0db813dd449574cfd56b459480a155167338e8f5e19a5ab02c8335d98be295d1

Analysis

max time kernel
150s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe
Size

204KB
MD5

4ede1f20c01989f6fc2afefd1c7fd0c8
SHA1

9fcb63da846cfc5b37d933a77819758806c123c1
SHA256

0db813dd449574cfd56b459480a155167338e8f5e19a5ab02c8335d98be295d1
SHA512

37db6856dc67475166c05a86eddc8582789ad3227d3e15d1abfdcc005e3fa305373a835d99264ff775804db758e970e689a16369e24892145b54808eac17a460
SSDEEP

1536:1EGh0oKl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oKl1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012265-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000019337-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00120000000055a2-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000012265-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00130000000055a2-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012265-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00140000000055a2-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012265-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00150000000055a2-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012265-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00160000000055a2-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012265-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}	{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}\stubpath = "C:\\Windows\\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe"	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12960F67-10C3-4d1e-84E0-84192D29CDAE}	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12960F67-10C3-4d1e-84E0-84192D29CDAE}\stubpath = "C:\\Windows\\{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe"	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}	{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57195892-CB3D-43f7-9EDE-16C1A2E57146}	{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E713E96E-0F6E-4693-971F-9B64995124C2}	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B97086D4-A090-401a-81AF-08E3385BAC59}	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}\stubpath = "C:\\Windows\\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe"	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8F54F69D-6386-4f69-B875-DB48F34D4137}	{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}\stubpath = "C:\\Windows\\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe"	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}\stubpath = "C:\\Windows\\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe"	{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8F54F69D-6386-4f69-B875-DB48F34D4137}\stubpath = "C:\\Windows\\{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe"	{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}\stubpath = "C:\\Windows\\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe"	{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E713E96E-0F6E-4693-971F-9B64995124C2}\stubpath = "C:\\Windows\\{E713E96E-0F6E-4693-971F-9B64995124C2}.exe"	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B97086D4-A090-401a-81AF-08E3385BAC59}\stubpath = "C:\\Windows\\{B97086D4-A090-401a-81AF-08E3385BAC59}.exe"	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44959D66-2E68-4387-B7FF-AA4151A4CE73}\stubpath = "C:\\Windows\\{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe"	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57195892-CB3D-43f7-9EDE-16C1A2E57146}\stubpath = "C:\\Windows\\{57195892-CB3D-43f7-9EDE-16C1A2E57146}.exe"	{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}\stubpath = "C:\\Windows\\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe"	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44959D66-2E68-4387-B7FF-AA4151A4CE73}	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe

Deletes itself 1 IoCs

pid	Process
2040	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe
2776	{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
1596	{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
2176	{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
1744	{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe
2132	{57195892-CB3D-43f7-9EDE-16C1A2E57146}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe
File created	C:\Windows\{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
File created	C:\Windows\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
File created	C:\Windows\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
File created	C:\Windows\{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
File created	C:\Windows\{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe	{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
File created	C:\Windows\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe	{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
File created	C:\Windows\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
File created	C:\Windows\{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
File created	C:\Windows\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe
File created	C:\Windows\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe	{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
File created	C:\Windows\{57195892-CB3D-43f7-9EDE-16C1A2E57146}.exe	{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
Token: SeIncBasePriorityPrivilege	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
Token: SeIncBasePriorityPrivilege	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
Token: SeIncBasePriorityPrivilege	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
Token: SeIncBasePriorityPrivilege	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
Token: SeIncBasePriorityPrivilege	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
Token: SeIncBasePriorityPrivilege	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe
Token: SeIncBasePriorityPrivilege	2776	{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
Token: SeIncBasePriorityPrivilege	1596	{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
Token: SeIncBasePriorityPrivilege	2176	{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
Token: SeIncBasePriorityPrivilege	1744	{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1096	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	28
PID 3020 wrote to memory of 1096	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	28
PID 3020 wrote to memory of 1096	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	28
PID 3020 wrote to memory of 1096	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	28
PID 3020 wrote to memory of 2040	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	29
PID 3020 wrote to memory of 2040	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	29
PID 3020 wrote to memory of 2040	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	29
PID 3020 wrote to memory of 2040	3020	2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe	29
PID 1096 wrote to memory of 2520	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	32
PID 1096 wrote to memory of 2520	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	32
PID 1096 wrote to memory of 2520	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	32
PID 1096 wrote to memory of 2520	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	32
PID 1096 wrote to memory of 2916	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	33
PID 1096 wrote to memory of 2916	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	33
PID 1096 wrote to memory of 2916	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	33
PID 1096 wrote to memory of 2916	1096	{E713E96E-0F6E-4693-971F-9B64995124C2}.exe	33
PID 2520 wrote to memory of 2460	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	34
PID 2520 wrote to memory of 2460	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	34
PID 2520 wrote to memory of 2460	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	34
PID 2520 wrote to memory of 2460	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	34
PID 2520 wrote to memory of 2408	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	35
PID 2520 wrote to memory of 2408	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	35
PID 2520 wrote to memory of 2408	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	35
PID 2520 wrote to memory of 2408	2520	{B97086D4-A090-401a-81AF-08E3385BAC59}.exe	35
PID 2460 wrote to memory of 2928	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	36
PID 2460 wrote to memory of 2928	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	36
PID 2460 wrote to memory of 2928	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	36
PID 2460 wrote to memory of 2928	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	36
PID 2460 wrote to memory of 3040	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	37
PID 2460 wrote to memory of 3040	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	37
PID 2460 wrote to memory of 3040	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	37
PID 2460 wrote to memory of 3040	2460	{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe	37
PID 2928 wrote to memory of 548	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	38
PID 2928 wrote to memory of 548	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	38
PID 2928 wrote to memory of 548	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	38
PID 2928 wrote to memory of 548	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	38
PID 2928 wrote to memory of 2380	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	39
PID 2928 wrote to memory of 2380	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	39
PID 2928 wrote to memory of 2380	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	39
PID 2928 wrote to memory of 2380	2928	{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe	39
PID 548 wrote to memory of 1356	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	40
PID 548 wrote to memory of 1356	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	40
PID 548 wrote to memory of 1356	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	40
PID 548 wrote to memory of 1356	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	40
PID 548 wrote to memory of 2708	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	41
PID 548 wrote to memory of 2708	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	41
PID 548 wrote to memory of 2708	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	41
PID 548 wrote to memory of 2708	548	{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe	41
PID 1356 wrote to memory of 2464	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	42
PID 1356 wrote to memory of 2464	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	42
PID 1356 wrote to memory of 2464	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	42
PID 1356 wrote to memory of 2464	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	42
PID 1356 wrote to memory of 2732	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	43
PID 1356 wrote to memory of 2732	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	43
PID 1356 wrote to memory of 2732	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	43
PID 1356 wrote to memory of 2732	1356	{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe	43
PID 2464 wrote to memory of 2776	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	44
PID 2464 wrote to memory of 2776	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	44
PID 2464 wrote to memory of 2776	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	44
PID 2464 wrote to memory of 2776	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	44
PID 2464 wrote to memory of 2796	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	45
PID 2464 wrote to memory of 2796	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	45
PID 2464 wrote to memory of 2796	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	45
PID 2464 wrote to memory of 2796	2464	{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_4ede1f20c01989f6fc2afefd1c7fd0c8_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
  C:\Windows\{E713E96E-0F6E-4693-971F-9B64995124C2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
    C:\Windows\{B97086D4-A090-401a-81AF-08E3385BAC59}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
      C:\Windows\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
        
        C:\Windows\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2928
      - C:\Windows\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
        
        C:\Windows\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
        
        C:\Windows\{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe
        
        C:\Windows\{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
        
        C:\Windows\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
        
        C:\Windows\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
        
        C:\Windows\{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
        
        C:\Windows\{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Windows\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe
        
        C:\Windows\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\{57195892-CB3D-43f7-9EDE-16C1A2E57146}.exe
        
        C:\Windows\{57195892-CB3D-43f7-9EDE-16C1A2E57146}.exe
        13⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{380BD~1.EXE > nul
        13⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8F54F~1.EXE > nul
        12⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95DF5~1.EXE > nul
        11⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C614D~1.EXE > nul
        10⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44959~1.EXE > nul
        9⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12960~1.EXE > nul
        8⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DCF43~1.EXE > nul
        7⤵
        
        PID:2708
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2E8FB~1.EXE > nul
        6⤵
        
        PID:2380
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7E94~1.EXE > nul
        5⤵
        
        PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B9708~1.EXE > nul
      4⤵
      PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E713E~1.EXE > nul
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{12960F67-10C3-4d1e-84E0-84192D29CDAE}.exe

Filesize
204KB

MD5
e60bdf6836cc8e6114988a3c79e0b5b4

SHA1
e203978702d9063fee0f85de17d6d3e65fa3d4ec

SHA256
d76b0b7dddd2c08bd224f0a261e71d35436b1fdfc8d20365fd6a113ec5589911

SHA512
13bc3298a74f337c6cfb456e76a67d57debc791ee4c2a42fe4190e1ee09a8e4545017a9d7038af3bafec8e522aac99a2c134cad3bd19a214f6e3f85e3e75958f

Download Submit
C:\Windows\{2E8FB1AB-BD88-4337-B539-6F07ED19C4D6}.exe

Filesize
204KB

MD5
79bf74bf62bce5d694e828bc14ca6a72

SHA1
ffb0851fe2b7ce3196eabd5d8b4d08ea3e2f13ef

SHA256
7512592d3cd9776a29f89dd837145906ca89a0f8a137f385e2c0928ea003c6a8

SHA512
f42bffe327e58e50310b227a0acf4a0189fec89ba7bf95979c667c69e1198174d703f2134ec0fc850b24033c5e4f9e2e86e3952dddfa6307f9bd3d018bfaf237

Download Submit
C:\Windows\{380BD3AA-EB29-4cb9-A7C1-8D4895765D4C}.exe

Filesize
204KB

MD5
487a5477265c6b593d46dafd295e1fbf

SHA1
3551d7fd8c5fd6e0475d2c92c64730d1700a862c

SHA256
db294645065f24f04c02cf0dc4ac83e65b3cbde3daa4eb3730760fa2661ba9dd

SHA512
c34d42e7c19108e6d27f0fdc0641656fb0f2cc83284dca0704261a998cea38cd4a7d76e85fc2269663745be0d6635a8fc11222943eda37326442552a79b98dcb

Download Submit
C:\Windows\{44959D66-2E68-4387-B7FF-AA4151A4CE73}.exe

Filesize
204KB

MD5
8d5da1f62b2895518f8e2b3231fa6fc0

SHA1
b6cc8ff6a0043b8ddcd47079217dacb3fc645ff6

SHA256
c5b128eeca295fba24f56bccc5309a1765167c3d165ad37765c362f72f1d934d

SHA512
0d8116e349e191e09d07f86d1da1413d48222899c1baf8b364bdaa2af29562b92d4f62ef6ef7c7a3e27c64da5d99beff01bf098fdb326d164ef900a77f10b278

Download Submit
C:\Windows\{57195892-CB3D-43f7-9EDE-16C1A2E57146}.exe

Filesize
204KB

MD5
6cc3d30a07ac1d2f64fbb727dabe3afe

SHA1
69736ab73673b36541a8c3f46fbb5059d210cf6d

SHA256
8f847ca643a0d3a67ecb031e49119ccd29605f0e0568856a091249121997f4d0

SHA512
256d857f7a0450b3810229bd5a1c9e77d53f7c7f7e0808c0dd0391c499238b08b1e663ef24ada7f96b6d61716e6665bcb9b9fca916f3fbf8865048d65eeb2489

Download Submit
C:\Windows\{8F54F69D-6386-4f69-B875-DB48F34D4137}.exe

Filesize
204KB

MD5
c27299e1b104f10f43c8ef949bd4a633

SHA1
d6ac4018fc7a4f68cae735e8b3315a1e0045e6ba

SHA256
5ae8a280568cfcdc8f5f6b8b799640ef4e61509dfa19edaabcebe572f49d4573

SHA512
6f3846706f85faaca86072e8c99027a09e147277c895568e92f0ac48fb2fe6df4a2fccef7678b1a2ab7d4b235b1802719755a6e0c687be6f3951c4057ba3e312

Download Submit
C:\Windows\{95DF550D-B1D6-4c63-B9D2-B92DA8FC3C31}.exe

Filesize
204KB

MD5
02d018dc46b6850e2809ad3fb7c2266a

SHA1
c44731c96af75d1a7f339d1af9b392af275d351d

SHA256
dffb3dca76d61f9e054fa151f84678d62df869e4df65c14d4891f5250988be4c

SHA512
a0035f0e23b506db84db7db047e0a2556974d17f2040e50c70c8dd1b77fe19e65aa2dc184c01d70cdd3d550b4027575413f4e9f961dd058903216ac102b765dd

Download Submit
C:\Windows\{B7E94D2C-20C3-47bb-9C0F-E73EF016335D}.exe

Filesize
204KB

MD5
cef411c047a02de483004446f006b536

SHA1
bc8b52f98fd2bd0a0188e25a67df491d0b04759a

SHA256
2fe5d0798ff46e0d5f5f05c9973484ad2cb81fa89b421b0ace19895149b6368b

SHA512
50fb2372eecf6cfea073076bf922ed60cf8d903f62c96b2100a2a957c8423aeb782ebad31aa16a6a3e90496110c32d174a54aabc8521475ecf0c64502fe12932

Download Submit
C:\Windows\{B97086D4-A090-401a-81AF-08E3385BAC59}.exe

Filesize
204KB

MD5
6d2c704b2e8d2d005e97f57dba3cb80f

SHA1
432bcf1e54d929efcb8de770e351859e11171cae

SHA256
047bd11cd672dd86d03e831611591333a58be837649f7030cbf858402ac53539

SHA512
87dd2c13bfe4e706e44f5f9c002870eb7aa4dbc8656b61d9b731f127cf5f762d107eb6449e05f2a7c60436fa31e5b5c3bd8892f134ebe5e4286edd1f52efd29a

Download Submit
C:\Windows\{C614DD44-2EE7-4e2a-B071-274BD7B53A20}.exe

Filesize
204KB

MD5
e7f409837889cbe62b5ace32dbc92080

SHA1
70d5ae7e7ef3adb081a98af922874d9453dd9686

SHA256
86fe6af9f196551984ac00bfd44528977c7ddf7843190eb8b1c31b91d40a3b9c

SHA512
e2791f78ab41f67d544a4acd4008eac4e41f3dcc251b9587bf48fc2f49e3bcfe6c46908612306fb63198eab3aac5521f7ba61956de139ddcc6534f55029154dc

Download Submit
C:\Windows\{DCF4320A-CF14-4ba8-A839-B9B6D7384458}.exe

Filesize
204KB

MD5
b0f20363fb0be47d73ba90e8d5cfe08e

SHA1
adef420844478e97a5aa93d426c23701ddd35cc5

SHA256
72846b6584058e9491752fb35441c5544a1dc5ec1277b6c9a86a27bab6db8a80

SHA512
005ec0b461747a451a33074c80cd4e8e12d516d62358b5e5336fb89c99e3f966831b6ca2566e03ccde85ca6bb7ca98dd2fe3dce3dd946d27edf6e978d92a8c78

Download Submit
C:\Windows\{E713E96E-0F6E-4693-971F-9B64995124C2}.exe

Filesize
204KB

MD5
5450ed693fa1bafe7576da79c3be33c2

SHA1
6d829fb0df207d3a9396035ab3da54b24bd58eae

SHA256
500162ce43bc40b84a4361424215eee8f73447b5a6e44654354364e36de3d628

SHA512
624e458273e08fd1785314fe17e988fa8551ad2cc1b104d0e691b61cb8d08f2cab62d17de01f6ecbca57559e51c0095bc3b0ff6663a577441494c984b990cebb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads