Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe
- Size 216KB
- Sample240613-mjktlavdnd
- SHA256 3c20f635aa39055295e0b5548ecda9db7057f2f8fb4c71dc1caa3cd5b098319f
- MD5 58dfd8cd2900375c29eac9d02fb10b2f
- SHA1 18c14d5698331590a6234cf14f6b8ac55aa3219a
- SHA512 daed22fd147e8298e7f866bc6406bcd20825b70b98866a043ba9263ada1d76bf5bfe6346f12111858df383d763270039f72a9707b9a992e2b0e47f95241f7c26
- SSDEEP 3072:jEGh0o+l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGolEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000b000000023671-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023676-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023372-10.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023375-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023372-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023375-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023372-25.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023388-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023372-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023388-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c0000000006c3-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023388-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C55A0F74-4682-4b11-A378-C8A1C3677CF9} {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{217AF1B7-504D-4f90-BB0B-0743C0A747C3} {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{217AF1B7-504D-4f90-BB0B-0743C0A747C3}\stubpath = "C:\\Windows\\{217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe" {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8} {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8} {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}\stubpath = "C:\\Windows\\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe" {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACB85AE1-D36D-4298-921F-410C08AF88E3}\stubpath = "C:\\Windows\\{ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe" {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2261AAA3-584E-4ec8-A545-149C1653909C} {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9713E2D1-E554-41d1-B35D-FDA16CA889DC}\stubpath = "C:\\Windows\\{9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe" {2261AAA3-584E-4ec8-A545-149C1653909C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACB85AE1-D36D-4298-921F-410C08AF88E3} {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6}\stubpath = "C:\\Windows\\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe" {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2261AAA3-584E-4ec8-A545-149C1653909C}\stubpath = "C:\\Windows\\{2261AAA3-584E-4ec8-A545-149C1653909C}.exe" {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6} {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}\stubpath = "C:\\Windows\\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe" 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C} {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C}\stubpath = "C:\\Windows\\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe" {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{018B3D2C-5399-4c97-98B1-888AB9BE74B2} {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{018B3D2C-5399-4c97-98B1-888AB9BE74B2}\stubpath = "C:\\Windows\\{018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe" {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}\stubpath = "C:\\Windows\\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe" {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C55A0F74-4682-4b11-A378-C8A1C3677CF9}\stubpath = "C:\\Windows\\{C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe" {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F4757EB-01FC-4735-B912-F7D1F6653CAC} {C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A} 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9713E2D1-E554-41d1-B35D-FDA16CA889DC} {2261AAA3-584E-4ec8-A545-149C1653909C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F4757EB-01FC-4735-B912-F7D1F6653CAC}\stubpath = "C:\\Windows\\{3F4757EB-01FC-4735-B912-F7D1F6653CAC}.exe" {C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe - Executes dropped EXE 12 IoCs
pid Process 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 4824 {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe 3568 {C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe 2364 {3F4757EB-01FC-4735-B912-F7D1F6653CAC}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe File created C:\Windows\{C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe File created C:\Windows\{018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe File created C:\Windows\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe File created C:\Windows\{2261AAA3-584E-4ec8-A545-149C1653909C}.exe {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe File created C:\Windows\{9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe {2261AAA3-584E-4ec8-A545-149C1653909C}.exe File created C:\Windows\{ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe File created C:\Windows\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe File created C:\Windows\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe File created C:\Windows\{217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe File created C:\Windows\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe File created C:\Windows\{3F4757EB-01FC-4735-B912-F7D1F6653CAC}.exe {C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe Token: SeIncBasePriorityPrivilege 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe Token: SeIncBasePriorityPrivilege 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe Token: SeIncBasePriorityPrivilege 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe Token: SeIncBasePriorityPrivilege 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe Token: SeIncBasePriorityPrivilege 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe Token: SeIncBasePriorityPrivilege 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe Token: SeIncBasePriorityPrivilege 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe Token: SeIncBasePriorityPrivilege 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe Token: SeIncBasePriorityPrivilege 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe Token: SeIncBasePriorityPrivilege 4824 {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe Token: SeIncBasePriorityPrivilege 3568 {C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 788 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 93 PID 3152 wrote to memory of 788 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 93 PID 3152 wrote to memory of 788 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 93 PID 3152 wrote to memory of 3284 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 94 PID 3152 wrote to memory of 3284 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 94 PID 3152 wrote to memory of 3284 3152 2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe 94 PID 788 wrote to memory of 516 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 95 PID 788 wrote to memory of 516 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 95 PID 788 wrote to memory of 516 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 95 PID 788 wrote to memory of 4468 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 96 PID 788 wrote to memory of 4468 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 96 PID 788 wrote to memory of 4468 788 {3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe 96 PID 516 wrote to memory of 4328 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 101 PID 516 wrote to memory of 4328 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 101 PID 516 wrote to memory of 4328 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 101 PID 516 wrote to memory of 2364 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 102 PID 516 wrote to memory of 2364 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 102 PID 516 wrote to memory of 2364 516 {72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe 102 PID 4328 wrote to memory of 2548 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 103 PID 4328 wrote to memory of 2548 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 103 PID 4328 wrote to memory of 2548 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 103 PID 4328 wrote to memory of 1416 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 104 PID 4328 wrote to memory of 1416 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 104 PID 4328 wrote to memory of 1416 4328 {018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe 104 PID 2548 wrote to memory of 1740 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 105 PID 2548 wrote to memory of 1740 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 105 PID 2548 wrote to memory of 1740 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 105 PID 2548 wrote to memory of 4320 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 106 PID 2548 wrote to memory of 4320 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 106 PID 2548 wrote to memory of 4320 2548 {217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe 106 PID 1740 wrote to memory of 4024 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 107 PID 1740 wrote to memory of 4024 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 107 PID 1740 wrote to memory of 4024 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 107 PID 1740 wrote to memory of 4372 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 108 PID 1740 wrote to memory of 4372 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 108 PID 1740 wrote to memory of 4372 1740 {2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe 108 PID 4024 wrote to memory of 3068 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 109 PID 4024 wrote to memory of 3068 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 109 PID 4024 wrote to memory of 3068 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 109 PID 4024 wrote to memory of 3088 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 110 PID 4024 wrote to memory of 3088 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 110 PID 4024 wrote to memory of 3088 4024 {F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe 110 PID 3068 wrote to memory of 924 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 113 PID 3068 wrote to memory of 924 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 113 PID 3068 wrote to memory of 924 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 113 PID 3068 wrote to memory of 60 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 114 PID 3068 wrote to memory of 60 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 114 PID 3068 wrote to memory of 60 3068 {2261AAA3-584E-4ec8-A545-149C1653909C}.exe 114 PID 924 wrote to memory of 520 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 115 PID 924 wrote to memory of 520 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 115 PID 924 wrote to memory of 520 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 115 PID 924 wrote to memory of 2596 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 116 PID 924 wrote to memory of 2596 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 116 PID 924 wrote to memory of 2596 924 {9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe 116 PID 520 wrote to memory of 4824 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 117 PID 520 wrote to memory of 4824 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 117 PID 520 wrote to memory of 4824 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 117 PID 520 wrote to memory of 1896 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 118 PID 520 wrote to memory of 1896 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 118 PID 520 wrote to memory of 1896 520 {ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe 118 PID 4824 wrote to memory of 3568 4824 {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe 119 PID 4824 wrote to memory of 3568 4824 {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe 119 PID 4824 wrote to memory of 3568 4824 {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe 119 PID 4824 wrote to memory of 4592 4824 {A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_58dfd8cd2900375c29eac9d02fb10b2f_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exeC:\Windows\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exeC:\Windows\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\{018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exeC:\Windows\{018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\{217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exeC:\Windows\{217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exeC:\Windows\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exeC:\Windows\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\{2261AAA3-584E-4ec8-A545-149C1653909C}.exeC:\Windows\{2261AAA3-584E-4ec8-A545-149C1653909C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\{9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exeC:\Windows\{9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\{ACB85AE1-D36D-4298-921F-410C08AF88E3}.exeC:\Windows\{ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exeC:\Windows\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\{C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exeC:\Windows\{C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3568 -
C:\Windows\{3F4757EB-01FC-4735-B912-F7D1F6653CAC}.exeC:\Windows\{3F4757EB-01FC-4735-B912-F7D1F6653CAC}.exe13⤵
- Executes dropped EXE
PID:2364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C55A0~1.EXE > nul13⤵PID:516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5011~1.EXE > nul12⤵PID:4592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACB85~1.EXE > nul11⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9713E~1.EXE > nul10⤵PID:2596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2261A~1.EXE > nul9⤵PID:60
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F95C2~1.EXE > nul8⤵PID:3088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F0E4~1.EXE > nul7⤵PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{217AF~1.EXE > nul6⤵PID:4320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{018B3~1.EXE > nul5⤵PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72F0A~1.EXE > nul4⤵PID:2364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C1F7~1.EXE > nul3⤵PID:4468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1444,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:81⤵PID:396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{018B3D2C-5399-4c97-98B1-888AB9BE74B2}.exe
- Size 216KB
- SHA256 7dbc72adab684fdc191e9dae27ed275c09b05fe362dbb06cfc6ae865ffae0345
- MD5 2e34e54943ac67cd834bab0a75c43998
- SHA1 d472e31bf044c95a128918e135c8c45aa7665fef
- SHA512 93792c02c542399484fc299f9d6c53f077c9f0282410400344cab34c8e9a3e5dadcf38a75a36752e8ef830d5311c06d14204431baded676a02a06ca4eb66b46c
- SSDEEP 3072:jEGh0o/8l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGl8lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{217AF1B7-504D-4f90-BB0B-0743C0A747C3}.exe
- Size 216KB
- SHA256 79031c9b669a8797b9d50677181c0910be11a5e85d8d7436f298c0ee9687da46
- MD5 b0787df3a571192a49e69c332dc4f872
- SHA1 35e0828fa56c8dd294919a8864740147fc9251a3
- SHA512 79b81d7f18fb42693bafbd34cdb4cfaaefdf54a8accbc0ca7ebc50a7c1245b024654fdc5a4aefadb1a4e1828016cdc02598cf0d9cbe293aed6c9d846aa2bfbe2
- SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGzlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2261AAA3-584E-4ec8-A545-149C1653909C}.exe
- Size 216KB
- SHA256 461e6e3c40420bdb883bbc6f19a4a95ed16d35958e9d87c1fcf4aeadf3d48cc9
- MD5 8c853bbc1b20f031e83d69a16ee8cc65
- SHA1 f27ee53a7c66d274eb9d846c0bd2a567856c1e91
- SHA512 83fafdec30afafb8d5bcf08fcf0907617c158d7219125a0912574c0f996e4f867b3fc81d5d5ab5312f27f5bf0f73a5bc15bb33aa0d60f6974afc86ed6c337559
- SSDEEP 3072:jEGh0otl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGflEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2F0E4DFB-1BC7-490f-AB58-BE6A3D7167C8}.exe
- Size 216KB
- SHA256 25d9942e026806a4110d63c67aad664a820a1fe83f29fed5ae4eb9db5862ac18
- MD5 1cfb608f3268803569c3c2038afe4c8a
- SHA1 e87b6e4a00bfe797a503b173bd4d1365d8dba38a
- SHA512 82848c9ec5e6a2b7f5d6ae73e6cae72736aff36e383d1d81b985c74ec9aaa2bf06002d87e5e220817fe413dba473e643e2a1fc70e0ddf2791f68cb34c7b0e3ce
- SSDEEP 3072:jEGh0oil+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGwlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3C1F7756-EB6D-45e6-987C-C5B9EAA4391A}.exe
- Size 216KB
- SHA256 c5b845acb62464339cd9d28106faf0fc0ea431ff457ab9573a5bd7d6036417e1
- MD5 20552c164f82aee1996fcebdf168e928
- SHA1 54d8ab485950c3e2fa3a31c12ecc3ebba79c6c44
- SHA512 e7a11d91f98b3dd89d7b7f4afe5d4c5bb8115180f746cdb65a4bfdc0f58d536878164187a40848d4d745606ce3c4134272d71f4f19623b9ab38686653dc80964
- SSDEEP 3072:jEGh0ogl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGGlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3F4757EB-01FC-4735-B912-F7D1F6653CAC}.exe
- Size 216KB
- SHA256 75d74f5b9530f71a369cd23f20908e636cbd92fb16b56f01129b062f07032d94
- MD5 eaa43d1bcafcd4d9389f3ec35459a8c3
- SHA1 2bf01c0ccdbb4d2fda340e200d9c759a17895243
- SHA512 bdf2a0e1b81f55aab3034dd159980576e16586195024f92567dd4f2776fc9e59661c9c89b0840811d80bfae8d589b2fe9f9203fc4c5e32299c4a64b08e140578
- SSDEEP 3072:jEGh0ooKl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG5lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{72F0A0DD-BED0-4fc1-9BD8-915FF187508C}.exe
- Size 216KB
- SHA256 8bf3a5737960abb8898274eda7af8ff69bb2dcb12aa521801474980ff535cb13
- MD5 fdf73749db6b58429e7ccacecac94afb
- SHA1 0e62cf9c1d37a0b3bcd2a5a42612c853568c46a5
- SHA512 9c04ba0dbb37bcee50a2ace800a2e47282a638ee43c7052687c89275d7f558e4fe1d85c66d3d4db6d81f97dc2df95a42281d0d5b41dd36517eacdfcd84ac1769
- SSDEEP 3072:jEGh0orl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG9lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9713E2D1-E554-41d1-B35D-FDA16CA889DC}.exe
- Size 216KB
- SHA256 131da7d8ae3af6a012beca385e83fcaa07f749499f8248aa5bd50c851207f8af
- MD5 e00f1854cfadcc5d362b5ac62d818e56
- SHA1 de52eaddaffcdf899797eea85164149f0d9b742e
- SHA512 d3d41d0a2e6d1b93221c7d04f36f0fe3b92f0d6ef22ea27f8adbbbac98a6964216bbb891e07000a0eaee2f7fba0554997a8467f2f1715a8b9ea198f0c69f3c62
- SSDEEP 3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGdlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A5011B44-2295-49ed-929B-B9A2C5C8B6A6}.exe
- Size 216KB
- SHA256 c24ff52e35fc472fcf861af82b2ec0809f764c48f1394af62d286a78f44949b3
- MD5 8e534c2683dbf9b2fd2ac3f3becb6160
- SHA1 85b0d680e9fbf7cc25c1cd8711e8f5208a7ec046
- SHA512 c4bbb88e067ed7d044d1f984785933a8430dbf92309d91ae7d8c154b8ce1cc2560c6f04e36c4e24e8c012186fcaf6bc4e609197188c570a1fbaed67c0b533a51
- SSDEEP 3072:jEGh0oql+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGIlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ACB85AE1-D36D-4298-921F-410C08AF88E3}.exe
- Size 216KB
- SHA256 260524368bd38f0f2d5917c0766b38cdbe42a0112ec52724530ecffb9351e7ae
- MD5 19f2511947811fefe10cee74de2fa28d
- SHA1 648c6195dd113efca34ad5168692edf81473b171
- SHA512 847ac4a5a3ffe9d05bd0f9995938ef9957d579a611a0186147868a53afaa1f16562fd326a42816a5513ee48640f04ffc9036da093098c9184436ed127b3cd833
- SSDEEP 3072:jEGh0oVl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGblEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C55A0F74-4682-4b11-A378-C8A1C3677CF9}.exe
- Size 216KB
- SHA256 02896d3332840a9588c1e214d12eef1f2bea2c9792cdaaf85a9c29fde3d2ce44
- MD5 246b94dffa7538ab031084d80a685ee7
- SHA1 fd727013a22e16c422949ac41f86e0960262d536
- SHA512 bbaa76aba58648ee08930e1f926e395619508db72e8a8b86028982a9060d440992997f79252fa51ecefd402d8229a2bfc30c9355d46b6fe386810dcda8102dbe
- SSDEEP 3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGflEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F95C2C19-C4E4-44c4-BC0E-0883EF5342A8}.exe
- Size 216KB
- SHA256 99dfde6333a345ab5647ff85d37816ba40145ff5b84f8f11ed45852b837296b0
- MD5 4e79cb9cb5067cf982ae08cbfb544b52
- SHA1 ceba40973ba1043be33e85183113e78c78625040
- SHA512 c805b6ce4a60a1f7fda7384ebf7e95cb472a0b222b8b420eece53ba11e80deead76e0a3ac30ddc747144dd84b61170d88eeea6a107561fa71a77fab2b5fc4011
- SSDEEP 3072:jEGh0oul+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGMlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP