1aaba6f1798acbb1cfbc4c1039686f59d2514d81c4e7901bcf48b48cc85fa506

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe
Size

216KB
MD5

54fdccf6c125d0cadfec4a6cde1307b5
SHA1

793e34f2199f03d011711ce03dce78700a126787
SHA256

1aaba6f1798acbb1cfbc4c1039686f59d2514d81c4e7901bcf48b48cc85fa506
SHA512

eb7f5cbe96bc26ac045c96bb6af16d67f1e5577e185c2741577b4d61783100546bf753e855182656ac1d0b68e62abf75d3a0e973a4ed694d3a3adacee9b824ca
SSDEEP

3072:jEGh0ozl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG5lEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224c-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000132c6-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0013000000013721-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-25.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000132c6-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000132c6-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0014000000013721-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000132c6-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a0000000139c6-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00100000000132c6-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000139c6-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}\stubpath = "C:\\Windows\\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe"	{D7C21380-8689-4d57-98EE-453E0628A73D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}\stubpath = "C:\\Windows\\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe"	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5BF34E5-E86D-4e36-8926-B6F319404927}	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}\stubpath = "C:\\Windows\\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe"	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7C21380-8689-4d57-98EE-453E0628A73D}\stubpath = "C:\\Windows\\{D7C21380-8689-4d57-98EE-453E0628A73D}.exe"	{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9B6D6654-CEB0-4601-B981-C6494C653986}\stubpath = "C:\\Windows\\{9B6D6654-CEB0-4601-B981-C6494C653986}.exe"	{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}	{9B6D6654-CEB0-4601-B981-C6494C653986}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{430BA673-F44C-42ca-BA9F-90DEBD437658}	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{430BA673-F44C-42ca-BA9F-90DEBD437658}\stubpath = "C:\\Windows\\{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe"	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}\stubpath = "C:\\Windows\\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe"	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9B6D6654-CEB0-4601-B981-C6494C653986}	{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}\stubpath = "C:\\Windows\\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe"	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5BF34E5-E86D-4e36-8926-B6F319404927}\stubpath = "C:\\Windows\\{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe"	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7C21380-8689-4d57-98EE-453E0628A73D}	{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}	{D7C21380-8689-4d57-98EE-453E0628A73D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A075BDAB-0E92-4a4d-8671-221240CB4819}	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A075BDAB-0E92-4a4d-8671-221240CB4819}\stubpath = "C:\\Windows\\{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe"	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}\stubpath = "C:\\Windows\\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe"	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}\stubpath = "C:\\Windows\\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}.exe"	{9B6D6654-CEB0-4601-B981-C6494C653986}.exe

Deletes itself 1 IoCs

pid	Process
2564	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
1980	{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
1776	{D7C21380-8689-4d57-98EE-453E0628A73D}.exe
932	{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
2052	{9B6D6654-CEB0-4601-B981-C6494C653986}.exe
1560	{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe
File created	C:\Windows\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
File created	C:\Windows\{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
File created	C:\Windows\{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
File created	C:\Windows\{D7C21380-8689-4d57-98EE-453E0628A73D}.exe	{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
File created	C:\Windows\{9B6D6654-CEB0-4601-B981-C6494C653986}.exe	{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
File created	C:\Windows\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}.exe	{9B6D6654-CEB0-4601-B981-C6494C653986}.exe
File created	C:\Windows\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
File created	C:\Windows\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
File created	C:\Windows\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
File created	C:\Windows\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
File created	C:\Windows\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe	{D7C21380-8689-4d57-98EE-453E0628A73D}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
Token: SeIncBasePriorityPrivilege	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
Token: SeIncBasePriorityPrivilege	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
Token: SeIncBasePriorityPrivilege	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
Token: SeIncBasePriorityPrivilege	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
Token: SeIncBasePriorityPrivilege	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
Token: SeIncBasePriorityPrivilege	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
Token: SeIncBasePriorityPrivilege	1980	{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
Token: SeIncBasePriorityPrivilege	1776	{D7C21380-8689-4d57-98EE-453E0628A73D}.exe
Token: SeIncBasePriorityPrivilege	932	{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
Token: SeIncBasePriorityPrivilege	2052	{9B6D6654-CEB0-4601-B981-C6494C653986}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2940	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	28
PID 3012 wrote to memory of 2940	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	28
PID 3012 wrote to memory of 2940	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	28
PID 3012 wrote to memory of 2940	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	28
PID 3012 wrote to memory of 2564	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	29
PID 3012 wrote to memory of 2564	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	29
PID 3012 wrote to memory of 2564	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	29
PID 3012 wrote to memory of 2564	3012	2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe	29
PID 2940 wrote to memory of 2412	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	30
PID 2940 wrote to memory of 2412	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	30
PID 2940 wrote to memory of 2412	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	30
PID 2940 wrote to memory of 2412	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	30
PID 2940 wrote to memory of 2752	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	31
PID 2940 wrote to memory of 2752	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	31
PID 2940 wrote to memory of 2752	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	31
PID 2940 wrote to memory of 2752	2940	{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe	31
PID 2412 wrote to memory of 2480	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	34
PID 2412 wrote to memory of 2480	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	34
PID 2412 wrote to memory of 2480	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	34
PID 2412 wrote to memory of 2480	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	34
PID 2412 wrote to memory of 2832	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	35
PID 2412 wrote to memory of 2832	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	35
PID 2412 wrote to memory of 2832	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	35
PID 2412 wrote to memory of 2832	2412	{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe	35
PID 2480 wrote to memory of 2164	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	36
PID 2480 wrote to memory of 2164	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	36
PID 2480 wrote to memory of 2164	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	36
PID 2480 wrote to memory of 2164	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	36
PID 2480 wrote to memory of 584	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	37
PID 2480 wrote to memory of 584	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	37
PID 2480 wrote to memory of 584	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	37
PID 2480 wrote to memory of 584	2480	{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe	37
PID 2164 wrote to memory of 564	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	38
PID 2164 wrote to memory of 564	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	38
PID 2164 wrote to memory of 564	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	38
PID 2164 wrote to memory of 564	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	38
PID 2164 wrote to memory of 1360	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	39
PID 2164 wrote to memory of 1360	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	39
PID 2164 wrote to memory of 1360	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	39
PID 2164 wrote to memory of 1360	2164	{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe	39
PID 564 wrote to memory of 3060	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	40
PID 564 wrote to memory of 3060	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	40
PID 564 wrote to memory of 3060	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	40
PID 564 wrote to memory of 3060	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	40
PID 564 wrote to memory of 1412	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	41
PID 564 wrote to memory of 1412	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	41
PID 564 wrote to memory of 1412	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	41
PID 564 wrote to memory of 1412	564	{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe	41
PID 3060 wrote to memory of 1504	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	42
PID 3060 wrote to memory of 1504	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	42
PID 3060 wrote to memory of 1504	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	42
PID 3060 wrote to memory of 1504	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	42
PID 3060 wrote to memory of 2320	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	43
PID 3060 wrote to memory of 2320	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	43
PID 3060 wrote to memory of 2320	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	43
PID 3060 wrote to memory of 2320	3060	{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe	43
PID 1504 wrote to memory of 1980	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	44
PID 1504 wrote to memory of 1980	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	44
PID 1504 wrote to memory of 1980	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	44
PID 1504 wrote to memory of 1980	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	44
PID 1504 wrote to memory of 2676	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	45
PID 1504 wrote to memory of 2676	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	45
PID 1504 wrote to memory of 2676	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	45
PID 1504 wrote to memory of 2676	1504	{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_54fdccf6c125d0cadfec4a6cde1307b5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
  C:\Windows\{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
    C:\Windows\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
      C:\Windows\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
        
        C:\Windows\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2164
      - C:\Windows\{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
        
        C:\Windows\{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
        
        C:\Windows\{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
        
        C:\Windows\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
        
        C:\Windows\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
        
        C:\Windows\{D7C21380-8689-4d57-98EE-453E0628A73D}.exe
        
        C:\Windows\{D7C21380-8689-4d57-98EE-453E0628A73D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
        
        C:\Windows\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
        
        C:\Windows\{9B6D6654-CEB0-4601-B981-C6494C653986}.exe
        
        C:\Windows\{9B6D6654-CEB0-4601-B981-C6494C653986}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Windows\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}.exe
        
        C:\Windows\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}.exe
        13⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B6D6~1.EXE > nul
        13⤵
        
        PID:828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8C2FD~1.EXE > nul
        12⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7C21~1.EXE > nul
        11⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1C3FA~1.EXE > nul
        10⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D48C7~1.EXE > nul
        9⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5BF3~1.EXE > nul
        8⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{430BA~1.EXE > nul
        7⤵
        
        PID:1412
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA8CF~1.EXE > nul
        6⤵
        
        PID:1360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{40286~1.EXE > nul
        5⤵
        
        PID:584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DA8E2~1.EXE > nul
      4⤵
      PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A075B~1.EXE > nul
    3⤵
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1C3FAA91-544C-4433-9CFF-A3FF07DA23EA}.exe

Filesize
216KB

MD5
2b078b6685545a8e1bb890c39245e63e

SHA1
770ace34df86772fdca53d83c515348421840809

SHA256
d26ae5c4d2b5634e433ec20d2355953149155e266961ac7403dca7956f240f43

SHA512
c59a445aa8c87b14fd2b705dfccddca4e3d3f9a4215e03555bd79fa639f8f9c17e3c802a47290a6a73306e90014926f8c180fff2f44fa275a011d8f768a32ff4

Download Submit
C:\Windows\{40286CAF-DBDC-4240-A816-B5833B8A8C8F}.exe

Filesize
216KB

MD5
406f3767700f4fa35f0dd9faddc3d2e0

SHA1
14e2f50368cd409ee9642ca7bd31c2410a8dd190

SHA256
b022bf30816c7b162f34190b61ee424221a1288ca13032b3f8df51933b1e331c

SHA512
8e15423eb902c255d74aa3bd2a4294b9a974e3c83170422a1efcd96f515fd4d40104978e53a21af6becd93cba1732803712a961664fdb175fd981dcef016d03b

Download Submit
C:\Windows\{430BA673-F44C-42ca-BA9F-90DEBD437658}.exe

Filesize
216KB

MD5
2eace806dade9e9b10a431b14d4b670f

SHA1
fa06b132d866407b4e40c82cf29db5e2b592e353

SHA256
f22d89a7519b5c4287ee7b6c740b6a581bd4c9b1eb7f08f4968132bd044e716a

SHA512
fc325a65953fd9eece79858258a75bc44696c9b5b285febde981dd398a10aab7cd73702341e28f934ac31fbaa5b0501a52c733e97b8672c8332325c8f7b6be67

Download Submit
C:\Windows\{8C2FD754-D183-4cdd-A6C7-CCEF27554939}.exe

Filesize
216KB

MD5
15d6b56841fbaa17f4868d1a694faeef

SHA1
e1e252db8c298f233c79850dd0f7fa4840413ea9

SHA256
4915b441767a2111872b0c26d116ab529c51ad21da630ecd6bfedf0a01b949ab

SHA512
d71732b6fd1da4f7e7de8f304c52760665cbf0d1a61609653faaab6ec16abb6ec6a504a8bf599a0fba09fad82ac2309adec93d27eb930ff420e8cc559b2abd3e

Download Submit
C:\Windows\{9B6D6654-CEB0-4601-B981-C6494C653986}.exe

Filesize
216KB

MD5
3d8f56f857b656f3a84b5c2e8b94b34f

SHA1
cd2218c8d7e579aeb9080137c4d1330ac371f5ee

SHA256
8dbc9cd4ee9938b9a8c30150edf9b9fc3032de53eec6ff9331cd68e06466d929

SHA512
a90c1e67d2de81a2ced6bac36db41fce6b96fd94fc56f4919a99d969982dec63a3d2f8879a216eded03e7896fe80c1b1fc7145a0f899e0711e008120482021f6

Download Submit
C:\Windows\{9DEE2FE2-3C73-48de-8601-A9C00FC56A5D}.exe

Filesize
216KB

MD5
aeb4e0ff669858f3b033b2931f3b75bb

SHA1
f2598795af7db62a8e789d15b7cdd3b7bd505947

SHA256
5cd360f43b4bcb887cea65220d3cc3faa713b22ad32d62f6203dfd9ebd51d1a9

SHA512
aad0b209e3954d7b5f6f2e16a15db69a6539010ecd04e6ccc754b1b4f4d8c69307300ea2fe1d86e4d3b4a22322311741928805676eb297f9b9d5497762026b94

Download Submit
C:\Windows\{A075BDAB-0E92-4a4d-8671-221240CB4819}.exe

Filesize
216KB

MD5
b9b9665d1cdf31bdb2c0b01959362f65

SHA1
a5dfc0fc53ef9237ecb3d97defa9f06f648302a4

SHA256
86f664d19be6ab9e59797014bb6d8778263a9080529f585098a1599619966fb1

SHA512
4cd6457ff5810b7b55e3858775dc7ec1e89aa9311f3c3ee937b21f5017c6eb5ad138d4e065589207a7bd581e395f679a0d955fb89d8e1cc15980c23acc1aefc1

Download Submit
C:\Windows\{A5BF34E5-E86D-4e36-8926-B6F319404927}.exe

Filesize
216KB

MD5
ab1e8869b79271106e960a549f3e35ac

SHA1
8821217807f8fa86dd24b02511b79bd929443512

SHA256
c85e341f5a0b23f97aebaa1b539073d832f5f0137fe4ecec1cd8e777c20d725a

SHA512
00392c86e961258ea24fa571a9f8c1c1c5cba9389ab1a23bd5967f050f24436303ecd3b85f14ed8536f3a43e623c0ad83a4028d5c500b1feb228f28303fff4e3

Download Submit
C:\Windows\{D48C75CF-F699-4cf6-AF8B-52FBE1F8E0E7}.exe

Filesize
216KB

MD5
2462c755625ec3655f771cb2cbec1ad8

SHA1
2bb50efaabb44eb33f691dfbd41db3a209fb62fb

SHA256
275463089af4bd1a0de9c1c57a72cac76bcc648e053da55cc4b93ca39a56680c

SHA512
96c383fcda87decc9710512dd5a29a4de0a5210b5879d82dd393f3a19c2c0691b1cdd2c42b5294c9cfb3567bc38ee29db2ff9bcb86c10c2d0f06a227da562ff1

Download Submit
C:\Windows\{D7C21380-8689-4d57-98EE-453E0628A73D}.exe

Filesize
216KB

MD5
e0b33979f47796849a1d96c42d9ece36

SHA1
e3031e35ac6a8c6efd242fbd49e7faa831303907

SHA256
3d360bf2a65c366ca3cd4a8245cd594a5d8c365e834e7aea1ba267d869baf1b7

SHA512
18ae332706e73d9eb95846d473cf7ee5b90c099a03a1c36d466dbfb131467ec0db294d3e1aee355353878d08068922e2a110819ff1aa21be709ae6b498e07e06

Download Submit
C:\Windows\{DA8E2881-FA57-46d9-BF4A-C99BB533818C}.exe

Filesize
216KB

MD5
08d765a90f0af4a0ed786f273fc252f5

SHA1
48b00a1be125f6ff3efdc21eb6d9c062e1967524

SHA256
39953cd4fdd63b2363720d592b0dff6874f7c6923d3715a9ce0e05a72f15dfeb

SHA512
17de117c774458fc7e476825c28003d5a81602f0b315a930f4c3964664e590850d5d2b03b5c8fc8c8f6072a20659013c90bce17e1943067112b456b59411fc9c

Download Submit
C:\Windows\{FA8CF276-640E-4a4a-BB76-724A729D6D3B}.exe

Filesize
216KB

MD5
7f9db7da03b5f520a76e5325d5834609

SHA1
69fe549c9e8989684d1ca359f9f27a1abfd2b443

SHA256
df59a8fdaedffc880b4998c0a7d4126cea73920bacd44afb3777c9438e66d935

SHA512
b84f4421f0550b431f2983c2d38e9ea6e5fb17f6c20a14da4318e20ace8fe20c03fc93b0635ccfd328827cf3452f0ac22686d5d9cd3714a5be8e2cabc2c07493

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads