513431148338963242d5359966e5222d071b8f994231f062904ac3888de0ba39

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe
Size

372KB
MD5

c888fc904a41f991fe67cf9faa72345d
SHA1

cf72621831e12a3feff50b85ee119b47d7b55e15
SHA256

513431148338963242d5359966e5222d071b8f994231f062904ac3888de0ba39
SHA512

103eb90c8b419340a893254703c4910d57e6c55d025217dc12c73812fbb25370f5bcae525f469d8e278458cecfb42647eff38accb66e63c0d4514f76370081de
SSDEEP

3072:CEGh0oLlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGllkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000800000002320a-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023214-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002321b-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023214-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021c86-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021c87-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021c86-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000733-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070f-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000073b-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BDAEBE4-A998-494b-A32C-475C04F70704}	{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20756611-7A2C-4943-8E6B-5596A35D74D7}	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}\stubpath = "C:\\Windows\\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe"	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1909380B-2A34-4177-890C-B190DB6486D2}	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B692A72-E175-44e9-9E14-882887A1E516}	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}\stubpath = "C:\\Windows\\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe"	{3B692A72-E175-44e9-9E14-882887A1E516}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}\stubpath = "C:\\Windows\\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe"	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}\stubpath = "C:\\Windows\\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe"	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1909380B-2A34-4177-890C-B190DB6486D2}\stubpath = "C:\\Windows\\{1909380B-2A34-4177-890C-B190DB6486D2}.exe"	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}\stubpath = "C:\\Windows\\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe"	{1909380B-2A34-4177-890C-B190DB6486D2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20756611-7A2C-4943-8E6B-5596A35D74D7}\stubpath = "C:\\Windows\\{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe"	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}\stubpath = "C:\\Windows\\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe"	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}\stubpath = "C:\\Windows\\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe"	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}\stubpath = "C:\\Windows\\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe"	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BDAEBE4-A998-494b-A32C-475C04F70704}\stubpath = "C:\\Windows\\{9BDAEBE4-A998-494b-A32C-475C04F70704}.exe"	{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}	{1909380B-2A34-4177-890C-B190DB6486D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B692A72-E175-44e9-9E14-882887A1E516}\stubpath = "C:\\Windows\\{3B692A72-E175-44e9-9E14-882887A1E516}.exe"	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}	{3B692A72-E175-44e9-9E14-882887A1E516}.exe

Executes dropped EXE 12 IoCs

pid	Process
4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe
4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe
4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
1820	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
2484	{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe
1096	{9BDAEBE4-A998-494b-A32C-475C04F70704}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{1909380B-2A34-4177-890C-B190DB6486D2}.exe	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe
File created	C:\Windows\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
File created	C:\Windows\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
File created	C:\Windows\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	{1909380B-2A34-4177-890C-B190DB6486D2}.exe
File created	C:\Windows\{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
File created	C:\Windows\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
File created	C:\Windows\{3B692A72-E175-44e9-9E14-882887A1E516}.exe	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
File created	C:\Windows\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	{3B692A72-E175-44e9-9E14-882887A1E516}.exe
File created	C:\Windows\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
File created	C:\Windows\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
File created	C:\Windows\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
File created	C:\Windows\{9BDAEBE4-A998-494b-A32C-475C04F70704}.exe	{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe
Token: SeIncBasePriorityPrivilege	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
Token: SeIncBasePriorityPrivilege	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
Token: SeIncBasePriorityPrivilege	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
Token: SeIncBasePriorityPrivilege	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
Token: SeIncBasePriorityPrivilege	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe
Token: SeIncBasePriorityPrivilege	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
Token: SeIncBasePriorityPrivilege	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
Token: SeIncBasePriorityPrivilege	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
Token: SeIncBasePriorityPrivilege	1820	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
Token: SeIncBasePriorityPrivilege	2484	{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4716	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe	94
PID 3560 wrote to memory of 4716	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe	94
PID 3560 wrote to memory of 4716	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe	94
PID 3560 wrote to memory of 1628	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe	95
PID 3560 wrote to memory of 1628	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe	95
PID 3560 wrote to memory of 1628	3560	2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe	95
PID 4716 wrote to memory of 4828	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe	96
PID 4716 wrote to memory of 4828	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe	96
PID 4716 wrote to memory of 4828	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe	96
PID 4716 wrote to memory of 3200	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe	97
PID 4716 wrote to memory of 3200	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe	97
PID 4716 wrote to memory of 3200	4716	{1909380B-2A34-4177-890C-B190DB6486D2}.exe	97
PID 4828 wrote to memory of 3320	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	99
PID 4828 wrote to memory of 3320	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	99
PID 4828 wrote to memory of 3320	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	99
PID 4828 wrote to memory of 1536	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	100
PID 4828 wrote to memory of 1536	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	100
PID 4828 wrote to memory of 1536	4828	{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe	100
PID 3320 wrote to memory of 3568	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	101
PID 3320 wrote to memory of 3568	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	101
PID 3320 wrote to memory of 3568	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	101
PID 3320 wrote to memory of 2112	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	102
PID 3320 wrote to memory of 2112	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	102
PID 3320 wrote to memory of 2112	3320	{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe	102
PID 3568 wrote to memory of 4428	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	103
PID 3568 wrote to memory of 4428	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	103
PID 3568 wrote to memory of 4428	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	103
PID 3568 wrote to memory of 4632	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	104
PID 3568 wrote to memory of 4632	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	104
PID 3568 wrote to memory of 4632	3568	{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe	104
PID 4428 wrote to memory of 4824	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	105
PID 4428 wrote to memory of 4824	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	105
PID 4428 wrote to memory of 4824	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	105
PID 4428 wrote to memory of 4876	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	106
PID 4428 wrote to memory of 4876	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	106
PID 4428 wrote to memory of 4876	4428	{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe	106
PID 4824 wrote to memory of 4268	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe	107
PID 4824 wrote to memory of 4268	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe	107
PID 4824 wrote to memory of 4268	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe	107
PID 4824 wrote to memory of 3688	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe	108
PID 4824 wrote to memory of 3688	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe	108
PID 4824 wrote to memory of 3688	4824	{3B692A72-E175-44e9-9E14-882887A1E516}.exe	108
PID 4268 wrote to memory of 1396	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	109
PID 4268 wrote to memory of 1396	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	109
PID 4268 wrote to memory of 1396	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	109
PID 4268 wrote to memory of 4436	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	110
PID 4268 wrote to memory of 4436	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	110
PID 4268 wrote to memory of 4436	4268	{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe	110
PID 1396 wrote to memory of 3432	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	111
PID 1396 wrote to memory of 3432	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	111
PID 1396 wrote to memory of 3432	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	111
PID 1396 wrote to memory of 1084	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	112
PID 1396 wrote to memory of 1084	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	112
PID 1396 wrote to memory of 1084	1396	{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe	112
PID 3432 wrote to memory of 1820	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	113
PID 3432 wrote to memory of 1820	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	113
PID 3432 wrote to memory of 1820	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	113
PID 3432 wrote to memory of 3948	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	114
PID 3432 wrote to memory of 3948	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	114
PID 3432 wrote to memory of 3948	3432	{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe	114
PID 1820 wrote to memory of 2484	1820	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe	115
PID 1820 wrote to memory of 2484	1820	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe	115
PID 1820 wrote to memory of 2484	1820	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe	115
PID 1820 wrote to memory of 840	1820	{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe	116

C:\Users\Admin\AppData\Local\Temp\2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_c888fc904a41f991fe67cf9faa72345d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\{1909380B-2A34-4177-890C-B190DB6486D2}.exe
  C:\Windows\{1909380B-2A34-4177-890C-B190DB6486D2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
    C:\Windows\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
      C:\Windows\{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
        
        C:\Windows\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3568
      - C:\Windows\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
        
        C:\Windows\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\{3B692A72-E175-44e9-9E14-882887A1E516}.exe
        
        C:\Windows\{3B692A72-E175-44e9-9E14-882887A1E516}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
        
        C:\Windows\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
        
        C:\Windows\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
        
        C:\Windows\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
        
        C:\Windows\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe
        
        C:\Windows\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
        
        C:\Windows\{9BDAEBE4-A998-494b-A32C-475C04F70704}.exe
        
        C:\Windows\{9BDAEBE4-A998-494b-A32C-475C04F70704}.exe
        13⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1DB6F~1.EXE > nul
        13⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{611F0~1.EXE > nul
        12⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C1AB0~1.EXE > nul
        11⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B0E7~1.EXE > nul
        10⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8EA7~1.EXE > nul
        9⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B692~1.EXE > nul
        8⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FDF35~1.EXE > nul
        7⤵
        
        PID:4876
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95D14~1.EXE > nul
        6⤵
        
        PID:4632
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20756~1.EXE > nul
        5⤵
        
        PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B457C~1.EXE > nul
      4⤵
      PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{19093~1.EXE > nul
    3⤵
    PID:3200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1909380B-2A34-4177-890C-B190DB6486D2}.exe

Filesize
372KB

MD5
c4c564c08802b70ea57798d14a25c24e

SHA1
a50bd980e47a137773758080203ee9df6978f5a7

SHA256
c19bba58c4de2d3c45ed38486034358aab48d8709d8592b325ca0636d041f8d5

SHA512
09071f0124e65dc9ee16a0d303cd9578b49c283606ae12d2e52dce45de81619d41da36b53bdcb3fb424e5d3d006f998b48b579dd72b6202db9c124c8358f541f

Download Submit
C:\Windows\{1DB6F44C-972C-4515-8385-AFCAF2B366DD}.exe

Filesize
372KB

MD5
ef5eccdb877788c9d1e534031cb1fc36

SHA1
faf92ba9f60e6e28e896b99631a2163a34033507

SHA256
973071c828fe83b0f509037075f72a970831e76bfab3d1ddd1e08ccebdbf6980

SHA512
e1dbf73b964fa11d26ee2a95aa481a3394437fcf9f9acda82448a086f99bf858a61b9b7bc4bdc54d0edb45cc877f132c8beb0141cac94df95d740c4cbee6dd72

Download Submit
C:\Windows\{20756611-7A2C-4943-8E6B-5596A35D74D7}.exe

Filesize
372KB

MD5
9a8c7b082c3119b2f0507c22a72d5f50

SHA1
d80e60d4097c99c267e871ec95b3915c0960a22c

SHA256
0287c088feb1b4b55cc8a4cc5a0662d2c1d6a8af4ef78c0a4741b2f08b6604d2

SHA512
63700fd4cc5e2b65cec5b20bd1de93c9f1248c750edf714e10ec5ff9ddda8bbd8c8341111a51d38582c1688f737f27c3ba9b69715153fda0845c369c5e28e8e6

Download Submit
C:\Windows\{3B0E7490-70DE-49a5-9B15-0E17D4D3E92D}.exe

Filesize
372KB

MD5
4abe16f16cb12396e6752ad20786a66e

SHA1
275c25c99e63b9ef7f5a668efa94a07b918dadc2

SHA256
b5cd6f891b428505112932b156b4aaad266e0832c5f096c6a5dbbafd811f0393

SHA512
38181ca7bedd9d0e653a8afccae4c75b748c46e95edb7bd7af7b60e6614d4c3a41e72168c766fd249ec85954fe14f97877956e4d105ab1c51c2f05b206d76fab

Download Submit
C:\Windows\{3B692A72-E175-44e9-9E14-882887A1E516}.exe

Filesize
372KB

MD5
7cf55006c3101f532e5f3ea52ae60a55

SHA1
a09fd0aae7edd4473bf12e871963c2e0449de03f

SHA256
55e9f600d0344d97e0eef6a646a937d04bde7c01270746d669c920570d2e170c

SHA512
9957e2b97dfb518de44281602e5ababe360b3df4efad46f5ce2946cf7068710c828ab4de213f2e760509ed066e40de13cff72a52ceae63a833fd49aaa69683c1

Download Submit
C:\Windows\{611F0A5A-E65A-4f8b-9C12-A7159D3AC2E1}.exe

Filesize
372KB

MD5
fa5166c0d06ee091587e6e6b481be03a

SHA1
e9f1bca833517e2583327d384e95ba25466c7b67

SHA256
a7755b296c7e433e10f7b9b04d62259c780459fb86eff6eff32b719df4d34d8d

SHA512
c308fae237ef4b222663a950807a06a49fba97488a169c28ac90f70e6d50221cfb864e123013be0378cb65f2c7301e5613daba570b225f20337231277f40fd5e

Download Submit
C:\Windows\{95D14C34-E391-41e3-96F0-6DBCDDB9817E}.exe

Filesize
372KB

MD5
0d507e2f64085726eff8145dae1703aa

SHA1
a7eb290cb262c7a5361f91849444f2bfa08f1561

SHA256
7981852b83a06b335f818783f85a8f3c9858644f82a0db5bca67a27ebb66adbc

SHA512
8c1dd5f97dabd3f8f342383a227070471f80144505106b27af2474b5064c0d324affe9ed01e104fa3d2c9b6f1ed0ce720a0271b28e4a0ccb47ab36e14c75d7ec

Download Submit
C:\Windows\{9BDAEBE4-A998-494b-A32C-475C04F70704}.exe

Filesize
372KB

MD5
e9e205bdaf50ec34e10229acf816a444

SHA1
8b2d05decaa6da908ef2943819e06fe54b60a1a9

SHA256
23434494393fc6ea9bf17afbf14736f2b733caeeb7d0751bec2095d52ce86b7c

SHA512
0817ab09b521946091322ceddcb473e34e63fb232620984bcf6dd965bc32f409d7ab4786ac7c0dc32de867f7056229f39c190c361cbd2dc74578b84cd320954b

Download Submit
C:\Windows\{B457C2EC-5835-4923-8EE6-8C76DBD038B2}.exe

Filesize
372KB

MD5
1de6dda7abffbae41a844aa412bd1917

SHA1
5a5885447e7519d4530adadc6b5a30c18ca2b673

SHA256
a2aa978041ca4ba58b013b16d8465cae8a40eaa92442d299b2866970f712667b

SHA512
5bd081f014b1d993db9ca85c7ce24c37f4597fc6d350aeb3c2b6cfbac140c135bf9b32261b229d154453ae82b722b5bd54494027dd37d8fd57574908aed21be0

Download Submit
C:\Windows\{B8EA7087-B992-49ee-A7A3-09BA87E8B304}.exe

Filesize
372KB

MD5
c8ca231f35ab03811e7a9fc2f0d2d220

SHA1
f3bbe5d1d094a53c3db9d61583d19168b78702c6

SHA256
3fdbfe643169d52982df0e40e11ec5b4ad93b3800a6fdaa19ecea2fc36b28d16

SHA512
b85b174e6f648638376a189fa0f8ea4d896d30ea6be0cc1771612dfece9d70e01c7988d487b102453636b5a25118896ed30e9caee76ccde6c937e5384dfbce72

Download Submit
C:\Windows\{C1AB0026-907D-4fc1-9A00-693A2C28EB81}.exe

Filesize
372KB

MD5
0f7c78b915a337c9a109cb078a0eebdd

SHA1
2a99f46f245a8ffb36b6916fdfa0cb265f25236d

SHA256
18874ce529d25b823c1625e7acc111891c1c51989f4b228a554c1d6967baccc6

SHA512
b21fa7efcc2b2347c83c80283d31401f18d4220184fdf24158704744b9d0337dda072298e78d799ac40981b8cabc1e51a6afd4fd79edc630dd5753036a936c70

Download Submit
C:\Windows\{FDF35C02-BBBF-4b99-B317-493CDBBF93A5}.exe

Filesize
372KB

MD5
5212a124d58f1a42e40c3e7d14edca13

SHA1
bdd6b7a0b63b9ae74ca6d5b3bce80f86732a4333

SHA256
a6ec49ecc6da20257945671579b4d5fb8e1fc0ab504636c9fb55eca1a267beaf

SHA512
15ed2481b176de1fbe5eb410638b75e5854120b169ede70d346a325a37dfa340422ea1dc2de0fe941a29e9b7b959537d1e360bfa2f02b9e91550f189cd987990

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads