8598d672aa51aef99b6d01afaf3d21a7f2327898d8928d678aa844f0d7a030f5

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe
Size

204KB
MD5

4a3b522526cdc234bfb76c6987137247
SHA1

2eaa67efa2e16eefdb093a597ef44844b0f56109
SHA256

8598d672aa51aef99b6d01afaf3d21a7f2327898d8928d678aa844f0d7a030f5
SHA512

2fa4f9804e244fce535253c45987eb0f02dd427017673e62de3206741774e74a85106ab4dfbaa9396ff8177028720b5c36c6e085b3937e1c2cc18de1d23c54f2
SSDEEP

1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o5l1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00080000000234e6-1.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00120000000234e7-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023563-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00130000000234e7-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023567-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023568-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023567-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023571-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023567-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023571-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000234bf-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000234c2-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}\stubpath = "C:\\Windows\\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe"	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}\stubpath = "C:\\Windows\\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe"	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29F08E99-B664-4396-A662-B579CFCDEB67}	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B458657-CC8E-4540-8BB3-AB7512235251}\stubpath = "C:\\Windows\\{4B458657-CC8E-4540-8BB3-AB7512235251}.exe"	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59E998F1-3B29-4461-9165-4B12CD49FCE9}\stubpath = "C:\\Windows\\{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe"	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50E53D45-79F5-4aab-8612-7DA4063F7838}	{C921ED89-59B5-4314-9BC1-683DCD233886}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}\stubpath = "C:\\Windows\\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe"	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}	{068F58FA-94F6-4314-91C9-4D4983243806}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4920F098-CC45-4997-AF36-6A40F2411AF6}\stubpath = "C:\\Windows\\{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe"	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50E53D45-79F5-4aab-8612-7DA4063F7838}\stubpath = "C:\\Windows\\{50E53D45-79F5-4aab-8612-7DA4063F7838}.exe"	{C921ED89-59B5-4314-9BC1-683DCD233886}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29F08E99-B664-4396-A662-B579CFCDEB67}\stubpath = "C:\\Windows\\{29F08E99-B664-4396-A662-B579CFCDEB67}.exe"	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B458657-CC8E-4540-8BB3-AB7512235251}	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}\stubpath = "C:\\Windows\\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe"	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{068F58FA-94F6-4314-91C9-4D4983243806}	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{068F58FA-94F6-4314-91C9-4D4983243806}\stubpath = "C:\\Windows\\{068F58FA-94F6-4314-91C9-4D4983243806}.exe"	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}\stubpath = "C:\\Windows\\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe"	{068F58FA-94F6-4314-91C9-4D4983243806}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4920F098-CC45-4997-AF36-6A40F2411AF6}	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59E998F1-3B29-4461-9165-4B12CD49FCE9}	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C921ED89-59B5-4314-9BC1-683DCD233886}	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C921ED89-59B5-4314-9BC1-683DCD233886}\stubpath = "C:\\Windows\\{C921ED89-59B5-4314-9BC1-683DCD233886}.exe"	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe

Executes dropped EXE 12 IoCs

pid	Process
1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe
3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe
4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
5088	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe
2352	{C921ED89-59B5-4314-9BC1-683DCD233886}.exe
4056	{50E53D45-79F5-4aab-8612-7DA4063F7838}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{C921ED89-59B5-4314-9BC1-683DCD233886}.exe	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe
File created	C:\Windows\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe
File created	C:\Windows\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
File created	C:\Windows\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
File created	C:\Windows\{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
File created	C:\Windows\{068F58FA-94F6-4314-91C9-4D4983243806}.exe	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
File created	C:\Windows\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	{068F58FA-94F6-4314-91C9-4D4983243806}.exe
File created	C:\Windows\{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
File created	C:\Windows\{50E53D45-79F5-4aab-8612-7DA4063F7838}.exe	{C921ED89-59B5-4314-9BC1-683DCD233886}.exe
File created	C:\Windows\{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
File created	C:\Windows\{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
File created	C:\Windows\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
Token: SeIncBasePriorityPrivilege	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
Token: SeIncBasePriorityPrivilege	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
Token: SeIncBasePriorityPrivilege	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe
Token: SeIncBasePriorityPrivilege	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
Token: SeIncBasePriorityPrivilege	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
Token: SeIncBasePriorityPrivilege	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
Token: SeIncBasePriorityPrivilege	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe
Token: SeIncBasePriorityPrivilege	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
Token: SeIncBasePriorityPrivilege	5088	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe
Token: SeIncBasePriorityPrivilege	2352	{C921ED89-59B5-4314-9BC1-683DCD233886}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1488	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe	93
PID 1428 wrote to memory of 1488	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe	93
PID 1428 wrote to memory of 1488	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe	93
PID 1428 wrote to memory of 2800	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe	94
PID 1428 wrote to memory of 2800	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe	94
PID 1428 wrote to memory of 2800	1428	2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe	94
PID 1488 wrote to memory of 3168	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	95
PID 1488 wrote to memory of 3168	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	95
PID 1488 wrote to memory of 3168	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	95
PID 1488 wrote to memory of 4424	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	96
PID 1488 wrote to memory of 4424	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	96
PID 1488 wrote to memory of 4424	1488	{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe	96
PID 3168 wrote to memory of 1364	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	100
PID 3168 wrote to memory of 1364	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	100
PID 3168 wrote to memory of 1364	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	100
PID 3168 wrote to memory of 3388	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	101
PID 3168 wrote to memory of 3388	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	101
PID 3168 wrote to memory of 3388	3168	{29F08E99-B664-4396-A662-B579CFCDEB67}.exe	101
PID 1364 wrote to memory of 2460	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	102
PID 1364 wrote to memory of 2460	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	102
PID 1364 wrote to memory of 2460	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	102
PID 1364 wrote to memory of 2492	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	103
PID 1364 wrote to memory of 2492	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	103
PID 1364 wrote to memory of 2492	1364	{4B458657-CC8E-4540-8BB3-AB7512235251}.exe	103
PID 2460 wrote to memory of 3708	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	105
PID 2460 wrote to memory of 3708	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	105
PID 2460 wrote to memory of 3708	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	105
PID 2460 wrote to memory of 3676	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	106
PID 2460 wrote to memory of 3676	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	106
PID 2460 wrote to memory of 3676	2460	{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe	106
PID 3708 wrote to memory of 1132	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	107
PID 3708 wrote to memory of 1132	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	107
PID 3708 wrote to memory of 1132	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	107
PID 3708 wrote to memory of 4072	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	108
PID 3708 wrote to memory of 4072	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	108
PID 3708 wrote to memory of 4072	3708	{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe	108
PID 1132 wrote to memory of 4384	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	109
PID 1132 wrote to memory of 4384	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	109
PID 1132 wrote to memory of 4384	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	109
PID 1132 wrote to memory of 4976	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	110
PID 1132 wrote to memory of 4976	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	110
PID 1132 wrote to memory of 4976	1132	{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe	110
PID 4384 wrote to memory of 2400	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	117
PID 4384 wrote to memory of 2400	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	117
PID 4384 wrote to memory of 2400	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	117
PID 4384 wrote to memory of 1200	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	118
PID 4384 wrote to memory of 1200	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	118
PID 4384 wrote to memory of 1200	4384	{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe	118
PID 2400 wrote to memory of 4088	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe	119
PID 2400 wrote to memory of 4088	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe	119
PID 2400 wrote to memory of 4088	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe	119
PID 2400 wrote to memory of 968	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe	120
PID 2400 wrote to memory of 968	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe	120
PID 2400 wrote to memory of 968	2400	{068F58FA-94F6-4314-91C9-4D4983243806}.exe	120
PID 4088 wrote to memory of 5088	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	121
PID 4088 wrote to memory of 5088	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	121
PID 4088 wrote to memory of 5088	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	121
PID 4088 wrote to memory of 2964	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	122
PID 4088 wrote to memory of 2964	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	122
PID 4088 wrote to memory of 2964	4088	{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe	122
PID 5088 wrote to memory of 2352	5088	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe	126
PID 5088 wrote to memory of 2352	5088	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe	126
PID 5088 wrote to memory of 2352	5088	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe	126
PID 5088 wrote to memory of 976	5088	{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe	127

C:\Users\Admin\AppData\Local\Temp\2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_4a3b522526cdc234bfb76c6987137247_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
  C:\Windows\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
    C:\Windows\{29F08E99-B664-4396-A662-B579CFCDEB67}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
      C:\Windows\{4B458657-CC8E-4540-8BB3-AB7512235251}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Windows\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe
        
        C:\Windows\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
        
        C:\Windows\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
        
        C:\Windows\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
        
        C:\Windows\{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\{068F58FA-94F6-4314-91C9-4D4983243806}.exe
        
        C:\Windows\{068F58FA-94F6-4314-91C9-4D4983243806}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
        
        C:\Windows\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe
        
        C:\Windows\{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\{C921ED89-59B5-4314-9BC1-683DCD233886}.exe
        
        C:\Windows\{C921ED89-59B5-4314-9BC1-683DCD233886}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\{50E53D45-79F5-4aab-8612-7DA4063F7838}.exe
        
        C:\Windows\{50E53D45-79F5-4aab-8612-7DA4063F7838}.exe
        13⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C921E~1.EXE > nul
        13⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4920F~1.EXE > nul
        12⤵
        
        PID:976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CC6B1~1.EXE > nul
        11⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{068F5~1.EXE > nul
        10⤵
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59E99~1.EXE > nul
        9⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93A67~1.EXE > nul
        8⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{54AF9~1.EXE > nul
        7⤵
        
        PID:4072
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0469~1.EXE > nul
        6⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4B458~1.EXE > nul
        5⤵
        
        PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{29F08~1.EXE > nul
      4⤵
      PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B1983~1.EXE > nul
    3⤵
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{068F58FA-94F6-4314-91C9-4D4983243806}.exe

Filesize
204KB

MD5
1a0482493742fc0bdd4a3eef886d6b70

SHA1
151d177421ee07bc4e28b9ea0a1755c75b9d6d35

SHA256
dec4ab538d48adaa81a1f137f7ba845d167063abb6d57be7cdfd0e7fc9e8801a

SHA512
05d0171a5f3aa7fc7d5b546443f9a2429481fcd90a430441ec8ad05bc249d421f7f96ec537aeceb4d30791ff3966c8ee654231adbf61eb703b5a80c37ac21d25

Download Submit
C:\Windows\{29F08E99-B664-4396-A662-B579CFCDEB67}.exe

Filesize
204KB

MD5
65c6baba7b0cefb73c24d9451621b54b

SHA1
126bb5c4d9ec91c6ea6790d6950ce67f5d1278d7

SHA256
d06fe7aa40e48e5e7285696d1cc08af3ce6d1dd95b9fd909a8f62ecac7f92d95

SHA512
fc7b6df9d93a9b8b88d80c59fd713e12e0f104409321c0b7c85b734a6a7aa9394386d91a53c7582b66cd615afbdec797397d27b55bc5b12fde0046b075796453

Download Submit
C:\Windows\{4920F098-CC45-4997-AF36-6A40F2411AF6}.exe

Filesize
204KB

MD5
5f5ba33f1d4cd85c4eec8d483259704f

SHA1
5372d7e658ef87b309c9b4c2286d1b8b7dcdfcb3

SHA256
95cd7fe1e3ddff2df95f05ba7a604048a4eb9becb42bc4f25f52ac162966074c

SHA512
29b3426cb545875cdacee794430d45349e32aa5eb49fe834be4a34af536d2a68fc7193116b9999e08b91f1087f1c820a91b51c87b82820f2accee654784cd6af

Download Submit
C:\Windows\{4B458657-CC8E-4540-8BB3-AB7512235251}.exe

Filesize
204KB

MD5
c5fb658be6f3fae9dd6ebd928b9861b9

SHA1
89f67590e79dd43718f23abce09af5b718b7908d

SHA256
0556ea94be4920df084ffd338a5a9254a8ebcd9f9c1172ac8104dca467db5829

SHA512
9e9bfa2d70338770a3730d10bec5341168846b123e16d77bbbd3877dd5bf877578d2118f267b1d16cd6d7a9654087d535fbd0cbee8dc559db358f54c95d8ce5e

Download Submit
C:\Windows\{50E53D45-79F5-4aab-8612-7DA4063F7838}.exe

Filesize
204KB

MD5
7584a6c5cb7414a7d7a003d9835ca412

SHA1
ccba0d3c4e60795fd5d0806da857ce55a7ae5a4f

SHA256
8587eb6882dbab83b8ff85905c85e0ea07b3098d9d8e764c17de4c1bb0f103e4

SHA512
e0e7c7d4c91a175d2f271f8d7e9097c0f6975ad009b02196012c25a4cc13b2d36ea1c28d0fd63caf7af12a2194fdbe63390aae2fbd25bbbf5728fcabf8854908

Download Submit
C:\Windows\{54AF9467-35CE-4923-81E9-8EE8C37BBC49}.exe

Filesize
204KB

MD5
642ed3218b33a6f418066c3f7950eaf4

SHA1
0e8f5db597650610ec9a9a58b454e83bf8d4dc40

SHA256
cccb6c24421acf11b65a7122bd90f820658689fa7028d5b2c529a9702450cabc

SHA512
91494808c0ff8dd63f20db48f6df6ce863894d4e4fb1f39c658e9cd3515b4c1ddb405bb11ebf564e3b6fe801b950682f3205e69755575201916adaefa19344ba

Download Submit
C:\Windows\{59E998F1-3B29-4461-9165-4B12CD49FCE9}.exe

Filesize
204KB

MD5
f008015bfe20a65e4152073e2e262cff

SHA1
a6225065b7a6c4d6ad4301430d0738cf1bfdfdd9

SHA256
1c888af3a1a96063d2a865cfc549dac1607129253e96300e699a09613397ccbb

SHA512
3e10140b8e89c5519382deaad9f6488af61074ff868d01db3f91d98d4a904dcbfb118fbc907b684bf8474abc890601842bd9087bc0aca5670f38756fbd27b5c4

Download Submit
C:\Windows\{93A6732D-ADA1-49d4-9E6D-0D5F83ABF0E4}.exe

Filesize
204KB

MD5
d8daefdbc78c2ba81183151f3d544488

SHA1
eccc3d09461edc68ac369f6f9a08b8e7fc91c814

SHA256
923abeadc7ab19faea9b0edd14b8baa63d048b4399e33de9731f28b88d5cc351

SHA512
92f2eaf8e164b018d2cdbd2b7da29b2cf4d5b56f97e4e64257bc2ad08020f55a4bf6d2e3c17e19f2cc39733c199921488726a6e9ec4486e335b2ef9e060388bd

Download Submit
C:\Windows\{A046953E-0A75-4e6c-A2F8-C3DA0243C894}.exe

Filesize
204KB

MD5
43f1169b92012d5808ae886fc87d5760

SHA1
8ae385e85ba53c60fe9c03457f3dcdf18af5e41c

SHA256
51e3970469359d48cac32f459b50a02edda87b517dd3a43af478321d6311adcb

SHA512
9a676669529b1ce7df18bab2507b6f2cff1ceb01c18c701b92f2530ea9ba560ae60b3723123047e80663ada2f419418c980e320eb5f391c767dff3e30ef9c4a2

Download Submit
C:\Windows\{B198319E-F3BC-47c0-92FE-A8ED2A6C6D03}.exe

Filesize
204KB

MD5
e8b1f10db84ceb020298e02464bf3ef1

SHA1
aad1d23be41fea87dec9492cf1de1063183318c9

SHA256
2e906f5bf0f3b66e7217a8512ddda517a508797eb3a3a208a5bd732cf0f71de7

SHA512
fb64bcad79d9c4d6f2bde59b2d4a75dcf07c784cc67dae4c1afa1ba8c881a1aa584db2d3b695604772fb29d20e6779ba96bb0c32951dc6302a889cda41f432c3

Download Submit
C:\Windows\{C921ED89-59B5-4314-9BC1-683DCD233886}.exe

Filesize
204KB

MD5
d8872d2d3c05f712a328359b32016935

SHA1
e775447c8a3a0c013398d830cd1c83f5c8b0b140

SHA256
d82e871c044ba83ebb76dd0d4d3c30458c998f64d71d957f90383355f8eb1a73

SHA512
b890b8b437c9cbd5bbb14a0d0a89eefa8f4a2c91254850a0150a80f807e6758769ea73bcaeeb7ad2be99bc32c692ab489f36fc978e89989255b283e9b9c97cf9

Download Submit
C:\Windows\{CC6B1B26-6CCA-4750-9E74-DE4F8D13D15B}.exe

Filesize
204KB

MD5
a7eea97dc7459d413a0c87d10bae6051

SHA1
d89298b0b967adab3eb13805c80fd88abc069cc0

SHA256
fefb30438331da17932cf4ec332ba31bd711e3d8385e5a22c1f8ea0abfe5ac3e

SHA512
774c637f776ca71461a26105990b41a72b0a94a884de57ba3c5c1b822900406fe82d04119156e305168d76a93e91b3da9ce3eaebd567f1b3d7c3cc57e915d974

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads