5be47f6cfa23c963c5c5b95cf30bf4d5822fa55df5b629858e6b0b681c0b2c6f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe
Size

197KB
MD5

8d258646807568a133177ae894ec4019
SHA1

92e35ae009764fc31fc44d6de546dfde293d3d57
SHA256

5be47f6cfa23c963c5c5b95cf30bf4d5822fa55df5b629858e6b0b681c0b2c6f
SHA512

01be30b5536ed9ab5c331871e0b9fec9c0daab8b4e23ab5d3bc33df9cb76bdd0da37cfa98af61d23b429efa6174a803a9612a1aa8c2d908a13e9e377a8be4333
SSDEEP

3072:jEGh0oel+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGklEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023209-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023212-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023218-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023212-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002167d-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000021681-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002167d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000711-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000719-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000711-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000739-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000739-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09B92D3F-5244-463c-90E5-7527742197B3}	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}\stubpath = "C:\\Windows\\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe"	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}\stubpath = "C:\\Windows\\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe"	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}\stubpath = "C:\\Windows\\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe"	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}\stubpath = "C:\\Windows\\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe"	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}\stubpath = "C:\\Windows\\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe"	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}\stubpath = "C:\\Windows\\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe"	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C981D3A7-27D8-4da8-AF72-9069200D44CD}\stubpath = "C:\\Windows\\{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe"	{09B92D3F-5244-463c-90E5-7527742197B3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09B92D3F-5244-463c-90E5-7527742197B3}\stubpath = "C:\\Windows\\{09B92D3F-5244-463c-90E5-7527742197B3}.exe"	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}\stubpath = "C:\\Windows\\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe"	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}\stubpath = "C:\\Windows\\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe"	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}\stubpath = "C:\\Windows\\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe"	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C981D3A7-27D8-4da8-AF72-9069200D44CD}	{09B92D3F-5244-463c-90E5-7527742197B3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E736341C-1F8F-462e-837D-291DF0C336D9}	{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E736341C-1F8F-462e-837D-291DF0C336D9}\stubpath = "C:\\Windows\\{E736341C-1F8F-462e-837D-291DF0C336D9}.exe"	{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe

Executes dropped EXE 12 IoCs

pid	Process
784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe
4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe
3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
4112	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
1228	{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe
2508	{E736341C-1F8F-462e-837D-291DF0C336D9}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
File created	C:\Windows\{09B92D3F-5244-463c-90E5-7527742197B3}.exe	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
File created	C:\Windows\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
File created	C:\Windows\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
File created	C:\Windows\{E736341C-1F8F-462e-837D-291DF0C336D9}.exe	{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe
File created	C:\Windows\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
File created	C:\Windows\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
File created	C:\Windows\{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	{09B92D3F-5244-463c-90E5-7527742197B3}.exe
File created	C:\Windows\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
File created	C:\Windows\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
File created	C:\Windows\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe
File created	C:\Windows\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe
Token: SeIncBasePriorityPrivilege	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
Token: SeIncBasePriorityPrivilege	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
Token: SeIncBasePriorityPrivilege	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
Token: SeIncBasePriorityPrivilege	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe
Token: SeIncBasePriorityPrivilege	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
Token: SeIncBasePriorityPrivilege	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe
Token: SeIncBasePriorityPrivilege	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
Token: SeIncBasePriorityPrivilege	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
Token: SeIncBasePriorityPrivilege	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
Token: SeIncBasePriorityPrivilege	4112	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
Token: SeIncBasePriorityPrivilege	1228	{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 784	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe	87
PID 4364 wrote to memory of 784	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe	87
PID 4364 wrote to memory of 784	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe	87
PID 4364 wrote to memory of 2508	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe	88
PID 4364 wrote to memory of 2508	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe	88
PID 4364 wrote to memory of 2508	4364	2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe	88
PID 784 wrote to memory of 3740	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	92
PID 784 wrote to memory of 3740	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	92
PID 784 wrote to memory of 3740	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	92
PID 784 wrote to memory of 4512	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	93
PID 784 wrote to memory of 4512	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	93
PID 784 wrote to memory of 4512	784	{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe	93
PID 3740 wrote to memory of 1212	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	96
PID 3740 wrote to memory of 1212	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	96
PID 3740 wrote to memory of 1212	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	96
PID 3740 wrote to memory of 4496	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	95
PID 3740 wrote to memory of 4496	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	95
PID 3740 wrote to memory of 4496	3740	{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe	95
PID 1212 wrote to memory of 4196	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	97
PID 1212 wrote to memory of 4196	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	97
PID 1212 wrote to memory of 4196	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	97
PID 1212 wrote to memory of 2520	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	98
PID 1212 wrote to memory of 2520	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	98
PID 1212 wrote to memory of 2520	1212	{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe	98
PID 4196 wrote to memory of 4120	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	99
PID 4196 wrote to memory of 4120	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	99
PID 4196 wrote to memory of 4120	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	99
PID 4196 wrote to memory of 4388	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	100
PID 4196 wrote to memory of 4388	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	100
PID 4196 wrote to memory of 4388	4196	{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe	100
PID 4120 wrote to memory of 1664	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	101
PID 4120 wrote to memory of 1664	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	101
PID 4120 wrote to memory of 1664	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	101
PID 4120 wrote to memory of 1412	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	102
PID 4120 wrote to memory of 1412	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	102
PID 4120 wrote to memory of 1412	4120	{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe	102
PID 1664 wrote to memory of 3128	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe	103
PID 1664 wrote to memory of 3128	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe	103
PID 1664 wrote to memory of 3128	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe	103
PID 1664 wrote to memory of 3964	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe	104
PID 1664 wrote to memory of 3964	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe	104
PID 1664 wrote to memory of 3964	1664	{09B92D3F-5244-463c-90E5-7527742197B3}.exe	104
PID 3128 wrote to memory of 2752	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	105
PID 3128 wrote to memory of 2752	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	105
PID 3128 wrote to memory of 2752	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	105
PID 3128 wrote to memory of 948	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	106
PID 3128 wrote to memory of 948	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	106
PID 3128 wrote to memory of 948	3128	{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe	106
PID 2752 wrote to memory of 4040	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	107
PID 2752 wrote to memory of 4040	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	107
PID 2752 wrote to memory of 4040	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	107
PID 2752 wrote to memory of 3036	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	108
PID 2752 wrote to memory of 3036	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	108
PID 2752 wrote to memory of 3036	2752	{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe	108
PID 4040 wrote to memory of 4112	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	109
PID 4040 wrote to memory of 4112	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	109
PID 4040 wrote to memory of 4112	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	109
PID 4040 wrote to memory of 2228	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	110
PID 4040 wrote to memory of 2228	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	110
PID 4040 wrote to memory of 2228	4040	{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe	110
PID 4112 wrote to memory of 1228	4112	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe	111
PID 4112 wrote to memory of 1228	4112	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe	111
PID 4112 wrote to memory of 1228	4112	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe	111
PID 4112 wrote to memory of 1844	4112	{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-11_8d258646807568a133177ae894ec4019_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
  C:\Windows\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
    C:\Windows\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{042AF~1.EXE > nul
      4⤵
      PID:4496
  - - C:\Windows\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
      C:\Windows\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe
        
        C:\Windows\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4196
      - C:\Windows\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
        
        C:\Windows\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\{09B92D3F-5244-463c-90E5-7527742197B3}.exe
        
        C:\Windows\{09B92D3F-5244-463c-90E5-7527742197B3}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
        
        C:\Windows\{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
        
        C:\Windows\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
        
        C:\Windows\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
        
        C:\Windows\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe
        
        C:\Windows\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EFA06~1.EXE > nul
        13⤵
        
        PID:3076
        
        C:\Windows\{E736341C-1F8F-462e-837D-291DF0C336D9}.exe
        
        C:\Windows\{E736341C-1F8F-462e-837D-291DF0C336D9}.exe
        13⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7675~1.EXE > nul
        12⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9307A~1.EXE > nul
        11⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA7C7~1.EXE > nul
        10⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C981D~1.EXE > nul
        9⤵
        
        PID:948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{09B92~1.EXE > nul
        8⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{68434~1.EXE > nul
        7⤵
        
        PID:1412
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B93B4~1.EXE > nul
        6⤵
        
        PID:4388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{90DBC~1.EXE > nul
        5⤵
        
        PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DC6CA~1.EXE > nul
    3⤵
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{042AF6B2-5A0C-4c50-A749-08A7CC38B84F}.exe

Filesize
197KB

MD5
c72182e577080eba23f3e24b3737a597

SHA1
df79a9b4c85ae27689b3e704454a14f1ddb14e70

SHA256
32331152f0d0c5ed47e23462b2f1893faee01ccfe86850c1196f36a7085a53a0

SHA512
8bfa1e8a452d8944f021e038ae25593f4a45e158fd29feee7911554f832c34907e0d4298d7ddb709de63ea3e00d74567865fcef160d06dae93654f31324280a2

Download Submit
C:\Windows\{09B92D3F-5244-463c-90E5-7527742197B3}.exe

Filesize
197KB

MD5
8718d18f23ea60e7777a381aca348af9

SHA1
cc3c1b7e325f66dec7cae9b74fbac6fa904b0ad8

SHA256
bb389ba863b4a2268d5eb6304aee82077e4b9fff7be241655ff4cb052772ccfe

SHA512
86c3c96195c402df26630197d995b330cc68b4f817f0aff9e58f80af8a9a7c08d2b3d4fc7b6b9b484b95aed11ee727d9919af5d0ae58cac9b2bd8dab60c0dd8c

Download Submit
C:\Windows\{68434D02-64E7-45d7-A7E9-8BFA31F7531B}.exe

Filesize
197KB

MD5
44844ae4b8a9ba16e7118d66c6113c6c

SHA1
7be8c581b22132c458b3f286673811f45fcdcb6d

SHA256
7a895edd493016c2de7cdeb46028b9e6c824e68f7af3467a406c68410e22f0df

SHA512
aa23d08a8931d4b8e8103eb22474abe66e3a7e774bc3f23538aca4175c35c0cb8e216589041d3db9e1dd539b8940b5efca5c125a9d65a41ed3da64412a2f7ef2

Download Submit
C:\Windows\{90DBC6F7-F571-4328-A1F1-9C31FB1B9457}.exe

Filesize
197KB

MD5
0b16ad064ffb386148e1d04dc963defd

SHA1
568ff82e6f510ad849a1c70162b3010f3047b26d

SHA256
3ed1df555b8c616386de2ff0adb8694afdcadbcb8dd4259d6a6ebdea0e0c709a

SHA512
7a449a71f6c83f1efc78687f18f5ef82382ddf8c92c6da50964234c4b7c7f1aea5f909539537b111a306fd0098921f44068810aab05224ac9cd0e61f5a4ef8e1

Download Submit
C:\Windows\{9307A8B2-8D7F-480f-9760-A84BC64FFAAC}.exe

Filesize
197KB

MD5
60b28596c33bbad4f56154bb1c94ad68

SHA1
bf3941cb165750fe93dd121f8f06ebe5637c2dd3

SHA256
40e06aa2ff9dc07fa2b3084666c31f7ffefb63f24d6c0bdd7fd8c554d829903f

SHA512
3807271c2765d554da1396d66468ad29aee5ee2665c71a4cc9d0fc30e3d38f3e22824f55d871baf5ee7e205177856e93fa079ae85cabddaec4074f66b58e0617

Download Submit
C:\Windows\{B93B409B-DE50-4a6b-B2FA-71891C83A62E}.exe

Filesize
197KB

MD5
c955fd2ec873feb1c73a208fc455a098

SHA1
52cf7771b67bcf015d6dfd468b80b48def9f72e7

SHA256
1bda969045613e0f38df0a27bc2fff39274479f716630998eccea43213ff492d

SHA512
480a64172fed6378e891fde329bebc7d83f268346d84c726c8e6e01716d51e80238b6a99050d61632762a26e147f85249e0b358ee19133dcb306b737c59ef510

Download Submit
C:\Windows\{C981D3A7-27D8-4da8-AF72-9069200D44CD}.exe

Filesize
197KB

MD5
5f86d4eb8b1a4494acf59ef9d59de66a

SHA1
eb4047fb93c8d421a7695e712ffdc3a721f583e1

SHA256
3f6e417bf414d0c1cda9c0a73cb328a8a81a5e73626a3c931c07449adb9335af

SHA512
b965919c609b2fd503032f61b77cbcad06835c23018c52e678647b7b0863e83462797b9f9f7e7f904c42d8ebc37079a912f6da9743f1ebb4a282f7af9083163c

Download Submit
C:\Windows\{CA7C71D2-999F-4fe4-BB4E-E5E49C363569}.exe

Filesize
197KB

MD5
b18e608eb3991a75d382315238631ac5

SHA1
8da1e8dc3c24f2ba9bb18056f14dd6b9e6af7896

SHA256
3f51eea2ef6233b546ecd9cb1b8c862305a66efacab481266163a51ba825bc98

SHA512
1877859f4a7a00c52bc51830babc203f662c627ef029975706c5a266a7c4238e2fe9e7595117d6aaf0aba1b1bd568c81710cb82b7415bf1a444e575b35710796

Download Submit
C:\Windows\{D76756A1-675A-4370-83E5-D4DFC0F67AC3}.exe

Filesize
197KB

MD5
78e83cda2c39c3a30ef36ecc8bd140b6

SHA1
cac94757ca45f75acd951d0dc6f04c42ef4dd465

SHA256
f19bba0129bf5ac0058cae053f9502309fc84d0f3171a4037892dcc42988a48a

SHA512
e8a143e53d2f67482ded0c9827defe429149f1397d008b5bbeec354546498acaac6e5d6676028b66fcfd4db4914d8e00c94f38f7a9aa711dcf2ba66950fd5cee

Download Submit
C:\Windows\{DC6CAF4E-AFF2-425d-A241-9089A99B7E66}.exe

Filesize
197KB

MD5
808a3a5291ca5e3bb6dca02f6273a482

SHA1
a090faea33ab91735ea32254a927e67a3354ae65

SHA256
7e7ac08f67ac1ca6d8ae4ca5e5ae61710cc72e3a09823c4d73be51969d13adb8

SHA512
3d272185650fdefc06ff0a3bddbf15eefbfd2e8d6b2323739ffe2eb75fb9d25852cb2975af708bd36e7a2ef9fd8a00aee73a480c4063653b0761bf0f77b60696

Download Submit
C:\Windows\{E736341C-1F8F-462e-837D-291DF0C336D9}.exe

Filesize
196KB

MD5
23e5a62cf797af50547692e25665365d

SHA1
0def5306765c5e67d13ee635a6285958746ca527

SHA256
12d059d74926037094b79944684016f1b822a01575aa7df2a84beb4bfa0567d3

SHA512
d61d81994e27c5fe60b526fc0da2dc26834d759b00c4faacbe17d0f53b245088686ca64b7efc56c835bf2241e384fc65940a8380a53721315c0aee4a396fdce6

Download Submit
C:\Windows\{E736341C-1F8F-462e-837D-291DF0C336D9}.exe

Filesize
93KB

MD5
10f37220cefab76d84acce41da7cb736

SHA1
8a987aee22e1a6a43667d223c636a47835826155

SHA256
0b956cc4b3d9ff354d154fc02e3d3c66a7b4ee692cf399156f3aa89251ae5316

SHA512
d490194f8f35133518dfe986004f1e50a1d333a3b74315b5755b8fbb7896457a36222f183dacfc346be8f00f35d5496dde4f3729364b0afb60fd4ea6c14fddb7

Download Submit
C:\Windows\{EFA06B3F-99CE-4622-9D5A-CC8461455C87}.exe

Filesize
197KB

MD5
d5a95b4f49443c3f003885c6f7ce77c4

SHA1
844bb481b57ea517bb81e959a5a788fad5b7fc3f

SHA256
a2a6b3d278485c7069baf5a32ea8dffd48d1784d44d6827c5ac0138431b252bc

SHA512
c0bf5cca26bce179751f26796b5c6ea31168b2819bfa81cc1d8e4d6d96bb66ac00517275533d30f5391411d462c661444e66c735f53d8992b10fef1208c98e71

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads