Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe
- Size 216KB
- Sample240613-mlp64aygjp
- SHA256 324c0a88341cd65599ea930d78265ca056bb9c8cde9bcbc9e5c1d1f6c3b899c5
- MD5 97ee751569506f65d6241243903d98c8
- SHA1 84cfedc48156de4fadadb98791c343c6fe8bf920
- SHA512 028d2efed303eec0aec4329776aee04b9cfcf1e3ab8bda73dabdb3ed6a7bada48b13c0029edb723dc72eb43a53fcb36cb4746460cce102ab5ff39a0248447b86
- SSDEEP 3072:jEGh0oPal+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG0lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x0005000000022abf-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c00000002337a-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023418-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002341c-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023422-17.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002341c-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023422-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023423-29.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023422-35.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023423-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023422-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023423-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66} {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269} {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E849996-637C-48de-933A-C52B4D2C9D2E} {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1459612F-948A-4e34-BABA-0977F8962382}\stubpath = "C:\\Windows\\{1459612F-948A-4e34-BABA-0977F8962382}.exe" {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9} {1459612F-948A-4e34-BABA-0977F8962382}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C} {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}\stubpath = "C:\\Windows\\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe" {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF} {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421C208E-BB90-4cdf-9985-429FC8F52235} {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE} {421C208E-BB90-4cdf-9985-429FC8F52235}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{444C24F5-6808-4a0e-9621-0B712DBAFBAF} {368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18567945-EE45-47ea-AC4A-2F6EA74E32A4}\stubpath = "C:\\Windows\\{18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe" 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89F02A17-6799-4e82-85DE-F23C05C5AF2C}\stubpath = "C:\\Windows\\{89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe" {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421C208E-BB90-4cdf-9985-429FC8F52235}\stubpath = "C:\\Windows\\{421C208E-BB90-4cdf-9985-429FC8F52235}.exe" {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66}\stubpath = "C:\\Windows\\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe" {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{444C24F5-6808-4a0e-9621-0B712DBAFBAF}\stubpath = "C:\\Windows\\{444C24F5-6808-4a0e-9621-0B712DBAFBAF}.exe" {368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1459612F-948A-4e34-BABA-0977F8962382} {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}\stubpath = "C:\\Windows\\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe" {1459612F-948A-4e34-BABA-0977F8962382}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}\stubpath = "C:\\Windows\\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe" {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18567945-EE45-47ea-AC4A-2F6EA74E32A4} 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89F02A17-6799-4e82-85DE-F23C05C5AF2C} {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF}\stubpath = "C:\\Windows\\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe" {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE}\stubpath = "C:\\Windows\\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe" {421C208E-BB90-4cdf-9985-429FC8F52235}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E849996-637C-48de-933A-C52B4D2C9D2E}\stubpath = "C:\\Windows\\{0E849996-637C-48de-933A-C52B4D2C9D2E}.exe" {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe - Executes dropped EXE 12 IoCs
pid Process 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 1412 {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe 644 {368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe 4104 {444C24F5-6808-4a0e-9621-0B712DBAFBAF}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe File created C:\Windows\{421C208E-BB90-4cdf-9985-429FC8F52235}.exe {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe File created C:\Windows\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe {421C208E-BB90-4cdf-9985-429FC8F52235}.exe File created C:\Windows\{0E849996-637C-48de-933A-C52B4D2C9D2E}.exe {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe File created C:\Windows\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe File created C:\Windows\{18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe File created C:\Windows\{89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe File created C:\Windows\{1459612F-948A-4e34-BABA-0977F8962382}.exe {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe File created C:\Windows\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe {1459612F-948A-4e34-BABA-0977F8962382}.exe File created C:\Windows\{444C24F5-6808-4a0e-9621-0B712DBAFBAF}.exe {368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe File created C:\Windows\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe File created C:\Windows\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe Token: SeIncBasePriorityPrivilege 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe Token: SeIncBasePriorityPrivilege 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe Token: SeIncBasePriorityPrivilege 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe Token: SeIncBasePriorityPrivilege 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe Token: SeIncBasePriorityPrivilege 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe Token: SeIncBasePriorityPrivilege 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe Token: SeIncBasePriorityPrivilege 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe Token: SeIncBasePriorityPrivilege 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe Token: SeIncBasePriorityPrivilege 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe Token: SeIncBasePriorityPrivilege 1412 {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe Token: SeIncBasePriorityPrivilege 644 {368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2544 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe 86 PID 1524 wrote to memory of 2544 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe 86 PID 1524 wrote to memory of 2544 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe 86 PID 1524 wrote to memory of 4008 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe 87 PID 1524 wrote to memory of 4008 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe 87 PID 1524 wrote to memory of 4008 1524 2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe 87 PID 2544 wrote to memory of 376 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 88 PID 2544 wrote to memory of 376 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 88 PID 2544 wrote to memory of 376 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 88 PID 2544 wrote to memory of 3912 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 89 PID 2544 wrote to memory of 3912 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 89 PID 2544 wrote to memory of 3912 2544 {18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe 89 PID 376 wrote to memory of 2240 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 92 PID 376 wrote to memory of 2240 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 92 PID 376 wrote to memory of 2240 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 92 PID 376 wrote to memory of 2356 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 93 PID 376 wrote to memory of 2356 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 93 PID 376 wrote to memory of 2356 376 {89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe 93 PID 2240 wrote to memory of 3292 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 98 PID 2240 wrote to memory of 3292 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 98 PID 2240 wrote to memory of 3292 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 98 PID 2240 wrote to memory of 3588 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 99 PID 2240 wrote to memory of 3588 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 99 PID 2240 wrote to memory of 3588 2240 {964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe 99 PID 3292 wrote to memory of 2576 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 101 PID 3292 wrote to memory of 2576 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 101 PID 3292 wrote to memory of 2576 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 101 PID 3292 wrote to memory of 2040 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 102 PID 3292 wrote to memory of 2040 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 102 PID 3292 wrote to memory of 2040 3292 {1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe 102 PID 2576 wrote to memory of 756 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 103 PID 2576 wrote to memory of 756 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 103 PID 2576 wrote to memory of 756 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 103 PID 2576 wrote to memory of 3700 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 104 PID 2576 wrote to memory of 3700 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 104 PID 2576 wrote to memory of 3700 2576 {421C208E-BB90-4cdf-9985-429FC8F52235}.exe 104 PID 756 wrote to memory of 3552 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 105 PID 756 wrote to memory of 3552 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 105 PID 756 wrote to memory of 3552 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 105 PID 756 wrote to memory of 3556 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 106 PID 756 wrote to memory of 3556 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 106 PID 756 wrote to memory of 3556 756 {E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe 106 PID 3552 wrote to memory of 2096 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 107 PID 3552 wrote to memory of 2096 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 107 PID 3552 wrote to memory of 2096 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 107 PID 3552 wrote to memory of 3260 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 108 PID 3552 wrote to memory of 3260 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 108 PID 3552 wrote to memory of 3260 3552 {F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe 108 PID 2096 wrote to memory of 4380 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 109 PID 2096 wrote to memory of 4380 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 109 PID 2096 wrote to memory of 4380 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 109 PID 2096 wrote to memory of 4976 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 110 PID 2096 wrote to memory of 4976 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 110 PID 2096 wrote to memory of 4976 2096 {0E849996-637C-48de-933A-C52B4D2C9D2E}.exe 110 PID 4380 wrote to memory of 1412 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 111 PID 4380 wrote to memory of 1412 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 111 PID 4380 wrote to memory of 1412 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 111 PID 4380 wrote to memory of 4136 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 112 PID 4380 wrote to memory of 4136 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 112 PID 4380 wrote to memory of 4136 4380 {1459612F-948A-4e34-BABA-0977F8962382}.exe 112 PID 1412 wrote to memory of 644 1412 {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe 113 PID 1412 wrote to memory of 644 1412 {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe 113 PID 1412 wrote to memory of 644 1412 {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe 113 PID 1412 wrote to memory of 3516 1412 {A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_97ee751569506f65d6241243903d98c8_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\{18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exeC:\Windows\{18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\{89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exeC:\Windows\{89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exeC:\Windows\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exeC:\Windows\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\{421C208E-BB90-4cdf-9985-429FC8F52235}.exeC:\Windows\{421C208E-BB90-4cdf-9985-429FC8F52235}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exeC:\Windows\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exeC:\Windows\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\{0E849996-637C-48de-933A-C52B4D2C9D2E}.exeC:\Windows\{0E849996-637C-48de-933A-C52B4D2C9D2E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\{1459612F-948A-4e34-BABA-0977F8962382}.exeC:\Windows\{1459612F-948A-4e34-BABA-0977F8962382}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exeC:\Windows\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exeC:\Windows\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:644 -
C:\Windows\{444C24F5-6808-4a0e-9621-0B712DBAFBAF}.exeC:\Windows\{444C24F5-6808-4a0e-9621-0B712DBAFBAF}.exe13⤵
- Executes dropped EXE
PID:4104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{368BC~1.EXE > nul13⤵PID:3160
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2428~1.EXE > nul12⤵PID:3516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14596~1.EXE > nul11⤵PID:4136
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E849~1.EXE > nul10⤵PID:4976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5F11~1.EXE > nul9⤵PID:3260
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8419~1.EXE > nul8⤵PID:3556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{421C2~1.EXE > nul7⤵PID:3700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B773~1.EXE > nul6⤵PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{964D9~1.EXE > nul5⤵PID:3588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89F02~1.EXE > nul4⤵PID:2356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18567~1.EXE > nul3⤵PID:3912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0E849996-637C-48de-933A-C52B4D2C9D2E}.exe
- Size 216KB
- SHA256 1ddd9d5ce4e9bfc9eea6909975e05f1260d83fc91b181302dd3d241460619968
- MD5 1789bda440f4d41881d9f79aeb430ae1
- SHA1 1dd497f7edbb761e6638fbbd0ede500dae0266b6
- SHA512 50f6d2930b4f1a651ed7cd1f980f5a90fe32a5ea984fb64fe0d5137f8fe1d85e07c041dfb056920f5e3566f23e0952560fa2dd67662dd97626298ce8d3cf2016
- SSDEEP 3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGrlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1459612F-948A-4e34-BABA-0977F8962382}.exe
- Size 216KB
- SHA256 09168e99319d11398cbf7fb51ca821a8a64a65029fd5d08f4e07b73be8379d64
- MD5 a4783168181989a5c1433f232ef7b2eb
- SHA1 9d735c90e1e298556271c4f52c674dd8ae9d7bbd
- SHA512 3891705d4162a67fc49434edf21db4fa8c4649f61b7afbd95806d1f01d85a87e74f915f206c3f954cee309a24a2979bac8cb107b974f9916fdb2ab20add3528b
- SSDEEP 3072:jEGh0oxl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGTlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{18567945-EE45-47ea-AC4A-2F6EA74E32A4}.exe
- Size 216KB
- SHA256 9027042571b4df3dbc34e7096846dc9f3bce57f0b85e36b9928afabe19891710
- MD5 863652e6944ce930ec69dbbc30950ae0
- SHA1 e967381b9f7821c3533dd32a9a5778e9d077d311
- SHA512 4501df934f9deb07372a056316cbd5c32c45ddc5049a842add0018d37924169ff051e8d26f254d3ec37a120018f77cffe96e00066e82e195b74ed8ce1794247d
- SSDEEP 3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG6lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1B77349B-D79E-48db-A33A-DEDA3FCA20EF}.exe
- Size 216KB
- SHA256 b2ba3209012684858423619ede389d9737101882c3797b9a7542bdcdc0a7e88a
- MD5 ad26e718dbed43a384ebe199e147ccd0
- SHA1 1c8b9cb6d0cbc69e8a66e2937c4da562c1ece14f
- SHA512 262f6dce477d14cec333bedae0383e2d4c1107744806d77b1fbe91f6b93beffba9f9fc8786da7eec583785fae473a666fa3b7172bd854378e19e621d2f3b8260
- SSDEEP 3072:jEGh0o8l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG6lEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{368BCF5D-0CE9-42eb-B9C3-12F5D25A5269}.exe
- Size 216KB
- SHA256 dcd0b72db186723e135e346dec637ffa74531e6aece69bc22c2d01471044465c
- MD5 42848610adc6f8a3b07cb40ec86f0ccc
- SHA1 2bddef3604760f70498f516f29a1d21f889c71b2
- SHA512 374e7096c9e00aec02895586b999f6386c4ca5405186c9dd4d51885d66f3246134f0a2099f8d91aae51e198a5a92985dc91d1dcb54ee5c9b3bad36de2fd4ba73
- SSDEEP 3072:jEGh0okl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGClEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{421C208E-BB90-4cdf-9985-429FC8F52235}.exe
- Size 216KB
- SHA256 8a706ee6414fc7ac09b78d0ce80e0562e56477ccd5d943afb847c5dbff7b2194
- MD5 1caaf13b9fcf0c11a684eb244b1aab49
- SHA1 203cfd8616b2cfcf7aec7e0e2d95ab19502dc42f
- SHA512 767c38b9e7c0006addf0a36f53fbbdd1b06e23404134139d3065e076e5b490904119daa5c20284d4c5fbd1ff40dada1915ba72e3908d2528edcc96780ca024a2
- SSDEEP 3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGhlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{444C24F5-6808-4a0e-9621-0B712DBAFBAF}.exe
- Size 216KB
- SHA256 dcb746d04cd03f0288844a416d0d93c750081d193ecf36092ed720317eb3959d
- MD5 42b13d090928761e94c980f1443ff95b
- SHA1 693816fbe9b003f751685429ec139f977d69ba2d
- SHA512 64183c54d710171aa77bf4ae564069ecaae55c4dfada4fdb2b69b694db0deddae8f5d39bb281ba8c14ee3d09929a391a548a59aa6736992cbe721b704068c08b
- SSDEEP 3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGclEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{89F02A17-6799-4e82-85DE-F23C05C5AF2C}.exe
- Size 216KB
- SHA256 706548a0b062e8ac73536984b10c52cee065785b16baa87ca7c69c827736e628
- MD5 796703273fc86084246515ad36c45824
- SHA1 c8d29a14acc6538a65a437bf8bb968084999c477
- SHA512 f25ad418266be5fb907c0e82e551add5441579a3809fb42a4f52913a20d4bf54a304fadcaf7b6616b99189506ff2ce36dd1708388927d91d5600e5bd69e6c8a4
- SSDEEP 3072:jEGh0oLl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGhlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{964D97AA-CD45-45cf-ADBE-3AEE7CA93D6C}.exe
- Size 216KB
- SHA256 cdf2306d4e72bf3eca7a98b548bcc2da73647e5a9379dc5c701ada213ec31f12
- MD5 c7d753893ce768a6a98dbc9f9ab4f292
- SHA1 948ed8aecd4790fc3fbdfc10c6122abb177bc3c8
- SHA512 8e197425c0356859e0f4f71ed471a77a84eb6ed45366ccdc7babaaae9efbb899909f031ed2d023dba178a7c41c3b40f94508e7d767251178982f58a498242c8b
- SSDEEP 3072:jEGh0opl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGXlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A2428A5B-BD38-41ef-8A84-C1D914F5D5F9}.exe
- Size 216KB
- SHA256 7380ff0c90a8708bcc4b0341fa2ca393f3f505cc26684070ffb3c8acb0f30c18
- MD5 90fe748e375024879dce6b03ca5cb0a4
- SHA1 2a67401c66ac3a11d506f1360fd0033c10b6d908
- SHA512 a881d3becf85344744aa9a33e5b781632fb6a16c05c4f85b5539caaa164e8fcd76e872b0ab71f23939f7c68a5cde2af55673805419af1ee1fb7eddbeb99b9db8
- SSDEEP 3072:jEGh0o4l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGqlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E84193E5-6BFA-4104-BF41-6DE1EDD408DE}.exe
- Size 216KB
- SHA256 8b981adcf0c64684dea024cb2ce06b9f45f8a6cde7470037a8e264f7b7ffed17
- MD5 d2ae13e7c7d7d79cc0bfc4c6c7d37c2f
- SHA1 51edeefaeeee7c9876ff8edc883c7d4d7510048f
- SHA512 c8e7d159ed77fcfea3fcfa57d79f9d5663e6ac138e2c94f043c947104f4138c05e0fce47bbbfec94c7ea2a2dc6e101222c7b692f65556715a6b26b171b1a3697
- SSDEEP 3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGdlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F5F11E63-98AE-4f4a-BC3B-263B447F5F66}.exe
- Size 216KB
- SHA256 9063ae9f95506e5217f994496df7310d156c5e1e900d0ee78c2a0f1b949ae282
- MD5 b01e3ecda52932fd908d1b76b99d8e58
- SHA1 96c814241ff0e18e7e909cfcc50597a1269ee92e
- SHA512 baac00191498b2c966a748032d59656dfccf9fd4120ab3c01354c5a1190498334e5c2a63833a6a896848b69d556b7a2ae0e3baa5f861aeb5002b243bc5ec7dba
- SSDEEP 3072:jEGh0oil+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGIlEeKcAEcGy
- MD5 SHA1 SHA512 SSDEEP