eebdd1d4b422a9a6b7549d5dd2ae15f3f746420f6b9f964aa861f8d60c634cbd

Analysis

max time kernel
151s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe
Size

380KB
MD5

99137d5a5a4f7164d19fc43992909ab3
SHA1

8af1ed97175debe661e338af8943d3edb663cf9e
SHA256

eebdd1d4b422a9a6b7549d5dd2ae15f3f746420f6b9f964aa861f8d60c634cbd
SHA512

6369a22bdcb9379a88a09b8f720cbb3ed46bc33e0a2c6797901d2f04708f6f730439b8dfce16b14a54c1ae64949a03795c8c7f3a61d376c36f32a4f562edf631
SSDEEP

3072:mEGh0oKlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015c23-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015d88-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015c23-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015c23-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000f680-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015c23-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015d88-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015c23-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015d88-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015c23-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7EF80216-01B4-4c22-B288-A138037BA352}	{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}\stubpath = "C:\\Windows\\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe"	{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}\stubpath = "C:\\Windows\\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}.exe"	{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60B07880-78C4-4dd6-AF19-6722F65376C8}\stubpath = "C:\\Windows\\{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe"	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70190C30-6449-462d-AEEF-67287D5D450B}\stubpath = "C:\\Windows\\{70190C30-6449-462d-AEEF-67287D5D450B}.exe"	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}\stubpath = "C:\\Windows\\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe"	{70190C30-6449-462d-AEEF-67287D5D450B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7EF80216-01B4-4c22-B288-A138037BA352}\stubpath = "C:\\Windows\\{7EF80216-01B4-4c22-B288-A138037BA352}.exe"	{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4029F95B-6949-4181-8D84-18BB2D92C082}	{7EF80216-01B4-4c22-B288-A138037BA352}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8F208A27-BC4F-4909-89B7-01586919508D}	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60B07880-78C4-4dd6-AF19-6722F65376C8}	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}\stubpath = "C:\\Windows\\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe"	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6101732E-31C3-4ffa-A846-CAC553E2317B}	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4029F95B-6949-4181-8D84-18BB2D92C082}\stubpath = "C:\\Windows\\{4029F95B-6949-4181-8D84-18BB2D92C082}.exe"	{7EF80216-01B4-4c22-B288-A138037BA352}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8F208A27-BC4F-4909-89B7-01586919508D}\stubpath = "C:\\Windows\\{8F208A27-BC4F-4909-89B7-01586919508D}.exe"	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}	{8F208A27-BC4F-4909-89B7-01586919508D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6101732E-31C3-4ffa-A846-CAC553E2317B}\stubpath = "C:\\Windows\\{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe"	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70190C30-6449-462d-AEEF-67287D5D450B}	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}	{70190C30-6449-462d-AEEF-67287D5D450B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}	{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}	{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}\stubpath = "C:\\Windows\\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe"	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}\stubpath = "C:\\Windows\\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe"	{8F208A27-BC4F-4909-89B7-01586919508D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe

Deletes itself 1 IoCs

pid	Process
2876	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe
2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe
1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe
2368	{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
1276	{7EF80216-01B4-4c22-B288-A138037BA352}.exe
3048	{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
2992	{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe
3064	{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{7EF80216-01B4-4c22-B288-A138037BA352}.exe	{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
File created	C:\Windows\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe	{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
File created	C:\Windows\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	{8F208A27-BC4F-4909-89B7-01586919508D}.exe
File created	C:\Windows\{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
File created	C:\Windows\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe
File created	C:\Windows\{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
File created	C:\Windows\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe	{70190C30-6449-462d-AEEF-67287D5D450B}.exe
File created	C:\Windows\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe
File created	C:\Windows\{8F208A27-BC4F-4909-89B7-01586919508D}.exe	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
File created	C:\Windows\{70190C30-6449-462d-AEEF-67287D5D450B}.exe	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
File created	C:\Windows\{4029F95B-6949-4181-8D84-18BB2D92C082}.exe	{7EF80216-01B4-4c22-B288-A138037BA352}.exe
File created	C:\Windows\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}.exe	{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
Token: SeIncBasePriorityPrivilege	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe
Token: SeIncBasePriorityPrivilege	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
Token: SeIncBasePriorityPrivilege	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe
Token: SeIncBasePriorityPrivilege	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
Token: SeIncBasePriorityPrivilege	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
Token: SeIncBasePriorityPrivilege	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe
Token: SeIncBasePriorityPrivilege	2368	{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
Token: SeIncBasePriorityPrivilege	1276	{7EF80216-01B4-4c22-B288-A138037BA352}.exe
Token: SeIncBasePriorityPrivilege	3048	{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
Token: SeIncBasePriorityPrivilege	2992	{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 940	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	28
PID 2772 wrote to memory of 940	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	28
PID 2772 wrote to memory of 940	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	28
PID 2772 wrote to memory of 940	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	28
PID 2772 wrote to memory of 2876	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	29
PID 2772 wrote to memory of 2876	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	29
PID 2772 wrote to memory of 2876	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	29
PID 2772 wrote to memory of 2876	2772	2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe	29
PID 940 wrote to memory of 2568	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	32
PID 940 wrote to memory of 2568	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	32
PID 940 wrote to memory of 2568	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	32
PID 940 wrote to memory of 2568	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	32
PID 940 wrote to memory of 2764	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	33
PID 940 wrote to memory of 2764	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	33
PID 940 wrote to memory of 2764	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	33
PID 940 wrote to memory of 2764	940	{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe	33
PID 2568 wrote to memory of 2520	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	34
PID 2568 wrote to memory of 2520	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	34
PID 2568 wrote to memory of 2520	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	34
PID 2568 wrote to memory of 2520	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	34
PID 2568 wrote to memory of 2424	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	35
PID 2568 wrote to memory of 2424	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	35
PID 2568 wrote to memory of 2424	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	35
PID 2568 wrote to memory of 2424	2568	{8F208A27-BC4F-4909-89B7-01586919508D}.exe	35
PID 2520 wrote to memory of 2452	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	36
PID 2520 wrote to memory of 2452	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	36
PID 2520 wrote to memory of 2452	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	36
PID 2520 wrote to memory of 2452	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	36
PID 2520 wrote to memory of 704	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	37
PID 2520 wrote to memory of 704	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	37
PID 2520 wrote to memory of 704	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	37
PID 2520 wrote to memory of 704	2520	{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe	37
PID 2452 wrote to memory of 1984	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	38
PID 2452 wrote to memory of 1984	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	38
PID 2452 wrote to memory of 1984	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	38
PID 2452 wrote to memory of 1984	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	38
PID 2452 wrote to memory of 1848	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	39
PID 2452 wrote to memory of 1848	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	39
PID 2452 wrote to memory of 1848	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	39
PID 2452 wrote to memory of 1848	2452	{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe	39
PID 1984 wrote to memory of 2636	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	40
PID 1984 wrote to memory of 2636	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	40
PID 1984 wrote to memory of 2636	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	40
PID 1984 wrote to memory of 2636	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	40
PID 1984 wrote to memory of 2632	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	41
PID 1984 wrote to memory of 2632	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	41
PID 1984 wrote to memory of 2632	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	41
PID 1984 wrote to memory of 2632	1984	{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe	41
PID 2636 wrote to memory of 1332	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	42
PID 2636 wrote to memory of 1332	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	42
PID 2636 wrote to memory of 1332	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	42
PID 2636 wrote to memory of 1332	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	42
PID 2636 wrote to memory of 1948	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	43
PID 2636 wrote to memory of 1948	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	43
PID 2636 wrote to memory of 1948	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	43
PID 2636 wrote to memory of 1948	2636	{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe	43
PID 1332 wrote to memory of 2368	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	44
PID 1332 wrote to memory of 2368	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	44
PID 1332 wrote to memory of 2368	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	44
PID 1332 wrote to memory of 2368	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	44
PID 1332 wrote to memory of 1852	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	45
PID 1332 wrote to memory of 1852	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	45
PID 1332 wrote to memory of 1852	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	45
PID 1332 wrote to memory of 1852	1332	{70190C30-6449-462d-AEEF-67287D5D450B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_99137d5a5a4f7164d19fc43992909ab3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
  C:\Windows\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\{8F208A27-BC4F-4909-89B7-01586919508D}.exe
    C:\Windows\{8F208A27-BC4F-4909-89B7-01586919508D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
      C:\Windows\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe
        
        C:\Windows\{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Windows\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
        
        C:\Windows\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
        
        C:\Windows\{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\{70190C30-6449-462d-AEEF-67287D5D450B}.exe
        
        C:\Windows\{70190C30-6449-462d-AEEF-67287D5D450B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
        
        C:\Windows\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\{7EF80216-01B4-4c22-B288-A138037BA352}.exe
        
        C:\Windows\{7EF80216-01B4-4c22-B288-A138037BA352}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
        
        C:\Windows\{4029F95B-6949-4181-8D84-18BB2D92C082}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
        
        C:\Windows\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe
        
        C:\Windows\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
        
        C:\Windows\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}.exe
        
        C:\Windows\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}.exe
        13⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9683~1.EXE > nul
        13⤵
        
        PID:600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4029F~1.EXE > nul
        12⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7EF80~1.EXE > nul
        11⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8C2DD~1.EXE > nul
        10⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70190~1.EXE > nul
        9⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{61017~1.EXE > nul
        8⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F6DF~1.EXE > nul
        7⤵
        
        PID:2632
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{60B07~1.EXE > nul
        6⤵
        
        PID:1848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ACCD8~1.EXE > nul
        5⤵
        
        PID:704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8F208~1.EXE > nul
      4⤵
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E9210~1.EXE > nul
    3⤵
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{4029F95B-6949-4181-8D84-18BB2D92C082}.exe

Filesize
380KB

MD5
3842eb10189803b1823ef8542fb2e20e

SHA1
d45898c484b3c187afd365198b6cdc621789170c

SHA256
f4e20837b7ebeb61a530bab62f4c95306580b38c36e468f806e4cc9be66af2fe

SHA512
566ff631c6bf471bb77510eb330feec5d2dfe47fad3d9e6380f20fdcae175ee2cd62be8d351b799746efa9f8ca26541b218dd9c5317af091e8b9ebf314d2e769

Download Submit
C:\Windows\{60B07880-78C4-4dd6-AF19-6722F65376C8}.exe

Filesize
380KB

MD5
7625c2b88bce43d38188401c699239f1

SHA1
b32c11b3d99dd39554f25a4745a920467a9f5b8e

SHA256
feb1a2f80f323a1849a26a049f8b2801b1c2e965b342e725d321f7661f9183b5

SHA512
ec909ff5de6d0c051fa009deeacb7f0ab385d171bd2e961479d1d77a7f7847648f9a102adc8c3145efd14aabbf443dbcac2f00a1a75327c32f0c41629c2d86d6

Download Submit
C:\Windows\{6101732E-31C3-4ffa-A846-CAC553E2317B}.exe

Filesize
380KB

MD5
577523b2c272f0dd61f187cd76db3b29

SHA1
649daa38ccdacb91f3453151c95f7a5049aa55c9

SHA256
678487e328d86115f556d6f634e9a9630265a95c31b3628bba193127400bbcfc

SHA512
03d8bbbb02d4e3891d595e0038c0943ba2b79ec81ec97d086d7ff02a3c96160b65e3455911aaa8cd01e7e3cab16f334a73961269240bcc14e8ddead2d973750b

Download Submit
C:\Windows\{70190C30-6449-462d-AEEF-67287D5D450B}.exe

Filesize
380KB

MD5
efe8d97dc1b165298f89c1cc955b1711

SHA1
b7c6e2075c2f3b50eba84dc4b9757cb237ebf8db

SHA256
f0fb75d94396adca8678099af03ecf488a0dd41da94ac38f588a281f2c56706d

SHA512
30aa2fe79d0b6273410268a45d67b7e51d65f8ea7dbc879581530239b429c074f2a6c293a7ab6a0f05cff3acea131d1fd18f3bcd9ddf6ce555c17b51cb33cdde

Download Submit
C:\Windows\{7EF80216-01B4-4c22-B288-A138037BA352}.exe

Filesize
380KB

MD5
adbb6a2b80a007ccc75d4dd039d1f50b

SHA1
df6f33521621a007882f109c071a868fd7f1d628

SHA256
2af24c21812b967276ad2a2a0e9cd4e2336fe2ad2d5c8e4d182d4b67cfaa6b43

SHA512
3b126d9f9ffc727d0806c8d2c482f3bdaa4b3d9e75edc9811272d02b99ee253ff9e507c43f3cbaa1f775858754e2f8adb653cef24cbf4dc062d717d623437151

Download Submit
C:\Windows\{8A0A3A6A-5D3D-4d84-A49E-BCCF3AEBC283}.exe

Filesize
380KB

MD5
e9acad43307a34f13f02c621e2a239ae

SHA1
e50e01ed1e0af181a3dbac9757a1b316dff5a857

SHA256
295450581febb6b04ecd497c53dd74463d452cf69d1dd3a2765a50547a813654

SHA512
ec07c8e61890071c90ec2dc9ae6ddd79d68cac47c36340257141cbab5f7d25c9407ad4a14c15919f0131ad19d044ce591fa8d7ba95d4811a788d2e45be724392

Download Submit
C:\Windows\{8C2DDFE8-7815-47e7-840B-5E8CD9A75F3F}.exe

Filesize
380KB

MD5
40458287f2d9b1ca24d122a12d4ebaa4

SHA1
031003e451dc6e74ee4413636ae734268b8de5f7

SHA256
9b827cac5a15a86bae97b85fc760bfe6e156292603f1e57f1c7cf99f53452ff4

SHA512
e4b38df8ee9017c7795525d079ba49f19c32276c49e057558248a952a8e9f75915afd4a33ce49ce85bd446ba2aaa3481dd742672df422f46e83a48bd1f6f8c84

Download Submit
C:\Windows\{8F208A27-BC4F-4909-89B7-01586919508D}.exe

Filesize
380KB

MD5
49f74cbb0dbf75e1b1ed1ecd6942c648

SHA1
dff66ec39e745e937fc4b884ba3fafc61f6fb9b9

SHA256
3a810001aa95d8de09a9cfe50082f4b0e8db701bba978dfce2000ae35a7f492e

SHA512
161ba2e10f1b7b3e5e49c995d1baa72ef59608382e7b52a3ac1f81248c118d8c30c00ee19faed04ac33f8466249f2ff68249717ee6dd2bd96deccc76c464778d

Download Submit
C:\Windows\{9F6DFA59-D4DC-4847-A1D1-FA04715A32F0}.exe

Filesize
380KB

MD5
03cf5915da708adbc972ab223a17ee1f

SHA1
116006c80e7bc2fe762d0388156231cd119a2a87

SHA256
7e503399e25a9c6554973cb5e7827987611c8d6a35226b292899e0abe2b4d719

SHA512
10d77873bae93201bdc97e09284609587f4a23182b8f4cb31bcfd775a438f11fe47a6605639144a80714b52a9a8c8de7bc849a723599dfb60ebc374d0b4420ee

Download Submit
C:\Windows\{ACCD887E-B915-4691-A2B0-821AFF0F7C04}.exe

Filesize
380KB

MD5
776c917d580aa0dba26e7ef9920bf53b

SHA1
e440ed1eda62d735a1a023ebabd5492841cbd1ec

SHA256
14e12828abe58771f2fc9416a7178a21304a3a125c825fddf0194dbda703819c

SHA512
7910ca3086e652cf8847662d5f1b95fc1400289607f8c36e088d225a10430d8841968b9972b4e191f4933fc934018ba806df17e04240acd600c75985f3942422

Download Submit
C:\Windows\{E92101E3-9237-4b73-AB7F-EFCBE48FD3C9}.exe

Filesize
380KB

MD5
64187a3e930cc2f303425b7957799370

SHA1
22bc00b3138ff0ef149f2d9d5aa6356e8e283e4a

SHA256
59a54348f431e4cb2e52051b43b6313afbe09e415fa3d660515cd4883eb6824c

SHA512
e360e87beb7c2b03a9bbfa69d99e93dbe96e4d2fbce18d1feed203772a0ce14d3cc47c3fd8b766b448e8b3a5cb9a7ac89fe6b3defca487c46ebfb5650c096065

Download Submit
C:\Windows\{F9683DFA-7F38-4e1f-B485-47DD1B0AABB7}.exe

Filesize
380KB

MD5
a46d06b8d1c28ea5029fc072f6e93656

SHA1
a3807ae164ef8d7a4788ab602787cdb3963fbc3a

SHA256
ab5e5c657ed40626fef5b00e95e834120f13819d02dc08a9ed392f2632dd8f6f

SHA512
dfb640af4fa94ab6d8586c68b7ede242854ccfb69f60d1f6d34411d5eda595100853ba4355a318a112f6cc7eb9aaa396a090c80fc8f870b57eab2d12f33b6500

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads