367d8feabc74e951e518930a00f928bf8b9d1ea4f636dcb9d261bd71ffc4c3ff

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe
Size

168KB
MD5

0da3d763a7d434a71aef11d949301a2e
SHA1

489b2a114b56cb6b286d8ebe13c642b76f95f2a5
SHA256

367d8feabc74e951e518930a00f928bf8b9d1ea4f636dcb9d261bd71ffc4c3ff
SHA512

f37f618604bfc4e4bde287601b11c9db3d75b65bbb1a1d13c86c98b8d4cf7b5f8e4787347122a1a0b45e4f9fc9bf3d9fdb0326e9d395a95367844158e678aafd
SSDEEP

1536:1EGh0oqlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oqlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 14 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023205-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001000000002320a-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002314c-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002320a-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002320a-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002314c-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001300000002320a-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002314c-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001400000002320a-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000227d9-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000227d9-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023125-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002321e-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023125-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94285119-4970-4ff9-AFB5-171E14EAF55B}	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94285119-4970-4ff9-AFB5-171E14EAF55B}\stubpath = "C:\\Windows\\{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe"	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}\stubpath = "C:\\Windows\\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe"	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71CE7CE1-985E-4a3f-A7A2-95077972425F}	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66466EA2-87A9-430e-924E-1007AE9FC744}	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05BD9A60-83E8-45a6-8280-A64825F08910}	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F13DF09F-47E1-4698-B229-C10195EE63AD}	{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1DE0405-AEFD-465f-94C3-D5E30888A343}	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{857ECC63-9625-469d-9392-52234955644E}	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}\stubpath = "C:\\Windows\\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe"	{857ECC63-9625-469d-9392-52234955644E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}\stubpath = "C:\\Windows\\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe"	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F13DF09F-47E1-4698-B229-C10195EE63AD}\stubpath = "C:\\Windows\\{F13DF09F-47E1-4698-B229-C10195EE63AD}.exe"	{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}\stubpath = "C:\\Windows\\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe"	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{857ECC63-9625-469d-9392-52234955644E}\stubpath = "C:\\Windows\\{857ECC63-9625-469d-9392-52234955644E}.exe"	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66466EA2-87A9-430e-924E-1007AE9FC744}\stubpath = "C:\\Windows\\{66466EA2-87A9-430e-924E-1007AE9FC744}.exe"	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1DE0405-AEFD-465f-94C3-D5E30888A343}\stubpath = "C:\\Windows\\{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe"	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}	{857ECC63-9625-469d-9392-52234955644E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71CE7CE1-985E-4a3f-A7A2-95077972425F}\stubpath = "C:\\Windows\\{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe"	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05BD9A60-83E8-45a6-8280-A64825F08910}\stubpath = "C:\\Windows\\{05BD9A60-83E8-45a6-8280-A64825F08910}.exe"	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}\stubpath = "C:\\Windows\\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe"	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe

Executes dropped EXE 12 IoCs

pid	Process
412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
4776	{857ECC63-9625-469d-9392-52234955644E}.exe
1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe
3100	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe
1968	{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe
4144	{F13DF09F-47E1-4698-B229-C10195EE63AD}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
File created	C:\Windows\{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
File created	C:\Windows\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe
File created	C:\Windows\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe
File created	C:\Windows\{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
File created	C:\Windows\{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
File created	C:\Windows\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
File created	C:\Windows\{857ECC63-9625-469d-9392-52234955644E}.exe	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
File created	C:\Windows\{F13DF09F-47E1-4698-B229-C10195EE63AD}.exe	{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe
File created	C:\Windows\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	{857ECC63-9625-469d-9392-52234955644E}.exe
File created	C:\Windows\{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
File created	C:\Windows\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
Token: SeIncBasePriorityPrivilege	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
Token: SeIncBasePriorityPrivilege	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
Token: SeIncBasePriorityPrivilege	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
Token: SeIncBasePriorityPrivilege	4776	{857ECC63-9625-469d-9392-52234955644E}.exe
Token: SeIncBasePriorityPrivilege	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
Token: SeIncBasePriorityPrivilege	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
Token: SeIncBasePriorityPrivilege	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
Token: SeIncBasePriorityPrivilege	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe
Token: SeIncBasePriorityPrivilege	3100	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe
Token: SeIncBasePriorityPrivilege	1968	{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 412	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe	102
PID 812 wrote to memory of 412	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe	102
PID 812 wrote to memory of 412	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe	102
PID 812 wrote to memory of 3100	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe	101
PID 812 wrote to memory of 3100	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe	101
PID 812 wrote to memory of 3100	812	2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe	101
PID 412 wrote to memory of 2792	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	104
PID 412 wrote to memory of 2792	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	104
PID 412 wrote to memory of 2792	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	104
PID 412 wrote to memory of 2552	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	103
PID 412 wrote to memory of 2552	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	103
PID 412 wrote to memory of 2552	412	{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe	103
PID 2792 wrote to memory of 684	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	108
PID 2792 wrote to memory of 684	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	108
PID 2792 wrote to memory of 684	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	108
PID 2792 wrote to memory of 3356	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	107
PID 2792 wrote to memory of 3356	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	107
PID 2792 wrote to memory of 3356	2792	{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe	107
PID 684 wrote to memory of 1116	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	109
PID 684 wrote to memory of 1116	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	109
PID 684 wrote to memory of 1116	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	109
PID 684 wrote to memory of 2192	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	110
PID 684 wrote to memory of 2192	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	110
PID 684 wrote to memory of 2192	684	{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe	110
PID 1116 wrote to memory of 4776	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	112
PID 1116 wrote to memory of 4776	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	112
PID 1116 wrote to memory of 4776	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	112
PID 1116 wrote to memory of 1764	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	111
PID 1116 wrote to memory of 1764	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	111
PID 1116 wrote to memory of 1764	1116	{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe	111
PID 4776 wrote to memory of 1604	4776	{857ECC63-9625-469d-9392-52234955644E}.exe	114
PID 4776 wrote to memory of 1604	4776	{857ECC63-9625-469d-9392-52234955644E}.exe	114
PID 4776 wrote to memory of 1604	4776	{857ECC63-9625-469d-9392-52234955644E}.exe	114
PID 4776 wrote to memory of 4028	4776	{857ECC63-9625-469d-9392-52234955644E}.exe	115
PID 4776 wrote to memory of 4028	4776	{857ECC63-9625-469d-9392-52234955644E}.exe	115
PID 4776 wrote to memory of 4028	4776	{857ECC63-9625-469d-9392-52234955644E}.exe	115
PID 1604 wrote to memory of 4084	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	116
PID 1604 wrote to memory of 4084	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	116
PID 1604 wrote to memory of 4084	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	116
PID 1604 wrote to memory of 1960	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	117
PID 1604 wrote to memory of 1960	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	117
PID 1604 wrote to memory of 1960	1604	{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe	117
PID 4084 wrote to memory of 1920	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	119
PID 4084 wrote to memory of 1920	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	119
PID 4084 wrote to memory of 1920	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	119
PID 4084 wrote to memory of 1972	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	118
PID 4084 wrote to memory of 1972	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	118
PID 4084 wrote to memory of 1972	4084	{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe	118
PID 1920 wrote to memory of 4860	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	129
PID 1920 wrote to memory of 4860	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	129
PID 1920 wrote to memory of 4860	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	129
PID 1920 wrote to memory of 3292	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	128
PID 1920 wrote to memory of 3292	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	128
PID 1920 wrote to memory of 3292	1920	{66466EA2-87A9-430e-924E-1007AE9FC744}.exe	128
PID 4860 wrote to memory of 3100	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	130
PID 4860 wrote to memory of 3100	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	130
PID 4860 wrote to memory of 3100	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	130
PID 4860 wrote to memory of 3844	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	131
PID 4860 wrote to memory of 3844	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	131
PID 4860 wrote to memory of 3844	4860	{05BD9A60-83E8-45a6-8280-A64825F08910}.exe	131
PID 3100 wrote to memory of 1968	3100	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe	135
PID 3100 wrote to memory of 1968	3100	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe	135
PID 3100 wrote to memory of 1968	3100	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe	135
PID 3100 wrote to memory of 2684	3100	{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe	136

C:\Users\Admin\AppData\Local\Temp\2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_0da3d763a7d434a71aef11d949301a2e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3100
- C:\Windows\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
  C:\Windows\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CA29F~1.EXE > nul
    3⤵
    PID:2552
- - C:\Windows\{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
    C:\Windows\{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F1DE0~1.EXE > nul
      4⤵
      PID:3356
  - - C:\Windows\{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
      C:\Windows\{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Windows\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
        
        C:\Windows\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{783DB~1.EXE > nul
        6⤵
        
        PID:1764
      - C:\Windows\{857ECC63-9625-469d-9392-52234955644E}.exe
        
        C:\Windows\{857ECC63-9625-469d-9392-52234955644E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
        
        C:\Windows\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
        
        C:\Windows\{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71CE7~1.EXE > nul
        9⤵
        
        PID:1972
        
        C:\Windows\{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
        
        C:\Windows\{66466EA2-87A9-430e-924E-1007AE9FC744}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{66466~1.EXE > nul
        10⤵
        
        PID:3292
        
        C:\Windows\{05BD9A60-83E8-45a6-8280-A64825F08910}.exe
        
        C:\Windows\{05BD9A60-83E8-45a6-8280-A64825F08910}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe
        
        C:\Windows\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe
        
        C:\Windows\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Windows\{F13DF09F-47E1-4698-B229-C10195EE63AD}.exe
        
        C:\Windows\{F13DF09F-47E1-4698-B229-C10195EE63AD}.exe
        13⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31C00~1.EXE > nul
        13⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{57A20~1.EXE > nul
        12⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05BD9~1.EXE > nul
        11⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{956B0~1.EXE > nul
        8⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{857EC~1.EXE > nul
        7⤵
        
        PID:4028
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94285~1.EXE > nul
        5⤵
        
        PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05BD9A60-83E8-45a6-8280-A64825F08910}.exe

Filesize
41KB

MD5
47fa573657218da755aa8e71f5bec033

SHA1
b5a12fdd1022ddd8c0b5babd98235c73366cf8d5

SHA256
8b19a57aa6daa9ce9cd83a57385b41fd1ecdb90d59272d079f1c91f163751204

SHA512
8b845557d8fa09bd68fb5e2f23b87ad151d80fa4996e89daa96a48f126e9aeb9a647a572d5825535c2fda9210eaad9144060a9b99d29b0e61dc9a7421cb54ed2

Download Submit
C:\Windows\{05BD9A60-83E8-45a6-8280-A64825F08910}.exe

Filesize
7KB

MD5
1854fd76e98c7d47509ab2c5e3763d72

SHA1
6af4ff4407421b388dd8f942baccefcf3919d496

SHA256
fadc9dedaf8a185fd674b659b6d2e9149d1c36d54673b19944242766e86962a4

SHA512
c7c027728f4d1e1cb54ea39db975d6ab643a2d482f214ca391b0fb9ab700305a5d42e2fce92a2c113fb5c35e906a67cb4735e766f523a999351e627511fc0890

Download Submit
C:\Windows\{31C00A14-6F2B-4b70-9D47-6D1657F8EAE5}.exe

Filesize
168KB

MD5
7b80c6058f6158ce0d2f959f6b0fe8fb

SHA1
94173a22a6be92528bdb8840d65b9f5e3bbe16dc

SHA256
53ef27e91b6f8c6990745aa0061529efcaed8f3a333e17834ff2b20c6e5a0c37

SHA512
e66f356ea2136b5af95e6181c5ed4cea9a778b4a21dbb487cdf3f33b55a9ea8cc7cb10cf04549c3edea10acb27c3b277dadcde3df9d745e2534dac9d3ac1a3b7

Download Submit
C:\Windows\{57A20AAD-98CD-4b33-B681-FBB03D7E6A38}.exe

Filesize
168KB

MD5
2179cc88b7aba778ba8c656e7580f5d2

SHA1
b53a5a67884ae09fe4c3267fb5aa9b5e0e406936

SHA256
741c756e4a111e5d8e8e07fd09c6c07f72f77f342c390b7a588bac83a92fd027

SHA512
0cc20d5512dbb706700632ce9affbae908c262bc0c997936c7262bd67f45b3aa178b71dbf8a421ba9ec9b81d55eb814a6891cc60d45d55bfc1f3c032b4effdb2

Download Submit
C:\Windows\{66466EA2-87A9-430e-924E-1007AE9FC744}.exe

Filesize
168KB

MD5
4247387f3029b55e14ebf5d72ad2b6ad

SHA1
7a7de55925472b3a3992e5aa4cf6350d7ea5f29c

SHA256
d61aa5683c7b8f02b0ff76484a135978be8250c2b9802006b208677cdad093aa

SHA512
9f67240aa5f9241d78f6303cb1ea750d73f23036d4531ae6c373eb1ac99c106a7bc8b7780903c0e905fd9dedef0a84683df0d7942f353202d9f9ba5226b18ae3

Download Submit
C:\Windows\{71CE7CE1-985E-4a3f-A7A2-95077972425F}.exe

Filesize
168KB

MD5
9727d5d7e8393ee581a5b793de8b0abc

SHA1
f226b3f4cfb21b487541aa09225fd8e08f768179

SHA256
2367f9a7d0c198156b41129fdb4bb828dafdfcec575a0ccb3400e9aa5c5d81d3

SHA512
ff8f208d111997174702694163949e8a93e92ddf03eb7b7dbf1355cf4dfaff0633fb1e3899150059b3da099ed14333634fa26eb67236cf7b1ef95b72301617dd

Download Submit
C:\Windows\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe

Filesize
65KB

MD5
53ec6455c36f96c1d9685611cb36bc84

SHA1
619f29201cbe3536e45a19916dde02a386d93de0

SHA256
911819503cdc2bd928b94c433677f43a192ab2b95491cb7bc63685677f13afe6

SHA512
8dfad20e77b12faf6f3a42d7718f6dda67d2ebded81884ec8266585da2af5b7fbad40e2ba5ab89baa1963239654dbbf004093a25700251804ede8cfa2f799625

Download Submit
C:\Windows\{783DB2AB-A2C7-42a3-8E8D-B55054465EAB}.exe

Filesize
93KB

MD5
de2f252ff4d186cf6bd4f0aa6af63728

SHA1
7ea5f5d421a17ec53b8652d24f0be6dbd5b1605c

SHA256
a399ec4a6834eac7dc7eebd75f6263e35b2a345f9efc289d4ddbeb40e7367d14

SHA512
2a9d861badd360143de895f08cefc533531fff807471898e7f895410a83136b1226476ca40d2b1ebc6d2ee1fa141316f4cd51bc0a1da5c85f86cd4218be62c99

Download Submit
C:\Windows\{857ECC63-9625-469d-9392-52234955644E}.exe

Filesize
168KB

MD5
31867a4e00480b700a83971b7a9936fe

SHA1
81e237197b50344b712e34992701abd47e34bb53

SHA256
3208d0c92121a058b854cee152533392ed01249c9c9bc37c48553f3cc7c45a4b

SHA512
0094ab19cad2067cbf9dff605f5a3d6ef3dbe940fa1084f70a01bc46c377cf4f88cfb12026fa24b59633c69355ff9760dead16b404955bba550020074cbd369d

Download Submit
C:\Windows\{94285119-4970-4ff9-AFB5-171E14EAF55B}.exe

Filesize
168KB

MD5
0f6cf3ab9a7e8ca18f29fe2fc546a9e1

SHA1
73b3cd77be5b6f014cab01de63d2b21be42e6760

SHA256
dbeed4a9e67112590b0dc4c9dbad04108d40e4d13f370f0802400a653bfad18a

SHA512
071c9d41e8b3462f267fbff58413b04273c268473e3739d7081808e0bf12263f1c8462df840ff51d1c6e1735bc5de7a2db4825e21ab7246603b57548e922ae23

Download Submit
C:\Windows\{956B0C54-CA06-4b4f-8DEF-BFEC0DFC3A50}.exe

Filesize
168KB

MD5
cb0116e47b035865b10e8d283be98b56

SHA1
9780c9d22662f2d62bd3817afe0a69c0687e7a14

SHA256
3c959fdc80e3bf8f57bae834fe406a2fc891e53b12f07caaede5c95856cb4918

SHA512
7bf65c9141e9adc52892c9253b978d05cfb7cff56aa3f5ac552800763ef00c84e5fcc8c071dff0834e6eebbd184f6dbfdf2ab0545d3990b5c628b95fdc4f3573

Download Submit
C:\Windows\{CA29F0FC-1F89-4418-AA2B-ADFB8F2C5110}.exe

Filesize
168KB

MD5
eb47bc30ead5c698792066a63d4bff7a

SHA1
5ccc5e5e4fca83dec80919b5f884718879973f79

SHA256
929e3abb23063c85d977a86e072a5ad004c155dbfbaff83557ef8c43e9776c2e

SHA512
d79859ba94721feeb83af8602c33df01af69dd9c637a250309e6aac795dadd57ae2a48a95ebcaa13fbb96d1bde97a1db5798eea453af486057a0449c69c34494

Download Submit
C:\Windows\{F13DF09F-47E1-4698-B229-C10195EE63AD}.exe

Filesize
168KB

MD5
da2deb88cb8439c150e8fd6cfcadcd1f

SHA1
d5d0abde4158504da5f58aa7eaf16b3a1b03a1bb

SHA256
d7e070843d83b99057ef3ce82791b340394a43595dd48af1e7729e8aafc33c65

SHA512
24c5e258bd3f70061f37e9cc2c401c1a5ef4bb5ec623a2afbaaa4f094592b078abcacfcb7367a57dc3151373883bb603222842962ad9817f657f2300fe015cef

Download Submit
C:\Windows\{F1DE0405-AEFD-465f-94C3-D5E30888A343}.exe

Filesize
168KB

MD5
6e14e52078635374c2b77c14ea724c36

SHA1
3eee5e3f0346e49702248f2ac5480c947949983e

SHA256
0d5a9ad6d631fc01198324963e4f0efd7077debbb79f79e67ae77d081143992e

SHA512
24b290e9b4e646135c13c3e8c28bd54ed0e508853dd9f19f7f89f2935fca0c38b3adc323bb3e233f5e36b424ff914cb484c9169cee3b24cf44aa89c6b2ec377a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads