d1cb33ed6c3086536f0372e351f4c5d461721f6d1beaf14e88ed67ce1f4f9ab7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Size

180KB
MD5

f004ba35380e50242981a5a106dd5bdd
SHA1

ac9608f34ec0725e06b96fb097c30fb62596cbff
SHA256

d1cb33ed6c3086536f0372e351f4c5d461721f6d1beaf14e88ed67ce1f4f9ab7
SHA512

af9f626fdcb8b748dc5bb766c6cee3889fe9e23e285bc96d0a9b1a1697286718a40ed0cb9ad78e81741da350c9f5df7b4157270ecc5714e6a43341444ddfe19c
SSDEEP

3072:jEGh0o9lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGHl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023227-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002321c-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002322e-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002321c-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000022043-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000022044-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000022043-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000709-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}\stubpath = "C:\\Windows\\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe"	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9910834F-51A8-42be-9442-F85F5F164437}	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56E25A67-13FD-4874-B9AB-808846FAD2E9}\stubpath = "C:\\Windows\\{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe"	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}\stubpath = "C:\\Windows\\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe"	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61B9230F-F114-4555-9AE9-5F2326F1B60E}\stubpath = "C:\\Windows\\{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe"	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51E61F2F-426F-46ff-8B09-903ED38CE48D}\stubpath = "C:\\Windows\\{51E61F2F-426F-46ff-8B09-903ED38CE48D}.exe"	{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA158564-A49B-4770-B676-E8CD50A8A03A}\stubpath = "C:\\Windows\\{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe"	{76496333-751B-43a4-9453-D842E70135D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}\stubpath = "C:\\Windows\\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe"	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9910834F-51A8-42be-9442-F85F5F164437}\stubpath = "C:\\Windows\\{9910834F-51A8-42be-9442-F85F5F164437}.exe"	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}\stubpath = "C:\\Windows\\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe"	{9910834F-51A8-42be-9442-F85F5F164437}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}\stubpath = "C:\\Windows\\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe"	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51E61F2F-426F-46ff-8B09-903ED38CE48D}	{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}	{9910834F-51A8-42be-9442-F85F5F164437}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}\stubpath = "C:\\Windows\\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe"	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76496333-751B-43a4-9453-D842E70135D4}	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76496333-751B-43a4-9453-D842E70135D4}\stubpath = "C:\\Windows\\{76496333-751B-43a4-9453-D842E70135D4}.exe"	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA158564-A49B-4770-B676-E8CD50A8A03A}	{76496333-751B-43a4-9453-D842E70135D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56E25A67-13FD-4874-B9AB-808846FAD2E9}	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61B9230F-F114-4555-9AE9-5F2326F1B60E}	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe

Executes dropped EXE 12 IoCs

pid	Process
2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
1088	{76496333-751B-43a4-9453-D842E70135D4}.exe
4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe
4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe
4700	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
1880	{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe
4024	{51E61F2F-426F-46ff-8B09-903ED38CE48D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
File created	C:\Windows\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
File created	C:\Windows\{9910834F-51A8-42be-9442-F85F5F164437}.exe	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
File created	C:\Windows\{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe
File created	C:\Windows\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
File created	C:\Windows\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
File created	C:\Windows\{76496333-751B-43a4-9453-D842E70135D4}.exe	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
File created	C:\Windows\{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	{76496333-751B-43a4-9453-D842E70135D4}.exe
File created	C:\Windows\{51E61F2F-426F-46ff-8B09-903ED38CE48D}.exe	{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe
File created	C:\Windows\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
File created	C:\Windows\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
File created	C:\Windows\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	{9910834F-51A8-42be-9442-F85F5F164437}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
Token: SeIncBasePriorityPrivilege	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe
Token: SeIncBasePriorityPrivilege	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
Token: SeIncBasePriorityPrivilege	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
Token: SeIncBasePriorityPrivilege	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
Token: SeIncBasePriorityPrivilege	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
Token: SeIncBasePriorityPrivilege	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
Token: SeIncBasePriorityPrivilege	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe
Token: SeIncBasePriorityPrivilege	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe
Token: SeIncBasePriorityPrivilege	4700	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
Token: SeIncBasePriorityPrivilege	1880	{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 2404	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	92
PID 3172 wrote to memory of 2404	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	92
PID 3172 wrote to memory of 2404	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	92
PID 3172 wrote to memory of 1324	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	91
PID 3172 wrote to memory of 1324	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	91
PID 3172 wrote to memory of 1324	3172	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	91
PID 2404 wrote to memory of 1088	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	93
PID 2404 wrote to memory of 1088	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	93
PID 2404 wrote to memory of 1088	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	93
PID 2404 wrote to memory of 4152	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	94
PID 2404 wrote to memory of 4152	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	94
PID 2404 wrote to memory of 4152	2404	{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe	94
PID 1088 wrote to memory of 4184	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe	97
PID 1088 wrote to memory of 4184	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe	97
PID 1088 wrote to memory of 4184	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe	97
PID 1088 wrote to memory of 4044	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe	96
PID 1088 wrote to memory of 4044	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe	96
PID 1088 wrote to memory of 4044	1088	{76496333-751B-43a4-9453-D842E70135D4}.exe	96
PID 4184 wrote to memory of 2076	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	98
PID 4184 wrote to memory of 2076	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	98
PID 4184 wrote to memory of 2076	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	98
PID 4184 wrote to memory of 1688	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	99
PID 4184 wrote to memory of 1688	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	99
PID 4184 wrote to memory of 1688	4184	{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe	99
PID 2076 wrote to memory of 2660	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	100
PID 2076 wrote to memory of 2660	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	100
PID 2076 wrote to memory of 2660	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	100
PID 2076 wrote to memory of 4884	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	101
PID 2076 wrote to memory of 4884	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	101
PID 2076 wrote to memory of 4884	2076	{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe	101
PID 2660 wrote to memory of 456	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	102
PID 2660 wrote to memory of 456	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	102
PID 2660 wrote to memory of 456	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	102
PID 2660 wrote to memory of 4976	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	103
PID 2660 wrote to memory of 4976	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	103
PID 2660 wrote to memory of 4976	2660	{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe	103
PID 456 wrote to memory of 1096	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	104
PID 456 wrote to memory of 1096	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	104
PID 456 wrote to memory of 1096	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	104
PID 456 wrote to memory of 3680	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	105
PID 456 wrote to memory of 3680	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	105
PID 456 wrote to memory of 3680	456	{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe	105
PID 1096 wrote to memory of 4640	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	106
PID 1096 wrote to memory of 4640	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	106
PID 1096 wrote to memory of 4640	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	106
PID 1096 wrote to memory of 2364	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	107
PID 1096 wrote to memory of 2364	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	107
PID 1096 wrote to memory of 2364	1096	{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe	107
PID 4640 wrote to memory of 4108	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe	108
PID 4640 wrote to memory of 4108	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe	108
PID 4640 wrote to memory of 4108	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe	108
PID 4640 wrote to memory of 5040	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe	109
PID 4640 wrote to memory of 5040	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe	109
PID 4640 wrote to memory of 5040	4640	{9910834F-51A8-42be-9442-F85F5F164437}.exe	109
PID 4108 wrote to memory of 4700	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	110
PID 4108 wrote to memory of 4700	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	110
PID 4108 wrote to memory of 4700	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	110
PID 4108 wrote to memory of 4208	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	111
PID 4108 wrote to memory of 4208	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	111
PID 4108 wrote to memory of 4208	4108	{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe	111
PID 4700 wrote to memory of 1880	4700	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe	112
PID 4700 wrote to memory of 1880	4700	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe	112
PID 4700 wrote to memory of 1880	4700	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe	112
PID 4700 wrote to memory of 4592	4700	{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1324
- C:\Windows\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
  C:\Windows\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\{76496333-751B-43a4-9453-D842E70135D4}.exe
    C:\Windows\{76496333-751B-43a4-9453-D842E70135D4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{76496~1.EXE > nul
      4⤵
      PID:4044
  - - C:\Windows\{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
      C:\Windows\{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
        
        C:\Windows\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Windows\{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
        
        C:\Windows\{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
        
        C:\Windows\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
        
        C:\Windows\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\{9910834F-51A8-42be-9442-F85F5F164437}.exe
        
        C:\Windows\{9910834F-51A8-42be-9442-F85F5F164437}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe
        
        C:\Windows\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
        
        C:\Windows\{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe
        
        C:\Windows\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
        
        C:\Windows\{51E61F2F-426F-46ff-8B09-903ED38CE48D}.exe
        
        C:\Windows\{51E61F2F-426F-46ff-8B09-903ED38CE48D}.exe
        13⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D1E75~1.EXE > nul
        13⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{61B92~1.EXE > nul
        12⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BF2F~1.EXE > nul
        11⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{99108~1.EXE > nul
        10⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{146A3~1.EXE > nul
        9⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1441A~1.EXE > nul
        8⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56E25~1.EXE > nul
        7⤵
        
        PID:4976
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C74B~1.EXE > nul
        6⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA158~1.EXE > nul
        5⤵
        
        PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9EC8A~1.EXE > nul
    3⤵
    PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1441A3C0-09E4-40b6-B0AF-FACC8A4557C8}.exe

Filesize
180KB

MD5
9fa559720c976d1249d405f0587fff50

SHA1
cdf581136daa29a7f8b69772b5288e5e53ae5ea3

SHA256
102460aaeda88e6caeba463f8ebb3be5a269920faa83c38dc4128a70e10628eb

SHA512
4ac26a2a5392b4645f79ae4834df900110857783476e7053587ecba8ccdf2bf72ba737b5b9f6795d583381aaa57a2a114c15c4145956ba99d0768ff7a3eab321

Download Submit
C:\Windows\{146A31F1-FFE2-43cc-AA6E-DB1BD39482CD}.exe

Filesize
180KB

MD5
eb2699b006356995c8add30125955a7d

SHA1
47a4bae991f330b8fab9c4cb2b03704ac8fb8c98

SHA256
187728eeab8b8d7a21afb134359d69988e07c4d441bd7e30183e2a8d4dff4bf9

SHA512
b4ea45ccffb46c899c61a80ead61f121eb5d3e03792e6be9b91293cfa857ab195c1c08b57d907d94d0cd4f685f11625cbb33b728c41185fa7c9b4ad40470d883

Download Submit
C:\Windows\{3BF2FDF4-C512-4740-A7A7-BCAE7776250E}.exe

Filesize
180KB

MD5
23b5ebe1e07ba53a095a66f953f35a15

SHA1
0fb15cbfa0e1c13452b3c287bdd3aaa7787f92aa

SHA256
d09fe71cf3bd419379c066bb26c306d0ee99afd8650d153e7651a4b1938ace25

SHA512
bfc84a526fafa6aaa23ac8145c81a51f283334823ef1c7c14615b779e506cdae035fb9a96875176efed25cdd0bc2e3b766ad8c082339853b8ad738dd8f8ef576

Download Submit
C:\Windows\{51E61F2F-426F-46ff-8B09-903ED38CE48D}.exe

Filesize
180KB

MD5
606256022650b29ea59ace4776cbe899

SHA1
8b86f07a553b05d29a2301bc8e4e11e277d53d78

SHA256
7d08530bc0915a9c670efb2d6948ff34c782e77944f8be35bae8dcd380a5e98d

SHA512
6c051819dd63caa459b0a3dbc9c3e5c20f3e0bfcdadd3a3928303941b1445f02660bf3bcd91f4e92b142baa22ccbb0e3d9cb26d03f9181fd34eab890d613d8ab

Download Submit
C:\Windows\{56E25A67-13FD-4874-B9AB-808846FAD2E9}.exe

Filesize
180KB

MD5
f63c4e9207f99521c4e2ad881afe2bda

SHA1
fe595b0eb43262850fa2c7755f4f6f42640838ca

SHA256
1c421c8abc5b8c42327e00272cc6a9b5607b6118a2e742786aa9d3ef0468ab3d

SHA512
33a9b79c512d93601ca8eaba3327218edcc99b2c0647f106a40b3e089e598ee5f108c3479894ef3dc901fb5c0e633b0fa495f0b628f94cb80721ead65d0107b9

Download Submit
C:\Windows\{61B9230F-F114-4555-9AE9-5F2326F1B60E}.exe

Filesize
180KB

MD5
faf38411853f5594fb9d11982e08c4bd

SHA1
009a8824a0794a3a5509fdf1a93196f5a5b21d4b

SHA256
090164923b64c7de4cdb279277ae36cd55b8c56bf8316815b5c34bcbfc99da15

SHA512
45fd0a1c3fb74161da543ff138df89a03c3dfd581183b701f0014395c7edbb9416904fc7398ad624a1bdefe64e05be0a49b799d73776789866b5b902218333d1

Download Submit
C:\Windows\{6C74B375-8F3A-4a04-8A9A-84ABB35356C4}.exe

Filesize
180KB

MD5
1aad250e43ca9238178cb7678a1df4a4

SHA1
9aafc1cb0b6bc6abe4aa263960422b5237202f7e

SHA256
0dd9d29debeb955595bd81c951c6d6d4426869d32163fad21e68f1e3be1fd35e

SHA512
b896771e762df65262e072eb2b0fe3832d365a476f3e4f41476580ffa7ff730d675a07662ecfbabc8006ddbc0b5d36ec87c26002deb7cc8baa2611a2b8ad75c2

Download Submit
C:\Windows\{76496333-751B-43a4-9453-D842E70135D4}.exe

Filesize
180KB

MD5
9396e6a6a4a0973a42521ebe6f5b3895

SHA1
0c671484a44f73662ccf5c4baff6d46db58ab2e7

SHA256
01026dd3460bdd5631f9eedd04ad15b80daa034b08ebc8ad9efbfb1922dce55a

SHA512
151259224db72a2fa09037d0c096da2282839e03075a240878f8f3fb9ac7fba7d7828193c29dba45d38ea10d465210179dc29b8cf94537ec013dac4ad9cb6410

Download Submit
C:\Windows\{9910834F-51A8-42be-9442-F85F5F164437}.exe

Filesize
180KB

MD5
27af6573ff8735fcc66cd10f7a898cd0

SHA1
c0fb4bf7900e8abfd50f0b654dd6293ddbb47011

SHA256
0e9b14fe115ba928b24d8a57d64a694a176dda5585e39abc2abd71ce6b274b67

SHA512
f6bf19ccdb4d4060336f8c546f142cca38cd8ea4e51709bcb7b42cbdd144e35a018499d5f2efe3425928355420f56842a3f5d6260b9d27672a94098a38427f54

Download Submit
C:\Windows\{9EC8A020-E129-4e45-A947-726B6FE7FB4A}.exe

Filesize
180KB

MD5
49ba31d0eea4f749e9c15aaff65c9ed3

SHA1
c7dad32cc4e75befdbe191db4fb9f4300bd857cc

SHA256
e0956f8b0e9390cf5ba3b99dab360bd23a3e808c63cc1b101f7cc141fcf75bf3

SHA512
a93cbb949cb592e29734e1451cafa1b9509271c3afe79730111b2b928468ad7a90f7a4ed90daaba5d6f2582b0a60adf7fb29cbb3dff0d7a5003b3e8583c9f2cc

Download Submit
C:\Windows\{D1E7561B-2CFA-47ff-8B20-2F8D4DE35D80}.exe

Filesize
180KB

MD5
e4f45356f884b8599b95ac96665962bb

SHA1
c422cff54f43274df5cd5e6ebad35c66cd0f2f78

SHA256
bbb104e71e81765ece7f4ff7074ccf970d1cffb236297b9fab8b4c23d66146f0

SHA512
9f08100a02bafe752860185f8fec951b36d246fb9b060e229db775d4755f83c81663041e723e60fc9908f6e0b7e032506e9b56f95a74fcde93ac96d5d471974d

Download Submit
C:\Windows\{EA158564-A49B-4770-B676-E8CD50A8A03A}.exe

Filesize
180KB

MD5
f46e482d48df4e992db809c09a0c9487

SHA1
8c7213504978bf577f31ba4210b3f4f946c593bd

SHA256
8c1e361f5593eb3275e648dc92b9bac5dbdf92311154c931082aa8f200bc6834

SHA512
0e1e0fc5518353b635f355bd7da3d71f5eb7733e956fe50f1a3fbbda03e7598c7e3651d2fa9e4863d363450011df34bd038f1911705b493e1ce18a96a333469d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads