1ce6038ad69f2261ae73838ec703e0863c07e8f41ddc2525db3ebf72b3d1534e

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe
Size

192KB
MD5

ae2295dc1f38fc634f7df4b6d6f88149
SHA1

09e773c814b5fad55b3469de5f5558f60314a008
SHA256

1ce6038ad69f2261ae73838ec703e0863c07e8f41ddc2525db3ebf72b3d1534e
SHA512

5c3ca089b48bb07a72151ba75f83a5ac6548b3253834a2d81ff7f48acd846c8c842a65db7f155cfb9fde97912c3fc60bdb743ec065f70d06ee25123bdd8c921c
SSDEEP

1536:1EGh0osLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o4l1OPOe2MUVg3Ve+rXfMUa

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0005000000022ac4-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000022ac6-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023410-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023414-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002341a-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023414-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002341a-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023414-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002341a-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023414-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002341a-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023414-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}\stubpath = "C:\\Windows\\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe"	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}\stubpath = "C:\\Windows\\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe"	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}\stubpath = "C:\\Windows\\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}.exe"	{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}\stubpath = "C:\\Windows\\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe"	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{320F7778-EAF2-474d-B6F8-CF6783E5F701}	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}\stubpath = "C:\\Windows\\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe"	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0219DC73-08D5-43e3-B107-41519393FCAC}\stubpath = "C:\\Windows\\{0219DC73-08D5-43e3-B107-41519393FCAC}.exe"	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}\stubpath = "C:\\Windows\\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe"	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}\stubpath = "C:\\Windows\\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe"	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0219DC73-08D5-43e3-B107-41519393FCAC}	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}\stubpath = "C:\\Windows\\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe"	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}	{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B2EC028-D06E-48db-A466-0157F832A96B}\stubpath = "C:\\Windows\\{8B2EC028-D06E-48db-A466-0157F832A96B}.exe"	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{047F7CD4-7759-474c-8DDD-70161C9E1C74}	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{047F7CD4-7759-474c-8DDD-70161C9E1C74}\stubpath = "C:\\Windows\\{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe"	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B2EC028-D06E-48db-A466-0157F832A96B}	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{320F7778-EAF2-474d-B6F8-CF6783E5F701}\stubpath = "C:\\Windows\\{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe"	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe

Executes dropped EXE 12 IoCs

pid	Process
1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe
3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe
460	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
540	{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe
3724	{FA72F138-61B1-4bfd-8A3D-1D68F762B968}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe
File created	C:\Windows\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe
File created	C:\Windows\{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
File created	C:\Windows\{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
File created	C:\Windows\{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
File created	C:\Windows\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
File created	C:\Windows\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
File created	C:\Windows\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
File created	C:\Windows\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}.exe	{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe
File created	C:\Windows\{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
File created	C:\Windows\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
File created	C:\Windows\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
Token: SeIncBasePriorityPrivilege	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
Token: SeIncBasePriorityPrivilege	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
Token: SeIncBasePriorityPrivilege	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
Token: SeIncBasePriorityPrivilege	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe
Token: SeIncBasePriorityPrivilege	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
Token: SeIncBasePriorityPrivilege	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
Token: SeIncBasePriorityPrivilege	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
Token: SeIncBasePriorityPrivilege	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe
Token: SeIncBasePriorityPrivilege	460	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
Token: SeIncBasePriorityPrivilege	540	{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 1668	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe	86
PID 3532 wrote to memory of 1668	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe	86
PID 3532 wrote to memory of 1668	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe	86
PID 3532 wrote to memory of 1304	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe	87
PID 3532 wrote to memory of 1304	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe	87
PID 3532 wrote to memory of 1304	3532	2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe	87
PID 1668 wrote to memory of 3460	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	88
PID 1668 wrote to memory of 3460	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	88
PID 1668 wrote to memory of 3460	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	88
PID 1668 wrote to memory of 2504	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	89
PID 1668 wrote to memory of 2504	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	89
PID 1668 wrote to memory of 2504	1668	{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe	89
PID 3460 wrote to memory of 2824	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	92
PID 3460 wrote to memory of 2824	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	92
PID 3460 wrote to memory of 2824	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	92
PID 3460 wrote to memory of 444	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	93
PID 3460 wrote to memory of 444	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	93
PID 3460 wrote to memory of 444	3460	{8B2EC028-D06E-48db-A466-0157F832A96B}.exe	93
PID 2824 wrote to memory of 3552	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	98
PID 2824 wrote to memory of 3552	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	98
PID 2824 wrote to memory of 3552	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	98
PID 2824 wrote to memory of 1484	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	99
PID 2824 wrote to memory of 1484	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	99
PID 2824 wrote to memory of 1484	2824	{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe	99
PID 3552 wrote to memory of 4940	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	101
PID 3552 wrote to memory of 4940	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	101
PID 3552 wrote to memory of 4940	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	101
PID 3552 wrote to memory of 3528	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	102
PID 3552 wrote to memory of 3528	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	102
PID 3552 wrote to memory of 3528	3552	{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe	102
PID 4940 wrote to memory of 3520	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	103
PID 4940 wrote to memory of 3520	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	103
PID 4940 wrote to memory of 3520	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	103
PID 4940 wrote to memory of 1504	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	104
PID 4940 wrote to memory of 1504	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	104
PID 4940 wrote to memory of 1504	4940	{0219DC73-08D5-43e3-B107-41519393FCAC}.exe	104
PID 3520 wrote to memory of 1756	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	105
PID 3520 wrote to memory of 1756	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	105
PID 3520 wrote to memory of 1756	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	105
PID 3520 wrote to memory of 1544	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	106
PID 3520 wrote to memory of 1544	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	106
PID 3520 wrote to memory of 1544	3520	{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe	106
PID 1756 wrote to memory of 4864	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	107
PID 1756 wrote to memory of 4864	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	107
PID 1756 wrote to memory of 4864	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	107
PID 1756 wrote to memory of 1976	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	108
PID 1756 wrote to memory of 1976	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	108
PID 1756 wrote to memory of 1976	1756	{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe	108
PID 4864 wrote to memory of 628	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	109
PID 4864 wrote to memory of 628	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	109
PID 4864 wrote to memory of 628	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	109
PID 4864 wrote to memory of 4644	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	110
PID 4864 wrote to memory of 4644	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	110
PID 4864 wrote to memory of 4644	4864	{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe	110
PID 628 wrote to memory of 460	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	111
PID 628 wrote to memory of 460	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	111
PID 628 wrote to memory of 460	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	111
PID 628 wrote to memory of 4388	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	112
PID 628 wrote to memory of 4388	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	112
PID 628 wrote to memory of 4388	628	{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe	112
PID 460 wrote to memory of 540	460	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe	113
PID 460 wrote to memory of 540	460	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe	113
PID 460 wrote to memory of 540	460	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe	113
PID 460 wrote to memory of 2372	460	{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_ae2295dc1f38fc634f7df4b6d6f88149_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
  C:\Windows\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
    C:\Windows\{8B2EC028-D06E-48db-A466-0157F832A96B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
      C:\Windows\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
        
        C:\Windows\{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3552
      - C:\Windows\{0219DC73-08D5-43e3-B107-41519393FCAC}.exe
        
        C:\Windows\{0219DC73-08D5-43e3-B107-41519393FCAC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
        
        C:\Windows\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
        
        C:\Windows\{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
        
        C:\Windows\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe
        
        C:\Windows\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
        
        C:\Windows\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:460
        
        C:\Windows\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe
        
        C:\Windows\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
        
        C:\Windows\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}.exe
        
        C:\Windows\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}.exe
        13⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D1883~1.EXE > nul
        13⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{650A5~1.EXE > nul
        12⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6B39~1.EXE > nul
        11⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E658~1.EXE > nul
        10⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{320F7~1.EXE > nul
        9⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{991F4~1.EXE > nul
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0219D~1.EXE > nul
        7⤵
        
        PID:1504
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{047F7~1.EXE > nul
        6⤵
        
        PID:3528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2860F~1.EXE > nul
        5⤵
        
        PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8B2EC~1.EXE > nul
      4⤵
      PID:444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8FA15~1.EXE > nul
    3⤵
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0219DC73-08D5-43e3-B107-41519393FCAC}.exe

Filesize
192KB

MD5
6ad041980321c3cc27142418c3a1d9e0

SHA1
7c9f6505a0f1d86a0ba124d1abb20704d6eda71f

SHA256
8c5c63288ea7184f1d07238fb785070e8377d1aa0ea6b28693a90ebca201097f

SHA512
e5db0f63e5180ed31bd6f41471816ddc3bfe7a4fbcc29c541dec612135e10f3e95043005b03cf203921024e8c7394a8eb95b43acc803964c9600225a1bf69794

Download Submit
C:\Windows\{047F7CD4-7759-474c-8DDD-70161C9E1C74}.exe

Filesize
192KB

MD5
54b0f1dfe046a7eeeacac232f03f5f62

SHA1
0c7326446d52e13f19caed468bbacaef54d80e6d

SHA256
b41fe24bbba365a3d1b6b48613e55a34341629b63ab05c9295d7a968d1fbfd10

SHA512
314cadca7b75a33559a0202e4e6d446fcf1ca471cec7ed1bc34574398dfddf1a85144dcfc2a1d10226db2f67cfd7744cdab81fa633679941a734ccadbe460065

Download Submit
C:\Windows\{2860FE3B-7787-48c1-BC06-3D1C63B97EC3}.exe

Filesize
192KB

MD5
5c71113fd61d7382d03dee8d8a7b9211

SHA1
90f1c486a9dab3c5616fcc8e63f4a5763b6d7b25

SHA256
2d116ca0d7abeafe37dfb1b1f9a442e9ffc406e24ce2c4456264fcc20e4fe7fd

SHA512
ee7202fcc775f3e09e9febafaf8ac2f605416bf3596812c532cd0f4420dc4b3ca766f085df9920b77cd3e6fd542ba3675f73bda585ab35aca66135644734fa81

Download Submit
C:\Windows\{320F7778-EAF2-474d-B6F8-CF6783E5F701}.exe

Filesize
192KB

MD5
b9d6d0a966347bd2ec2d23fb3e02f7db

SHA1
6387808094ea55d15241029372d0a7531b1b2253

SHA256
24ac55acc010eda26dd5db4e6aaf160f0eb825e1a2216de8062993c9aacd8269

SHA512
93025a13a99566c2daa60b54bfb93b1083f2b71428394626742b10128b513fca96ba7007686ae12ecea1c25191e284831d5744b1e3b1dd18d76b296c0b4f39cd

Download Submit
C:\Windows\{650A5A53-9F62-4f2d-8348-30AB97AB30D5}.exe

Filesize
192KB

MD5
4a270123967cbc2d559fd7158226fc85

SHA1
815ef0b97b9781804ea7c9f82518c63ade876252

SHA256
66fc4ef018e1e681a953dd7c857cd64abda30319e65c124c4693f4c97f7b803e

SHA512
58998c7bb57e9ce9fc43ce97331053c85515c4658045d9fe17cbc28fcba7af9bb9a2b605c376f80ae00703e8def526eafa7f1793a8bb8dcc55f5ef2e74493ccb

Download Submit
C:\Windows\{7E65808D-9C85-4bdc-950B-D8576FCEBC78}.exe

Filesize
192KB

MD5
5b4db0fa8173174fbc2e7ead14b3cf23

SHA1
bec2a63d40da169293181369a164648f8377e5eb

SHA256
6c58c627debd18c6e209fa50710c753e6049682a8c6f830929474f328cf62960

SHA512
1c63385f3e438af4262c9b34d7349c7d732cbab91977d5378a52d2df3e02cfbccaf4a617eba91ee1c62a70581a50c1e059530b7cc19f59814ae59ee9ae5513dd

Download Submit
C:\Windows\{8B2EC028-D06E-48db-A466-0157F832A96B}.exe

Filesize
192KB

MD5
cd0ceb68a8bb767d26f1cd8308dc5843

SHA1
af396b23a4c622a0de8e50b8fa8cf54e72141a3b

SHA256
f4ab980f441cbf0f5bb065bcd75010a060aa0ab49aef851b7624c217032db9ec

SHA512
0785d7acc3f47206c54bc2d68001614d322d3fa6bfaae732d56cf07af1a6fea52dc14f0450be3a2f11935def1633428bf94cafa484b5c0a264cac010fe194a74

Download Submit
C:\Windows\{8FA15EC8-A5B0-472e-843A-7824E6AFE9E5}.exe

Filesize
192KB

MD5
cbe020b143209219fa82efafffe5199c

SHA1
ab1a20eb5deefe3b80f228029084d3d7ed4f9148

SHA256
5dd7058479ba2873a7fb435c6ae34b737edda5afc83772002f2cf32983ec65a6

SHA512
19106b22912c37a6e44e70d3936a2f4c9c53915c170b1100eb4cb7ef94950ff5677721e323117457b6161b5adb5e650ea034ad42ab232da0e01e52f9d748c504

Download Submit
C:\Windows\{991F4B61-5F86-4b63-9E2E-B52C38A277D0}.exe

Filesize
192KB

MD5
36ee56b478f8ede4011b6251c07324cf

SHA1
9f8373a6983e50c31dd132bae1aa59afa416efeb

SHA256
e85708faaa3960fdb6a200755bbdf6bbfb741e25cb6a8b37f2927328b1471d8d

SHA512
902f2e430cb1ab805abb9e16308dd8922def7010ce4b310065ccced3a82d9b384d8fd785ea28e07143753d2dd8c002986333c685d6e4e694e9aea85b854375a9

Download Submit
C:\Windows\{C6B3974D-BB65-4f0d-93D5-F2A8CC1E8F88}.exe

Filesize
192KB

MD5
9485bcb6b87c5aa5f66ff0d118a497df

SHA1
916baec5f9115ae838110a3e06705c73db02ff86

SHA256
a24f404b6ce719a884bdd0218b5d6f272a2a1c6af408600e52567f669717ce91

SHA512
56657b5dafae65ffe00311a7de01dc5352c37cdc3cd89d2de9819bf5d7127048d4e252df3a0c7a0cff979dd267250d775d58d8f7b63715eb12418c3c68834e97

Download Submit
C:\Windows\{D1883BA3-6AF8-44cf-8ACA-67117AB92920}.exe

Filesize
192KB

MD5
7deddf0fdbc27f09816554cef1e0dc5f

SHA1
81f415bb36bb9d354e8e40353b6dcc4616cbdbfa

SHA256
de71ffc3d71a8294a96bdafb6b3465684a63900b18f73ac0a5272a019fcf62d9

SHA512
f78c3a72167a5a714172b1eb3c07f96a601ddfb8fdeb1f38ddb13ff0f47ffb016b9191d265124711b284d2504a01d50e58a84ce28cd480339a9d67179dd9161c

Download Submit
C:\Windows\{FA72F138-61B1-4bfd-8A3D-1D68F762B968}.exe

Filesize
192KB

MD5
5adf71a3e9857dc79f2491e0a9abed28

SHA1
4d93be77bded03ec4379e99bed50640fddd5c7f9

SHA256
ef1df90dae5dd61a01ae7240544a1e59d8ff368e7ef63ccc26a679e18554e326

SHA512
67a6da32f5535c47e176d0e972cba250a4b2929fa11de3b9c8e873f96649f9a10d9fc5f1438e50af8ea51b1a4332c85d8ca6011bc6ff0baff0c9f344b044e6ad

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads