000f03aac5a2cc884610d2b63248375cf6bb109fcc80e2a26ad1748248aefa39

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe
Size

372KB
MD5

c84dfd0d50a2556361eec842fcde25f0
SHA1

3a641302abee20fe1c02447c6fe454f6ef791744
SHA256

000f03aac5a2cc884610d2b63248375cf6bb109fcc80e2a26ad1748248aefa39
SHA512

f1fbe0692c034f4f239f304121ea120f6ddd0e83c9ccbf8d1f6cbe4e12341818e7a6c20e4543c6fe8624aa797f3860c7002fd553d70432dbac1d100bb5aa51bd
SSDEEP

3072:CEGh0o0lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGulkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000700000002342d-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023426-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023434-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023426-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002335d-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023437-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002335d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001400000002335a-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002335d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001500000002335a-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002335b-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001600000002335a-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2279D85A-9740-4638-B680-E2B049432124}	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBD52074-C82F-4775-973C-F8198BAE5E91}	{2279D85A-9740-4638-B680-E2B049432124}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBD52074-C82F-4775-973C-F8198BAE5E91}\stubpath = "C:\\Windows\\{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe"	{2279D85A-9740-4638-B680-E2B049432124}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5951BD7E-C437-4858-97DA-3A4E175275E3}	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4611D7D5-D7CA-495d-BC97-35DA562CC516}	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}	{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5847E2DD-08E2-45be-9DEF-5EF61F332297}\stubpath = "C:\\Windows\\{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe"	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4611D7D5-D7CA-495d-BC97-35DA562CC516}\stubpath = "C:\\Windows\\{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe"	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9715177-3B23-4f93-B296-A52D8BC857A0}\stubpath = "C:\\Windows\\{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe"	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}\stubpath = "C:\\Windows\\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe"	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2279D85A-9740-4638-B680-E2B049432124}\stubpath = "C:\\Windows\\{2279D85A-9740-4638-B680-E2B049432124}.exe"	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}\stubpath = "C:\\Windows\\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe"	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}\stubpath = "C:\\Windows\\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe"	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}\stubpath = "C:\\Windows\\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}.exe"	{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}\stubpath = "C:\\Windows\\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe"	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5847E2DD-08E2-45be-9DEF-5EF61F332297}	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5951BD7E-C437-4858-97DA-3A4E175275E3}\stubpath = "C:\\Windows\\{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe"	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}\stubpath = "C:\\Windows\\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe"	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9715177-3B23-4f93-B296-A52D8BC857A0}	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe

Executes dropped EXE 12 IoCs

pid	Process
540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
4976	{2279D85A-9740-4638-B680-E2B049432124}.exe
3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe
2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
1200	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe
4528	{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe
4788	{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{2279D85A-9740-4638-B680-E2B049432124}.exe	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
File created	C:\Windows\{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	{2279D85A-9740-4638-B680-E2B049432124}.exe
File created	C:\Windows\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
File created	C:\Windows\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
File created	C:\Windows\{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
File created	C:\Windows\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}.exe	{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe
File created	C:\Windows\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
File created	C:\Windows\{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
File created	C:\Windows\{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
File created	C:\Windows\{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe
File created	C:\Windows\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe
File created	C:\Windows\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe
Token: SeIncBasePriorityPrivilege	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
Token: SeIncBasePriorityPrivilege	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
Token: SeIncBasePriorityPrivilege	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
Token: SeIncBasePriorityPrivilege	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe
Token: SeIncBasePriorityPrivilege	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe
Token: SeIncBasePriorityPrivilege	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
Token: SeIncBasePriorityPrivilege	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
Token: SeIncBasePriorityPrivilege	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
Token: SeIncBasePriorityPrivilege	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
Token: SeIncBasePriorityPrivilege	1200	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe
Token: SeIncBasePriorityPrivilege	4528	{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 540	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe	100
PID 1200 wrote to memory of 540	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe	100
PID 1200 wrote to memory of 540	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe	100
PID 1200 wrote to memory of 2284	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe	101
PID 1200 wrote to memory of 2284	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe	101
PID 1200 wrote to memory of 2284	1200	2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe	101
PID 540 wrote to memory of 612	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	102
PID 540 wrote to memory of 612	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	102
PID 540 wrote to memory of 612	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	102
PID 540 wrote to memory of 1888	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	103
PID 540 wrote to memory of 1888	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	103
PID 540 wrote to memory of 1888	540	{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe	103
PID 612 wrote to memory of 4108	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	106
PID 612 wrote to memory of 4108	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	106
PID 612 wrote to memory of 4108	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	106
PID 612 wrote to memory of 2316	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	107
PID 612 wrote to memory of 2316	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	107
PID 612 wrote to memory of 2316	612	{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe	107
PID 4108 wrote to memory of 4976	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	108
PID 4108 wrote to memory of 4976	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	108
PID 4108 wrote to memory of 4976	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	108
PID 4108 wrote to memory of 3696	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	109
PID 4108 wrote to memory of 3696	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	109
PID 4108 wrote to memory of 3696	4108	{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe	109
PID 4976 wrote to memory of 3580	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe	111
PID 4976 wrote to memory of 3580	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe	111
PID 4976 wrote to memory of 3580	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe	111
PID 4976 wrote to memory of 4880	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe	112
PID 4976 wrote to memory of 4880	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe	112
PID 4976 wrote to memory of 4880	4976	{2279D85A-9740-4638-B680-E2B049432124}.exe	112
PID 3580 wrote to memory of 2632	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	116
PID 3580 wrote to memory of 2632	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	116
PID 3580 wrote to memory of 2632	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	116
PID 3580 wrote to memory of 4996	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	117
PID 3580 wrote to memory of 4996	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	117
PID 3580 wrote to memory of 4996	3580	{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe	117
PID 2632 wrote to memory of 2192	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	118
PID 2632 wrote to memory of 2192	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	118
PID 2632 wrote to memory of 2192	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	118
PID 2632 wrote to memory of 3016	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	119
PID 2632 wrote to memory of 3016	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	119
PID 2632 wrote to memory of 3016	2632	{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe	119
PID 2192 wrote to memory of 4856	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	127
PID 2192 wrote to memory of 4856	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	127
PID 2192 wrote to memory of 4856	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	127
PID 2192 wrote to memory of 1092	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	128
PID 2192 wrote to memory of 1092	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	128
PID 2192 wrote to memory of 1092	2192	{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe	128
PID 4856 wrote to memory of 3844	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	129
PID 4856 wrote to memory of 3844	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	129
PID 4856 wrote to memory of 3844	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	129
PID 4856 wrote to memory of 4772	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	130
PID 4856 wrote to memory of 4772	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	130
PID 4856 wrote to memory of 4772	4856	{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe	130
PID 3844 wrote to memory of 1200	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	131
PID 3844 wrote to memory of 1200	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	131
PID 3844 wrote to memory of 1200	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	131
PID 3844 wrote to memory of 948	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	132
PID 3844 wrote to memory of 948	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	132
PID 3844 wrote to memory of 948	3844	{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe	132
PID 1200 wrote to memory of 4528	1200	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe	137
PID 1200 wrote to memory of 4528	1200	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe	137
PID 1200 wrote to memory of 4528	1200	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe	137
PID 1200 wrote to memory of 3672	1200	{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe	138

C:\Users\Admin\AppData\Local\Temp\2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_c84dfd0d50a2556361eec842fcde25f0_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
  C:\Windows\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
    C:\Windows\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
      C:\Windows\{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\{2279D85A-9740-4638-B680-E2B049432124}.exe
        
        C:\Windows\{2279D85A-9740-4638-B680-E2B049432124}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4976
      - C:\Windows\{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe
        
        C:\Windows\{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
        
        C:\Windows\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
        
        C:\Windows\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
        
        C:\Windows\{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
        
        C:\Windows\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe
        
        C:\Windows\{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe
        
        C:\Windows\{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Windows\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}.exe
        
        C:\Windows\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}.exe
        13⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9715~1.EXE > nul
        13⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4611D~1.EXE > nul
        12⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46A3B~1.EXE > nul
        11⤵
        
        PID:948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5951B~1.EXE > nul
        10⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2AF79~1.EXE > nul
        9⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBEF2~1.EXE > nul
        8⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBD52~1.EXE > nul
        7⤵
        
        PID:4996
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2279D~1.EXE > nul
        6⤵
        
        PID:4880
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5847E~1.EXE > nul
        5⤵
        
        PID:3696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{734AB~1.EXE > nul
      4⤵
      PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A70E2~1.EXE > nul
    3⤵
    PID:1888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2279D85A-9740-4638-B680-E2B049432124}.exe

Filesize
372KB

MD5
5ed4b58e13e465a964bd6c0706a75c92

SHA1
837e3a696a952da11528a51c679d25f37eab91ec

SHA256
19089a630c83bd81cdbabc6069e814b7aa27fb19d57a47b8fa62d06da4a2f302

SHA512
8b642f408ca5f25ba15e4fa57a70bdfe4023ffe598deaa2904ac211753636748566192ad7e6d60a109e6d309ec501de9f87f8d7f1bf94ae676cca71a675d3fed

Download Submit
C:\Windows\{2AF79C92-E2C7-49d8-A855-E93A0761AD69}.exe

Filesize
372KB

MD5
ab0c16e9bff79a0946153d448f59e423

SHA1
6d22a1cf9c10c639873d5f56001b4e47165808e9

SHA256
09ab8acd4bda7bfe6ce9025b2ce42bb69724b8307f54d747cdb84f94f92640d3

SHA512
cf64e6f538216a8fd5cf79affdbbb578369aa05a80d897951fde137cd91232a483015f052a3622b5f7d9b446e14d6b0304110be2d3c0221681f5b3449eb867cd

Download Submit
C:\Windows\{4611D7D5-D7CA-495d-BC97-35DA562CC516}.exe

Filesize
372KB

MD5
2c2f092e181d09a5b260d1ca0d68f886

SHA1
f43b00a583166f137e15218b196631fd42761e1b

SHA256
c8d16d0d165d84e6c00960b68915f1d1e9f057deb6017a91754f3fd8b1262d6b

SHA512
3beef333c37cf85f0b02782bbcf17aec4f0a39534c3f8d8f7c7670928f4bd175c3249d466db3d1b19db9ab370d93c98f17cb3c7d2ce50ad72a838b4a6fc943ee

Download Submit
C:\Windows\{46A3B82B-5D73-44c3-BAB8-DA3D1BA512E1}.exe

Filesize
372KB

MD5
4c4e78f0b20183783315871c36eb0075

SHA1
0ce5be60bdbe944af70d41988074f22ebfcd73b9

SHA256
c2bd5eb061af7a5edcf8b59d8f8aada338a7b8e2a98143cd3c664b155ac63b32

SHA512
dd70b5f5eb2a4c09dd219ab887a406a3ecc531dcb27b82369a953d66eca897f23e096882ca5aca219e58c10e8c7d3c4b9e23107c9adc98949c8161bf17683599

Download Submit
C:\Windows\{5847E2DD-08E2-45be-9DEF-5EF61F332297}.exe

Filesize
372KB

MD5
1cd2f486259d2af18e47dbd7233e43eb

SHA1
4c6416aeacf9d23362f1c43c6533da12260dca02

SHA256
32cf53b0e491d31e18a238c52e213e2f3e7f188e34e78eab95da32cacbc082c0

SHA512
8b853e15f3570ff69c73dac9b77112b58d4ab4ebe41106392b2070aa4d9c1716bc87d87f838850113a977f83ad8f6fa65230f6ddadb399c513296bb2fc6b831b

Download Submit
C:\Windows\{5951BD7E-C437-4858-97DA-3A4E175275E3}.exe

Filesize
372KB

MD5
bac36627c72b2dcd6484923c39a786ac

SHA1
1ab527078615ea5e29d81f8ef7a358174aa13516

SHA256
0c2a8a6075ce19cf4d78a9ace0940a337b2e09ae6eb2a7f4fd84dd05b897c3f6

SHA512
d319b643576d176ce8048dfc77923837a053654b75d260aa23ed83e644ddd9888da21de95e389b102705a06c64d3c9e84acad88dcac4f98b47d646b686967ab2

Download Submit
C:\Windows\{734ABBCC-620E-4765-8E4A-F04EE376E4AF}.exe

Filesize
372KB

MD5
ee346ec0119f68cba6c6543d9b60b65c

SHA1
f09524d619f48cf038b7f432bdcd833b928fa207

SHA256
033b04f8d8a6472a9a7bb62f5f0434738b24d3f70582720dc52c1798dbce5efa

SHA512
b3f4a8b73dddc5c00c541659ce8a5fc5e158dd393a27d93abf197395eb6de0dc191339a198e77d755f41e5878887570697cd113d3595f2f15b6d390922343474

Download Submit
C:\Windows\{82162B9A-D8AA-46d8-B7BD-1739CF6EC9D8}.exe

Filesize
372KB

MD5
49d19aca816b47199fce7b9e4e391d19

SHA1
fca8993e1be42d3aec5ce18d1faa5d0f5c49deb4

SHA256
2efcad936ee4a71bf382245ea24c75641aec6e1e82ca5c566458607fee01db6d

SHA512
5b758466086bc965b254ea386af165d431ed7ee3de19b8889e4e3f4cf9efc27c150853046c602d2b5dc14f2fbed31c48a1ae57657eb709a855a3546d5c0cc3e5

Download Submit
C:\Windows\{A70E2CEF-6CCD-4221-AB78-5D8CF0AE4F2D}.exe

Filesize
372KB

MD5
6fef3b6c63cbcf190c9dcccbe94f324a

SHA1
ed91bf892690d06e4ca9d9dc1a50d9d82c087e6f

SHA256
e0c9b94ee73d7d862abe47f63ddadcf3e697242b8aeb44969dd2f97320c92397

SHA512
1e5f4aee9ca4835a497444bf9e5ccd0940c70111594b70bf1933dc5d6c836c12676d2b2b9703cc95b3d99559f92bc6b1c8467f8de2d7e805bc8cdff77cb5b5c5

Download Submit
C:\Windows\{F9715177-3B23-4f93-B296-A52D8BC857A0}.exe

Filesize
372KB

MD5
6657547fb8e7787d8a61d8521efd5c82

SHA1
920d02fc662eacab90caf2c31d446ff5a16f3b38

SHA256
3c74e63163dd91412259278fd7d82948a986ceadbd905073dd17208c0f3518d7

SHA512
786f9d02f10521aa41dc3706feda6a4c6f438460301c40b51799edc5a351573e05633867b2530b4b16cacbce0e976075836cd5e68810a05a3127292a5333d025

Download Submit
C:\Windows\{FBD52074-C82F-4775-973C-F8198BAE5E91}.exe

Filesize
372KB

MD5
dfadda31d245513d75b44c06c52cd869

SHA1
3d95b036da7054fb2a5a60ab37e4659e9c9a2926

SHA256
4462d0488ed158b9d5083cce2b93bb748628400138f660d4594e2b7fd530db7e

SHA512
2cde7d9f774bbd259413b5bd66bd16517143a67936ba1db9f7a6c91b851996b6d26e374a6eb439191b3d05d882a2a78c0b3163b995368416cedeefa347d307d3

Download Submit
C:\Windows\{FBEF2FFE-6E38-4cbc-B95A-86AA856A9DA4}.exe

Filesize
372KB

MD5
b57f181ebdadf4c031af365c5d1ed539

SHA1
3d3d25456c93e2a6133c0e6342e19d95ea5e6b86

SHA256
6db743d19ffafabd43331c8bcc2b1d158b79cf1843ae627956f7ac563d890b7e

SHA512
843385ee03bcf5a3d9f72cfbb7295dc0e1c41688d7896c1d7be982c085d9467df9188ea9cd85c23cf1bbacc6312c878fc06ebcc9684c38b55b9798b26ffd83fa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads