61dc0782753bf9af2aa67cb5c83964f1c9ef8dd55a0581ee5c31edc99a657a24

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe
Size

168KB
MD5

31554424de54fb03c822637050bcb42f
SHA1

e71f5d2999a5edf0c159f6dc91c997c902179442
SHA256

61dc0782753bf9af2aa67cb5c83964f1c9ef8dd55a0581ee5c31edc99a657a24
SHA512

568aa838dbc4b904c3035c4a2c36e5e9aa8fcde870987c7f179646d6666329d08e451dc13aeceefb8824a4693d9715f2d5b82c2fdf4f4f03a4be45d1ed4d7ca8
SSDEEP

1536:1EGh0oslq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oslqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012256-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014b3c-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f3-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f3-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f3-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f3-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000004ed7-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}\stubpath = "C:\\Windows\\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe"	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4AEBF0-8B9D-464b-A008-6663365E3110}\stubpath = "C:\\Windows\\{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe"	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98CE5F4F-C7F5-4c87-88B0-27591016525E}\stubpath = "C:\\Windows\\{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe"	{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}	{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}\stubpath = "C:\\Windows\\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe"	{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{826369BE-D034-47de-A7B9-7C4E6A67B34F}	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{826369BE-D034-47de-A7B9-7C4E6A67B34F}\stubpath = "C:\\Windows\\{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe"	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}\stubpath = "C:\\Windows\\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe"	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AAE1511A-FA73-4128-945F-49A73E932FD7}\stubpath = "C:\\Windows\\{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe"	{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}\stubpath = "C:\\Windows\\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe"	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35C28D3B-9D0D-4af3-815F-25C495ED3293}	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35C28D3B-9D0D-4af3-815F-25C495ED3293}\stubpath = "C:\\Windows\\{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe"	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}\stubpath = "C:\\Windows\\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe"	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4AEBF0-8B9D-464b-A008-6663365E3110}	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{683A148A-759F-4d2a-B065-31429D6E14B1}	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{683A148A-759F-4d2a-B065-31429D6E14B1}\stubpath = "C:\\Windows\\{683A148A-759F-4d2a-B065-31429D6E14B1}.exe"	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98CE5F4F-C7F5-4c87-88B0-27591016525E}	{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AAE1511A-FA73-4128-945F-49A73E932FD7}	{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}	{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}\stubpath = "C:\\Windows\\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}.exe"	{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe

Deletes itself 1 IoCs

pid	Process
1644	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
2768	{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
1624	{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
2248	{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe
1892	{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe
2280	{ADE8653B-32AA-4239-B11B-50D87A1FCE31}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
File created	C:\Windows\{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe	{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
File created	C:\Windows\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}.exe	{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe
File created	C:\Windows\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
File created	C:\Windows\{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
File created	C:\Windows\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
File created	C:\Windows\{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
File created	C:\Windows\{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
File created	C:\Windows\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe
File created	C:\Windows\{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
File created	C:\Windows\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe	{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
File created	C:\Windows\{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe	{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
Token: SeIncBasePriorityPrivilege	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
Token: SeIncBasePriorityPrivilege	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
Token: SeIncBasePriorityPrivilege	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
Token: SeIncBasePriorityPrivilege	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
Token: SeIncBasePriorityPrivilege	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
Token: SeIncBasePriorityPrivilege	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
Token: SeIncBasePriorityPrivilege	2768	{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
Token: SeIncBasePriorityPrivilege	1624	{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
Token: SeIncBasePriorityPrivilege	2248	{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe
Token: SeIncBasePriorityPrivilege	1892	{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3060	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	28
PID 2148 wrote to memory of 3060	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	28
PID 2148 wrote to memory of 3060	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	28
PID 2148 wrote to memory of 3060	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	28
PID 2148 wrote to memory of 1644	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	29
PID 2148 wrote to memory of 1644	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	29
PID 2148 wrote to memory of 1644	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	29
PID 2148 wrote to memory of 1644	2148	2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe	29
PID 3060 wrote to memory of 2688	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	30
PID 3060 wrote to memory of 2688	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	30
PID 3060 wrote to memory of 2688	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	30
PID 3060 wrote to memory of 2688	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	30
PID 3060 wrote to memory of 2548	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	31
PID 3060 wrote to memory of 2548	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	31
PID 3060 wrote to memory of 2548	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	31
PID 3060 wrote to memory of 2548	3060	{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe	31
PID 2688 wrote to memory of 2472	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	34
PID 2688 wrote to memory of 2472	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	34
PID 2688 wrote to memory of 2472	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	34
PID 2688 wrote to memory of 2472	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	34
PID 2688 wrote to memory of 2544	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	35
PID 2688 wrote to memory of 2544	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	35
PID 2688 wrote to memory of 2544	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	35
PID 2688 wrote to memory of 2544	2688	{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe	35
PID 2472 wrote to memory of 848	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	36
PID 2472 wrote to memory of 848	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	36
PID 2472 wrote to memory of 848	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	36
PID 2472 wrote to memory of 848	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	36
PID 2472 wrote to memory of 2836	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	37
PID 2472 wrote to memory of 2836	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	37
PID 2472 wrote to memory of 2836	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	37
PID 2472 wrote to memory of 2836	2472	{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe	37
PID 848 wrote to memory of 2988	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	38
PID 848 wrote to memory of 2988	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	38
PID 848 wrote to memory of 2988	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	38
PID 848 wrote to memory of 2988	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	38
PID 848 wrote to memory of 3064	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	39
PID 848 wrote to memory of 3064	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	39
PID 848 wrote to memory of 3064	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	39
PID 848 wrote to memory of 3064	848	{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe	39
PID 2988 wrote to memory of 2704	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	40
PID 2988 wrote to memory of 2704	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	40
PID 2988 wrote to memory of 2704	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	40
PID 2988 wrote to memory of 2704	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	40
PID 2988 wrote to memory of 2752	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	41
PID 2988 wrote to memory of 2752	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	41
PID 2988 wrote to memory of 2752	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	41
PID 2988 wrote to memory of 2752	2988	{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe	41
PID 2704 wrote to memory of 824	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	42
PID 2704 wrote to memory of 824	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	42
PID 2704 wrote to memory of 824	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	42
PID 2704 wrote to memory of 824	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	42
PID 2704 wrote to memory of 660	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	43
PID 2704 wrote to memory of 660	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	43
PID 2704 wrote to memory of 660	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	43
PID 2704 wrote to memory of 660	2704	{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe	43
PID 824 wrote to memory of 2768	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	44
PID 824 wrote to memory of 2768	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	44
PID 824 wrote to memory of 2768	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	44
PID 824 wrote to memory of 2768	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	44
PID 824 wrote to memory of 1360	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	45
PID 824 wrote to memory of 1360	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	45
PID 824 wrote to memory of 1360	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	45
PID 824 wrote to memory of 1360	824	{683A148A-759F-4d2a-B065-31429D6E14B1}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_31554424de54fb03c822637050bcb42f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
  C:\Windows\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
    C:\Windows\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
      C:\Windows\{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Windows\{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
        
        C:\Windows\{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Windows\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
        
        C:\Windows\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
        
        C:\Windows\{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
        
        C:\Windows\{683A148A-759F-4d2a-B065-31429D6E14B1}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
        
        C:\Windows\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
        
        C:\Windows\{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
        
        C:\Windows\{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe
        
        C:\Windows\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe
        
        C:\Windows\{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Windows\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}.exe
        
        C:\Windows\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}.exe
        13⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AAE15~1.EXE > nul
        13⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C9F3~1.EXE > nul
        12⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98CE5~1.EXE > nul
        11⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D40DF~1.EXE > nul
        10⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{683A1~1.EXE > nul
        9⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EB4AE~1.EXE > nul
        8⤵
        
        PID:660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B018~1.EXE > nul
        7⤵
        
        PID:2752
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{35C28~1.EXE > nul
        6⤵
        
        PID:3064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{82636~1.EXE > nul
        5⤵
        
        PID:2836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1DCA3~1.EXE > nul
      4⤵
      PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B0D58~1.EXE > nul
    3⤵
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1DCA3895-BB76-44a2-857E-5AFA3DE9AD6B}.exe

Filesize
168KB

MD5
2d08eb4f86489468a046a0785094d9e7

SHA1
f2a4fa8e11658e108540f37443df359da762543e

SHA256
e29190699cadde3ae31481f0b036d4dee956fcfe573110eee237d2c48f5666c7

SHA512
c8e957933fa777c9db0250974e6d661897c91e04dd08533ad59225801c9e39fc52ae01cb7c8b26e501b625e94ff9d6b75986072c2a4e36859c3f92a07be9763b

Download Submit
C:\Windows\{35C28D3B-9D0D-4af3-815F-25C495ED3293}.exe

Filesize
168KB

MD5
f82f7f61352fd13753c05c3c0b0f67a6

SHA1
1884f9097aea6c42277fb92ebec04994b02764f1

SHA256
1022b4a4f260f4cf147f436cdad7971c1e36dfb1b78e8e6fb98be1dbdce26354

SHA512
a6e10f68e05e52dd9bddd219e490295aa6b27ae757e0427274b15990b52c6e5eea6b5c151b9e6011a5e99c04a03bd341aeb5328ca8ded6ec7d9969a6aa81825f

Download Submit
C:\Windows\{3C9F3FD2-10EA-4fae-8356-F992F3622B24}.exe

Filesize
168KB

MD5
192644308bc159b4a149488240ef2435

SHA1
36c9fcb27a3b0982ccd5011b2d392305f6bd2a09

SHA256
b5fc89264c9b1c2e95ec3d5e0558187de201e6ad912cfa634baceb36bd83f79e

SHA512
73ea6aefd1aa1f22f2214c2f4bab3b569cd2c66102b97f9c21148f44b069ee915c89c3f423f9e7e9d17b5520bdd7692dd6d82341e7a4e85e68a01a7f4be57e73

Download Submit
C:\Windows\{683A148A-759F-4d2a-B065-31429D6E14B1}.exe

Filesize
168KB

MD5
40e12b4c88596632c8fe566ba4b39071

SHA1
b4ef951a676e89462bec5fe3c56e4548799d6eba

SHA256
70e30b5b3680f41c0f28ef17be8a9cc48b89035b82c0385ddfc4766478d122ea

SHA512
650550d564a6da38c2b0e5fec7b757f29feca05c1e5125abe4a43596e9de0c6de93fa7de1de5a49dff4cc739428117d8c9a8c195d8fe00335d5eb315dbdbecd3

Download Submit
C:\Windows\{7B0181FC-0F50-4e90-B10E-7F82C97F1182}.exe

Filesize
168KB

MD5
df813b869ffb5702439563c0f88e637f

SHA1
0c161ef625474056cd6ba69f1d525f6c42f495cb

SHA256
128fa8d56c377c2426c144252e3733fd07d3016c560130722be3fbd4c797d6e0

SHA512
03356c0df09e82d02083f8a07d5132a599b832b963390b1e38aa5edfd462412e04cb17d2eb99eb8827004ee9735ac70b769072d7715814bd9e01daf2865da74c

Download Submit
C:\Windows\{826369BE-D034-47de-A7B9-7C4E6A67B34F}.exe

Filesize
168KB

MD5
c52ab96ee52a043c78f8c8b6eab7eec8

SHA1
7a6cbe874546213358548e136e705e8fa95cc7c9

SHA256
964bcca7ae1e9c251523d741d77fe326e333c91bbb402a6249dbe2ee1d2e5792

SHA512
731a9242ccd087b933a62fa5b7ad8280b44a6f643b0ec612aeec899a4f4824f6ac52d720a359018c4968adab54c6449d457c36a8bcd1b81f07078456a280cdfd

Download Submit
C:\Windows\{98CE5F4F-C7F5-4c87-88B0-27591016525E}.exe

Filesize
168KB

MD5
e77e0612cb3692cc127036f02b7407ea

SHA1
16bbce5e4a26f78f5d2a81a5a5ebf22324819466

SHA256
3751ca2823dfe937036d6efaad459e5d889722b3b76cfe893406313a3006f409

SHA512
9484bc90287d79700eb4e64c8ea7d290d49188f22667bae4ac6a9cdc66929750f54c1eb9845b43d30c3fde569122f3edec8bd6c21ca3c84e9aaa7b30f0c72080

Download Submit
C:\Windows\{AAE1511A-FA73-4128-945F-49A73E932FD7}.exe

Filesize
168KB

MD5
c059de38a2772e19fd8d98b3cd5f1dcc

SHA1
2158e0c2cca14e560afebd467e1d6cb89df32d4c

SHA256
f0ed1f29e1575cf2459b14a24d7fa419ce99590bb4cfcf6118cd90343617a890

SHA512
fba4a10d9bfcf5a98a25c99babad7b91d62a097c290e8942f261238d972a7d5e895489aa6d7f7473b1eaf7257e2acbf0907c018cd24c49a2d5d77470b5a72098

Download Submit
C:\Windows\{ADE8653B-32AA-4239-B11B-50D87A1FCE31}.exe

Filesize
168KB

MD5
ce1881d2b81a05da74519fd355f7d6e8

SHA1
039556f1cc420f206ce7e0d47124e54a648cd4e0

SHA256
48ad29eac577cfbd7acb2075f023ad856f521120f93e2fede88e187aebe8d810

SHA512
c5a81a3ea58c90f595be6f88fdc037d60a39248db74824ecaea921f82ceebc15b994c33de73a86ff133fa88a89851af0a79462462a8cbe84d2aee89b6245aa6a

Download Submit
C:\Windows\{B0D58533-931D-4c59-B8D5-DF61D67E68CC}.exe

Filesize
168KB

MD5
981c909fd9ad72e4a7f7a21693d56c5a

SHA1
6e3c5560422e1c586f4ce9a884cf7aeeff07a5fd

SHA256
3798e868927a32564c06270218e20d5fd8c3c4d8166ad7d955777ec998ed3b3b

SHA512
5e38c3baece4b6411d72a592820ee8c6d681b65f312795d2f91972bf0df960c96721af51737d68daf59e8d197ad5e77d3ab95fe36352be502fd1575d526c2c4a

Download Submit
C:\Windows\{D40DFFFB-05B6-40f8-99E8-50A3FC1B216A}.exe

Filesize
168KB

MD5
677e743b0a4b425e2fd2aa58444f62bf

SHA1
0394fa358f1429cf0b8ef00392f4ae4c5b173b27

SHA256
e546d1b676581a35629a2271dc80016f35788064bfef0b79180c7563e6d53d50

SHA512
05e30909d62d16414becd98ac5d2147f3ce1aa21f6ca3ac1fc5faab275d155b20a271e64f67b192ef0897cedd7f6f0855e5f1cb2d69c29ed26be06e0f75d2261

Download Submit
C:\Windows\{EB4AEBF0-8B9D-464b-A008-6663365E3110}.exe

Filesize
168KB

MD5
c757f0b0113d37e904772ce98715865f

SHA1
8d2e4feeccf9f89c0178ef46c149ba51013fc7d8

SHA256
cfc75dbdc881149c75b079fa3dc8fe7022f3b94454dd9d1ebdd81073a044fc65

SHA512
681202d390c7b20f9a81b77880c13e25909347493391a39b80d9026eaa4df5de6c8920850dc9e3a6b9e1838664d64f50760aea059911057e0df584e8813900b2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads