b1f35a3a1f42ba940dd1d2af345963b6c96d312bd2c95edf0a6b25e97793a097

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe
Size

197KB
MD5

1ae09e21086541e8bdba42c3abdef102
SHA1

51b295a33ec89053a3637fe40c1b325fd91ea03f
SHA256

b1f35a3a1f42ba940dd1d2af345963b6c96d312bd2c95edf0a6b25e97793a097
SHA512

8addb071998a116f6fec1a69451b90d3adff391ad929052e1a8e8f5ae7cebf93033f294e647c45ad8079a1f8cad3174c107309a956dbac89c33fb73d09b10615
SSDEEP

3072:jEGh0ool+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGqlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023130-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001000000002321d-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023224-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002321d-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000215c9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000215d0-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000215c9-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000711-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000713-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000711-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000713-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000071d-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}\stubpath = "C:\\Windows\\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe"	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}\stubpath = "C:\\Windows\\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe"	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}\stubpath = "C:\\Windows\\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe"	{F52D07EB-6374-4553-B202-76995AED6D40}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32832589-EEFA-421b-BD52-3CB0D7CDED51}	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA85DFA7-8702-4aab-91D8-CE5103E00930}	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FE93482-9795-472c-80D8-833E8FE1DE1F}	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FE93482-9795-472c-80D8-833E8FE1DE1F}\stubpath = "C:\\Windows\\{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe"	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}\stubpath = "C:\\Windows\\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe"	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}\stubpath = "C:\\Windows\\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe"	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F52D07EB-6374-4553-B202-76995AED6D40}	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}\stubpath = "C:\\Windows\\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe"	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}	{F52D07EB-6374-4553-B202-76995AED6D40}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{635935D9-196B-4097-AE26-645505314352}	{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F52D07EB-6374-4553-B202-76995AED6D40}\stubpath = "C:\\Windows\\{F52D07EB-6374-4553-B202-76995AED6D40}.exe"	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA85DFA7-8702-4aab-91D8-CE5103E00930}\stubpath = "C:\\Windows\\{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe"	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{635935D9-196B-4097-AE26-645505314352}\stubpath = "C:\\Windows\\{635935D9-196B-4097-AE26-645505314352}.exe"	{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32832589-EEFA-421b-BD52-3CB0D7CDED51}\stubpath = "C:\\Windows\\{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe"	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}\stubpath = "C:\\Windows\\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe"	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe

Executes dropped EXE 12 IoCs

pid	Process
3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe
928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe
3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe
1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
3264	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
1952	{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe
4652	{635935D9-196B-4097-AE26-645505314352}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
File created	C:\Windows\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
File created	C:\Windows\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	{F52D07EB-6374-4553-B202-76995AED6D40}.exe
File created	C:\Windows\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe
File created	C:\Windows\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
File created	C:\Windows\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
File created	C:\Windows\{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
File created	C:\Windows\{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
File created	C:\Windows\{635935D9-196B-4097-AE26-645505314352}.exe	{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe
File created	C:\Windows\{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
File created	C:\Windows\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe
File created	C:\Windows\{F52D07EB-6374-4553-B202-76995AED6D40}.exe	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
Token: SeIncBasePriorityPrivilege	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
Token: SeIncBasePriorityPrivilege	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe
Token: SeIncBasePriorityPrivilege	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
Token: SeIncBasePriorityPrivilege	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
Token: SeIncBasePriorityPrivilege	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
Token: SeIncBasePriorityPrivilege	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe
Token: SeIncBasePriorityPrivilege	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe
Token: SeIncBasePriorityPrivilege	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
Token: SeIncBasePriorityPrivilege	3264	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
Token: SeIncBasePriorityPrivilege	1952	{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3208	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe	96
PID 848 wrote to memory of 3208	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe	96
PID 848 wrote to memory of 3208	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe	96
PID 848 wrote to memory of 1472	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe	97
PID 848 wrote to memory of 1472	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe	97
PID 848 wrote to memory of 1472	848	2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe	97
PID 3208 wrote to memory of 4880	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	98
PID 3208 wrote to memory of 4880	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	98
PID 3208 wrote to memory of 4880	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	98
PID 3208 wrote to memory of 2384	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	99
PID 3208 wrote to memory of 2384	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	99
PID 3208 wrote to memory of 2384	3208	{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe	99
PID 4880 wrote to memory of 3276	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	101
PID 4880 wrote to memory of 3276	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	101
PID 4880 wrote to memory of 3276	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	101
PID 4880 wrote to memory of 3092	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	102
PID 4880 wrote to memory of 3092	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	102
PID 4880 wrote to memory of 3092	4880	{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe	102
PID 3276 wrote to memory of 928	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	103
PID 3276 wrote to memory of 928	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	103
PID 3276 wrote to memory of 928	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	103
PID 3276 wrote to memory of 656	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	104
PID 3276 wrote to memory of 656	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	104
PID 3276 wrote to memory of 656	3276	{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe	104
PID 928 wrote to memory of 2720	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	105
PID 928 wrote to memory of 2720	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	105
PID 928 wrote to memory of 2720	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	105
PID 928 wrote to memory of 1500	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	106
PID 928 wrote to memory of 1500	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	106
PID 928 wrote to memory of 1500	928	{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe	106
PID 2720 wrote to memory of 4396	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	107
PID 2720 wrote to memory of 4396	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	107
PID 2720 wrote to memory of 4396	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	107
PID 2720 wrote to memory of 4404	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	108
PID 2720 wrote to memory of 4404	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	108
PID 2720 wrote to memory of 4404	2720	{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe	108
PID 4396 wrote to memory of 488	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	109
PID 4396 wrote to memory of 488	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	109
PID 4396 wrote to memory of 488	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	109
PID 4396 wrote to memory of 1112	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	110
PID 4396 wrote to memory of 1112	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	110
PID 4396 wrote to memory of 1112	4396	{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe	110
PID 488 wrote to memory of 3828	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	111
PID 488 wrote to memory of 3828	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	111
PID 488 wrote to memory of 3828	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	111
PID 488 wrote to memory of 2896	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	112
PID 488 wrote to memory of 2896	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	112
PID 488 wrote to memory of 2896	488	{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe	112
PID 3828 wrote to memory of 1596	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe	113
PID 3828 wrote to memory of 1596	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe	113
PID 3828 wrote to memory of 1596	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe	113
PID 3828 wrote to memory of 3608	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe	114
PID 3828 wrote to memory of 3608	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe	114
PID 3828 wrote to memory of 3608	3828	{F52D07EB-6374-4553-B202-76995AED6D40}.exe	114
PID 1596 wrote to memory of 3264	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	115
PID 1596 wrote to memory of 3264	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	115
PID 1596 wrote to memory of 3264	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	115
PID 1596 wrote to memory of 4668	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	116
PID 1596 wrote to memory of 4668	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	116
PID 1596 wrote to memory of 4668	1596	{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe	116
PID 3264 wrote to memory of 1952	3264	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe	117
PID 3264 wrote to memory of 1952	3264	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe	117
PID 3264 wrote to memory of 1952	3264	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe	117
PID 3264 wrote to memory of 1348	3264	{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_1ae09e21086541e8bdba42c3abdef102_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
  C:\Windows\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
    C:\Windows\{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe
      C:\Windows\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Windows\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
        
        C:\Windows\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:928
      - C:\Windows\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
        
        C:\Windows\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
        
        C:\Windows\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe
        
        C:\Windows\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Windows\{F52D07EB-6374-4553-B202-76995AED6D40}.exe
        
        C:\Windows\{F52D07EB-6374-4553-B202-76995AED6D40}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
        
        C:\Windows\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
        
        C:\Windows\{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe
        
        C:\Windows\{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BA85D~1.EXE > nul
        13⤵
        
        PID:1232
        
        C:\Windows\{635935D9-196B-4097-AE26-645505314352}.exe
        
        C:\Windows\{635935D9-196B-4097-AE26-645505314352}.exe
        13⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32832~1.EXE > nul
        12⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA9DE~1.EXE > nul
        11⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F52D0~1.EXE > nul
        10⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{826C4~1.EXE > nul
        9⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3BC1~1.EXE > nul
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1AD44~1.EXE > nul
        7⤵
        
        PID:4404
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81F4F~1.EXE > nul
        6⤵
        
        PID:1500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7083~1.EXE > nul
        5⤵
        
        PID:656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5FE93~1.EXE > nul
      4⤵
      PID:3092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C1C07~1.EXE > nul
    3⤵
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1AD4417E-57A3-410a-A9AB-E667AEDC9E3E}.exe

Filesize
197KB

MD5
3c0e299e73f94da079c0c41d73a0f031

SHA1
76e166f8fd64b7a84962ee041d4de9c512e55e98

SHA256
fe20b155f7dce39c9d03dbb883faca64f6881df24ca7711ffb293256e0f5fb4e

SHA512
d2008f2fb18d2da63ebedb02ac435225f08ed6b4a213f0e6d34bab8d3e9e429ca02e121ef924c84f3f203ab1d03e798269a636b657a0e3346d7ab436586856b2

Download Submit
C:\Windows\{32832589-EEFA-421b-BD52-3CB0D7CDED51}.exe

Filesize
197KB

MD5
0a354b4c66b17d55ce5011668d7ab182

SHA1
0c02cd7a23a91a3bffa62c8e741ed7be3538edda

SHA256
e0a4573d2dd4fb2f853fadbcdbc7fdde39551d670ffcdd1fd922def8bf6c3db4

SHA512
720d90a09a66f6c9f56a1277611f669b8eaf13a7180729333ed1744a03df8397ed86b3a1fb1ab3830dd338c1ea75e969cdf3744400b8f368495b9a289c282b3a

Download Submit
C:\Windows\{5FE93482-9795-472c-80D8-833E8FE1DE1F}.exe

Filesize
197KB

MD5
0e72c7c7d077e2b137c8c2d9ea7c1417

SHA1
032311226de457eea9ea55d61a8d803b2c8eaee8

SHA256
a1f6c552a153abd3904ba5b9b17b70368b14b8c6e55dbde86561ba7d98a238e0

SHA512
954dd18b048f0474399e60f504145135d4221b9cebd73ff2436e76a94d1e4d6850529953c71f1106efbdd791d9801b43da6f0ca9ee9d650edab243a94f3f1afb

Download Submit
C:\Windows\{635935D9-196B-4097-AE26-645505314352}.exe

Filesize
197KB

MD5
1fb19ad772087f46b075b3b1cab0ed90

SHA1
e1d3d88631b1e923fab24cb58f8b31bb4b0bbb74

SHA256
3ca1f094238c0bcbc26c3fd3e2ff2c04942c659a7c1756a20b63b3c0489ba440

SHA512
8a587f79dc4030eb9300804030cde55bf5ac27dcb1a43f4521c622ca374e243910c495fe56e0de3ff9e72384916c4bce6b71d504887d81fdcc349d53ff931314

Download Submit
C:\Windows\{81F4F8ED-A4BF-4f74-95EC-77D4BAB9B56C}.exe

Filesize
197KB

MD5
f0b1f62a077a8adc2c80f862596d4c5c

SHA1
8a16df0f6ee8e9507325183fc0099c5f0c5e4a43

SHA256
57a22a70ded0895c96916f3f1dd3ffe96f6a82203c18453795a388abc32da965

SHA512
b9f94d9084aa826ede5d707065cd544242ca93611a085cdff228b520b0a60684c151ecfd58966b1d57df2089fcd1789f822f1e4ef4cfdd803b2aed377df832bb

Download Submit
C:\Windows\{826C4DDB-7C11-46fe-81C3-64C7872A87BD}.exe

Filesize
197KB

MD5
081d68db2516bce012a951e5b2c04358

SHA1
c74bec56e0f307b85adb301255bac5dc3b9363eb

SHA256
d34edb7c74848efb07dd4667e87a90eb89bb4e9f156093062ea9162b0ec93c59

SHA512
5126fab64dd9c2354b0bd40afcb7f07abef3ec2a9b2b4f8bfdde5caadd4cc52652bc7deaac28803008dbea10f03247f795831f6f70d191fd089194dcd5a87626

Download Submit
C:\Windows\{BA85DFA7-8702-4aab-91D8-CE5103E00930}.exe

Filesize
197KB

MD5
f228d4b055fd84b2a12deda8b22aa4bc

SHA1
a66e3d066d0b74145781d2794b1baff3854ed5b6

SHA256
17d424eabcd2537de885deb6756d2df8958d44322eac2524d4631d32e8dac2dd

SHA512
90252f58fa85eb76996104da74d1346f534a13fd5a225f0f5b25cb7bf331010c95e6feb60ace6f062b45756d5c6ea3f551f114feb9b6fb638ce807962ce764d5

Download Submit
C:\Windows\{C1C071B5-32F1-4ab6-ACFC-4B2A544C83DB}.exe

Filesize
197KB

MD5
39660644eacd212cc44d1ea5f285ae91

SHA1
bfd673fd3d9beb756f1e89e14563a6a0c0364c31

SHA256
65b3219bb194b8b444335f061522e1758f5255bc5828fc0bb643352d6944658a

SHA512
f71e2490b60fa7618abc1f39279eafe2992c463ad7ec292b066ef0fbe3020674bfa0cb63df19c054b80fcc27eaaf1b023b94de0dee4406f89fd1f7ee7fa9e6e4

Download Submit
C:\Windows\{C708357B-C8AA-412d-B612-1C8A9B2FA85B}.exe

Filesize
197KB

MD5
b883c2216a8f74d25ec64e62bf71bcbe

SHA1
e3dc23df935861cc82769f7d8c783a0d092aaeb3

SHA256
6df6303962d0b73d46267ddaf86391410f15c111588fcfcd6f356edd3b9ffafd

SHA512
50b70350474a2d10313049b79dec530fbe0cab30626e4717a5e06b738ca2f1e2644f494e715959affbe98db0a377786b7724e0f223993fe9e9be13931330ec75

Download Submit
C:\Windows\{D3BC196B-B4ED-43b7-B290-6C8FB6564BEA}.exe

Filesize
197KB

MD5
67fd1156dc1d2d65491416f51ba6a028

SHA1
9585d23331238f51ff2d7fbedace9467337da334

SHA256
ccfd12ea7a2a9567ab73ed150c59fc3914a56c303d833f3233eb494a0b4adc81

SHA512
0525678ab27e7bfb189f54c27ef095b9203618329283908ea93e2c1867e39fe4474a406f274a269bbbc6e77e0b652ad0526dc1207fc0d5d44c5096c7e17418a6

Download Submit
C:\Windows\{EA9DEC90-C5F8-4202-A5D8-CC018207F648}.exe

Filesize
197KB

MD5
0a4263628369a78620e03f0e59a2fe25

SHA1
40706306d54c221d4ebeed60042536054fb5eee8

SHA256
c781930bb8582216a4fa99ef7413c182fc571940dbd03678cc65312459131c0f

SHA512
144254cd504aa9f19d02ef2dcb6c1d01c957143c23777827aa08ca9beaa9b532a6be3253b1fb8cad60c35debe785c5e8cfa6981792cd4f81578bca843d7782be

Download Submit
C:\Windows\{F52D07EB-6374-4553-B202-76995AED6D40}.exe

Filesize
197KB

MD5
7fc836611320eb4cf2c6713e3b2128cd

SHA1
8b84de9ad9a2cc85a5aa3b4d58268fb46b6e8df5

SHA256
bb23fe5f9fe17bd5f4ddeac8bf9ca4759ebc8c92002bc6fb9a8bdbc98b8220fc

SHA512
22af26173beb5d8d62196016da300ef2bfc89ab729d148bc05c3a9303ce5656ded1a6675fb8f553dd10b96421f877cb77d440e9da9ba4a1ab40e652ba823586d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads