916dc0627aa66dd412406916060575bbb6edd10d6bf591ac2974372b2620dfae

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe
Size

180KB
MD5

5882a0b3a771c5512778086a71308eef
SHA1

30f3fa1293c814fed5ec7ea37deb47382aed5aa2
SHA256

916dc0627aa66dd412406916060575bbb6edd10d6bf591ac2974372b2620dfae
SHA512

83f1933ceb0c46c3dcfde88e698ce138fba0205f8c8dfc7d05bd383b688cc8812ec025a1cf8bca24fb6e0d995a725fd080781007c0bd57ee15fd5ffbdb781f71
SSDEEP

3072:jEGh0ovlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGNl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000b00000002311c-1.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00110000000231fe-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023207-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023208-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023212-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023220-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002331e-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001e30d-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001db7d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001db1f-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023138-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002339f-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DE36CE5-3301-4815-B926-278B24B461DA}	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DE36CE5-3301-4815-B926-278B24B461DA}\stubpath = "C:\\Windows\\{7DE36CE5-3301-4815-B926-278B24B461DA}.exe"	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}\stubpath = "C:\\Windows\\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe"	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A6A10CD-9A89-440f-9199-B86864564759}\stubpath = "C:\\Windows\\{6A6A10CD-9A89-440f-9199-B86864564759}.exe"	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA120540-3634-4e13-9224-5A0DA6411389}\stubpath = "C:\\Windows\\{AA120540-3634-4e13-9224-5A0DA6411389}.exe"	{6A6A10CD-9A89-440f-9199-B86864564759}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E498D7F-05C3-43a1-9BC2-E495B6878557}\stubpath = "C:\\Windows\\{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe"	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{999F24CF-7D5F-4aff-9678-029597B64526}\stubpath = "C:\\Windows\\{999F24CF-7D5F-4aff-9678-029597B64526}.exe"	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}\stubpath = "C:\\Windows\\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe"	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A6A10CD-9A89-440f-9199-B86864564759}	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}\stubpath = "C:\\Windows\\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}.exe"	{AA120540-3634-4e13-9224-5A0DA6411389}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA120540-3634-4e13-9224-5A0DA6411389}	{6A6A10CD-9A89-440f-9199-B86864564759}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{999F24CF-7D5F-4aff-9678-029597B64526}	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}	{999F24CF-7D5F-4aff-9678-029597B64526}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}\stubpath = "C:\\Windows\\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe"	{999F24CF-7D5F-4aff-9678-029597B64526}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38388C94-D163-4f53-B5A4-524B619BE51C}\stubpath = "C:\\Windows\\{38388C94-D163-4f53-B5A4-524B619BE51C}.exe"	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}	{AA120540-3634-4e13-9224-5A0DA6411389}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E498D7F-05C3-43a1-9BC2-E495B6878557}	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}\stubpath = "C:\\Windows\\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe"	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}\stubpath = "C:\\Windows\\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe"	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38388C94-D163-4f53-B5A4-524B619BE51C}	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe

Executes dropped EXE 12 IoCs

pid	Process
3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe
2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe
1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
3328	{6A6A10CD-9A89-440f-9199-B86864564759}.exe
3932	{AA120540-3634-4e13-9224-5A0DA6411389}.exe
2120	{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
File created	C:\Windows\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
File created	C:\Windows\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
File created	C:\Windows\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
File created	C:\Windows\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}.exe	{AA120540-3634-4e13-9224-5A0DA6411389}.exe
File created	C:\Windows\{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe
File created	C:\Windows\{999F24CF-7D5F-4aff-9678-029597B64526}.exe	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
File created	C:\Windows\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	{999F24CF-7D5F-4aff-9678-029597B64526}.exe
File created	C:\Windows\{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
File created	C:\Windows\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe
File created	C:\Windows\{6A6A10CD-9A89-440f-9199-B86864564759}.exe	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
File created	C:\Windows\{AA120540-3634-4e13-9224-5A0DA6411389}.exe	{6A6A10CD-9A89-440f-9199-B86864564759}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
Token: SeIncBasePriorityPrivilege	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
Token: SeIncBasePriorityPrivilege	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
Token: SeIncBasePriorityPrivilege	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe
Token: SeIncBasePriorityPrivilege	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
Token: SeIncBasePriorityPrivilege	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
Token: SeIncBasePriorityPrivilege	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
Token: SeIncBasePriorityPrivilege	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe
Token: SeIncBasePriorityPrivilege	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
Token: SeIncBasePriorityPrivilege	3328	{6A6A10CD-9A89-440f-9199-B86864564759}.exe
Token: SeIncBasePriorityPrivilege	3932	{AA120540-3634-4e13-9224-5A0DA6411389}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3308	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe	100
PID 1948 wrote to memory of 3308	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe	100
PID 1948 wrote to memory of 3308	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe	100
PID 1948 wrote to memory of 388	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe	101
PID 1948 wrote to memory of 388	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe	101
PID 1948 wrote to memory of 388	1948	2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe	101
PID 3308 wrote to memory of 4080	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	102
PID 3308 wrote to memory of 4080	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	102
PID 3308 wrote to memory of 4080	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	102
PID 3308 wrote to memory of 2008	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	103
PID 3308 wrote to memory of 2008	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	103
PID 3308 wrote to memory of 2008	3308	{7DE36CE5-3301-4815-B926-278B24B461DA}.exe	103
PID 4080 wrote to memory of 112	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	106
PID 4080 wrote to memory of 112	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	106
PID 4080 wrote to memory of 112	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	106
PID 4080 wrote to memory of 4832	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	107
PID 4080 wrote to memory of 4832	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	107
PID 4080 wrote to memory of 4832	4080	{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe	107
PID 112 wrote to memory of 2292	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	108
PID 112 wrote to memory of 2292	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	108
PID 112 wrote to memory of 2292	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	108
PID 112 wrote to memory of 1532	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	109
PID 112 wrote to memory of 1532	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	109
PID 112 wrote to memory of 1532	112	{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe	109
PID 2292 wrote to memory of 2144	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe	110
PID 2292 wrote to memory of 2144	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe	110
PID 2292 wrote to memory of 2144	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe	110
PID 2292 wrote to memory of 2816	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe	111
PID 2292 wrote to memory of 2816	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe	111
PID 2292 wrote to memory of 2816	2292	{999F24CF-7D5F-4aff-9678-029597B64526}.exe	111
PID 2144 wrote to memory of 3332	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	114
PID 2144 wrote to memory of 3332	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	114
PID 2144 wrote to memory of 3332	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	114
PID 2144 wrote to memory of 676	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	115
PID 2144 wrote to memory of 676	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	115
PID 2144 wrote to memory of 676	2144	{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe	115
PID 3332 wrote to memory of 1772	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	116
PID 3332 wrote to memory of 1772	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	116
PID 3332 wrote to memory of 1772	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	116
PID 3332 wrote to memory of 3932	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	117
PID 3332 wrote to memory of 3932	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	117
PID 3332 wrote to memory of 3932	3332	{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe	117
PID 1772 wrote to memory of 4944	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	118
PID 1772 wrote to memory of 4944	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	118
PID 1772 wrote to memory of 4944	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	118
PID 1772 wrote to memory of 736	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	119
PID 1772 wrote to memory of 736	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	119
PID 1772 wrote to memory of 736	1772	{38388C94-D163-4f53-B5A4-524B619BE51C}.exe	119
PID 4944 wrote to memory of 1560	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	124
PID 4944 wrote to memory of 1560	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	124
PID 4944 wrote to memory of 1560	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	124
PID 4944 wrote to memory of 5112	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	125
PID 4944 wrote to memory of 5112	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	125
PID 4944 wrote to memory of 5112	4944	{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe	125
PID 1560 wrote to memory of 3328	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	131
PID 1560 wrote to memory of 3328	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	131
PID 1560 wrote to memory of 3328	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	131
PID 1560 wrote to memory of 3532	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	132
PID 1560 wrote to memory of 3532	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	132
PID 1560 wrote to memory of 3532	1560	{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe	132
PID 3328 wrote to memory of 3932	3328	{6A6A10CD-9A89-440f-9199-B86864564759}.exe	133
PID 3328 wrote to memory of 3932	3328	{6A6A10CD-9A89-440f-9199-B86864564759}.exe	133
PID 3328 wrote to memory of 3932	3328	{6A6A10CD-9A89-440f-9199-B86864564759}.exe	133
PID 3328 wrote to memory of 3520	3328	{6A6A10CD-9A89-440f-9199-B86864564759}.exe	134

C:\Users\Admin\AppData\Local\Temp\2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_5882a0b3a771c5512778086a71308eef_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
  C:\Windows\{7DE36CE5-3301-4815-B926-278B24B461DA}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
    C:\Windows\{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
      C:\Windows\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:112
    - - C:\Windows\{999F24CF-7D5F-4aff-9678-029597B64526}.exe
        
        C:\Windows\{999F24CF-7D5F-4aff-9678-029597B64526}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
        
        C:\Windows\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
        
        C:\Windows\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
        
        C:\Windows\{38388C94-D163-4f53-B5A4-524B619BE51C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe
        
        C:\Windows\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
        
        C:\Windows\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\{6A6A10CD-9A89-440f-9199-B86864564759}.exe
        
        C:\Windows\{6A6A10CD-9A89-440f-9199-B86864564759}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\{AA120540-3634-4e13-9224-5A0DA6411389}.exe
        
        C:\Windows\{AA120540-3634-4e13-9224-5A0DA6411389}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Windows\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}.exe
        
        C:\Windows\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}.exe
        13⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AA120~1.EXE > nul
        13⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A6A1~1.EXE > nul
        12⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB644~1.EXE > nul
        11⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8694E~1.EXE > nul
        10⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{38388~1.EXE > nul
        9⤵
        
        PID:736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{29D40~1.EXE > nul
        8⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8A16~1.EXE > nul
        7⤵
        
        PID:676
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{999F2~1.EXE > nul
        6⤵
        
        PID:2816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3DFCE~1.EXE > nul
        5⤵
        
        PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2E498~1.EXE > nul
      4⤵
      PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7DE36~1.EXE > nul
    3⤵
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{29D40820-2138-46a4-8CEE-3FDF3E3E2D01}.exe

Filesize
180KB

MD5
26ecec6012a5432ec983784620c7b7df

SHA1
28d4e06f3d4c8a45cfbd4428b33f79ce15ec4f49

SHA256
df815d7e3b08f02eccf1c89a40b4f8dddcb4b988e64afd37459cea062b3f40ea

SHA512
6ae3e207a50abe8c626017a7adf3f58a86f8e975564d20c91442f88a9b21857f9166e4f348c8bb737c1618ba791eba732cee9f5b0677044d148e605594c8def4

Download Submit
C:\Windows\{2E498D7F-05C3-43a1-9BC2-E495B6878557}.exe

Filesize
180KB

MD5
2cba2533e070a0c410a420fc90e479f3

SHA1
f320cc60725343c1ec40a58a72f6b351dd8d524b

SHA256
ce36351f626bf8c1f5e2e2a1afc60dec03fde607baf3f0657d06b4e2b7ac0647

SHA512
bd7512717479424c7f695b745ac103c52b70fdd89994c0fdb8f621a63b6056fa4db5c33e556c42521d4692c841685f5bc261898246335c17f94a964b8b6f8eb1

Download Submit
C:\Windows\{38388C94-D163-4f53-B5A4-524B619BE51C}.exe

Filesize
180KB

MD5
6788eb477ff3e787d4c6a91d0423bd44

SHA1
0d1ac0151d6e358bdbfe3c493fa8a5a959cb1ae3

SHA256
30dfa9a21354daeac472b95590fb21aac1a531298209effc1824e4d32e340822

SHA512
ee39e213da7174a4e33c4537d4424a4aa73527d70b748e27b29ced09bc0bda5795eca9884106b6b6c871be3d120e6916b5feafbbab45e44531c4b7dc894f9301

Download Submit
C:\Windows\{3DFCE37E-C3FB-4d9a-BD5C-6F58AB1A0689}.exe

Filesize
180KB

MD5
40b47f588247ddc893501ef684e28490

SHA1
f449147e3790ec7fab0df1d1e361585ee7cc8927

SHA256
33ae40db9270b72ca8461191071955d1220b007f60b6e58167bf6868a5783b34

SHA512
d0e5c22ec2ad0c50eedf3a672ca3241b4690607f5ac0f72fb301415ddc0eea6eb67701efcbf8edbca4634a2c1c6d28f9135298e4100a5b78e046c1bb6e547799

Download Submit
C:\Windows\{51D92270-F8E9-41b8-A070-0FD3DA8D2FFA}.exe

Filesize
180KB

MD5
9cebb9b212e28f3836ffc1a808134fea

SHA1
9be43020465e45c83e4f119f700237cfdc97114d

SHA256
dbacd19fc1d744fb08c46580d1be220288d07a3ed0b66e18e0546196c3bd73a6

SHA512
4041f948f6f95e4dfd2a228f1f76c1aa6990fc16739f4956ef46444950512128825d21093e4ccb090154042959dbb8c68b84e12563d6c11251de8f74b4578168

Download Submit
C:\Windows\{6A6A10CD-9A89-440f-9199-B86864564759}.exe

Filesize
180KB

MD5
2c1c1629a9255a40356f2855c7c3d1f1

SHA1
b94d0c8f317f2621a1b6537cc8018d947bd82c5a

SHA256
3fed20bf0f6df3c4b035f6a0982e5eddaf670deac80b7cd5966ffb387a22c7f8

SHA512
cefcf7e0312c793d8bf58c63ea39b1af3cabe505acc77152b7398752a0159a265993b8f0cbedc7d7fd33d26eebd7bee8657c10df8071968fce31dcdd3d9b5922

Download Submit
C:\Windows\{7DE36CE5-3301-4815-B926-278B24B461DA}.exe

Filesize
180KB

MD5
42fe5d19d30447b946699523a967ae94

SHA1
6138d5207e953b1d65006ddec17a82bf5c284b76

SHA256
ab81564a1942a69fbbd1745493a43f8dff113d25895149e85ce302c52fc7401e

SHA512
b97be41f326ed5a3e2dde025f2c8dc8a5d8633e8e3e00eaa0ca6f9781388d0715212b8af02d9be62319feb1300f649b3942295d9a24b576fa8a6e369ecf7fe65

Download Submit
C:\Windows\{8694EDE8-9B28-41b9-AA3C-EEE3EA837A9A}.exe

Filesize
180KB

MD5
d6a3e26782c03568c6e5b0d80edc0588

SHA1
26779e7888d0671467606d0a3c9eeb2c4e6fa7a1

SHA256
e734702da21c0ca8b5a6521de7e7193984f48fb78b79fa684e4e6b76998bc8d1

SHA512
e859f5a28c5e869975ae2cd523b92cf3c8b0061b86d9a8c8337912abb8ced5cfd74c8f6c46c2522d08610f20075dad0ebffc51a864752b8685f506a9c8b5c891

Download Submit
C:\Windows\{999F24CF-7D5F-4aff-9678-029597B64526}.exe

Filesize
180KB

MD5
e7bc1de98fdfb383790b98f01b92e4e0

SHA1
98ced3fcf486146a3d258ba08024a92c9095fd4b

SHA256
e811e954fab0c55f8d88389347a75507e70d5380d9b7177a065e7c6957c5788e

SHA512
572ee285d29105ed582773e217fc0935da7955f0c86a217116eb604a643c6ea005c3733f4e61ba798f2463d8448ca784777b2986d6aa0d6e66c5ab77c2396631

Download Submit
C:\Windows\{AA120540-3634-4e13-9224-5A0DA6411389}.exe

Filesize
180KB

MD5
4ecf6056636ce73f9b5a255ef8eee182

SHA1
a40904fc5e25978fe49650d27b39f60d51bd0974

SHA256
9d77392a43906b9b7d37389e9759e7e7108d0369895489dd2b3029543e4c8caa

SHA512
577fe3768c7c8f2a8a25a472ca112413b771ce0332d4b99c55028b2b37a554382fa0c0f14aff0410ee24bf19b717157d083e01c2aff9bf95bb11fbe1deae29b9

Download Submit
C:\Windows\{BB644FDB-9057-4809-8950-0BC9D8ED1B98}.exe

Filesize
180KB

MD5
e16749e94efcf7d4853fe39ca34bedc2

SHA1
89378782e1dee9112bf4f3158b218276c453320f

SHA256
5a10c4162236873e6aa7463d33bcdc43835de454ddb272e24e18594c70ee5fad

SHA512
f0d06b83771b650334fc8f31cd4f63faf6e689286e22faea20bb65c18c649c714ebc1f6264dec75ed961a94d32bc25f20fa69fd0080e2b96d848a7c3b03f45c4

Download Submit
C:\Windows\{F8A167CC-2B43-4f51-AA1F-9E8ECBA9C257}.exe

Filesize
180KB

MD5
9176f2326feb42693f272d23e8d8a913

SHA1
91f2342f7603b45db50b74464450ddbea1178fd2

SHA256
13b0a6e13648302d0174488510bb2b37632dc92b6ee0e99ddc4365c7654e421d

SHA512
f4417a37b5eec68c404bfdf1c2d3759f79c190fd8f486a07a8050943e0506de01293ab94ac76ec286ea5d2bb342c4bafb1326ff67534e5757bac567771c7698e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads