81ab34cb1602281db56a3bfe977116db9e51113365b6504edf6350b6f2cdb9d5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe
Size

204KB
MD5

c8a9d9fd6178d44896a9330655789981
SHA1

41992b5a713efee130850a780d5dd767250d5ccf
SHA256

81ab34cb1602281db56a3bfe977116db9e51113365b6504edf6350b6f2cdb9d5
SHA512

5e001457e64fe3ea5263cae2f22a9eba4464f4046f7c5a34eb55dd30e61a719121e22b45529ae946a5d0f2e84f88b24604e52d6995af100188d6a846ae781c2b
SSDEEP

1536:1EGh0oql15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oql1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233eb-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000233fb-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002340e-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000200000001e52d-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002340e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e52d-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001500000001da55-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001db0f-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001600000001da55-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023364-37.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001800000001da55-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023364-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C647815B-EBF0-4336-8096-DE83D4DD8A80}\stubpath = "C:\\Windows\\{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe"	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06389EE9-C1F8-475a-A3F3-158775F32061}	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}\stubpath = "C:\\Windows\\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe"	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{027361F7-44C1-4760-827F-292EB117C6A0}	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6351679-9986-4b7c-9FE7-11D33B4545AE}\stubpath = "C:\\Windows\\{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe"	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3E10893-8DC3-404a-B548-63B1E20AF64E}\stubpath = "C:\\Windows\\{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe"	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}\stubpath = "C:\\Windows\\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe"	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}\stubpath = "C:\\Windows\\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe"	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}\stubpath = "C:\\Windows\\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe"	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06389EE9-C1F8-475a-A3F3-158775F32061}\stubpath = "C:\\Windows\\{06389EE9-C1F8-475a-A3F3-158775F32061}.exe"	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}\stubpath = "C:\\Windows\\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe"	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C73A84A-84F8-4d64-8117-DAD71379810C}	{027361F7-44C1-4760-827F-292EB117C6A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C73A84A-84F8-4d64-8117-DAD71379810C}\stubpath = "C:\\Windows\\{4C73A84A-84F8-4d64-8117-DAD71379810C}.exe"	{027361F7-44C1-4760-827F-292EB117C6A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{027361F7-44C1-4760-827F-292EB117C6A0}\stubpath = "C:\\Windows\\{027361F7-44C1-4760-827F-292EB117C6A0}.exe"	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6351679-9986-4b7c-9FE7-11D33B4545AE}	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}\stubpath = "C:\\Windows\\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe"	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C647815B-EBF0-4336-8096-DE83D4DD8A80}	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3E10893-8DC3-404a-B548-63B1E20AF64E}	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe

Executes dropped EXE 12 IoCs

pid	Process
848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe
1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe
464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
1216	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
4016	{027361F7-44C1-4760-827F-292EB117C6A0}.exe
316	{4C73A84A-84F8-4d64-8117-DAD71379810C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
File created	C:\Windows\{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
File created	C:\Windows\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
File created	C:\Windows\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
File created	C:\Windows\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
File created	C:\Windows\{027361F7-44C1-4760-827F-292EB117C6A0}.exe	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
File created	C:\Windows\{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe
File created	C:\Windows\{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe
File created	C:\Windows\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
File created	C:\Windows\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
File created	C:\Windows\{4C73A84A-84F8-4d64-8117-DAD71379810C}.exe	{027361F7-44C1-4760-827F-292EB117C6A0}.exe
File created	C:\Windows\{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe
Token: SeIncBasePriorityPrivilege	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
Token: SeIncBasePriorityPrivilege	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe
Token: SeIncBasePriorityPrivilege	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
Token: SeIncBasePriorityPrivilege	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe
Token: SeIncBasePriorityPrivilege	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
Token: SeIncBasePriorityPrivilege	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
Token: SeIncBasePriorityPrivilege	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
Token: SeIncBasePriorityPrivilege	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
Token: SeIncBasePriorityPrivilege	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
Token: SeIncBasePriorityPrivilege	1216	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
Token: SeIncBasePriorityPrivilege	4016	{027361F7-44C1-4760-827F-292EB117C6A0}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 848	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe	93
PID 1408 wrote to memory of 848	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe	93
PID 1408 wrote to memory of 848	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe	93
PID 1408 wrote to memory of 4288	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe	94
PID 1408 wrote to memory of 4288	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe	94
PID 1408 wrote to memory of 4288	1408	2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe	94
PID 848 wrote to memory of 752	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	97
PID 848 wrote to memory of 752	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	97
PID 848 wrote to memory of 752	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	97
PID 848 wrote to memory of 452	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	98
PID 848 wrote to memory of 452	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	98
PID 848 wrote to memory of 452	848	{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe	98
PID 752 wrote to memory of 1940	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	101
PID 752 wrote to memory of 1940	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	101
PID 752 wrote to memory of 1940	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	101
PID 752 wrote to memory of 3772	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	102
PID 752 wrote to memory of 3772	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	102
PID 752 wrote to memory of 3772	752	{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe	102
PID 1940 wrote to memory of 5108	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	104
PID 1940 wrote to memory of 5108	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	104
PID 1940 wrote to memory of 5108	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	104
PID 1940 wrote to memory of 2872	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	105
PID 1940 wrote to memory of 2872	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	105
PID 1940 wrote to memory of 2872	1940	{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe	105
PID 5108 wrote to memory of 464	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	106
PID 5108 wrote to memory of 464	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	106
PID 5108 wrote to memory of 464	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	106
PID 5108 wrote to memory of 5036	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	107
PID 5108 wrote to memory of 5036	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	107
PID 5108 wrote to memory of 5036	5108	{06389EE9-C1F8-475a-A3F3-158775F32061}.exe	107
PID 464 wrote to memory of 1420	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	108
PID 464 wrote to memory of 1420	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	108
PID 464 wrote to memory of 1420	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	108
PID 464 wrote to memory of 4688	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	109
PID 464 wrote to memory of 4688	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	109
PID 464 wrote to memory of 4688	464	{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe	109
PID 1420 wrote to memory of 4032	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	116
PID 1420 wrote to memory of 4032	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	116
PID 1420 wrote to memory of 4032	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	116
PID 1420 wrote to memory of 4008	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	117
PID 1420 wrote to memory of 4008	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	117
PID 1420 wrote to memory of 4008	1420	{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe	117
PID 4032 wrote to memory of 3756	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	118
PID 4032 wrote to memory of 3756	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	118
PID 4032 wrote to memory of 3756	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	118
PID 4032 wrote to memory of 1604	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	119
PID 4032 wrote to memory of 1604	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	119
PID 4032 wrote to memory of 1604	4032	{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe	119
PID 3756 wrote to memory of 4948	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	121
PID 3756 wrote to memory of 4948	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	121
PID 3756 wrote to memory of 4948	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	121
PID 3756 wrote to memory of 2180	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	122
PID 3756 wrote to memory of 2180	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	122
PID 3756 wrote to memory of 2180	3756	{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe	122
PID 4948 wrote to memory of 1216	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	126
PID 4948 wrote to memory of 1216	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	126
PID 4948 wrote to memory of 1216	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	126
PID 4948 wrote to memory of 3564	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	127
PID 4948 wrote to memory of 3564	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	127
PID 4948 wrote to memory of 3564	4948	{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe	127
PID 1216 wrote to memory of 4016	1216	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe	128
PID 1216 wrote to memory of 4016	1216	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe	128
PID 1216 wrote to memory of 4016	1216	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe	128
PID 1216 wrote to memory of 4568	1216	{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe	129

C:\Users\Admin\AppData\Local\Temp\2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_c8a9d9fd6178d44896a9330655789981_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
  C:\Windows\{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe
    C:\Windows\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
      C:\Windows\{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\{06389EE9-C1F8-475a-A3F3-158775F32061}.exe
        
        C:\Windows\{06389EE9-C1F8-475a-A3F3-158775F32061}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Windows\{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
        
        C:\Windows\{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
        
        C:\Windows\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
        
        C:\Windows\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
        
        C:\Windows\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
        
        C:\Windows\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
        
        C:\Windows\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\{027361F7-44C1-4760-827F-292EB117C6A0}.exe
        
        C:\Windows\{027361F7-44C1-4760-827F-292EB117C6A0}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
        
        C:\Windows\{4C73A84A-84F8-4d64-8117-DAD71379810C}.exe
        
        C:\Windows\{4C73A84A-84F8-4d64-8117-DAD71379810C}.exe
        13⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02736~1.EXE > nul
        13⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94A29~1.EXE > nul
        12⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8F4D7~1.EXE > nul
        11⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44B98~1.EXE > nul
        10⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BD33~1.EXE > nul
        9⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7A62~1.EXE > nul
        8⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3E10~1.EXE > nul
        7⤵
        
        PID:4688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{06389~1.EXE > nul
        6⤵
        
        PID:5036
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6478~1.EXE > nul
        5⤵
        
        PID:2872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E02D3~1.EXE > nul
      4⤵
      PID:3772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A6351~1.EXE > nul
    3⤵
    PID:452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{027361F7-44C1-4760-827F-292EB117C6A0}.exe

Filesize
204KB

MD5
d4fa707a1230be9fb2fd13b3b1216684

SHA1
bb2f04471801d9bcba4482d4bfdfb5f86db77c95

SHA256
ccc5caa114288eafb7a399b7a92d5b69d60d1313dd62f3870ffee738af08ff41

SHA512
10cc6fed5213e2aa538ec3bdafa51ae14f68a458d14fd089e103af33194263afaae44b01ea22fedcccb2c7e467ead129d7337932122a0d928b5a2c18428f79f5

Download Submit
C:\Windows\{06389EE9-C1F8-475a-A3F3-158775F32061}.exe

Filesize
204KB

MD5
fc6ab6037f9a4f168a1c99578231ddba

SHA1
db0653bd126fec4190c29c773939af1a73e917e6

SHA256
1cf21f3398838e4cd95e9c5c18981cb7a1253c785ef0243d6a3e62d35f324af8

SHA512
3630c01600b528b410605d56238678293c805bd08905db3b22f186c4a67081d9187f0e96c063895bfd96cd3698bad57f0085791d0b4f30780e5d4fbf1cddc50a

Download Submit
C:\Windows\{3BD33E7B-1F4F-4774-9514-BF3B2DBFC428}.exe

Filesize
204KB

MD5
c3358a31ca5ffcec51ec80cf8d3a415e

SHA1
c1468e33de869686bdbef91ae32d9396fe75c791

SHA256
be4edbd6e67f7e9ee8baa687b375a024904228f41f7cff716a13cd5132f894f8

SHA512
174f25fb04cf06e5b0a2408082e4d5149bbba9239d6f34d1b154c381531e230252f19d498fbc20757804e3ef3fd33d635fb7abea0a4e02de63f7a4aba76cf10e

Download Submit
C:\Windows\{44B98867-74BA-4c8f-AC2F-6CFB6CD1214B}.exe

Filesize
204KB

MD5
69697a2435563bbf793ca42105c189c7

SHA1
2ee8e027c3225697e06575c423864a1891bacc1c

SHA256
64fe76964bf2a48e2f686053b5ceb1f4af791a343cfa02606e4aa5fb742919eb

SHA512
cfd2038849a09e87230a08aea2397edf843dddc10e840bb2a88094adc1c80625f35236bd99c88055581d4e169b89a546fe753216c4f74ccf8707be14f62f6cce

Download Submit
C:\Windows\{4C73A84A-84F8-4d64-8117-DAD71379810C}.exe

Filesize
204KB

MD5
3287f0840d1950b795f9a9e40bc41a96

SHA1
5b78fc230b5f3298f468bf0156b46596198a9b7f

SHA256
99992a383d0d8fa0f3fe36bb3f3fa0f237e3f81a5ffe6acbe7ca6a64d468bd45

SHA512
aea93e1e80f4ff259328bc25e312beea82025dd4a6b6fec4467595cd1ea11af70671daa76ceabda3a52b5057307b7e76d4f9beaa11174ec8af0e471e07b46b48

Download Submit
C:\Windows\{8F4D7AB8-F0B9-46f4-AA31-4B3DFD82142D}.exe

Filesize
204KB

MD5
ee2777617d1afeb5a626ee99b3399fed

SHA1
22031ac2a34e8a4bedb412da8b7d1f4c722da7c2

SHA256
0efab95d3bbbdb958120f9af2c1c08193beb2f6c532eab7f783e655aa2410534

SHA512
55d65bd70250f35e99dda2157a356d0e8711d066edb8bf7fbbfad05d451269bbbc52fb2d76fef450f78c9d6b4aea4aa83670e8663a2d866ebb909b0044a57bd4

Download Submit
C:\Windows\{94A2929B-D6DB-4aaa-A013-798B1D133D1C}.exe

Filesize
204KB

MD5
c238a5e536dec9d7dcbf4314268950b9

SHA1
8ce1faa0b43abfebe1e67b85f3c4d0a0a9114716

SHA256
1e452f58b3a9e27c41b996c48ca5acf8c5e56613a2ed412d2f996ad5a6b5793b

SHA512
f0a41c099edf9ce21de3e147a29d37572e14d1bb114e8fd7e9bf856c9d6b8eb5f1fa7c864961ad0197db462f100b016bf45c0440ad53802486c875e560095d99

Download Submit
C:\Windows\{A3E10893-8DC3-404a-B548-63B1E20AF64E}.exe

Filesize
204KB

MD5
698fc13e1c27f899620df04a512ba4de

SHA1
daba69b6be6d229a9194ea0317601fc50df939fd

SHA256
6543ea5a63c17df75f41e91619fb41843bda517c44b5af4a8deb1e2a4fdd7701

SHA512
fb075dff8b4c274727da43b7b93892d176e4e6c4639da0cd71bc7ce8a9a32194a7f45c1b79ea1b50299d18c0637aa971a972eb7ee38c62907464b6aac39c0816

Download Submit
C:\Windows\{A6351679-9986-4b7c-9FE7-11D33B4545AE}.exe

Filesize
204KB

MD5
669258618386d0c543ef162e8ecd5a3f

SHA1
e57938de3fb8b9492ba6ab62835509c8703f3325

SHA256
acc1970af8781269e73c31c0acfb53a79369b6b43b3bacad38b53c1535068d4e

SHA512
6c94ba2dcf75e2d66cfbb08d4ab29bc111101ce0781ce7e192e6090bebd46daad4843b46fc7681ba4d81e811ca30c1922c167193b37e1665e0e7fff05d240937

Download Submit
C:\Windows\{C647815B-EBF0-4336-8096-DE83D4DD8A80}.exe

Filesize
204KB

MD5
c0c9d93f91a022d23a0119d5bd149992

SHA1
026b869b2c2ed3207eca4f1be094dc4d3427ec84

SHA256
8ea7975dc22e5e07f76a64b3a228522845a0541322c3949a6ddd923424bad584

SHA512
42762c5d85878e12f1b1668b06022e98b0716a942ef7fe097bf8e665f82fa92cd27f99244dde36752060b412e1561dff77ebb2cf3370ec99316391efce39941d

Download Submit
C:\Windows\{C7A62CBB-F0B5-46a7-8D72-AA027E11FF5D}.exe

Filesize
204KB

MD5
78734aabfc0c71df7ed03288a276f52d

SHA1
f322252044e6b6cd8afe2a6991666c8bff4511f4

SHA256
da1c08348415a8bb6c8c778b355a0a40e4752047136b0b0bfbb21b3b69091df7

SHA512
98bfe2b568180936de8ac2703489734b15e86cb3cef30e43fedccd6e4d7d4c8f597c2f500ae65c9a4d8db6cc6754ac2ce6e64a93fc3f1078d6a2f77739a10df9

Download Submit
C:\Windows\{E02D3ADD-CD2F-4889-A283-82DD2AE61CE6}.exe

Filesize
204KB

MD5
dedcf5f8b8972022c44b53bcbc78a23f

SHA1
13255650500769d5517cd85da86ad4d43872993a

SHA256
6d275b9168a94d7c9665f2879aae6f9e207aa909ac9548680e3c88bdf632a8be

SHA512
ceadfddd1b074af306c326ad5c2ecd1a13bc6a85433b7e5ae20cff2881b01bfbee28f69e336ea101780fc7e3b20ede7e51556ab56afc352b9bee6a3a11c7892c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads