Analysis
- max time kernel
149s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 11:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe
- Size 192KB
- Sample240613-m366yazejq
- SHA256 fcbc3419c53b2818f32af9b6d6217e848641940da6e38062a4ad9c932126e93b
- MD5 ed66ef9a367080a58cc2853e35f54f32
- SHA1 3177aec07ba9789162768754feba4dd01f772d42
- SHA512 38731f1b2d83b6d99e2ae5b8398193b090ef0e3fe612c44c82416705a1441a6ba98e2ebd178bfc1df9ad38ff77c835f93e960dab60c9fd43e0ad986dc2423812
- SSDEEP 1536:1EGh0ool15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ool1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000d0000000233b5-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233bd-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f0000000233be-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233bd-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00100000000233be-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d0000000233bd-23.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00110000000233be-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a0000000233e1-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00120000000233be-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b0000000233e1-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00130000000233be-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000233e1-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{848A1749-70FC-47e6-A37B-6458E3D57564}\stubpath = "C:\\Windows\\{848A1749-70FC-47e6-A37B-6458E3D57564}.exe" {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9DE25F7-5EF7-464f-B45D-2DECE3323678} {848A1749-70FC-47e6-A37B-6458E3D57564}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B67ED58-8765-4a2b-9324-460C0AA81393} 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}\stubpath = "C:\\Windows\\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe" {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28F03A51-F1EB-4557-8717-CBAE556C8737}\stubpath = "C:\\Windows\\{28F03A51-F1EB-4557-8717-CBAE556C8737}.exe" {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{537C1224-B688-4065-BC81-D3492AF6D1D5} {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{537C1224-B688-4065-BC81-D3492AF6D1D5}\stubpath = "C:\\Windows\\{537C1224-B688-4065-BC81-D3492AF6D1D5}.exe" {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{848A1749-70FC-47e6-A37B-6458E3D57564} {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}\stubpath = "C:\\Windows\\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe" {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD259FA7-DB50-4183-A243-6035C1BFC070}\stubpath = "C:\\Windows\\{FD259FA7-DB50-4183-A243-6035C1BFC070}.exe" {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C14254B-79CB-47b2-AB81-B277607DBAAE} {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4} {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD259FA7-DB50-4183-A243-6035C1BFC070} {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C} {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}\stubpath = "C:\\Windows\\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe" {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}\stubpath = "C:\\Windows\\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}.exe" {2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA} {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28F03A51-F1EB-4557-8717-CBAE556C8737} {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13299D9C-7A4C-4d63-B0F3-F699692A4A32} {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9DE25F7-5EF7-464f-B45D-2DECE3323678}\stubpath = "C:\\Windows\\{E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe" {848A1749-70FC-47e6-A37B-6458E3D57564}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B67ED58-8765-4a2b-9324-460C0AA81393}\stubpath = "C:\\Windows\\{1B67ED58-8765-4a2b-9324-460C0AA81393}.exe" 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13299D9C-7A4C-4d63-B0F3-F699692A4A32}\stubpath = "C:\\Windows\\{13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe" {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C14254B-79CB-47b2-AB81-B277607DBAAE}\stubpath = "C:\\Windows\\{0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe" {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC} {2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe - Executes dropped EXE 12 IoCs
pid Process 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 1396 {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe 3528 {2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe 8 {CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{537C1224-B688-4065-BC81-D3492AF6D1D5}.exe {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe File created C:\Windows\{13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe File created C:\Windows\{E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe {848A1749-70FC-47e6-A37B-6458E3D57564}.exe File created C:\Windows\{0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe File created C:\Windows\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe File created C:\Windows\{FD259FA7-DB50-4183-A243-6035C1BFC070}.exe {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe File created C:\Windows\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe File created C:\Windows\{28F03A51-F1EB-4557-8717-CBAE556C8737}.exe {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe File created C:\Windows\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe File created C:\Windows\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}.exe {2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe File created C:\Windows\{1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe File created C:\Windows\{848A1749-70FC-47e6-A37B-6458E3D57564}.exe {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe Token: SeIncBasePriorityPrivilege 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe Token: SeIncBasePriorityPrivilege 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe Token: SeIncBasePriorityPrivilege 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe Token: SeIncBasePriorityPrivilege 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe Token: SeIncBasePriorityPrivilege 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe Token: SeIncBasePriorityPrivilege 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe Token: SeIncBasePriorityPrivilege 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe Token: SeIncBasePriorityPrivilege 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe Token: SeIncBasePriorityPrivilege 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe Token: SeIncBasePriorityPrivilege 1396 {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe Token: SeIncBasePriorityPrivilege 3528 {2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3740 wrote to memory of 3352 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe 88 PID 3740 wrote to memory of 3352 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe 88 PID 3740 wrote to memory of 3352 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe 88 PID 3740 wrote to memory of 4140 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe 89 PID 3740 wrote to memory of 4140 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe 89 PID 3740 wrote to memory of 4140 3740 2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe 89 PID 3352 wrote to memory of 1380 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 90 PID 3352 wrote to memory of 1380 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 90 PID 3352 wrote to memory of 1380 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 90 PID 3352 wrote to memory of 4812 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 91 PID 3352 wrote to memory of 4812 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 91 PID 3352 wrote to memory of 4812 3352 {1B67ED58-8765-4a2b-9324-460C0AA81393}.exe 91 PID 1380 wrote to memory of 4076 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 95 PID 1380 wrote to memory of 4076 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 95 PID 1380 wrote to memory of 4076 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 95 PID 1380 wrote to memory of 3064 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 96 PID 1380 wrote to memory of 3064 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 96 PID 1380 wrote to memory of 3064 1380 {A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe 96 PID 4076 wrote to memory of 412 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 97 PID 4076 wrote to memory of 412 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 97 PID 4076 wrote to memory of 412 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 97 PID 4076 wrote to memory of 4112 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 98 PID 4076 wrote to memory of 4112 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 98 PID 4076 wrote to memory of 4112 4076 {28F03A51-F1EB-4557-8717-CBAE556C8737}.exe 98 PID 412 wrote to memory of 3496 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 99 PID 412 wrote to memory of 3496 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 99 PID 412 wrote to memory of 3496 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 99 PID 412 wrote to memory of 3628 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 100 PID 412 wrote to memory of 3628 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 100 PID 412 wrote to memory of 3628 412 {537C1224-B688-4065-BC81-D3492AF6D1D5}.exe 100 PID 3496 wrote to memory of 1520 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 101 PID 3496 wrote to memory of 1520 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 101 PID 3496 wrote to memory of 1520 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 101 PID 3496 wrote to memory of 4396 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 102 PID 3496 wrote to memory of 4396 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 102 PID 3496 wrote to memory of 4396 3496 {13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe 102 PID 1520 wrote to memory of 4136 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 103 PID 1520 wrote to memory of 4136 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 103 PID 1520 wrote to memory of 4136 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 103 PID 1520 wrote to memory of 4920 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 104 PID 1520 wrote to memory of 4920 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 104 PID 1520 wrote to memory of 4920 1520 {848A1749-70FC-47e6-A37B-6458E3D57564}.exe 104 PID 4136 wrote to memory of 1904 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 105 PID 4136 wrote to memory of 1904 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 105 PID 4136 wrote to memory of 1904 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 105 PID 4136 wrote to memory of 1788 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 106 PID 4136 wrote to memory of 1788 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 106 PID 4136 wrote to memory of 1788 4136 {E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe 106 PID 1904 wrote to memory of 3512 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 107 PID 1904 wrote to memory of 3512 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 107 PID 1904 wrote to memory of 3512 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 107 PID 1904 wrote to memory of 4564 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 108 PID 1904 wrote to memory of 4564 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 108 PID 1904 wrote to memory of 4564 1904 {0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe 108 PID 3512 wrote to memory of 1396 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 109 PID 3512 wrote to memory of 1396 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 109 PID 3512 wrote to memory of 1396 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 109 PID 3512 wrote to memory of 4848 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 110 PID 3512 wrote to memory of 4848 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 110 PID 3512 wrote to memory of 4848 3512 {9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe 110 PID 1396 wrote to memory of 3528 1396 {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe 111 PID 1396 wrote to memory of 3528 1396 {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe 111 PID 1396 wrote to memory of 3528 1396 {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe 111 PID 1396 wrote to memory of 5028 1396 {FD259FA7-DB50-4183-A243-6035C1BFC070}.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_ed66ef9a367080a58cc2853e35f54f32_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\{1B67ED58-8765-4a2b-9324-460C0AA81393}.exeC:\Windows\{1B67ED58-8765-4a2b-9324-460C0AA81393}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exeC:\Windows\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\{28F03A51-F1EB-4557-8717-CBAE556C8737}.exeC:\Windows\{28F03A51-F1EB-4557-8717-CBAE556C8737}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\{537C1224-B688-4065-BC81-D3492AF6D1D5}.exeC:\Windows\{537C1224-B688-4065-BC81-D3492AF6D1D5}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\{13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exeC:\Windows\{13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\{848A1749-70FC-47e6-A37B-6458E3D57564}.exeC:\Windows\{848A1749-70FC-47e6-A37B-6458E3D57564}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\{E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exeC:\Windows\{E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\{0C14254B-79CB-47b2-AB81-B277607DBAAE}.exeC:\Windows\{0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exeC:\Windows\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\{FD259FA7-DB50-4183-A243-6035C1BFC070}.exeC:\Windows\{FD259FA7-DB50-4183-A243-6035C1BFC070}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exeC:\Windows\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3528 -
C:\Windows\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}.exeC:\Windows\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}.exe13⤵
- Executes dropped EXE
PID:8
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D0C8~1.EXE > nul13⤵PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD259~1.EXE > nul12⤵PID:5028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D474~1.EXE > nul11⤵PID:4848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C142~1.EXE > nul10⤵PID:4564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9DE2~1.EXE > nul9⤵PID:1788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{848A1~1.EXE > nul8⤵PID:4920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13299~1.EXE > nul7⤵PID:4396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{537C1~1.EXE > nul6⤵PID:3628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28F03~1.EXE > nul5⤵PID:4112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A63BD~1.EXE > nul4⤵PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B67E~1.EXE > nul3⤵PID:4812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0C14254B-79CB-47b2-AB81-B277607DBAAE}.exe
- Size 192KB
- SHA256 7ebb27236fac5d1918a43fa4b36464bc1e976f8e24f18e53be58665a7e25eae4
- MD5 855605bbb4c1f3a3a45493a073a32446
- SHA1 007e95eb96a4dcace4e1f6f5bc1925dc2781ea41
- SHA512 5287dcd4d4f15a93199c2392630dacef8442c22dbf00e038eb36e3eaae5e30d3575e3809323781a7f190e744090b2258600e5fee1ffb5dceb143c7206dafa093
- SSDEEP 1536:1EGh0oJl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oJl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{13299D9C-7A4C-4d63-B0F3-F699692A4A32}.exe
- Size 192KB
- SHA256 ddc5d01387f81f52bd919a70d3e0836c908d4c2e124bf2fafac47a707fabcbd7
- MD5 7412286b96fdca49ecb0c619ab6b83ef
- SHA1 3a13a10210eb1c32c4f3deffe9599112fc2051d9
- SHA512 71df1d6ecdf073bc2fedf8a7aa7988708f555091b9df47c62d80d972d51288927f60527df947371c7e2ff28d0b2e0e20b0ea2b44da4cbbe962fdc68458c45382
- SSDEEP 1536:1EGh0ofl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ofl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1B67ED58-8765-4a2b-9324-460C0AA81393}.exe
- Size 192KB
- SHA256 f0ab2ebda137187734d9f827cc9f551ef0fe7d1893686141826d20c5d6d7faf7
- MD5 71e4377217d2a71f4b9261245e718e4e
- SHA1 4b54a8bad8f0742a9646edd60d4fb2cbdbc04f05
- SHA512 dd150d0e1a951d72cf51df600bdee78018903a4a82d5ccbf8a47f69aa0433cbaa6b651b02004d9bbfef5dacb0c35f43af4bf9e9f2e7a2a851bbbe5618e3b3c26
- SSDEEP 1536:1EGh0o+l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o+l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{28F03A51-F1EB-4557-8717-CBAE556C8737}.exe
- Size 192KB
- SHA256 3b58326cdaa9b59d2bae16ce5f01f829aa6a5128b4f1afaf3dc159ad90e51161
- MD5 88180bd85feffcc262394932cecfa590
- SHA1 e176c1cf362846398ce71c37f9f3ae0e4d28825c
- SHA512 0c22edd62cd0044f0548beb4c7843e33f2c3881411bbfe0d1efad54049a217ec20cbb4c4c77c113aa053631aa88d4516f953206623a421b5de9883ce4b7b92f6
- SSDEEP 1536:1EGh0oFl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oFl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2D0C8AD0-42E1-4ae3-8B46-8297E713C61C}.exe
- Size 192KB
- SHA256 55cb0d9f8a41f8de210dbbd077aed05fd843cb0b60fd7a06495c45212db51ce8
- MD5 2430b93a6d5da2cc85820f44fc902302
- SHA1 17cc4622785c748a4340893c2380bd600ace3ee5
- SHA512 eae6a53d44ea9bf79b22f6b03b0d864d3014adf966e43e3775488bb826d04d55a3f380e80e48f72b108db534a9cf3a04d192417a02140e1f28d1ca1ccb909840
- SSDEEP 1536:1EGh0o6l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o6l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{537C1224-B688-4065-BC81-D3492AF6D1D5}.exe
- Size 192KB
- SHA256 6a57e7ee584e719c8b8b19da755fc9ea0caf349ec5f345d663b40882e16fccdf
- MD5 1a3f3111f67eea815878022481de3b38
- SHA1 733a80ae4d37d8a8533c20cc81d52eef9f67a238
- SHA512 5228aabb1c1126f40f69cd51a8291dc15508c7b099ceafa489f202e7c873a7a0264b542d0e9913d06f865031ab16a5bae4f0a24c29b56d60ddfa4437991fb8dd
- SSDEEP 1536:1EGh0oZTl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oRl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{848A1749-70FC-47e6-A37B-6458E3D57564}.exe
- Size 192KB
- SHA256 8639708a69bf8b96b665fccb5fa4b55215375d69239069b9be40572af906d573
- MD5 879858c71db91ffdb6392fa7e382c16a
- SHA1 d864b89a9710d8b7d80eab5e628ba9c186c72f7e
- SHA512 47ed3eb735ee4647626acaf7d48ba5b040ee25f54e267f784aa0757cde5160e42bfb8c0d223065f5f21ae50c5cf9e93699ccd6a014c4b44e333ccfd4836499f5
- SSDEEP 1536:1EGh0o/l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o/l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9D4746D8-BCC5-4c46-B2A2-8C255FA0EEA4}.exe
- Size 192KB
- SHA256 dd3da0fdf0de04dd8bf12cc0900c8f9d64c4f87a512e612af5ea73fd8e203e5c
- MD5 7903a0d90dee7c9be32d4a1085a2dbd7
- SHA1 19039bcc817356f432b57e44d61893147eb36f82
- SHA512 456d22068f79dab91090df7b5197d2e2764d5978e65f3646626bf800f72d218885443a9e9cf372a3aab0bd524d9a118eaeb1a4f6103008e70cbe50821bec6978
- SSDEEP 1536:1EGh0o6l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o6l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A63BD5DF-A816-46e7-8AAD-FE1CDCD6E9EA}.exe
- Size 192KB
- SHA256 52e97987e633a77c7235c62648a26f5afb977feb44bfa92b7af0db1496a2a11d
- MD5 b5979187aa7c76fcee0f0feb42b7e48f
- SHA1 f82a676b6a931c201dc6404f23b7425c1d78f9f7
- SHA512 158174adc1fa751a30cfde1936a5f8de1a1db602b4ca564bdc6a43c6096299c31b89df29ca35a8a889866be4aa152437d1b5c583f5bbab490ce6ec94bb52fc6d
- SSDEEP 1536:1EGh0orl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0orl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{CBC31B67-DDA1-4b6d-B5F0-375A091DBEAC}.exe
- Size 192KB
- SHA256 20bd9f054dc9f19fea297cf7371be643674dfa3e9a1908f4757aadc2f8a08918
- MD5 3be693e065ba328aa829aaef92fa9e53
- SHA1 9601ee509a4720b59626800fa9e21f16496dbd03
- SHA512 9564ef4b5651db048471555de6256ea109e43115d6046871d64dfe5c6c420bac1f525283389148765a287fbc380f2fd33578010462e15f1f3f193845fd6c8e57
- SSDEEP 1536:1EGh0ofl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ofl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E9DE25F7-5EF7-464f-B45D-2DECE3323678}.exe
- Size 192KB
- SHA256 02108614fc0b4bf30f713e8f483b1df0a7ea837193c5c1f6f1318399c0e68a1b
- MD5 e93a8b8123441d5cc4e41a6007485366
- SHA1 ddd191491381b0bb27699fa5e7f1c1c530553915
- SHA512 f2cbef6b3c7f288a04901ea8d4c3866ed9d0ef536efe23ebff1bc1e20ce525b7ffdb1e9f255ba23378b468e8e98261f3d7195d1f434970966553761d0189d182
- SSDEEP 1536:1EGh0oSl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oSl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FD259FA7-DB50-4183-A243-6035C1BFC070}.exe
- Size 192KB
- SHA256 fb6be43243309a40c5fc68c46ee3f312e48d897ef597600241e8bf5cd8eb55b5
- MD5 6be449590ba3e9e629901eab540e831f
- SHA1 107f10ff28930d13588c12264f5079f2293ab4e5
- SHA512 a0cef5b96034a6f227181fe7088b568a56b38ab85a9ef1fdce035998b4c66ae081ceed01af5e1d904a248cd1a4f76198831b486001e77b6e167cbca96d0d0701
- SSDEEP 1536:1EGh0o7l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o7l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP