f46c8797f741fa69370e7cd3af92d66d44b5e1364327fb81d0f21e0257995b90

Analysis

max time kernel
156s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe
Size

180KB
MD5

ebb4139bb66669a1d18ab98ffc823485
SHA1

21072d5b896d370d88a1bee68b5ce6e08b78b580
SHA256

f46c8797f741fa69370e7cd3af92d66d44b5e1364327fb81d0f21e0257995b90
SHA512

18f5649d04615837053ec01c36f7b00fc0be6dfce59ce8b540d6d471d95561f55d4c22a1d28fcf534b6e746f3ceac3e6ee6b35b44e828d7ed6650f99864e154e
SSDEEP

3072:jEGh0o3lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGVl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023130-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002313c-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023141-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002301e-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002313c-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000217fa-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006df-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000006df-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D92428F-25D9-42a9-8081-77088C0CB679}	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}\stubpath = "C:\\Windows\\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe"	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D92428F-25D9-42a9-8081-77088C0CB679}\stubpath = "C:\\Windows\\{9D92428F-25D9-42a9-8081-77088C0CB679}.exe"	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}\stubpath = "C:\\Windows\\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe"	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}\stubpath = "C:\\Windows\\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe"	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0538E112-6800-45d9-AF8F-5993AD91358A}	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0538E112-6800-45d9-AF8F-5993AD91358A}\stubpath = "C:\\Windows\\{0538E112-6800-45d9-AF8F-5993AD91358A}.exe"	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB63F225-AA06-4165-9D40-20C0F9001D92}	{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB63F225-AA06-4165-9D40-20C0F9001D92}\stubpath = "C:\\Windows\\{AB63F225-AA06-4165-9D40-20C0F9001D92}.exe"	{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}\stubpath = "C:\\Windows\\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe"	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}\stubpath = "C:\\Windows\\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe"	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}\stubpath = "C:\\Windows\\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe"	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}\stubpath = "C:\\Windows\\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe"	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}\stubpath = "C:\\Windows\\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe"	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}\stubpath = "C:\\Windows\\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe"	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe

Executes dropped EXE 12 IoCs

pid	Process
3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
4360	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe
2464	{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe
3348	{AB63F225-AA06-4165-9D40-20C0F9001D92}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
File created	C:\Windows\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
File created	C:\Windows\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
File created	C:\Windows\{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
File created	C:\Windows\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe
File created	C:\Windows\{AB63F225-AA06-4165-9D40-20C0F9001D92}.exe	{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe
File created	C:\Windows\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
File created	C:\Windows\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
File created	C:\Windows\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
File created	C:\Windows\{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
File created	C:\Windows\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
File created	C:\Windows\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
Token: SeIncBasePriorityPrivilege	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
Token: SeIncBasePriorityPrivilege	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
Token: SeIncBasePriorityPrivilege	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
Token: SeIncBasePriorityPrivilege	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
Token: SeIncBasePriorityPrivilege	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
Token: SeIncBasePriorityPrivilege	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
Token: SeIncBasePriorityPrivilege	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
Token: SeIncBasePriorityPrivilege	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
Token: SeIncBasePriorityPrivilege	4360	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe
Token: SeIncBasePriorityPrivilege	2464	{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3580	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe	84
PID 640 wrote to memory of 3580	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe	84
PID 640 wrote to memory of 3580	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe	84
PID 640 wrote to memory of 5024	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe	85
PID 640 wrote to memory of 5024	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe	85
PID 640 wrote to memory of 5024	640	2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe	85
PID 3580 wrote to memory of 3344	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	91
PID 3580 wrote to memory of 3344	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	91
PID 3580 wrote to memory of 3344	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	91
PID 3580 wrote to memory of 2352	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	92
PID 3580 wrote to memory of 2352	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	92
PID 3580 wrote to memory of 2352	3580	{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe	92
PID 3344 wrote to memory of 4440	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	96
PID 3344 wrote to memory of 4440	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	96
PID 3344 wrote to memory of 4440	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	96
PID 3344 wrote to memory of 1868	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	97
PID 3344 wrote to memory of 1868	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	97
PID 3344 wrote to memory of 1868	3344	{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe	97
PID 4440 wrote to memory of 1616	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	98
PID 4440 wrote to memory of 1616	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	98
PID 4440 wrote to memory of 1616	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	98
PID 4440 wrote to memory of 920	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	99
PID 4440 wrote to memory of 920	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	99
PID 4440 wrote to memory of 920	4440	{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe	99
PID 1616 wrote to memory of 1124	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	100
PID 1616 wrote to memory of 1124	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	100
PID 1616 wrote to memory of 1124	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	100
PID 1616 wrote to memory of 1260	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	101
PID 1616 wrote to memory of 1260	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	101
PID 1616 wrote to memory of 1260	1616	{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe	101
PID 1124 wrote to memory of 4140	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	102
PID 1124 wrote to memory of 4140	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	102
PID 1124 wrote to memory of 4140	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	102
PID 1124 wrote to memory of 4044	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	103
PID 1124 wrote to memory of 4044	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	103
PID 1124 wrote to memory of 4044	1124	{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe	103
PID 4140 wrote to memory of 2040	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	104
PID 4140 wrote to memory of 2040	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	104
PID 4140 wrote to memory of 2040	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	104
PID 4140 wrote to memory of 4216	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	105
PID 4140 wrote to memory of 4216	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	105
PID 4140 wrote to memory of 4216	4140	{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe	105
PID 2040 wrote to memory of 1660	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	106
PID 2040 wrote to memory of 1660	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	106
PID 2040 wrote to memory of 1660	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	106
PID 2040 wrote to memory of 4696	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	107
PID 2040 wrote to memory of 4696	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	107
PID 2040 wrote to memory of 4696	2040	{0538E112-6800-45d9-AF8F-5993AD91358A}.exe	107
PID 1660 wrote to memory of 1300	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	109
PID 1660 wrote to memory of 1300	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	109
PID 1660 wrote to memory of 1300	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	109
PID 1660 wrote to memory of 1256	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	108
PID 1660 wrote to memory of 1256	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	108
PID 1660 wrote to memory of 1256	1660	{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe	108
PID 1300 wrote to memory of 4360	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	110
PID 1300 wrote to memory of 4360	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	110
PID 1300 wrote to memory of 4360	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	110
PID 1300 wrote to memory of 4392	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	111
PID 1300 wrote to memory of 4392	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	111
PID 1300 wrote to memory of 4392	1300	{9D92428F-25D9-42a9-8081-77088C0CB679}.exe	111
PID 4360 wrote to memory of 2464	4360	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe	112
PID 4360 wrote to memory of 2464	4360	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe	112
PID 4360 wrote to memory of 2464	4360	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe	112
PID 4360 wrote to memory of 5024	4360	{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ebb4139bb66669a1d18ab98ffc823485_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
  C:\Windows\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
    C:\Windows\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
      C:\Windows\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
        
        C:\Windows\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1616
      - C:\Windows\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
        
        C:\Windows\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
        
        C:\Windows\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
        
        C:\Windows\{0538E112-6800-45d9-AF8F-5993AD91358A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
        
        C:\Windows\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4FDF6~1.EXE > nul
        10⤵
        
        PID:1256
        
        C:\Windows\{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
        
        C:\Windows\{9D92428F-25D9-42a9-8081-77088C0CB679}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe
        
        C:\Windows\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe
        
        C:\Windows\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
        
        C:\Windows\{AB63F225-AA06-4165-9D40-20C0F9001D92}.exe
        
        C:\Windows\{AB63F225-AA06-4165-9D40-20C0F9001D92}.exe
        13⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DBBBF~1.EXE > nul
        13⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3FD0~1.EXE > nul
        12⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9D924~1.EXE > nul
        11⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0538E~1.EXE > nul
        9⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{709B5~1.EXE > nul
        8⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D22F~1.EXE > nul
        7⤵
        
        PID:4044
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{242ED~1.EXE > nul
        6⤵
        
        PID:1260
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5BCD1~1.EXE > nul
        5⤵
        
        PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3CF02~1.EXE > nul
      4⤵
      PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A7A16~1.EXE > nul
    3⤵
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0538E112-6800-45d9-AF8F-5993AD91358A}.exe

Filesize
180KB

MD5
0f3d21fdac38333f50437f61e373804d

SHA1
9234fd29558a6bf33a3329f4abccce8caca75d76

SHA256
6920ec7d7f0b283f26e169c4b5d78c8ee8e37a7f563d2be5ba19cb1eeb9ff874

SHA512
3e2bad421c7c615f86292c5ac8ea6363fb3a75b98729402ee8a2b5c0649cf32de67691ae4dcdee349c048c346cd479e58b44c133a451768985d6b4229a7059c2

Download Submit
C:\Windows\{242EDDE9-E3F9-41c2-B993-B935CE8B94AB}.exe

Filesize
180KB

MD5
545646d5c14da226147e27e6f7402952

SHA1
70339ce4b22b5bc1ca986327e7b1d0edd18a5156

SHA256
4237b41335378baa6d78a0fbf95d66e07bb4d7490fc9967e021090d0f7ed4dee

SHA512
b38b413708203a5a15d4ca6ef9c3b0c925e7401f095a98d21e69d453c8490fe7c20470b02a3ab74a35ee41e8c853886a2726572d1e1c0d334519d56869470ab8

Download Submit
C:\Windows\{2D22F416-466A-4b5e-AA14-87E67A6A97E5}.exe

Filesize
180KB

MD5
dde29e4a77092104d015008ec1393dc6

SHA1
1f85c5012d289fc6382809ff7498129168cb6b8f

SHA256
b882996e6f3912053e321ac88195d2850e1609ee9ceaf9622859403cb2488a8d

SHA512
bcffe96264cc3350488e4524d8701a93e2f9409fbf13466816dc7d143b30138ff2227e274ab8a8bc7065bd5eb32b35cbc20d298eebf0fdba622992526bdc1ac0

Download Submit
C:\Windows\{3CF027DA-F786-4899-B1E5-B6D4DB1B31FA}.exe

Filesize
180KB

MD5
1be5dccc9895a24f19ab5e3a94b8c295

SHA1
630f1c5e1c3ffa147a3539b0b063724e9a6f4178

SHA256
62826c958c001943baf4eb3bc986fffeec151b31440e53862e1f2f141fb6e0f8

SHA512
2af9d9f70281c37571dcf5e6ee4197d526d83503ca6017f7f258376b25aa7dadc17281756f2d4792ee1e55a20e34cfd4763a2f7a8ea9d5666527325b57ea355e

Download Submit
C:\Windows\{4FDF65A2-EC30-43cd-9AEE-BA33725D0675}.exe

Filesize
180KB

MD5
174a51394234435abb0f60c468dbdcfb

SHA1
206925ab6972a2fab9d66ede946d78341e685f23

SHA256
207a8a679094b0f2967d85076eaef5078ac2a1e6a1d43537dd31429d7c1bff96

SHA512
78ef2a77d90c7668e7d6cd514d960aa8ea15b04bf51eae9d3f093e3a01fbf9540825ee2c405e17ec7f60b775c051ba8ead2f5ed8b57a330278a62db81066b00c

Download Submit
C:\Windows\{5BCD1FC5-2900-4d83-8DBB-A767717A7518}.exe

Filesize
180KB

MD5
60567c144d38f7e9e2ef2d46e3ae8bac

SHA1
a7c5787b10f2b1f2d1cb7ee0eea540ce7fcada5f

SHA256
16eaa98d6790dd95dd4a1da40d0e94dc1204ef80c4c5ee1b74179c9d06a6b08d

SHA512
ee58cc4104021c5212c3aa75ce194c77acd9698ca81203db69b136d65ad3073ac2a0e61ee429b7a3d6990897991d183cc6b26bb7c11d5e62ddaea0c8c664d291

Download Submit
C:\Windows\{709B517D-4FE3-439a-9DDE-01DFCE7AA778}.exe

Filesize
180KB

MD5
6dc2af7f0673fefdf6b830aff5dbb5ef

SHA1
e538af6b0104166528aa8769d0067fd61f906c88

SHA256
11d6606054bfdf6b0d821ff230a58437a998ec892df0119c2580678c0508269b

SHA512
07464d4900c6ee08d958ffbdb2c05a4c88863f527308b998391c5a8efaa18affa24ffbaecbd59e66c646c51a6061067b47b59fe422c120db4b3271c6445680e6

Download Submit
C:\Windows\{9D92428F-25D9-42a9-8081-77088C0CB679}.exe

Filesize
180KB

MD5
cd56f5ff051bff428afa6a565c81e69a

SHA1
304484e8dd9ae9898058cd1ab3158ed87f5e7391

SHA256
0c440f44fe7e6f676b570990130f86bd991692cab206e65f592dd8e32abcf099

SHA512
85004127c28e6b8350f58a9ce24ca8741a016b539bafaf6c81a86bca99434de880dea6e8a8c5602165ddf000a60d6525c7d4813d9a717a5483d62e1b959eac54

Download Submit
C:\Windows\{A7A16C71-3F84-400b-89EF-2A671E22BAF1}.exe

Filesize
180KB

MD5
a8e60be83bb0b25388a8600ea330e6d6

SHA1
56c752007950fb4a208765fe1b8fcbf46696fb03

SHA256
0116b61080a289bbee93fa215c93d6e3326e75c82285a1189e11ac6092af3756

SHA512
5d96b5b134302c56ac9b1617beac375467521b8998f14b76b686d7119212efd17ff0ac1e5570acc19eb6d5f79796e6fcc76f86833749dc6b857f9db86b3debbb

Download Submit
C:\Windows\{AB63F225-AA06-4165-9D40-20C0F9001D92}.exe

Filesize
180KB

MD5
176ebe607f1003f3b9413128a4fe0b9b

SHA1
4466b60fe6611a6e7ff06485199d8ba849e8d701

SHA256
72f66508d8cc9f71326bd63e10a7fcb576937430e7e50b302888b12013f569a8

SHA512
2657d09f2ab0ed530a148c231db99aa41e785848422d16f2a0a41abda987a5067dc82ba2491e9900122597892f7468e26fe94fc991f85ab9ff5f45c08149890a

Download Submit
C:\Windows\{C3FD02A5-C392-418c-9C24-7C915E9BC5C6}.exe

Filesize
180KB

MD5
fddb60ce6dc927b3090f3b4c34e15617

SHA1
18c452c05fa9d3b50b4ddacdca3dcb216caa2b27

SHA256
1ba7a42417a23a3c07eeeacce3de29bfebde4a9365bf90d88d4eca0a8f5835db

SHA512
94bc487b06274b804858f68c66558c8aebd4b9a45b572f6bf7c46de1acd8ca9cf53e624a692e3e2240f276bccb61ee16d23825713c6202192b80edcd4a97a133

Download Submit
C:\Windows\{DBBBF544-8F78-463c-8EA1-4D97DAFD9D01}.exe

Filesize
180KB

MD5
8784e65b94e9e5e7325edd749aaf0a8d

SHA1
127b75337a616ec0ae94176e133b7d691b684922

SHA256
4362ff30459bad72501489113b733259b0c0c78055d4812606c2618103581ee3

SHA512
9d08e05a7003e1f7bfe8182dfcb6e10efd2fd27c62cef41bc1f55c8989201c73c131c5358f2af82962337bde2a71d8bfacea2eb0425226d98b3f5a77d0a95dcc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads