e813f5045d267bcd57f05adb5c0627c1bd39e7e47166808ce36f94f6818d3abb

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
Size 180KB
Sample240404-vzdn8ade4v
SHA256 e813f5045d267bcd57f05adb5c0627c1bd39e7e47166808ce36f94f6818d3abb
MD5 11b0ce922f0155fe91da91b57e9fb027
SHA1 f421640d5c4eb37a509b84e1900e4231bd98a4ef
SHA512 b127620e6c570641e33251efe6982fa4f148efefd8bd0a60ad2b6eea65cedc6a773eb0f85e581de4d7fb7c56d2a922a532824b535913f659a109e6614f06f73d
SSDEEP 3072:jEGh0o6lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG8l5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231d5-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000231db-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231e2-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231db-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d41-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d42-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021d41-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000707-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D58C772-501E-4f43-A775-15EC4D9C61C2}\stubpath = "C:\\Windows\\{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe"	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}\stubpath = "C:\\Windows\\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe"	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53743818-D20F-424d-AE19-19189804EEBA}\stubpath = "C:\\Windows\\{53743818-D20F-424d-AE19-19189804EEBA}.exe"	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1DD968E-A289-474a-94DD-35BB88D977A2}	{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A8AB76E-0689-4c85-A668-041D85C81B23}\stubpath = "C:\\Windows\\{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe"	{53743818-D20F-424d-AE19-19189804EEBA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}\stubpath = "C:\\Windows\\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe"	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E752701C-0894-460d-A4FA-3B9BADE32C8C}	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}\stubpath = "C:\\Windows\\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe"	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}	{62075666-1579-4425-B8C9-ACD6824EF084}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}\stubpath = "C:\\Windows\\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe"	{62075666-1579-4425-B8C9-ACD6824EF084}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{765C08DC-B0A5-425b-B24E-99FE42985A78}\stubpath = "C:\\Windows\\{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe"	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A8AB76E-0689-4c85-A668-041D85C81B23}	{53743818-D20F-424d-AE19-19189804EEBA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E752701C-0894-460d-A4FA-3B9BADE32C8C}\stubpath = "C:\\Windows\\{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe"	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62075666-1579-4425-B8C9-ACD6824EF084}\stubpath = "C:\\Windows\\{62075666-1579-4425-B8C9-ACD6824EF084}.exe"	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}\stubpath = "C:\\Windows\\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe"	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1DD968E-A289-474a-94DD-35BB88D977A2}\stubpath = "C:\\Windows\\{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe"	{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62075666-1579-4425-B8C9-ACD6824EF084}	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D58C772-501E-4f43-A775-15EC4D9C61C2}	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{765C08DC-B0A5-425b-B24E-99FE42985A78}	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53743818-D20F-424d-AE19-19189804EEBA}	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe

Executes dropped EXE 12 IoCs

pid	Process
2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe
1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe
4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe
3692	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
4556	{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
1452	{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
File created	C:\Windows\{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
File created	C:\Windows\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
File created	C:\Windows\{53743818-D20F-424d-AE19-19189804EEBA}.exe	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
File created	C:\Windows\{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe	{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
File created	C:\Windows\{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
File created	C:\Windows\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
File created	C:\Windows\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	{62075666-1579-4425-B8C9-ACD6824EF084}.exe
File created	C:\Windows\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
File created	C:\Windows\{62075666-1579-4425-B8C9-ACD6824EF084}.exe	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
File created	C:\Windows\{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	{53743818-D20F-424d-AE19-19189804EEBA}.exe
File created	C:\Windows\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
Token: SeIncBasePriorityPrivilege	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
Token: SeIncBasePriorityPrivilege	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe
Token: SeIncBasePriorityPrivilege	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
Token: SeIncBasePriorityPrivilege	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
Token: SeIncBasePriorityPrivilege	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
Token: SeIncBasePriorityPrivilege	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
Token: SeIncBasePriorityPrivilege	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe
Token: SeIncBasePriorityPrivilege	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe
Token: SeIncBasePriorityPrivilege	3692	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
Token: SeIncBasePriorityPrivilege	4556	{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2816	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe	97
PID 4760 wrote to memory of 2816	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe	97
PID 4760 wrote to memory of 2816	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe	97
PID 4760 wrote to memory of 3460	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe	98
PID 4760 wrote to memory of 3460	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe	98
PID 4760 wrote to memory of 3460	4760	2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe	98
PID 2816 wrote to memory of 4200	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	99
PID 2816 wrote to memory of 4200	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	99
PID 2816 wrote to memory of 4200	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	99
PID 2816 wrote to memory of 528	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	100
PID 2816 wrote to memory of 528	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	100
PID 2816 wrote to memory of 528	2816	{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe	100
PID 4200 wrote to memory of 5072	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	102
PID 4200 wrote to memory of 5072	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	102
PID 4200 wrote to memory of 5072	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	102
PID 4200 wrote to memory of 4940	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	103
PID 4200 wrote to memory of 4940	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	103
PID 4200 wrote to memory of 4940	4200	{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe	103
PID 5072 wrote to memory of 1804	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe	104
PID 5072 wrote to memory of 1804	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe	104
PID 5072 wrote to memory of 1804	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe	104
PID 5072 wrote to memory of 4612	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe	105
PID 5072 wrote to memory of 4612	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe	105
PID 5072 wrote to memory of 4612	5072	{62075666-1579-4425-B8C9-ACD6824EF084}.exe	105
PID 1804 wrote to memory of 2780	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	106
PID 1804 wrote to memory of 2780	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	106
PID 1804 wrote to memory of 2780	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	106
PID 1804 wrote to memory of 1628	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	107
PID 1804 wrote to memory of 1628	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	107
PID 1804 wrote to memory of 1628	1804	{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe	107
PID 2780 wrote to memory of 3060	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	108
PID 2780 wrote to memory of 3060	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	108
PID 2780 wrote to memory of 3060	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	108
PID 2780 wrote to memory of 4812	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	109
PID 2780 wrote to memory of 4812	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	109
PID 2780 wrote to memory of 4812	2780	{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe	109
PID 3060 wrote to memory of 2840	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	110
PID 3060 wrote to memory of 2840	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	110
PID 3060 wrote to memory of 2840	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	110
PID 3060 wrote to memory of 4716	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	111
PID 3060 wrote to memory of 4716	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	111
PID 3060 wrote to memory of 4716	3060	{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe	111
PID 2840 wrote to memory of 4208	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	112
PID 2840 wrote to memory of 4208	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	112
PID 2840 wrote to memory of 4208	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	112
PID 2840 wrote to memory of 1496	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	113
PID 2840 wrote to memory of 1496	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	113
PID 2840 wrote to memory of 1496	2840	{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe	113
PID 4208 wrote to memory of 4144	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe	114
PID 4208 wrote to memory of 4144	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe	114
PID 4208 wrote to memory of 4144	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe	114
PID 4208 wrote to memory of 4504	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe	115
PID 4208 wrote to memory of 4504	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe	115
PID 4208 wrote to memory of 4504	4208	{53743818-D20F-424d-AE19-19189804EEBA}.exe	115
PID 4144 wrote to memory of 3692	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	116
PID 4144 wrote to memory of 3692	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	116
PID 4144 wrote to memory of 3692	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	116
PID 4144 wrote to memory of 4972	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	117
PID 4144 wrote to memory of 4972	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	117
PID 4144 wrote to memory of 4972	4144	{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe	117
PID 3692 wrote to memory of 4556	3692	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe	118
PID 3692 wrote to memory of 4556	3692	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe	118
PID 3692 wrote to memory of 4556	3692	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe	118
PID 3692 wrote to memory of 1188	3692	{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_11b0ce922f0155fe91da91b57e9fb027_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
  C:\Windows\{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
    C:\Windows\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\{62075666-1579-4425-B8C9-ACD6824EF084}.exe
      C:\Windows\{62075666-1579-4425-B8C9-ACD6824EF084}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
        
        C:\Windows\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Windows\{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
        
        C:\Windows\{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
        
        C:\Windows\{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
        
        C:\Windows\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\{53743818-D20F-424d-AE19-19189804EEBA}.exe
        
        C:\Windows\{53743818-D20F-424d-AE19-19189804EEBA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe
        
        C:\Windows\{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
        
        C:\Windows\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
        
        C:\Windows\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
        
        C:\Windows\{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe
        
        C:\Windows\{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe
        13⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{47390~1.EXE > nul
        13⤵
        
        PID:736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4EF40~1.EXE > nul
        12⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A8AB~1.EXE > nul
        11⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53743~1.EXE > nul
        10⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C95B~1.EXE > nul
        9⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{765C0~1.EXE > nul
        8⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7D58C~1.EXE > nul
        7⤵
        
        PID:4812
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EC6B8~1.EXE > nul
        6⤵
        
        PID:1628
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62075~1.EXE > nul
        5⤵
        
        PID:4612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BA292~1.EXE > nul
      4⤵
      PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E7527~1.EXE > nul
    3⤵
    PID:528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe

Path C:\Windows\{3C95B2C3-775C-4347-92A8-1914BEDC8B68}.exe
Size 180KB
SHA256 2d2e6fc7cd5150275e2b43e195f78dd1798a1df4799419cfdce1477b51dc8832
MD5 d132437b79e60aaca86d1a9714455458
SHA1 7fd160fbd298761b2f7ddcd3d8fe0b45063a5610
SHA512 2c451c293bd22b9bc33e36d158df6a678fe54dcdb8ef2e2dbb349aa5936e34082d946e30da39b0c9f06a96b2ab9bfa1e056fc8c4ce5d34a11ce50e062457d76d
SSDEEP 3072:jEGh0odlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGLl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe

Path C:\Windows\{47390F9E-1EA4-4bf6-9DC0-2C3B22A847A3}.exe
Size 180KB
SHA256 894d76b30502761e10824311747162b7737d0207b1b6fc8f257cfb2a2cac6b98
MD5 ddb3b6930ec3a3fc323b020225ab4054
SHA1 0a4e3f5daa30c918f76fa581b217f6d5833d567a
SHA512 c73df3c91ac4ecb16cf6a5b729639d9a1925a17ec1087345696b002236a129395113fb02a255a7ab38c7207e70201053448c9dbf5dcaa60c8ad3b0f0201c06f1
SSDEEP 3072:jEGh0o8lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGml5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe

Path C:\Windows\{4A8AB76E-0689-4c85-A668-041D85C81B23}.exe
Size 180KB
SHA256 9cec21809c2300ad41943b07beb006a673814501f67dc13f06dbbb56566369ce
MD5 5039b07e0377cb5bf073fab5b6c16585
SHA1 4324dcea7f86edfaf90ce0a85d662d3c08e17d83
SHA512 ebf9d17d82e84659bc0bf71015925ecf1a0dab4ef5ea2cf3837d7a4e57cbc57203fe6553e91420bda72fb681896f184abbc99db64f9b1d2b76a9e987b5c63fe6
SSDEEP 3072:jEGh0oxlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGzl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe

Path C:\Windows\{4EF408DB-94C6-4d62-80C8-F392D2B05D77}.exe
Size 180KB
SHA256 e111fe96c47f0a1108c317ea8e6db9bdb74adcb0d45f655bcd234692d172535d
MD5 048a270181d88f98a43aa202becc3985
SHA1 eff4f7d1d9dbe74ec93a97fd93093acbe7d0beb3
SHA512 3326f2b2d3ea4db495bafe65b45fd0f88a924c8ed5bb59b39cf0a0fcdffa2fd92c2da3eeef060d53e656a321b7e984de11abd1201a90179c816c1309aec09b1f
SSDEEP 3072:jEGh0o1lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGzl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{53743818-D20F-424d-AE19-19189804EEBA}.exe

Path C:\Windows\{53743818-D20F-424d-AE19-19189804EEBA}.exe
Size 180KB
SHA256 b47d820657c8cebd9e12c7f5839d932ea23a0c8b46f5798928c2e0d650a67c37
MD5 ab22a185deb21e9335fe665f5417bab7
SHA1 5066a2277798ec1d7d15984bed450df004e3a737
SHA512 3a1ba7ba575a7cc9a4b81a001385c3f24622af3b9c7f4b42f5ba6c0b3bd64b0cdd69e7c06612f41736a14440a547e0758fc4ba455847d68b57c7906022cefac5
SSDEEP 3072:jEGh0oMlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG+l5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{62075666-1579-4425-B8C9-ACD6824EF084}.exe

Path C:\Windows\{62075666-1579-4425-B8C9-ACD6824EF084}.exe
Size 180KB
SHA256 c7ee38bfcc7572d0ccd2d59461aa81ed2b7850389b192a51fea78b379f3135bf
MD5 4d76852e551f696197a6f85fc8d3e9f6
SHA1 b6a0507a0a4babb55d9b07f4fc593839c3f1c6fc
SHA512 22e4159da8437b7d39f2601198bdb1935a93f03ab7921cdb5756951695a5a0913da77dbd34232e0f34f183ab6318b21a323406ec65fc1ea4bd81f9fb267ccc67
SSDEEP 3072:jEGh0oolfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGOl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe

Path C:\Windows\{765C08DC-B0A5-425b-B24E-99FE42985A78}.exe
Size 180KB
SHA256 fa846818969342e6a1524f8dbe3e260a782c67ce3459f01f3361426e49e95644
MD5 f2096d6278dfcf63333f2f00f1e48533
SHA1 04986594bd34602a3a9e4ae7650547d5ce28188b
SHA512 18762992e7db0aa519aaee556548fedb23be26c45d11316e23cfe62c8dea1be0c4fcf6fc385092de4b827e8d9694875ed2ab5b657899fc32c6cfee086f659301
SSDEEP 3072:jEGh0oNlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGbl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe

Path C:\Windows\{7D58C772-501E-4f43-A775-15EC4D9C61C2}.exe
Size 180KB
SHA256 6ec1cd6be28c0e2e487f38fdcd5fe57665d706525f6f08cd38aca4a67afed112
MD5 5a88e5c4a062c98288646b370c690db8
SHA1 1a6cc858ded254fde0f376fe6b79344783da4756
SHA512 80f80d2ae71f1ba39eb20f899ce8ffd177f7c37c8d2b1275a4a7c4716fa51bcecb2140a818f54a68e2ddcc3eea475aea4b13209468a322ae6723967178a63512
SSDEEP 3072:jEGh0oFlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGDl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe

Path C:\Windows\{B1DD968E-A289-474a-94DD-35BB88D977A2}.exe
Size 180KB
SHA256 0b76c423ebc4ba612f8526775c6800fccda0abb330da40e587f625509b880046
MD5 1442ef41fa874c5b9e534c44386a1986
SHA1 94b817c20c19c8c2f171b4c52a2461ead7644cd9
SHA512 0f3ab58debaef911b2f5276900705d103d057b5876d0889d0826f2ccee4d81289b89af33942e24dcd2f16ce3d2b55b5c4cadfca5b2ef2e6d63cf8996ba3c3f3f
SSDEEP 3072:jEGh0oklfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGyl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe

Path C:\Windows\{BA292CDB-E8A3-4df3-A80E-592649FC14A9}.exe
Size 180KB
SHA256 3684a235e9562fba844e7f8fad876a4e28318a09e62ca73ab60e33a64c9a7f81
MD5 8195041af4ad964b586aebe0cf7f3b25
SHA1 3261fdf23a19aa75585b23329711bc0307155a04
SHA512 bb100b5013b4fb2ea8e13ef7b6d03ecb6fda3a1e8530f50c631155db3da3e042e78dfc29728dd5e418c9e41b82d55aa8707ea27df986a21692b73cbf02ee45b5
SSDEEP 3072:jEGh0oAlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGul5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe

Path C:\Windows\{E752701C-0894-460d-A4FA-3B9BADE32C8C}.exe
Size 180KB
SHA256 180e7779f820f55ac9e8dbd49c4c163ca4cb83785abe2fcbdaa129f560ceb930
MD5 281c18c9dbbcddd280492183e59e73a7
SHA1 993eea932454c0cad2378848b46d226cccbd0a55
SHA512 41e236943d6470e2098c63318d09a3cc8291297a97045c33cdb5ac14fa2ab794bdc5849e916e9ea88c52a629865306d1576cf50948fb0806d144198d9e4c4d80
SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGwl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe

Path C:\Windows\{EC6B8DE4-E5A7-49b0-BC3F-3F2916CABCD9}.exe
Size 180KB
SHA256 392d940d34dfdc065a9de1e824504f5fb8660795474bc1f5bbcd2d0998b10296
MD5 3ac9af3aa2193800a0c3dfc0d5f7841c
SHA1 f028341fe7320346d8250494e14bd77048a41c3f
SHA512 7ece38082cc8befc90dda19105e170d7577082a4d42c6885f647e7a4897a1d456c7e1e0472286271959bb9e8fbd3abc921c17fb5e1cc9e80a8643ce2410221d8
SSDEEP 3072:jEGh0ozlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGJl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads