723d6e9642c5ff9a7d1a6a0af4ea58f08e88d7025060b83aca083e3b493b6e2f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe
Size

204KB
MD5

a35addbb113cecd1b6d1a91c2974be2a
SHA1

ea393bfbaea4783c9c34ce5999ede1723afde89d
SHA256

723d6e9642c5ff9a7d1a6a0af4ea58f08e88d7025060b83aca083e3b493b6e2f
SHA512

fb640234b0acadfe02912b8f35fdcebe275ba65ce0e67b9e84e355c7b42da0e98046ff73e3f623081a229f6ec4031675d9caa9835861f5777cd034bfa05b16ee
SSDEEP

1536:1EGh0o+l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o+l1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320f-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023210-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023218-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023116-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023218-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023116-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023218-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023116-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023218-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023116-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023214-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023116-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}\stubpath = "C:\\Windows\\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe"	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}\stubpath = "C:\\Windows\\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe"	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{219EB0F4-56F4-4583-8269-791EFAB39C10}\stubpath = "C:\\Windows\\{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe"	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B41241B-0FD5-4f73-897D-77211E2E2550}\stubpath = "C:\\Windows\\{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe"	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}\stubpath = "C:\\Windows\\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe"	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFBDD9D0-744B-492e-8068-2F77519E8F35}	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00458449-7ECD-4e14-8041-33E29D95FE88}	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7718681-EFED-42e9-AD64-B77D9CD70736}\stubpath = "C:\\Windows\\{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe"	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B41241B-0FD5-4f73-897D-77211E2E2550}	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}\stubpath = "C:\\Windows\\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe"	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5418ADBC-3C74-4624-8627-7524411D36BB}	{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7718681-EFED-42e9-AD64-B77D9CD70736}	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31B7207F-A56A-4563-9FF7-0CEF39D17971}	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31B7207F-A56A-4563-9FF7-0CEF39D17971}\stubpath = "C:\\Windows\\{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe"	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{219EB0F4-56F4-4583-8269-791EFAB39C10}	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}\stubpath = "C:\\Windows\\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe"	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFBDD9D0-744B-492e-8068-2F77519E8F35}\stubpath = "C:\\Windows\\{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe"	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00458449-7ECD-4e14-8041-33E29D95FE88}\stubpath = "C:\\Windows\\{00458449-7ECD-4e14-8041-33E29D95FE88}.exe"	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5418ADBC-3C74-4624-8627-7524411D36BB}\stubpath = "C:\\Windows\\{5418ADBC-3C74-4624-8627-7524411D36BB}.exe"	{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe

Executes dropped EXE 12 IoCs

pid	Process
2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
540	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe
3300	{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe
4024	{5418ADBC-3C74-4624-8627-7524411D36BB}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe
File created	C:\Windows\{5418ADBC-3C74-4624-8627-7524411D36BB}.exe	{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe
File created	C:\Windows\{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
File created	C:\Windows\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
File created	C:\Windows\{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
File created	C:\Windows\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
File created	C:\Windows\{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
File created	C:\Windows\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
File created	C:\Windows\{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
File created	C:\Windows\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
File created	C:\Windows\{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
File created	C:\Windows\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
Token: SeIncBasePriorityPrivilege	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
Token: SeIncBasePriorityPrivilege	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
Token: SeIncBasePriorityPrivilege	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
Token: SeIncBasePriorityPrivilege	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
Token: SeIncBasePriorityPrivilege	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
Token: SeIncBasePriorityPrivilege	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
Token: SeIncBasePriorityPrivilege	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
Token: SeIncBasePriorityPrivilege	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
Token: SeIncBasePriorityPrivilege	540	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe
Token: SeIncBasePriorityPrivilege	3300	{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2312	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe	92
PID 3300 wrote to memory of 2312	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe	92
PID 3300 wrote to memory of 2312	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe	92
PID 3300 wrote to memory of 844	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe	93
PID 3300 wrote to memory of 844	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe	93
PID 3300 wrote to memory of 844	3300	2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe	93
PID 2312 wrote to memory of 4088	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	94
PID 2312 wrote to memory of 4088	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	94
PID 2312 wrote to memory of 4088	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	94
PID 2312 wrote to memory of 2460	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	95
PID 2312 wrote to memory of 2460	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	95
PID 2312 wrote to memory of 2460	2312	{00458449-7ECD-4e14-8041-33E29D95FE88}.exe	95
PID 4088 wrote to memory of 1460	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	99
PID 4088 wrote to memory of 1460	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	99
PID 4088 wrote to memory of 1460	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	99
PID 4088 wrote to memory of 4988	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	98
PID 4088 wrote to memory of 4988	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	98
PID 4088 wrote to memory of 4988	4088	{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe	98
PID 1460 wrote to memory of 1520	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	101
PID 1460 wrote to memory of 1520	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	101
PID 1460 wrote to memory of 1520	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	101
PID 1460 wrote to memory of 1952	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	102
PID 1460 wrote to memory of 1952	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	102
PID 1460 wrote to memory of 1952	1460	{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe	102
PID 1520 wrote to memory of 3536	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	103
PID 1520 wrote to memory of 3536	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	103
PID 1520 wrote to memory of 3536	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	103
PID 1520 wrote to memory of 4764	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	104
PID 1520 wrote to memory of 4764	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	104
PID 1520 wrote to memory of 4764	1520	{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe	104
PID 3536 wrote to memory of 924	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	105
PID 3536 wrote to memory of 924	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	105
PID 3536 wrote to memory of 924	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	105
PID 3536 wrote to memory of 732	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	106
PID 3536 wrote to memory of 732	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	106
PID 3536 wrote to memory of 732	3536	{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe	106
PID 924 wrote to memory of 2328	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	107
PID 924 wrote to memory of 2328	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	107
PID 924 wrote to memory of 2328	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	107
PID 924 wrote to memory of 1424	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	108
PID 924 wrote to memory of 1424	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	108
PID 924 wrote to memory of 1424	924	{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe	108
PID 2328 wrote to memory of 4104	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	109
PID 2328 wrote to memory of 4104	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	109
PID 2328 wrote to memory of 4104	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	109
PID 2328 wrote to memory of 4528	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	110
PID 2328 wrote to memory of 4528	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	110
PID 2328 wrote to memory of 4528	2328	{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe	110
PID 4104 wrote to memory of 4428	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	111
PID 4104 wrote to memory of 4428	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	111
PID 4104 wrote to memory of 4428	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	111
PID 4104 wrote to memory of 4512	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	112
PID 4104 wrote to memory of 4512	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	112
PID 4104 wrote to memory of 4512	4104	{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe	112
PID 4428 wrote to memory of 540	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	113
PID 4428 wrote to memory of 540	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	113
PID 4428 wrote to memory of 540	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	113
PID 4428 wrote to memory of 3776	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	114
PID 4428 wrote to memory of 3776	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	114
PID 4428 wrote to memory of 3776	4428	{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe	114
PID 540 wrote to memory of 3300	540	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe	115
PID 540 wrote to memory of 3300	540	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe	115
PID 540 wrote to memory of 3300	540	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe	115
PID 540 wrote to memory of 428	540	{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe	116

C:\Users\Admin\AppData\Local\Temp\2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_a35addbb113cecd1b6d1a91c2974be2a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
  C:\Windows\{00458449-7ECD-4e14-8041-33E29D95FE88}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
    C:\Windows\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1A631~1.EXE > nul
      4⤵
      PID:4988
  - - C:\Windows\{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
      C:\Windows\{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Windows\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
        
        C:\Windows\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
      - C:\Windows\{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
        
        C:\Windows\{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
        
        C:\Windows\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
        
        C:\Windows\{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
        
        C:\Windows\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
        
        C:\Windows\{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe
        
        C:\Windows\{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe
        
        C:\Windows\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
        
        C:\Windows\{5418ADBC-3C74-4624-8627-7524411D36BB}.exe
        
        C:\Windows\{5418ADBC-3C74-4624-8627-7524411D36BB}.exe
        13⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42D5F~1.EXE > nul
        13⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B412~1.EXE > nul
        12⤵
        
        PID:428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AFBDD~1.EXE > nul
        11⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FCD6F~1.EXE > nul
        10⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{219EB~1.EXE > nul
        9⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{080E3~1.EXE > nul
        8⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F7718~1.EXE > nul
        7⤵
        
        PID:732
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98F49~1.EXE > nul
        6⤵
        
        PID:4764
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31B72~1.EXE > nul
        5⤵
        
        PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{00458~1.EXE > nul
    3⤵
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00458449-7ECD-4e14-8041-33E29D95FE88}.exe

Filesize
204KB

MD5
9c8149facaa24cfe6165ca6e1e0f64ea

SHA1
7d65adc7ef2bdd278df26952b6cb99ec9246130d

SHA256
cb5cb8fa4d5ca329b8d0d8cb5f3fbaee5e42546f9ef51283e491b3688d3f8375

SHA512
7b398aa884c85e044f747e32f6108c30d5c4d33a207b0b8f3c4f8fa0e415c3929bb9c8a77b46e003d2a9c7e9e341bc7c6bbe62b170e4466b526e237c20646285

Download Submit
C:\Windows\{080E3BA5-98A4-40aa-9DA8-9E0BF5B7A6D1}.exe

Filesize
204KB

MD5
3e6b108c43cc63ee545da39e6834983e

SHA1
9035368fda687bf933337671950498161a06a953

SHA256
8c5859707ccce70fbaa808ac4b1a293f145d0b4bf2947ed18495bc30d99a582e

SHA512
978aa9b2154f086ae3031ce4fdb3439eb7ba454d4393f1f5ec975d91b85e3c2242b1e5cf1de5b074d2589cbba0f0e8c91a4ee88501ff285983dbb7fb8f84ad33

Download Submit
C:\Windows\{1A63111A-0951-4cd4-BB06-E6826EDAD7E5}.exe

Filesize
204KB

MD5
1a392e582ed633f7e5d8a3fea44c30b0

SHA1
af63f48d5c2b674c5b19e82701ab47edfbd211f7

SHA256
8ad79a1c5e4336e6f1295a987a25056d4860433bd409e06e18c7ac1c6d84817f

SHA512
cee9c5208b6bcdfd0df60c9be80385c060d1f0bfaf4aa1132babc0d1e59a3aa48d72715e14bc2497aa30b06e1ca362697482ee052d4099a4073de8bfce1a394e

Download Submit
C:\Windows\{219EB0F4-56F4-4583-8269-791EFAB39C10}.exe

Filesize
204KB

MD5
fd5e5624123326ae2c1a90f25cde3a42

SHA1
c457afd427605dd324ca512d1f0702202c686d03

SHA256
439d7d1fd2e9fa85523c3747b7fb3bbbc3fcbeee08067209d230af14da65c81f

SHA512
f2af9071227e885815f401558367ac83add7eb87fab72280eac98198bed7b070c9fb089b17d56f6d021e16d37ebb1be51a79c528ffdb6cfee34ce3cc9da22baf

Download Submit
C:\Windows\{31B7207F-A56A-4563-9FF7-0CEF39D17971}.exe

Filesize
204KB

MD5
0415b5cd14908907bb49414c11913618

SHA1
c62615a45d90825a58bada00e6735856a2f67d31

SHA256
a908bdda30a3b7cbf2dead21e96026936b7e2c597f00d2c17450ea7c53711c14

SHA512
133fb23cd73ed13118a39b51d663a60e277970c384d1a09b515b1e17277467044317fbde02d3f281dfcd49015b8685bfa8cdb3790c457414ba4f5efbae700197

Download Submit
C:\Windows\{42D5F4BE-072A-4895-B347-9C8FBE7E30CC}.exe

Filesize
204KB

MD5
2ef20e6147a9429594b357be796ff629

SHA1
ecd8dd92169c087daff17c43430547abcf05ceda

SHA256
825be7b04bb04cb071a51d457f1c1759e93ae6aba5c544c54a7cb7e5d4040c0e

SHA512
b4eeaa5d99be78d2470412213ee75d9f6d96a7ba8a28f70a2b844632179d11ecd9d2526d9ac7dea327351c846a1f59088d5028b1ecd499ae3595c1914f65c5b4

Download Submit
C:\Windows\{5418ADBC-3C74-4624-8627-7524411D36BB}.exe

Filesize
204KB

MD5
1ff61273ac3629e89ea1eb6b42889632

SHA1
c94e47e8d54557e7336f58e06432e356a6e1d7c8

SHA256
20dd2cbac136bf22ccea22f6b0a1a6a3d153e964eb2adff0777eb7447beadec0

SHA512
1b5df50e4b32389349d33bf85c80ce910697312bf5b41a3b332e1cfa6f53f5e96e262312000cbabf1e94e33b697e54b446edef5695467cfcf28a05efae2d3f5e

Download Submit
C:\Windows\{98F49B0E-6115-4327-8E17-06E44FF5B0F2}.exe

Filesize
204KB

MD5
f17496821fc808427dff6f3674792c07

SHA1
b36f8bde03e4c3f0d67aa182c0f31ea6e43a2ec3

SHA256
5c99fd216d2b1486d0260bba4309e1fc95a1b70ffe3bff92224ac5bcdd530bb6

SHA512
fc95ca326d92febd896a9cb676ccf7b1f41023047a22f741080ff8b1a29a4eb6f8b953d47253e1d37a6fb4f15ce447d81b43884f9351c30382834ebf4e90abc0

Download Submit
C:\Windows\{9B41241B-0FD5-4f73-897D-77211E2E2550}.exe

Filesize
204KB

MD5
e3edeb82392897590b4465d9abeaa758

SHA1
f046548a7759b3a4442c76b0060fb7fdf25d86b9

SHA256
c882c2bfb91695286cf4f7611cbef2d1bf7fd857feae76856e02d3b23f872612

SHA512
22f59c4657489179855a78f0dbb4105c25f391c6fdf60dd01c63e0f5a492e4f0414f8133815dc399f73cdfc7b279f089356978bfe9cce62e5211331117754264

Download Submit
C:\Windows\{AFBDD9D0-744B-492e-8068-2F77519E8F35}.exe

Filesize
204KB

MD5
5f51b730aed30c123c8d224268c065e1

SHA1
b76e32408622170543dd16e03f8cfe0c432fa49a

SHA256
6f2dd3608e990d121cb370c62b9d8f518811232e0f2dda8665f30dc8400c3062

SHA512
9f1c9dbc2cec705c53b0f6e6fad8038e52c3697af1c0ad7afc841de65c8c28a1c7e4ea12fe26551983da7a5c47676d85a3c2fb1d5f654233aed3edad21638951

Download Submit
C:\Windows\{F7718681-EFED-42e9-AD64-B77D9CD70736}.exe

Filesize
204KB

MD5
3533db93cc2bd2d9f12fc911cbdb2ea8

SHA1
9b9610e78c7fbf260ffbe6cafdd1c96a89aed1ec

SHA256
cb72b515f975bd62baad47b8c4e2885c1a4be6df1bf8498fa16b61f14e8ffe09

SHA512
166f51415283d59fbb2fc5f5f07c17d0aefe9ab298da5929b957d4c4d92a6b67148c83c5e425fedaee5d9b2969970dcd01370107f874d87626e868811c1f4c5c

Download Submit
C:\Windows\{FCD6FB6E-CEBB-48f3-8CF8-46727300D32A}.exe

Filesize
204KB

MD5
7c4b5f036ca9565e47f75a194bf19684

SHA1
98866c8bc5d24b52d15e3b996ba46f850cbccbf7

SHA256
338f1f6312438ff53335708898b4707bfad3f4a626187c1de53547a71bcf453a

SHA512
0374eab895196ce994c330ee5c1c0ebd3c366500bb34474a3958dfe3151b643d6baddbc5b28b8c47c7bab3868c2978279d7bed6806c2963a1983245377939b3b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads