Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe
- Size 408KB
- Sample240613-mzdp8awamd
- SHA256 8d16ce13c939ae09da1bb01fc5713e768367eee602346cc5fa41823bc9e526a1
- MD5 83e7ec18f0949f9c29932aa12a831797
- SHA1 7c46130e86a22b45a6c45638a0d49f973d447419
- SHA512 b43b9dbe41e25375cafb06ca2e88318ff021a2685cb10f0c9e798f341d39c2039303fc7b9eb903b3924e75d716e769000444d73ceb6c3baf6d3e0d13ca2bff0c
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG8ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000b000000023383-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023384-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023410-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023414-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000700000002341a-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023414-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000800000002341a-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023414-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000900000002341a-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023414-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a00000002341a-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023414-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E0D6DA3-247E-419b-AB9E-CFA01E809838}\stubpath = "C:\\Windows\\{4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe" {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA}\stubpath = "C:\\Windows\\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe" {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7A64FED-6A9D-477c-BF4C-78324EA29397} {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C}\stubpath = "C:\\Windows\\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe" {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E0D6DA3-247E-419b-AB9E-CFA01E809838} {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6} {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{824E7128-F6DA-476d-B057-BD993A32ABF8} 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C} {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}\stubpath = "C:\\Windows\\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe" {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7A64FED-6A9D-477c-BF4C-78324EA29397}\stubpath = "C:\\Windows\\{F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe" {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81A4E483-2644-4442-8EFB-11DF7CD82994}\stubpath = "C:\\Windows\\{81A4E483-2644-4442-8EFB-11DF7CD82994}.exe" {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D06E63A9-67CD-4505-9FB1-65C326C438C6} {B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D06E63A9-67CD-4505-9FB1-65C326C438C6}\stubpath = "C:\\Windows\\{D06E63A9-67CD-4505-9FB1-65C326C438C6}.exe" {B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{824E7128-F6DA-476d-B057-BD993A32ABF8}\stubpath = "C:\\Windows\\{824E7128-F6DA-476d-B057-BD993A32ABF8}.exe" 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FA38F67-C737-4093-8EDB-B6CA54768CC9}\stubpath = "C:\\Windows\\{2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe" {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47A224EF-5B80-4e8f-8127-6110AD07644A} {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47A224EF-5B80-4e8f-8127-6110AD07644A}\stubpath = "C:\\Windows\\{47A224EF-5B80-4e8f-8127-6110AD07644A}.exe" {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81A4E483-2644-4442-8EFB-11DF7CD82994} {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA} {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}\stubpath = "C:\\Windows\\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe" {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B} {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FA38F67-C737-4093-8EDB-B6CA54768CC9} {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5} {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B}\stubpath = "C:\\Windows\\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe" {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe - Executes dropped EXE 12 IoCs
pid Process 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 2948 {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe 2712 {B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe 2824 {D06E63A9-67CD-4505-9FB1-65C326C438C6}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe File created C:\Windows\{D06E63A9-67CD-4505-9FB1-65C326C438C6}.exe {B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe File created C:\Windows\{824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe File created C:\Windows\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe File created C:\Windows\{4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe File created C:\Windows\{F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe File created C:\Windows\{81A4E483-2644-4442-8EFB-11DF7CD82994}.exe {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe File created C:\Windows\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe File created C:\Windows\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe File created C:\Windows\{2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe File created C:\Windows\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe File created C:\Windows\{47A224EF-5B80-4e8f-8127-6110AD07644A}.exe {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe Token: SeIncBasePriorityPrivilege 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe Token: SeIncBasePriorityPrivilege 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe Token: SeIncBasePriorityPrivilege 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe Token: SeIncBasePriorityPrivilege 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe Token: SeIncBasePriorityPrivilege 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe Token: SeIncBasePriorityPrivilege 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe Token: SeIncBasePriorityPrivilege 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe Token: SeIncBasePriorityPrivilege 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe Token: SeIncBasePriorityPrivilege 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe Token: SeIncBasePriorityPrivilege 2948 {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe Token: SeIncBasePriorityPrivilege 2712 {B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 552 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 85 PID 3948 wrote to memory of 552 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 85 PID 3948 wrote to memory of 552 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 85 PID 3948 wrote to memory of 4868 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 86 PID 3948 wrote to memory of 4868 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 86 PID 3948 wrote to memory of 4868 3948 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 86 PID 552 wrote to memory of 4400 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 87 PID 552 wrote to memory of 4400 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 87 PID 552 wrote to memory of 4400 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 87 PID 552 wrote to memory of 2912 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 88 PID 552 wrote to memory of 2912 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 88 PID 552 wrote to memory of 2912 552 {824E7128-F6DA-476d-B057-BD993A32ABF8}.exe 88 PID 4400 wrote to memory of 2680 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 91 PID 4400 wrote to memory of 2680 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 91 PID 4400 wrote to memory of 2680 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 91 PID 4400 wrote to memory of 3060 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 92 PID 4400 wrote to memory of 3060 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 92 PID 4400 wrote to memory of 3060 4400 {2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe 92 PID 2680 wrote to memory of 3796 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 97 PID 2680 wrote to memory of 3796 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 97 PID 2680 wrote to memory of 3796 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 97 PID 2680 wrote to memory of 3976 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 98 PID 2680 wrote to memory of 3976 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 98 PID 2680 wrote to memory of 3976 2680 {A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe 98 PID 3796 wrote to memory of 2908 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 100 PID 3796 wrote to memory of 2908 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 100 PID 3796 wrote to memory of 2908 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 100 PID 3796 wrote to memory of 1464 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 101 PID 3796 wrote to memory of 1464 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 101 PID 3796 wrote to memory of 1464 3796 {47A224EF-5B80-4e8f-8127-6110AD07644A}.exe 101 PID 2908 wrote to memory of 4284 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 102 PID 2908 wrote to memory of 4284 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 102 PID 2908 wrote to memory of 4284 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 102 PID 2908 wrote to memory of 4960 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 103 PID 2908 wrote to memory of 4960 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 103 PID 2908 wrote to memory of 4960 2908 {F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe 103 PID 4284 wrote to memory of 2176 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 104 PID 4284 wrote to memory of 2176 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 104 PID 4284 wrote to memory of 2176 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 104 PID 4284 wrote to memory of 3404 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 105 PID 4284 wrote to memory of 3404 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 105 PID 4284 wrote to memory of 3404 4284 {ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe 105 PID 2176 wrote to memory of 4236 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 106 PID 2176 wrote to memory of 4236 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 106 PID 2176 wrote to memory of 4236 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 106 PID 2176 wrote to memory of 4880 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 107 PID 2176 wrote to memory of 4880 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 107 PID 2176 wrote to memory of 4880 2176 {4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe 107 PID 4236 wrote to memory of 1584 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 108 PID 4236 wrote to memory of 1584 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 108 PID 4236 wrote to memory of 1584 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 108 PID 4236 wrote to memory of 1816 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 109 PID 4236 wrote to memory of 1816 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 109 PID 4236 wrote to memory of 1816 4236 {81A4E483-2644-4442-8EFB-11DF7CD82994}.exe 109 PID 1584 wrote to memory of 2948 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 110 PID 1584 wrote to memory of 2948 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 110 PID 1584 wrote to memory of 2948 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 110 PID 1584 wrote to memory of 2956 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 111 PID 1584 wrote to memory of 2956 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 111 PID 1584 wrote to memory of 2956 1584 {1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe 111 PID 2948 wrote to memory of 2712 2948 {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe 112 PID 2948 wrote to memory of 2712 2948 {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe 112 PID 2948 wrote to memory of 2712 2948 {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe 112 PID 2948 wrote to memory of 2200 2948 {2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\{824E7128-F6DA-476d-B057-BD993A32ABF8}.exeC:\Windows\{824E7128-F6DA-476d-B057-BD993A32ABF8}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\{2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exeC:\Windows\{2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exeC:\Windows\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\{47A224EF-5B80-4e8f-8127-6110AD07644A}.exeC:\Windows\{47A224EF-5B80-4e8f-8127-6110AD07644A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\{F7A64FED-6A9D-477c-BF4C-78324EA29397}.exeC:\Windows\{F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exeC:\Windows\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\{4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exeC:\Windows\{4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\{81A4E483-2644-4442-8EFB-11DF7CD82994}.exeC:\Windows\{81A4E483-2644-4442-8EFB-11DF7CD82994}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exeC:\Windows\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exeC:\Windows\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exeC:\Windows\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\{D06E63A9-67CD-4505-9FB1-65C326C438C6}.exeC:\Windows\{D06E63A9-67CD-4505-9FB1-65C326C438C6}.exe13⤵
- Executes dropped EXE
PID:2824
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7C55~1.EXE > nul13⤵PID:4660
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E05E~1.EXE > nul12⤵PID:2200
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F2EC~1.EXE > nul11⤵PID:2956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81A4E~1.EXE > nul10⤵PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E0D6~1.EXE > nul9⤵PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACD43~1.EXE > nul8⤵PID:3404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7A64~1.EXE > nul7⤵PID:4960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47A22~1.EXE > nul6⤵PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A80BF~1.EXE > nul5⤵PID:3976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FA38~1.EXE > nul4⤵PID:3060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{824E7~1.EXE > nul3⤵PID:2912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{1F2EC85D-80AD-4698-AF21-178B5C7B23DA}.exe
- Size 408KB
- SHA256 f2d5f85867a44dabd05f9bb8fe9d2d2c2920f17df48d144f419e6827f2f18e8e
- MD5 2cbfe4bffa108e031805945a2ab1c8f1
- SHA1 b62e7f63a2d24641196556f912f5ff6047b902c6
- SHA512 1db41d86f315d164cbdb2f12e85fa5fae7bdb98143660f2a2970d32c8bcf1679ce3b3eff93d71ffc99c28c25f4eb59cc0a21634e237a0249838c42330fb13417
- SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGjldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2E05EE9D-9B0F-4bfb-B977-25BC2F51D8B6}.exe
- Size 408KB
- SHA256 22ceacdbc11880ce80956dae05daed91a780fde4f3b0206ba08a847430a0a02b
- MD5 f0882ef4f364c3de50cd2ad57a4156c3
- SHA1 8b424271feaf33a27903f6dd66ab0d29ba533390
- SHA512 688878a45f503dec541a417011174655af4bd0e28beb83d49d46014d6d760988b18df42aedaadb72776c58b748f7d748fb08fbbab3a8ceaf06b51ade125a8fbc
- SSDEEP 3072:CEGh0oRl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGnldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2FA38F67-C737-4093-8EDB-B6CA54768CC9}.exe
- Size 408KB
- SHA256 bc1a56b02517816ced2c29798cee76b695904ea2d4b0375784f567441a6781ed
- MD5 686a6d2bced816d865d9c881685efad9
- SHA1 61e5425219ddfffa1eb36a24e39f2c4ef0fcec40
- SHA512 d18f58242b6010de5946ee5845e6323ac7f775db062601184b9630847b5ee8b8f1ebbc65c1bc7e585e2e4cd300ceb2566214434f6e750bee7dd91fee69dbe13d
- SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{47A224EF-5B80-4e8f-8127-6110AD07644A}.exe
- Size 408KB
- SHA256 c87ab76a52a4d313b5c7b7e94bb927efb1bc30173f3971865286af613a0dd4f4
- MD5 b40c969745334f2a30e0b7d700247b71
- SHA1 336cb8e62647bf79747abc8b3b16947360618c0c
- SHA512 df97f9b918bd4dfce9c3c16067fa0a43e347d0d125661b4cce991540e420081e30f0a5056dcdbc2c443fd643ee2b21e325a7bc1fc6dac809143ffdd2db8f9c0a
- SSDEEP 3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGKldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4E0D6DA3-247E-419b-AB9E-CFA01E809838}.exe
- Size 408KB
- SHA256 c92ff8bcdbc1b59583a564ed06b7a352e8fe2ac7787805b78c5c5ac8a6028385
- MD5 874e4286b3a8be08d962754e3a3e97bf
- SHA1 7fc9178fa39f2dac47e5cd5dfca3f42d92230022
- SHA512 48e3dab1663cedbad0fcf0ac53413107715144ab1c001b36d7bc2839dad9323548be9a4e09a6b3eb3d8f231ac53248f38cab5aa906752b16525da112c3714602
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGUldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{81A4E483-2644-4442-8EFB-11DF7CD82994}.exe
- Size 408KB
- SHA256 6f67a98b0fc1c33af6814c6c0bb631803067b384dd9b7da0fbf434057070c9b5
- MD5 bea8de609a155c6fe58ba7d4b2bf4cb0
- SHA1 b57ac4a9efe982a98179b8175ac02320c5f48d4d
- SHA512 215b69db95c57c1536ab6cadc05d343d4e0215c7722125329dd1d5bdfa3f532aab222aefe3f0572fa6f65c8cf745060f09af21dda71a9ec095228b8221c07ac0
- SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGRldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{824E7128-F6DA-476d-B057-BD993A32ABF8}.exe
- Size 408KB
- SHA256 9d7fdf03dfe70db154aaa5b87ea71df1d6dfdd81814977ff7f64ad7f265f4421
- MD5 e902c4b8008d6ca35cc9418af81bb0fe
- SHA1 1f54c3003e6eba785b9839d5f6adb570ee95e7b9
- SHA512 2d08a3057a17d208022b12fc0fe08c127b234daa710f434ae5577264fe491592214bd13797294e4f7626aad9e8a81f09598f7f0a44ace5611862d4b64b637b77
- SSDEEP 3072:CEGh0ovl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGhldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A80BF7E4-E6F0-44e9-8533-A357DF51F3C5}.exe
- Size 408KB
- SHA256 dae31f8f51aad44b81534bf89ce20ef2c0347fb802173ceac048c7e4d5731652
- MD5 7c994967e5e97e66ba993202cd00e4bc
- SHA1 1ab1a002fa5c7a48d457d2529995f158d71a6ca1
- SHA512 82e49b48bd2d791971d0b87ba437c49117b714ac5fd9a0a1e3dd8598e2456c8cc45e4aa232e2f8dfe58a4be624dcc5d5a2bf093aba21f5448d23067ca055cc70
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGkldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ACD43DE7-0659-4ccb-B57E-91CB9584B66C}.exe
- Size 408KB
- SHA256 a0e543b76139a76892ac68edcd85e9a2eb68ed2a95580f6e54cec99f3ba778f9
- MD5 60dd8b76105a23d689d620e28ac8881b
- SHA1 1647b0a9cef8bba2e6ee29978409bfe6ed9b8351
- SHA512 4ccbac2fd05b3d3fa656cc8649c9361e83bacbce5a47e6ced5814529b76956df927a217e21b5179e4f6f0cffea2e8404a02523d66f4928dc5e5522f7a4369ac6
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGWldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B7C55F8F-622D-44c3-96B7-5EBAC16D705B}.exe
- Size 408KB
- SHA256 b9ff69bd852688cca2c386c43f8421688633fec727a17cbc56578924b6eb9f85
- MD5 db594ac310e5c7bb6cf902fffbb48266
- SHA1 e549a081529a1333d5b6f02b4cf0a8a638bc0d80
- SHA512 4b8667234ff939ca887bb6f381d8e67958aee342e448d377f722c94c1583d03f23f1662692b039afbc6cc783dd5f92075366e97bea00af01739c825da388332a
- SSDEEP 3072:CEGh0oNZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf:CEGJldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D06E63A9-67CD-4505-9FB1-65C326C438C6}.exe
- Size 408KB
- SHA256 683c843ec5d9343489e6592e0ce4f8e2796327f81c1fd591018853300b226ee7
- MD5 41b6292c750d8a8e1f55967e59b51f72
- SHA1 c5145dcbae0c14d6a419baf2d9fa6dcd88293279
- SHA512 d1c523fc7516669d57b5bf91c19cafba107bf646fcea42bed4a3cdab8191fdf3782aa869d01879e0d4e87218988525cc584bc7c67a283a7abbfb1e84d4c0fac4
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F7A64FED-6A9D-477c-BF4C-78324EA29397}.exe
- Size 408KB
- SHA256 306617563eb8b0f1bb07a504c67c0393017f7e86947bea3d4a38f06d87d2d90c
- MD5 e9b985e5474f57dd4606a20466f5f9e3
- SHA1 cf7f1cdfacba4b4143df4f28783c9220249d506e
- SHA512 574c8853950c3814399661370ec857d89b8d4318fbbd400da83084440ed054128a742ec0f5d9404e02866f1ccd928e95fc003fc2613e201bb84a92647d29d993
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP