Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe
- Size 168KB
- Sample240613-x1ap3aselm
- SHA256 9aadda1149f6fd4d3d58ef5a4c4fa0d92f3daea7ced3b71a01fd9e4c90791f47
- MD5 e44675c0d91e2da33b8a7ed78d7de56b
- SHA1 738f73b035bb946a4319fdfbf3d7e0b3ab9a4efc
- SHA512 acdfe68739ff8c79d0dd7b3f7b4e514d49dcebc8ded5371133076f3ffd1ac46dab4daccae8b298b2e7d4a1faf250fda06b5d2af928282d17feaa9ff983386f0f
- SSDEEP 1536:1EGh0oQlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oQlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 12 IoCs
resource yara_rule behavioral2/files/0x000c00000002338c-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023440-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000e000000023390-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023440-15.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000f000000023390-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000a000000023440-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0010000000023390-27.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000b000000023440-31.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0011000000023390-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000c000000023440-39.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0012000000023390-43.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000d000000023440-46.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13BC6883-CFE2-4d9f-ADB2-D256312A5721}\stubpath = "C:\\Windows\\{13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe" {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}\stubpath = "C:\\Windows\\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe" {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AD42AB2-FC29-4974-8B32-2570F61B4A82} {9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F07F31E-E20A-47d4-85E0-7C6836DD4310}\stubpath = "C:\\Windows\\{0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe" {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{860964EB-63AC-4b02-9A05-3626B20C1B51} {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76B2C27C-9F91-42f5-ACFA-05A1C045314D} {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13BC6883-CFE2-4d9f-ADB2-D256312A5721} {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{860964EB-63AC-4b02-9A05-3626B20C1B51}\stubpath = "C:\\Windows\\{860964EB-63AC-4b02-9A05-3626B20C1B51}.exe" {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC304BB9-0976-4070-922D-70B8D9CF9CCD}\stubpath = "C:\\Windows\\{DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe" {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4} {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BF78F67-FBC2-4917-8AF3-3D11422A507E} 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{130428C3-1841-4f08-949E-B84E1C0299FD} {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86950670-80CD-4498-B299-8CBBA0A0EA30} {130428C3-1841-4f08-949E-B84E1C0299FD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2}\stubpath = "C:\\Windows\\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe" {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AD42AB2-FC29-4974-8B32-2570F61B4A82}\stubpath = "C:\\Windows\\{9AD42AB2-FC29-4974-8B32-2570F61B4A82}.exe" {9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BF78F67-FBC2-4917-8AF3-3D11422A507E}\stubpath = "C:\\Windows\\{1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe" 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F07F31E-E20A-47d4-85E0-7C6836DD4310} {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86950670-80CD-4498-B299-8CBBA0A0EA30}\stubpath = "C:\\Windows\\{86950670-80CD-4498-B299-8CBBA0A0EA30}.exe" {130428C3-1841-4f08-949E-B84E1C0299FD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC304BB9-0976-4070-922D-70B8D9CF9CCD} {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76B2C27C-9F91-42f5-ACFA-05A1C045314D}\stubpath = "C:\\Windows\\{76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe" {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4E86D04-017B-41e5-98DC-EDCA532127C5} {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4E86D04-017B-41e5-98DC-EDCA532127C5}\stubpath = "C:\\Windows\\{B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe" {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{130428C3-1841-4f08-949E-B84E1C0299FD}\stubpath = "C:\\Windows\\{130428C3-1841-4f08-949E-B84E1C0299FD}.exe" {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2} {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe - Executes dropped EXE 12 IoCs
pid Process 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 1172 {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe 372 {9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe 4932 {9AD42AB2-FC29-4974-8B32-2570F61B4A82}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{860964EB-63AC-4b02-9A05-3626B20C1B51}.exe {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe File created C:\Windows\{DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe File created C:\Windows\{9AD42AB2-FC29-4974-8B32-2570F61B4A82}.exe {9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe File created C:\Windows\{B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe File created C:\Windows\{130428C3-1841-4f08-949E-B84E1C0299FD}.exe {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe File created C:\Windows\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe File created C:\Windows\{76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe File created C:\Windows\{13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe File created C:\Windows\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe File created C:\Windows\{1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe File created C:\Windows\{0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe File created C:\Windows\{86950670-80CD-4498-B299-8CBBA0A0EA30}.exe {130428C3-1841-4f08-949E-B84E1C0299FD}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe Token: SeIncBasePriorityPrivilege 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe Token: SeIncBasePriorityPrivilege 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe Token: SeIncBasePriorityPrivilege 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe Token: SeIncBasePriorityPrivilege 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe Token: SeIncBasePriorityPrivilege 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe Token: SeIncBasePriorityPrivilege 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe Token: SeIncBasePriorityPrivilege 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe Token: SeIncBasePriorityPrivilege 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe Token: SeIncBasePriorityPrivilege 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe Token: SeIncBasePriorityPrivilege 1172 {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe Token: SeIncBasePriorityPrivilege 372 {9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1516 wrote to memory of 3492 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe 85 PID 1516 wrote to memory of 3492 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe 85 PID 1516 wrote to memory of 3492 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe 85 PID 1516 wrote to memory of 1848 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe 86 PID 1516 wrote to memory of 1848 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe 86 PID 1516 wrote to memory of 1848 1516 2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe 86 PID 3492 wrote to memory of 3148 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 87 PID 3492 wrote to memory of 3148 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 87 PID 3492 wrote to memory of 3148 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 87 PID 3492 wrote to memory of 3512 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 88 PID 3492 wrote to memory of 3512 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 88 PID 3492 wrote to memory of 3512 3492 {1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe 88 PID 3148 wrote to memory of 3408 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 92 PID 3148 wrote to memory of 3408 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 92 PID 3148 wrote to memory of 3408 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 92 PID 3148 wrote to memory of 2260 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 93 PID 3148 wrote to memory of 2260 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 93 PID 3148 wrote to memory of 2260 3148 {0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe 93 PID 3408 wrote to memory of 2560 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 94 PID 3408 wrote to memory of 2560 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 94 PID 3408 wrote to memory of 2560 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 94 PID 3408 wrote to memory of 4300 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 95 PID 3408 wrote to memory of 4300 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 95 PID 3408 wrote to memory of 4300 3408 {B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe 95 PID 2560 wrote to memory of 3452 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 96 PID 2560 wrote to memory of 3452 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 96 PID 2560 wrote to memory of 3452 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 96 PID 2560 wrote to memory of 3432 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 97 PID 2560 wrote to memory of 3432 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 97 PID 2560 wrote to memory of 3432 2560 {130428C3-1841-4f08-949E-B84E1C0299FD}.exe 97 PID 3452 wrote to memory of 4828 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 98 PID 3452 wrote to memory of 4828 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 98 PID 3452 wrote to memory of 4828 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 98 PID 3452 wrote to memory of 4136 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 99 PID 3452 wrote to memory of 4136 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 99 PID 3452 wrote to memory of 4136 3452 {86950670-80CD-4498-B299-8CBBA0A0EA30}.exe 99 PID 4828 wrote to memory of 4376 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 100 PID 4828 wrote to memory of 4376 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 100 PID 4828 wrote to memory of 4376 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 100 PID 4828 wrote to memory of 2448 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 101 PID 4828 wrote to memory of 2448 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 101 PID 4828 wrote to memory of 2448 4828 {EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe 101 PID 4376 wrote to memory of 4020 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 102 PID 4376 wrote to memory of 4020 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 102 PID 4376 wrote to memory of 4020 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 102 PID 4376 wrote to memory of 3004 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 103 PID 4376 wrote to memory of 3004 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 103 PID 4376 wrote to memory of 3004 4376 {860964EB-63AC-4b02-9A05-3626B20C1B51}.exe 103 PID 4020 wrote to memory of 2688 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 104 PID 4020 wrote to memory of 2688 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 104 PID 4020 wrote to memory of 2688 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 104 PID 4020 wrote to memory of 928 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 105 PID 4020 wrote to memory of 928 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 105 PID 4020 wrote to memory of 928 4020 {DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe 105 PID 2688 wrote to memory of 1172 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 106 PID 2688 wrote to memory of 1172 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 106 PID 2688 wrote to memory of 1172 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 106 PID 2688 wrote to memory of 4024 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 107 PID 2688 wrote to memory of 4024 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 107 PID 2688 wrote to memory of 4024 2688 {76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe 107 PID 1172 wrote to memory of 372 1172 {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe 108 PID 1172 wrote to memory of 372 1172 {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe 108 PID 1172 wrote to memory of 372 1172 {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe 108 PID 1172 wrote to memory of 1580 1172 {13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_e44675c0d91e2da33b8a7ed78d7de56b_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\{1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exeC:\Windows\{1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\{0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exeC:\Windows\{0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\{B4E86D04-017B-41e5-98DC-EDCA532127C5}.exeC:\Windows\{B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\{130428C3-1841-4f08-949E-B84E1C0299FD}.exeC:\Windows\{130428C3-1841-4f08-949E-B84E1C0299FD}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\{86950670-80CD-4498-B299-8CBBA0A0EA30}.exeC:\Windows\{86950670-80CD-4498-B299-8CBBA0A0EA30}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exeC:\Windows\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\{860964EB-63AC-4b02-9A05-3626B20C1B51}.exeC:\Windows\{860964EB-63AC-4b02-9A05-3626B20C1B51}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\{DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exeC:\Windows\{DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\{76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exeC:\Windows\{76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\{13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exeC:\Windows\{13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exeC:\Windows\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:372 -
C:\Windows\{9AD42AB2-FC29-4974-8B32-2570F61B4A82}.exeC:\Windows\{9AD42AB2-FC29-4974-8B32-2570F61B4A82}.exe13⤵
- Executes dropped EXE
PID:4932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E1BB~1.EXE > nul13⤵PID:3912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13BC6~1.EXE > nul12⤵PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76B2C~1.EXE > nul11⤵PID:4024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC304~1.EXE > nul10⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86096~1.EXE > nul9⤵PID:3004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF9A8~1.EXE > nul8⤵PID:2448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86950~1.EXE > nul7⤵PID:4136
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13042~1.EXE > nul6⤵PID:3432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4E86~1.EXE > nul5⤵PID:4300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F07F~1.EXE > nul4⤵PID:2260
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BF78~1.EXE > nul3⤵PID:3512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:1848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0F07F31E-E20A-47d4-85E0-7C6836DD4310}.exe
- Size 168KB
- SHA256 e69f7fd7f087cfb7c3cd7715ab59a4cc61e025f5d83040de44a050efa8724572
- MD5 a6c4785b368f68fedd11f5dd2c12dbf0
- SHA1 e03a1e7fed24cdfebb595d45383c9d800d989283
- SHA512 1506e42480be14e6d9d454bc8c8dbacd4c239a58f8995a6873a33b4742beda366cf2a809ce2ec31b6660f17a5ae477d0ba347f294c1219ada1db522849de2304
- SSDEEP 1536:1EGh0oFVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oFVlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{130428C3-1841-4f08-949E-B84E1C0299FD}.exe
- Size 168KB
- SHA256 9a094bcba4284521473e47ad7c1c0aab70627e920880fc484c85ddb82de2549c
- MD5 61910773b792e4cb2771dd71da69d9d2
- SHA1 6fbd5c37d39d1af6915af835f478c7f098bc1142
- SHA512 94d34ed62477027eab8d2d46d8a3483f6bb3b01d03d02f8b729d55133dc9834714394a3773b149a8a4361fa6708725f9c6075e52156fa8e4c26fe62a7fb79152
- SSDEEP 1536:1EGh0oJlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{13BC6883-CFE2-4d9f-ADB2-D256312A5721}.exe
- Size 168KB
- SHA256 90697ff6f1a239a6f4c7adc9262d73a3ae6783b855894a78a165fe913de4121a
- MD5 370c5c344563d5c15a4e6bfcb8a7cc12
- SHA1 89ba6c7b97c6f2402aff33c654b8bb23ee59e450
- SHA512 5f7e55fadf7951fe247b6725a594970d7a58da4810aa32b792d18b927874a30e0a25b9b6e76de640bbb56d77f6d6ab0723d56bff798a988f5c6d74a25423c860
- SSDEEP 1536:1EGh0oWlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oWlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1BF78F67-FBC2-4917-8AF3-3D11422A507E}.exe
- Size 168KB
- SHA256 bd890326e25e332a13230efdd6d9ee29d7c045e7be4b31cb27a8939a16eee196
- MD5 f74420849500b3e3655b4d184764afe5
- SHA1 193c57702091db4b45fa1681bbb9e9176cd6ac07
- SHA512 53ec1160cafb231c94e9b2eee8529b98b58f78fa68276df0c0924d630357f0afaf9bd41cc194cda932439a45e07b3f083dd1349da6eb38e4d7305d12e7e3b065
- SSDEEP 1536:1EGh0oBlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oBlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{76B2C27C-9F91-42f5-ACFA-05A1C045314D}.exe
- Size 168KB
- SHA256 f6992b2b5d54989c5ad93bd88984c6c6fb0a4ac14eb4b5ff13fd1e9ee61505d0
- MD5 782ad59b63ff39774543e444523111ff
- SHA1 e60ab56784a05ba71b10d1ab18eef3e94ba89809
- SHA512 74156b65ac76272a9646dbcbaa91883b773dfbcd420d41325693939f0c3b0c17181f86d31eff545a82d9229e7a0559a6be865d85a97e3ae2555f820881fc806b
- SSDEEP 1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{860964EB-63AC-4b02-9A05-3626B20C1B51}.exe
- Size 168KB
- SHA256 22efce814e104ccab9a997989c994b834c440ca0371bc1b5bc1072bb3417eecb
- MD5 cd0455f96104f779c3dcd2ed03a516d2
- SHA1 86be5b04df966004d0f6c5fe99f4a427c2b92b45
- SHA512 566c996719a38ea33d79f1e51c8d08b6140882a4059bc287a06b0469c504deb2d04d36b80bb63521dc079c96da847da5f561eb486dfca91c571d18504c7e6822
- SSDEEP 1536:1EGh0oqlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oqlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{86950670-80CD-4498-B299-8CBBA0A0EA30}.exe
- Size 168KB
- SHA256 a1ab72b8a87e40b890b374804a7a95a3446ca74e0e3d37a52ff83c8e08f26daf
- MD5 7f8117b011947cc2faad0699e8a7032a
- SHA1 2fa9264d2123b8c9f722fac8b1fb48859ae811ee
- SHA512 ef279362e51c6a2552513f068804c6244566fce2c60cd98c63f017318872c135f088d2d6c467387b78006afb2bd3e790c710492a483e2c3ddd35bdb6893645df
- SSDEEP 1536:1EGh0oXelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9AD42AB2-FC29-4974-8B32-2570F61B4A82}.exe
- Size 168KB
- SHA256 95bf040998c49a9e71ffb7b77fb02169fa9508da1c2c6f905217d12aa31880b4
- MD5 392a0b38c0bc7268a3c33599c913f20e
- SHA1 184b0640e13a55fa821afdd0ae84b6a2ae1657f5
- SHA512 3ae377e93972966f89ae54a99ecadb7eaf842441d1e6db073015d1f6f02dbef2238599192b4aa70b73baaf2b42840ac529600b3752cc5bfe94fc2ea4fcd5cdf3
- SSDEEP 1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{9E1BB459-067D-40bc-A5C5-B64C4D4A8EA4}.exe
- Size 168KB
- SHA256 a3f15d2e7039a357f7a5134ae7d334a1f7fd5ba8abb87b7d234dc9e1a3e70d5f
- MD5 77ab883b9310933d32ad50eb054b7a6f
- SHA1 cf0ae419f027637a3538be4bc70e56b541b0fd6e
- SHA512 f7ca6356f3a1aa721ef1faf34b84745f57fe585e6307fbda61d820f46894badf6e4cfe407e880e4cb224dad15277b2af7bce940a1f86ba1724cf5224b7869c54
- SSDEEP 1536:1EGh0oClq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oClqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B4E86D04-017B-41e5-98DC-EDCA532127C5}.exe
- Size 168KB
- SHA256 ee5c7405944732865203958e41069c5098b3e496b39b19ab6955b2f6aea433c7
- MD5 1c04036e9889d1158e8853336dc975c5
- SHA1 ec9f17dbfb8074630cad77b5cfc78b516ab94314
- SHA512 7e58eb59b70957ff847d81572bba2b34820b82ce87ae5e20850d4b8a5aa1ee8807fa354d468602aae8d4e09095c6466d347970b79dd4a34f9f3079a7afd24c2f
- SSDEEP 1536:1EGh0o0lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o0lqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{DC304BB9-0976-4070-922D-70B8D9CF9CCD}.exe
- Size 168KB
- SHA256 71e287a5b597dc8454ea95d28382843ce2ced4ec4522bd838294f236e8e3410b
- MD5 0cd2ba1c4a98038f7cae8e794f249004
- SHA1 e7202db403c2d0bb2ee0ebc68b66a061c641fe52
- SHA512 4aa4cf6186e0417e1704cbb9cfa40f94ea00deecae15e2c5e53ff25d714a97c2cd3b87384d45d33281eb86c5bb62a58605e96b00ae3444c060da7771eb933866
- SSDEEP 1536:1EGh0oWlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oWlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{EF9A8397-39C5-4e81-9EBC-2587D4B698F2}.exe
- Size 168KB
- SHA256 3bdc5c200378537a2498b933171a87860eb02d96ddfdc945f31baeb292c49933
- MD5 c89eb8507adbd5b8cd5ba1e411e0c50c
- SHA1 3dbb94d3cb33ad774179549afac8a60328b31053
- SHA512 86508a6c0141e4258aaff74c2e91f5139bed76769857435038451b7e98477c1917c9aa064dd592f9c53a952f72bd787c22e1cb54234acd79d1454f00a34dcdc8
- SSDEEP 1536:1EGh0oBlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oBlqOPOe2MUVg3Ve+rX
- MD5 SHA1 SHA512 SSDEEP