a4a703e80c1874301395983afe748740cd59035413e942cd66868b4647fcdd40

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe
Size

380KB
MD5

cb4e5b004c66601c150ae3d92bca8c2c
SHA1

5c1ead54d11c02fddb92224cba449367e99a1baf
SHA256

a4a703e80c1874301395983afe748740cd59035413e942cd66868b4647fcdd40
SHA512

79acc8d1984ba817827357ddd02351676d07b788442a314c0a11dfea38240b901ac9cc9c2e6d1c490e4ee604d389e983e45f16ecbb3ece88e1555d5b3d5438a2
SSDEEP

3072:mEGh0oQlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGCl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023459-1.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023452-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002345f-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023452-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000006eb-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000200000002219f-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000006eb-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000006eb-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000006eb-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000709-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}\stubpath = "C:\\Windows\\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe"	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05BB3B0F-B289-4153-8859-A66129801299}	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00660DFC-A728-4a59-9854-2FDEB930DBA8}	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}\stubpath = "C:\\Windows\\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe"	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25EAC050-EBCD-4787-B88E-4367FA4164BD}\stubpath = "C:\\Windows\\{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe"	{05BB3B0F-B289-4153-8859-A66129801299}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00660DFC-A728-4a59-9854-2FDEB930DBA8}\stubpath = "C:\\Windows\\{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe"	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}\stubpath = "C:\\Windows\\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}.exe"	{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}\stubpath = "C:\\Windows\\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe"	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}\stubpath = "C:\\Windows\\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe"	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{918E8B4F-35BA-4ba7-879C-27E636979640}	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{918E8B4F-35BA-4ba7-879C-27E636979640}\stubpath = "C:\\Windows\\{918E8B4F-35BA-4ba7-879C-27E636979640}.exe"	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A732F72-8779-4269-8566-C92B5D82D2DE}	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{358E5266-2014-4fc1-BABF-A690CFDAF32F}	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{358E5266-2014-4fc1-BABF-A690CFDAF32F}\stubpath = "C:\\Windows\\{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe"	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}	{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A732F72-8779-4269-8566-C92B5D82D2DE}\stubpath = "C:\\Windows\\{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe"	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05BB3B0F-B289-4153-8859-A66129801299}\stubpath = "C:\\Windows\\{05BB3B0F-B289-4153-8859-A66129801299}.exe"	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25EAC050-EBCD-4787-B88E-4367FA4164BD}	{05BB3B0F-B289-4153-8859-A66129801299}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}\stubpath = "C:\\Windows\\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe"	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe

Executes dropped EXE 12 IoCs

pid	Process
2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe
2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe
3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
1052	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe
4036	{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe
892	{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}.exe	{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe
File created	C:\Windows\{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe
File created	C:\Windows\{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
File created	C:\Windows\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
File created	C:\Windows\{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	{05BB3B0F-B289-4153-8859-A66129801299}.exe
File created	C:\Windows\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe
File created	C:\Windows\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
File created	C:\Windows\{05BB3B0F-B289-4153-8859-A66129801299}.exe	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
File created	C:\Windows\{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
File created	C:\Windows\{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
File created	C:\Windows\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
File created	C:\Windows\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
Token: SeIncBasePriorityPrivilege	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
Token: SeIncBasePriorityPrivilege	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
Token: SeIncBasePriorityPrivilege	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe
Token: SeIncBasePriorityPrivilege	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
Token: SeIncBasePriorityPrivilege	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
Token: SeIncBasePriorityPrivilege	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
Token: SeIncBasePriorityPrivilege	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe
Token: SeIncBasePriorityPrivilege	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
Token: SeIncBasePriorityPrivilege	1052	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe
Token: SeIncBasePriorityPrivilege	4036	{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2152	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe	94
PID 4856 wrote to memory of 2152	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe	94
PID 4856 wrote to memory of 2152	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe	94
PID 4856 wrote to memory of 2556	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe	95
PID 4856 wrote to memory of 2556	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe	95
PID 4856 wrote to memory of 2556	4856	2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe	95
PID 2152 wrote to memory of 1680	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	96
PID 2152 wrote to memory of 1680	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	96
PID 2152 wrote to memory of 1680	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	96
PID 2152 wrote to memory of 1780	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	97
PID 2152 wrote to memory of 1780	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	97
PID 2152 wrote to memory of 1780	2152	{918E8B4F-35BA-4ba7-879C-27E636979640}.exe	97
PID 1680 wrote to memory of 1584	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	99
PID 1680 wrote to memory of 1584	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	99
PID 1680 wrote to memory of 1584	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	99
PID 1680 wrote to memory of 880	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	100
PID 1680 wrote to memory of 880	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	100
PID 1680 wrote to memory of 880	1680	{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe	100
PID 1584 wrote to memory of 4056	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	101
PID 1584 wrote to memory of 4056	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	101
PID 1584 wrote to memory of 4056	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	101
PID 1584 wrote to memory of 916	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	102
PID 1584 wrote to memory of 916	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	102
PID 1584 wrote to memory of 916	1584	{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe	102
PID 4056 wrote to memory of 2564	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe	103
PID 4056 wrote to memory of 2564	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe	103
PID 4056 wrote to memory of 2564	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe	103
PID 4056 wrote to memory of 2176	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe	104
PID 4056 wrote to memory of 2176	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe	104
PID 4056 wrote to memory of 2176	4056	{05BB3B0F-B289-4153-8859-A66129801299}.exe	104
PID 2564 wrote to memory of 4752	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	105
PID 2564 wrote to memory of 4752	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	105
PID 2564 wrote to memory of 4752	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	105
PID 2564 wrote to memory of 1032	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	106
PID 2564 wrote to memory of 1032	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	106
PID 2564 wrote to memory of 1032	2564	{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe	106
PID 4752 wrote to memory of 1176	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	107
PID 4752 wrote to memory of 1176	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	107
PID 4752 wrote to memory of 1176	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	107
PID 4752 wrote to memory of 3420	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	108
PID 4752 wrote to memory of 3420	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	108
PID 4752 wrote to memory of 3420	4752	{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe	108
PID 1176 wrote to memory of 4388	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	109
PID 1176 wrote to memory of 4388	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	109
PID 1176 wrote to memory of 4388	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	109
PID 1176 wrote to memory of 1744	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	110
PID 1176 wrote to memory of 1744	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	110
PID 1176 wrote to memory of 1744	1176	{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe	110
PID 4388 wrote to memory of 3124	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	111
PID 4388 wrote to memory of 3124	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	111
PID 4388 wrote to memory of 3124	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	111
PID 4388 wrote to memory of 3828	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	112
PID 4388 wrote to memory of 3828	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	112
PID 4388 wrote to memory of 3828	4388	{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe	112
PID 3124 wrote to memory of 1052	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	113
PID 3124 wrote to memory of 1052	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	113
PID 3124 wrote to memory of 1052	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	113
PID 3124 wrote to memory of 1636	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	114
PID 3124 wrote to memory of 1636	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	114
PID 3124 wrote to memory of 1636	3124	{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe	114
PID 1052 wrote to memory of 4036	1052	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe	115
PID 1052 wrote to memory of 4036	1052	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe	115
PID 1052 wrote to memory of 4036	1052	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe	115
PID 1052 wrote to memory of 4648	1052	{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe	116

C:\Users\Admin\AppData\Local\Temp\2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_cb4e5b004c66601c150ae3d92bca8c2c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
  C:\Windows\{918E8B4F-35BA-4ba7-879C-27E636979640}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
    C:\Windows\{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
      C:\Windows\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\{05BB3B0F-B289-4153-8859-A66129801299}.exe
        
        C:\Windows\{05BB3B0F-B289-4153-8859-A66129801299}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Windows\{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
        
        C:\Windows\{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
        
        C:\Windows\{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
        
        C:\Windows\{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe
        
        C:\Windows\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
        
        C:\Windows\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe
        
        C:\Windows\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe
        
        C:\Windows\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
        
        C:\Windows\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}.exe
        
        C:\Windows\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}.exe
        13⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5522F~1.EXE > nul
        13⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A54BA~1.EXE > nul
        12⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E6E55~1.EXE > nul
        11⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB0F3~1.EXE > nul
        10⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{358E5~1.EXE > nul
        9⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00660~1.EXE > nul
        8⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25EAC~1.EXE > nul
        7⤵
        
        PID:1032
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05BB3~1.EXE > nul
        6⤵
        
        PID:2176
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A55AD~1.EXE > nul
        5⤵
        
        PID:916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6A732~1.EXE > nul
      4⤵
      PID:880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{918E8~1.EXE > nul
    3⤵
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00660DFC-A728-4a59-9854-2FDEB930DBA8}.exe

Filesize
380KB

MD5
7f6212ef80ffe4ca4a3079e6a0f02a45

SHA1
03df4a7b0014363be0b3e2575fc0d78d5feb5112

SHA256
fbe382981e3eef736873d0c07b6cd7c646b4013e75a960c8e956cc148c4acd09

SHA512
8b609a2b53f3a52239c7f0ee9182224693b7f805ca2e73ccf67553bc4450b58af934d1706807ada0b84a74883d73a5c1a37eef48f04ec7b7587bb627c6d68beb

Download Submit
C:\Windows\{05BB3B0F-B289-4153-8859-A66129801299}.exe

Filesize
380KB

MD5
8609feb721f6b87490cae5a5fe6f470e

SHA1
8d298a62598fa46583a01b0c1f4f5bf5d09db0ee

SHA256
40bc6029eb16f0f93926e8ea4c61e0e3656eb5fdca8e388efc6e347ea3638563

SHA512
f9fd1de07d06de472b72aa3ca9ffc44934a5a393503476d3e02a6ab03d8168e51559de19eac154ad78d11b509139d011915ff500c1d10559060321b01ea127c0

Download Submit
C:\Windows\{25EAC050-EBCD-4787-B88E-4367FA4164BD}.exe

Filesize
380KB

MD5
bd8423d9ddb38f8b02abbf21f360b0d2

SHA1
47fe5ada7fad470f48f438141ddcc3d89c899a0a

SHA256
c2c232fc522d06bce8d9e40980b9bf40928e2d81c615f19f3dc9afee44095585

SHA512
2f70afaaa8a12789abb803fe96057bc1e6dcea1d32cb002c31e5f7f0a5958a57db01f8af91d54299b9a703b1f97aa94203b9ab48b3027ddcad5bd3c831c5dcd7

Download Submit
C:\Windows\{358E5266-2014-4fc1-BABF-A690CFDAF32F}.exe

Filesize
380KB

MD5
c68758c0d4fabdb5ffb9acfa1d18f797

SHA1
d74e439d4b6e9aed9479376b7302434d7b2ff4f2

SHA256
5cf57a7239a9d5c7f01580824cf2e65d0b902a97e9dc6445926f6912488540de

SHA512
d83678d5f6ab8869c592c576bd581f1771cc6a060e6985698db8d9e7fe2ddfda03a7dd61c6132e35d84fd4d0b21066d7d48865119331273bbe1c2c05414a7329

Download Submit
C:\Windows\{5522F5D4-DDBA-49a6-BF04-F064373F1BB5}.exe

Filesize
380KB

MD5
9b833fb0bce5932007bb36116a044f73

SHA1
e2861d2387e027dee9efe88f8791873106a24199

SHA256
ec81154fe5db09ec5f525b2f3980702a81b3d6108848151e0c2431e831a732df

SHA512
e1fe21c1759d05ba2fbf6ed27494be01a2582ab9664a81ee6cf695c1a284e507a1e5f27e9c090263efa38bd8a94a811e06689d79ce571143d7a9eb2a5b2cfd04

Download Submit
C:\Windows\{6A732F72-8779-4269-8566-C92B5D82D2DE}.exe

Filesize
380KB

MD5
bbb159caf594418b59cd419398b967c0

SHA1
1ecde13858722361ffa5d7246fda1bac49dd081c

SHA256
cf807b9c9870bc8a62d5eca0444959f56b241db822253c9ee6b2090944c8d09a

SHA512
1f8b56a40bc0a8d89599b7f5a455a3b22458618ac7c08153b904cc85b6a8f618953ad0faaca002fc8094c37f2533ea9aa4c714ad3096e3244f7c761dca5de02f

Download Submit
C:\Windows\{918E8B4F-35BA-4ba7-879C-27E636979640}.exe

Filesize
380KB

MD5
2526f8140869cf5bcef00bc4a476777a

SHA1
6106e9feb269467d91338ff3d96628fbb29e17f4

SHA256
ec03efa83d2c588f2d16c1bffa021906aab939a9736a2a8fe669a6659c651d75

SHA512
562f9d3d6104fe8c7442784e57193e8277b6ec048a6528a9c2b4edfde4ca7a60c6491d87d95b2fa3bd45bff5c7845325c97bdf2f1311d6a2b9c882ed14476f5d

Download Submit
C:\Windows\{A54BAFAE-6DCB-4dd3-BC3A-B01E08ECED4F}.exe

Filesize
380KB

MD5
addab65689b4beac830ebce4b12dd54c

SHA1
a6350b65fb0bcb7da917902022febab4e56b371d

SHA256
8be892b8c85d19cfcc3d8aacb1918ac93311f6b857a03a8afe3a4e220f44f74b

SHA512
ac790dcaae3caf70ef3ec7422c3d14fc1914cb88b786c4b3d4905459c7bbb06500752d89d6ce65db7d876cd66692586b3c9464f3964d481f21f828fd4a2ea20b

Download Submit
C:\Windows\{A55ADBC0-6EA9-4911-A798-9128AE7ED494}.exe

Filesize
380KB

MD5
6f7523d2a337abc15defd69aa0c92930

SHA1
64894656db0358c0f730451462e6665db302d3db

SHA256
ec4fa3f9d087704beee2a46a055c40f4c079bf1c297d74f145e8803ee0edcf8d

SHA512
270e9cb0cf3e7e24d9862f99ae3b8a78331e7531ac7903871205793a8ba3a5c5456b5082bee8eb54c147d27cf15fb29f65976e4503b9fac03afe81f328a4b7c8

Download Submit
C:\Windows\{AF7A330D-C59E-48b1-ACDA-637BFD98BB45}.exe

Filesize
380KB

MD5
c6c361dea700abc2f0c4d01d102ad406

SHA1
ac6e8792db7d6c3832e344b61524ab5667d8e9c0

SHA256
0134fb5075489c3e63374cecd9d86da8299101ed6bb302d6514a86414fde0360

SHA512
af369cc4a7ffffeaea1c24d2548c2b4a891d824f28e3ecf3df4a26009490feb52a880d50a42d17c8fdca124175d494d1ac68d62758bb5a0266e7588055c3f711

Download Submit
C:\Windows\{DB0F36C4-435D-49a4-81A9-0CA2D42A7586}.exe

Filesize
380KB

MD5
7ce2944ae2bdbd97dbc5c31cc7ece2bd

SHA1
83f50141cbef0ec1510148a50b7fdb068c51018b

SHA256
d4e69b276ce66e4fa36baa49057fddfc621bd83fc5946b3778f1efc0d78fb2c0

SHA512
4c2f20871ff1b922a2e8fc93350a43043233790f8004373d76cd1d5eb6552bbf75817584ba8c47144ea44dfc1d507d40bffd251c56392e5b01263abaaf084f3f

Download Submit
C:\Windows\{E6E557B4-EFC2-46c1-A88E-1F69D7C5E38C}.exe

Filesize
380KB

MD5
9815e454e8c978414dd2b60e5141cfcb

SHA1
54d50c22432aeb6ad531ba58bb7833b865199fdf

SHA256
0f176229870eee10287b828288cd58e4b9888e8943a4094088a76f5e615cb06e

SHA512
5169d2ac8512132e0dfae28646a6b6682e47032339d7a0c118599f930ea6677e0c84dcfdd9afa79f8a1c0779454779f8063ce05dd7392245cc7fbd542c088593

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads