854f200b2385a3f5c491f687f2fe5d195959265cc141e75ea01ad49952960c2d

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe
Size

408KB
MD5

81df15c866424e15b1bf5824337e491a
SHA1

569a78f826615dc7d9bafed3a4850e692a251f6b
SHA256

854f200b2385a3f5c491f687f2fe5d195959265cc141e75ea01ad49952960c2d
SHA512

ee0803eae01c01c45bf1584cc3c6215f2f4e7c0b65f0f2cb19f52be036cc0876b14e85dfa0aeb6c6fc4efa7a73def302e409527b5f2ce618147e5f15e9f0a388
SSDEEP

3072:CEGh0oLl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGVldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233ae-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000233af-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023433-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000233af-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023433-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000233af-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023433-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e0000000233af-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023433-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f0000000233af-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233b5-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00100000000233af-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}\stubpath = "C:\\Windows\\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe"	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{405AAFB6-0217-484b-8617-BDD887EF363A}	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97D6BECB-A933-47e6-9DA5-BF7499519964}\stubpath = "C:\\Windows\\{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe"	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7307DBBA-97E5-41d1-B16B-54747A59C21C}	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7307DBBA-97E5-41d1-B16B-54747A59C21C}\stubpath = "C:\\Windows\\{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe"	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}\stubpath = "C:\\Windows\\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe"	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0613E409-B784-4bd4-8BFE-B899E0D56847}\stubpath = "C:\\Windows\\{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe"	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}\stubpath = "C:\\Windows\\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe"	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}\stubpath = "C:\\Windows\\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe"	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C21E0878-8996-4ac5-809B-6E50AE797063}\stubpath = "C:\\Windows\\{C21E0878-8996-4ac5-809B-6E50AE797063}.exe"	{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97D6BECB-A933-47e6-9DA5-BF7499519964}	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0613E409-B784-4bd4-8BFE-B899E0D56847}	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}\stubpath = "C:\\Windows\\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe"	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B904B709-FEA8-4826-8CFB-ECCE69A64023}	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B01A8A54-1414-42d7-B677-47EEF22D6155}	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{405AAFB6-0217-484b-8617-BDD887EF363A}\stubpath = "C:\\Windows\\{405AAFB6-0217-484b-8617-BDD887EF363A}.exe"	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C21E0878-8996-4ac5-809B-6E50AE797063}	{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B904B709-FEA8-4826-8CFB-ECCE69A64023}\stubpath = "C:\\Windows\\{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe"	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B01A8A54-1414-42d7-B677-47EEF22D6155}\stubpath = "C:\\Windows\\{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe"	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe

Executes dropped EXE 12 IoCs

pid	Process
2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe
4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe
960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
1180	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
3944	{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe
3432	{C21E0878-8996-4ac5-809B-6E50AE797063}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
File created	C:\Windows\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
File created	C:\Windows\{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
File created	C:\Windows\{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
File created	C:\Windows\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe
File created	C:\Windows\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
File created	C:\Windows\{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
File created	C:\Windows\{C21E0878-8996-4ac5-809B-6E50AE797063}.exe	{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe
File created	C:\Windows\{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe
File created	C:\Windows\{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
File created	C:\Windows\{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
File created	C:\Windows\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
Token: SeIncBasePriorityPrivilege	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
Token: SeIncBasePriorityPrivilege	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
Token: SeIncBasePriorityPrivilege	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe
Token: SeIncBasePriorityPrivilege	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
Token: SeIncBasePriorityPrivilege	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe
Token: SeIncBasePriorityPrivilege	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
Token: SeIncBasePriorityPrivilege	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
Token: SeIncBasePriorityPrivilege	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
Token: SeIncBasePriorityPrivilege	1180	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
Token: SeIncBasePriorityPrivilege	3944	{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2180	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe	93
PID 3708 wrote to memory of 2180	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe	93
PID 3708 wrote to memory of 2180	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe	93
PID 3708 wrote to memory of 4360	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe	94
PID 3708 wrote to memory of 4360	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe	94
PID 3708 wrote to memory of 4360	3708	2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe	94
PID 2180 wrote to memory of 5068	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	95
PID 2180 wrote to memory of 5068	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	95
PID 2180 wrote to memory of 5068	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	95
PID 2180 wrote to memory of 4880	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	96
PID 2180 wrote to memory of 4880	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	96
PID 2180 wrote to memory of 4880	2180	{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe	96
PID 5068 wrote to memory of 2984	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	100
PID 5068 wrote to memory of 2984	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	100
PID 5068 wrote to memory of 2984	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	100
PID 5068 wrote to memory of 4188	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	101
PID 5068 wrote to memory of 4188	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	101
PID 5068 wrote to memory of 4188	5068	{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe	101
PID 2984 wrote to memory of 3152	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	102
PID 2984 wrote to memory of 3152	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	102
PID 2984 wrote to memory of 3152	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	102
PID 2984 wrote to memory of 2840	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	103
PID 2984 wrote to memory of 2840	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	103
PID 2984 wrote to memory of 2840	2984	{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe	103
PID 3152 wrote to memory of 4824	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	104
PID 3152 wrote to memory of 4824	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	104
PID 3152 wrote to memory of 4824	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	104
PID 3152 wrote to memory of 3428	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	105
PID 3152 wrote to memory of 3428	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	105
PID 3152 wrote to memory of 3428	3152	{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe	105
PID 4824 wrote to memory of 3036	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	106
PID 4824 wrote to memory of 3036	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	106
PID 4824 wrote to memory of 3036	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	106
PID 4824 wrote to memory of 4984	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	107
PID 4824 wrote to memory of 4984	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	107
PID 4824 wrote to memory of 4984	4824	{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe	107
PID 3036 wrote to memory of 960	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	108
PID 3036 wrote to memory of 960	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	108
PID 3036 wrote to memory of 960	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	108
PID 3036 wrote to memory of 5112	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	109
PID 3036 wrote to memory of 5112	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	109
PID 3036 wrote to memory of 5112	3036	{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe	109
PID 960 wrote to memory of 516	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	110
PID 960 wrote to memory of 516	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	110
PID 960 wrote to memory of 516	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	110
PID 960 wrote to memory of 3436	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	111
PID 960 wrote to memory of 3436	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	111
PID 960 wrote to memory of 3436	960	{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe	111
PID 516 wrote to memory of 4324	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	112
PID 516 wrote to memory of 4324	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	112
PID 516 wrote to memory of 4324	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	112
PID 516 wrote to memory of 3840	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	113
PID 516 wrote to memory of 3840	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	113
PID 516 wrote to memory of 3840	516	{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe	113
PID 4324 wrote to memory of 1180	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	114
PID 4324 wrote to memory of 1180	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	114
PID 4324 wrote to memory of 1180	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	114
PID 4324 wrote to memory of 4360	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	115
PID 4324 wrote to memory of 4360	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	115
PID 4324 wrote to memory of 4360	4324	{405AAFB6-0217-484b-8617-BDD887EF363A}.exe	115
PID 1180 wrote to memory of 3944	1180	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe	116
PID 1180 wrote to memory of 3944	1180	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe	116
PID 1180 wrote to memory of 3944	1180	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe	116
PID 1180 wrote to memory of 3324	1180	{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_81df15c866424e15b1bf5824337e491a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
  C:\Windows\{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
    C:\Windows\{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
      C:\Windows\{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Windows\{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe
        
        C:\Windows\{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3152
      - C:\Windows\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
        
        C:\Windows\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe
        
        C:\Windows\{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
        
        C:\Windows\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
        
        C:\Windows\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
        
        C:\Windows\{405AAFB6-0217-484b-8617-BDD887EF363A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
        
        C:\Windows\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe
        
        C:\Windows\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
        
        C:\Windows\{C21E0878-8996-4ac5-809B-6E50AE797063}.exe
        
        C:\Windows\{C21E0878-8996-4ac5-809B-6E50AE797063}.exe
        13⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2B6F~1.EXE > nul
        13⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3680~1.EXE > nul
        12⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{405AA~1.EXE > nul
        11⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3478~1.EXE > nul
        10⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1CAB~1.EXE > nul
        9⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0613E~1.EXE > nul
        8⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A9924~1.EXE > nul
        7⤵
        
        PID:4984
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B01A8~1.EXE > nul
        6⤵
        
        PID:3428
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7307D~1.EXE > nul
        5⤵
        
        PID:2840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B904B~1.EXE > nul
      4⤵
      PID:4188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{97D6B~1.EXE > nul
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0613E409-B784-4bd4-8BFE-B899E0D56847}.exe

Filesize
408KB

MD5
7a95a91544ee9c0c1c116ea8154fee9b

SHA1
ab7e70ad1e49a409e57f6378e8900cea43267571

SHA256
c4cf8121a89e690c3e5bdea94fb9f34e826a154426292becab877788d0b61ea4

SHA512
5232d54f0ed7b4040b79f7b4ba55d21f987ff78f41b2b78265bda3d44a6a522f84969a3d2294d2c86235d5a8bff3195b77786241384d86ca2bff47295fd99fca

Download Submit
C:\Windows\{405AAFB6-0217-484b-8617-BDD887EF363A}.exe

Filesize
408KB

MD5
6a47194f0b70615b44855890770ef692

SHA1
604b1a3a5c38a3733664cedfcc981e7e2ce06b4f

SHA256
168dadf642102e098729841fee72a8cb3c4f54c6a7e042538c0a8be9be410478

SHA512
23841d4407c2220b34b546aa9e9b7656834080607f346dc70f21757371ee41c7d56d2946915ebe6e438f6bea8bde025dcdcd29a0ecd75d56e4756c39d3822be2

Download Submit
C:\Windows\{7307DBBA-97E5-41d1-B16B-54747A59C21C}.exe

Filesize
408KB

MD5
18ee473b7945cf3964e752f580dd7639

SHA1
a552ed31466ddf05ad2243976bf2d2fa5e29b815

SHA256
667a10abbcd5d4099c0f85357036536fe53ff3d1de654f39dbf4130282157a6e

SHA512
5f5a8f090bffaa033c1f0427283819544662c144f3df8af8067e5d82adce2975debdac635872f78f1f2a91bd04aef5f3e531cc9f58d50014db8c4771df7cbed3

Download Submit
C:\Windows\{97D6BECB-A933-47e6-9DA5-BF7499519964}.exe

Filesize
408KB

MD5
5fd65e333dd382b706d18de691ea2b73

SHA1
abb596b70f3864661773285ef06f15a47490d942

SHA256
b97b045fcdc51b18ac031bd6308c61f5f9c9979ee17a4d8982f73b728d986d0f

SHA512
8c1907a95f6c1575d4c2bd70ae0fd56528fc611634e659a876e2b629e62cc25282e55160420a435a79682efd60db987ec3477c53a022fda129bbf22a39bf4ef8

Download Submit
C:\Windows\{A3478AAB-F199-4acc-A1D7-FC4D047E460D}.exe

Filesize
408KB

MD5
cb51dcf5e6fa60cf52738bb0ab8b6934

SHA1
eb5104c08678cd27816f18d9fe8032b3aa779889

SHA256
43444c71bd4e7d9f1b3250ff021a06d4d1c28134b99694bcd46a9650ba5fe4a9

SHA512
2d7e7ef2fd80cdcd31f22d5ffd7e8acbf1ff37d150ac54233611349462bdc7441c9f8c803ae5abde82ca14d57dd6e0de0b983c29a813f0119da6f74a5daf29d6

Download Submit
C:\Windows\{A3680DDE-4F3F-4ca2-8CBF-3B50F51CEC16}.exe

Filesize
408KB

MD5
29d5f91b5fe624f6521847fa976f3d23

SHA1
737a1ed3f116a77a90cc87e88e119832c7d8da21

SHA256
1b15b0da36c497748fdc4e023945e734da6a1e4d1a02c23780698e5f2c31906e

SHA512
ef98108a3a5a857961dd96c6678d77f4ff576e1f1cec77af1ec29a3ee336d48c313437293e2c43ee04f86e0ac97b2f8f1d1e0a154387e61446a5667dc0f55fe6

Download Submit
C:\Windows\{A9924B6F-0B5D-4a04-AE6F-4DF584896618}.exe

Filesize
408KB

MD5
e4b74c3fb7e9e20b321835c26e026e4c

SHA1
36c0e1a6079b5538917fade06185305b07e5d52a

SHA256
8d435d610aa9f14fb880320c06f55803cb232a00e0911369b180e439b853d501

SHA512
20bf03986f73b44a189347571b634de8afbefadccaa53299f80df3a28f7d8198eea46b6b8762900755a67e6c235ead80088f0d68b4862f21f1b0d1042c80126b

Download Submit
C:\Windows\{B01A8A54-1414-42d7-B677-47EEF22D6155}.exe

Filesize
408KB

MD5
b9096278f479d0926615b226761e2bec

SHA1
459f9f96ef0b81513d1d28fa4ac09acce66bac90

SHA256
523ec6f0ad813881ce4a40ad59e967291444d91e8313a034a1fc4fa3aceb284c

SHA512
39fb3a97f80cdad1212915d6671c87b125545f65661b8ecf64238d90376ce75bd68d48fe6cea5d39904dd22cf106014bbcac10a20f51bed4032ffa0956079b55

Download Submit
C:\Windows\{B1CABE10-41F1-4b7b-A2B7-A885F61E4412}.exe

Filesize
408KB

MD5
f2f2a8de15b2fd27d681f7eeb56c34d2

SHA1
ade37612b2f982fe5c15774ad24df25785dd01a7

SHA256
8474a788ea097745cd3fb737ba81d3c3847e535528ec6491e3a5a3aa193abaef

SHA512
d1ab80286038fc8168d90c83d403a90bb494b54bb7d006395ea761e3980b4c7cc896730ab6fde692d16d520530bfd7743f002ab249d622e872558de82e214172

Download Submit
C:\Windows\{B904B709-FEA8-4826-8CFB-ECCE69A64023}.exe

Filesize
408KB

MD5
0f74fff0b5c3deeea6c9c3fa41092c6d

SHA1
66e6aba3978ee70a411c6032d5e90411017547f8

SHA256
08834d53aa9e733de6acb816d133dc8ea022946303af0aea3f84df487c4ab217

SHA512
6fa97789130ca9a99896f8c0cb2bf9199012cf9954d7dbae25e5df06bc356d35b096ed32385ff6af6dc4cbb0758f231cec73ca5f932ca70120a83b5cdcf74a38

Download Submit
C:\Windows\{C21E0878-8996-4ac5-809B-6E50AE797063}.exe

Filesize
408KB

MD5
d0eeec0e4386fc4d23deb4f49a0d9fa3

SHA1
29198eaa7addbb6eacf0921a276b163fd90a488c

SHA256
b0f6b4bc8f3e0d6eea1d06ac2eae9892399709c8abe95377a18695df7b4446b2

SHA512
d64def1e815a64dae1e28025143467188630c9261fedd6e9313575233ec10d7202c17d69a6de336e29bde516896d3d04082379392e306b7aa03ba67da8695877

Download Submit
C:\Windows\{E2B6F7F4-ACD3-4244-A889-B5CB1B91A956}.exe

Filesize
408KB

MD5
0a7edac5b41c069ee68b666d48e046c0

SHA1
62e1150cfbc9452ca35b2410d14774f0815ff9b3

SHA256
2a5fcdaca41e22826a58907b9424a3436cb13ee91dfafdc38f5de18ba0c83119

SHA512
4204403b59f417f12f8b5681f9b936831bf14f4bfdef2e07ed49a3dd475bb9871d7e50504881712e49003c696068bdeed06040c246e36db5f19d268416b62b65

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads