 3952 wrote to memory of 3540 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe 88 PID 3952 wrote to memory of 3540 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe 88 PID 3952 wrote to memory of 3008 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe 89 PID 3952 wrote to memory of 3008 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe 89 PID 3952 wrote to memory of 3008 3952 2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe 89 PID 3540 wrote to memory of 848 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 90 PID 3540 wrote to memory of 848 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 90 PID 3540 wrote to memory of 848 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 90 PID 3540 wrote to memory of 4248 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 91 PID 3540 wrote to memory of 4248 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 91 PID 3540 wrote to memory of 4248 3540 {00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe 91 PID 848 wrote to memory of 1276 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 95 PID 848 wrote to memory of 1276 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 95 PID 848 wrote to memory of 1276 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 95 PID 848 wrote to memory of 2828 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 96 PID 848 wrote to memory of 2828 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 96 PID 848 wrote to memory of 2828 848 {B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe 96 PID 1276 wrote to memory of 3232 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 97 PID 1276 wrote to memory of 3232 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 97 PID 1276 wrote to memory of 3232 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 97 PID 1276 wrote to memory of 4352 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 98 PID 1276 wrote to memory of 4352 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 98 PID 1276 wrote to memory of 4352 1276 {C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe 98 PID 3232 wrote to memory of 1416 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 99 PID 3232 wrote to memory of 1416 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 99 PID 3232 wrote to memory of 1416 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 99 PID 3232 wrote to memory of 1524 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 100 PID 3232 wrote to memory of 1524 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 100 PID 3232 wrote to memory of 1524 3232 {8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe 100 PID 1416 wrote to memory of 3652 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 101 PID 1416 wrote to memory of 3652 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 101 PID 1416 wrote to memory of 3652 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 101 PID 1416 wrote to memory of 2484 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 102 PID 1416 wrote to memory of 2484 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 102 PID 1416 wrote to memory of 2484 1416 {93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe 102 PID 3652 wrote to memory of 3108 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 103 PID 3652 wrote to memory of 3108 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 103 PID 3652 wrote to memory of 3108 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 103 PID 3652 wrote to memory of 4240 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 104 PID 3652 wrote to memory of 4240 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 104 PID 3652 wrote to memory of 4240 3652 {006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe 104 PID 3108 wrote to memory of 4396 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 105 PID 3108 wrote to memory of 4396 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 105 PID 3108 wrote to memory of 4396 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 105 PID 3108 wrote to memory of 3752 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 106 PID 3108 wrote to memory of 3752 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 106 PID 3108 wrote to memory of 3752 3108 {58C45481-53BE-435e-A8AC-32E437CDA743}.exe 106 PID 4396 wrote to memory of 2476 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 107 PID 4396 wrote to memory of 2476 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 107 PID 4396 wrote to memory of 2476 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 107 PID 4396 wrote to memory of 2448 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 108 PID 4396 wrote to memory of 2448 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 108 PID 4396 wrote to memory of 2448 4396 {DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe 108 PID 2476 wrote to memory of 4124 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 109 PID 2476 wrote to memory of 4124 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 109 PID 2476 wrote to memory of 4124 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 109 PID 2476 wrote to memory of 4724 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 110 PID 2476 wrote to memory of 4724 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 110 PID 2476 wrote to memory of 4724 2476 {74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe 110 PID 4124 wrote to memory of 2116 4124 {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe 111 PID 4124 wrote to memory of 2116 4124 {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe 111 PID 4124 wrote to memory of 2116 4124 {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe 111 PID 4124 wrote to memory of 2784 4124 {AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_a931f967e8db0c3bd0a224afcf3aab42_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exeC:\Windows\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exeC:\Windows\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\{C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exeC:\Windows\{C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\{8D10975F-6623-4288-81BA-BD3BC45D50D3}.exeC:\Windows\{8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exeC:\Windows\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\{006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exeC:\Windows\{006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\{58C45481-53BE-435e-A8AC-32E437CDA743}.exeC:\Windows\{58C45481-53BE-435e-A8AC-32E437CDA743}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exeC:\Windows\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\{74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exeC:\Windows\{74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exeC:\Windows\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\{198CDCAF-F434-4575-B716-B7AB834BD0A1}.exeC:\Windows\{198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\{7F87608F-8F99-4189-B750-F6F4444D77CC}.exeC:\Windows\{7F87608F-8F99-4189-B750-F6F4444D77CC}.exe13⤵
- Executes dropped EXE
PID:1952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{198CD~1.EXE > nul13⤵PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC4E7~1.EXE > nul12⤵PID:2784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74C26~1.EXE > nul11⤵PID:4724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC8F3~1.EXE > nul10⤵PID:2448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58C45~1.EXE > nul9⤵PID:3752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{006E2~1.EXE > nul8⤵PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93F7A~1.EXE > nul7⤵PID:2484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D109~1.EXE > nul6⤵PID:1524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C73C5~1.EXE > nul5⤵PID:4352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B12C3~1.EXE > nul4⤵PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00FA6~1.EXE > nul3⤵PID:4248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{006E2F90-B989-4291-A49C-E1EBF58CEFCC}.exe
- Size 197KB
- SHA256 16ab46d9d56cc981aa8061880610e6f602234886a4bcd8b598a7c19f3021f022
- MD5 d50b7852f79d5fb43e57224d0e785e25
- SHA1 d903eb1a6b7a8627cdda67b0b5b54c34ab901a6b
- SHA512 4e4103ee40b5d5209bcadd5bb5628522a11ee0a96e6271d8757330f95230ecf251c0762f62bf2ee24e6711e8c92709bf4652bd243b05b3091eb79fb8109515f0
- SSDEEP 3072:jEGh0ohl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGnlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{00FA62CC-2E3D-4d50-8E6A-CF1D890AD93A}.exe
- Size 197KB
- SHA256 1f843a32b35eb0011cf017088bb3b52112725282bf98f58c92debfded7469425
- MD5 190690cac14a45c9e847d114af8a517d
- SHA1 663088586b000b25c50d3d74b2a5bac8bb2fae49
- SHA512 2b6636b4b15906ab87e04b814e97dfea84fc383f6f24f66af81b81118ee454ff1fcb4a7717f4e80ac49f30487b41d56fe13db3c69c2b4c3e8616ee58c78091f2
- SSDEEP 3072:jEGh0oZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGjlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{198CDCAF-F434-4575-B716-B7AB834BD0A1}.exe
- Size 197KB
- SHA256 2f0693927b3eafc10364fe2877ab2a69f89ef925ac1bf9034be88ad9c951cb88
- MD5 61c179c0acad5362a9e62348b7e510e3
- SHA1 c0c32a468b977cd41f1457e334e2adf5f3e85547
- SHA512 0c2a42859ba7bc462895d1247bdd0e34a971c4e7d00797ad98049309c2b4490545b3426741f4cf1c046fef6d6a0ec90f16d807ae12bd78881605646749361515
- SSDEEP 3072:jEGh0oSl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGYlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{58C45481-53BE-435e-A8AC-32E437CDA743}.exe
- Size 197KB
- SHA256 a75e103be75837bcc95689aa973ad23bb3c853812590bb9ef6ec7b9cf2a33130
- MD5 3c563723d97c9389c873f51c833a6a0d
- SHA1 21958907127a2f0afdc221c87ccd9d6889a8ee8b
- SHA512 a9af720e606724b0aae43aa050dc9766d236be4276051aabbb9aab55cefc36bf126303a9d46c07286c99b78a82aab59a7387fda8acaca537f32d6eed2110d459
- SSDEEP 3072:jEGh0oHl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG1lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{74C260AE-9474-4ab5-84BD-3D63AD17CC20}.exe
- Size 197KB
- SHA256 c355e8d916719b2603dd612636819da8984c942696a1355f16d7115728abb828
- MD5 deb07259251b7cd2e478afa276d15558
- SHA1 9df403463c2282a0b03c5d86fc1cee93ff350d29
- SHA512 d56626c6d48c726e55457d193df5089e61b998687d5b17a625f85e79a287c8f4d65f157b931403ccd5775fa2a8f22c99ffb7a155fde24ddb919ba2e2fbf06f58
- SSDEEP 3072:jEGh0ohl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGflEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7F87608F-8F99-4189-B750-F6F4444D77CC}.exe
- Size 197KB
- SHA256 ff197c16c13fe8cae6dcd7203ea5e273703467108e35bd544be1ff46edf89e62
- MD5 15676094836b3b8399c262ad3526d64a
- SHA1 ce17dce317b63171a7a0d3667728cb6bf4260082
- SHA512 26f521270b5597959d8e9ce9273f019038302f03d6c9dab56cae17abf5c877e73bf204d5fa3d0668eba20653637a59fb4f09a18abd592ab4bbaefa3a7ff7fe41
- SSDEEP 3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG4lEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8D10975F-6623-4288-81BA-BD3BC45D50D3}.exe
- Size 197KB
- SHA256 43b98fb47f5646c4ccefa76e6cad2ba83d07c2e446e1dbd92f7ba21299082499
- MD5 c77ac7f4feb5be4482f7a809e36e10b3
- SHA1 0bae0e6f0735705b657a9aafa96e9f5fe8df6052
- SHA512 c311520ef09f5123263dc744ebaa64e389c44738fc7dbe533a496678c7752d2f2dac6d183fddeb75d4d7ccd317e3e94ebca9908f904f48288e56de5404ff540f
- SSDEEP 3072:jEGh0owl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGqlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{93F7ABA6-D49D-446b-8BAD-2E24BF50CCD2}.exe
- Size 197KB
- SHA256 251db9317b9f314f452e07ceeee03a9a622adb0644d524ebe54222bff3dabd5b
- MD5 59dacbb4a3f84281387fd78f702b495c
- SHA1 5599acba349bc5945fbe6a6fa15b88be85895858
- SHA512 450a5b05e92f82c13aed8a4ea1f55ab16d46ba7d3b03e85f00360c4fe868bbd25b2e32da7e4a1a513a0d767931a68bbeba629e6724abdfb268cefb3cb6a69381
- SSDEEP 3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGNlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AC4E7948-DFBC-48be-BC90-DEBF5DE2CEE3}.exe
- Size 197KB
- SHA256 7a6e9bb454d104422b48f2cbd989892767ec4e056e71943bbef63c1cefac4f90
- MD5 38dc0bf3933c255d3f6e481524c9f881
- SHA1 8388176c6dfd1b8c389e3f3d086af24dbf8efb5f
- SHA512 952a804c2aaff2123f17d8537951f983ecd538d49e8a59e0f062a827710459fa4fd21d36949e4c85f115f28c2242a0e22100228d20108b444bad397d0a0e70de
- SSDEEP 3072:jEGh0oQl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGSlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B12C335B-DFD3-4043-9E7A-74C1AB1C6070}.exe
- Size 197KB
- SHA256 7cd48e7e5b27b0102851d607da4d53bede4b21aa38d02742534db5b4652bfaff
- MD5 3191d81882b0ee7038307ab0f0eb8db4
- SHA1 f762880be2d61afeaf08f5bf951279dea3a3b52b
- SHA512 8fb18ee01f16a520080f94490830d4fc9c6ad7bff0d596c5669ca730b9b906f6a309f237889fd9d7e892fb4f3a5ab6fa355dc1535e51e8433b4bb256945902de
- SSDEEP 3072:jEGh0oal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGglEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C73C53D9-5EE9-4506-B17C-11AEEEF41477}.exe
- Size 197KB
- SHA256 42feaa2743e0259b8706781fe0834e7c63fc0daa2b15be348a74eee83e4a100a
- MD5 e66e2ff1ab5df66c33dd1cefd54b3b6c
- SHA1 f077d1301caa24b5dce5a96d528be37504d53453
- SHA512 960d2d95dcaaf15bab395a2073caffbc95e5fafcff13a3b02623799e4d3b69337368521449c0cdc1c6446ceb1080f78420f2309ed2927b7be09a29d548a17613
- SSDEEP 3072:jEGh0oul+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGklEeKcAEca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DC8F3EF0-A276-4bf6-86DF-1C26A03EB559}.exe
- Size 197KB
- SHA256 821a8fa0acb44a973728b57a06e74bc1bd2574de5d398bd070292e799d45b847
- MD5 52e6668c154dbf89b7fb0adc04984a8a
- SHA1 a07d84e45673e8c95ee9a9651025a359beae3b90
- SHA512 55fb836b44f56c683c4ecf07ea15597e83cc5107cd3a1845553089adf2bff1f780fcf2d3fcdc1f821ab3a2405d785ab5fb5e79d572d810e2af6f532f0b915944
- SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGdlEeKcAEca
- MD5 SHA1 SHA512 SSDEEP