4bb9ae48a897342633a6a52a6917b058bafbb65d09f2149fba7695ab6e5134b9

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe
Size

216KB
MD5

7c87bb6045af8c76c0ada3757dc9a887
SHA1

1b01c478b57f8a1e01b4bf2efb871d33c7850aed
SHA256

4bb9ae48a897342633a6a52a6917b058bafbb65d09f2149fba7695ab6e5134b9
SHA512

a03b8f9154c26572d5e56dbd7f0e5cc23c8dc08652c0f39c462d8674c9ab1e91d0c5a417835f70a8d8c440feaecd34dedcd16848c27dffeff39fa323e82f6348
SSDEEP

3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGXlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000b00000002347d-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023487-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000234a4-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023487-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000234a4-17.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023487-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000234a4-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023482-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023483-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023482-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023483-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023482-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AED18765-0341-400d-A57A-7A5B92A1735B}	{D843F395-726E-4382-83F3-F869A322623C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AED18765-0341-400d-A57A-7A5B92A1735B}\stubpath = "C:\\Windows\\{AED18765-0341-400d-A57A-7A5B92A1735B}.exe"	{D843F395-726E-4382-83F3-F869A322623C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}\stubpath = "C:\\Windows\\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe"	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}\stubpath = "C:\\Windows\\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe"	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B71DBB69-B31B-463a-BA53-50E85BAF0013}	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B71DBB69-B31B-463a-BA53-50E85BAF0013}\stubpath = "C:\\Windows\\{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe"	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}\stubpath = "C:\\Windows\\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe"	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CB658A6-B8ED-4087-8194-AB275A315D27}	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CB658A6-B8ED-4087-8194-AB275A315D27}\stubpath = "C:\\Windows\\{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe"	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}\stubpath = "C:\\Windows\\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe"	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{307E0127-BE02-4355-937A-6E33642F5B90}\stubpath = "C:\\Windows\\{307E0127-BE02-4355-937A-6E33642F5B90}.exe"	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}\stubpath = "C:\\Windows\\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}.exe"	{307E0127-BE02-4355-937A-6E33642F5B90}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}	{307E0127-BE02-4355-937A-6E33642F5B90}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F94BA50-7859-49e6-A64B-BB455137290B}	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F94BA50-7859-49e6-A64B-BB455137290B}\stubpath = "C:\\Windows\\{9F94BA50-7859-49e6-A64B-BB455137290B}.exe"	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D843F395-726E-4382-83F3-F869A322623C}	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D843F395-726E-4382-83F3-F869A322623C}\stubpath = "C:\\Windows\\{D843F395-726E-4382-83F3-F869A322623C}.exe"	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}\stubpath = "C:\\Windows\\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe"	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{307E0127-BE02-4355-937A-6E33642F5B90}	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe

Executes dropped EXE 12 IoCs

pid	Process
4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
3316	{D843F395-726E-4382-83F3-F869A322623C}.exe
2496	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe
1220	{307E0127-BE02-4355-937A-6E33642F5B90}.exe
3836	{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
File created	C:\Windows\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
File created	C:\Windows\{D843F395-726E-4382-83F3-F869A322623C}.exe	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
File created	C:\Windows\{AED18765-0341-400d-A57A-7A5B92A1735B}.exe	{D843F395-726E-4382-83F3-F869A322623C}.exe
File created	C:\Windows\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
File created	C:\Windows\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
File created	C:\Windows\{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
File created	C:\Windows\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
File created	C:\Windows\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
File created	C:\Windows\{307E0127-BE02-4355-937A-6E33642F5B90}.exe	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe
File created	C:\Windows\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}.exe	{307E0127-BE02-4355-937A-6E33642F5B90}.exe
File created	C:\Windows\{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
Token: SeIncBasePriorityPrivilege	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
Token: SeIncBasePriorityPrivilege	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
Token: SeIncBasePriorityPrivilege	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
Token: SeIncBasePriorityPrivilege	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
Token: SeIncBasePriorityPrivilege	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
Token: SeIncBasePriorityPrivilege	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
Token: SeIncBasePriorityPrivilege	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
Token: SeIncBasePriorityPrivilege	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe
Token: SeIncBasePriorityPrivilege	2496	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe
Token: SeIncBasePriorityPrivilege	1220	{307E0127-BE02-4355-937A-6E33642F5B90}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4724	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe	87
PID 4804 wrote to memory of 4724	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe	87
PID 4804 wrote to memory of 4724	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe	87
PID 4804 wrote to memory of 3140	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe	88
PID 4804 wrote to memory of 3140	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe	88
PID 4804 wrote to memory of 3140	4804	2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe	88
PID 4724 wrote to memory of 4352	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	89
PID 4724 wrote to memory of 4352	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	89
PID 4724 wrote to memory of 4352	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	89
PID 4724 wrote to memory of 400	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	90
PID 4724 wrote to memory of 400	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	90
PID 4724 wrote to memory of 400	4724	{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe	90
PID 4352 wrote to memory of 1880	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	94
PID 4352 wrote to memory of 1880	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	94
PID 4352 wrote to memory of 1880	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	94
PID 4352 wrote to memory of 2936	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	95
PID 4352 wrote to memory of 2936	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	95
PID 4352 wrote to memory of 2936	4352	{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe	95
PID 1880 wrote to memory of 1356	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	96
PID 1880 wrote to memory of 1356	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	96
PID 1880 wrote to memory of 1356	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	96
PID 1880 wrote to memory of 3640	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	97
PID 1880 wrote to memory of 3640	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	97
PID 1880 wrote to memory of 3640	1880	{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe	97
PID 1356 wrote to memory of 2388	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	98
PID 1356 wrote to memory of 2388	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	98
PID 1356 wrote to memory of 2388	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	98
PID 1356 wrote to memory of 3084	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	99
PID 1356 wrote to memory of 3084	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	99
PID 1356 wrote to memory of 3084	1356	{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe	99
PID 2388 wrote to memory of 3184	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	100
PID 2388 wrote to memory of 3184	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	100
PID 2388 wrote to memory of 3184	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	100
PID 2388 wrote to memory of 3000	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	101
PID 2388 wrote to memory of 3000	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	101
PID 2388 wrote to memory of 3000	2388	{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe	101
PID 3184 wrote to memory of 3952	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	102
PID 3184 wrote to memory of 3952	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	102
PID 3184 wrote to memory of 3952	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	102
PID 3184 wrote to memory of 3244	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	103
PID 3184 wrote to memory of 3244	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	103
PID 3184 wrote to memory of 3244	3184	{9F94BA50-7859-49e6-A64B-BB455137290B}.exe	103
PID 3952 wrote to memory of 5040	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	106
PID 3952 wrote to memory of 5040	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	106
PID 3952 wrote to memory of 5040	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	106
PID 3952 wrote to memory of 2536	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	107
PID 3952 wrote to memory of 2536	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	107
PID 3952 wrote to memory of 2536	3952	{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe	107
PID 5040 wrote to memory of 3316	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	108
PID 5040 wrote to memory of 3316	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	108
PID 5040 wrote to memory of 3316	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	108
PID 5040 wrote to memory of 1280	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	109
PID 5040 wrote to memory of 1280	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	109
PID 5040 wrote to memory of 1280	5040	{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe	109
PID 3316 wrote to memory of 2496	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe	110
PID 3316 wrote to memory of 2496	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe	110
PID 3316 wrote to memory of 2496	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe	110
PID 3316 wrote to memory of 3632	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe	111
PID 3316 wrote to memory of 3632	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe	111
PID 3316 wrote to memory of 3632	3316	{D843F395-726E-4382-83F3-F869A322623C}.exe	111
PID 2496 wrote to memory of 1220	2496	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe	112
PID 2496 wrote to memory of 1220	2496	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe	112
PID 2496 wrote to memory of 1220	2496	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe	112
PID 2496 wrote to memory of 5084	2496	{AED18765-0341-400d-A57A-7A5B92A1735B}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_7c87bb6045af8c76c0ada3757dc9a887_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
  C:\Windows\{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
    C:\Windows\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
      C:\Windows\{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
        
        C:\Windows\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
      - C:\Windows\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
        
        C:\Windows\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
        
        C:\Windows\{9F94BA50-7859-49e6-A64B-BB455137290B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
        
        C:\Windows\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
        
        C:\Windows\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\{D843F395-726E-4382-83F3-F869A322623C}.exe
        
        C:\Windows\{D843F395-726E-4382-83F3-F869A322623C}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\{AED18765-0341-400d-A57A-7A5B92A1735B}.exe
        
        C:\Windows\{AED18765-0341-400d-A57A-7A5B92A1735B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\{307E0127-BE02-4355-937A-6E33642F5B90}.exe
        
        C:\Windows\{307E0127-BE02-4355-937A-6E33642F5B90}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
        
        C:\Windows\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}.exe
        
        C:\Windows\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}.exe
        13⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{307E0~1.EXE > nul
        13⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AED18~1.EXE > nul
        12⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D843F~1.EXE > nul
        11⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7FD6F~1.EXE > nul
        10⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EBD0C~1.EXE > nul
        9⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F94B~1.EXE > nul
        8⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{919F5~1.EXE > nul
        7⤵
        
        PID:3000
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ECE19~1.EXE > nul
        6⤵
        
        PID:3084
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2CB65~1.EXE > nul
        5⤵
        
        PID:3640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C5BFA~1.EXE > nul
      4⤵
      PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B71DB~1.EXE > nul
    3⤵
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2CB658A6-B8ED-4087-8194-AB275A315D27}.exe

Filesize
216KB

MD5
c374c0037ee8ae00aed844238326dd40

SHA1
ac001df38c904ff4c98eee010a5b3fb780c2bfa1

SHA256
17b256d28f8f7e684fdc5a5b40a0df06a6c5a1efaa6d30c23ed6c06b4b48e842

SHA512
cb10e7cccbc61eb62dace1b8ae4385a3e9785b5016c633523d8dcc7a0997c2fa6ad0c5cbe9208ec11a3d997f701c8ae4840786f095875ca288496c4f503541d1

Download Submit
C:\Windows\{307E0127-BE02-4355-937A-6E33642F5B90}.exe

Filesize
216KB

MD5
12f5d1a53b59b9a5aa10af475709342e

SHA1
6a491cd58d0361a2d4c63c4d35e08a6261e3038d

SHA256
97d767a8ad840aaa478d7129fcd13d943454a372a7cb59e8133ecb5e8ce6cbe8

SHA512
48157dbfc2519f0977921b6347353365337fbec0e064905e6715ee79b2c7aa1ed3df157a7b4ea731c866c8f45897cfdf14ed7c46b0912958c05de146dfa5066c

Download Submit
C:\Windows\{6F4E36C6-E5C2-4c6b-B61F-BB11F8FF9A82}.exe

Filesize
216KB

MD5
05ccf0887cba86b358b96cdd76ba6f8c

SHA1
47b099ef35782ab3110c4380cf6d9b0b99cb20ab

SHA256
d9dba4f761425c157f9e7677a78204357eec406cbe365e2f91f58ddb67ee3487

SHA512
0641c16d6ad31019f39d371b7f636a622971ffd10744999bd772038c3b01a1a00e194797ad14b2c71f26819f1022882e2bc5eebbb38aa2ee6303f940e97504bb

Download Submit
C:\Windows\{7FD6F2F7-FBB9-4535-A27A-3A977E708E9B}.exe

Filesize
216KB

MD5
945a275186d5a50653690f8c57bd687f

SHA1
e18ef16624cdd30cdf8191d596753cc1678dbe12

SHA256
4433f2acd94daf9288e9d8ba7c5ac87dbf7673900b661e369c5ce2f00673df33

SHA512
41a41463aa149e4db1c095f44e4a6e21592adce6bb23faf4e054e49dc7f80e0de2910b2a52a806dc1c781374f74ee8916979f38b1db161396c9b9665a38551a4

Download Submit
C:\Windows\{919F5796-EC7A-4917-8105-B5DFF2ECD7FA}.exe

Filesize
216KB

MD5
7f57c2e8ade84b266de194c5a0effa49

SHA1
2ddde77a7807125a903420d199ac6241d0e2748f

SHA256
7b4d4696de3f081790be38b5849b272c13a1506104be4c9b9d8bd2712aebe1aa

SHA512
bbb47557b90f17bf75d74d694d5a99d8aee51b3a366c00e78e401ea508da8f9b19ed96bcb9790b84fdc0fc4b4d9f47c8b98eadb742811304034f83120826f899

Download Submit
C:\Windows\{9F94BA50-7859-49e6-A64B-BB455137290B}.exe

Filesize
216KB

MD5
faae6f8418a0893501424f428e94faad

SHA1
ec1589461094687968fdaf4cb43c4b116157d2bd

SHA256
970ad12840b5854acd34375409ec3dce4584124c7c88b64e9462adc34a598404

SHA512
22cd484285d3e03a4234fb608f1f09a2c0a5dd3f96b8a1e60f3f91ad59197faaba0c8e5cd141ce4ad7fa4f44ec99a1a61cf45fb3bd0435fdffbb28ee1bd3087a

Download Submit
C:\Windows\{AED18765-0341-400d-A57A-7A5B92A1735B}.exe

Filesize
216KB

MD5
26efd5f6cf54ad0d65857f5bc4c34c6c

SHA1
8fa46816ed50eb23b93e281a97c4ef038ea220e2

SHA256
60a96e95889985f3895e0a360db89499d187fbae81d2c6093bc51031222f65d0

SHA512
8b338a13a3b44fbc8671274431c04e3b691d63562d3fba0a4ee99fdd2c14f4065c41f7b049015156942c88285120572f7039538381b9eff2dc083e5be6afaa13

Download Submit
C:\Windows\{B71DBB69-B31B-463a-BA53-50E85BAF0013}.exe

Filesize
216KB

MD5
cce3f6058f34e3de9ba42c74b82907b8

SHA1
29cd143dd5a1088374730a5ff1cfb18fc8caa37a

SHA256
eb686e7a5f835f9797c2dd9d62fad6baaebb80ea6ee03f966d174e57b7942849

SHA512
3a22f83c02538df785595698d144ca0f369a602ef3c65dc319f85960e0b2321adaa26d67eafc9138586ec28f981a911ef55cdffe2dc613488f6a1cc7675296be

Download Submit
C:\Windows\{C5BFABC6-1A44-413b-99D7-C3F348E865E8}.exe

Filesize
216KB

MD5
3591f9dbe05854345a284892602a79fe

SHA1
8b6c2d70ac0d7924516eb43c589331bd2cfee432

SHA256
dc257e7d3b30d331be4aba806e7ec148ae9a7dddc1111c8d46b74f4156d496e9

SHA512
496f2406159e5d82c5ca84ed3a0005dcb35f5a9662886ada85eb69b41fb76af1623c6383888c0725dfbb6451099278f768294a17581278582549a5f85a1b110d

Download Submit
C:\Windows\{D843F395-726E-4382-83F3-F869A322623C}.exe

Filesize
216KB

MD5
e9d55abc11015bfbac453199766a57fd

SHA1
a86e0a0f87d292febe003f63ce21e10773b95061

SHA256
8c9db618e942fd5346df7259dfd6d4c34dcfd2a49aa6db3fa81bf1367aaf6fe2

SHA512
adfebf4b3ce45dd00cec3b9a171a4f2d9a16a17b1b4256f2d1abe15e516c907ce187b0fe35fcfe514d147ab46a6720df8fa507baa22679c7d5999f07f5696891

Download Submit
C:\Windows\{EBD0C084-20CF-4da5-8C91-45B58AD25BB1}.exe

Filesize
216KB

MD5
a865228ce74a8a8c22878e12c1786926

SHA1
d80874a0ebbef4984cb48a1203032f90a3b13177

SHA256
f2c86a8a90bc3d1758c5d3158795cf544103b8fd3c7cb0ba09049f6565a0fcbb

SHA512
d6235947414d48aa0e6e2b9d3946d6589347b985046a48a6200a10c36f5ace248e7f913282abaa2c76fc1c8d5cfd8f94f4dab04e5016a523db525a4f8ca2a130

Download Submit
C:\Windows\{ECE19E31-50E0-410a-92F1-48DB38ED61B9}.exe

Filesize
216KB

MD5
765f07102124cdb2444fc57eed7e07a6

SHA1
316d1d9cd1e60d8c6cf561be82b13184638b06ff

SHA256
9ece2aae1bd6900c44fdb2316641f3437d7470172a874015259063dcb53a1648

SHA512
768749d1f6d69bb40419d30f1f2a782963c0eff7670e6ecbb7aa8dd4d8f9061386b4e35a9c6432c3063c38974a5d5711f6b5b595878888a3c6b8de209af0a7a7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads