1c0cb1b769ca5c78525c2c1567b93a1af6318d6e967a453d7faeb778b38379e0

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe
Size

204KB
MD5

719f150a125ce2af17da832453b3480e
SHA1

9410f4ed2dfe274706f8bfdb8991f6c7f14aaadc
SHA256

1c0cb1b769ca5c78525c2c1567b93a1af6318d6e967a453d7faeb778b38379e0
SHA512

7f52bdccb3cef7b5419ac83b93897d28989e07624e49eb8fa2edeb51e86f557d6aed576a6dbec99eaa05efed7dc766c8d9729843372a1d730ddae2e4e10bac5f
SSDEEP

1536:1EGh0oFl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oFl1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023470-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023468-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023478-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023468-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023478-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002347a-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023478-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002348c-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023491-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233b8-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002348c-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023491-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}\stubpath = "C:\\Windows\\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe"	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}\stubpath = "C:\\Windows\\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe"	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}\stubpath = "C:\\Windows\\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe"	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29D42938-E982-4c0d-B63C-43DE41B46263}	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28AE1BB1-3A78-45ca-BCF0-735308F90170}	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{338EB420-1680-4a14-B7D8-8E405D22B737}	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}\stubpath = "C:\\Windows\\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe"	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DC4DDD6-E193-4c6e-B004-0067298E6072}\stubpath = "C:\\Windows\\{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe"	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}	{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29D42938-E982-4c0d-B63C-43DE41B46263}\stubpath = "C:\\Windows\\{29D42938-E982-4c0d-B63C-43DE41B46263}.exe"	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28AE1BB1-3A78-45ca-BCF0-735308F90170}\stubpath = "C:\\Windows\\{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe"	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62513459-E88B-45ab-B683-FEF1888DC153}	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}\stubpath = "C:\\Windows\\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe"	{62513459-E88B-45ab-B683-FEF1888DC153}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}\stubpath = "C:\\Windows\\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe"	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62513459-E88B-45ab-B683-FEF1888DC153}\stubpath = "C:\\Windows\\{62513459-E88B-45ab-B683-FEF1888DC153}.exe"	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}	{62513459-E88B-45ab-B683-FEF1888DC153}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{338EB420-1680-4a14-B7D8-8E405D22B737}\stubpath = "C:\\Windows\\{338EB420-1680-4a14-B7D8-8E405D22B737}.exe"	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}\stubpath = "C:\\Windows\\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}.exe"	{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DC4DDD6-E193-4c6e-B004-0067298E6072}	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe

Executes dropped EXE 12 IoCs

pid	Process
1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe
532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe
4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
3820	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
3728	{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe
3024	{466498D0-E630-4cfb-8ED6-FA4CFF25048D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
File created	C:\Windows\{338EB420-1680-4a14-B7D8-8E405D22B737}.exe	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
File created	C:\Windows\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
File created	C:\Windows\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
File created	C:\Windows\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
File created	C:\Windows\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
File created	C:\Windows\{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
File created	C:\Windows\{62513459-E88B-45ab-B683-FEF1888DC153}.exe	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
File created	C:\Windows\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	{62513459-E88B-45ab-B683-FEF1888DC153}.exe
File created	C:\Windows\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}.exe	{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe
File created	C:\Windows\{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe
File created	C:\Windows\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe
Token: SeIncBasePriorityPrivilege	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
Token: SeIncBasePriorityPrivilege	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
Token: SeIncBasePriorityPrivilege	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
Token: SeIncBasePriorityPrivilege	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
Token: SeIncBasePriorityPrivilege	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
Token: SeIncBasePriorityPrivilege	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
Token: SeIncBasePriorityPrivilege	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe
Token: SeIncBasePriorityPrivilege	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
Token: SeIncBasePriorityPrivilege	3820	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
Token: SeIncBasePriorityPrivilege	3728	{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1404	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe	102
PID 4568 wrote to memory of 1404	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe	102
PID 4568 wrote to memory of 1404	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe	102
PID 4568 wrote to memory of 3356	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe	103
PID 4568 wrote to memory of 3356	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe	103
PID 4568 wrote to memory of 3356	4568	2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe	103
PID 1404 wrote to memory of 532	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	104
PID 1404 wrote to memory of 532	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	104
PID 1404 wrote to memory of 532	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	104
PID 1404 wrote to memory of 956	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	105
PID 1404 wrote to memory of 956	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	105
PID 1404 wrote to memory of 956	1404	{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe	105
PID 532 wrote to memory of 2152	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	108
PID 532 wrote to memory of 2152	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	108
PID 532 wrote to memory of 2152	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	108
PID 532 wrote to memory of 4964	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	109
PID 532 wrote to memory of 4964	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	109
PID 532 wrote to memory of 4964	532	{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe	109
PID 2152 wrote to memory of 4392	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	110
PID 2152 wrote to memory of 4392	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	110
PID 2152 wrote to memory of 4392	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	110
PID 2152 wrote to memory of 2000	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	111
PID 2152 wrote to memory of 2000	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	111
PID 2152 wrote to memory of 2000	2152	{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe	111
PID 4392 wrote to memory of 548	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	112
PID 4392 wrote to memory of 548	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	112
PID 4392 wrote to memory of 548	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	112
PID 4392 wrote to memory of 4132	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	113
PID 4392 wrote to memory of 4132	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	113
PID 4392 wrote to memory of 4132	4392	{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe	113
PID 548 wrote to memory of 1044	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	119
PID 548 wrote to memory of 1044	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	119
PID 548 wrote to memory of 1044	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	119
PID 548 wrote to memory of 4868	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	120
PID 548 wrote to memory of 4868	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	120
PID 548 wrote to memory of 4868	548	{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe	120
PID 1044 wrote to memory of 2868	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	121
PID 1044 wrote to memory of 2868	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	121
PID 1044 wrote to memory of 2868	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	121
PID 1044 wrote to memory of 4524	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	122
PID 1044 wrote to memory of 4524	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	122
PID 1044 wrote to memory of 4524	1044	{29D42938-E982-4c0d-B63C-43DE41B46263}.exe	122
PID 2868 wrote to memory of 1052	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	126
PID 2868 wrote to memory of 1052	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	126
PID 2868 wrote to memory of 1052	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	126
PID 2868 wrote to memory of 2692	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	127
PID 2868 wrote to memory of 2692	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	127
PID 2868 wrote to memory of 2692	2868	{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe	127
PID 1052 wrote to memory of 4748	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe	129
PID 1052 wrote to memory of 4748	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe	129
PID 1052 wrote to memory of 4748	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe	129
PID 1052 wrote to memory of 4948	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe	130
PID 1052 wrote to memory of 4948	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe	130
PID 1052 wrote to memory of 4948	1052	{62513459-E88B-45ab-B683-FEF1888DC153}.exe	130
PID 4748 wrote to memory of 3820	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	131
PID 4748 wrote to memory of 3820	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	131
PID 4748 wrote to memory of 3820	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	131
PID 4748 wrote to memory of 2608	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	132
PID 4748 wrote to memory of 2608	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	132
PID 4748 wrote to memory of 2608	4748	{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe	132
PID 3820 wrote to memory of 3728	3820	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe	133
PID 3820 wrote to memory of 3728	3820	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe	133
PID 3820 wrote to memory of 3728	3820	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe	133
PID 3820 wrote to memory of 2864	3820	{338EB420-1680-4a14-B7D8-8E405D22B737}.exe	134

C:\Users\Admin\AppData\Local\Temp\2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_719f150a125ce2af17da832453b3480e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe
  C:\Windows\{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
    C:\Windows\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Windows\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
      C:\Windows\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
        
        C:\Windows\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4392
      - C:\Windows\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
        
        C:\Windows\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
        
        C:\Windows\{29D42938-E982-4c0d-B63C-43DE41B46263}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
        
        C:\Windows\{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\{62513459-E88B-45ab-B683-FEF1888DC153}.exe
        
        C:\Windows\{62513459-E88B-45ab-B683-FEF1888DC153}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
        
        C:\Windows\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
        
        C:\Windows\{338EB420-1680-4a14-B7D8-8E405D22B737}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe
        
        C:\Windows\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3728
        
        C:\Windows\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}.exe
        
        C:\Windows\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}.exe
        13⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F79FD~1.EXE > nul
        13⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{338EB~1.EXE > nul
        12⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE185~1.EXE > nul
        11⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62513~1.EXE > nul
        10⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28AE1~1.EXE > nul
        9⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{29D42~1.EXE > nul
        8⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3CBCA~1.EXE > nul
        7⤵
        
        PID:4868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F95C5~1.EXE > nul
        6⤵
        
        PID:4132
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E51E5~1.EXE > nul
        5⤵
        
        PID:2000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C2211~1.EXE > nul
      4⤵
      PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4DC4D~1.EXE > nul
    3⤵
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{28AE1BB1-3A78-45ca-BCF0-735308F90170}.exe

Filesize
204KB

MD5
59c17ddfd6ee86f347eccefcad8373e8

SHA1
f41061e18290ae2545d8bbb8f4bbaf452acb9c76

SHA256
03dfdfaf6f18230919d817e2041440546b0f8792837158363e51d3b90ce458fa

SHA512
6ed5a0b435477192189634a9cc5f86cf8d15d06e16c9d9db6243de80d22426ae457368eecd1aea7f55d0e7eea1c99940f08dfb11d78fc9f3269d5382f77b2996

Download Submit
C:\Windows\{29D42938-E982-4c0d-B63C-43DE41B46263}.exe

Filesize
204KB

MD5
b483f60d787a437fc30fef154c4bfc8c

SHA1
f74c8f19a1f014a05f68505ffef2e38f9019db68

SHA256
d176b9c6717e3023928043135866267421bdc4653b8fc0c6f4bc6165c821595a

SHA512
95ee783eed007796ea3e9fa1e18752b023cf5794742206e199fdab26f44de99f1784c34e9d879e9368d3ab2d546ea144cbcbe1d1c14984b46bb3a78b2fc1f1b7

Download Submit
C:\Windows\{338EB420-1680-4a14-B7D8-8E405D22B737}.exe

Filesize
204KB

MD5
c98ecd858d89d8b1ea14b0bfcb5070b0

SHA1
bba44e56c98212fc83f711a25c423469d1542baf

SHA256
097763b3fde3b0eb46f961a6a3fa4647328ea830cf64774ae4b1e23980d76821

SHA512
48370e977948e3d4d02db379988d9689243ea64f1db9e7a34f5f5545fcf6a9e5620719b10f3fc5d81e94291ec0b82fcd77709516dd8d10d44fa79d2e0f88b5d0

Download Submit
C:\Windows\{3CBCAB31-4FFF-48a6-87B7-1565C61EAEA1}.exe

Filesize
204KB

MD5
eade188807505791b376b6e82ee87efd

SHA1
fa0c2a35e7c35ee4db3f6327c6edf2e7c1ddfefb

SHA256
cfa5ddde85f3860b7ba9cc4cca6b268f7321edc74a30aaf8af81e1fa0fc300e5

SHA512
78a785034e9ea204211180f1d228b9381719653f4572b8d0b9a2b7e0f2e62996dc0d2b8e546629b16d442b2b5934baff3fea9c14ecc010fbdc67e5a121a83d5a

Download Submit
C:\Windows\{466498D0-E630-4cfb-8ED6-FA4CFF25048D}.exe

Filesize
204KB

MD5
711db4134dfd1ee466e45233254e7176

SHA1
ee14b5777b4b83eddbc4ed0d960d2cab6551250a

SHA256
c0a537ed64a086b4665cf849d29f3c1cd958aae172232837c4c0ef5791e7e778

SHA512
8d501bef30c9c78e088641874c5ffd11ea58be9e4f0cea704b25cb38aed8c99b838152bc0bf5cd790cde35c541ce2f5cb8786e54eb3b607181ebec64399c2658

Download Submit
C:\Windows\{4DC4DDD6-E193-4c6e-B004-0067298E6072}.exe

Filesize
204KB

MD5
9c62525e526abb01602c7da3e8ff2c51

SHA1
115c5492f23d5f0eb554727ffec1cfcd1da9f21c

SHA256
4fc3e933af517e9095cb2a3088142e3497e1c92900e94e271d5fe668c9138198

SHA512
8511d4f7931347e1dd4c8d398e162eb8dcb6c35044f3d0e9782e29e1461e7f6fba61b2078e5c0bc05ca02342d33a8b9a03a36a6c47bfe29579a1ddadaf8f5785

Download Submit
C:\Windows\{62513459-E88B-45ab-B683-FEF1888DC153}.exe

Filesize
204KB

MD5
dca036892967ce7b4d5da1816118998e

SHA1
3dabb25b690bd03b07d26cd8a94718ccbbc818a9

SHA256
e5ca746172070d85764ca061a2538abeed3e114861caaf50aa7b91500e305869

SHA512
10e2a8c70d3c23ce391f5be2fda2704b24ec5323c346b57a1ab0a86ab81c895aafce558162de121b6ab04af990146b03e8e97e61bc23b6adb737604bcf5844d5

Download Submit
C:\Windows\{BE1856A6-3C43-4a3b-A6E7-9B46BA86EF83}.exe

Filesize
204KB

MD5
d5fbbdffcd6c152c879fcbe295f08a41

SHA1
fc6e9ca15082a4610c6c93e8a8eeb1952ae9daeb

SHA256
d20fd626ffae112b7004840e002f844ac2e2bbe3d7c1ea0b205720056c87ee0e

SHA512
6c2e6c495e9c6e9856b54f249cbec31cafc84841a7cebade138fd8cec06d5c1bb22422b2d7287a53a73045f200a02246235bfc9fa3ce6710c9785c3031734dc7

Download Submit
C:\Windows\{C22116CE-4F2B-4599-8DC4-F155D0C9EA0E}.exe

Filesize
204KB

MD5
2fa029f57169ea55d2a77e0e4b1d4b3f

SHA1
98a6915bafefca38e18cb4671a0e6c3d11b6c934

SHA256
665502a92a07217e782248a9d658de31fca3ae6272d7e60a665e7dd9e7ce0e18

SHA512
8783cf1cfd58e4d4c91674c7aa141278aacec5bd6a6085993bb5c0be54a1a237395ae54f864964305d91e71b42da84384686560a0116a9df7fcd77879c170d19

Download Submit
C:\Windows\{E51E5C96-8FC7-4a75-8443-B7A901F4402A}.exe

Filesize
204KB

MD5
73afee3aa539933c92e98d3d630afbb7

SHA1
7b064d02fd5fc7557f524737dd5b65a76cae2c95

SHA256
0421c2a3ded9ab491447a4eb53914e07c50969d8deb515b952a3fe51aa6b9b85

SHA512
70adb971a8003d422b383d7760d08e2c3d003399e746fde30ec334374853f0331e328a9a521928a03ba3f581fd41f687e2d975822afb26ec25cf854b896f2b91

Download Submit
C:\Windows\{F79FDCC0-BBDA-4ed4-ADCF-F2A238999090}.exe

Filesize
204KB

MD5
e904a60251655a70ff4a525c53e77e3b

SHA1
5c30fdcf62386ec432850f599ec9878ead6636e1

SHA256
8e58dad6ee5d1865f461ba4e6609f55d06d268616a5f4009decf8d98e3a7a1ab

SHA512
f604ac8667d42e7b4a690b75c50dbf64ad4026f11638a40285da22d561abeb2b0c5404d909ab4bd7ed4b306ba4003f599e983d9d06e7cc8c16c2debf4d89aa49

Download Submit
C:\Windows\{F95C541C-B3B6-4b6c-9BF8-0FDC8E396624}.exe

Filesize
204KB

MD5
73d24eb264615db392861ba29b4b0b8d

SHA1
d61a35c82e8b0c07d35918b5261abe61616abe25

SHA256
81986d30593fd7a636e3f03ad63b62cd1b58767067ec1b3f9f6f7bc371897590

SHA512
41010fae37f94305d426cf8c91df2d7a0cc70d72eefb2ffc2ad6ee653c1444921b55bb65818412b20ae3b6b2796f736df703bfe9ee66a701df3663ed6fb4ef1d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads