71cd05d26bf611057a00407b68c3df6066d49fc28db0866c5a0f8d65b4b2f363

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe
Size

408KB
MD5

0905be4259a30a270a1961685901bdb6
SHA1

dc965006193aa0aeb5ab0b3ecc442414a44e28a1
SHA256

71cd05d26bf611057a00407b68c3df6066d49fc28db0866c5a0f8d65b4b2f363
SHA512

a66ba7cab6af93ba823c6e7e498ed06d5cee2ba1eb964f02a920b5b4eb30214fe0dceda51a6c8771e23b59aa96f1febdf648adde01caa90d0989586eaeb69893
SSDEEP

3072:CEGh0o0l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG6ldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023200-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000231f0-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000230f0-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231f0-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000230f0-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000231f0-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000230f0-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000227ca-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000230f0-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000227ca-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000230f0-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000227ca-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000227ca-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}\stubpath = "C:\\Windows\\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe"	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}\stubpath = "C:\\Windows\\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe"	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}\stubpath = "C:\\Windows\\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe"	{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B41EEF75-39B7-47fb-8CFF-642654DB8876}	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B41EEF75-39B7-47fb-8CFF-642654DB8876}\stubpath = "C:\\Windows\\{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe"	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}\stubpath = "C:\\Windows\\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe"	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75D67753-B408-4d20-86B6-B1F724FB962C}\stubpath = "C:\\Windows\\{75D67753-B408-4d20-86B6-B1F724FB962C}.exe"	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38BCD35E-4589-45c2-B6BA-0F6E75965020}\stubpath = "C:\\Windows\\{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe"	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}	{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}\stubpath = "C:\\Windows\\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe"	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75D67753-B408-4d20-86B6-B1F724FB962C}	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FBE688D-2583-48a5-AF19-394DC90F89B8}\stubpath = "C:\\Windows\\{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe"	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38BCD35E-4589-45c2-B6BA-0F6E75965020}	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}\stubpath = "C:\\Windows\\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe"	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B063D824-30E6-47a5-84B4-FF98BD819920}	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B063D824-30E6-47a5-84B4-FF98BD819920}\stubpath = "C:\\Windows\\{B063D824-30E6-47a5-84B4-FF98BD819920}.exe"	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}\stubpath = "C:\\Windows\\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe"	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FBE688D-2583-48a5-AF19-394DC90F89B8}	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe

Executes dropped EXE 12 IoCs

pid	Process
2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe
1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe
4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
5036	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
4048	{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe
1004	{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
File created	C:\Windows\{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
File created	C:\Windows\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
File created	C:\Windows\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
File created	C:\Windows\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
File created	C:\Windows\{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe
File created	C:\Windows\{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
File created	C:\Windows\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
File created	C:\Windows\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe	{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe
File created	C:\Windows\{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe
File created	C:\Windows\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
File created	C:\Windows\{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
Token: SeIncBasePriorityPrivilege	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
Token: SeIncBasePriorityPrivilege	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe
Token: SeIncBasePriorityPrivilege	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
Token: SeIncBasePriorityPrivilege	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
Token: SeIncBasePriorityPrivilege	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe
Token: SeIncBasePriorityPrivilege	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
Token: SeIncBasePriorityPrivilege	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
Token: SeIncBasePriorityPrivilege	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
Token: SeIncBasePriorityPrivilege	5036	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
Token: SeIncBasePriorityPrivilege	4048	{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2384	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe	92
PID 4652 wrote to memory of 2384	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe	92
PID 4652 wrote to memory of 2384	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe	92
PID 4652 wrote to memory of 3424	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe	93
PID 4652 wrote to memory of 3424	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe	93
PID 4652 wrote to memory of 3424	4652	2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe	93
PID 2384 wrote to memory of 812	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	94
PID 2384 wrote to memory of 812	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	94
PID 2384 wrote to memory of 812	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	94
PID 2384 wrote to memory of 3436	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	95
PID 2384 wrote to memory of 3436	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	95
PID 2384 wrote to memory of 3436	2384	{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe	95
PID 812 wrote to memory of 4352	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	100
PID 812 wrote to memory of 4352	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	100
PID 812 wrote to memory of 4352	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	100
PID 812 wrote to memory of 3104	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	99
PID 812 wrote to memory of 3104	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	99
PID 812 wrote to memory of 3104	812	{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe	99
PID 4352 wrote to memory of 1376	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	101
PID 4352 wrote to memory of 1376	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	101
PID 4352 wrote to memory of 1376	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	101
PID 4352 wrote to memory of 1712	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	102
PID 4352 wrote to memory of 1712	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	102
PID 4352 wrote to memory of 1712	4352	{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe	102
PID 1376 wrote to memory of 4604	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	103
PID 1376 wrote to memory of 4604	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	103
PID 1376 wrote to memory of 4604	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	103
PID 1376 wrote to memory of 2012	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	104
PID 1376 wrote to memory of 2012	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	104
PID 1376 wrote to memory of 2012	1376	{B063D824-30E6-47a5-84B4-FF98BD819920}.exe	104
PID 4604 wrote to memory of 4796	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	105
PID 4604 wrote to memory of 4796	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	105
PID 4604 wrote to memory of 4796	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	105
PID 4604 wrote to memory of 3264	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	106
PID 4604 wrote to memory of 3264	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	106
PID 4604 wrote to memory of 3264	4604	{75D67753-B408-4d20-86B6-B1F724FB962C}.exe	106
PID 4796 wrote to memory of 4524	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	107
PID 4796 wrote to memory of 4524	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	107
PID 4796 wrote to memory of 4524	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	107
PID 4796 wrote to memory of 1492	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	108
PID 4796 wrote to memory of 1492	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	108
PID 4796 wrote to memory of 1492	4796	{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe	108
PID 4524 wrote to memory of 704	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	111
PID 4524 wrote to memory of 704	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	111
PID 4524 wrote to memory of 704	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	111
PID 4524 wrote to memory of 1936	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	112
PID 4524 wrote to memory of 1936	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	112
PID 4524 wrote to memory of 1936	4524	{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe	112
PID 704 wrote to memory of 636	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	113
PID 704 wrote to memory of 636	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	113
PID 704 wrote to memory of 636	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	113
PID 704 wrote to memory of 2592	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	114
PID 704 wrote to memory of 2592	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	114
PID 704 wrote to memory of 2592	704	{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe	114
PID 636 wrote to memory of 5036	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	115
PID 636 wrote to memory of 5036	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	115
PID 636 wrote to memory of 5036	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	115
PID 636 wrote to memory of 5048	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	116
PID 636 wrote to memory of 5048	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	116
PID 636 wrote to memory of 5048	636	{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe	116
PID 5036 wrote to memory of 4048	5036	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe	117
PID 5036 wrote to memory of 4048	5036	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe	117
PID 5036 wrote to memory of 4048	5036	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe	117
PID 5036 wrote to memory of 3392	5036	{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_0905be4259a30a270a1961685901bdb6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
  C:\Windows\{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
    C:\Windows\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8FB5B~1.EXE > nul
      4⤵
      PID:3104
  - - C:\Windows\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe
      C:\Windows\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Windows\{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
        
        C:\Windows\{B063D824-30E6-47a5-84B4-FF98BD819920}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1376
      - C:\Windows\{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
        
        C:\Windows\{75D67753-B408-4d20-86B6-B1F724FB962C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe
        
        C:\Windows\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
        
        C:\Windows\{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
        
        C:\Windows\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
        
        C:\Windows\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
        
        C:\Windows\{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe
        
        C:\Windows\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
        
        C:\Windows\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe
        
        C:\Windows\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe
        13⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93449~1.EXE > nul
        13⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{38BCD~1.EXE > nul
        12⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE6D2~1.EXE > nul
        11⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50734~1.EXE > nul
        10⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5FBE6~1.EXE > nul
        9⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B476~1.EXE > nul
        8⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75D67~1.EXE > nul
        7⤵
        
        PID:3264
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B063D~1.EXE > nul
        6⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96B13~1.EXE > nul
        5⤵
        
        PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B41EE~1.EXE > nul
    3⤵
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{38BCD35E-4589-45c2-B6BA-0F6E75965020}.exe

Filesize
408KB

MD5
c2ae4d298555422894cf491a002fd829

SHA1
bd083a2dd461f2f810158da2483712b989a6f30e

SHA256
6f93d9cbe51162278493fc36e2119eb70163a80f5a230d72543a81d4d116d3f5

SHA512
59acaaa47924c0adc24959b0e336df348bbe2014fb2ab5150d6028855212563f94d87d6c64cecbd18ebcb3bd184901ad035eb1a679d492b6019bac0dd377841a

Download Submit
C:\Windows\{3B476DA9-D2EA-4e75-BF96-EF509E6B32A0}.exe

Filesize
408KB

MD5
c30aeb568b53bc1491c3d2e59cdc810d

SHA1
3859fb4fff07c9a767f2d5bbaabf5083f7ef7c6b

SHA256
97e6071bb080a4264ca43251b85fdce932a69cac3faf24e40cba7f407fc07e36

SHA512
4abe6dac8291200068298c475b91f89279a4d8896f9d19a7e4e4c053fb40c7175e3efb75850075a3881b2fcbf4be9200dccf0f63d1e60e36e962baa3b3352c1a

Download Submit
C:\Windows\{50734BD3-4BA1-4bfc-9548-3A9D99E8E05B}.exe

Filesize
408KB

MD5
48e2fc824bff85c05762b30f46513597

SHA1
14b93cf82241eee975bcf8c694a2eb5b87d3e948

SHA256
c5c5467c4eb4b6de9405ec7944959ff959bbdcad29c5576c5d86a1965456e59c

SHA512
8803bbf6e42449b834e606c70a091d7d3c2dbe00f497e18a269b13627698126e002ba177bc176fc7b319be264eac508cf19f4260246178c0a0af6a58be860e1b

Download Submit
C:\Windows\{5FBE688D-2583-48a5-AF19-394DC90F89B8}.exe

Filesize
408KB

MD5
3fd27e47bb40202163ede007ff5798ef

SHA1
b7bb239ef36f9657b038965f6a8f0b3251cfc2f0

SHA256
84fcb1d8044e055e0c25119bccb8d4be81dbe42579b12ef7bd65350c71e2614e

SHA512
e7c34287321216166412c7979c16cbed95bf46af64e0e45ad833a733cda5be3f3a432d000f320513451fa66db1190af1ea5d79ac687c64ab6958d16ecd56faac

Download Submit
C:\Windows\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe

Filesize
166KB

MD5
20cfa1c7fc3be16acf0b17fd1ef015c5

SHA1
655385f6e07230861de739725f33229ae7214a2c

SHA256
2c5650a91ef3edca947630144d4e59eaad1cee4b6218457908cc3697c79fc3d1

SHA512
066b5616940d1df36f12ab69843c4dc94a0d7ea15ddb6ce2c1cdb396cef2c0594b14ae49ff8f77e6fd84eafe68ac1d79599301a42d08567df7df4339ed1fdf2b

Download Submit
C:\Windows\{714B1BCD-6D92-4594-B2FD-83F4EF1204C6}.exe

Filesize
408KB

MD5
346ebb240ee1bdfe5164f7cf0ad35290

SHA1
db16660eeac7bc000af6fa5e54b1753ac9bc120a

SHA256
ab332ca8a43f86a1b6f11e29deaa2a7fbfa382f013699954d83d63979a1df534

SHA512
ab95bbe458d3f66e604ebc9d220af65ddf584db3b205d031cbb4eba8086b29ec4587f4c6ea56781d69088459d520508dc8c2f46ee97777c90c4ef82376ef9c50

Download Submit
C:\Windows\{75D67753-B408-4d20-86B6-B1F724FB962C}.exe

Filesize
408KB

MD5
838a152a2e36ca6119b3bafeaeefb759

SHA1
2d23b2748507a93734b5150f351213e807b6236c

SHA256
5f19228c04b6cd0d42fd7bd7e98e7b37c4ee098200551db644447a2d9f5eda08

SHA512
b230009687d19407aa26cc001df7387f7ebd02e1f7b62151e8535f065b5f2d1c4d94a8b1dc588a5e8c74beac4e02062c2e3f10eb7ff0c0c57804b1467389ffd2

Download Submit
C:\Windows\{8FB5B5FA-0696-4b58-AF1F-22663BE44427}.exe

Filesize
408KB

MD5
bd505a199fc5c0670b13790c52b75ad8

SHA1
282d939143911e37ed3554888cc298042f290e0f

SHA256
13ce4fafaaca47b9012cebb08dcac06b32b2e23ebc809c09a5f6f2709670ed80

SHA512
bfcb470ed571a657823769fbd29586c4b0bd1d58c7bc503f6fb1ad2849835181de58172f7f582ee8b319ce61eb1d54f5bb9049d605ed61a62b27363201b4f0cf

Download Submit
C:\Windows\{93449C8D-4E8A-46e0-9587-5CF8E4B345BA}.exe

Filesize
408KB

MD5
e68d58eddf583854ba1f10e39122b320

SHA1
fc3b046ae1867cbcae961b937b4a1db8db5fece4

SHA256
04e1d7bafcb39f9cf520a7fa30913ef249e6b68028456ea85f8999bee950f880

SHA512
f8b74e625b6d3140f6bab0fac1416c9643cd7a61871bfc5e470f4b8ce6c6224931822c8c71d378f8004ab708e2949425338bcd0e6b1ec96eb10d51fffa65d8e1

Download Submit
C:\Windows\{96B13911-04E5-4c3a-9F76-0E7720C29FD4}.exe

Filesize
408KB

MD5
4c9bb1cb0de7005e29d382996ba766ac

SHA1
67dd3607eafa7b52badaa665490d99e8159819d4

SHA256
f64d3363ee58fa82be0992ffc8e2f84c53db79714c39748b5b13eec608e44a5e

SHA512
6550e4f33454e6de5907bc8b8b5ad6554dc3984f59ce710ca6b5b6256e4eec7142c5b3cc611d9c0a2db86158d8e3468b98264e25f67a387bcea61c6c0e603043

Download Submit
C:\Windows\{B063D824-30E6-47a5-84B4-FF98BD819920}.exe

Filesize
408KB

MD5
96fe988a6d5fe6d20923da74fbfe236a

SHA1
6ac6dbdeff10e249036c100c2e5070a0b381d912

SHA256
fbb78331d46fbc374d21b989a80a31ca4a6559c1fa9cfe648aaa963d9f227177

SHA512
ba0ea0eb6c7d705fbe6f55f6e1a84d856a37d32a273bdae96b2af56f32d6b01c464ee55223ef41b66249389ab2c4b97b0d1e30725ed97ae1dc2a9e707af4a924

Download Submit
C:\Windows\{B41EEF75-39B7-47fb-8CFF-642654DB8876}.exe

Filesize
408KB

MD5
a717db1dc9bc85ec6e68937f65bc31ad

SHA1
cb015abf652aa080e532fa5e3d93f3ceca167275

SHA256
1df993aff2f24193dabd5c2e4c1f3ab886e858f948c4f67539d0b2bd78cbe330

SHA512
1c7e4a3e8022113918b6e06ba840a40d63245dfecfb85e0a51499442b4f451b129d32b162e9228b9a1a38d638c56a785e2e4658bb45365a07c9fc4ef1a5ff409

Download Submit
C:\Windows\{DE6D2649-4E9C-4e07-BB0E-3356BCF740CB}.exe

Filesize
408KB

MD5
8a89c41b18fef5d500847f2655124752

SHA1
7a0efe8196a5679fac932d66375de625f52925e9

SHA256
9129c1f44cdd5e64c5a27adfb1cafad554ef849b622530cc7ce53d21f81198be

SHA512
1eee6f6c70c6827cc818780a84ca14fe0b01675e35e45f98138aa99054284e5ca18e3f77a0d4b58afb4b52bfeabab41e801f11fde449059d6dfe41721d3954d2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads