cdb52a13fcdbafc3d07b12580bff9ddd21b7318b1759beff0a423d03e807b8a8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe
Size

216KB
MD5

ae489b55a7885c6a6ad6a978a85b585a
SHA1

463feddb950a8b9a5e07f090120e443d1f7b6555
SHA256

cdb52a13fcdbafc3d07b12580bff9ddd21b7318b1759beff0a423d03e807b8a8
SHA512

adc47c5ba14d29a0e1d31af3441a6dd50b88910c0f8d59cb71333faf56fbdbd2fefb0ee88a7eee9f3239495ca096f1e0189ac7dd8eb1d0072baca0ff13e4fdf3
SSDEEP

3072:jEGh0oZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGrlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023217-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e804-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023225-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001e804-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021f82-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000001e804-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021f82-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-37.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3C4D036-708D-4a22-973D-2A5800C47C2B}\stubpath = "C:\\Windows\\{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe"	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}\stubpath = "C:\\Windows\\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe"	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}	{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}\stubpath = "C:\\Windows\\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe"	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E436214-A398-4d34-83AD-14481CA0D9BD}\stubpath = "C:\\Windows\\{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe"	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DD671AB-C5C8-480b-856F-7142A7B55035}\stubpath = "C:\\Windows\\{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe"	{0015EB47-E42F-4593-A69F-09F638C70574}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}\stubpath = "C:\\Windows\\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe"	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3C4D036-708D-4a22-973D-2A5800C47C2B}	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AAE5021-B087-469b-87F2-EA31971740E2}	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AAE5021-B087-469b-87F2-EA31971740E2}\stubpath = "C:\\Windows\\{1AAE5021-B087-469b-87F2-EA31971740E2}.exe"	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E436214-A398-4d34-83AD-14481CA0D9BD}	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DD671AB-C5C8-480b-856F-7142A7B55035}	{0015EB47-E42F-4593-A69F-09F638C70574}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}\stubpath = "C:\\Windows\\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe"	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}\stubpath = "C:\\Windows\\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe"	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}\stubpath = "C:\\Windows\\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe"	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0015EB47-E42F-4593-A69F-09F638C70574}	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0015EB47-E42F-4593-A69F-09F638C70574}\stubpath = "C:\\Windows\\{0015EB47-E42F-4593-A69F-09F638C70574}.exe"	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}\stubpath = "C:\\Windows\\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}.exe"	{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe

Executes dropped EXE 12 IoCs

pid	Process
216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe
2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe
5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
1096	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
2192	{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe
4416	{3B84AE88-407C-4446-A89B-3011EDCF4B8D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
File created	C:\Windows\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
File created	C:\Windows\{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	{0015EB47-E42F-4593-A69F-09F638C70574}.exe
File created	C:\Windows\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
File created	C:\Windows\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
File created	C:\Windows\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
File created	C:\Windows\{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
File created	C:\Windows\{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
File created	C:\Windows\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
File created	C:\Windows\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}.exe	{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe
File created	C:\Windows\{0015EB47-E42F-4593-A69F-09F638C70574}.exe	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe
File created	C:\Windows\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe
Token: SeIncBasePriorityPrivilege	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe
Token: SeIncBasePriorityPrivilege	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
Token: SeIncBasePriorityPrivilege	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
Token: SeIncBasePriorityPrivilege	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
Token: SeIncBasePriorityPrivilege	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
Token: SeIncBasePriorityPrivilege	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
Token: SeIncBasePriorityPrivilege	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
Token: SeIncBasePriorityPrivilege	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
Token: SeIncBasePriorityPrivilege	1096	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
Token: SeIncBasePriorityPrivilege	2192	{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 216	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe	90
PID 3044 wrote to memory of 216	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe	90
PID 3044 wrote to memory of 216	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe	90
PID 3044 wrote to memory of 1924	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe	91
PID 3044 wrote to memory of 1924	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe	91
PID 3044 wrote to memory of 1924	3044	2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe	91
PID 216 wrote to memory of 2964	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe	94
PID 216 wrote to memory of 2964	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe	94
PID 216 wrote to memory of 2964	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe	94
PID 216 wrote to memory of 4536	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe	95
PID 216 wrote to memory of 4536	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe	95
PID 216 wrote to memory of 4536	216	{0015EB47-E42F-4593-A69F-09F638C70574}.exe	95
PID 2964 wrote to memory of 5032	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	97
PID 2964 wrote to memory of 5032	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	97
PID 2964 wrote to memory of 5032	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	97
PID 2964 wrote to memory of 3956	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	98
PID 2964 wrote to memory of 3956	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	98
PID 2964 wrote to memory of 3956	2964	{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe	98
PID 5032 wrote to memory of 5020	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	99
PID 5032 wrote to memory of 5020	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	99
PID 5032 wrote to memory of 5020	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	99
PID 5032 wrote to memory of 3756	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	100
PID 5032 wrote to memory of 3756	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	100
PID 5032 wrote to memory of 3756	5032	{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe	100
PID 5020 wrote to memory of 2132	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	101
PID 5020 wrote to memory of 2132	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	101
PID 5020 wrote to memory of 2132	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	101
PID 5020 wrote to memory of 1008	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	102
PID 5020 wrote to memory of 1008	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	102
PID 5020 wrote to memory of 1008	5020	{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe	102
PID 2132 wrote to memory of 4068	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	103
PID 2132 wrote to memory of 4068	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	103
PID 2132 wrote to memory of 4068	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	103
PID 2132 wrote to memory of 464	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	104
PID 2132 wrote to memory of 464	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	104
PID 2132 wrote to memory of 464	2132	{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe	104
PID 4068 wrote to memory of 456	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	105
PID 4068 wrote to memory of 456	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	105
PID 4068 wrote to memory of 456	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	105
PID 4068 wrote to memory of 4228	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	106
PID 4068 wrote to memory of 4228	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	106
PID 4068 wrote to memory of 4228	4068	{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe	106
PID 456 wrote to memory of 3280	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	107
PID 456 wrote to memory of 3280	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	107
PID 456 wrote to memory of 3280	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	107
PID 456 wrote to memory of 3712	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	108
PID 456 wrote to memory of 3712	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	108
PID 456 wrote to memory of 3712	456	{1AAE5021-B087-469b-87F2-EA31971740E2}.exe	108
PID 3280 wrote to memory of 1728	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	109
PID 3280 wrote to memory of 1728	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	109
PID 3280 wrote to memory of 1728	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	109
PID 3280 wrote to memory of 3224	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	110
PID 3280 wrote to memory of 3224	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	110
PID 3280 wrote to memory of 3224	3280	{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe	110
PID 1728 wrote to memory of 1096	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	111
PID 1728 wrote to memory of 1096	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	111
PID 1728 wrote to memory of 1096	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	111
PID 1728 wrote to memory of 2908	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	112
PID 1728 wrote to memory of 2908	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	112
PID 1728 wrote to memory of 2908	1728	{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe	112
PID 1096 wrote to memory of 2192	1096	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe	113
PID 1096 wrote to memory of 2192	1096	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe	113
PID 1096 wrote to memory of 2192	1096	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe	113
PID 1096 wrote to memory of 4840	1096	{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_ae489b55a7885c6a6ad6a978a85b585a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\{0015EB47-E42F-4593-A69F-09F638C70574}.exe
  C:\Windows\{0015EB47-E42F-4593-A69F-09F638C70574}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe
    C:\Windows\{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
      C:\Windows\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
        
        C:\Windows\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Windows\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
        
        C:\Windows\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
        
        C:\Windows\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
        
        C:\Windows\{1AAE5021-B087-469b-87F2-EA31971740E2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
        
        C:\Windows\{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
        
        C:\Windows\{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
        
        C:\Windows\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe
        
        C:\Windows\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}.exe
        
        C:\Windows\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}.exe
        13⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9F7E~1.EXE > nul
        13⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D86A3~1.EXE > nul
        12⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3C4D~1.EXE > nul
        11⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6E436~1.EXE > nul
        10⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1AAE5~1.EXE > nul
        9⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F38C~1.EXE > nul
        8⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{274FA~1.EXE > nul
        7⤵
        
        PID:464
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{99B86~1.EXE > nul
        6⤵
        
        PID:1008
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B2CC~1.EXE > nul
        5⤵
        
        PID:3756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2DD67~1.EXE > nul
      4⤵
      PID:3956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0015E~1.EXE > nul
    3⤵
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0015EB47-E42F-4593-A69F-09F638C70574}.exe

Filesize
216KB

MD5
b55f50274fa37c842dd5ed85d8d84de8

SHA1
66fb3a32eb13626c6164d7fe471d9eec47b869b0

SHA256
e4630b85402b71f47527c92df23fa185ea23eb8fc07a2c1d89aa6f755b9e9d63

SHA512
11fc9b21c90ef8bac852227a667fa652b950cead40201403d1c557defe26e85640f19b60ecc1763ce5f2e0b18093064bb846d2201e4c66827c9c018bfa11a03a

Download Submit
C:\Windows\{1AAE5021-B087-469b-87F2-EA31971740E2}.exe

Filesize
216KB

MD5
125cece46846255850b649d824063a6a

SHA1
03ef8690e10b5a1d6ada9905c70a4b06bd9cc81f

SHA256
ef8d275ec3f5483aced5d424c67c89814f8e6358c17201763b98a9e267e757ff

SHA512
8caf46fdc413d19d0eed9d4d75279659bf7133b0712bba5d7e3deb1ac4569b6f1a527cb1d87ab7501f45ef14e088ee525fa1e0568e9e5df3c402488a81ce0e33

Download Submit
C:\Windows\{274FA1A0-961C-41b6-9991-AB806AEBB3B9}.exe

Filesize
216KB

MD5
9b54fe02b1c53b079fec415640a41d59

SHA1
efe5c2aa2c91428124b37a89b68bf115cad937ee

SHA256
040a13f2f9554bb0206e5e325f5fa24bd6dbffe3f00af60a249a1b42e83f726d

SHA512
34760e367ac0de73d1821770438ce910e885a34ed75bb2e220ba5328a22ca0a4aaa1ebd80ed8aac63ef98d2cece072e9a2a11cc19a81ad0f8cd0a860bc449fd4

Download Submit
C:\Windows\{2DD671AB-C5C8-480b-856F-7142A7B55035}.exe

Filesize
216KB

MD5
032203ba0435bf1f95e9765d2e711bef

SHA1
8499a1264c3dae1a73c18784a4daacf1c8440b6d

SHA256
d75e227c32bef46db96dd9cc61347133dd59466a10e53e41881d14a66ed9c1de

SHA512
4ece454b3888133e3b2b517990614d0d8de2b767ec26566137ad5f10f366f99cb4214aefb49e80340dbf9bb434f9bd415bcf6e2369d26abc081dbc0a2ec16673

Download Submit
C:\Windows\{3B2CCFB3-148C-4d5d-895F-35F7BF061923}.exe

Filesize
216KB

MD5
3e169ab3d8f6293d70c6ff052197b6a8

SHA1
a0dc5018add1aae91d9a88e12bf402684873798e

SHA256
c32b0441c8e6d530f95d4342cf135ad73aafd98e5c8469ac9dc9f5e8cdde505d

SHA512
ab1fb65c19fbb6c9456b911c228396400c0690a74bf6c840415d29fc72fc8e4b9643045a17d6ac3e96e04d61d108906d7221330312d82e014fdafb600d7bc2f8

Download Submit
C:\Windows\{3B84AE88-407C-4446-A89B-3011EDCF4B8D}.exe

Filesize
216KB

MD5
d1a48974f6bb75e299285001ca9d211c

SHA1
803485c1cab33f72735eace63993597f7e7c069c

SHA256
5c41ac8da6aafdba5ebebc075e516ad6c065f694a97588778309a460406f684b

SHA512
d1a296a5ab98a6210bbf7a422629a6ab60d8aa7f11968afe176f110d96a1b9ee9699e24d836ee54b6fd0dd2d240cea110c130438c8a14e283730a233e3fb600e

Download Submit
C:\Windows\{6E436214-A398-4d34-83AD-14481CA0D9BD}.exe

Filesize
216KB

MD5
03ff675ff292fb402a8d6c492a8d18cc

SHA1
b055acbee199eec6bea0841c42e5fb75309e4398

SHA256
6dc67ee215f93aff4985193a652408097ec324bfaaa02bddabfa10f5e995d594

SHA512
836bd8b0db6201233660a1fada8205fabfbcd6ae97b1b9ba83872f6a2217a5d544112c888194142bee3f0454b58066e5e8dabf034c67e5ef6d10405c62291dbd

Download Submit
C:\Windows\{6F38CD37-547E-46e5-ADD8-4F4AF1FEB8E0}.exe

Filesize
216KB

MD5
4217811fe5a1e2b418cd53e14b5440d8

SHA1
74fde0ae798a5cc7e8c622b83b4c699906b08a89

SHA256
63e88cea3c63b1daa45f8e57ac971d42a3653d84fcf9245ee627fd8cf8d6d267

SHA512
86a76a502c2191d3f6da2995850efa890683478c1474a345c8eb524b9aaacff9523f81a75161c72b92b206076c3a5279ad0fc8384a1404c3d9e6d0975e38025c

Download Submit
C:\Windows\{99B864C7-EEC4-46f3-9BB4-0F16BB8A378C}.exe

Filesize
216KB

MD5
2fa8df32d7dd45ed0f0a24ae38df962a

SHA1
0810a1322296d9408100e4ae8904bc6818e4629e

SHA256
81ccbb9cf871bc928d3959bddb85889168a30f8bb389bcb08358c0b275000ccf

SHA512
c9179c8e6478a084a527e7a67edd2803e4db99d586573a72c3bd8ab2b8aeaa3e6a1162c5eda442148ad14eaa60f45b565041bd297de25234a4fb4bb9b3f65bd9

Download Submit
C:\Windows\{C3C4D036-708D-4a22-973D-2A5800C47C2B}.exe

Filesize
216KB

MD5
14ceded7ee2e6f5e59c14ece07d593ed

SHA1
e1f1e0cfd3486e6a1a87ebbf3fed33282e8ad9d8

SHA256
0185950099c452a34ce54e08eb2263e4d877e4e525d0e35923ea0947b410a75a

SHA512
482cba4dfa666416e8affb432f377e68a41785a8a315501dff15091199303e3e65cd961b394fc9a73a43a7d4fc0a35e2b6a409093831528522f78455912d4dec

Download Submit
C:\Windows\{D86A3804-57EB-44f0-82DB-9D8896EB19FD}.exe

Filesize
216KB

MD5
4f8e51d766c407532b21f0d4a45b39fa

SHA1
04b2dd260ea9a067023c6a39731389e762f1a26e

SHA256
dea7907f494e3551f779776e26609a3c77d265d5ebcc58492815e585ef70dec4

SHA512
d2439d5d0501b8c0d30cdd880d0cec6a07f03a47cb9a0128e24db25b7ae66b23e54d5e9f215ff84857a5fd5a7df5b6ecc65152d1524375bef60757207126b983

Download Submit
C:\Windows\{F9F7E6BD-BE27-4470-ACE8-4B5FDDBD6F55}.exe

Filesize
216KB

MD5
b51aa552697d6f3de5809fa1ed298406

SHA1
964cb9373aca177b871ada41522e44423f655172

SHA256
eccfd46002bdad33ee6d8df5e7bbb31e14292adecb5f249dcdd3b7ad6360ad90

SHA512
04dfda1a53ffe4068dfb0799cd8191ca2b0e95c5b2d898dcbf5f9b77d6d86973fd445dfae96648e78915bced552f7530d9ae6a1eb5640d0a67ea06580eb9e820

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads