1783e0325fca91b73a56961d301bcbd451ab0392613d54e0393fd0f3b3fd1d00

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Size

380KB
MD5

ee8677e786d37814a7200bf9e430c69e
SHA1

cfc28d1d0223cb0d18ead6b421645828509c7783
SHA256

1783e0325fca91b73a56961d301bcbd451ab0392613d54e0393fd0f3b3fd1d00
SHA512

692e41c25005a3d11705506708581881d1b87aefcdbd83adba254bd7754ef31c282ea71265617a70f19f0c30f35f746e9b3a1479405ad8aaff2cb2e3beb8bba3
SSDEEP

3072:mEGh0oHlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGxl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001ea83-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002326d-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023275-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023136-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023275-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023136-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023275-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023136-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023275-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023136-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023275-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023136-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1904574E-766A-416a-BC6D-ACA6926A69B0}\stubpath = "C:\\Windows\\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe"	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DC983F8-ED6B-4907-AD21-C23B136816ED}	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DC983F8-ED6B-4907-AD21-C23B136816ED}\stubpath = "C:\\Windows\\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe"	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}	{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}\stubpath = "C:\\Windows\\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe"	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}\stubpath = "C:\\Windows\\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe"	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}\stubpath = "C:\\Windows\\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe"	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}\stubpath = "C:\\Windows\\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe"	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1904574E-766A-416a-BC6D-ACA6926A69B0}	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DF043BD-8341-451a-A1A2-148090872A6C}\stubpath = "C:\\Windows\\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe"	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}\stubpath = "C:\\Windows\\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe"	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DCB4109-92ED-4847-B621-9A99C20F0971}	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}\stubpath = "C:\\Windows\\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe"	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DF043BD-8341-451a-A1A2-148090872A6C}	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A06AAA4-A708-4c9c-A775-364B1288501C}\stubpath = "C:\\Windows\\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe"	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DCB4109-92ED-4847-B621-9A99C20F0971}\stubpath = "C:\\Windows\\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe"	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}\stubpath = "C:\\Windows\\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe"	{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A06AAA4-A708-4c9c-A775-364B1288501C}	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe

Executes dropped EXE 12 IoCs

pid	Process
4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
528	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
1820	{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
5776	{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
File created	C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
File created	C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
File created	C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe	{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
File created	C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
File created	C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
File created	C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
File created	C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
File created	C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
File created	C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
File created	C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
File created	C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
Token: SeIncBasePriorityPrivilege	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
Token: SeIncBasePriorityPrivilege	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
Token: SeIncBasePriorityPrivilege	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
Token: SeIncBasePriorityPrivilege	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
Token: SeIncBasePriorityPrivilege	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
Token: SeIncBasePriorityPrivilege	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
Token: SeIncBasePriorityPrivilege	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
Token: SeIncBasePriorityPrivilege	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
Token: SeIncBasePriorityPrivilege	528	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
Token: SeIncBasePriorityPrivilege	1820	{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4628	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	96
PID 4596 wrote to memory of 4628	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	96
PID 4596 wrote to memory of 4628	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	96
PID 4596 wrote to memory of 4168	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	97
PID 4596 wrote to memory of 4168	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	97
PID 4596 wrote to memory of 4168	4596	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	97
PID 4628 wrote to memory of 6020	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	100
PID 4628 wrote to memory of 6020	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	100
PID 4628 wrote to memory of 6020	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	100
PID 4628 wrote to memory of 5500	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	101
PID 4628 wrote to memory of 5500	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	101
PID 4628 wrote to memory of 5500	4628	{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe	101
PID 6020 wrote to memory of 5876	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	105
PID 6020 wrote to memory of 5876	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	105
PID 6020 wrote to memory of 5876	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	105
PID 6020 wrote to memory of 1660	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	104
PID 6020 wrote to memory of 1660	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	104
PID 6020 wrote to memory of 1660	6020	{2DF043BD-8341-451a-A1A2-148090872A6C}.exe	104
PID 5876 wrote to memory of 4868	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	108
PID 5876 wrote to memory of 4868	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	108
PID 5876 wrote to memory of 4868	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	108
PID 5876 wrote to memory of 2816	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	109
PID 5876 wrote to memory of 2816	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	109
PID 5876 wrote to memory of 2816	5876	{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe	109
PID 4868 wrote to memory of 1280	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	110
PID 4868 wrote to memory of 1280	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	110
PID 4868 wrote to memory of 1280	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	110
PID 4868 wrote to memory of 3476	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	111
PID 4868 wrote to memory of 3476	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	111
PID 4868 wrote to memory of 3476	4868	{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe	111
PID 1280 wrote to memory of 3900	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	112
PID 1280 wrote to memory of 3900	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	112
PID 1280 wrote to memory of 3900	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	112
PID 1280 wrote to memory of 2008	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	113
PID 1280 wrote to memory of 2008	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	113
PID 1280 wrote to memory of 2008	1280	{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe	113
PID 3900 wrote to memory of 5176	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	114
PID 3900 wrote to memory of 5176	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	114
PID 3900 wrote to memory of 5176	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	114
PID 3900 wrote to memory of 3748	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	115
PID 3900 wrote to memory of 3748	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	115
PID 3900 wrote to memory of 3748	3900	{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe	115
PID 5176 wrote to memory of 4952	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	117
PID 5176 wrote to memory of 4952	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	117
PID 5176 wrote to memory of 4952	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	117
PID 5176 wrote to memory of 5216	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	116
PID 5176 wrote to memory of 5216	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	116
PID 5176 wrote to memory of 5216	5176	{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe	116
PID 4952 wrote to memory of 6136	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	118
PID 4952 wrote to memory of 6136	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	118
PID 4952 wrote to memory of 6136	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	118
PID 4952 wrote to memory of 5212	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	119
PID 4952 wrote to memory of 5212	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	119
PID 4952 wrote to memory of 5212	4952	{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe	119
PID 6136 wrote to memory of 528	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	120
PID 6136 wrote to memory of 528	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	120
PID 6136 wrote to memory of 528	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	120
PID 6136 wrote to memory of 4916	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	121
PID 6136 wrote to memory of 4916	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	121
PID 6136 wrote to memory of 4916	6136	{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe	121
PID 528 wrote to memory of 1820	528	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe	122
PID 528 wrote to memory of 1820	528	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe	122
PID 528 wrote to memory of 1820	528	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe	122
PID 528 wrote to memory of 3540	528	{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe	123

C:\Users\Admin\AppData\Local\Temp\2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
  C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
    C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2DF04~1.EXE > nul
      4⤵
      PID:1660
  - - C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
      C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5876
    - - C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
        
        C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4868
      - C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
        
        C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
        
        C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
        
        C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{933C6~1.EXE > nul
        9⤵
        
        PID:5216
        
        C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
        
        C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
        
        C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
        
        C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
        
        C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6DCB4~1.EXE > nul
        13⤵
        
        PID:3180
        
        C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe
        
        C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe
        13⤵
        Executes dropped EXE
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A06A~1.EXE > nul
        12⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7136~1.EXE > nul
        11⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{935B1~1.EXE > nul
        10⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3DC98~1.EXE > nul
        8⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EF278~1.EXE > nul
        7⤵
        
        PID:2008
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{19045~1.EXE > nul
        6⤵
        
        PID:3476
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA77D~1.EXE > nul
        5⤵
        
        PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{69F08~1.EXE > nul
    3⤵
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe

Filesize
380KB

MD5
32bf3ff282f5e410284469c47012aac4

SHA1
6c882f123e6d49540f5fc5e34b5995bea6db11b9

SHA256
963728c671f3a2be9b7a31d8c13446ab642f310b4ac58362f7575287faccfbf6

SHA512
157aca937cef12f84b91940fcf903c32c757938e2aa0ab642946cd84c025a0fb7cc5c827edbbd1086081d9a14ef55ebd2f05cefa865bbab63a051bd23857f03b

Download Submit
C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe

Filesize
380KB

MD5
cf9e6617e6dadea8b6695d804df520b1

SHA1
a8976d122edf38992557cf485a6e6302ada1b508

SHA256
dd3079a682083ed7d033a2a60017eb81fe7c301342396d11b81dfccbb9b1b196

SHA512
688282d2ac314343f60d2d3631140e64569ba8e041f99d9753a574387d59644191d58b417dd87bd6f2b9e2d9e8e1cf3bc2da950823eab75e1960ffe325873ec2

Download Submit
C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe

Filesize
380KB

MD5
8b9c4dd52f42b083e60c820c3e9abe90

SHA1
df45073634f2ead6ca1e4afab30448ac209ec649

SHA256
d41a8f6d5b0007a6e5d5a7347b9df839f0c8f8224d6cd0798114b4cd56720c15

SHA512
805fcf3e0e2eb4a6cdfe68d2ed215a6630730d372c90f607c9e9396372fda6327d2c265ab990b23eb18713a22ebcf7895e80aee1115aec3ffb56be19b5280886

Download Submit
C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe

Filesize
380KB

MD5
44fb49434ff0076ae9f8181b8a0234e3

SHA1
5c66513fc6898dbbdedf4b333cfeda56fa4147ef

SHA256
edfc25ba18106b683de6e06e4cd6dc99b5c080652bae1f7cd567cea81487fd4b

SHA512
062b92a0f9c69f54f41651504d8753c0ae7eadae8c41fa36286cf888cf39b7fb608d4f595c4dd70b103d0042bf2279e23cc59f474c2b864e7d95e097a8e36eb2

Download Submit
C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe

Filesize
380KB

MD5
a9637112b1ac10975bd353c94ddc5f14

SHA1
6ef1c93fe3729c90202d6b7a632e36b3ef7e438f

SHA256
3670de3353a0ce1a1b526c8d9cdcf1ed199c6d980c7204eb58e14fc91a5ff6a7

SHA512
3ce052f8f825a0574a351281b503f845a2ae00cd11921babc28ebf310adc7be6068d51a388827320e562b4c4eab901e8b045d9a5143acd8a37be1e523434abf8

Download Submit
C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe

Filesize
380KB

MD5
f65c0436a0edc152bf01effa56eb74bc

SHA1
eebf319629d09f32d0bfa8b5e2698cefdb62857a

SHA256
5e24964b1203e26b6df04387dada0798ecfa0f1fa12bdf536228191eaa521b81

SHA512
e39bbab746993b9292571cf5224cc2d3806f4f0752b08bdacdd0f4d3b0026de7a62365f088a8d35d09b7219c25a20428f4e82867d1836f63cb55d47a554f2a04

Download Submit
C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe

Filesize
380KB

MD5
9914926177fcab611e7955e2bedc05e8

SHA1
6353c47026940c628fd3070d6a20e29545315373

SHA256
cd768864a36135a9c053656a2d62a418f34f2a6f7d73d1bf369935949d260637

SHA512
2f5093b8925fd57f22fa1097ce833fd75aed3042d2ae349fda519007a6ff7e431080b593124adee7e18794e466e530846573899449587848139cca1d63eebcf1

Download Submit
C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe

Filesize
380KB

MD5
a88c877f895d0fecc835d1fd8c28ee7d

SHA1
55c2b5ae6914167f01c796d73a9b3c486155a3a7

SHA256
d9acc7fe98a27fceab64e15fa17300f269eca946ec370a4f97a772ed5277f23c

SHA512
b601af04b96e23601301b0f3d3992afc52844ab983769245f734918c41cfcd9eaccdfe4f0e79834cb107db0177f1c7978a96d93992443fe16c4d2f8dc2d45641

Download Submit
C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe

Filesize
380KB

MD5
153bbda2de51213a88715a42b2453a09

SHA1
11c286434ddabdec765c808ef585dacb6fd52f62

SHA256
453147859ccc37208e69889d0b0a94e6065046955cac56eca21e24b7e564df42

SHA512
8b6d9f38900c9f22694df933c3f80cac5c4aa2751548680a9beb3e0048af34b76d6d879e59950ce24e51d9d8b0f6224e8af1428e83dadd573e3ee8578f67f8b5

Download Submit
C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe

Filesize
380KB

MD5
f98218955a3f2c5d1a58d4e107496ffe

SHA1
222ba37bdd59a82aecf4e3a7680722cd667590e8

SHA256
4b8ff02a86b5d6fdef66ec66dac986813cdae39176297349ce03467e63f0d0c5

SHA512
5eead8a1629e8531ed664a216ceaf6ee363cae5e63901bc2bd6fccfe5684ffc7d92f981207ba55c130ce153b06039c4974f0dc1d195d304e14251ae63d852700

Download Submit
C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe

Filesize
380KB

MD5
f7d4017541ab6f68f4a66a75578acd2f

SHA1
ea471339896e41144092e2e2a318a5845844b5a0

SHA256
6630e42d85eaac068302f81c3733f1b4eaf694301d9c81f8c3c0e3d6c9712b9c

SHA512
37d003cf680fc1e30a1f3b1e71d6cf10fb9e6312f94719bec9dfe09b4436053b49ea4a210bcce7b22bf40b8e49c304323b4b76e0546ba32fbc9e0f0ce0b7e47d

Download Submit
C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe

Filesize
380KB

MD5
f64a985f4d9d921f335716343493a08c

SHA1
ca4ef93a6c3a6e9251eb637d340ef1d83514ec7c

SHA256
8eef8cab4dfcd1d95ac4b056ca4198a3ffe8e513596bb952ba73f09bcdf39ac1

SHA512
7577f3f4bc0c5736a237b477dbdca1b777d75ce6a71dcf7da0cad53114c3cfd0984f5b1ae453310208b639e086d6e93af500c33c65bdf5a89b1d4c238783f4e9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads