aebf5805369fca9f8dd91f47ccd00c44fe8a27aa853acf4fefd5ec3304bfbbdb

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Size

372KB
MD5

6f9f5e208dfe22443b65c767fb43d0d3
SHA1

c7ea8004cf48461d7c44be775776c4bd0c720a56
SHA256

aebf5805369fca9f8dd91f47ccd00c44fe8a27aa853acf4fefd5ec3304bfbbdb
SHA512

78e0032cb78789000a9642a8215218a3a50cce62baa92c5b1d03b142c9a5609336ff3e2b47395e496f47747cc3c16ab73f91913c1baeeff92b927aa1465b3412
SSDEEP

3072:CEGh0oclMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGmlkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023206-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023211-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001e4f0-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002323c-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023246-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002332e-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023332-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023333-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023398-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023398-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023333-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002339b-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06383D75-7564-467f-9AC7-B167F3DC628B}\stubpath = "C:\\Windows\\{06383D75-7564-467f-9AC7-B167F3DC628B}.exe"	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}\stubpath = "C:\\Windows\\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe"	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6724FFAF-702F-4251-A64E-070B7C68D48D}\stubpath = "C:\\Windows\\{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe"	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}\stubpath = "C:\\Windows\\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe"	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02738283-4E57-4685-963D-F4234DE9DEFF}	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06383D75-7564-467f-9AC7-B167F3DC628B}	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}\stubpath = "C:\\Windows\\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe"	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}\stubpath = "C:\\Windows\\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe"	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}\stubpath = "C:\\Windows\\{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe"	{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6724FFAF-702F-4251-A64E-070B7C68D48D}	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}\stubpath = "C:\\Windows\\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe"	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}	{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}\stubpath = "C:\\Windows\\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe"	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02738283-4E57-4685-963D-F4234DE9DEFF}\stubpath = "C:\\Windows\\{02738283-4E57-4685-963D-F4234DE9DEFF}.exe"	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}\stubpath = "C:\\Windows\\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe"	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92B18BB3-909F-4c77-98B9-1814A448937C}	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92B18BB3-909F-4c77-98B9-1814A448937C}\stubpath = "C:\\Windows\\{92B18BB3-909F-4c77-98B9-1814A448937C}.exe"	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe

Executes dropped EXE 11 IoCs

pid	Process
4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe
4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
3516	{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe
2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
1760	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe
384	{02738283-4E57-4685-963D-F4234DE9DEFF}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
File created	C:\Windows\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
File created	C:\Windows\{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe
File created	C:\Windows\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
File created	C:\Windows\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe
File created	C:\Windows\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
File created	C:\Windows\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
File created	C:\Windows\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
File created	C:\Windows\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
File created	C:\Windows\{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
File created	C:\Windows\{02738283-4E57-4685-963D-F4234DE9DEFF}.exe	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
Token: SeIncBasePriorityPrivilege	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
Token: SeIncBasePriorityPrivilege	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
Token: SeIncBasePriorityPrivilege	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
Token: SeIncBasePriorityPrivilege	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe
Token: SeIncBasePriorityPrivilege	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
Token: SeIncBasePriorityPrivilege	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe
Token: SeIncBasePriorityPrivilege	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
Token: SeIncBasePriorityPrivilege	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
Token: SeIncBasePriorityPrivilege	1760	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4528	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	92
PID 4656 wrote to memory of 4528	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	92
PID 4656 wrote to memory of 4528	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	92
PID 4656 wrote to memory of 3004	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	93
PID 4656 wrote to memory of 3004	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	93
PID 4656 wrote to memory of 3004	4656	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	93
PID 4528 wrote to memory of 1828	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	101
PID 4528 wrote to memory of 1828	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	101
PID 4528 wrote to memory of 1828	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	101
PID 4528 wrote to memory of 4904	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	102
PID 4528 wrote to memory of 4904	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	102
PID 4528 wrote to memory of 4904	4528	{06383D75-7564-467f-9AC7-B167F3DC628B}.exe	102
PID 1828 wrote to memory of 3952	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	108
PID 1828 wrote to memory of 3952	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	108
PID 1828 wrote to memory of 3952	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	108
PID 1828 wrote to memory of 4124	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	109
PID 1828 wrote to memory of 4124	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	109
PID 1828 wrote to memory of 4124	1828	{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe	109
PID 3952 wrote to memory of 472	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	110
PID 3952 wrote to memory of 472	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	110
PID 3952 wrote to memory of 472	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	110
PID 3952 wrote to memory of 4816	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	111
PID 3952 wrote to memory of 4816	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	111
PID 3952 wrote to memory of 4816	3952	{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe	111
PID 472 wrote to memory of 3348	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	114
PID 472 wrote to memory of 3348	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	114
PID 472 wrote to memory of 3348	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	114
PID 472 wrote to memory of 1984	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	115
PID 472 wrote to memory of 1984	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	115
PID 472 wrote to memory of 1984	472	{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe	115
PID 3348 wrote to memory of 4436	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	120
PID 3348 wrote to memory of 4436	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	120
PID 3348 wrote to memory of 4436	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	120
PID 3348 wrote to memory of 1756	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	121
PID 3348 wrote to memory of 1756	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	121
PID 3348 wrote to memory of 1756	3348	{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe	121
PID 4436 wrote to memory of 3516	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	122
PID 4436 wrote to memory of 3516	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	122
PID 4436 wrote to memory of 3516	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	122
PID 4436 wrote to memory of 560	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	123
PID 4436 wrote to memory of 560	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	123
PID 4436 wrote to memory of 560	4436	{92B18BB3-909F-4c77-98B9-1814A448937C}.exe	123
PID 5000 wrote to memory of 2908	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe	126
PID 5000 wrote to memory of 2908	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe	126
PID 5000 wrote to memory of 2908	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe	126
PID 5000 wrote to memory of 4936	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe	127
PID 5000 wrote to memory of 4936	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe	127
PID 5000 wrote to memory of 4936	5000	{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe	127
PID 2908 wrote to memory of 3876	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	128
PID 2908 wrote to memory of 3876	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	128
PID 2908 wrote to memory of 3876	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	128
PID 2908 wrote to memory of 748	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	129
PID 2908 wrote to memory of 748	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	129
PID 2908 wrote to memory of 748	2908	{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe	129
PID 3876 wrote to memory of 1760	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	130
PID 3876 wrote to memory of 1760	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	130
PID 3876 wrote to memory of 1760	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	130
PID 3876 wrote to memory of 3004	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	131
PID 3876 wrote to memory of 3004	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	131
PID 3876 wrote to memory of 3004	3876	{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe	131
PID 1760 wrote to memory of 384	1760	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe	132
PID 1760 wrote to memory of 384	1760	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe	132
PID 1760 wrote to memory of 384	1760	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe	132
PID 1760 wrote to memory of 3536	1760	{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe	133

C:\Users\Admin\AppData\Local\Temp\2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
  C:\Windows\{06383D75-7564-467f-9AC7-B167F3DC628B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
    C:\Windows\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
      C:\Windows\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Windows\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
        
        C:\Windows\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:472
      - C:\Windows\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe
        
        C:\Windows\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
        
        C:\Windows\{92B18BB3-909F-4c77-98B9-1814A448937C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe
        
        C:\Windows\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:3516
        
        C:\Windows\{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe
        
        C:\Windows\{F4A28CE5-9D10-437a-893A-10AC3C6F0E3D}.exe
        9⤵
        Modifies Installed Components in the registry
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
        
        C:\Windows\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
        
        C:\Windows\{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe
        
        C:\Windows\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\{02738283-4E57-4685-963D-F4234DE9DEFF}.exe
        
        C:\Windows\{02738283-4E57-4685-963D-F4234DE9DEFF}.exe
        13⤵
        Executes dropped EXE
        
        PID:384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9C0CD~1.EXE > nul
        13⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6724F~1.EXE > nul
        12⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FAD87~1.EXE > nul
        11⤵
        
        PID:748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F4A28~1.EXE > nul
        10⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{048D8~1.EXE > nul
        9⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92B18~1.EXE > nul
        8⤵
        
        PID:560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E41B0~1.EXE > nul
        7⤵
        
        PID:1756
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8E8BD~1.EXE > nul
        6⤵
        
        PID:1984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88BAF~1.EXE > nul
        5⤵
        
        PID:4816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F8BFD~1.EXE > nul
      4⤵
      PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{06383~1.EXE > nul
    3⤵
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{02738283-4E57-4685-963D-F4234DE9DEFF}.exe

Filesize
372KB

MD5
87c313a017f4ad0e8d92d37cbda14c81

SHA1
9a2d07b5a78b5d719c4b41fb0548b8d75a4e00c9

SHA256
a5b603c0a3f1d98fb076bf2640c6cb998f02bf65cc1e76f04192f42ee98c09b1

SHA512
b175de064b9d99b130b37551bbb2feb9040187b17f81744ef8485083af9d5feb1d10010969e4abf9c54ae7b8750337d0d4639ee0be329af4147ef00bb19133c1

Download Submit
C:\Windows\{048D8B35-17C4-4f8c-B219-CC28324AEBAB}.exe

Filesize
372KB

MD5
d448d3ed517445a2d2975bfacc0deac7

SHA1
16a28af292cb2d4497398f1d2e5da2a3b961af84

SHA256
df906d917d9311289cf506e461616aefabdfa8b710eff5f169892f405ea7cfe7

SHA512
98fed5fcab469f08ccb3507310f3e48a79a9ea2810867afec077c7b2dfdf29b5fc4413a0a5fc3b8865f628535c289b9780ea733c72efaa816504ee05aac9ff89

Download Submit
C:\Windows\{06383D75-7564-467f-9AC7-B167F3DC628B}.exe

Filesize
372KB

MD5
4b1cc54e23ae6f9867baa2a10f4be3dc

SHA1
97b09d9757c25c04dce2195d3fa10e754dcfd7ea

SHA256
76a365810ed53cbff48755c985f3a4ccc55a0c8d087f71d2acebc0e5eb6f29af

SHA512
54f7a2deffc8c7c8e2f252a0cc784655f32bf4b80dddbb6b64215f59f0ebb5b34ac8e960f4b0ac63cd7dcc9b3579abb58072e3c5fbfee32394c4a5a59932fda9

Download Submit
C:\Windows\{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe

Filesize
372KB

MD5
31f0e1260fad4071188304c1726bb5c2

SHA1
54107ea86ae23d8f0b5ca9efc741041797f40efe

SHA256
ddbd97cfa5acb1b51bb166f80cb4ce75a3f862815b0537f2a48dafad4a216df1

SHA512
0f9d87fe0adbc9a48db5d253277fe0d3b4f4c4cbf61325390de85d0eab21ce6c857c5ebfff3bedbffd0021620408b0387aa049226a985d80b86340c4f4e630ae

Download Submit
C:\Windows\{6724FFAF-702F-4251-A64E-070B7C68D48D}.exe

Filesize
130KB

MD5
1769604a9c70feb9b753e3126f3190c6

SHA1
6a76551117e99f3e88bb73a65d3e95f588cab44c

SHA256
8f5878cb25ba0932cef7ca283591f522abe6a140ba6d9cc8ca67cd137384638b

SHA512
4518979d0feb0d09203f3b6e135abb0e2c8a8c28993438ab0979b266e44cf38554f37ec525c2abdb47f8539891af405d55047720dbb91edb81aa95d9c67fb41b

Download Submit
C:\Windows\{88BAF3C5-65B4-424d-BBD2-113D2911CEF8}.exe

Filesize
372KB

MD5
4cd4cca8c4859d2f8e2ff71a10ed1422

SHA1
5fb587294dd306ab44c39bc564399b7f5544d497

SHA256
d1d5d5a0edfa03eed58673d6666d79beba1e8f068a663479a01fdfefcde607df

SHA512
8f58a2cbeff3107df9c0681a3977efc220f4ca8cdc2e8c8459df3a879d822c405e9e249644347281cf9a06642a91a6df80879001e7a456cd86bdfbd253982e8e

Download Submit
C:\Windows\{8E8BD7EB-DC28-4a1f-B85E-C9384014208E}.exe

Filesize
372KB

MD5
d6f7be2edda6fe773eb0b79913e8bd53

SHA1
8737eacd2c31b474068b487985c93bc48b1678ed

SHA256
3ba8a0a5c1ec96d0278491945aa0077489757a10b8ce73249ab90c4e94fd58e7

SHA512
4613b48e23699841e8f92e1280b6804ab593a70a632e820e27771d4c1a0014ad818160cbcc335cfe857fbf9eac7afd1d370360490fc039f191461962278d3aae

Download Submit
C:\Windows\{92B18BB3-909F-4c77-98B9-1814A448937C}.exe

Filesize
372KB

MD5
3abdefc47c8c5f9e1cff1c3b80c791d4

SHA1
9ce6b1c2877f39df908972b800a21305629d42ab

SHA256
adecd2f5674f66550dbb22efba0ea42f9a4709124b688f1c7644951276f5ae14

SHA512
043295bd24da7c51dc418ebd9bab2f75fcdbde766aa91ac62289bc7e3573c8b6906b0582d53a0d0772a383da8434715258cbba58349dba1becb44c080aff92b8

Download Submit
C:\Windows\{9C0CDA6F-62F4-458f-A041-2DF65F1642CB}.exe

Filesize
372KB

MD5
a9bd0cd01e33753440b2edb2a7dfb8a7

SHA1
9d0f2ebf8c68c6d2a7698f188a1a8f128535df79

SHA256
70b303e677d3425c05f79845037187742ca0e1372ba32dfcb47d0128b37a45b5

SHA512
9bf1ffec27009c15dbd81dd91fb7b39689f2c221a634b1e05bbd2fa9938462d352b8d24bc672054fe304268da662cac64cbb3d4240eb653645ffc972c4545601

Download Submit
C:\Windows\{E41B0FCF-E503-43b7-9AE4-D4111D09F5F6}.exe

Filesize
372KB

MD5
4c69fa15bf209e971726fdfe196644a9

SHA1
97f903bec3f0c56137f4b863cfc27a1abe38ba6e

SHA256
5c33b82a7eaccd378ce1e0d1592ad4f6c6769a66f3aebed813244539b3e57107

SHA512
ee9cc3743cf87d1076a2914e9006cc925e7a0f3c035f25d52265c973be977685d36ce82f5666ae4b2cfbc76936082f72808aebae963be1226bc9b7d60945886d

Download Submit
C:\Windows\{F8BFD8ED-F885-4ed1-A0AC-CF279F79E4F0}.exe

Filesize
372KB

MD5
49d5e05f5068c8636fedacb93cf379b2

SHA1
584730e2d61176b5e66aa0128b4007909d4a2bc4

SHA256
249f290b53ab62b551fb6739c0084db463daa44003667771ad1e5eb6835230dd

SHA512
130a4357474f9baaf7981a2784dad67cd80ebae6ae3dc6dae9eb2ddad9896c7ee0ab99ca9dbff771207308255dd232133802cd0f298a51e076498250bdc16b7f

Download Submit
C:\Windows\{FAD8777B-FC22-4be4-8CA2-EFF978B0F5F9}.exe

Filesize
372KB

MD5
b893ccac266578bcde80cb70ece6b285

SHA1
289fed00789c7544dbbea629ecb44b84512577d1

SHA256
271f1444e6e4bca6dc20d96be9aacc754f288e50b87d3656868499dc763dc071

SHA512
7ed30fb983563f70cf62dfc52255d883a7e5e0981e7e3c3c6ee93a4b1855da551a88a463ccbf1da15c95e7aa34780a56de5086ad53134a5ffeb2f5c9a061a655

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads