Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe
- Size 344KB
- Sample240613-dhrfbasbqf
- SHA256 221c12292934484313a0e4c0616c12ccbc14024efa56c16040e09ac6afd691bd
- MD5 edeabfd31140c33d942a63a71736a0ba
- SHA1 cf2cf97e59886cadf15a5491cd607236dcb8a387
- SHA512 4bb4826f5c6e5b3cb3e7103471bcafde68514d6c89cac189dcb0f313cb2e8ba80e22457808687bc86850a94b201d05726c4041a1702c567f388befea7b994cf1
- SSDEEP 3072:mEGh0oxlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGvlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x00080000000233ed-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233ee-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233f2-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233f5-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00070000000233fc-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233f5-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00080000000233fc-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233f5-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00090000000233fc-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233f5-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233fc-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233f5-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2DFF365-0B72-4495-AF96-F93A649BE0A5}\stubpath = "C:\\Windows\\{C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe" {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8CE8E06-1004-46d4-A975-75B0639353C7} {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8CE8E06-1004-46d4-A975-75B0639353C7}\stubpath = "C:\\Windows\\{A8CE8E06-1004-46d4-A975-75B0639353C7}.exe" {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0857784-0EC5-4851-BFDB-CC58168FE398} {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0857784-0EC5-4851-BFDB-CC58168FE398}\stubpath = "C:\\Windows\\{D0857784-0EC5-4851-BFDB-CC58168FE398}.exe" {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{137379B4-EB61-49df-AA9E-2D6E40463416}\stubpath = "C:\\Windows\\{137379B4-EB61-49df-AA9E-2D6E40463416}.exe" {D0857784-0EC5-4851-BFDB-CC58168FE398}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5E66775-5950-4bc2-94E5-C075A6EE27C5}\stubpath = "C:\\Windows\\{F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe" 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF} {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A}\stubpath = "C:\\Windows\\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe" {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B97C427-4A47-4864-BE59-ABF6DC25100D}\stubpath = "C:\\Windows\\{3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe" {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27AE91E9-1A26-45ed-A5B6-735E3354EA83} {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A} {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04C66282-699B-4e00-A7F0-CAF7BAA4336B} {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B97C427-4A47-4864-BE59-ABF6DC25100D} {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{137379B4-EB61-49df-AA9E-2D6E40463416} {D0857784-0EC5-4851-BFDB-CC58168FE398}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}\stubpath = "C:\\Windows\\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe" {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70200A9A-97C4-442a-86DC-7D663AC0A7CA}\stubpath = "C:\\Windows\\{70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe" {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2514FC63-5F77-4156-A084-A1559ACC2FB7} {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2514FC63-5F77-4156-A084-A1559ACC2FB7}\stubpath = "C:\\Windows\\{2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe" {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70200A9A-97C4-442a-86DC-7D663AC0A7CA} {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04C66282-699B-4e00-A7F0-CAF7BAA4336B}\stubpath = "C:\\Windows\\{04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe" {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2DFF365-0B72-4495-AF96-F93A649BE0A5} {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5E66775-5950-4bc2-94E5-C075A6EE27C5} 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27AE91E9-1A26-45ed-A5B6-735E3354EA83}\stubpath = "C:\\Windows\\{27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe" {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe - Executes dropped EXE 12 IoCs
pid Process 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 4140 {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe 3460 {D0857784-0EC5-4851-BFDB-CC58168FE398}.exe 4656 {137379B4-EB61-49df-AA9E-2D6E40463416}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe File created C:\Windows\{70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe File created C:\Windows\{A8CE8E06-1004-46d4-A975-75B0639353C7}.exe {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe File created C:\Windows\{D0857784-0EC5-4851-BFDB-CC58168FE398}.exe {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe File created C:\Windows\{137379B4-EB61-49df-AA9E-2D6E40463416}.exe {D0857784-0EC5-4851-BFDB-CC58168FE398}.exe File created C:\Windows\{3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe File created C:\Windows\{F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe File created C:\Windows\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe File created C:\Windows\{27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe File created C:\Windows\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe File created C:\Windows\{04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe File created C:\Windows\{C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe Token: SeIncBasePriorityPrivilege 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe Token: SeIncBasePriorityPrivilege 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe Token: SeIncBasePriorityPrivilege 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe Token: SeIncBasePriorityPrivilege 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe Token: SeIncBasePriorityPrivilege 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe Token: SeIncBasePriorityPrivilege 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe Token: SeIncBasePriorityPrivilege 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe Token: SeIncBasePriorityPrivilege 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe Token: SeIncBasePriorityPrivilege 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe Token: SeIncBasePriorityPrivilege 4140 {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe Token: SeIncBasePriorityPrivilege 3460 {D0857784-0EC5-4851-BFDB-CC58168FE398}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 1312 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe 81 PID 4708 wrote to memory of 1312 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe 81 PID 4708 wrote to memory of 1312 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe 81 PID 4708 wrote to memory of 2224 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe 82 PID 4708 wrote to memory of 2224 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe 82 PID 4708 wrote to memory of 2224 4708 2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe 82 PID 1312 wrote to memory of 4724 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 83 PID 1312 wrote to memory of 4724 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 83 PID 1312 wrote to memory of 4724 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 83 PID 1312 wrote to memory of 3204 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 84 PID 1312 wrote to memory of 3204 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 84 PID 1312 wrote to memory of 3204 1312 {F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe 84 PID 4724 wrote to memory of 1660 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 87 PID 4724 wrote to memory of 1660 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 87 PID 4724 wrote to memory of 1660 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 87 PID 4724 wrote to memory of 3056 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 88 PID 4724 wrote to memory of 3056 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 88 PID 4724 wrote to memory of 3056 4724 {6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe 88 PID 1660 wrote to memory of 2192 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 93 PID 1660 wrote to memory of 2192 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 93 PID 1660 wrote to memory of 2192 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 93 PID 1660 wrote to memory of 2996 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 94 PID 1660 wrote to memory of 2996 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 94 PID 1660 wrote to memory of 2996 1660 {27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe 94 PID 2192 wrote to memory of 4524 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 96 PID 2192 wrote to memory of 4524 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 96 PID 2192 wrote to memory of 4524 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 96 PID 2192 wrote to memory of 4784 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 97 PID 2192 wrote to memory of 4784 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 97 PID 2192 wrote to memory of 4784 2192 {2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe 97 PID 4524 wrote to memory of 4176 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 98 PID 4524 wrote to memory of 4176 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 98 PID 4524 wrote to memory of 4176 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 98 PID 4524 wrote to memory of 1300 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 99 PID 4524 wrote to memory of 1300 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 99 PID 4524 wrote to memory of 1300 4524 {D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe 99 PID 4176 wrote to memory of 2424 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 100 PID 4176 wrote to memory of 2424 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 100 PID 4176 wrote to memory of 2424 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 100 PID 4176 wrote to memory of 3712 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 101 PID 4176 wrote to memory of 3712 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 101 PID 4176 wrote to memory of 3712 4176 {70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe 101 PID 2424 wrote to memory of 2236 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 102 PID 2424 wrote to memory of 2236 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 102 PID 2424 wrote to memory of 2236 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 102 PID 2424 wrote to memory of 2968 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 103 PID 2424 wrote to memory of 2968 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 103 PID 2424 wrote to memory of 2968 2424 {04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe 103 PID 2236 wrote to memory of 4328 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 104 PID 2236 wrote to memory of 4328 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 104 PID 2236 wrote to memory of 4328 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 104 PID 2236 wrote to memory of 3944 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 105 PID 2236 wrote to memory of 3944 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 105 PID 2236 wrote to memory of 3944 2236 {C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe 105 PID 4328 wrote to memory of 4140 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 106 PID 4328 wrote to memory of 4140 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 106 PID 4328 wrote to memory of 4140 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 106 PID 4328 wrote to memory of 3216 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 107 PID 4328 wrote to memory of 3216 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 107 PID 4328 wrote to memory of 3216 4328 {A8CE8E06-1004-46d4-A975-75B0639353C7}.exe 107 PID 4140 wrote to memory of 3460 4140 {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe 108 PID 4140 wrote to memory of 3460 4140 {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe 108 PID 4140 wrote to memory of 3460 4140 {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe 108 PID 4140 wrote to memory of 3440 4140 {3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_edeabfd31140c33d942a63a71736a0ba_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\{F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exeC:\Windows\{F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exeC:\Windows\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\{27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exeC:\Windows\{27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\{2514FC63-5F77-4156-A084-A1559ACC2FB7}.exeC:\Windows\{2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exeC:\Windows\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\{70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exeC:\Windows\{70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\{04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exeC:\Windows\{04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\{C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exeC:\Windows\{C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\{A8CE8E06-1004-46d4-A975-75B0639353C7}.exeC:\Windows\{A8CE8E06-1004-46d4-A975-75B0639353C7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\{3B97C427-4A47-4864-BE59-ABF6DC25100D}.exeC:\Windows\{3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\{D0857784-0EC5-4851-BFDB-CC58168FE398}.exeC:\Windows\{D0857784-0EC5-4851-BFDB-CC58168FE398}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3460 -
C:\Windows\{137379B4-EB61-49df-AA9E-2D6E40463416}.exeC:\Windows\{137379B4-EB61-49df-AA9E-2D6E40463416}.exe13⤵
- Executes dropped EXE
PID:4656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0857~1.EXE > nul13⤵PID:4436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B97C~1.EXE > nul12⤵PID:3440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8CE8~1.EXE > nul11⤵PID:3216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2DFF~1.EXE > nul10⤵PID:3944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04C66~1.EXE > nul9⤵PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70200~1.EXE > nul8⤵PID:3712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5CDA~1.EXE > nul7⤵PID:1300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2514F~1.EXE > nul6⤵PID:4784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27AE9~1.EXE > nul5⤵PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A0EE~1.EXE > nul4⤵PID:3056
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5E66~1.EXE > nul3⤵PID:3204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{04C66282-699B-4e00-A7F0-CAF7BAA4336B}.exe
- Size 344KB
- SHA256 ec9898ae86e6873df8909f86640622cbed7b199c2ce6a492aa790ae23e1c28a8
- MD5 f922f2f4e71a7d4da1abd5e774a9af6c
- SHA1 937b13ddebbb81c8eb00e17866b86fbc378a973a
- SHA512 53bccf022bc9981915b9ce1742cfa11df484a101417699d3a222c363bcc9da34c805200eeb8984f2921daf2e521df60d377fb7013aa16c21811d13ed5c76b465
- SSDEEP 3072:mEGh0o/lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG1lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{137379B4-EB61-49df-AA9E-2D6E40463416}.exe
- Size 344KB
- SHA256 098a881aa616107aa450b29d6cb2dfe8b734fd52ef4e25923d3b4dd5352a0ce2
- MD5 818af7cfde0e0d404c9d4eec485c9354
- SHA1 8eff8bf1b7519a70774ea01eb0f5d8c19d5a28be
- SHA512 4729656b70a5397971ae327d3822dd2e00c19c5e04ef92d4e2e6b7d7d279658b540b17542996be43ed03d32157d2c47a11fd178ef36327f7ba928eb65318ee44
- SSDEEP 3072:mEGh0o2lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG8lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2514FC63-5F77-4156-A084-A1559ACC2FB7}.exe
- Size 344KB
- SHA256 dbbad7752d3c5e4cfe6df47384d563a9a91d67580acef4fbd07b3ddc651da74c
- MD5 c05ac78d0cf4cf10ae61d876cb3854c5
- SHA1 b2d1dd672390ac58c63d844a70d34ab7d8c007a8
- SHA512 c1fc09e8d5822491957129ef45365a070056c50e6131a7068bc91b9d0720293502541a57d39512379d6466d9d56d3b053b42639c9d396f0576e41043a6a8926c
- SSDEEP 3072:mEGh0o9lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGzlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{27AE91E9-1A26-45ed-A5B6-735E3354EA83}.exe
- Size 344KB
- SHA256 f5ef76f1f4f6a64fc5afeb5c5825ce33abe15c18d9b6ee5a6bd3c6037bd40e90
- MD5 0ea383cdc6123b1bd8b8a5ae92272eb0
- SHA1 1b838b7ae07676793d008ce9d2a50cc674ffd7b5
- SHA512 ccc4d5fb53afe7ae31478c95f742a8d0f901951b536f8ecd0d79d4613d9a1f6f2fe65f9dd0bd64a4531815bff6a86c3453aa7924e847bff91acc2a18ec3b947a
- SSDEEP 3072:mEGh0oZlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3B97C427-4A47-4864-BE59-ABF6DC25100D}.exe
- Size 344KB
- SHA256 764a4f66d2f4488b22de94064e8562f7550532bcbff900c6035d4193b1219fd8
- MD5 7e5666d88946b5abbc07351ce520eefc
- SHA1 b015f8b889b2e7126546caaaed35982568cc7ddb
- SHA512 5b74bedec795891428a416a4f9bd2ef664b138d369f2130f00c36dfa49c5d50abaefede3ca94e25140cff0a2563999335b3b172bea7c783367b3bcf71449514c
- SSDEEP 3072:mEGh0o6lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGklqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6A0EEEF5-C67D-4b0d-8E5A-C41852BCA2EF}.exe
- Size 344KB
- SHA256 7c8f66253d6b112fe2f9ba1f20c5234d8046761d1e67946a9334fdd8dcd8cd89
- MD5 fe4ff994635b4bc07ffbfa318ed1435c
- SHA1 fb2b1abb483224334b41c0451a8f96bda8281216
- SHA512 497b7bf47397431ee3416ceb485155945d28b18d908cb1243c6bbcf86fd0f870e97819f6035aad4959a40af4fc111f58f4ef3e52994952d216df7336c55fe0a8
- SSDEEP 3072:mEGh0oUlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGOlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{70200A9A-97C4-442a-86DC-7D663AC0A7CA}.exe
- Size 344KB
- SHA256 1eeca0ef8bb1904278a92a76f81f7588b006f513a69c6304e744648eee191e9f
- MD5 fe11fec6eae5b140ca4efdf2bfb25dd5
- SHA1 1e32cda11847a8e19dc0366f93cc0ecc79c1d846
- SHA512 660f7b045df195feaec68cd417fc579463c207852b490604b16d093ca1293c76f17c323d0dbc256b7f401a97a0096e231a79f93f6c16219265b2675c5502471c
- SSDEEP 3072:mEGh0ozlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG1lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A8CE8E06-1004-46d4-A975-75B0639353C7}.exe
- Size 344KB
- SHA256 c7aa05ace87df675cb2506ceace48a431432c419af3b17ac1a81a9f0ecf1d362
- MD5 ba87cd364f0109687752102891065433
- SHA1 6fe9f87f5349179ab4d42a21857ba0daa7eef10f
- SHA512 f994349538aa82db77b3a72f7794ea9484603e6bf891e2b26bec04970ab90796c55d47d0f6bb1780f2ba031ed62c5264f33f48a92ec0366ccecfc88616a980bf
- SSDEEP 3072:mEGh0oclEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGulqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C2DFF365-0B72-4495-AF96-F93A649BE0A5}.exe
- Size 344KB
- SHA256 2ce5a6830277a600a4dcd0e90c5ae597affcd0f0995ba570ad5769bfb06d8c39
- MD5 a5697cdb8f9ab3ad1b7f47a09e0ee7ba
- SHA1 0dbc06a0b984c24b6c8df50df0e55234c5c8ca16
- SHA512 5ef4c74f7fcbe7e96faf6e2fd6959605d9dba1a319a58240806c3ff9656f409eecdec00ac50c92946c3bafc1b2ce16acb03455dcabbff19512d0237e2ca86ef6
- SSDEEP 3072:mEGh0oPlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG9lqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D0857784-0EC5-4851-BFDB-CC58168FE398}.exe
- Size 344KB
- SHA256 d4519a742d689693e5b616886d2e2f20093951ad68e4d46e0cfc956c4248d52c
- MD5 ab350cd3ad75ca419aec1d30ac52cfed
- SHA1 4a5a5de2fb3c717729202be313cd4fb8e5bc1fee
- SHA512 92bf9abd9aa556d835c4516390a977b010b40c87244c51aab68a7fe3aadf2728b81dc8e148d6397114422fd26aed064d0c23b3d0770040998728dd26eadc3b86
- SSDEEP 3072:mEGh0o5lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGPlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D5CDAD7E-2314-4b69-92E4-7AA17872A98A}.exe
- Size 344KB
- SHA256 44ebd6e60216fafa267c90259ee54c86381b73828a32db3b701203acb372a9ee
- MD5 e9e57dc36145b14f490cca8af42a63ae
- SHA1 e7abb19f4d58bb55183eb2ad2dd471b771d55147
- SHA512 bffc3fb8135f2cb452a3433dcb68cc9efcc142b3554ffe114ab2396a325093890dc500555c25ab5271cade5fdb09d89fac78935d766ba4aa20cb5f5ae516b55c
- SSDEEP 3072:mEGh0otlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGLlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F5E66775-5950-4bc2-94E5-C075A6EE27C5}.exe
- Size 344KB
- SHA256 1c4f9be1eb06a3a6b641110418924e9b5668a52fea5de4da91b8016f46694941
- MD5 0ddfb91ddca13c9ef0e5224af8316d7a
- SHA1 53d6a3dbd638b616496db17f8b456256d149315c
- SHA512 cb53c5ee2cc026250ff784bf148d3e280fee96c8a3149ba4b52594bef65de78511ebdb998bc1a6de122574e979e25c83f2cb7952117df3bbe32e98936ad3f3f7
- SSDEEP 3072:mEGh0oRlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGzlqOe2MUVg3v2IneKcAEcA
- MD5 SHA1 SHA512 SSDEEP