efb66c234a094d6c1f6c6740de9adecbd0a0cee76c28135a5e54e144e5b2949c

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe
Size

197KB
MD5

dca346791d85552a75a876387fc36147
SHA1

4fa413a57506a0e30a41f05ef23221d4fe5cd188
SHA256

efb66c234a094d6c1f6c6740de9adecbd0a0cee76c28135a5e54e144e5b2949c
SHA512

063a54e8a73ef8f07449fe65d40aa1b4dc51a7460b903eab3c3ffc77ee86495a92ca9decc20302d47cd29c8c67ab2a9e92d12545c0c70ae554e42cfb2857e376
SSDEEP

3072:jEGh0oPl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGZlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 14 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023126-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023126-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002312b-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023139-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002312b-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002312b-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023139-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000217fa-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000021876-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006df-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000006df-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B885624-253E-42c6-B9DF-0C1F75549201}	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{880D14C4-0ED4-4dc8-91A8-B747AB379815}	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}	{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}\stubpath = "C:\\Windows\\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}.exe"	{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C45713DB-348F-4434-80D0-02B6D7C03548}\stubpath = "C:\\Windows\\{C45713DB-348F-4434-80D0-02B6D7C03548}.exe"	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}\stubpath = "C:\\Windows\\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe"	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}\stubpath = "C:\\Windows\\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe"	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}\stubpath = "C:\\Windows\\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe"	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B885624-253E-42c6-B9DF-0C1F75549201}\stubpath = "C:\\Windows\\{1B885624-253E-42c6-B9DF-0C1F75549201}.exe"	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA52A91F-39CD-4599-9C9B-4E4130653D20}	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA52A91F-39CD-4599-9C9B-4E4130653D20}\stubpath = "C:\\Windows\\{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe"	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{880D14C4-0ED4-4dc8-91A8-B747AB379815}\stubpath = "C:\\Windows\\{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe"	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}\stubpath = "C:\\Windows\\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe"	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}\stubpath = "C:\\Windows\\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe"	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2F87CDC-9336-49fa-BC3A-1547B509F589}	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2F87CDC-9336-49fa-BC3A-1547B509F589}\stubpath = "C:\\Windows\\{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe"	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C45713DB-348F-4434-80D0-02B6D7C03548}	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}\stubpath = "C:\\Windows\\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe"	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe

Executes dropped EXE 12 IoCs

pid	Process
4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe
1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
1692	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
3772	{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe
4668	{3A7319FD-9331-4bfd-BB34-117F0F2E6064}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe
File created	C:\Windows\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
File created	C:\Windows\{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
File created	C:\Windows\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
File created	C:\Windows\{1B885624-253E-42c6-B9DF-0C1F75549201}.exe	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
File created	C:\Windows\{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
File created	C:\Windows\{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
File created	C:\Windows\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
File created	C:\Windows\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
File created	C:\Windows\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe
File created	C:\Windows\{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
File created	C:\Windows\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}.exe	{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
Token: SeIncBasePriorityPrivilege	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
Token: SeIncBasePriorityPrivilege	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
Token: SeIncBasePriorityPrivilege	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
Token: SeIncBasePriorityPrivilege	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
Token: SeIncBasePriorityPrivilege	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
Token: SeIncBasePriorityPrivilege	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
Token: SeIncBasePriorityPrivilege	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe
Token: SeIncBasePriorityPrivilege	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
Token: SeIncBasePriorityPrivilege	1692	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
Token: SeIncBasePriorityPrivilege	3772	{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4808	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe	84
PID 1484 wrote to memory of 4808	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe	84
PID 1484 wrote to memory of 4808	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe	84
PID 1484 wrote to memory of 4856	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe	85
PID 1484 wrote to memory of 4856	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe	85
PID 1484 wrote to memory of 4856	1484	2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe	85
PID 4808 wrote to memory of 1944	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	91
PID 4808 wrote to memory of 1944	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	91
PID 4808 wrote to memory of 1944	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	91
PID 4808 wrote to memory of 5056	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	92
PID 4808 wrote to memory of 5056	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	92
PID 4808 wrote to memory of 5056	4808	{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe	92
PID 1944 wrote to memory of 1576	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	96
PID 1944 wrote to memory of 1576	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	96
PID 1944 wrote to memory of 1576	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	96
PID 1944 wrote to memory of 4528	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	97
PID 1944 wrote to memory of 4528	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	97
PID 1944 wrote to memory of 4528	1944	{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe	97
PID 1576 wrote to memory of 1080	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	98
PID 1576 wrote to memory of 1080	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	98
PID 1576 wrote to memory of 1080	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	98
PID 1576 wrote to memory of 680	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	99
PID 1576 wrote to memory of 680	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	99
PID 1576 wrote to memory of 680	1576	{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe	99
PID 1080 wrote to memory of 784	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	100
PID 1080 wrote to memory of 784	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	100
PID 1080 wrote to memory of 784	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	100
PID 1080 wrote to memory of 1000	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	101
PID 1080 wrote to memory of 1000	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	101
PID 1080 wrote to memory of 1000	1080	{C45713DB-348F-4434-80D0-02B6D7C03548}.exe	101
PID 784 wrote to memory of 524	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	102
PID 784 wrote to memory of 524	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	102
PID 784 wrote to memory of 524	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	102
PID 784 wrote to memory of 3500	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	103
PID 784 wrote to memory of 3500	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	103
PID 784 wrote to memory of 3500	784	{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe	103
PID 524 wrote to memory of 3016	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	104
PID 524 wrote to memory of 3016	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	104
PID 524 wrote to memory of 3016	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	104
PID 524 wrote to memory of 4216	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	105
PID 524 wrote to memory of 4216	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	105
PID 524 wrote to memory of 4216	524	{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe	105
PID 3016 wrote to memory of 4076	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	106
PID 3016 wrote to memory of 4076	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	106
PID 3016 wrote to memory of 4076	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	106
PID 3016 wrote to memory of 4556	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	107
PID 3016 wrote to memory of 4556	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	107
PID 3016 wrote to memory of 4556	3016	{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe	107
PID 4076 wrote to memory of 1508	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	109
PID 4076 wrote to memory of 1508	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	109
PID 4076 wrote to memory of 1508	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	109
PID 4076 wrote to memory of 3256	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	108
PID 4076 wrote to memory of 3256	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	108
PID 4076 wrote to memory of 3256	4076	{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe	108
PID 1508 wrote to memory of 1692	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	111
PID 1508 wrote to memory of 1692	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	111
PID 1508 wrote to memory of 1692	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	111
PID 1508 wrote to memory of 1976	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	110
PID 1508 wrote to memory of 1976	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	110
PID 1508 wrote to memory of 1976	1508	{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe	110
PID 1692 wrote to memory of 3772	1692	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe	112
PID 1692 wrote to memory of 3772	1692	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe	112
PID 1692 wrote to memory of 3772	1692	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe	112
PID 1692 wrote to memory of 1204	1692	{1B885624-253E-42c6-B9DF-0C1F75549201}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_dca346791d85552a75a876387fc36147_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
  C:\Windows\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
    C:\Windows\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
      C:\Windows\{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
        
        C:\Windows\{C45713DB-348F-4434-80D0-02B6D7C03548}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
      - C:\Windows\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
        
        C:\Windows\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
        
        C:\Windows\{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
        
        C:\Windows\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe
        
        C:\Windows\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A45C~1.EXE > nul
        10⤵
        
        PID:3256
        
        C:\Windows\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
        
        C:\Windows\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0C1A8~1.EXE > nul
        11⤵
        
        PID:1976
        
        C:\Windows\{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
        
        C:\Windows\{1B885624-253E-42c6-B9DF-0C1F75549201}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe
        
        C:\Windows\{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
        
        C:\Windows\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}.exe
        
        C:\Windows\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}.exe
        13⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{880D1~1.EXE > nul
        13⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B885~1.EXE > nul
        12⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8840A~1.EXE > nul
        9⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA52A~1.EXE > nul
        8⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{841AC~1.EXE > nul
        7⤵
        
        PID:3500
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C4571~1.EXE > nul
        6⤵
        
        PID:1000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A2F87~1.EXE > nul
        5⤵
        
        PID:680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D1239~1.EXE > nul
      4⤵
      PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BCDE4~1.EXE > nul
    3⤵
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A45C47C-6EC6-4c39-A829-7B47C9340B8A}.exe

Filesize
197KB

MD5
f87c0fadfa808995ce4e095594fa26c7

SHA1
a117a60530483204fba1a2b9a39426bced06e5c6

SHA256
34a5fe4312940c2285c616c95144d85f0d8a6c596a51455b85e1be5d6a2bc8e7

SHA512
fb85536d287dce5e70f104d0d4d970ae085721d9d4c0cca3608e6523db9dc8f34c0daf64fabe78c26a100ee210afdbabcb37c5d360247cfb0afcf71f93331413

Download Submit
C:\Windows\{0C1A8A42-954F-43b7-B48F-BA87A68A71D8}.exe

Filesize
197KB

MD5
a09d2f277defa7f55984957c627e3914

SHA1
8209c9d98978641dd2375ec6faf824d6b113dd5e

SHA256
1d879c7a670da0c5c55d4a210af9dc8b159df2d928e85e9cf2a34c8e7fd050d9

SHA512
5a789af258e5e2d1dab6fb0e88c5c68d96bfd4b18367141be676504bf80200e1460b96dd8fbd398be4112ad46ab64dd237b97da29cf6f111af7c9a5e8418a58a

Download Submit
C:\Windows\{1B885624-253E-42c6-B9DF-0C1F75549201}.exe

Filesize
197KB

MD5
99accac2b99a35628014091044a09bf1

SHA1
7858218d82852006511c0ec66f7d5475cc36ccca

SHA256
76e227172f109b52dd7c30ee8996c8d141c78e9481853648ceb1f0486347d05f

SHA512
6bb905bcde184d66c6446d791e9540265a306ccebea3809f0061ecb9c65970f13f1ad19507915db6efa82d95f268faa38c600898ae07257f71354a69dda7ec6d

Download Submit
C:\Windows\{3A7319FD-9331-4bfd-BB34-117F0F2E6064}.exe

Filesize
197KB

MD5
f78a67191ccc2032b03ce03d10ea0ae6

SHA1
93752818d121271b37ade0439be8b0aa8cff79db

SHA256
02eeca737260df984effe98cb87a68d5fa7cf7ceb9ab9962af3ae6c8c1f3fa5f

SHA512
1f459d973a2cdb713eca1dad6500899da983ce7237b19add0740646198c742f8b68299f293eb0caf62b9f0f97abbce48324cd377848c323c310501a0881f827b

Download Submit
C:\Windows\{841AC65D-97EA-48fd-B2E7-BE8C7A98B935}.exe

Filesize
197KB

MD5
85bb3f88632911e89e4d6cf2023b8eea

SHA1
8edcad8102c3c88e213d3b5716a9fc627aca3170

SHA256
f971cb068d58a850bb4e040c06aa9665461e5bb501490664021de0113c917d7c

SHA512
cb1b6d30c4c3a12749e98d6aac3c6c3a19608a62f5a2c70d2da431d1fd8f622cd86f16ee769c303684a2ff97214a68310001073c3f08a35cb7d437b95cb496ef

Download Submit
C:\Windows\{880D14C4-0ED4-4dc8-91A8-B747AB379815}.exe

Filesize
197KB

MD5
e49dbda42cf9116e0a2504edc3996c3d

SHA1
d00b2220c213b1d46955be1a34ed220651a64ce1

SHA256
685a818b7b600f8a7c26f209a1c954774a3b84c31a716824111be73fad1363be

SHA512
694b753b64917a3fa7745bcbfb1a4a84a19c05276be423dc9c9a8b74901fa2ffcbef6bd775afcd51d295e3317c8bee44d4ea3c41220f8e7af49a4860ebd34f1e

Download Submit
C:\Windows\{8840AEDD-2B7E-4d4d-B514-95CB64947ED2}.exe

Filesize
197KB

MD5
827e048f2e61a12ab0a93f16b1fdb0bb

SHA1
c0367b67d81fded8678538a17bdf9a5304b49511

SHA256
37decc4025aacb9e089f212690fc7e419de6ef76b0543766a4cf016d6ea8e8c2

SHA512
2880165d6e9779a64f67a1cb156a9b302f0b954d2c35805d4a8992b67febd44356283bc0303e990f34bbe73acff2f9774e98f3904eab2d2556652dfb454c11e6

Download Submit
C:\Windows\{A2F87CDC-9336-49fa-BC3A-1547B509F589}.exe

Filesize
197KB

MD5
bb45e2f70cdd1ff66aea9cc1ae074259

SHA1
7e811cf91e34e0d22abf94255224548aed1291a9

SHA256
5c89797abb5d2c5616156348adedbe3758e833085de5cbe95eaaf78038cada90

SHA512
f7a7af0ba29f746a59f5938fc688b715919c8a9e428316d79d8f3ddca5434b32dba92ace0f95b62010df71861f69e10d973e40f4a14f437fb4bf63906695d4a7

Download Submit
C:\Windows\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe

Filesize
197KB

MD5
dcfc5e74cc01392624f7848b12b38aa6

SHA1
0083522dd53f87470e20afdfa28101ee0c0d5af9

SHA256
14c83520b3a26bcb184d98aebc83b625e2326f542c3dad91dc4389e4a0c1e1e2

SHA512
a9c56c2a4efd61f263879520f069e699542d711af96e79249dfe55bb960996534f82ba22271c9a1d1e8cc956499a52ce8b7717224a0396a2036c9b484fbae25f

Download Submit
C:\Windows\{BCDE40BA-BA88-419e-A8B7-AA927A39902B}.exe

Filesize
192KB

MD5
a957a53cf61504f1e517b352b7bac20c

SHA1
b92bf01c81f65b1ea3ea40ae891c71daa1fc10a1

SHA256
dd814fac6eeb878c7cc07b8be7ea1a3d4e8ab8e6fadaffd2e24e5275c5041ea3

SHA512
653a978adc915e4ae130ff9c2dbe57dff805ece6ed3bce523528a7219f741432bd325d7fe382c405aaacdfee6d9609e186981ea6dc4da9b07c8a1e39c5f0fd92

Download Submit
C:\Windows\{C45713DB-348F-4434-80D0-02B6D7C03548}.exe

Filesize
197KB

MD5
40ee73984c400342f46c2cc1c074af00

SHA1
bffcecc7cec02b2ee13d26232c1483ce21729ef0

SHA256
6ade7e07a1d1d74e242e1db1fe33364a077c305d08f85fa0237fd33032b44095

SHA512
dc835c1fc8e4e2adb6929c12e1873989a293859a61459d50c22f23b0826ab5acfd94b93ef9561d59e5d31914521e40b512becdae4dce795e8ddaf1a4249551e7

Download Submit
C:\Windows\{C45713DB-348F-4434-80D0-02B6D7C03548}.exe

Filesize
122KB

MD5
f1e770e0dbaca324cc93ce778fcc5d3c

SHA1
6a9cdc65f9a26f0464c4f98c41e0147522836050

SHA256
a9bb594a8f7194b55bc9a42c69a9b17b7a71c6f90547b7f4eff52c45c48ca4d6

SHA512
a3939daf040f04319b1387b81bb6377762212682def205a94f6317002d1e8a06071bc10b0f1f47a5b8346c34ce2b540bc48653c8a4e68ceb373390be1bbb8b9a

Download Submit
C:\Windows\{D12399FE-56F3-4be5-B835-3FBCEEAA3BE0}.exe

Filesize
197KB

MD5
8b4ee9066dba7fd4d7b5e7e5ac6ec680

SHA1
955c23d90d72232acd91dc9523b6d6c43baf4698

SHA256
ad18e0b9562c7d7bbe8166e1e712b6140fcd6d13de024ecc0757b9d29a13de0d

SHA512
a51230576eef75929e3882d635d859aedb9c3634a95d0f8a29796b9322759075d8a0bd75923e65df780372a19d9ae74bdbb222e02034521ae8047a8c3b997cfb

Download Submit
C:\Windows\{FA52A91F-39CD-4599-9C9B-4E4130653D20}.exe

Filesize
197KB

MD5
9ba6a5aef541d098c7051a40787befeb

SHA1
485927c6dcf27666b045c5a235b0283b07b9797e

SHA256
33f882e64e6482e0305c6b0aaf3994de5f164e36a81e18d47315bedb16f49b05

SHA512
7928ce05c4f685c97f1a509996755dbf5e13fda1e32d12145e0f54149e48bf8b4ec6f80980d55af184245f28dadd2921d4189b09cafd5b4b0fd41ec2dede9878

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads