9765be7826adf144df01b85b2483b9a25e1618834e0af6222e18a65181865cc9

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe
Size

168KB
MD5

4848c742a84ccdfdb81fea25fbfbee7c
SHA1

7c46053d89f15df7d8360a064531c23369028ffa
SHA256

9765be7826adf144df01b85b2483b9a25e1618834e0af6222e18a65181865cc9
SHA512

500a3c073b939e7cb9ad3fcec1a402904b91215c8657880591a125e690425c1a60427518b97a42bbbccaa6ea3e111617fa13bb65ecb21138052c9718fb023ee8
SSDEEP

1536:1EGh0oNlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oNlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023136-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023142-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023148-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023142-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023148-17.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000217fa-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002181f-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006df-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000006df-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000006df-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}	{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}\stubpath = "C:\\Windows\\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe"	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38BE1493-E080-4998-8C76-7059F902D0C9}\stubpath = "C:\\Windows\\{38BE1493-E080-4998-8C76-7059F902D0C9}.exe"	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}\stubpath = "C:\\Windows\\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe"	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}\stubpath = "C:\\Windows\\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}.exe"	{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}\stubpath = "C:\\Windows\\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe"	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E67AE9D3-A531-469f-A6EB-430B64029E3E}	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E67AE9D3-A531-469f-A6EB-430B64029E3E}\stubpath = "C:\\Windows\\{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe"	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{027732C3-C658-4e3d-9557-BF0931AC1272}\stubpath = "C:\\Windows\\{027732C3-C658-4e3d-9557-BF0931AC1272}.exe"	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E79906EC-2C3C-4279-BB6E-CE406A59A367}	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}\stubpath = "C:\\Windows\\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe"	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}\stubpath = "C:\\Windows\\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe"	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}\stubpath = "C:\\Windows\\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe"	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{027732C3-C658-4e3d-9557-BF0931AC1272}	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38BE1493-E080-4998-8C76-7059F902D0C9}	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}\stubpath = "C:\\Windows\\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe"	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E79906EC-2C3C-4279-BB6E-CE406A59A367}\stubpath = "C:\\Windows\\{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe"	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe

Executes dropped EXE 11 IoCs

pid	Process
3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe
4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
4344	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe
3980	{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{38BE1493-E080-4998-8C76-7059F902D0C9}.exe	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
File created	C:\Windows\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
File created	C:\Windows\{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
File created	C:\Windows\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
File created	C:\Windows\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
File created	C:\Windows\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
File created	C:\Windows\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}.exe	{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe
File created	C:\Windows\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe
File created	C:\Windows\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
File created	C:\Windows\{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
File created	C:\Windows\{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe
File created	C:\Windows\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
Token: SeIncBasePriorityPrivilege	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
Token: SeIncBasePriorityPrivilege	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
Token: SeIncBasePriorityPrivilege	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
Token: SeIncBasePriorityPrivilege	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
Token: SeIncBasePriorityPrivilege	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
Token: SeIncBasePriorityPrivilege	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe
Token: SeIncBasePriorityPrivilege	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
Token: SeIncBasePriorityPrivilege	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
Token: SeIncBasePriorityPrivilege	4344	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3512	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe	86
PID 3448 wrote to memory of 3512	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe	86
PID 3448 wrote to memory of 3512	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe	86
PID 3448 wrote to memory of 224	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe	87
PID 3448 wrote to memory of 224	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe	87
PID 3448 wrote to memory of 224	3448	2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe	87
PID 3512 wrote to memory of 1368	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	93
PID 3512 wrote to memory of 1368	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	93
PID 3512 wrote to memory of 1368	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	93
PID 3512 wrote to memory of 2936	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	94
PID 3512 wrote to memory of 2936	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	94
PID 3512 wrote to memory of 2936	3512	{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe	94
PID 1368 wrote to memory of 2712	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	97
PID 1368 wrote to memory of 2712	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	97
PID 1368 wrote to memory of 2712	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	97
PID 1368 wrote to memory of 2304	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	96
PID 1368 wrote to memory of 2304	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	96
PID 1368 wrote to memory of 2304	1368	{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe	96
PID 2712 wrote to memory of 936	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	98
PID 2712 wrote to memory of 936	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	98
PID 2712 wrote to memory of 936	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	98
PID 2712 wrote to memory of 1228	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	99
PID 2712 wrote to memory of 1228	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	99
PID 2712 wrote to memory of 1228	2712	{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe	99
PID 936 wrote to memory of 1708	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	100
PID 936 wrote to memory of 1708	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	100
PID 936 wrote to memory of 1708	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	100
PID 936 wrote to memory of 2928	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	101
PID 936 wrote to memory of 2928	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	101
PID 936 wrote to memory of 2928	936	{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe	101
PID 1708 wrote to memory of 2292	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	102
PID 1708 wrote to memory of 2292	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	102
PID 1708 wrote to memory of 2292	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	102
PID 1708 wrote to memory of 2876	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	103
PID 1708 wrote to memory of 2876	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	103
PID 1708 wrote to memory of 2876	1708	{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe	103
PID 2292 wrote to memory of 2736	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	104
PID 2292 wrote to memory of 2736	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	104
PID 2292 wrote to memory of 2736	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	104
PID 2292 wrote to memory of 2188	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	105
PID 2292 wrote to memory of 2188	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	105
PID 2292 wrote to memory of 2188	2292	{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe	105
PID 2736 wrote to memory of 4232	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	106
PID 2736 wrote to memory of 4232	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	106
PID 2736 wrote to memory of 4232	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	106
PID 2736 wrote to memory of 3968	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	107
PID 2736 wrote to memory of 3968	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	107
PID 2736 wrote to memory of 3968	2736	{027732C3-C658-4e3d-9557-BF0931AC1272}.exe	107
PID 4232 wrote to memory of 2104	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	108
PID 4232 wrote to memory of 2104	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	108
PID 4232 wrote to memory of 2104	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	108
PID 4232 wrote to memory of 4964	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	109
PID 4232 wrote to memory of 4964	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	109
PID 4232 wrote to memory of 4964	4232	{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe	109
PID 2104 wrote to memory of 4344	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	110
PID 2104 wrote to memory of 4344	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	110
PID 2104 wrote to memory of 4344	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	110
PID 2104 wrote to memory of 4352	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	111
PID 2104 wrote to memory of 4352	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	111
PID 2104 wrote to memory of 4352	2104	{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe	111
PID 4344 wrote to memory of 3980	4344	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe	112
PID 4344 wrote to memory of 3980	4344	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe	112
PID 4344 wrote to memory of 3980	4344	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe	112
PID 4344 wrote to memory of 416	4344	{38BE1493-E080-4998-8C76-7059F902D0C9}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_4848c742a84ccdfdb81fea25fbfbee7c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
  C:\Windows\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
    C:\Windows\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B228B~1.EXE > nul
      4⤵
      PID:2304
  - - C:\Windows\{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
      C:\Windows\{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
        
        C:\Windows\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
        
        C:\Windows\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
        
        C:\Windows\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\{027732C3-C658-4e3d-9557-BF0931AC1272}.exe
        
        C:\Windows\{027732C3-C658-4e3d-9557-BF0931AC1272}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
        
        C:\Windows\{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
        
        C:\Windows\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\{38BE1493-E080-4998-8C76-7059F902D0C9}.exe
        
        C:\Windows\{38BE1493-E080-4998-8C76-7059F902D0C9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe
        
        C:\Windows\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3980
        
        C:\Windows\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}.exe
        
        C:\Windows\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}.exe
        13⤵
        
        PID:640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3F7DF~1.EXE > nul
        13⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{38BE1~1.EXE > nul
        12⤵
        
        PID:416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE562~1.EXE > nul
        11⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7990~1.EXE > nul
        10⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02773~1.EXE > nul
        9⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{363B3~1.EXE > nul
        8⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FFEDC~1.EXE > nul
        7⤵
        
        PID:2876
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1880~1.EXE > nul
        6⤵
        
        PID:2928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E67AE~1.EXE > nul
        5⤵
        
        PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E50E0~1.EXE > nul
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{027732C3-C658-4e3d-9557-BF0931AC1272}.exe

Filesize
168KB

MD5
88897483a5878e30b9895afcc808e09a

SHA1
9447b8c5f554767f5d621ed49c01c2e8105fce59

SHA256
b6b06a10442eec041aa5de214c50c4c50afd5a239e63051b9aedb601ccf4ffd7

SHA512
ee0abf88ecd9b47f2172027adf8bf6fe669833ae43fbd562b1736c0f852547d9763cd3aac9d2c6ca888d695da303893771e8786e3bd35b008de9fa053a503425

Download Submit
C:\Windows\{363B3CE7-C007-43ec-A5CB-9F299A1FFE77}.exe

Filesize
168KB

MD5
72892deb5f746b67ff002eb3a839d42d

SHA1
3a852fd3a26451bdcb3340553c3854ade181de31

SHA256
1afd29900bc78e9a5671deef4b69b312336923f4ba313c3b6a8173679339282d

SHA512
27156363f11562b25284dc41b56f92f2160037f0b08f7696b4032359d9f27c092419ea4e63c989a96dd38d264c402b8d1098748cc3ce7cfa018149ae433a69b6

Download Submit
C:\Windows\{38BE1493-E080-4998-8C76-7059F902D0C9}.exe

Filesize
168KB

MD5
7251c836c11f5c21afb8cfe19da055fa

SHA1
09c392f547b059fc5b2fdfffd21e1d39757ebefc

SHA256
4c2fae0dd7a59a9dbaa7b84ca1728135e8dcb9ce87d26a56ae4047af894dd803

SHA512
af5b13c12ae360e85b3f42e58778b859be5bd22fa4f940d81bf59c92d3a3daaa22ea1e33e30fc447febbe95a9b0c403a2374ba91dafc6cd185c0381f15239b1e

Download Submit
C:\Windows\{3F7DF79A-CB08-41b9-9CDC-6E2D001F1BCF}.exe

Filesize
168KB

MD5
bd6fa78df6aa72014431652d069fa7d7

SHA1
bd0cd16ff2aea667ec2a2bd6323b6b3fe54f68a6

SHA256
7f6fb5cf6058dd1ec30b8c7ca61c52f134c0a7d17e511682a65b511ceff42c50

SHA512
ed2d1db2d40ad8bb59cc9056ea42baf60d31d786b7cc53efb56fe1199f3b01a24a357a4550ebff9c62182c56130c20eb068545811deb3a13aaa937244804db57

Download Submit
C:\Windows\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}.exe

Filesize
102KB

MD5
c8ad8c946af6cd39c3cef173c8494b73

SHA1
17183a6b4ae1a0e566b18455643ffd155a0b3dce

SHA256
de2b6ed70639f8dccbb679bdcda6f4a5c1ccd6a05d4a1163d04429947ae0418f

SHA512
06e214a6a9710db675f85f1755503f5a47453d375c9de18619ac8f614bad1b26154e00d860dcdeac3b5645f2abcaf2edc655cb189f4d881266c9acf94fd28227

Download Submit
C:\Windows\{4F095006-9E51-4c6f-B492-E164C1DEA5EE}.exe

Filesize
17KB

MD5
ffd63eb93b0fc3a468a244fa2758a6dc

SHA1
4696991fc416c34399fc74d051bdb26a94080b82

SHA256
3c814194c591616e69e05e35d6a337f695b9bd17a57cd7c9db5a2a79405ff176

SHA512
98c5ecc3c4227bf81a1a76a3eb910f9cb47c86cde4af3fb0963ef2f6b48f67201c2c09ab55d143636a8ad6080b5a36b69bc0ee3589ea456d6221117b931ac6c8

Download Submit
C:\Windows\{B1880CA8-A969-44f1-B8E6-DD7A804E37FD}.exe

Filesize
168KB

MD5
74a56c6c9a552282c79d7a6dbbe5b93a

SHA1
37d285a80d770954f5ce21b78a2b5ece9855ccac

SHA256
7dbc914fb12f72719b618639930e66b582fbf25233e246b49ad2ae8f128e7790

SHA512
e670052c89a10c2cf2bf17154e47ec17310203961a2b44fa0d48dc1aeaaa49e201fa6f05dc5d6cdeb2745f94223b6142662a992ea6f5da988fd777aea04814f9

Download Submit
C:\Windows\{B228B7AF-1A72-404c-A9BF-39BC4F377E92}.exe

Filesize
168KB

MD5
6a1e9bfaef916fccb0e0d7691a2439eb

SHA1
f2623664ff3e8a7b27cd97a545ec12e6a2e664e9

SHA256
80b024c903e2cf2a67dde0fc4170ed5b6b038ef6f8e0892c714028e4c13956c9

SHA512
1be84cc536ce6d1856944ad67b070efcf773d81827967e200d78f12ec99b642404281d8fd93a5acbe7a1db1f75950aa83c75deaaaa9203624484f8fb61f54f62

Download Submit
C:\Windows\{DE5628F1-09B1-4b0e-BFEC-8402098DA0E9}.exe

Filesize
168KB

MD5
fa7d623c9732df87e246b8138f087a11

SHA1
989f12a77b9ad840c46729ea153002aeb62183dd

SHA256
ab299eca265155abd6538f50b3a92d3076bc622a037f8c64533227ae976ee038

SHA512
fa85431a06f442653be6225e59907d0a4aa001632745cc5f9533628f90e5f471fe2edeecf80ff09edfd3bcf9577a2b61b0686633b0f2193265a961046a57a73c

Download Submit
C:\Windows\{E50E0047-F98F-4bc7-BA67-007E72B3FA40}.exe

Filesize
168KB

MD5
31f0be6902cff6022676f4a2d4a98488

SHA1
5c14465e5bf9fdcea1f39fed83c9110ba05fe9c3

SHA256
aee3e80ed90203357b0a28bd8af24a99249b26a1e61f6e68ace1d779afd583cf

SHA512
a10a6884fa7b3a68b2e18bbe7536835b0b24880afd82291692f7508ff6d881d361c82d6e5bffec22f5bb1c850a49f79af6759cbdbebb5b0e6a0bcee5ae8bab4a

Download Submit
C:\Windows\{E67AE9D3-A531-469f-A6EB-430B64029E3E}.exe

Filesize
168KB

MD5
b2d8c7c98698a6ed998019fcfa58856f

SHA1
7b52beff208218dbe8c4e46d48ace49512fcd72a

SHA256
0201e1e71429c775be0af46420db490e7e3e0d3b5e1001e873e0b76b9bf26c56

SHA512
f3af2853461741fd7b4e20d2f263ef8421991f0aafe7d33a808ab4a45639919ebb7df197147630807f6ef5ddef7f7cf4a6cc5998839bbab0670958dfd7f48728

Download Submit
C:\Windows\{E79906EC-2C3C-4279-BB6E-CE406A59A367}.exe

Filesize
168KB

MD5
6eb63f5f5e8cb8143b3c5f1a1ca63bb3

SHA1
5c9ef27d18783b32ccc6d96b2f303554471f4867

SHA256
f99deccee085d5bd574bf5119a2ea7030fa0717a46966e92bf7d024d05e12d0d

SHA512
d92169b1988e982f7f15cf805825dec59a94175a8307badd32d19784ca0b69e5944c632501d12ad93866c2b1526183068c610b374ebb64b957310148804252cc

Download Submit
C:\Windows\{FFEDC662-7274-47d1-9F19-2AB8F3066A3B}.exe

Filesize
168KB

MD5
9fe42d133e2ddf1ae6f8ab8df4113ac9

SHA1
c7f53574136bf99b701082ab317e10bb8ad7850e

SHA256
5d63e0e7a43f37c1bb902e5b0cc4d1c03eed8ad9ab6f81604bbf4290f49c03e2

SHA512
cf2abab43b8d872523035f39bda70cb32a3287fcfcf692202c216829cf5edc54d03cf90b302d2635c14eed47d69ce3097fd9ae2cc7f36477ff6c64ebc0d38fa8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads