5bd624e1e48b40582eedaf94dd4b1e628b164fe5d847f2385449eeafa2556cc3

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe
Size

408KB
MD5

2ce73e36544f566c452f098f07aa5b0a
SHA1

96829e1dd1e09b32adb799a877e198d3451926c2
SHA256

5bd624e1e48b40582eedaf94dd4b1e628b164fe5d847f2385449eeafa2556cc3
SHA512

22c6fb47e5c3ca8be67d48e98886bc413c2d47f1c9cdaf984f4d53cdd01d323cc825addcc2e727342616084ffe57999a5cbf5d6631afc45e149ac085beca6a2c
SSDEEP

3072:CEGh0o5l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGzldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000600000002311e-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002312a-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023130-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002312a-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023130-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000217fa-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002181f-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006df-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90DE41F5-041F-4be4-B87A-A6012B34BA53}\stubpath = "C:\\Windows\\{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe"	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}\stubpath = "C:\\Windows\\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe"	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D5BDE88-19A6-4698-A4DC-EB537345C836}\stubpath = "C:\\Windows\\{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe"	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98884819-5DE1-49d4-8FD9-3902B03C3972}	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F4899B2-C22C-4802-957B-0E903529800F}\stubpath = "C:\\Windows\\{2F4899B2-C22C-4802-957B-0E903529800F}.exe"	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4277A0CA-16ED-4288-8F38-62F80D66B96E}	{2F4899B2-C22C-4802-957B-0E903529800F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4277A0CA-16ED-4288-8F38-62F80D66B96E}\stubpath = "C:\\Windows\\{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe"	{2F4899B2-C22C-4802-957B-0E903529800F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE9C15E0-442C-4955-8526-C699C343A27D}	{EC33516C-9056-4791-861E-A533B7983827}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE9C15E0-442C-4955-8526-C699C343A27D}\stubpath = "C:\\Windows\\{AE9C15E0-442C-4955-8526-C699C343A27D}.exe"	{EC33516C-9056-4791-861E-A533B7983827}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}\stubpath = "C:\\Windows\\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe"	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}\stubpath = "C:\\Windows\\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe"	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC33516C-9056-4791-861E-A533B7983827}	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC33516C-9056-4791-861E-A533B7983827}\stubpath = "C:\\Windows\\{EC33516C-9056-4791-861E-A533B7983827}.exe"	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}\stubpath = "C:\\Windows\\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe"	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98884819-5DE1-49d4-8FD9-3902B03C3972}\stubpath = "C:\\Windows\\{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe"	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}\stubpath = "C:\\Windows\\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}.exe"	{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90DE41F5-041F-4be4-B87A-A6012B34BA53}	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F4899B2-C22C-4802-957B-0E903529800F}	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}	{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D5BDE88-19A6-4698-A4DC-EB537345C836}	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe

Executes dropped EXE 12 IoCs

pid	Process
1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
3292	{EC33516C-9056-4791-861E-A533B7983827}.exe
1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe
3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
3668	{2F4899B2-C22C-4802-957B-0E903529800F}.exe
3620	{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe
840	{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe
File created	C:\Windows\{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
File created	C:\Windows\{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
File created	C:\Windows\{2F4899B2-C22C-4802-957B-0E903529800F}.exe	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
File created	C:\Windows\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe
File created	C:\Windows\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
File created	C:\Windows\{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	{EC33516C-9056-4791-861E-A533B7983827}.exe
File created	C:\Windows\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
File created	C:\Windows\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}.exe	{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe
File created	C:\Windows\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
File created	C:\Windows\{EC33516C-9056-4791-861E-A533B7983827}.exe	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
File created	C:\Windows\{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe	{2F4899B2-C22C-4802-957B-0E903529800F}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
Token: SeIncBasePriorityPrivilege	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
Token: SeIncBasePriorityPrivilege	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
Token: SeIncBasePriorityPrivilege	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe
Token: SeIncBasePriorityPrivilege	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
Token: SeIncBasePriorityPrivilege	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe
Token: SeIncBasePriorityPrivilege	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
Token: SeIncBasePriorityPrivilege	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
Token: SeIncBasePriorityPrivilege	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
Token: SeIncBasePriorityPrivilege	3668	{2F4899B2-C22C-4802-957B-0E903529800F}.exe
Token: SeIncBasePriorityPrivilege	3620	{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1176	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe	87
PID 2572 wrote to memory of 1176	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe	87
PID 2572 wrote to memory of 1176	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe	87
PID 2572 wrote to memory of 1968	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe	88
PID 2572 wrote to memory of 1968	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe	88
PID 2572 wrote to memory of 1968	2572	2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe	88
PID 1176 wrote to memory of 4688	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	93
PID 1176 wrote to memory of 4688	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	93
PID 1176 wrote to memory of 4688	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	93
PID 1176 wrote to memory of 3436	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	94
PID 1176 wrote to memory of 3436	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	94
PID 1176 wrote to memory of 3436	1176	{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe	94
PID 4688 wrote to memory of 1560	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	97
PID 4688 wrote to memory of 1560	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	97
PID 4688 wrote to memory of 1560	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	97
PID 4688 wrote to memory of 8	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	96
PID 4688 wrote to memory of 8	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	96
PID 4688 wrote to memory of 8	4688	{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe	96
PID 1560 wrote to memory of 3292	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	98
PID 1560 wrote to memory of 3292	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	98
PID 1560 wrote to memory of 3292	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	98
PID 1560 wrote to memory of 3828	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	99
PID 1560 wrote to memory of 3828	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	99
PID 1560 wrote to memory of 3828	1560	{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe	99
PID 3292 wrote to memory of 1284	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe	100
PID 3292 wrote to memory of 1284	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe	100
PID 3292 wrote to memory of 1284	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe	100
PID 3292 wrote to memory of 3364	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe	101
PID 3292 wrote to memory of 3364	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe	101
PID 3292 wrote to memory of 3364	3292	{EC33516C-9056-4791-861E-A533B7983827}.exe	101
PID 1284 wrote to memory of 3532	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	102
PID 1284 wrote to memory of 3532	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	102
PID 1284 wrote to memory of 3532	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	102
PID 1284 wrote to memory of 1200	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	103
PID 1284 wrote to memory of 1200	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	103
PID 1284 wrote to memory of 1200	1284	{AE9C15E0-442C-4955-8526-C699C343A27D}.exe	103
PID 3532 wrote to memory of 3704	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	104
PID 3532 wrote to memory of 3704	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	104
PID 3532 wrote to memory of 3704	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	104
PID 3532 wrote to memory of 1840	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	105
PID 3532 wrote to memory of 1840	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	105
PID 3532 wrote to memory of 1840	3532	{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe	105
PID 3704 wrote to memory of 2804	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	106
PID 3704 wrote to memory of 2804	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	106
PID 3704 wrote to memory of 2804	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	106
PID 3704 wrote to memory of 2864	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	107
PID 3704 wrote to memory of 2864	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	107
PID 3704 wrote to memory of 2864	3704	{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe	107
PID 2804 wrote to memory of 1600	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	108
PID 2804 wrote to memory of 1600	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	108
PID 2804 wrote to memory of 1600	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	108
PID 2804 wrote to memory of 1848	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	109
PID 2804 wrote to memory of 1848	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	109
PID 2804 wrote to memory of 1848	2804	{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe	109
PID 1600 wrote to memory of 3668	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	110
PID 1600 wrote to memory of 3668	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	110
PID 1600 wrote to memory of 3668	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	110
PID 1600 wrote to memory of 4184	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	111
PID 1600 wrote to memory of 4184	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	111
PID 1600 wrote to memory of 4184	1600	{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe	111
PID 3668 wrote to memory of 3620	3668	{2F4899B2-C22C-4802-957B-0E903529800F}.exe	112
PID 3668 wrote to memory of 3620	3668	{2F4899B2-C22C-4802-957B-0E903529800F}.exe	112
PID 3668 wrote to memory of 3620	3668	{2F4899B2-C22C-4802-957B-0E903529800F}.exe	112
PID 3668 wrote to memory of 5092	3668	{2F4899B2-C22C-4802-957B-0E903529800F}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_2ce73e36544f566c452f098f07aa5b0a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
  C:\Windows\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
    C:\Windows\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C46C5~1.EXE > nul
      4⤵
      PID:8
  - - C:\Windows\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
      C:\Windows\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\{EC33516C-9056-4791-861E-A533B7983827}.exe
        
        C:\Windows\{EC33516C-9056-4791-861E-A533B7983827}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3292
      - C:\Windows\{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
        
        C:\Windows\{AE9C15E0-442C-4955-8526-C699C343A27D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe
        
        C:\Windows\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
        
        C:\Windows\{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
        
        C:\Windows\{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
        
        C:\Windows\{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\{2F4899B2-C22C-4802-957B-0E903529800F}.exe
        
        C:\Windows\{2F4899B2-C22C-4802-957B-0E903529800F}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe
        
        C:\Windows\{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
        
        C:\Windows\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}.exe
        
        C:\Windows\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}.exe
        13⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4277A~1.EXE > nul
        13⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2F489~1.EXE > nul
        12⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{90DE4~1.EXE > nul
        11⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98884~1.EXE > nul
        10⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D5BD~1.EXE > nul
        9⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64E1F~1.EXE > nul
        8⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AE9C1~1.EXE > nul
        7⤵
        
        PID:1200
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EC335~1.EXE > nul
        6⤵
        
        PID:3364
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D82C~1.EXE > nul
        5⤵
        
        PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5DB79~1.EXE > nul
    3⤵
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{122D7DBA-1156-4be6-BF7A-C69C0EAADF91}.exe

Filesize
408KB

MD5
af73a7e9488cbad2f849d20870a0e123

SHA1
eb98cfd923e6ec95ceeac566abfc94a99fc92db4

SHA256
2ae0fc089afd67538be17f08914da88d182e07085b1da2b59b33705a6fe112ae

SHA512
f12a8ea837fb16b7ec0e34504f1877b42b3d19bdd2602c7afb9ed310547e6c07fd03be1a3bd9afece9b8f85d7a7d8c6e0f0a8c992c00059a59bb5cfdb0e4f92f

Download Submit
C:\Windows\{2F4899B2-C22C-4802-957B-0E903529800F}.exe

Filesize
408KB

MD5
4c36f483e353932b39500840ebddb123

SHA1
92fe270e91ba5e720453a9482b46c56848eb08ce

SHA256
b8feaf83ccfc297697f6e7880f018c866e351a9d1504f492eb0f3cfef98e14de

SHA512
f3e0eaa98321bd9af22794b9cd5c193df0f144dd75ddf03e6ae98a32de874bebec89b995446f49ad7adb5cb7cab8308597a5dbdea9a4dedee5b7a79fb9fadfbe

Download Submit
C:\Windows\{3D5BDE88-19A6-4698-A4DC-EB537345C836}.exe

Filesize
408KB

MD5
03cfb0b603fe7b6c7c15d985c95ca70a

SHA1
3607c5bc094f34c4468b33c3e6d40dd997ee99cc

SHA256
7408c3e7dc44618369478a6bd0c2cb9245c5d44a55e7b4cde85c2d1d7bcbc1c3

SHA512
5f8abe79aeb7a94a4087ec2a28ece2e3818c9ab67cb56eec9578b24520406a39d6e9f572fbfdd152611e390942c43797f67a864895ab4b688936b60171506f87

Download Submit
C:\Windows\{4277A0CA-16ED-4288-8F38-62F80D66B96E}.exe

Filesize
408KB

MD5
761a69d1d148feb4e4eff55085f755e7

SHA1
45b7bf2c0cde4cdf6a00a7479335ee65f1cf5701

SHA256
711ed553fac2281ec091d78350581e0dce268e5272651b39516c7458afd96f58

SHA512
cb2a54d63a261de316a809a932d1c27178be834b02db0810d42b124b5df3beb94368abd7f84a088fb1e891b88f187c45ad282693e7da52b5d2dce87c4eeecdfc

Download Submit
C:\Windows\{5DB79CD6-9C01-4fc6-A3E0-90BB13DFF5CF}.exe

Filesize
408KB

MD5
8d3fc77d0b58e4ea10245837329caacb

SHA1
b6c61890c447546e4ad05453ba98764ac39dbc51

SHA256
15c556fdc874f8cd8a91e7afd4a7a8ebd8937cf5e301ab2ae6701a792571ff09

SHA512
f06373ed3a48821c00f7c94511add79675cfd255bb18ac85565cbf4ee7c526119f59c2d2b47bfe8ba1129aa33fa646c3f7795314d9ae7465e4570ea1cd00b16f

Download Submit
C:\Windows\{64E1F239-8652-4ccf-B613-38DC2BAADDFB}.exe

Filesize
408KB

MD5
2dcd66dcd922463f40c261b7295f27d8

SHA1
133c27ecc81f08abbf7dfdc80441bd8841b0a981

SHA256
9bb54caa62db4d13e5e5a2ed0044a44e4c1b0d002b0660d035798a186e312b83

SHA512
d97a5cb02e91a90ca2aab7c77913f4ff5cfa87001b8ae0d025da44c178bc469a8c323ad2b4290b9e92ebdd11487eadc14b16b6e91a5e000de673bef4531ed11e

Download Submit
C:\Windows\{6D82C95D-C933-4a8a-95F9-F2A13F2F011E}.exe

Filesize
408KB

MD5
841918650b4fbcabced5b631e6ecb655

SHA1
4bb43180e5d9745188040405d7c853864b410d7e

SHA256
1a78d36f27d43e22f00f974e2127d3911ac86978c88e544b505bb79de79b24d0

SHA512
36999f233ce8c97a6e561ac99a241a8ee22d29fc0faac42b1428ff468eca058b6ef10eb75667d0c3cc1d3d8d29dcd5a7c93e342fb9ae08984417a72e01f3f35a

Download Submit
C:\Windows\{90DE41F5-041F-4be4-B87A-A6012B34BA53}.exe

Filesize
408KB

MD5
fd85227cfa26609f8267d650b6a7ab82

SHA1
948e1cedb3192bff5a37fe95375bcb2a1ad25dae

SHA256
5f2779dd5f39f3c4019a58b7b4ca4ac874274e692bbb778a603783b4c1f6f900

SHA512
b24d3ec01912d1c9eaab426b492109ef851d047b57b8e5d4adba89cf8a01f8e365649789a40b9167cb4553385200e4cd389fd14d6063bd6c66592ed1eae57a63

Download Submit
C:\Windows\{98884819-5DE1-49d4-8FD9-3902B03C3972}.exe

Filesize
408KB

MD5
9bbec5fa234f3efb26ba405ccc258fc9

SHA1
f33a7f7b48bef9969e69f356a731050fbea8e275

SHA256
70427b95e5250cff23ab81a8807bb0dbcca7edebac6d4a6a72b9f46b11e93a6c

SHA512
03fbf56f4bab47945f53f9a80cbb20c72223bd0235142fef9879cf260faaf4a1ad7a376dac96751feb7dc7a097a05a93914adf5e8f331d4ba66bfdba34724df6

Download Submit
C:\Windows\{AE9C15E0-442C-4955-8526-C699C343A27D}.exe

Filesize
408KB

MD5
8e804dd541f8d21879bad0fabe562e86

SHA1
f6c5df1ed4f4c80eb400fb43ea2b3a6940551080

SHA256
7c07d7378b036e4b4ae2b39c4c60c801c4ec3b71e871ff2f31dacd26ad6c43b9

SHA512
1363932156bb709a414d7fda7c00b784b7317e8b12c17af6986e3f5813d29caa9e58aa21946c478d4d28842c3046540281821a1d56bc94d6e427a39477be07d4

Download Submit
C:\Windows\{C46C53E5-00E5-4e13-A64D-77E890F5DA09}.exe

Filesize
408KB

MD5
1b17e819be047c4b19c24426885423fb

SHA1
7c2618353459369bc2b5f7308f69ea95b806d842

SHA256
f3a078f14dd31b955e7768d50235ff05b832fd22092a5c6c9137a26bdc70b740

SHA512
158ea2c605484cd376b61c24089d2a6c854f74d5df378dcbec64f7b09e3deb81c8faff25e2b6cb1b78e27a4c6c0b9e1bec32c9a6a1ecf7571b853e6da37a29cf

Download Submit
C:\Windows\{EC33516C-9056-4791-861E-A533B7983827}.exe

Filesize
408KB

MD5
2e139a325670f53d387c0701095b3d70

SHA1
ff8015e7021ed6447d31b85cb0367a46bbe3a4ed

SHA256
bd2ffeee3af1d05c7645dad8cfffd889193df09b20c691d84c0a30decea6bf26

SHA512
1d57971e1a6904b1b63efe107df95f32b82f62c5b314806c8c102ad23383116d7d4321216df3ae4e59f1796f61c17d37e6f6f133b67fa137c277919908095b05

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads