1f6d8cd099ab8e8021c0885dc4e2790a7a4ae1075004ccadece9c03f3ffd852e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe
Size

197KB
MD5

3485ee585c76f724e6b01de7473f3016
SHA1

9928b78ba2388af8f9edc2c339638e0bfc3123e7
SHA256

1f6d8cd099ab8e8021c0885dc4e2790a7a4ae1075004ccadece9c03f3ffd852e
SHA512

076950abfe6a3741222699558dc5e5f7e5fd56aff9dc6155e259f90d7557f971dc71b7af5cbd57e620902d8d5777db42168908e2cb93ca00ee0390bb14fcfe7e
SSDEEP

3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGjlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000800000002321e-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001300000002322c-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023245-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023116-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023245-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023116-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000233ae-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000001e56c-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002313a-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000234c3-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000234c5-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000234c3-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF5C23F4-B82D-4d27-81A0-5399022F4224}\stubpath = "C:\\Windows\\{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe"	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C3764CE-0A20-442e-B82F-34030A5FC18C}\stubpath = "C:\\Windows\\{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe"	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}\stubpath = "C:\\Windows\\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe"	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}\stubpath = "C:\\Windows\\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe"	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF5C23F4-B82D-4d27-81A0-5399022F4224}	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}\stubpath = "C:\\Windows\\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe"	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}\stubpath = "C:\\Windows\\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe"	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D740D49-740A-40e5-A353-5B7A30C984AA}	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D39A45D4-D8D2-4262-B998-18358A35B3BE}	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D39A45D4-D8D2-4262-B998-18358A35B3BE}\stubpath = "C:\\Windows\\{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe"	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}\stubpath = "C:\\Windows\\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe"	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D740D49-740A-40e5-A353-5B7A30C984AA}\stubpath = "C:\\Windows\\{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe"	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFCFA052-6095-4afa-9497-0E30761792A8}	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}\stubpath = "C:\\Windows\\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe"	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C3764CE-0A20-442e-B82F-34030A5FC18C}	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFCFA052-6095-4afa-9497-0E30761792A8}\stubpath = "C:\\Windows\\{EFCFA052-6095-4afa-9497-0E30761792A8}.exe"	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97E9C175-66E0-44a2-904E-07EB8A86832B}	{EFCFA052-6095-4afa-9497-0E30761792A8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97E9C175-66E0-44a2-904E-07EB8A86832B}\stubpath = "C:\\Windows\\{97E9C175-66E0-44a2-904E-07EB8A86832B}.exe"	{EFCFA052-6095-4afa-9497-0E30761792A8}.exe

Executes dropped EXE 12 IoCs

pid	Process
3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
4676	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
2264	{EFCFA052-6095-4afa-9497-0E30761792A8}.exe
2876	{97E9C175-66E0-44a2-904E-07EB8A86832B}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
File created	C:\Windows\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
File created	C:\Windows\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
File created	C:\Windows\{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
File created	C:\Windows\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
File created	C:\Windows\{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
File created	C:\Windows\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
File created	C:\Windows\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
File created	C:\Windows\{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe
File created	C:\Windows\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
File created	C:\Windows\{EFCFA052-6095-4afa-9497-0E30761792A8}.exe	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
File created	C:\Windows\{97E9C175-66E0-44a2-904E-07EB8A86832B}.exe	{EFCFA052-6095-4afa-9497-0E30761792A8}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
Token: SeIncBasePriorityPrivilege	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
Token: SeIncBasePriorityPrivilege	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
Token: SeIncBasePriorityPrivilege	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
Token: SeIncBasePriorityPrivilege	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
Token: SeIncBasePriorityPrivilege	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
Token: SeIncBasePriorityPrivilege	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
Token: SeIncBasePriorityPrivilege	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
Token: SeIncBasePriorityPrivilege	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
Token: SeIncBasePriorityPrivilege	4676	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
Token: SeIncBasePriorityPrivilege	2264	{EFCFA052-6095-4afa-9497-0E30761792A8}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3804	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe	97
PID 2144 wrote to memory of 3804	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe	97
PID 2144 wrote to memory of 3804	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe	97
PID 2144 wrote to memory of 3632	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe	98
PID 2144 wrote to memory of 3632	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe	98
PID 2144 wrote to memory of 3632	2144	2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe	98
PID 3804 wrote to memory of 4660	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	100
PID 3804 wrote to memory of 4660	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	100
PID 3804 wrote to memory of 4660	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	100
PID 3804 wrote to memory of 4032	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	101
PID 3804 wrote to memory of 4032	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	101
PID 3804 wrote to memory of 4032	3804	{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe	101
PID 4660 wrote to memory of 3868	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	106
PID 4660 wrote to memory of 3868	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	106
PID 4660 wrote to memory of 3868	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	106
PID 4660 wrote to memory of 1532	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	107
PID 4660 wrote to memory of 1532	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	107
PID 4660 wrote to memory of 1532	4660	{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe	107
PID 3868 wrote to memory of 4920	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	114
PID 3868 wrote to memory of 4920	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	114
PID 3868 wrote to memory of 4920	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	114
PID 3868 wrote to memory of 1428	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	115
PID 3868 wrote to memory of 1428	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	115
PID 3868 wrote to memory of 1428	3868	{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe	115
PID 4920 wrote to memory of 2744	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	116
PID 4920 wrote to memory of 2744	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	116
PID 4920 wrote to memory of 2744	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	116
PID 4920 wrote to memory of 5060	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	117
PID 4920 wrote to memory of 5060	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	117
PID 4920 wrote to memory of 5060	4920	{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe	117
PID 2744 wrote to memory of 4000	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	119
PID 2744 wrote to memory of 4000	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	119
PID 2744 wrote to memory of 4000	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	119
PID 2744 wrote to memory of 3140	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	120
PID 2744 wrote to memory of 3140	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	120
PID 2744 wrote to memory of 3140	2744	{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe	120
PID 4000 wrote to memory of 1324	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	121
PID 4000 wrote to memory of 1324	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	121
PID 4000 wrote to memory of 1324	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	121
PID 4000 wrote to memory of 4584	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	122
PID 4000 wrote to memory of 4584	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	122
PID 4000 wrote to memory of 4584	4000	{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe	122
PID 1324 wrote to memory of 1940	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	123
PID 1324 wrote to memory of 1940	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	123
PID 1324 wrote to memory of 1940	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	123
PID 1324 wrote to memory of 1760	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	124
PID 1324 wrote to memory of 1760	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	124
PID 1324 wrote to memory of 1760	1324	{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe	124
PID 1940 wrote to memory of 4684	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	125
PID 1940 wrote to memory of 4684	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	125
PID 1940 wrote to memory of 4684	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	125
PID 1940 wrote to memory of 2808	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	126
PID 1940 wrote to memory of 2808	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	126
PID 1940 wrote to memory of 2808	1940	{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe	126
PID 4684 wrote to memory of 4676	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	127
PID 4684 wrote to memory of 4676	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	127
PID 4684 wrote to memory of 4676	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	127
PID 4684 wrote to memory of 1284	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	128
PID 4684 wrote to memory of 1284	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	128
PID 4684 wrote to memory of 1284	4684	{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe	128
PID 4676 wrote to memory of 2264	4676	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe	129
PID 4676 wrote to memory of 2264	4676	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe	129
PID 4676 wrote to memory of 2264	4676	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe	129
PID 4676 wrote to memory of 4524	4676	{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe	130

C:\Users\Admin\AppData\Local\Temp\2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_3485ee585c76f724e6b01de7473f3016_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
  C:\Windows\{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
    C:\Windows\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
      C:\Windows\{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
        
        C:\Windows\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Windows\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
        
        C:\Windows\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
        
        C:\Windows\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
        
        C:\Windows\{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
        
        C:\Windows\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
        
        C:\Windows\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
        
        C:\Windows\{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\{EFCFA052-6095-4afa-9497-0E30761792A8}.exe
        
        C:\Windows\{EFCFA052-6095-4afa-9497-0E30761792A8}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\{97E9C175-66E0-44a2-904E-07EB8A86832B}.exe
        
        C:\Windows\{97E9C175-66E0-44a2-904E-07EB8A86832B}.exe
        13⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EFCFA~1.EXE > nul
        13⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D740~1.EXE > nul
        12⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3052~1.EXE > nul
        11⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3E819~1.EXE > nul
        10⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C376~1.EXE > nul
        9⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E89BC~1.EXE > nul
        8⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B3D0C~1.EXE > nul
        7⤵
        
        PID:3140
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD6A5~1.EXE > nul
        6⤵
        
        PID:5060
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EF5C2~1.EXE > nul
        5⤵
        
        PID:1428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AA477~1.EXE > nul
      4⤵
      PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D39A4~1.EXE > nul
    3⤵
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3C3764CE-0A20-442e-B82F-34030A5FC18C}.exe

Filesize
197KB

MD5
d54f180b9999890e6264d02337b6c347

SHA1
3363db8fe1d3a2f17aef90ff08e86115db7144d9

SHA256
63edf841712b6db8ba02c4f2e331193f7b3d85611855f74804d3e4dedc9e1d1e

SHA512
e3329d6c3bad6b0645ba633b57be8d17aa0f26609e7eae6604c1ea2aa81e747d22eb7a97a4255b2188b9001e05b74f799f545b50b6010e427dd03a5c5bf589a0

Download Submit
C:\Windows\{3D740D49-740A-40e5-A353-5B7A30C984AA}.exe

Filesize
197KB

MD5
b9081b0f972889978bd428d586e331f4

SHA1
938ad5b12c19ca51737aff18f0aa9bb54a122487

SHA256
2a289ef858313c86e6d7e3efc46b5bfe9c9b79836cf793d09102d0508c02024f

SHA512
3c80cf7fa3a698f8982e1f105dca84604a1cdc86e6cc540024a26d343b254c7bbbba8cc085b418751c8a622738aeb05e77bc7d29d2c2a3eaff223c5350d63e69

Download Submit
C:\Windows\{3E819B66-BA0D-406d-9B2B-2DE5B1F693AF}.exe

Filesize
197KB

MD5
3ebf474b5886f816de98d69405a61468

SHA1
74792b9ac2e3f84cc31a6d0d5676a7065d42abe4

SHA256
c9c219cf50545f3e3b30883a7aa889c712c4dba469dcf08a2027bfc80108c0ff

SHA512
57b94f78c135092e805caf82cff62a84410b941ecbed7cf8eee0ee2560903789da61b07085cb6a020d260cd7449a1ffd377c5e3eb65e93429e9babb6e2330b42

Download Submit
C:\Windows\{97E9C175-66E0-44a2-904E-07EB8A86832B}.exe

Filesize
197KB

MD5
5ffe52b0bece759826273c4cceb53423

SHA1
730e5018aa0555c324ceda556e3f3a36cb80c76a

SHA256
4f2f84c1d6f2a588766e3dd2f91a40db0d26efd1bbc460e0d7a24f627e74c1a1

SHA512
243733a6aa8c7eecf76778fe46b3f2641b28c9daba9afc849c7d7726dc24707e73416ecbdce0ddd834f063993e75f749863a6ba030dd37ca238b3ee8bc083000

Download Submit
C:\Windows\{AA477E31-1BB4-40a8-8ADE-34CC38B96C3C}.exe

Filesize
197KB

MD5
32c82d7444901603b42e6a03600cd91b

SHA1
cc97c346d47bdfe43417cc19e33b397b82311fe3

SHA256
86c2cf2d4a25f5dc42ada8b194ecde5ee0cad6ad86d7689f89ea3f70ff930706

SHA512
19f3e462cdbf3e58a3c19f8d9cf51af7866aeb43e7b281517de2bbcbd24249522387869646eddd45c96b3ae6da7a72e12768f6fe8d1b7e978132afacc8cf7fcb

Download Submit
C:\Windows\{B3D0C09E-A7AC-41e2-BD28-6C43F05B7986}.exe

Filesize
197KB

MD5
830218cb8b515b39eb008d669aec5116

SHA1
21caf34342b00df8dbdc7af9ae1063d5d3ad0736

SHA256
04e4c76b03d74a1992a45fdd06ab6467df7e8aa3e88f7d8b57aaade90ca56961

SHA512
706a23221cd8bcccaf70dde7f4d2f9cd29e0962e04b713cc16e8ef6d04080fc0e55d7ec8ea5dedf45fc00ba96cc4bf7e79578109074bee0b31ad85f0cdb0462c

Download Submit
C:\Windows\{C30525D5-EEAC-412a-9FDB-76433F3EB0A7}.exe

Filesize
197KB

MD5
73eec699affd4696c5bf369ba3ab34dc

SHA1
2dfe50d6f6ef10da1afc4dac9886766da1bb7e11

SHA256
295de32694e3be23b8265707c058c96b0eaa4a99544ebbe1134ec8d5235d43d7

SHA512
3e5bdafe9dc5b4f08a061a4002b139f00243447174cc3ad44ae5cb397a7c42a277641d9a689860c04078dc61f145b77f0de097f42f4c5dc0821036f6fa835f99

Download Submit
C:\Windows\{CD6A52EA-2359-4168-BA6B-5561555D0F5D}.exe

Filesize
197KB

MD5
86f7730caf8b500418ab8edb8a28f1fd

SHA1
d1db30d0a2236faccb858f0e61ec42e7558a1508

SHA256
856114d5f7270b48e6e5b68cb155b58c95d2df3b24028e3f75c10b8581b3940f

SHA512
979d4b069a803dc5377afc17f2d56393e78e68e5fd286a8591da680457a228362cf5c458a7a00fb470c507d3db00555226b5b334e46bf7e316afa8110b337676

Download Submit
C:\Windows\{D39A45D4-D8D2-4262-B998-18358A35B3BE}.exe

Filesize
197KB

MD5
6ca8c3dc5862ac0409a4d2101e738d77

SHA1
f7e52c631068795905ec0d62617f8a07edc0a28d

SHA256
5fea7f547b6c69d9a1d58af8ec2f4d10afdb87b2d6fc9f5b6fc0091dc0577157

SHA512
5958f941385c5f1f0d4f93fa0a63a1ab5024339eeadcf0e9d028ceeeaa4987665d66c890a138dbb34fedc193f44b3c5630d39707625bc461712b0815a9677b51

Download Submit
C:\Windows\{E89BC40C-27EE-4105-9F4B-604B9EAC28E8}.exe

Filesize
197KB

MD5
efdc996f486e43e66fa4cfd97a4d6a14

SHA1
8498ab4954e1f8e644cef7fcc8ead21024cab7e5

SHA256
f6096ae11f9be9f50b023616589ea8415b0a848e136451d50b76c33b538ca84f

SHA512
04b3e13cf5521371beac81de9c7bf44add9ea2a40a858b07efc68d9c7cdf7071602dfca4d57d7d952e37f7d6c95f0a89b18919dc21a9d05f18ebadabba000c9a

Download Submit
C:\Windows\{EF5C23F4-B82D-4d27-81A0-5399022F4224}.exe

Filesize
197KB

MD5
3ba37e55bba22380256f212ebed6e8ff

SHA1
69ca162c37a35d0288322d51b45237be87e59ad6

SHA256
8d4c4b193ba375506b4fd966eca7c522fb1bd3b82f16ad701b4fe56c1ba512ab

SHA512
4c56819a2d958092c5abaf66576c30bcce06d30a2f08c93070bc9257afd563707d0108e633269a05680922178eb5904dbf4b9af55d0f29ecb7429ca14ef781f7

Download Submit
C:\Windows\{EFCFA052-6095-4afa-9497-0E30761792A8}.exe

Filesize
197KB

MD5
932328b9457a37e3ac53f078bf27799f

SHA1
2559c4647df41a62a637e2116e0dcc05bc1c2291

SHA256
743620e2428a37b0d5a63adef5e66603d8a5cdaf419047f1668fd886e7d73a6e

SHA512
cd478f297eef280f49ef9e6b74cc1e000771a0b787585c2d365d40dc23ba3649a5f489f4e9b9b4134c3f2b6d227e42eaf8582a3c5d02dedd240e50e99db7e838

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads