7bdd4f2471e13e4b3da3ea883a0475358d426160712f4a877e1b838b8a89bfdd

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe
Size

408KB
MD5

3d301fc4956d18fcc31ed3cba65c191f
SHA1

4fb3ea50eea4ad7ba7bb4f5dae42862cbbe4ce6a
SHA256

7bdd4f2471e13e4b3da3ea883a0475358d426160712f4a877e1b838b8a89bfdd
SHA512

aa91c9a58eac8521aeb36efb272587e058e56a20ad9fa8a2cca243960b63b01ae194aecaa8438f7a2af94494c5ae4715abc859d31b02ff4e453da543f665bb4b
SSDEEP

3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGWldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 18 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224e-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001224e-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000015c3c-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001224e-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001224e-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001224e-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001224e-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000f680-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001224e-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001224e-55.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000f680-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000f680-62.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001224e-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001224e-69.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001300000000f680-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}\stubpath = "C:\\Windows\\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe"	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}\stubpath = "C:\\Windows\\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe"	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}\stubpath = "C:\\Windows\\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe"	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ABB17D70-7B34-483a-B063-9F3720A9762F}\stubpath = "C:\\Windows\\{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe"	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3F891712-42F5-49fe-9A65-6A9CC763A208}	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{089E62B3-D658-44b8-B9FF-2E94FA89F247}	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}\stubpath = "C:\\Windows\\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}.exe"	{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3EF969A-2DF3-410d-8175-A8486C180840}\stubpath = "C:\\Windows\\{F3EF969A-2DF3-410d-8175-A8486C180840}.exe"	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}\stubpath = "C:\\Windows\\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe"	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{089E62B3-D658-44b8-B9FF-2E94FA89F247}\stubpath = "C:\\Windows\\{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe"	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}	{8122C62C-F31E-4836-B700-0C6462226588}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ABB17D70-7B34-483a-B063-9F3720A9762F}	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3F891712-42F5-49fe-9A65-6A9CC763A208}\stubpath = "C:\\Windows\\{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe"	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3EF969A-2DF3-410d-8175-A8486C180840}	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8122C62C-F31E-4836-B700-0C6462226588}	{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8122C62C-F31E-4836-B700-0C6462226588}\stubpath = "C:\\Windows\\{8122C62C-F31E-4836-B700-0C6462226588}.exe"	{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}\stubpath = "C:\\Windows\\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe"	{8122C62C-F31E-4836-B700-0C6462226588}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}	{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe

Deletes itself 1 IoCs

pid	Process
2424	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
2288	{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
1188	{8122C62C-F31E-4836-B700-0C6462226588}.exe
2244	{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe
1728	{91FCCEDF-0569-442a-A2D7-AEC117B7779E}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
File created	C:\Windows\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
File created	C:\Windows\{8122C62C-F31E-4836-B700-0C6462226588}.exe	{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
File created	C:\Windows\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}.exe	{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe
File created	C:\Windows\{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe
File created	C:\Windows\{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
File created	C:\Windows\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
File created	C:\Windows\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
File created	C:\Windows\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
File created	C:\Windows\{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
File created	C:\Windows\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe	{8122C62C-F31E-4836-B700-0C6462226588}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
Token: SeIncBasePriorityPrivilege	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
Token: SeIncBasePriorityPrivilege	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
Token: SeIncBasePriorityPrivilege	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
Token: SeIncBasePriorityPrivilege	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
Token: SeIncBasePriorityPrivilege	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
Token: SeIncBasePriorityPrivilege	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
Token: SeIncBasePriorityPrivilege	2288	{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
Token: SeIncBasePriorityPrivilege	1188	{8122C62C-F31E-4836-B700-0C6462226588}.exe
Token: SeIncBasePriorityPrivilege	2244	{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2688	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	28
PID 1692 wrote to memory of 2688	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	28
PID 1692 wrote to memory of 2688	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	28
PID 1692 wrote to memory of 2688	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	28
PID 1692 wrote to memory of 2424	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	29
PID 1692 wrote to memory of 2424	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	29
PID 1692 wrote to memory of 2424	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	29
PID 1692 wrote to memory of 2424	1692	2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe	29
PID 2688 wrote to memory of 2360	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	32
PID 2688 wrote to memory of 2360	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	32
PID 2688 wrote to memory of 2360	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	32
PID 2688 wrote to memory of 2360	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	32
PID 2688 wrote to memory of 2560	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	33
PID 2688 wrote to memory of 2560	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	33
PID 2688 wrote to memory of 2560	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	33
PID 2688 wrote to memory of 2560	2688	{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe	33
PID 2360 wrote to memory of 2348	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	34
PID 2360 wrote to memory of 2348	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	34
PID 2360 wrote to memory of 2348	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	34
PID 2360 wrote to memory of 2348	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	34
PID 2360 wrote to memory of 2408	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	35
PID 2360 wrote to memory of 2408	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	35
PID 2360 wrote to memory of 2408	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	35
PID 2360 wrote to memory of 2408	2360	{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe	35
PID 2348 wrote to memory of 1916	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	37
PID 2348 wrote to memory of 1916	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	37
PID 2348 wrote to memory of 1916	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	37
PID 2348 wrote to memory of 1916	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	37
PID 2348 wrote to memory of 528	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	36
PID 2348 wrote to memory of 528	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	36
PID 2348 wrote to memory of 528	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	36
PID 2348 wrote to memory of 528	2348	{F3EF969A-2DF3-410d-8175-A8486C180840}.exe	36
PID 1916 wrote to memory of 2188	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	38
PID 1916 wrote to memory of 2188	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	38
PID 1916 wrote to memory of 2188	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	38
PID 1916 wrote to memory of 2188	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	38
PID 1916 wrote to memory of 2652	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	39
PID 1916 wrote to memory of 2652	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	39
PID 1916 wrote to memory of 2652	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	39
PID 1916 wrote to memory of 2652	1916	{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe	39
PID 2188 wrote to memory of 2820	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	40
PID 2188 wrote to memory of 2820	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	40
PID 2188 wrote to memory of 2820	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	40
PID 2188 wrote to memory of 2820	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	40
PID 2188 wrote to memory of 1140	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	41
PID 2188 wrote to memory of 1140	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	41
PID 2188 wrote to memory of 1140	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	41
PID 2188 wrote to memory of 1140	2188	{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe	41
PID 2820 wrote to memory of 2016	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	42
PID 2820 wrote to memory of 2016	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	42
PID 2820 wrote to memory of 2016	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	42
PID 2820 wrote to memory of 2016	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	42
PID 2820 wrote to memory of 2148	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	43
PID 2820 wrote to memory of 2148	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	43
PID 2820 wrote to memory of 2148	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	43
PID 2820 wrote to memory of 2148	2820	{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe	43
PID 2016 wrote to memory of 2288	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	44
PID 2016 wrote to memory of 2288	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	44
PID 2016 wrote to memory of 2288	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	44
PID 2016 wrote to memory of 2288	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	44
PID 2016 wrote to memory of 2656	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	45
PID 2016 wrote to memory of 2656	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	45
PID 2016 wrote to memory of 2656	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	45
PID 2016 wrote to memory of 2656	2016	{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_3d301fc4956d18fcc31ed3cba65c191f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
  C:\Windows\{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
    C:\Windows\{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
      C:\Windows\{F3EF969A-2DF3-410d-8175-A8486C180840}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F3EF9~1.EXE > nul
        5⤵
        
        PID:528
    - - C:\Windows\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
        
        C:\Windows\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1916
      - C:\Windows\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
        
        C:\Windows\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
        
        C:\Windows\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
        
        C:\Windows\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
        
        C:\Windows\{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
        
        C:\Windows\{8122C62C-F31E-4836-B700-0C6462226588}.exe
        
        C:\Windows\{8122C62C-F31E-4836-B700-0C6462226588}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe
        
        C:\Windows\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}.exe
        
        C:\Windows\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}.exe
        12⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6907~1.EXE > nul
        12⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8122C~1.EXE > nul
        11⤵
        
        PID:672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{089E6~1.EXE > nul
        10⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E9D4D~1.EXE > nul
        9⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3A4E5~1.EXE > nul
        8⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA0D2~1.EXE > nul
        7⤵
        
        PID:1140
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2F969~1.EXE > nul
        6⤵
        
        PID:2652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3F891~1.EXE > nul
      4⤵
      PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{ABB17~1.EXE > nul
    3⤵
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe

Filesize
408KB

MD5
b9c43d1eee5e753f6195cc258ad6a5e9

SHA1
6e556b06095905364c44d77ddd34b0ae939b9f87

SHA256
11dafc7b5e049fa06b57559e8bc144de78ba14900ac8ad30a04984086dce2229

SHA512
ce7cb02dd2108ade88b900243f192e9e90f59dec6b07ff54a022db21f9d162b53b3d9079d7738fad75892b6f75c764184d0e5f9d64371535ba71da7e8e814aaf

Download Submit
C:\Windows\{089E62B3-D658-44b8-B9FF-2E94FA89F247}.exe

Filesize
92KB

MD5
dcbed5693447fe7e851720e11efcce6b

SHA1
a82b4f9e9cc8d5a6a55bd48797ab12115382906c

SHA256
71b78961dd139330d76fcc2615d16f64241fb2e5c2b696eb387cc155f3f0d155

SHA512
fe2b3b9d4dc82699a0238f73f290438a6d28f7befc0acd7c32ca21dc5c9917fd6c198b20bb0017c9f7a96a05338c594fe08b166c54cae7ec7c787faa39599cc1

Download Submit
C:\Windows\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe

Filesize
408KB

MD5
986094fbb42e2410d950c8f2f0f11c2a

SHA1
e781fb971072b3ba6df838a0f366ca09e2677cc8

SHA256
0d84df70059070f943348c8418608827b0083b41d94367d24f4987f88a4485fd

SHA512
9d48eb5574a6b7936804f255d8157394970461ddf8b2259cd0b8d2ad98afee35fee34475333db9d0d09350e57c1149b04034f07be4ab4a0089ecea5c16e121e8

Download Submit
C:\Windows\{2F969BCB-FFDD-4762-8F7E-C32FC9A16704}.exe

Filesize
315KB

MD5
9a1ef4d1fc03281a4b0517f52db39fbe

SHA1
7854289279e6bcc14c336835fb773f8d41595d52

SHA256
b797fb6b458e0a33aa1d0031dbdbb8db6e65293206b6f54e8cf1e8e548b3e71d

SHA512
017eca3077f0e92704c303d06fcad04678f9630a7aaeefc0f13191b914d0e9817a162d1fc520a802065bc085b5e4a3732dfc1aeb16b792631e56b9ff954ea395

Download Submit
C:\Windows\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe

Filesize
36KB

MD5
50574548b5df643328b48d6be27d8c7d

SHA1
975cd437a5ed91cb35058d1995805c089b396174

SHA256
4dc5ae6b48f15842b6e598fb029e3e3603ead8e0c1fc0a0390091054f7ca0bad

SHA512
f24ff763d00cefc25b9a47fd77675148a95ebcfd5e7405eb3468956b76df389ae2bbaeae8ec4e02a4e3bbd7c8c9a6819ed200b77cba4854e802be2309a204ee7

Download Submit
C:\Windows\{3A4E56FC-8404-4ad4-9F34-CC785AE6E7EE}.exe

Filesize
408KB

MD5
a5d5ee680e9f219859d219917c88e21b

SHA1
e9cd1fc4635005146575fdde21b70643141a0ed6

SHA256
9b94fe3eb8ca0df719739a50ff1c442d4bbdaeface37f7b1cabc35f38ec2184f

SHA512
73ef73a4f986dadd33c71e7765872fbcb62c27c3a9c4f518dda789a7fb8becb87b686957acac991fe88fd2e82bdf1629ee78d58f081028613047deb130d9c448

Download Submit
C:\Windows\{3F891712-42F5-49fe-9A65-6A9CC763A208}.exe

Filesize
408KB

MD5
1c8ca569b46927f0d21700cac221e8b3

SHA1
7a67551c31ec99bc0a5e8a4360ac1c3705da283b

SHA256
fdfd86d916517896c18e3a3865e2f834a19a150356872728d107f66f74c1b0ea

SHA512
dca0baafe871a447a9aa00c72b432d63827c193f0b18d676ea472c5fa80aa9e5ea87b47fa3cea06c1f3cd563eba69ec1eeaea5893fec3a200b025ac70c89459f

Download Submit
C:\Windows\{8122C62C-F31E-4836-B700-0C6462226588}.exe

Filesize
61KB

MD5
8d773dc03b42bd25507a56805c0cdb88

SHA1
b77f29b59405cb31d6358315c8712a3417183bb7

SHA256
756b4183f76ee2fbe3ca8c39cfaaa1f315f37621bba14070a819bb3db6c0dd58

SHA512
d9bbd42b5e601da08ff66249ac6540b1072981252508076e09b5df3ce139d969c01d16bfc9b7bc4c212f9d8c8668e5baa4bbaf5a077eaeb062c38afe7d6bb1cd

Download Submit
C:\Windows\{8122C62C-F31E-4836-B700-0C6462226588}.exe

Filesize
187KB

MD5
1f389c3a4248b7aea5d036bbb7d5b1ab

SHA1
1b6879e48af33afedd9eecf4973cfb2ce480316a

SHA256
6bf56fd0586b44ef394928cb2dc3db880d7149fa6c74ef4091a3efb8e11602b5

SHA512
fb0734f04dd124e5bbe7c8ee27af91844ede3288d7ed6893993e5f38015e807f9d691b60dc205f1e0efb4f5b7cd036000fc19f49618154c251801cf968d31d3f

Download Submit
C:\Windows\{91FCCEDF-0569-442a-A2D7-AEC117B7779E}.exe

Filesize
408KB

MD5
90ab37de2f6f86f2004a10919ddb1009

SHA1
570a88e8b6fc128042af678d339bb0e1bb5b45a9

SHA256
9903f3cd24b7bb9cbd1302494512a61636826775a0e64adf046e53ae376c1062

SHA512
6265cc20654c017158ebaaa6d270c73cf1c600e477f8c28a48c041e6dacb0356fc25b1aa2bbc0d02876161ac9463fe76df60558e0672fa01ed8bae39de41b1cd

Download Submit
C:\Windows\{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe

Filesize
408KB

MD5
be6b923d7950981617354ab3bba88ad5

SHA1
3d76580312317ae0c182d7ede93e6a5981e40a13

SHA256
c745ecc9977ccf548f7ba08fd80907788288a302a2a7532880d03cb53296e7d4

SHA512
6eb421c931c7d9447eddd9fa7856ac5e033a7e944af37e596bd2641ef10c2e7f1e5b0f35fb5f9bc000a696834a328d79567279ba230e13b2e557f953dce69d04

Download Submit
C:\Windows\{ABB17D70-7B34-483a-B063-9F3720A9762F}.exe

Filesize
313KB

MD5
1b22ef681b52e824cbdae46d92f79818

SHA1
6b28058016c21d866d428dfaeb4fd26e2f57475d

SHA256
9cd8f43c79cea061dcdefd72981d22c15098453b1620559deb37b46f6dd8ef9e

SHA512
a99ee9354caf9ede3fd5280bcd704a0611e7b86ff853c72556d02aaf1816c4e8863c96c51f02abd4b51ed000fbca0dc8d13e373e4f79353c0a400ea37c92d4f8

Download Submit
C:\Windows\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe

Filesize
45KB

MD5
66bfad9f5b452161ec7524164efbb73b

SHA1
8d120279219cb301b175d80718a0f76fcec08653

SHA256
4cbae41ecf07a89bd4d886de875e48fe7d4c355e995ed57feecdcce9497b020c

SHA512
c748595b679bbdaab0d9d9a16c25ac535741ae08248ac4d4cd1cebfe03d690d18405c737103fe1b6f6e1fc1a18b2717195654ae7d2670c4fe0c82ce7b0b39c4b

Download Submit
C:\Windows\{C6907BCE-7722-4bd8-AD35-BDD18235B4F1}.exe

Filesize
408KB

MD5
fca38d0dc4687214ab780ebbb503c1d4

SHA1
c23e28c8332e862535412a1b1112faa9492121fc

SHA256
176d78d6beee07b50a5724af02f53e247ed50f3a503ff71e26822e84935ef9e0

SHA512
5d859f6d8f07e1bc8396b840e53db475af51b3e45dd937b6d310b232b4279225dd825c6d54b32468f0f242b1420db684b2c25dd76363c648a14e7846a8a206cc

Download Submit
C:\Windows\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe

Filesize
408KB

MD5
8c7b5137a699693f18d2074f2005b987

SHA1
6e44260b4358aa0e6670dcd02b88d8a6d674f8f7

SHA256
e42297749bbc10046ae369c974b4c887a4c0743bd2463da70878e2a0dc70f0c7

SHA512
57c83c1b6373b9083ac6ae88f157d162d6e858ae05987d1f5c08ef8e0b565308eba621b2da525e0c4d5e153cd333b56f1c56e7590b79d8a389bebd4a78d5c62b

Download Submit
C:\Windows\{CA0D279C-CD9B-4f03-9F6B-0624F4043D3F}.exe

Filesize
110KB

MD5
14308c72618cc28b7619fac5c188428a

SHA1
310000ea088dc19cadc0e0eda002024e668e3b6e

SHA256
089f7da9feb6ed159a11c4ec52817a49dc252a16c3e3edae11ade05bfecb1dcc

SHA512
164d30e8606aa017b6f5f5e579a72f9f8a79f6cae42c60de80c6224b1a3557fa34d6a64f34ed276af2e3c32953ea156aeee8ab4d9bf198fbf858bff3f8b47ccf

Download Submit
C:\Windows\{E9D4D2DD-23DA-45bb-9D86-8FC3F8645ED8}.exe

Filesize
408KB

MD5
672a9d162c198049e35ff75c3d829fc5

SHA1
6986340735b0906249ce26a7b0d1606779ce6746

SHA256
9fd29fe4825c2880ad78b608d151444bfc436c73040df071130022f69087f729

SHA512
75617da61883930c937dabc39c3b41bd6d22b27f7e67309ed1369f36ede89aff0763b91b0ac7541653709d519a7240ba9c7fffae4b075f942216ea1688c3b8b8

Download Submit
C:\Windows\{F3EF969A-2DF3-410d-8175-A8486C180840}.exe

Filesize
408KB

MD5
9e0927542f273ce7ba24b05fa66c5cb3

SHA1
33623e48bf23f51a38fdd62d6df8063a034e00cb

SHA256
b40d2c294b0525a42c3322aecf95699aea88bc2748f7f627ea5eddfa4af3cc32

SHA512
33bdac042096698f00d223efa3d90c443fa73e79876a9978a905258e6da1ace244dbc23909069b29c3b76819ffca2cff74d0c00a1ea70f15242982d69ecf80b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads