6106faba29992c3359e54dd8c090fefec00ad505f393c54088151402e4e06165

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe
Size

197KB
MD5

de0e781a0c15e4170dd892d1b19a7b50
SHA1

0870e8878eced1fc239c571df8f53d6e1695275b
SHA256

6106faba29992c3359e54dd8c090fefec00ad505f393c54088151402e4e06165
SHA512

0715005fe00e27c09ba963dce1f47b35e6b4891a170543aab05601935a2f7c5f98a1a20ded3fe185456db0144a7ccf455e3816c543bc30bfd82f273e53cf8005
SSDEEP

3072:jEGh0oel+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGAlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023206-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001e464-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023214-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023215-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d92-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d93-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021d92-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006e1-45.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6026801E-6015-4f86-AA17-97F0C9DDB906}\stubpath = "C:\\Windows\\{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe"	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{431F6BED-8876-48ff-A739-3B2B56667757}	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{431F6BED-8876-48ff-A739-3B2B56667757}\stubpath = "C:\\Windows\\{431F6BED-8876-48ff-A739-3B2B56667757}.exe"	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}	{431F6BED-8876-48ff-A739-3B2B56667757}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6026801E-6015-4f86-AA17-97F0C9DDB906}	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}\stubpath = "C:\\Windows\\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe"	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6772407-09DF-4874-8E00-54ED559D53AE}	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}\stubpath = "C:\\Windows\\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe"	{431F6BED-8876-48ff-A739-3B2B56667757}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}\stubpath = "C:\\Windows\\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe"	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}	{3D970300-98EF-415c-A60A-116C7C1154D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}\stubpath = "C:\\Windows\\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe"	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}\stubpath = "C:\\Windows\\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe"	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D970300-98EF-415c-A60A-116C7C1154D7}	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}\stubpath = "C:\\Windows\\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe"	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6772407-09DF-4874-8E00-54ED559D53AE}\stubpath = "C:\\Windows\\{C6772407-09DF-4874-8E00-54ED559D53AE}.exe"	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}\stubpath = "C:\\Windows\\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe"	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D970300-98EF-415c-A60A-116C7C1154D7}\stubpath = "C:\\Windows\\{3D970300-98EF-415c-A60A-116C7C1154D7}.exe"	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}\stubpath = "C:\\Windows\\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}.exe"	{3D970300-98EF-415c-A60A-116C7C1154D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe

Executes dropped EXE 12 IoCs

pid	Process
2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe
4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe
3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
688	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
3976	{3D970300-98EF-415c-A60A-116C7C1154D7}.exe
5048	{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
File created	C:\Windows\{3D970300-98EF-415c-A60A-116C7C1154D7}.exe	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
File created	C:\Windows\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe
File created	C:\Windows\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe
File created	C:\Windows\{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
File created	C:\Windows\{431F6BED-8876-48ff-A739-3B2B56667757}.exe	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
File created	C:\Windows\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	{431F6BED-8876-48ff-A739-3B2B56667757}.exe
File created	C:\Windows\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
File created	C:\Windows\{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
File created	C:\Windows\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
File created	C:\Windows\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
File created	C:\Windows\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}.exe	{3D970300-98EF-415c-A60A-116C7C1154D7}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe
Token: SeIncBasePriorityPrivilege	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
Token: SeIncBasePriorityPrivilege	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
Token: SeIncBasePriorityPrivilege	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
Token: SeIncBasePriorityPrivilege	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe
Token: SeIncBasePriorityPrivilege	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
Token: SeIncBasePriorityPrivilege	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
Token: SeIncBasePriorityPrivilege	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
Token: SeIncBasePriorityPrivilege	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
Token: SeIncBasePriorityPrivilege	688	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
Token: SeIncBasePriorityPrivilege	3976	{3D970300-98EF-415c-A60A-116C7C1154D7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2988	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe	89
PID 1848 wrote to memory of 2988	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe	89
PID 1848 wrote to memory of 2988	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe	89
PID 1848 wrote to memory of 4516	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe	90
PID 1848 wrote to memory of 4516	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe	90
PID 1848 wrote to memory of 4516	1848	2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe	90
PID 2988 wrote to memory of 4976	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	93
PID 2988 wrote to memory of 4976	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	93
PID 2988 wrote to memory of 4976	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	93
PID 2988 wrote to memory of 492	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	94
PID 2988 wrote to memory of 492	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	94
PID 2988 wrote to memory of 492	2988	{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe	94
PID 4976 wrote to memory of 564	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	97
PID 4976 wrote to memory of 564	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	97
PID 4976 wrote to memory of 564	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	97
PID 4976 wrote to memory of 2704	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	96
PID 4976 wrote to memory of 2704	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	96
PID 4976 wrote to memory of 2704	4976	{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe	96
PID 564 wrote to memory of 1716	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	98
PID 564 wrote to memory of 1716	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	98
PID 564 wrote to memory of 1716	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	98
PID 564 wrote to memory of 3364	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	99
PID 564 wrote to memory of 3364	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	99
PID 564 wrote to memory of 3364	564	{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe	99
PID 1716 wrote to memory of 4716	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	100
PID 1716 wrote to memory of 4716	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	100
PID 1716 wrote to memory of 4716	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	100
PID 1716 wrote to memory of 5064	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	101
PID 1716 wrote to memory of 5064	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	101
PID 1716 wrote to memory of 5064	1716	{C6772407-09DF-4874-8E00-54ED559D53AE}.exe	101
PID 4716 wrote to memory of 3300	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe	102
PID 4716 wrote to memory of 3300	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe	102
PID 4716 wrote to memory of 3300	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe	102
PID 4716 wrote to memory of 3516	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe	103
PID 4716 wrote to memory of 3516	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe	103
PID 4716 wrote to memory of 3516	4716	{431F6BED-8876-48ff-A739-3B2B56667757}.exe	103
PID 3300 wrote to memory of 4720	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	104
PID 3300 wrote to memory of 4720	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	104
PID 3300 wrote to memory of 4720	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	104
PID 3300 wrote to memory of 4836	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	105
PID 3300 wrote to memory of 4836	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	105
PID 3300 wrote to memory of 4836	3300	{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe	105
PID 4720 wrote to memory of 4820	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	106
PID 4720 wrote to memory of 4820	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	106
PID 4720 wrote to memory of 4820	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	106
PID 4720 wrote to memory of 3296	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	107
PID 4720 wrote to memory of 3296	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	107
PID 4720 wrote to memory of 3296	4720	{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe	107
PID 4820 wrote to memory of 1728	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	108
PID 4820 wrote to memory of 1728	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	108
PID 4820 wrote to memory of 1728	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	108
PID 4820 wrote to memory of 3280	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	109
PID 4820 wrote to memory of 3280	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	109
PID 4820 wrote to memory of 3280	4820	{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe	109
PID 1728 wrote to memory of 688	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	110
PID 1728 wrote to memory of 688	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	110
PID 1728 wrote to memory of 688	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	110
PID 1728 wrote to memory of 2476	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	111
PID 1728 wrote to memory of 2476	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	111
PID 1728 wrote to memory of 2476	1728	{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe	111
PID 688 wrote to memory of 3976	688	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe	112
PID 688 wrote to memory of 3976	688	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe	112
PID 688 wrote to memory of 3976	688	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe	112
PID 688 wrote to memory of 3756	688	{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_de0e781a0c15e4170dd892d1b19a7b50_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe
  C:\Windows\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
    C:\Windows\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1BE20~1.EXE > nul
      4⤵
      PID:2704
  - - C:\Windows\{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
      C:\Windows\{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
        
        C:\Windows\{C6772407-09DF-4874-8E00-54ED559D53AE}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1716
      - C:\Windows\{431F6BED-8876-48ff-A739-3B2B56667757}.exe
        
        C:\Windows\{431F6BED-8876-48ff-A739-3B2B56667757}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
        
        C:\Windows\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
        
        C:\Windows\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
        
        C:\Windows\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
        
        C:\Windows\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
        
        C:\Windows\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\{3D970300-98EF-415c-A60A-116C7C1154D7}.exe
        
        C:\Windows\{3D970300-98EF-415c-A60A-116C7C1154D7}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
        
        C:\Windows\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}.exe
        
        C:\Windows\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}.exe
        13⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D970~1.EXE > nul
        13⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB3E8~1.EXE > nul
        12⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98D22~1.EXE > nul
        11⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ECADA~1.EXE > nul
        10⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56E0D~1.EXE > nul
        9⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4EF62~1.EXE > nul
        8⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{431F6~1.EXE > nul
        7⤵
        
        PID:3516
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6772~1.EXE > nul
        6⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{60268~1.EXE > nul
        5⤵
        
        PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DB275~1.EXE > nul
    3⤵
    PID:492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1BE20AEF-93CC-4235-9C2B-84163A6CAD98}.exe

Filesize
197KB

MD5
74a3b6ee0ffe94169d769892332a39b8

SHA1
3506e2a8e5f3185d0c7ba88048e736619811eec3

SHA256
97b5b2d4af70b5b1b6f14b02cc6f39a54987870b0162baa5cf434730393beacd

SHA512
d8fced3a470d2053cb956752f383d05edfb4def639863c2660ff104f8eae94cce38a4fcdafb1998e52d30f73b43dd0bd906957f279e401d18c842a29dded2614

Download Submit
C:\Windows\{3D970300-98EF-415c-A60A-116C7C1154D7}.exe

Filesize
197KB

MD5
e24f817655230d4a423c3cec7200219c

SHA1
20b81e2d5cbe6f348d8f5eaf23d6595cced6e608

SHA256
fbf7f99482df68e3b77b85ceda5215593124fed1e7aedc39a03ad2948f0e1022

SHA512
e39e8c4da871751e981ee618a118be268592c3f9f74475e81a0cd82e6eb2426fc6ea7aae94f5220ba2678b0160f196b8ffdd5e9693ec848cf7c0f9f87c8ab947

Download Submit
C:\Windows\{431F6BED-8876-48ff-A739-3B2B56667757}.exe

Filesize
197KB

MD5
c90cb1e7375c08dc6145d3a25ff4ad14

SHA1
4f706409936ac8a932a1ef733673408829678903

SHA256
41eaddf9965f0ef0cc56b3bc793b9967e16cdc3ab2f1b3e2510ac7395fbeb314

SHA512
1b5219ab095b54df6b97fdebef9b53cc34a9ee766c24f9aaf25e0d1d098515e498c71b94faf414250150c9e738b731557c836103406af29b18f7e6ddda0e7265

Download Submit
C:\Windows\{4EF62601-EF01-4cde-82A0-E8C3680EEF9A}.exe

Filesize
197KB

MD5
b54662682df501cacde95be4ca8588ae

SHA1
8cc18306b13b32434435f9851724592e78a308e6

SHA256
2db9351bb32c05f4f0506b65b128ff724c46626258df90f3619ee7b916e1ee75

SHA512
6b21ed071ddc50594e053144612fae82e32b1bc7443d639ed08ee45d59199ccc3dba14df139bbe89225dabafefdc108eeaa66332785db9098ec88bdcc876df72

Download Submit
C:\Windows\{56E0D9B9-B6AD-4b25-8850-40B44E9B1BFE}.exe

Filesize
197KB

MD5
4c1eb3a3db626f3668424984b38ffcb9

SHA1
a166af37b91dcfead56ff9425e59de51071078b7

SHA256
e0cc0a01d5be5ce88df335905026d218141bbe811f0a68e57488a8c0684be3b1

SHA512
a247b11b01c60a8aa95cccc3bbdf90b1c9f83a1b6ee5d990a1c46b1a491db7ca86c8b04f87d58869593ea56970ed6faa94e8741b9db5215610e2bf6b1e30b796

Download Submit
C:\Windows\{6026801E-6015-4f86-AA17-97F0C9DDB906}.exe

Filesize
197KB

MD5
864bb786dce3a413b061f35c0797a19c

SHA1
5258b93a40a240567be1a05b72aabcfa6f0c67b7

SHA256
50fb897faa39569cabf473e6907eabdbbb0c4c6c7cb49eaf54bc8680485a9ab2

SHA512
dc65e38ec0c9d7631013eca99a81c9aa20134ac9e76a60821b9383ac3b65f29ba1312856fa096a2cbcd2dc5ad79697f3ab122e5b98b7206aa9326958410f571d

Download Submit
C:\Windows\{98D22075-26FB-45c6-876D-1FDA24B3B9E2}.exe

Filesize
197KB

MD5
695f181511b4a37a98549bec9f1c6a66

SHA1
e618307dc80fcd574f731bc66c326225dc22cd88

SHA256
dbb3725f628cca5f669ea8020cb4b4c50599e83a5608757bf366edb716e49cbd

SHA512
9d9c48d530d6d9ec77ec7b1e67be06b7f0331cf47571c4bc40633623e743567096d88c65f49c7598dab0e51ad8d5f88c39dd8da33a8fbeffd0f70e02cc943170

Download Submit
C:\Windows\{C4F51D30-F116-4791-AB70-A44E3DC3ED0D}.exe

Filesize
197KB

MD5
124dc1c5874c45c309c214fd50f166a3

SHA1
8ccfab8a29d6f82d39bf1744362885ee18817c84

SHA256
d698a79443a6fe19a069ecb7de096c4596d9a8961e2a6bd95f66430f7d8ea6f0

SHA512
fc522b2f81fc851a658dc32a913a50e534cfb526480f194621b73b1a7fc88c60b679b405c2d5b93527060c481b537ccec13da15d9b0b9f899d3b22e624e80978

Download Submit
C:\Windows\{C6772407-09DF-4874-8E00-54ED559D53AE}.exe

Filesize
197KB

MD5
c66d807f63309eef1bf65b8baa5f5d60

SHA1
30051f529062527fc69f5599ea97908f12a03270

SHA256
1c47495e3d540a25841a6115babf05fc30535b535b989f22ba58f70077294a4a

SHA512
d3c2e845e2512b5af7f2122d78f70ab80a0ce0e66033c6f644b74e31627e434e9a81f9e1fa4b3839c88f42e30644c54b3be7ea026d2fa101c57c3927acc41ade

Download Submit
C:\Windows\{DB275AF5-B502-4f7e-B82D-A72CA20DFEEF}.exe

Filesize
197KB

MD5
9580d2275dee889de453388458279484

SHA1
3f7c38960c1dba6a886e9d5742e102da46fb4618

SHA256
b4c863bc104dfb4c856301af669021ba6b2bc5066db9416ee298d1f3a9c72519

SHA512
d77b068590174ae543585213488253c951688779312438bb1654fc5857640eca2c7fe8988b3a0b0afdf82329046ddcdc557e2cace5ca7016b6105ab40d2c36b2

Download Submit
C:\Windows\{ECADA4E0-9A2D-42a7-8BE1-A515E7213AE8}.exe

Filesize
197KB

MD5
c18ea79a27e7c674766e144e87f5caac

SHA1
1bb6b5aa32faee1f153782646690b8a7480138b4

SHA256
c9358b7777597941a1b0416bf440ad1156e489da2bf0dee96494e1d3998b7419

SHA512
29ae0ea1d60400855595ceaed1f1e2beb98b1f03a3bca0ead8bbf7c29c9d68a52857a7ff3b195c4c32476412f199aab1c6a7311527641f31d5eef269ac49cdd2

Download Submit
C:\Windows\{FB3E8343-6024-4990-9D6D-CEB9F79D0976}.exe

Filesize
197KB

MD5
8a4757aef1ed10bbe5cc32130c529885

SHA1
e8b2271ef3f135e2548d007bf911d64aba89938e

SHA256
fae3f2cac024a96807cdaeb5a2a1866303dd2ba29054f1168190d962d880371d

SHA512
0fdd3f01ecf1010688b849c92e1ae77db942b1cedf2e046d4f58f3dcd8b672bc8b0849aabb9f2b7a69f47931843c4c0a4a0061bf83cd83e85de937e4f9689545

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads