b4b6df39910bf0f5832e5534eeaef3116bbaea15314f9f594d274ffc28093164

Analysis

max time kernel
151s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe
Size

372KB
MD5

a74a48c48c1f360964643e7eb34b7871
SHA1

1550903768fd3433628aa8c67eeaf1a40dd3f18f
SHA256

b4b6df39910bf0f5832e5534eeaef3116bbaea15314f9f594d274ffc28093164
SHA512

72f79e3f0c63c0b8d864dfef136a6c551f95c782bb597e52384f7d86c32932433e5a0558592b8579f5f26ed6c21644d74c286a639c08ddf81632fa05842207e9
SSDEEP

3072:CEGh0oomlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGTl/Oe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c000000016c0e-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000016ce9-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f2-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0034000000016ce9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f2-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000016ce9-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000000f6f2-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000016ce9-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000000f6f2-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0037000000016ce9-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000000f6f2-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0038000000016ce9-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{845D948B-A175-4085-8FA3-7B70D670D0F8}	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{845D948B-A175-4085-8FA3-7B70D670D0F8}\stubpath = "C:\\Windows\\{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe"	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}\stubpath = "C:\\Windows\\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe"	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}\stubpath = "C:\\Windows\\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe"	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA287038-5B89-4f2d-B774-987291ADBD61}\stubpath = "C:\\Windows\\{BA287038-5B89-4f2d-B774-987291ADBD61}.exe"	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}\stubpath = "C:\\Windows\\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe"	{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}	{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}\stubpath = "C:\\Windows\\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe"	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}\stubpath = "C:\\Windows\\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}.exe"	{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{839BA38D-9AE4-461d-9603-77843324DB96}\stubpath = "C:\\Windows\\{839BA38D-9AE4-461d-9603-77843324DB96}.exe"	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}	{839BA38D-9AE4-461d-9603-77843324DB96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA287038-5B89-4f2d-B774-987291ADBD61}	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{883495AE-F7E6-40a9-A388-0412C5523D4A}	{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}	{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{839BA38D-9AE4-461d-9603-77843324DB96}	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA364EA4-5B38-4137-B60B-A68B4763D419}	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA364EA4-5B38-4137-B60B-A68B4763D419}\stubpath = "C:\\Windows\\{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe"	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}	{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}\stubpath = "C:\\Windows\\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe"	{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{883495AE-F7E6-40a9-A388-0412C5523D4A}\stubpath = "C:\\Windows\\{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe"	{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}\stubpath = "C:\\Windows\\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe"	{839BA38D-9AE4-461d-9603-77843324DB96}.exe

Deletes itself 1 IoCs

pid	Process
2664	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe
2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
1628	{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
1316	{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
2068	{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
2264	{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe
2588	{D8F9CCC6-B320-42b8-B934-2C960A4D8324}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
File created	C:\Windows\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
File created	C:\Windows\{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
File created	C:\Windows\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe	{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
File created	C:\Windows\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe	{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
File created	C:\Windows\{839BA38D-9AE4-461d-9603-77843324DB96}.exe	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe
File created	C:\Windows\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	{839BA38D-9AE4-461d-9603-77843324DB96}.exe
File created	C:\Windows\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
File created	C:\Windows\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
File created	C:\Windows\{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
File created	C:\Windows\{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe	{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
File created	C:\Windows\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}.exe	{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe
Token: SeIncBasePriorityPrivilege	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
Token: SeIncBasePriorityPrivilege	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
Token: SeIncBasePriorityPrivilege	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
Token: SeIncBasePriorityPrivilege	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
Token: SeIncBasePriorityPrivilege	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
Token: SeIncBasePriorityPrivilege	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
Token: SeIncBasePriorityPrivilege	1628	{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
Token: SeIncBasePriorityPrivilege	1316	{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
Token: SeIncBasePriorityPrivilege	2068	{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
Token: SeIncBasePriorityPrivilege	2264	{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2532	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	28
PID 2016 wrote to memory of 2532	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	28
PID 2016 wrote to memory of 2532	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	28
PID 2016 wrote to memory of 2532	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	28
PID 2016 wrote to memory of 2664	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	29
PID 2016 wrote to memory of 2664	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	29
PID 2016 wrote to memory of 2664	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	29
PID 2016 wrote to memory of 2664	2016	2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe	29
PID 2532 wrote to memory of 2232	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	32
PID 2532 wrote to memory of 2232	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	32
PID 2532 wrote to memory of 2232	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	32
PID 2532 wrote to memory of 2232	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	32
PID 2532 wrote to memory of 2332	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	33
PID 2532 wrote to memory of 2332	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	33
PID 2532 wrote to memory of 2332	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	33
PID 2532 wrote to memory of 2332	2532	{839BA38D-9AE4-461d-9603-77843324DB96}.exe	33
PID 2232 wrote to memory of 2860	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	34
PID 2232 wrote to memory of 2860	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	34
PID 2232 wrote to memory of 2860	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	34
PID 2232 wrote to memory of 2860	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	34
PID 2232 wrote to memory of 3048	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	35
PID 2232 wrote to memory of 3048	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	35
PID 2232 wrote to memory of 3048	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	35
PID 2232 wrote to memory of 3048	2232	{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe	35
PID 2860 wrote to memory of 528	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	36
PID 2860 wrote to memory of 528	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	36
PID 2860 wrote to memory of 528	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	36
PID 2860 wrote to memory of 528	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	36
PID 2860 wrote to memory of 764	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	37
PID 2860 wrote to memory of 764	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	37
PID 2860 wrote to memory of 764	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	37
PID 2860 wrote to memory of 764	2860	{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe	37
PID 528 wrote to memory of 1356	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	38
PID 528 wrote to memory of 1356	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	38
PID 528 wrote to memory of 1356	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	38
PID 528 wrote to memory of 1356	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	38
PID 528 wrote to memory of 2492	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	39
PID 528 wrote to memory of 2492	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	39
PID 528 wrote to memory of 2492	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	39
PID 528 wrote to memory of 2492	528	{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe	39
PID 1356 wrote to memory of 2724	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	40
PID 1356 wrote to memory of 2724	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	40
PID 1356 wrote to memory of 2724	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	40
PID 1356 wrote to memory of 2724	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	40
PID 1356 wrote to memory of 2848	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	41
PID 1356 wrote to memory of 2848	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	41
PID 1356 wrote to memory of 2848	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	41
PID 1356 wrote to memory of 2848	1356	{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe	41
PID 2724 wrote to memory of 932	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	43
PID 2724 wrote to memory of 932	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	43
PID 2724 wrote to memory of 932	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	43
PID 2724 wrote to memory of 932	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	43
PID 2724 wrote to memory of 1684	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	42
PID 2724 wrote to memory of 1684	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	42
PID 2724 wrote to memory of 1684	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	42
PID 2724 wrote to memory of 1684	2724	{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe	42
PID 932 wrote to memory of 1628	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	44
PID 932 wrote to memory of 1628	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	44
PID 932 wrote to memory of 1628	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	44
PID 932 wrote to memory of 1628	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	44
PID 932 wrote to memory of 1640	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	45
PID 932 wrote to memory of 1640	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	45
PID 932 wrote to memory of 1640	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	45
PID 932 wrote to memory of 1640	932	{BA287038-5B89-4f2d-B774-987291ADBD61}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_a74a48c48c1f360964643e7eb34b7871_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\{839BA38D-9AE4-461d-9603-77843324DB96}.exe
  C:\Windows\{839BA38D-9AE4-461d-9603-77843324DB96}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
    C:\Windows\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
      C:\Windows\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
        
        C:\Windows\{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:528
      - C:\Windows\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
        
        C:\Windows\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
        
        C:\Windows\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3AF85~1.EXE > nul
        8⤵
        
        PID:1684
        
        C:\Windows\{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
        
        C:\Windows\{BA287038-5B89-4f2d-B774-987291ADBD61}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
        
        C:\Windows\{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
        
        C:\Windows\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
        
        C:\Windows\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
        
        C:\Windows\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
        
        C:\Windows\{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe
        
        C:\Windows\{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}.exe
        
        C:\Windows\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}.exe
        13⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88349~1.EXE > nul
        13⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB60B~1.EXE > nul
        12⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10CDB~1.EXE > nul
        11⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA364~1.EXE > nul
        10⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BA287~1.EXE > nul
        9⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DFE1A~1.EXE > nul
        7⤵
        
        PID:2848
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{845D9~1.EXE > nul
        6⤵
        
        PID:2492
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{09382~1.EXE > nul
        5⤵
        
        PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{13797~1.EXE > nul
      4⤵
      PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{839BA~1.EXE > nul
    3⤵
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0938273C-0A58-4b1e-88C6-DB5E7F8B8022}.exe

Filesize
372KB

MD5
6761618a027c371452cd28b003e9cd72

SHA1
54a47cd2976977b1776756a01481bc3d4007858f

SHA256
d70b1926594e1b8859048052005a99be20b8b42cad8d534f113adf5f867d01ed

SHA512
eb60a32c6651e859e2095b010d4ef3ec0a427407f8567bfec76107aba0c7c2ca9606163281fb0a5a4ba8d4281dc425a3568c82a259a5eeac2529c7a26035fbbd

Download Submit
C:\Windows\{10CDBFAF-107F-4d7c-BC32-227F00F377E6}.exe

Filesize
372KB

MD5
42f2fe90167058364257d633ca15adf0

SHA1
fc29ec528db9b487376ce768c339623e78474071

SHA256
a9c7f7c3a7ad8846eaa23e466a78eff8639e0ba50935b27830105f1f4a04d8a6

SHA512
14b5a239e97f1d7d8589c8b55e35767f6646ac06a05f8aa33b176fa11f72bf5c70f0c68462b9666ff62c23d24bdbaba87d6bba5f97acdd9af05def9ad7641270

Download Submit
C:\Windows\{1379785E-9C3C-496b-9DF0-9F7D22AF61B3}.exe

Filesize
372KB

MD5
cce3820d23b0b2d93408100a8c20907a

SHA1
a62c1888fc4fc0697b29c89038c6fc7c3c231210

SHA256
4562e7a15425cef87100af1d89adf89ad768ac5c1f4bfa71a0fd3b10b13ed710

SHA512
3edece268c8cdccf3c686703ffb398f29dc963da9089955e117777b7bf8bc2ed06fb3fe30297cad3f3b4c6d4c47357017879a643fb5dad3d1131186d1f28b417

Download Submit
C:\Windows\{3AF85E75-6B6A-425d-8EC9-5FDA9908B195}.exe

Filesize
372KB

MD5
3602e48d0d49965a0a1c1e12e9151d5b

SHA1
2db064dd4146cbced75c21b0f3dc8023b943748e

SHA256
e5642fa054195870b8208fa9779332cfd38e7bf8f69d08ac6dab27df4e5bd454

SHA512
d79678a73e66841e650d3620b708254b2f73103f655810a51d1e4bd35e3c816c31b8c59ae9dc66313f32dfed31478e0873d2d97de9886eefc7de0a4400550cef

Download Submit
C:\Windows\{839BA38D-9AE4-461d-9603-77843324DB96}.exe

Filesize
372KB

MD5
a3066bb5c8f4bd14a368f7249f4ea7b2

SHA1
f25006f45f0b0914f35b729c76f3752a30d1914c

SHA256
e879f6a0b192c9950f4e0e9ff2aae243e02d3a31baf79a33d16962fa2860899c

SHA512
c938ecb18781a757e38b51d47a05778177227a62c6465b79c72300b2cfc3d235f670ef74bc317e3454c2ecff43017978bc4174d5278c338e1dfc5c7e4ba6e86a

Download Submit
C:\Windows\{845D948B-A175-4085-8FA3-7B70D670D0F8}.exe

Filesize
372KB

MD5
5426811f0dde0558da49ae957b2f25b9

SHA1
73e49384d52251dcb9c8d2a7ca88857b49508173

SHA256
76f0266f96e53955c759f472572af13c29d09a2d919e020bfccb5ce4c6e2690b

SHA512
7fdfdece6026a49ee8656cbe95ea23a95e3d7f18606690c816b90534b7bb99e49d655067ad544eff85c69385cc1173d1e3fa98d6b9cefdbba7ee2a65f57b8607

Download Submit
C:\Windows\{883495AE-F7E6-40a9-A388-0412C5523D4A}.exe

Filesize
372KB

MD5
41d4bce417e86d573d4910000bb071da

SHA1
b3a7c64b4ebe04fe3627f409e13c20a8099318bc

SHA256
6547cfa65ecc5d9f2842b5ce81e9cc12dc41c4f5db4784ba7ac864acef16b52d

SHA512
b546c84463dfe41c5d6087143848195a0c9e76589ae189f5f3b08d3911f931f28fe2f88f43092137034d470afb96e68e7369d6640d54773b6bb8a42aa6e12535

Download Submit
C:\Windows\{BA287038-5B89-4f2d-B774-987291ADBD61}.exe

Filesize
372KB

MD5
604772379ff62560dba473df7d17b105

SHA1
b581a1ae0079bdb394c866a3ba8299cf44c114d8

SHA256
5f4f15a325c589de62d077e2658072a276ede96ee56192a20094f36e3a124229

SHA512
fe859fd38c37b53cfc6204e658d48b7212d245e9117f81bc2b50ff1bd8a063149a958bc1279c6547296f823b82b611683daaf1d7ad92b9a7730371ce27393f99

Download Submit
C:\Windows\{D8F9CCC6-B320-42b8-B934-2C960A4D8324}.exe

Filesize
372KB

MD5
3c56165939d6b0cc4ca1585febdd5577

SHA1
8b907c0cce50e8fa03144d972019ff95a311b4cb

SHA256
09b7a826f87235abfe98d7839e2c033e25ca550c14cc3c40c0950ff6a323dc17

SHA512
e0a3339a0876c88240fcc4a487de34f165f60db2cd07ea5f1f19d273acada78c37d6266886fd980599c3298e0bade470d6d24d869fac189837670c939df14312

Download Submit
C:\Windows\{DFE1A7C0-5A36-4293-99A2-84BD5BB76EA9}.exe

Filesize
372KB

MD5
28fb2df84d9d3c0aafc3e4eb88215bc5

SHA1
fd4c58d2c7ee0097624e91ec28b206374112be2c

SHA256
25b2a29b60bbbc41b628c753326d70d79173535062c0152d95d71ff27887ef82

SHA512
d40131ba5b10ca825c402557a58ee803fde3ef4f806bfd0192ac56077e9bdebfb8feed3f2cecc56bb7a10655e8d05b0fcf08ed3023b2e87bfff51aef0aefc8c5

Download Submit
C:\Windows\{FA364EA4-5B38-4137-B60B-A68B4763D419}.exe

Filesize
372KB

MD5
7880e1d457752cec15871bb55ffb5569

SHA1
8599bf81486ecebd2690bb8099ed09249f529748

SHA256
fec0f369c662729d16a391a7ecf230c9844b6d94bf15e844fea8559229739457

SHA512
2ceeaabf4c1a9108619ac12f3d7c3c3f56674c427f4db44d295e03fcdc7f1449181743e378ab31ee44ce48d74e2ffbd36c317fa4cfefa183a61babb75d8ec306

Download Submit
C:\Windows\{FB60B3C7-5D49-4950-961D-CA57A3BE5131}.exe

Filesize
372KB

MD5
708e09e867d7ff2ed1ac9c3580e3b35b

SHA1
70337c468af1daa245f7924f1c2f915ea06869e1

SHA256
a54002b53fae21f4dc0884696ceb33f862e276b1eb2a6cf6e399f4d0aaac0278

SHA512
3503ba06abd3b21babaa54b80df0d8c192a887b34849014afdb050dd6aad55a6b738738560f40078d07664eb9fdc46cec2fb1fd81fb6f9dc427451c63226da89

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads