d2420f525a9f6a8b5793ade7107108f78814ae1c0007c05167b2ac316b4fba8a

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe
Size

408KB
MD5

093c1d93e46cd7e3daf2087e39ca3e91
SHA1

95577fc4b21aecdbc912d6213484d6fdfd9ca505
SHA256

d2420f525a9f6a8b5793ade7107108f78814ae1c0007c05167b2ac316b4fba8a
SHA512

b915e4dcc42a1c66774a01ba5ce03a3ebfc9edf8cf6ed98aae8106df79bc76d1036146f04d3cbc1be9a379ed514d678559e4b8555dcd76fb1bb3911c3f7b641c
SSDEEP

3072:CEGh0o3l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGZldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001507e-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002f000000016d37-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f3-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0030000000016d37-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0030000000016d37-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0012000000016d61-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0031000000016d37-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0013000000016d61-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000016d6d-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0014000000016d61-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000016d75-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}\stubpath = "C:\\Windows\\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe"	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{477407B5-A7E3-47d1-8BC7-1EA178CFD585}	{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}	{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{477407B5-A7E3-47d1-8BC7-1EA178CFD585}\stubpath = "C:\\Windows\\{477407B5-A7E3-47d1-8BC7-1EA178CFD585}.exe"	{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}\stubpath = "C:\\Windows\\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe"	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3C65B07-6470-499c-8B26-C9757BD17412}	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}	{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3C65B07-6470-499c-8B26-C9757BD17412}\stubpath = "C:\\Windows\\{D3C65B07-6470-499c-8B26-C9757BD17412}.exe"	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0065680A-639C-42c9-A5CC-9DD66D7D361A}	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4484E672-B6CF-4819-85CC-10297C8D81CA}	{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0065680A-639C-42c9-A5CC-9DD66D7D361A}\stubpath = "C:\\Windows\\{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe"	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}\stubpath = "C:\\Windows\\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe"	{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}\stubpath = "C:\\Windows\\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe"	{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBBFAA54-2B2F-474d-8B42-8A7500397156}	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBBFAA54-2B2F-474d-8B42-8A7500397156}\stubpath = "C:\\Windows\\{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe"	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}\stubpath = "C:\\Windows\\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe"	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}\stubpath = "C:\\Windows\\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe"	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}\stubpath = "C:\\Windows\\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe"	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4484E672-B6CF-4819-85CC-10297C8D81CA}\stubpath = "C:\\Windows\\{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe"	{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe

Deletes itself 1 IoCs

pid	Process
2592	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
1708	{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
1660	{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
2244	{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe
2212	{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
File created	C:\Windows\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
File created	C:\Windows\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
File created	C:\Windows\{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
File created	C:\Windows\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe	{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
File created	C:\Windows\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe	{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
File created	C:\Windows\{477407B5-A7E3-47d1-8BC7-1EA178CFD585}.exe	{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe
File created	C:\Windows\{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe
File created	C:\Windows\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
File created	C:\Windows\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
File created	C:\Windows\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
File created	C:\Windows\{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe	{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
Token: SeIncBasePriorityPrivilege	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
Token: SeIncBasePriorityPrivilege	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
Token: SeIncBasePriorityPrivilege	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
Token: SeIncBasePriorityPrivilege	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
Token: SeIncBasePriorityPrivilege	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
Token: SeIncBasePriorityPrivilege	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
Token: SeIncBasePriorityPrivilege	1708	{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
Token: SeIncBasePriorityPrivilege	1660	{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
Token: SeIncBasePriorityPrivilege	2244	{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1576	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	28
PID 1972 wrote to memory of 1576	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	28
PID 1972 wrote to memory of 1576	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	28
PID 1972 wrote to memory of 1576	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	28
PID 1972 wrote to memory of 2592	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	29
PID 1972 wrote to memory of 2592	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	29
PID 1972 wrote to memory of 2592	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	29
PID 1972 wrote to memory of 2592	1972	2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe	29
PID 1576 wrote to memory of 2568	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	30
PID 1576 wrote to memory of 2568	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	30
PID 1576 wrote to memory of 2568	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	30
PID 1576 wrote to memory of 2568	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	30
PID 1576 wrote to memory of 2560	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	31
PID 1576 wrote to memory of 2560	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	31
PID 1576 wrote to memory of 2560	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	31
PID 1576 wrote to memory of 2560	1576	{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe	31
PID 2568 wrote to memory of 2852	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	34
PID 2568 wrote to memory of 2852	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	34
PID 2568 wrote to memory of 2852	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	34
PID 2568 wrote to memory of 2852	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	34
PID 2568 wrote to memory of 3056	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	35
PID 2568 wrote to memory of 3056	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	35
PID 2568 wrote to memory of 3056	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	35
PID 2568 wrote to memory of 3056	2568	{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe	35
PID 2852 wrote to memory of 680	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	36
PID 2852 wrote to memory of 680	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	36
PID 2852 wrote to memory of 680	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	36
PID 2852 wrote to memory of 680	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	36
PID 2852 wrote to memory of 652	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	37
PID 2852 wrote to memory of 652	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	37
PID 2852 wrote to memory of 652	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	37
PID 2852 wrote to memory of 652	2852	{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe	37
PID 680 wrote to memory of 2712	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	38
PID 680 wrote to memory of 2712	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	38
PID 680 wrote to memory of 2712	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	38
PID 680 wrote to memory of 2712	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	38
PID 680 wrote to memory of 2736	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	39
PID 680 wrote to memory of 2736	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	39
PID 680 wrote to memory of 2736	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	39
PID 680 wrote to memory of 2736	680	{D3C65B07-6470-499c-8B26-C9757BD17412}.exe	39
PID 2712 wrote to memory of 748	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	40
PID 2712 wrote to memory of 748	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	40
PID 2712 wrote to memory of 748	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	40
PID 2712 wrote to memory of 748	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	40
PID 2712 wrote to memory of 1776	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	41
PID 2712 wrote to memory of 1776	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	41
PID 2712 wrote to memory of 1776	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	41
PID 2712 wrote to memory of 1776	2712	{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe	41
PID 748 wrote to memory of 1936	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	42
PID 748 wrote to memory of 1936	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	42
PID 748 wrote to memory of 1936	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	42
PID 748 wrote to memory of 1936	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	42
PID 748 wrote to memory of 904	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	43
PID 748 wrote to memory of 904	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	43
PID 748 wrote to memory of 904	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	43
PID 748 wrote to memory of 904	748	{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe	43
PID 1936 wrote to memory of 1708	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	44
PID 1936 wrote to memory of 1708	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	44
PID 1936 wrote to memory of 1708	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	44
PID 1936 wrote to memory of 1708	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	44
PID 1936 wrote to memory of 2608	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	45
PID 1936 wrote to memory of 2608	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	45
PID 1936 wrote to memory of 2608	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	45
PID 1936 wrote to memory of 2608	1936	{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-27_093c1d93e46cd7e3daf2087e39ca3e91_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
  C:\Windows\{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
    C:\Windows\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
      C:\Windows\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
        
        C:\Windows\{D3C65B07-6470-499c-8B26-C9757BD17412}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:680
      - C:\Windows\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
        
        C:\Windows\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
        
        C:\Windows\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
        
        C:\Windows\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
        
        C:\Windows\{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
        
        C:\Windows\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe
        
        C:\Windows\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe
        
        C:\Windows\{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C372E~1.EXE > nul
        12⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA7D5~1.EXE > nul
        11⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00656~1.EXE > nul
        10⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E6BE~1.EXE > nul
        9⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5CA9C~1.EXE > nul
        8⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10D89~1.EXE > nul
        7⤵
        
        PID:1776
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3C65~1.EXE > nul
        6⤵
        
        PID:2736
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7F567~1.EXE > nul
        5⤵
        
        PID:652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{20544~1.EXE > nul
      4⤵
      PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EBBFA~1.EXE > nul
    3⤵
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0065680A-639C-42c9-A5CC-9DD66D7D361A}.exe

Filesize
408KB

MD5
001efc846c01b9b1b147c72f7d7c7489

SHA1
d9b4c304594b6f22b5581677d0a4c3f0ed22f53b

SHA256
ab26d0adef0dcde8e09f86f8baee7eb43013e5eb9f1c698d7f776c0836cf4c11

SHA512
a5e266532a4913bdf1281bb1338bbe15c7af912c06d3337607c7c470b6be6a9b6c44722186b3475b7d1de31ca28a9549ee113b2af61d179760d899ecbb89783d

Download Submit
C:\Windows\{0E6BEEDE-E560-452a-B87E-7CDB3BA07D68}.exe

Filesize
408KB

MD5
c9ae56b02152db597366da2ef641184f

SHA1
6f2a48f741a52f1d31abe539b2e646234773bfea

SHA256
ec349daa9fddf8aa625006200197c6d790f60d0a1f3da7d763ba01ba56b35427

SHA512
0768d56696b6cdb141e89c6969991022631f749ebb6ff886abe8fcb560aaaadcaabe085de1163e6d510625208e85f79ffc18e54660e33d14fda244262a35fbe5

Download Submit
C:\Windows\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe

Filesize
408KB

MD5
85183e40beb82b5e6aad722c04f3391c

SHA1
6d9d79dc6c268a7066d617d0534cea6e007419a4

SHA256
ffe0a91e40ba673287f0c6f16bb0619dd7294e41748b8cb3cf6ce7198ab827b2

SHA512
f0e0bf1744fb82f09eef954222c93104a505229a0c64f59fa8df5856c01ac93bea9f49db65558db1f923e8c0f870117a91a406ecd7219a53659833130064ebab

Download Submit
C:\Windows\{10D89AFB-5AF9-4d47-946D-1883ADB8249C}.exe

Filesize
320KB

MD5
fc6c7d81e479bbd0c8deaa560b9f0281

SHA1
c277d8faca2a7e21b38eb3e636e33d00cf6ed3b5

SHA256
f19b3bcea0d6e1a61858a4350ec5a62ca79eea9ec8612960cb0bb57937ac9385

SHA512
3d66c74c9fcda47ec757c448d504cf869fed09ecba8793d8387aa8f09ac273b508ef4c7380f5cfd03e63d923e9edad68af9baa4589880803967e7ecf185830c7

Download Submit
C:\Windows\{20544271-E5C4-4b3d-BE59-39AB2BCFA676}.exe

Filesize
408KB

MD5
edad3bdf8d6a3d8a6927db216c76e081

SHA1
a442bab867cc3a534c367673bc328aaac5a0afcf

SHA256
2582c9ddc899ad545bf811187987ca61eb64ec7e0ee02a795867bb74bfd19ab0

SHA512
7c5fb66bd59dcd82ee6256ae3c1506a2d27bb337bab49e06f19a9700cb7eda8621fa8f4176d21fcf4d78443252be6d9858fc74c426809bdb301cfa5a32e7927b

Download Submit
C:\Windows\{4484E672-B6CF-4819-85CC-10297C8D81CA}.exe

Filesize
408KB

MD5
af50d1fba2bf2b46c8136ed6fbaf5855

SHA1
6585aaace0f862d0e88d54624a6ac386c1edc25c

SHA256
2adeb9c3fc315e3a8c691066ceb2a9a6df072b8c07f22b899ce398393e31ca1e

SHA512
41adebf55879930e313d6dd6ee177b1889fa0bf75ed70e93a5b585c3e838f74af31905a95c2ca6716e1c5c7f64a82f63e016f004eddf1c2ec24020afee892650

Download Submit
C:\Windows\{5CA9C093-7186-4897-B21E-11DB15FDBAE1}.exe

Filesize
408KB

MD5
bfb1472ab334d3d6ddf112abf77137b4

SHA1
c602c93d153018c42c6855c7bafb18b8aecc397e

SHA256
424e2b450a632ebe1eb990d2e5c2f51a2ea268cc3cce77032174072be94b5a80

SHA512
c3d458bcb8c0a43a42d569531c4522ca75fd00c85c342d0cba02e62488a6f0934a755f371434ca78c7fc9b193b11558b294887792754a3c647bb01911997a9c9

Download Submit
C:\Windows\{7F567F9E-2C7F-4cbd-8CEC-73E91AA59966}.exe

Filesize
408KB

MD5
7a6d8223791704ad2c3cbfd00aee00f6

SHA1
14857f52316bbc474b44976dac7d60913c84f497

SHA256
56a0b50fd7b04aa9aeb8f6a156a56cfdb6190a0461b0305637739dc5c2919a6b

SHA512
7452db5a417808f47ab723147a39a9f929b5ddab02cb9607f0007eff7fb8adfe88afa9b97f08774c54e7cd07f3f3343c112e13a6795c25f7b4b5152401cf1ac0

Download Submit
C:\Windows\{C372E424-CE1C-4bd0-8A5A-C3391C1F74B4}.exe

Filesize
408KB

MD5
b28250fc350a7149c33e7c8a059ef493

SHA1
1f56b1ee83416630b16b414a3faddd2ed27ba9ae

SHA256
59d896ea0be2f4c0ae6f6843a5696fa3807adc005efe30254e403284d9024f35

SHA512
bbeabab922ce913d1d8bb7a1d92699f213b6d09a2a3c090673492c286ca0f1dfa9421c44d27ede597132a7c8ab5d9e6248438424eb5061082852468b1d20c387

Download Submit
C:\Windows\{D3C65B07-6470-499c-8B26-C9757BD17412}.exe

Filesize
408KB

MD5
8bc6caa204d2554ac8c6a06130c5c3d3

SHA1
fcd1c64b937f96f47da3f49bcb9c49de42d43d64

SHA256
d9151d36bc0ddb2ebd8af2e3171f2002eedb287e716e2f7d57fa9b2c38dc4a1d

SHA512
27c59237fc0b331ab8137fb1f36d463b8882f977cb0a12d5e4eafa9c0f0875bcd35e6829f06f575a67c6b884de149ebca7d25b489c6af8e91db02036d1f9f874

Download Submit
C:\Windows\{DA7D5A77-3ECA-484b-8E6B-82E169C44953}.exe

Filesize
408KB

MD5
593009adef873ae19fecead5ac815ca5

SHA1
99657e612f2f4ab7fe2b9e723750877167384199

SHA256
5ab63e95be24872ed073cf87ef775aa707dda9438e1ff75fa6721eb72e4c330b

SHA512
5d6481bf6b165b49cbcd6bd1efb6700c61dcc9bf813ca02ce4a7852d4fc084f601ceec158fc83133e0bad9ed89ba6b3ef6915010cba2c019ed6d9ddbb287e77e

Download Submit
C:\Windows\{EBBFAA54-2B2F-474d-8B42-8A7500397156}.exe

Filesize
408KB

MD5
a9a0824004ae2c4494c2699f7f340db5

SHA1
19939511adb23c1ddc9a75c0c666841c2de473b3

SHA256
428c2eec8a364b93589329b717c117a306fe76d0674a57f924b37ed46681fac7

SHA512
9ab99bfcd58b2289858a04f268633e639dac15609774589032bbfd481dc966f55690d218e7c7317be1f88066260b5a03f6c13f7909e5809f834b7f64ea2555fb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads