5b4da516600e2177af80cb0efca3f000d5ff9f14c394f3e7fa503249260f476e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Size

216KB
MD5

7e3f6179f25cd650baaf5e291ec9fcfc
SHA1

e0f367cca860e96d525a9a4321496b50eac70a03
SHA256

5b4da516600e2177af80cb0efca3f000d5ff9f14c394f3e7fa503249260f476e
SHA512

c71499bf3509e161134db9b682442a3700158239f1d1a597c26f423d687177e539dfb92f33f49f13a07ff0223035769fd041ba044bb1779b832e824cc2e5548e
SSDEEP

3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGvlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023211-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023217-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002321e-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023217-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002321e-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023217-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002321e-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000072d-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000072f-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000072d-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000072f-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000000072d-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{997D60F3-11FF-4216-976B-3D4DED15579D}\stubpath = "C:\\Windows\\{997D60F3-11FF-4216-976B-3D4DED15579D}.exe"	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82D72316-BC43-4740-A593-62726C9D25D7}	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82D72316-BC43-4740-A593-62726C9D25D7}\stubpath = "C:\\Windows\\{82D72316-BC43-4740-A593-62726C9D25D7}.exe"	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0C618A2-8E60-4e82-974A-910B98D45930}\stubpath = "C:\\Windows\\{A0C618A2-8E60-4e82-974A-910B98D45930}.exe"	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}\stubpath = "C:\\Windows\\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe"	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64645ECD-00D6-4d34-B220-0965555A96B8}	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F19036BC-40FC-4be0-81A9-2A9C32646F63}	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9D95B8A-115E-4a09-8AB8-A593B648850B}	{82D72316-BC43-4740-A593-62726C9D25D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0C618A2-8E60-4e82-974A-910B98D45930}	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F19036BC-40FC-4be0-81A9-2A9C32646F63}\stubpath = "C:\\Windows\\{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe"	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}\stubpath = "C:\\Windows\\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}.exe"	{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}\stubpath = "C:\\Windows\\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe"	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}\stubpath = "C:\\Windows\\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe"	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{997D60F3-11FF-4216-976B-3D4DED15579D}	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}	{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9D95B8A-115E-4a09-8AB8-A593B648850B}\stubpath = "C:\\Windows\\{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe"	{82D72316-BC43-4740-A593-62726C9D25D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64645ECD-00D6-4d34-B220-0965555A96B8}\stubpath = "C:\\Windows\\{64645ECD-00D6-4d34-B220-0965555A96B8}.exe"	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}\stubpath = "C:\\Windows\\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe"	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}\stubpath = "C:\\Windows\\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe"	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe

Executes dropped EXE 12 IoCs

pid	Process
1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe
712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe
1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe
3392	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
3368	{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe
2340	{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}.exe	{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe
File created	C:\Windows\{82D72316-BC43-4740-A593-62726C9D25D7}.exe	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
File created	C:\Windows\{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
File created	C:\Windows\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
File created	C:\Windows\{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
File created	C:\Windows\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe
File created	C:\Windows\{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
File created	C:\Windows\{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	{82D72316-BC43-4740-A593-62726C9D25D7}.exe
File created	C:\Windows\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
File created	C:\Windows\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
File created	C:\Windows\{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
File created	C:\Windows\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe
Token: SeIncBasePriorityPrivilege	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
Token: SeIncBasePriorityPrivilege	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
Token: SeIncBasePriorityPrivilege	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
Token: SeIncBasePriorityPrivilege	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
Token: SeIncBasePriorityPrivilege	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe
Token: SeIncBasePriorityPrivilege	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
Token: SeIncBasePriorityPrivilege	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
Token: SeIncBasePriorityPrivilege	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe
Token: SeIncBasePriorityPrivilege	3392	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
Token: SeIncBasePriorityPrivilege	3368	{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1076	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	95
PID 3020 wrote to memory of 1076	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	95
PID 3020 wrote to memory of 1076	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	95
PID 3020 wrote to memory of 1792	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	96
PID 3020 wrote to memory of 1792	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	96
PID 3020 wrote to memory of 1792	3020	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	96
PID 1076 wrote to memory of 712	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe	97
PID 1076 wrote to memory of 712	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe	97
PID 1076 wrote to memory of 712	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe	97
PID 1076 wrote to memory of 4008	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe	98
PID 1076 wrote to memory of 4008	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe	98
PID 1076 wrote to memory of 4008	1076	{82D72316-BC43-4740-A593-62726C9D25D7}.exe	98
PID 712 wrote to memory of 4000	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	100
PID 712 wrote to memory of 4000	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	100
PID 712 wrote to memory of 4000	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	100
PID 712 wrote to memory of 512	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	101
PID 712 wrote to memory of 512	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	101
PID 712 wrote to memory of 512	712	{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe	101
PID 4000 wrote to memory of 3592	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	102
PID 4000 wrote to memory of 3592	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	102
PID 4000 wrote to memory of 3592	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	102
PID 4000 wrote to memory of 4892	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	103
PID 4000 wrote to memory of 4892	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	103
PID 4000 wrote to memory of 4892	4000	{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe	103
PID 3592 wrote to memory of 748	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	104
PID 3592 wrote to memory of 748	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	104
PID 3592 wrote to memory of 748	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	104
PID 3592 wrote to memory of 3192	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	105
PID 3592 wrote to memory of 3192	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	105
PID 3592 wrote to memory of 3192	3592	{A0C618A2-8E60-4e82-974A-910B98D45930}.exe	105
PID 748 wrote to memory of 4264	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	106
PID 748 wrote to memory of 4264	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	106
PID 748 wrote to memory of 4264	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	106
PID 748 wrote to memory of 4616	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	107
PID 748 wrote to memory of 4616	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	107
PID 748 wrote to memory of 4616	748	{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe	107
PID 4264 wrote to memory of 1368	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	108
PID 4264 wrote to memory of 1368	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	108
PID 4264 wrote to memory of 1368	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	108
PID 4264 wrote to memory of 2160	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	109
PID 4264 wrote to memory of 2160	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	109
PID 4264 wrote to memory of 2160	4264	{64645ECD-00D6-4d34-B220-0965555A96B8}.exe	109
PID 1368 wrote to memory of 4516	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	110
PID 1368 wrote to memory of 4516	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	110
PID 1368 wrote to memory of 4516	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	110
PID 1368 wrote to memory of 4520	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	111
PID 1368 wrote to memory of 4520	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	111
PID 1368 wrote to memory of 4520	1368	{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe	111
PID 4516 wrote to memory of 1440	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	112
PID 4516 wrote to memory of 1440	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	112
PID 4516 wrote to memory of 1440	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	112
PID 4516 wrote to memory of 2164	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	113
PID 4516 wrote to memory of 2164	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	113
PID 4516 wrote to memory of 2164	4516	{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe	113
PID 1440 wrote to memory of 3392	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	114
PID 1440 wrote to memory of 3392	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	114
PID 1440 wrote to memory of 3392	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	114
PID 1440 wrote to memory of 3496	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	115
PID 1440 wrote to memory of 3496	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	115
PID 1440 wrote to memory of 3496	1440	{997D60F3-11FF-4216-976B-3D4DED15579D}.exe	115
PID 3392 wrote to memory of 3368	3392	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe	116
PID 3392 wrote to memory of 3368	3392	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe	116
PID 3392 wrote to memory of 3368	3392	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe	116
PID 3392 wrote to memory of 3008	3392	{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\{82D72316-BC43-4740-A593-62726C9D25D7}.exe
  C:\Windows\{82D72316-BC43-4740-A593-62726C9D25D7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
    C:\Windows\{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
      C:\Windows\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
        
        C:\Windows\{A0C618A2-8E60-4e82-974A-910B98D45930}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3592
      - C:\Windows\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
        
        C:\Windows\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\{64645ECD-00D6-4d34-B220-0965555A96B8}.exe
        
        C:\Windows\{64645ECD-00D6-4d34-B220-0965555A96B8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
        
        C:\Windows\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
        
        C:\Windows\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\{997D60F3-11FF-4216-976B-3D4DED15579D}.exe
        
        C:\Windows\{997D60F3-11FF-4216-976B-3D4DED15579D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
        
        C:\Windows\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe
        
        C:\Windows\{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
        
        C:\Windows\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}.exe
        
        C:\Windows\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}.exe
        13⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F1903~1.EXE > nul
        13⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B47F~1.EXE > nul
        12⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{997D6~1.EXE > nul
        11⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{29F2C~1.EXE > nul
        10⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{070F0~1.EXE > nul
        9⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64645~1.EXE > nul
        8⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0F6F5~1.EXE > nul
        7⤵
        
        PID:4616
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0C61~1.EXE > nul
        6⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75DC8~1.EXE > nul
        5⤵
        
        PID:4892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C9D95~1.EXE > nul
      4⤵
      PID:512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{82D72~1.EXE > nul
    3⤵
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{070F02CC-27C5-4cb8-85CB-7F37BDD1FA37}.exe

Filesize
216KB

MD5
d7ede03b52cefea523300314aa4bc9a4

SHA1
033dbead42b7e55504b82680aa2bef75fe79e86d

SHA256
d1db734ea0de66a086f9a74785ab8a61acb314028b6ba364e1af5c59a00f64e8

SHA512
64d94ae0094fd4131a72175fb97e01e46ee0c52dd43b70c07e55d4f2f550d8cf4d33615dc37a03ade557e3fe698629f54defe457ac408a8e526529750e0baac1

Download Submit
C:\Windows\{0F6F533A-60DD-4bd4-A1C2-1087F64B85CC}.exe

Filesize
216KB

MD5
6a257851263c83b5351289bc33da0fad

SHA1
b5595a3d2647141efecf7ceb2d96bf756710df90

SHA256
be4065906d508b61f2a959dddef692e16674a23e2d1496142d60faefa92d061f

SHA512
e205182ca3511194d963db7fbebbaa52cfd1214e3078e148660f488b25daa3ec8f472e234aa5bcff2288b9a5394deea27a8a24217ca49b04d1c25a14c8bc147f

Download Submit
C:\Windows\{29F2C53F-34DB-4d19-9A6D-CDDC9E8627D0}.exe

Filesize
216KB

MD5
44bfd2a4a8ff960c6d4476b8bc534c5a

SHA1
9fb0ef0014448944325752d597d6292ac8b9cb9c

SHA256
7d0b77a8557779450ce789c2a10d2d4b3b7b634e7aa8831fc52d13926dec772e

SHA512
cdeaa5fff2a1e570da60a53b7bf5917f71867311a4cb553b7a7c5edf9ebb6a304b3e6a9b57bd106d281ed9676381213e650cc1e56c5030ef69c7ca9feb54a1e6

Download Submit
C:\Windows\{3012ED48-E216-4784-ADD0-E6B3B20DCE1D}.exe

Filesize
216KB

MD5
5727486c6c6554ac17f860ede4577fcf

SHA1
e77c6d22f48b46b79e3114091652b73b936a40a8

SHA256
2177081562a8b89035120ebda108b9607d814153451f7b769be3cb1233be6eef

SHA512
00ecfac147a24c44798b176e98f0763ea6ff980237eb8f9db195abd4cb6adb9e3d9bba1401eb19a05310dec11b8d342921725ed85f68094d36fd0c0fa595edfd

Download Submit
C:\Windows\{64645ECD-00D6-4d34-B220-0965555A96B8}.exe

Filesize
216KB

MD5
ed0de17057489117ee9975b80596da3b

SHA1
4c50f7bc4259066ce16578ebbef9e46947c3a72c

SHA256
37d15cd78385e30e01b8607b0524eae6115957077295b9775fd084ec9333898a

SHA512
232d3e421ba332465fab89a99afd477b6a1676ed723d4feca7be37caa75026fec3d8fe6f6125970417b14565f07a8435e421329434ecb739191a1c3aefbd267f

Download Submit
C:\Windows\{75DC833A-E13C-4245-AFB3-E6E1BCD288C2}.exe

Filesize
216KB

MD5
3f23dff50eee4343dff3dc217071a2e8

SHA1
75c284d3501f37b63bcc9eaa4db4d31f884f7aab

SHA256
1a114722ead3ff59e3a0b9c59a854544af25214f742c8e830383a22831b8a0dd

SHA512
749c818e4c2a92a3ff7f5e6235990dc0a2e47e714c3a592771795b32b86c1aa1dfd8d764de58fe6a8a503d3739eca45d0ed2d4235d47020691515635dfbcf9a9

Download Submit
C:\Windows\{82D72316-BC43-4740-A593-62726C9D25D7}.exe

Filesize
216KB

MD5
7e46fbda8c9e72de057f0d86f9362396

SHA1
4cc1fac46963716f3f49b10bcad7a248c7cfcdf5

SHA256
28bc7c424f058d90df441087f3a9e870024e753c911ebed6ae3614ce6d6d6774

SHA512
269752ca569b9ea547ed41711a5b5fafd529132e2ddce2fd1bc7b211d3e1b6340107cae44fa767eefc6ad83c6a01749f9a2cc485bda05931655e726bbfa11492

Download Submit
C:\Windows\{997D60F3-11FF-4216-976B-3D4DED15579D}.exe

Filesize
216KB

MD5
a13b22b8c520486f4eb30317bbbc203b

SHA1
b32cc5dedc76ebe6f401c282bab1460f20670e4c

SHA256
4902413d14842883c15e2c6838bc75c8b2fff14732f2844c4761206d49c8f5a3

SHA512
c95beca456459d3f6858682d37719b27474f6e23808fd1be5fb69c5d485a6f96b7c825ad0d00264b7f1263de1e1d93213a914e701ba3f57185209dd07589501f

Download Submit
C:\Windows\{9B47F392-D6E3-4d3d-A1EF-0C0A19D1166C}.exe

Filesize
216KB

MD5
f4cd67d14e8f21fb9cf8d69f04ae8812

SHA1
8fe4d38bd8187b42cf32922569dd6d49bbc22ca3

SHA256
14c797ec66e94a3b2dbbb14b647de931a554de2ee088f598755efc0dda957755

SHA512
aa51499bb76828a553d88c51c27ee67affa2fe1efae82b7736b442a785b1ea68a1450cf594f956cae1fbb0c4072e0d27597d1cca28a4c8e100d561102429a096

Download Submit
C:\Windows\{A0C618A2-8E60-4e82-974A-910B98D45930}.exe

Filesize
216KB

MD5
301c8d65aded3ce22acd09a597078409

SHA1
89ffd73a1d7a9d5925e4cb6172f8c62569309437

SHA256
877f337a2560cccdd8e9f40924ef1f5dbc2807a4eabc9e3bb9090ade27a2e0d8

SHA512
8b022cb067508c7c6b67e1dd2ac44c49266343061e42512a245969e7f4913067c05e1335609f39c64f1df7b163353be3f5e0d8af779077aaf12c79a01523eb79

Download Submit
C:\Windows\{C9D95B8A-115E-4a09-8AB8-A593B648850B}.exe

Filesize
216KB

MD5
9d85e9eb6d7c84e8a62f37eaf23b9551

SHA1
a83235e81e6ef7f9ff79acfb961685d7a2d100b9

SHA256
9aed3f1a516823e27b083e8cf776d8d8402019005f87e1f99097d46eed11c0c6

SHA512
af6918f5e1a64a75d3e52a2e29fdf17cc66a09e5055b484905fc0d8e5787a73580416ac18c0e9b6e2fc38726a2dfad031adb89844f95acb8b534228d95802e42

Download Submit
C:\Windows\{F19036BC-40FC-4be0-81A9-2A9C32646F63}.exe

Filesize
216KB

MD5
871280466d98a961c2d1e57d883b766e

SHA1
a405cc0a965722acb91f36676c828bcc8968adfa

SHA256
5ca7ed6123d6340bfd442beedd57539fdd60c3bbc56a126ed9e9950021695bf5

SHA512
db7584098aee6725dfc9481e8fcc30d1c0b5a9304e035f6ab202065d0abcc1610132439866bf4e164d9d8904502702744d588891864dfe8382e60e335c32f217

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads