228ecdbf8f8b327f6b27cf8dba3b1a2d580438cd205550417bfbb3dc6a9d53f4

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Size

216KB
MD5

6c1a6ed33785a1700d85fa0f682e6f36
SHA1

e5ac21c4c10e2f6486f666f6f63cb3503d9f2e77
SHA256

228ecdbf8f8b327f6b27cf8dba3b1a2d580438cd205550417bfbb3dc6a9d53f4
SHA512

8c8094cd37d194e69fcad58121f6055b7d2884e2449bc19ad82a9cdf7200871690f4f4e3c9cfc253e5bb4a2defc6c03543efe7adc6c0c4e80f8ba9523aa65344
SSDEEP

3072:jEGh0ofl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGNlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002311e-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023237-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002323d-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023252-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023261-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002313d-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023355-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002313d-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001e4f2-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000233c0-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001e4f2-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233c0-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E1B451A-FF21-48de-B0E2-85F08F37F544}	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}\stubpath = "C:\\Windows\\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe"	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53B05D9B-312D-4c18-93DB-18F99CA445A4}	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6247EE66-989C-4afe-9AF0-081938D18769}	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}	{6247EE66-989C-4afe-9AF0-081938D18769}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC58D3A5-DCF3-4a27-8924-546C315A5969}\stubpath = "C:\\Windows\\{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe"	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}\stubpath = "C:\\Windows\\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe"	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}\stubpath = "C:\\Windows\\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe"	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53B05D9B-312D-4c18-93DB-18F99CA445A4}\stubpath = "C:\\Windows\\{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe"	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6247EE66-989C-4afe-9AF0-081938D18769}\stubpath = "C:\\Windows\\{6247EE66-989C-4afe-9AF0-081938D18769}.exe"	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}	{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78AEFA27-74D3-4060-B409-F50249719EB1}	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78AEFA27-74D3-4060-B409-F50249719EB1}\stubpath = "C:\\Windows\\{78AEFA27-74D3-4060-B409-F50249719EB1}.exe"	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{585826DB-A835-4d08-8F4B-4FA03E61F45E}	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{585826DB-A835-4d08-8F4B-4FA03E61F45E}\stubpath = "C:\\Windows\\{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe"	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}\stubpath = "C:\\Windows\\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}.exe"	{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E1B451A-FF21-48de-B0E2-85F08F37F544}\stubpath = "C:\\Windows\\{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe"	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC58D3A5-DCF3-4a27-8924-546C315A5969}	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}\stubpath = "C:\\Windows\\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe"	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}\stubpath = "C:\\Windows\\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe"	{6247EE66-989C-4afe-9AF0-081938D18769}.exe

Executes dropped EXE 12 IoCs

pid	Process
5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
660	{6247EE66-989C-4afe-9AF0-081938D18769}.exe
312	{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe
4900	{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
File created	C:\Windows\{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
File created	C:\Windows\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
File created	C:\Windows\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
File created	C:\Windows\{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
File created	C:\Windows\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}.exe	{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe
File created	C:\Windows\{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
File created	C:\Windows\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
File created	C:\Windows\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
File created	C:\Windows\{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
File created	C:\Windows\{6247EE66-989C-4afe-9AF0-081938D18769}.exe	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
File created	C:\Windows\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe	{6247EE66-989C-4afe-9AF0-081938D18769}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
Token: SeIncBasePriorityPrivilege	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
Token: SeIncBasePriorityPrivilege	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
Token: SeIncBasePriorityPrivilege	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
Token: SeIncBasePriorityPrivilege	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
Token: SeIncBasePriorityPrivilege	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
Token: SeIncBasePriorityPrivilege	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
Token: SeIncBasePriorityPrivilege	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
Token: SeIncBasePriorityPrivilege	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
Token: SeIncBasePriorityPrivilege	660	{6247EE66-989C-4afe-9AF0-081938D18769}.exe
Token: SeIncBasePriorityPrivilege	312	{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 5004	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	92
PID 2692 wrote to memory of 5004	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	92
PID 2692 wrote to memory of 5004	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	92
PID 2692 wrote to memory of 1548	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	93
PID 2692 wrote to memory of 1548	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	93
PID 2692 wrote to memory of 1548	2692	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	93
PID 5004 wrote to memory of 2000	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	99
PID 5004 wrote to memory of 2000	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	99
PID 5004 wrote to memory of 2000	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	99
PID 5004 wrote to memory of 4736	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	100
PID 5004 wrote to memory of 4736	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	100
PID 5004 wrote to memory of 4736	5004	{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe	100
PID 2000 wrote to memory of 4188	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	102
PID 2000 wrote to memory of 4188	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	102
PID 2000 wrote to memory of 4188	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	102
PID 2000 wrote to memory of 1552	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	103
PID 2000 wrote to memory of 1552	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	103
PID 2000 wrote to memory of 1552	2000	{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe	103
PID 4188 wrote to memory of 1516	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	107
PID 4188 wrote to memory of 1516	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	107
PID 4188 wrote to memory of 1516	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	107
PID 4188 wrote to memory of 5052	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	108
PID 4188 wrote to memory of 5052	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	108
PID 4188 wrote to memory of 5052	4188	{78AEFA27-74D3-4060-B409-F50249719EB1}.exe	108
PID 1516 wrote to memory of 3504	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	111
PID 1516 wrote to memory of 3504	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	111
PID 1516 wrote to memory of 3504	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	111
PID 1516 wrote to memory of 2228	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	112
PID 1516 wrote to memory of 2228	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	112
PID 1516 wrote to memory of 2228	1516	{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe	112
PID 3504 wrote to memory of 2724	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	117
PID 3504 wrote to memory of 2724	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	117
PID 3504 wrote to memory of 2724	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	117
PID 3504 wrote to memory of 3884	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	118
PID 3504 wrote to memory of 3884	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	118
PID 3504 wrote to memory of 3884	3504	{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe	118
PID 2724 wrote to memory of 3424	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	120
PID 2724 wrote to memory of 3424	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	120
PID 2724 wrote to memory of 3424	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	120
PID 2724 wrote to memory of 4760	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	121
PID 2724 wrote to memory of 4760	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	121
PID 2724 wrote to memory of 4760	2724	{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe	121
PID 3424 wrote to memory of 1524	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	122
PID 3424 wrote to memory of 1524	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	122
PID 3424 wrote to memory of 1524	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	122
PID 3424 wrote to memory of 3796	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	123
PID 3424 wrote to memory of 3796	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	123
PID 3424 wrote to memory of 3796	3424	{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe	123
PID 1524 wrote to memory of 1148	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	124
PID 1524 wrote to memory of 1148	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	124
PID 1524 wrote to memory of 1148	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	124
PID 1524 wrote to memory of 992	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	125
PID 1524 wrote to memory of 992	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	125
PID 1524 wrote to memory of 992	1524	{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe	125
PID 1148 wrote to memory of 660	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	126
PID 1148 wrote to memory of 660	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	126
PID 1148 wrote to memory of 660	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	126
PID 1148 wrote to memory of 4580	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	127
PID 1148 wrote to memory of 4580	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	127
PID 1148 wrote to memory of 4580	1148	{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe	127
PID 660 wrote to memory of 312	660	{6247EE66-989C-4afe-9AF0-081938D18769}.exe	128
PID 660 wrote to memory of 312	660	{6247EE66-989C-4afe-9AF0-081938D18769}.exe	128
PID 660 wrote to memory of 312	660	{6247EE66-989C-4afe-9AF0-081938D18769}.exe	128
PID 660 wrote to memory of 4832	660	{6247EE66-989C-4afe-9AF0-081938D18769}.exe	129

C:\Users\Admin\AppData\Local\Temp\2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
  C:\Windows\{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
    C:\Windows\{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
      C:\Windows\{78AEFA27-74D3-4060-B409-F50249719EB1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Windows\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
        
        C:\Windows\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1516
      - C:\Windows\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
        
        C:\Windows\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
        
        C:\Windows\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
        
        C:\Windows\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
        
        C:\Windows\{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
        
        C:\Windows\{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\{6247EE66-989C-4afe-9AF0-081938D18769}.exe
        
        C:\Windows\{6247EE66-989C-4afe-9AF0-081938D18769}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:660
        
        C:\Windows\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe
        
        C:\Windows\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:312
        
        C:\Windows\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}.exe
        
        C:\Windows\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}.exe
        13⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DFFD9~1.EXE > nul
        13⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6247E~1.EXE > nul
        12⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53B05~1.EXE > nul
        11⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58582~1.EXE > nul
        10⤵
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{57F0C~1.EXE > nul
        9⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CB27~1.EXE > nul
        8⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2049E~1.EXE > nul
        7⤵
        
        PID:3884
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EB69E~1.EXE > nul
        6⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{78AEF~1.EXE > nul
        5⤵
        
        PID:5052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BC58D~1.EXE > nul
      4⤵
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7E1B4~1.EXE > nul
    3⤵
    PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2049E0E8-4DA3-4262-98E9-E93969CDF38A}.exe

Filesize
216KB

MD5
7b2d538c958a008fee9e6bc8006156e7

SHA1
00dde254b8036d18d8c651ef729bc0efde527b6a

SHA256
8471a42157ff4f84b5baea8b95766c0e3f3244eecec3d435d7ff54bb53a282ba

SHA512
74ae1538abad4e9e739610d309eb873e7d274693ba735919ada1c6fcd3bb13db38630641d6e2f7e3d5346d96fbe0abc4d8a97e7bdf9596b005905e1752c47061

Download Submit
C:\Windows\{2F1F15BA-7A20-4e43-A8AB-E961DE04EE8B}.exe

Filesize
216KB

MD5
8c3518e8b7b8b5a1a67d1e5533225383

SHA1
bfb6dc5aef12e92c6ad653fbc13fc45c2aa46008

SHA256
c90f9c4f43f237e3d785aa53c9aa78c99198e05181fc09f360edbd06e2764fc0

SHA512
06e1677b9f6bf9b4164ec3091247229d6d72ffc8074945081eaf10ff4e92f3cf6ac5ae84b5d87d4c5e74709dc87a2024c58a7c1bbfaa7c8338300cbe2605326b

Download Submit
C:\Windows\{53B05D9B-312D-4c18-93DB-18F99CA445A4}.exe

Filesize
216KB

MD5
ecfa49d6c4f10dd03aad3d1a8c0f44fb

SHA1
97a54eff1a82499cb40dd1b0ff3481daa26d5118

SHA256
0180b1ba17870022e21ef6149f7870ccaeac800d1af5c75f00d0a39a5c5868b3

SHA512
eef331472d7c7819098d5192ca6920371a4273e3a6c0296419b77ae83e32abd0474cf68a4b307038133a6789b50056ab53955b222c0c20f2bf729a645c5c8386

Download Submit
C:\Windows\{57F0C4D4-C738-43d8-B6E5-7C6E76CE7697}.exe

Filesize
216KB

MD5
6d8221dfaad84af4556010d3b35dfa01

SHA1
5e27aff01e94e1c3ef47e2dc9f81d5241a667780

SHA256
32756e9aca82e17404c96ae1bdd415f078788956bd3e46ee235df4b63f67c612

SHA512
a013645b0d3678c32094d587bb750fe080a65c86dbf52915ea664662402bd79fcc2d6022c2f95d1847331e933432bf7e06ebd1ecd83cc9d846aed83504bb4096

Download Submit
C:\Windows\{585826DB-A835-4d08-8F4B-4FA03E61F45E}.exe

Filesize
216KB

MD5
0736917f14b2998657e7230f2e89801b

SHA1
dd4e92778becba6bf410acdf37bfc274285bac0e

SHA256
470d72f727d61f86e7491d43e256f68202e6701b09d23a34753c1fcfaab80504

SHA512
cc1f16874c1979472e8e11c92b00708ea3758f8b09020079f460e7f662d6d9b2d124eee6b023294b0ed2fa7c7b57f1ed83fd0640c2c182a8745e74fcd72cf89f

Download Submit
C:\Windows\{6247EE66-989C-4afe-9AF0-081938D18769}.exe

Filesize
216KB

MD5
a4a8649aac41590da31964f4f7ca42b0

SHA1
dabf24f9b37a208470ace84e11c439fd01ce01cf

SHA256
f627fca640063f59c838077bdc719a5a80c1120e8097a2f46abc6b67ec92420a

SHA512
d71fba721baf2da003aa3b121ce8072e5dbe50c07a62b378d781be7340bb190314ce2774f0c924c241cc705ef4b44087d90b5da5567e995837c94be6f6eff453

Download Submit
C:\Windows\{6CB27413-42E5-42d7-ACAF-70EFA95924E4}.exe

Filesize
216KB

MD5
3bf345b51f0b781cbef65d04ddf78c30

SHA1
cb9663e2f359804e12a5b2dd34e9a0df3cc27e4d

SHA256
2834c515194ee6e5af6aeb178edb64f3175608ce4fc77a7a9ae8caaff671cf34

SHA512
656fcd7389fdfef0b604b4b47a6ea0b4bc02f66fac85ad39802ad9140d3f23dae7a52e14194cfc723db56e10e63d22ccc345e638da33e9968824564652270908

Download Submit
C:\Windows\{78AEFA27-74D3-4060-B409-F50249719EB1}.exe

Filesize
216KB

MD5
1d4c2e324d6af60d8959ebb33181f799

SHA1
092156f437e29deb78e0730b5556bee78fc7f044

SHA256
fd473cd5bba05246934ad15d15570314b3ade148a65530c7529456f584c8fa0b

SHA512
8bdc977d21643f14ab8c381bd8d1d58a39d529414d0ff9405030de03bc626e77361de010a3a454ef810ba5777c46953e9f1a8bb5dff202b11626c76db0759cc0

Download Submit
C:\Windows\{7E1B451A-FF21-48de-B0E2-85F08F37F544}.exe

Filesize
216KB

MD5
eefd9365a2ab0367ab35f26caf5d6580

SHA1
e0dee92dfea644ca3668b0e4ca18197c56816a67

SHA256
e18e424cd4a3efba101ad48b2fe0249e404773fb8ccd5bbc85909ce7640f774a

SHA512
49b24d0c046d4411f9b1fcc4b814a8f0c812337f71eb47b700fd338f26a47b6eeefe75e87fec8f226468a7de61e255c2da412c7ce666a5c36ca7bd95c68cc33a

Download Submit
C:\Windows\{BC58D3A5-DCF3-4a27-8924-546C315A5969}.exe

Filesize
216KB

MD5
be2daa75c190bcfba3455cd4d1c44047

SHA1
b2132675c065ce047d4b9ba38dcd08f9d9000b8b

SHA256
d4bb52ecd27b083ca103f13499a31b52b827b8479384729f296eb5936abbcc2c

SHA512
92c80c016769e374bf85ce8ade662f358584d66114feebb84ffd145f9ca2a4d41ae522edc7ad830e4041eabda768621b93949472af675f80d7163b7f2f304706

Download Submit
C:\Windows\{DFFD98CF-3046-4b32-B4BD-652F25C0C564}.exe

Filesize
216KB

MD5
552de0afcd89df15314f3a44d6469a8b

SHA1
04a6d7ac1ae4a4ec24e220711954c1058578e0b2

SHA256
e3d87912b5f5e31e2bcfacc35234ab6b611e69f6b1225b4f26f8ef00da07986f

SHA512
674657e07d2c77ccdf295872525c1053c896766359cab121cebb901e111d50fae639496855b91a0480345e768266334489333754d303fece741cd765be36b44c

Download Submit
C:\Windows\{EB69EC68-0F1A-4515-9BDB-AACC33289DEB}.exe

Filesize
216KB

MD5
dddf67b91d434afad23c9864971a914f

SHA1
d794d77dfcf4ba542a2dd7d308b6b75f7d1cbafb

SHA256
2b7fef4d8638a60db606e321bafb2520b9019ccb95d9c2b69e0cb62c45925935

SHA512
b9f80ddd6c9dd02b93ea1a7814dd54da42aaeba1ee8fa7a958e3f22152b530b4efb07845a676a33d7f7459b75c6d465ab94f6874a4b6e5b268ed647816d794b4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads