e6e6d6da5d85e09e11f2a2b27e2224907db538b65a0c5cf4f291547bac676db8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe
Size

168KB
MD5

cc5a1c532eb5a0ccb25653297c2444f5
SHA1

6e69fcd03a445b419c6128d51032e6cde424f1d5
SHA256

e6e6d6da5d85e09e11f2a2b27e2224907db538b65a0c5cf4f291547bac676db8
SHA512

97ab023b38cc5d7d84ce09b44da443f821a4aa91ea0e2b4af80979a2a606eacbf90872bdd71e30c8cfd2ea5e4e5b700a71e7172216b1a0a37700d238efcd1be0
SSDEEP

1536:1EGh0ofli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ofliOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023333-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002333c-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023333-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023344-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00110000000230dd-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023333-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00130000000230dd-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023333-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00140000000230dd-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000230e9-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001e477-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}	{16466435-065E-4c95-8429-AA4AE551F525}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}\stubpath = "C:\\Windows\\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe"	{16466435-065E-4c95-8429-AA4AE551F525}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}\stubpath = "C:\\Windows\\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe"	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C9BEF63-C218-4459-AFA8-B987300B65CC}\stubpath = "C:\\Windows\\{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe"	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B18E63C8-13E0-40b0-9A32-39A445922BFB}\stubpath = "C:\\Windows\\{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe"	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C9BEF63-C218-4459-AFA8-B987300B65CC}	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7201B64A-1296-4477-B359-9A82BAB5DE6E}	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7201B64A-1296-4477-B359-9A82BAB5DE6E}\stubpath = "C:\\Windows\\{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe"	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}\stubpath = "C:\\Windows\\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe"	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}\stubpath = "C:\\Windows\\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe"	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFD30124-F097-40af-89AC-0D191D2FB0F3}	{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFD30124-F097-40af-89AC-0D191D2FB0F3}\stubpath = "C:\\Windows\\{BFD30124-F097-40af-89AC-0D191D2FB0F3}.exe"	{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}\stubpath = "C:\\Windows\\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe"	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}\stubpath = "C:\\Windows\\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe"	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7524DF52-6589-4ce1-BBB6-FA3053635450}	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16466435-065E-4c95-8429-AA4AE551F525}\stubpath = "C:\\Windows\\{16466435-065E-4c95-8429-AA4AE551F525}.exe"	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7524DF52-6589-4ce1-BBB6-FA3053635450}\stubpath = "C:\\Windows\\{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe"	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16466435-065E-4c95-8429-AA4AE551F525}	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B18E63C8-13E0-40b0-9A32-39A445922BFB}	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe

Executes dropped EXE 11 IoCs

pid	Process
4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe
3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe
4444	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe
2604	{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
File created	C:\Windows\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
File created	C:\Windows\{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
File created	C:\Windows\{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
File created	C:\Windows\{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe
File created	C:\Windows\{BFD30124-F097-40af-89AC-0D191D2FB0F3}.exe	{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe
File created	C:\Windows\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe
File created	C:\Windows\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
File created	C:\Windows\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe
File created	C:\Windows\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
File created	C:\Windows\{16466435-065E-4c95-8429-AA4AE551F525}.exe	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
File created	C:\Windows\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe	{16466435-065E-4c95-8429-AA4AE551F525}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
Token: SeIncBasePriorityPrivilege	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
Token: SeIncBasePriorityPrivilege	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
Token: SeIncBasePriorityPrivilege	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe
Token: SeIncBasePriorityPrivilege	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
Token: SeIncBasePriorityPrivilege	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
Token: SeIncBasePriorityPrivilege	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
Token: SeIncBasePriorityPrivilege	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
Token: SeIncBasePriorityPrivilege	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe
Token: SeIncBasePriorityPrivilege	4444	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4584	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe	104
PID 3688 wrote to memory of 4584	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe	104
PID 3688 wrote to memory of 4584	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe	104
PID 3688 wrote to memory of 1628	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe	105
PID 3688 wrote to memory of 1628	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe	105
PID 3688 wrote to memory of 1628	3688	2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe	105
PID 4584 wrote to memory of 3416	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	108
PID 4584 wrote to memory of 3416	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	108
PID 4584 wrote to memory of 3416	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	108
PID 4584 wrote to memory of 2896	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	109
PID 4584 wrote to memory of 2896	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	109
PID 4584 wrote to memory of 2896	4584	{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe	109
PID 3416 wrote to memory of 1504	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	112
PID 3416 wrote to memory of 1504	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	112
PID 3416 wrote to memory of 1504	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	112
PID 3416 wrote to memory of 2940	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	113
PID 3416 wrote to memory of 2940	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	113
PID 3416 wrote to memory of 2940	3416	{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe	113
PID 1504 wrote to memory of 464	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	116
PID 1504 wrote to memory of 464	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	116
PID 1504 wrote to memory of 464	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	116
PID 1504 wrote to memory of 2584	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	117
PID 1504 wrote to memory of 2584	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	117
PID 1504 wrote to memory of 2584	1504	{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe	117
PID 464 wrote to memory of 3460	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	118
PID 464 wrote to memory of 3460	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	118
PID 464 wrote to memory of 3460	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	118
PID 464 wrote to memory of 2188	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	119
PID 464 wrote to memory of 2188	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	119
PID 464 wrote to memory of 2188	464	{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe	119
PID 3460 wrote to memory of 2628	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	120
PID 3460 wrote to memory of 2628	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	120
PID 3460 wrote to memory of 2628	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	120
PID 3460 wrote to memory of 3660	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	121
PID 3460 wrote to memory of 3660	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	121
PID 3460 wrote to memory of 3660	3460	{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe	121
PID 2628 wrote to memory of 2304	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	125
PID 2628 wrote to memory of 2304	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	125
PID 2628 wrote to memory of 2304	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	125
PID 2628 wrote to memory of 536	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	126
PID 2628 wrote to memory of 536	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	126
PID 2628 wrote to memory of 536	2628	{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe	126
PID 2304 wrote to memory of 4864	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	127
PID 2304 wrote to memory of 4864	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	127
PID 2304 wrote to memory of 4864	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	127
PID 2304 wrote to memory of 3532	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	128
PID 2304 wrote to memory of 3532	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	128
PID 2304 wrote to memory of 3532	2304	{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe	128
PID 4864 wrote to memory of 2792	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	129
PID 4864 wrote to memory of 2792	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	129
PID 4864 wrote to memory of 2792	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	129
PID 4864 wrote to memory of 4140	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	130
PID 4864 wrote to memory of 4140	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	130
PID 4864 wrote to memory of 4140	4864	{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe	130
PID 2792 wrote to memory of 4444	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe	139
PID 2792 wrote to memory of 4444	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe	139
PID 2792 wrote to memory of 4444	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe	139
PID 2792 wrote to memory of 3340	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe	140
PID 2792 wrote to memory of 3340	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe	140
PID 2792 wrote to memory of 3340	2792	{16466435-065E-4c95-8429-AA4AE551F525}.exe	140
PID 4444 wrote to memory of 2604	4444	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe	141
PID 4444 wrote to memory of 2604	4444	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe	141
PID 4444 wrote to memory of 2604	4444	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe	141
PID 4444 wrote to memory of 3184	4444	{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe	142

C:\Users\Admin\AppData\Local\Temp\2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_cc5a1c532eb5a0ccb25653297c2444f5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
  C:\Windows\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
    C:\Windows\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
      C:\Windows\{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe
        
        C:\Windows\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:464
      - C:\Windows\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
        
        C:\Windows\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
        
        C:\Windows\{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
        
        C:\Windows\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
        
        C:\Windows\{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\{16466435-065E-4c95-8429-AA4AE551F525}.exe
        
        C:\Windows\{16466435-065E-4c95-8429-AA4AE551F525}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe
        
        C:\Windows\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe
        
        C:\Windows\{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7CEF~1.EXE > nul
        12⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16466~1.EXE > nul
        11⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7524D~1.EXE > nul
        10⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3BB1~1.EXE > nul
        9⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C9BE~1.EXE > nul
        8⤵
        
        PID:536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42FF7~1.EXE > nul
        7⤵
        
        PID:3660
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{61B2E~1.EXE > nul
        6⤵
        
        PID:2188
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B18E6~1.EXE > nul
        5⤵
        
        PID:2584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BBF19~1.EXE > nul
      4⤵
      PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9D8CB~1.EXE > nul
    3⤵
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{16466435-065E-4c95-8429-AA4AE551F525}.exe

Filesize
168KB

MD5
89cae170294038c4de6cf8f94b0e0d03

SHA1
db0bfcf33e3d14d29658ce35f4e4ca39a3a98f92

SHA256
5420f6f0ba7bb2abdff30110eb14da74ae653c96403e98bcfb7842bb336401b6

SHA512
fa98377c2081cdb3b839e6f881f564350f4b6a64072207660fd143c9aa2add45a9ed0e5c6a27620bb51dc1a0ae90ce833b55dc5bf71323618d909040fb9bc703

Download Submit
C:\Windows\{42FF78EC-0D6C-4176-AC07-2F3E84BE1371}.exe

Filesize
168KB

MD5
92278ab3870207bb624d8e6f2eb08cfc

SHA1
e1849ff7aa521b96635cae3712467f3fd0e03343

SHA256
5c8a7279f77f0ed8e25cf577edba540762181f6d778977ad1cbf9d363a762c98

SHA512
d31993011c09a3cc7d42b78bc4e74a286eb0aa462d0e321a66607bd64e04c04b8853f94819a03291dff3ffd99a2fe30160f4cf96ec9fbc5a8c44aed2fd9fefb4

Download Submit
C:\Windows\{61B2ED1D-EFBC-4116-B6BE-C8477E61F163}.exe

Filesize
168KB

MD5
7770eaddcabe771568caeb8f2b7daa19

SHA1
d9d1794c30b2757ed98527e603e1afa10e33808a

SHA256
d1d8d9e8fe885889029cbe10117e651ff19914e631dc7beb663edfd08346713a

SHA512
44b7071c3aeaa03e334609b036478ab3df9b7a396b6e099a7e9257da1e917240ae1f9ccc31ab320baa073babefe26145fef478eada4b59a491c67d89c1f88625

Download Submit
C:\Windows\{7201B64A-1296-4477-B359-9A82BAB5DE6E}.exe

Filesize
168KB

MD5
5fcebeb99e042c6d512b603f025cb406

SHA1
aebc30c9e0a2889eb3aa4f953bd7478352254377

SHA256
7ce5cbd5ebea5f5ba4e433c50013ab8c531fe99dbe91cdedc0aa8ca606c02c1d

SHA512
60d68707e4c504772ea36d4c156ebdc60c1a73ceb53e55cca2bd5998f61f039f5d3f383f5f25116aeac07018bc3a97ec629ae157408268d3587318e38f1c8ef5

Download Submit
C:\Windows\{7524DF52-6589-4ce1-BBB6-FA3053635450}.exe

Filesize
168KB

MD5
ba66932833bd3b9dbf63a49115f98203

SHA1
3cc791176db18cc0c38851084b852ba8aa3ed48a

SHA256
372531f44aa870601be4721a69b2e7880321d77594ac543fc405117c1057c70c

SHA512
cedd4bc58ac06d1fbfaeeedf671740eaa475fdd36d6aafb7ec1965e037ea997c3222f51f6f3d5b6505e28eebd426ba8d56b4bb257f4bad90fb74335fb90cd89e

Download Submit
C:\Windows\{7C9BEF63-C218-4459-AFA8-B987300B65CC}.exe

Filesize
168KB

MD5
7bd84514d1d0d25e3c9bb8e252277977

SHA1
e7c573d101965fc9733e71a49848d57b906b8553

SHA256
3197cefbbd0a299ecde65be259bf63376e31c13b43143ab7a18feacda573f608

SHA512
04c61f23ede5cf1d1b2bc67bcfbfc485f82243340f01cab9769d5e0ac81a71c53f6a3c2bef2bc8f89e83fddb527c11d87ec6a4abb25d03720c66c5b6010e818c

Download Submit
C:\Windows\{9D8CB081-B11A-4cde-8AB2-1C428FE99D5E}.exe

Filesize
168KB

MD5
a5cd4f38633d5997265fe951fcb9f331

SHA1
a8327aef2fd7de8ee482cf42af6c352037086ea6

SHA256
6dd37b77be8e151a778487b1974a0da03a77126c39873656318007b157df14ec

SHA512
6fb26dabef762e096fde960d8977b807db2013897ac5a47ff392b79c51f468027091c695cd989bdf941217f3a8588ff4555259eaeb1746de408bef0306c2b70e

Download Submit
C:\Windows\{B18E63C8-13E0-40b0-9A32-39A445922BFB}.exe

Filesize
168KB

MD5
2305c3ab4e09e4d4c8a291ea18596c46

SHA1
d83e910cc560b57b29420f084b2dc148528291c1

SHA256
9447984e66bd49ca72269687343a68765aea544c426553e2d82f450cfba1a1af

SHA512
1baad5b6ac75c7192537e2e3aef4d31d267c8fcd1ec687cf4856381d67c7bd11821f50a2e7a7d7375d4b2b0c136e29588a1a853328bf0b800373ddb0b8ed7177

Download Submit
C:\Windows\{BBF1956D-B7AE-4e7c-84F4-CB1299B43CCC}.exe

Filesize
168KB

MD5
1900c7c5ba213ae3815405c6f03c6d89

SHA1
1f019ac05816fab2f9111fddfe078119ebf2e04e

SHA256
b16e0927438f505b6f67d2cb642731d3559ec8a452727b02cbc689f18381e6fd

SHA512
a0e7eb6c7d98caecf7a9a0e918191cedc9a69c24cc92bc18f10c9c9fc40cf6403fad778bbae0faf9cbeaedb2b09b3e8e57a7b661bbf4e4681b8f3d7a5c233562

Download Submit
C:\Windows\{C3BB1EA5-CE51-4a57-9AB9-2689839FC124}.exe

Filesize
168KB

MD5
bfd7a5974093e3c4961d287e36daaea3

SHA1
4d9a92a98e9d48a53398bacef7f11056ef65b6cf

SHA256
422bbce095d2947bba6876cec942db0e3cacf7a038ffd47d440da15ca94a11a4

SHA512
4b5146153ee4cc6549b9b9b0526400b7965e832b3a87226891ba0f19c2d75f4261c39fe7552448d6918aab29ff8dcad9942faba58368d2518ae27463647e1a05

Download Submit
C:\Windows\{C7CEF30D-CE4A-4ad2-BE1A-30943B42883B}.exe

Filesize
168KB

MD5
423f8fd0b824f2ab2f18e1e0687de46b

SHA1
b0a6bd6ea5e4fcbce863d0e60d3dc20ae73c2126

SHA256
49cb9836bfd7d94aecb71dabe76174044fa7ebc5e3a1d8dc6ef352cc1223c35b

SHA512
f370a6b34b2b124dc0b3d7ece9f3a0ae4379512dc3f1e0c2a9aea7f7a0c0bb3cb6034e3b8a43d156cd2af614785ab6ffa2afe24c6f100b24c6def4ae10a811e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads