54552dd4fac6af5148599285592eccb387215cc8a9bbcdf90f52160e76fa0187

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe
Size

344KB
MD5

f7caddd2003f4cd4c0eb7c6b9818e2bd
SHA1

4c06c0022775db792d21bdd4f18b038617efe2b6
SHA256

54552dd4fac6af5148599285592eccb387215cc8a9bbcdf90f52160e76fa0187
SHA512

cf51aeb70d1630ef13e803b35baca8105860099a47939315a1f0e0f88fef63b8cae6f98f0df4f941db19a5ae3389e625495975ecfe0b11e7bbe0ef051bdcd6b7
SSDEEP

3072:mEGh0oulEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGYlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023390-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002342b-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023432-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001200000002342b-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023432-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023435-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023432-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023453-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000002337e-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023426-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002337c-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023426-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5625FD4F-EB82-4769-A39A-73C509E2CC57}\stubpath = "C:\\Windows\\{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe"	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}\stubpath = "C:\\Windows\\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe"	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C74D212-6364-4479-A9D5-5B48DE39977B}\stubpath = "C:\\Windows\\{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe"	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{622AE6A0-9285-4905-9B7A-876A60A827A6}\stubpath = "C:\\Windows\\{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe"	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60AF7482-A6EA-46c1-AADE-B8023504752D}\stubpath = "C:\\Windows\\{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe"	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79768B8D-838F-4e9d-94D5-0B454907619E}\stubpath = "C:\\Windows\\{79768B8D-838F-4e9d-94D5-0B454907619E}.exe"	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5625FD4F-EB82-4769-A39A-73C509E2CC57}	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E12D2715-8186-42f7-A556-E35A5E08DD4A}	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}	{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E878048B-FCA3-405f-B97D-8F36982DE5D3}	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C74D212-6364-4479-A9D5-5B48DE39977B}	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E12D2715-8186-42f7-A556-E35A5E08DD4A}\stubpath = "C:\\Windows\\{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe"	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{622AE6A0-9285-4905-9B7A-876A60A827A6}	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}\stubpath = "C:\\Windows\\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe"	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}\stubpath = "C:\\Windows\\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe"	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60AF7482-A6EA-46c1-AADE-B8023504752D}	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}\stubpath = "C:\\Windows\\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}.exe"	{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8C945A8-50F1-4305-865E-D5631B72F981}	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8C945A8-50F1-4305-865E-D5631B72F981}\stubpath = "C:\\Windows\\{A8C945A8-50F1-4305-865E-D5631B72F981}.exe"	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79768B8D-838F-4e9d-94D5-0B454907619E}	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E878048B-FCA3-405f-B97D-8F36982DE5D3}\stubpath = "C:\\Windows\\{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe"	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe

Executes dropped EXE 12 IoCs

pid	Process
376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe
3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
1760	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
2696	{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe
64	{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
File created	C:\Windows\{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
File created	C:\Windows\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}.exe	{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe
File created	C:\Windows\{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
File created	C:\Windows\{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
File created	C:\Windows\{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
File created	C:\Windows\{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
File created	C:\Windows\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
File created	C:\Windows\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
File created	C:\Windows\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
File created	C:\Windows\{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe
File created	C:\Windows\{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
Token: SeIncBasePriorityPrivilege	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
Token: SeIncBasePriorityPrivilege	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
Token: SeIncBasePriorityPrivilege	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
Token: SeIncBasePriorityPrivilege	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
Token: SeIncBasePriorityPrivilege	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
Token: SeIncBasePriorityPrivilege	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
Token: SeIncBasePriorityPrivilege	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe
Token: SeIncBasePriorityPrivilege	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
Token: SeIncBasePriorityPrivilege	1760	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
Token: SeIncBasePriorityPrivilege	2696	{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 376	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe	98
PID 4692 wrote to memory of 376	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe	98
PID 4692 wrote to memory of 376	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe	98
PID 4692 wrote to memory of 4896	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe	99
PID 4692 wrote to memory of 4896	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe	99
PID 4692 wrote to memory of 4896	4692	2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe	99
PID 376 wrote to memory of 2324	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	101
PID 376 wrote to memory of 2324	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	101
PID 376 wrote to memory of 2324	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	101
PID 376 wrote to memory of 3148	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	102
PID 376 wrote to memory of 3148	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	102
PID 376 wrote to memory of 3148	376	{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe	102
PID 2324 wrote to memory of 2272	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	105
PID 2324 wrote to memory of 2272	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	105
PID 2324 wrote to memory of 2272	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	105
PID 2324 wrote to memory of 3652	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	106
PID 2324 wrote to memory of 3652	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	106
PID 2324 wrote to memory of 3652	2324	{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe	106
PID 2272 wrote to memory of 1552	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	107
PID 2272 wrote to memory of 1552	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	107
PID 2272 wrote to memory of 1552	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	107
PID 2272 wrote to memory of 1596	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	108
PID 2272 wrote to memory of 1596	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	108
PID 2272 wrote to memory of 1596	2272	{A8C945A8-50F1-4305-865E-D5631B72F981}.exe	108
PID 1552 wrote to memory of 4880	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	110
PID 1552 wrote to memory of 4880	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	110
PID 1552 wrote to memory of 4880	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	110
PID 1552 wrote to memory of 2844	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	111
PID 1552 wrote to memory of 2844	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	111
PID 1552 wrote to memory of 2844	1552	{79768B8D-838F-4e9d-94D5-0B454907619E}.exe	111
PID 4880 wrote to memory of 232	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	116
PID 4880 wrote to memory of 232	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	116
PID 4880 wrote to memory of 232	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	116
PID 4880 wrote to memory of 2040	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	117
PID 4880 wrote to memory of 2040	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	117
PID 4880 wrote to memory of 2040	4880	{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe	117
PID 232 wrote to memory of 1816	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	118
PID 232 wrote to memory of 1816	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	118
PID 232 wrote to memory of 1816	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	118
PID 232 wrote to memory of 2268	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	119
PID 232 wrote to memory of 2268	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	119
PID 232 wrote to memory of 2268	232	{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe	119
PID 1816 wrote to memory of 3084	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	124
PID 1816 wrote to memory of 3084	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	124
PID 1816 wrote to memory of 3084	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	124
PID 1816 wrote to memory of 5048	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	125
PID 1816 wrote to memory of 5048	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	125
PID 1816 wrote to memory of 5048	1816	{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe	125
PID 3084 wrote to memory of 3372	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	129
PID 3084 wrote to memory of 3372	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	129
PID 3084 wrote to memory of 3372	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	129
PID 3084 wrote to memory of 1436	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	130
PID 3084 wrote to memory of 1436	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	130
PID 3084 wrote to memory of 1436	3084	{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe	130
PID 3372 wrote to memory of 1760	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	131
PID 3372 wrote to memory of 1760	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	131
PID 3372 wrote to memory of 1760	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	131
PID 3372 wrote to memory of 2248	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	132
PID 3372 wrote to memory of 2248	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	132
PID 3372 wrote to memory of 2248	3372	{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe	132
PID 1760 wrote to memory of 2696	1760	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe	135
PID 1760 wrote to memory of 2696	1760	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe	135
PID 1760 wrote to memory of 2696	1760	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe	135
PID 1760 wrote to memory of 1560	1760	{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe	136

C:\Users\Admin\AppData\Local\Temp\2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_f7caddd2003f4cd4c0eb7c6b9818e2bd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
  C:\Windows\{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
    C:\Windows\{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
      C:\Windows\{A8C945A8-50F1-4305-865E-D5631B72F981}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Windows\{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
        
        C:\Windows\{79768B8D-838F-4e9d-94D5-0B454907619E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1552
      - C:\Windows\{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
        
        C:\Windows\{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
        
        C:\Windows\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
        
        C:\Windows\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe
        
        C:\Windows\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
        
        C:\Windows\{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
        
        C:\Windows\{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe
        
        C:\Windows\{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Windows\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}.exe
        
        C:\Windows\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}.exe
        13⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E12D2~1.EXE > nul
        13⤵
        
        PID:388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C74D~1.EXE > nul
        12⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E8780~1.EXE > nul
        11⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CCCFD~1.EXE > nul
        10⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{226BB~1.EXE > nul
        9⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4DC0~1.EXE > nul
        8⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5625F~1.EXE > nul
        7⤵
        
        PID:2040
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79768~1.EXE > nul
        6⤵
        
        PID:2844
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8C94~1.EXE > nul
        5⤵
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{60AF7~1.EXE > nul
      4⤵
      PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{622AE~1.EXE > nul
    3⤵
    PID:3148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{226BBFAE-3BF0-4420-82E2-387C3FF89FA4}.exe

Filesize
344KB

MD5
1ca4c1ec726b98ceffd5b3975ac1519a

SHA1
bcc074027ee03c25344db60383688e24c2a92f84

SHA256
7740dc9dac5e4efea285fd77221c0fc357fb8af69bff3119278f695a886d858e

SHA512
acfdf2bf1690832f16363e82b4dfab668d357498651b3d858eec13c285218e0dc76a441437fbe8d4a1e7814d558abdcb19c15429ff0ecb077e333aa303bca97c

Download Submit
C:\Windows\{3C74D212-6364-4479-A9D5-5B48DE39977B}.exe

Filesize
344KB

MD5
83026e3c229d2da5c4600e0260c37134

SHA1
88152d75b0050921a2af32f9cbb64e01cbe7430f

SHA256
947d2b22805f2f1277dc7533a8ed6050279a272d5ec031dc8448ac6412f7fc16

SHA512
0313eb53bf9f51f97b63a07fc6fe63369df3b5ab640f7725eeaf82fee4b26adb0c83754b698e83e4b616c10f504b2e66bb52a30a1c97e1ab00365cfdf5722f3c

Download Submit
C:\Windows\{5625FD4F-EB82-4769-A39A-73C509E2CC57}.exe

Filesize
344KB

MD5
97c0fbdf075914fdbeb107e706603c18

SHA1
cc0ff19590c113e7a9d87d48178c889a6f4bceb8

SHA256
8104f8561cec547fcb24a2dd519868c6f2dadb372b39db25f722b5d56f050620

SHA512
607287f63db21358d50179d075ad337c9f302d07439a9d697c052741fd97df22462c5bb2775d9c0d58a51d61589d0e822033cb901c2d1e8a316ba48614a2ef07

Download Submit
C:\Windows\{60AF7482-A6EA-46c1-AADE-B8023504752D}.exe

Filesize
344KB

MD5
149fb44b3f507f651f9511112ee6a054

SHA1
f7a0dab6623e98e94ec9fccd1f7c7b8c2b99babe

SHA256
19ab710b64eba9d497822d0cfbd80cab8c0e27585f40c653209288a9afb8934e

SHA512
53f9c34c5bbcbaf939723b22128b6e94e6dd80a366e88821d01262e81985f8e68ef7e19b5252791ae0ac8fbf098ecca8a38e9419ca0ab9299681df4eb638e2f5

Download Submit
C:\Windows\{622AE6A0-9285-4905-9B7A-876A60A827A6}.exe

Filesize
344KB

MD5
bcc7635fd6221c8f60bb8d6dc89242d0

SHA1
fbcbd9bd9afc0b608cc3cd21ebab64b04a3d504d

SHA256
b0631f08690b88c22a1ecb1b8f3234d2ab9d95e0e1b7a04868f26394fcc09c48

SHA512
c2496a9b1b5969c142b5d6f1f92a49256a4a29bb85d3fbc89e4bc17da6edaa4f50a541ba87b6bb093a4f24af99e38dab09f56e6a326bfc1a585a62ed4df26169

Download Submit
C:\Windows\{79768B8D-838F-4e9d-94D5-0B454907619E}.exe

Filesize
344KB

MD5
9eb11f220b0ee76e4b0d9cfbd50e6d9b

SHA1
af0d6f66394cfee421d1fa3f562ee61c7f87ac09

SHA256
c3797c96d159b6900151aa57dec6eedeb99f6831c16efeb1acafccd88142ab73

SHA512
bedffc3e2962fe27e01d6b676c21f5d1debcc300ace96b5b6945e3e033694573ae6670213f97eae2cc89c8cf5fd9a476df3d7e0447487c5b2cdfcb76415eb006

Download Submit
C:\Windows\{A8C945A8-50F1-4305-865E-D5631B72F981}.exe

Filesize
344KB

MD5
135746382baf5281ba8fe266220a9ab9

SHA1
a8b566aa9c830992b67c28bb9841e819c5c1333d

SHA256
a0f02fc7a49f585db62513d875b770a62fc98d780b85e8d18e8a778c347a0a4c

SHA512
25dc0b3f62c0d80ddadc00eea88934689a01b61bb2cc9e2e003aed29bb96277892ba6ea8a56dd4099967a48ed124a49ffab0f69cd1a1a68c2abcf40141a535a2

Download Submit
C:\Windows\{CCCFDC67-B418-4d76-AF2F-0D65BB64629B}.exe

Filesize
344KB

MD5
e6c1c31374b5a36fb496db571687a93c

SHA1
3a5a838d566183011b7cb8e4044dd04fb5a33667

SHA256
3f320b9c7f503bbaf3b5655b18d3bab6191b188a153be9ecd9a842b873d606af

SHA512
be41ab552e02b2aac5cf8fc6c1da94572592d923fd5f90f9bc8b88d2ae57a848a0cabbc9cbd63f5cc50a3b49f8f75390b9a3cc4229e0af9a76bc089199f85159

Download Submit
C:\Windows\{D6A76113-7D57-4460-8D2A-6C3BAB24FBAB}.exe

Filesize
344KB

MD5
eed313a9e8ba84b298e8c140d78a22c5

SHA1
1aa819e36c30104e01ee4c419b1b100d0ba81963

SHA256
e0bfc85eff9051504bf84146a8d4f3a89a987ebf926f03b6743a6e8ecd985a1c

SHA512
55a9603793190bf301f5a873e94a58c6fbaecfdcdab96c1c50521606444a8a7cc164cb20a0554943301582932942253152f05b32251f4c71ac87a959dcbf043c

Download Submit
C:\Windows\{E12D2715-8186-42f7-A556-E35A5E08DD4A}.exe

Filesize
344KB

MD5
c9512fb764ee87dddd2536f2ecb51993

SHA1
f17377fe0374a945c394643d4ffe110f6535edb0

SHA256
282498e2b9dc820b925fc4f6689bb7800bbe3bd1641e6f66c64a9b74872cb568

SHA512
4d6df95483d7b3ac8f46a7f8685ec5afcdea0a6aa1747f2f5f421d92a05244b2797be0f973fb0562172fd3f115b54e3415f3d268e2cee98f51fa7bca240ec4b5

Download Submit
C:\Windows\{E4DC036E-AA6A-4f57-B7D8-0AC510AB2AAD}.exe

Filesize
344KB

MD5
98d72d69996b0f25959b7b2dcac84684

SHA1
0c8294a414104de12ab5690ba3a31f94229bc350

SHA256
cc29105582e499d564ba8411f41c09d3306d848dd09d11434a84c40c22e92d45

SHA512
e9ff7271d8d634cda7afc234a63a175b3fdcd79c3df53cb41cc96e98f0d3e1f9e17a39c64d45d4ada64684a5870aa3e48ae02b345100d6cbc20e0c2abbe94ca4

Download Submit
C:\Windows\{E878048B-FCA3-405f-B97D-8F36982DE5D3}.exe

Filesize
344KB

MD5
94c96a6fcf71394c5f7701dc9c19d171

SHA1
54d6f2504f2582929bfc73c5cbf27600406d9898

SHA256
80a3e9cda178ab901202b3154237a24d8deb35d36bd5998cef95cdab6a986cb3

SHA512
a93924e08138c36f22b05d2e1433c63ddc91e5a53961f8e1bd02c94bf23e8ca1405e6f9b7b5cc2e72213fe464ce62eb3c40b084b5aa6ffdf326011f5535c54ad

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads