Analysis
- max time kernel
149s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe
- Size 192KB
- Sample240613-mwkpcszbmr
- SHA256 18936afc54a62b846d3022bd00771b1b00b32f0f5775fdd4b20cc977f6bbe7dc
- MD5 5490e1e7b5b76b35e5a9e6199d00d55a
- SHA1 690f38d300826951260dc11a76885fa77d1fd9fd
- SHA512 c051e6e39e6527f47b75f5ae7e8925e0f8333b824deb1cff6cd92cf720fe934e9948a4ed8e50e44825e80b4c72a296872529852cf2c31e0cf76a22ce9e6322ad
- SSDEEP 1536:1EGh0oql15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oql1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000400000001e3f9-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023440-7.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000002293d-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023440-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000002293d-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023440-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000500000002293d-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023440-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000600000002293d-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023440-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002293d-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023440-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93A364D1-3EDA-43ae-AE9B-888B197B36DE}\stubpath = "C:\\Windows\\{93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe" {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E} {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68} {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{937F1D12-8154-4342-82C0-9F606BB022D3} {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7933012-DE45-497a-8C4E-115888D8B98A}\stubpath = "C:\\Windows\\{F7933012-DE45-497a-8C4E-115888D8B98A}.exe" {0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{280E23C3-0DA4-42d5-9BC4-E778D8043A70} {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D458B42F-6391-45c7-B9DA-8474D507C7AA} {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7313991-66DC-40ce-8AEA-12E7052CB025} {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}\stubpath = "C:\\Windows\\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe" {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B} {937F1D12-8154-4342-82C0-9F606BB022D3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}\stubpath = "C:\\Windows\\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe" {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7313991-66DC-40ce-8AEA-12E7052CB025}\stubpath = "C:\\Windows\\{C7313991-66DC-40ce-8AEA-12E7052CB025}.exe" {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4} {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8} 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93A364D1-3EDA-43ae-AE9B-888B197B36DE} {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F03C584E-39A7-4b04-A187-9235FC84F4C5} {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{280E23C3-0DA4-42d5-9BC4-E778D8043A70}\stubpath = "C:\\Windows\\{280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe" {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D458B42F-6391-45c7-B9DA-8474D507C7AA}\stubpath = "C:\\Windows\\{D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe" {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7933012-DE45-497a-8C4E-115888D8B98A} {0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}\stubpath = "C:\\Windows\\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe" 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F03C584E-39A7-4b04-A187-9235FC84F4C5}\stubpath = "C:\\Windows\\{F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe" {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}\stubpath = "C:\\Windows\\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe" {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{937F1D12-8154-4342-82C0-9F606BB022D3}\stubpath = "C:\\Windows\\{937F1D12-8154-4342-82C0-9F606BB022D3}.exe" {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}\stubpath = "C:\\Windows\\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe" {937F1D12-8154-4342-82C0-9F606BB022D3}.exe - Executes dropped EXE 12 IoCs
pid Process 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 3896 {937F1D12-8154-4342-82C0-9F606BB022D3}.exe 3188 {0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe 1772 {F7933012-DE45-497a-8C4E-115888D8B98A}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe File created C:\Windows\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe File created C:\Windows\{C7313991-66DC-40ce-8AEA-12E7052CB025}.exe {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe File created C:\Windows\{F7933012-DE45-497a-8C4E-115888D8B98A}.exe {0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe File created C:\Windows\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe File created C:\Windows\{F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe File created C:\Windows\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe File created C:\Windows\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe File created C:\Windows\{937F1D12-8154-4342-82C0-9F606BB022D3}.exe {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe File created C:\Windows\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe {937F1D12-8154-4342-82C0-9F606BB022D3}.exe File created C:\Windows\{93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe File created C:\Windows\{280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe Token: SeIncBasePriorityPrivilege 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe Token: SeIncBasePriorityPrivilege 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe Token: SeIncBasePriorityPrivilege 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe Token: SeIncBasePriorityPrivilege 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe Token: SeIncBasePriorityPrivilege 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe Token: SeIncBasePriorityPrivilege 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe Token: SeIncBasePriorityPrivilege 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe Token: SeIncBasePriorityPrivilege 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe Token: SeIncBasePriorityPrivilege 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe Token: SeIncBasePriorityPrivilege 3896 {937F1D12-8154-4342-82C0-9F606BB022D3}.exe Token: SeIncBasePriorityPrivilege 3188 {0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 1648 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe 84 PID 3412 wrote to memory of 1648 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe 84 PID 3412 wrote to memory of 1648 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe 84 PID 3412 wrote to memory of 4384 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe 85 PID 3412 wrote to memory of 4384 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe 85 PID 3412 wrote to memory of 4384 3412 2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe 85 PID 1648 wrote to memory of 4940 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 86 PID 1648 wrote to memory of 4940 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 86 PID 1648 wrote to memory of 4940 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 86 PID 1648 wrote to memory of 5084 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 87 PID 1648 wrote to memory of 5084 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 87 PID 1648 wrote to memory of 5084 1648 {286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe 87 PID 4940 wrote to memory of 3972 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 91 PID 4940 wrote to memory of 3972 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 91 PID 4940 wrote to memory of 3972 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 91 PID 4940 wrote to memory of 2844 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 92 PID 4940 wrote to memory of 2844 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 92 PID 4940 wrote to memory of 2844 4940 {93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe 92 PID 3972 wrote to memory of 2980 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 93 PID 3972 wrote to memory of 2980 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 93 PID 3972 wrote to memory of 2980 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 93 PID 3972 wrote to memory of 4348 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 94 PID 3972 wrote to memory of 4348 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 94 PID 3972 wrote to memory of 4348 3972 {F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe 94 PID 2980 wrote to memory of 3560 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 95 PID 2980 wrote to memory of 3560 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 95 PID 2980 wrote to memory of 3560 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 95 PID 2980 wrote to memory of 1636 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 96 PID 2980 wrote to memory of 1636 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 96 PID 2980 wrote to memory of 1636 2980 {280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe 96 PID 3560 wrote to memory of 2208 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 97 PID 3560 wrote to memory of 2208 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 97 PID 3560 wrote to memory of 2208 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 97 PID 3560 wrote to memory of 2036 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 98 PID 3560 wrote to memory of 2036 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 98 PID 3560 wrote to memory of 2036 3560 {D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe 98 PID 2208 wrote to memory of 3968 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 99 PID 2208 wrote to memory of 3968 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 99 PID 2208 wrote to memory of 3968 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 99 PID 2208 wrote to memory of 3884 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 100 PID 2208 wrote to memory of 3884 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 100 PID 2208 wrote to memory of 3884 2208 {85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe 100 PID 3968 wrote to memory of 1208 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 101 PID 3968 wrote to memory of 1208 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 101 PID 3968 wrote to memory of 1208 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 101 PID 3968 wrote to memory of 3552 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 102 PID 3968 wrote to memory of 3552 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 102 PID 3968 wrote to memory of 3552 3968 {7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe 102 PID 1208 wrote to memory of 992 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 103 PID 1208 wrote to memory of 992 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 103 PID 1208 wrote to memory of 992 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 103 PID 1208 wrote to memory of 3892 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 104 PID 1208 wrote to memory of 3892 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 104 PID 1208 wrote to memory of 3892 1208 {C7313991-66DC-40ce-8AEA-12E7052CB025}.exe 104 PID 992 wrote to memory of 3896 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 105 PID 992 wrote to memory of 3896 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 105 PID 992 wrote to memory of 3896 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 105 PID 992 wrote to memory of 3224 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 106 PID 992 wrote to memory of 3224 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 106 PID 992 wrote to memory of 3224 992 {2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe 106 PID 3896 wrote to memory of 3188 3896 {937F1D12-8154-4342-82C0-9F606BB022D3}.exe 107 PID 3896 wrote to memory of 3188 3896 {937F1D12-8154-4342-82C0-9F606BB022D3}.exe 107 PID 3896 wrote to memory of 3188 3896 {937F1D12-8154-4342-82C0-9F606BB022D3}.exe 107 PID 3896 wrote to memory of 4460 3896 {937F1D12-8154-4342-82C0-9F606BB022D3}.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_5490e1e7b5b76b35e5a9e6199d00d55a_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exeC:\Windows\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\{93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exeC:\Windows\{93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\{F03C584E-39A7-4b04-A187-9235FC84F4C5}.exeC:\Windows\{F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\{280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exeC:\Windows\{280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\{D458B42F-6391-45c7-B9DA-8474D507C7AA}.exeC:\Windows\{D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exeC:\Windows\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exeC:\Windows\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\{C7313991-66DC-40ce-8AEA-12E7052CB025}.exeC:\Windows\{C7313991-66DC-40ce-8AEA-12E7052CB025}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exeC:\Windows\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\{937F1D12-8154-4342-82C0-9F606BB022D3}.exeC:\Windows\{937F1D12-8154-4342-82C0-9F606BB022D3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exeC:\Windows\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3188 -
C:\Windows\{F7933012-DE45-497a-8C4E-115888D8B98A}.exeC:\Windows\{F7933012-DE45-497a-8C4E-115888D8B98A}.exe13⤵
- Executes dropped EXE
PID:1772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D6B1~1.EXE > nul13⤵PID:3264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{937F1~1.EXE > nul12⤵PID:4460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2381F~1.EXE > nul11⤵PID:3224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7313~1.EXE > nul10⤵PID:3892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A876~1.EXE > nul9⤵PID:3552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85E8C~1.EXE > nul8⤵PID:3884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D458B~1.EXE > nul7⤵PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{280E2~1.EXE > nul6⤵PID:1636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F03C5~1.EXE > nul5⤵PID:4348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93A36~1.EXE > nul4⤵PID:2844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{286A5~1.EXE > nul3⤵PID:5084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0D6B1EED-7FD3-40ee-A719-8F3B1967F07B}.exe
- Size 192KB
- SHA256 a1e3f871b482636de85adf45acc2ba7bd6618b3706be7ad2643af0a732a499a3
- MD5 52e1224b660e3da0a1128812641787b8
- SHA1 7179f00a078c203625da68a0703d9400810b8e2a
- SHA512 35ed005cb6ba7f38519713a8cf71c6fa2cdddadaef567eff413016680e18032593d954a963d57dafa520fc54bc0662eb4e43b97fbe491bcee3d02c567b141fc4
- SSDEEP 1536:1EGh0ool15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ool1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2381FC66-AB83-41e8-9C06-9DAC2EBDF5B4}.exe
- Size 192KB
- SHA256 b36ab4d8e14e9aa7956e2cf53c7a519efa4896b575fe40117d90ae97e7a47358
- MD5 e33fd3c456a060a145a36409751b582c
- SHA1 68b3f4d1c5f4f07a37e240ff84276f438239d6cf
- SHA512 eb1b3544f52514fb1eb6959eb592ab8255843dae068a5d338eb50c5fd984bc6f953d5749ed4a2ef99722b802929ba17bb4944d369852ea894e727b09075a84ef
- SSDEEP 1536:1EGh0oql15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oql1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{280E23C3-0DA4-42d5-9BC4-E778D8043A70}.exe
- Size 192KB
- SHA256 660912a73af9faf5988e763592d4a20226bdbe34ace8f470f4632e2182a5689f
- MD5 c9a809bc76dbd50813d0123122275458
- SHA1 b3cc41838d5dc79290de50f5e0bc49e9aebfc51c
- SHA512 2e1c46a887f893215e26b0e6ed7f017f641ab2a01fd798ee3e20f9e5b218acf2761fb62bc80eef0ad51a2a7c5f7e277e24e9fdd0488e5098be30c07f811379f6
- SSDEEP 1536:1EGh0o0l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o0l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{286A551E-FA7D-4111-B9A0-7AB30E9DD0F8}.exe
- Size 192KB
- SHA256 f5d94f6bf10fcef634502cbd22d5a36f952c9dfed46611361f97288ada35493a
- MD5 34be45f05d40ebaae73588e0eec882db
- SHA1 1f8577128dc633ca237c83cde8d8b1cf2378d16f
- SHA512 2ece84ce27f272df66a24b39d530ba3ce72ec647e2b7b34bcd2804fade4ba374643989727fa9e5d93becc39798e32f29229c0713a7a60b4674f7b97c867f2ce9
- SSDEEP 1536:1EGh0ojl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ojl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7A876CC4-E1C1-4af6-9B4B-7FA4B3CDBD68}.exe
- Size 192KB
- SHA256 f1f69f5a950ee64029cf0a83704af96eeba1ab3e3868240a7acb0fbe16d36388
- MD5 d34bb3d12bfc748ac8cf6c4be54ae935
- SHA1 c7b90eff755fe93d321ab378eeb8d04be069e619
- SHA512 d22f4b4743a4565aa5e776b4cea3628a8795757e97dccd68d52dc644c8ee6dd915f686655440cbf7734cb441357874610d93f65c6b147c6673017fe36458727e
- SSDEEP 1536:1EGh0oTl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oTl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{85E8C0D4-8AF2-47f5-9895-D8A2D427F85E}.exe
- Size 192KB
- SHA256 8cb7f134843c2bc6133f940ae76342463ca3c820184a0264a04752fa4080291a
- MD5 cff34a12e164285410e0e244682873f3
- SHA1 c6a8b50458101c76ea774a14e82a17de57608abd
- SHA512 b4c566ff2a90ce768087f81ec0305d2fbba197fa9d42ee4bca03ebf7019452ecb0f3fd5ce69c555fbd0f24f7c6eb43a27da7138bd454a63cd5b25754f43f20f3
- SSDEEP 1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o5l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{937F1D12-8154-4342-82C0-9F606BB022D3}.exe
- Size 192KB
- SHA256 c2f74dd37627c53594372bc1821ad574a6545e270722100610266e486a2cd3c7
- MD5 5f90a183604c5463a1573f006bb0ad55
- SHA1 9e258da5e992a343ccc875506ba18065ea53a88f
- SHA512 283c0dd21daa5c2ec3d1b95ce539890a589666a299cb2fed2f3fe6817785b17b685d3d9c5a18f34516c69d7917cec6b8e65fc0db12b013e55f10f04a22742ec8
- SSDEEP 1536:1EGh0oHl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oHl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{93A364D1-3EDA-43ae-AE9B-888B197B36DE}.exe
- Size 192KB
- SHA256 fcbed04c4a74ed5042899d5be088ded408a57e68fad296f9c573696a1faa63ff
- MD5 744df8af11cd9a07e060cb77ef8dd250
- SHA1 7d01ee7c76add488be8233df3588188964e7777b
- SHA512 d5fca3c99f2ddf1302279f3a762e79cacb770ecbd21a5ccc464b62e534285fa77dd7cd39a923903b62f68d58dca65b93e4fbcdb12ea0443976465d2fa01096a1
- SSDEEP 1536:1EGh0ojl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ojl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{C7313991-66DC-40ce-8AEA-12E7052CB025}.exe
- Size 192KB
- SHA256 ca17422efe3cfa5234670ec14fe0951d0a1267af63b2fa7e99194ff3ef7f4286
- MD5 8fca8b967f29ac8af72d9f670663ea56
- SHA1 89705b47fed24a423003c7697b1a6553e6193046
- SHA512 30d75edf36f81f3ce54ef07ad831fde474b860e3bfb93a2e1311d79b02db591aac582e5374561d8675da9bc7420503a94d89fe79bfe0a64c2e88369b800430ad
- SSDEEP 1536:1EGh0oal15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oal1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D458B42F-6391-45c7-B9DA-8474D507C7AA}.exe
- Size 192KB
- SHA256 68815d731958aba231b60ff36bc28b662dd7ff0f6ca8bafe37927bf857b2657c
- MD5 49d3ec6bbdeff6ec58e8bfed7c0da500
- SHA1 840ab0f0ee05cd8998cb6065cca0ae4642b3dc14
- SHA512 3b0a10d1b1b74c274450691995af493f23ffaf1f71822a2436b4557fcdd732c9316c1b3297c21a34ccb378c68593f3207daf6ced997cb35bbe6d4d4c5ac394f5
- SSDEEP 1536:1EGh0o4l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o4l1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F03C584E-39A7-4b04-A187-9235FC84F4C5}.exe
- Size 192KB
- SHA256 17b81eadb2bac663456f17852fa1957516a1d7c35e19556a348a0c522956ce9d
- MD5 2d82095758c887767bfe7e4b99ad5281
- SHA1 e76aca56fbbf2bbf2809b4173e4534f62871cdc1
- SHA512 5c915ee7f17bb09c3c1da1b2a1a00912dc2a27ff07f09da8236874330b42c68cf90c63641f54f7ead1c06629afed8091e595575229598543fe48bc0fbb593e46
- SSDEEP 1536:1EGh0onl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0onl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F7933012-DE45-497a-8C4E-115888D8B98A}.exe
- Size 192KB
- SHA256 ff1ceb87e9f8a73c3fc4842645bee25815e11795b2d566c3ae61fbcc4b28cffa
- MD5 baf0b98a9b186e02415a02b5b87b95bd
- SHA1 68dbe4d128e83cdd4ec67c5ae3f6c1e8820cb252
- SHA512 249419f5747bfae722b33e9c4429bfbd95476f13559b8ef994ae1dca13050d7e9f5dd48343da373da24900c55014eb127f10217533ca592462037d3ca407a1c6
- SSDEEP 1536:1EGh0ojl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ojl1OPOe2MUVg3Ve+rXfMUa
- MD5 SHA1 SHA512 SSDEEP