a5c12aa57d0a54471df45aa9c3c039d0a8d12bac883a6707e0dd00de35c6f153

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe
Size

372KB
MD5

e7f1c3896573ef34cb8235b21598ade3
SHA1

e244c0c421a946734209cbd6d1de048234ed482c
SHA256

a5c12aa57d0a54471df45aa9c3c039d0a8d12bac883a6707e0dd00de35c6f153
SHA512

755733376d21f3477935a15a76edea258301e4b42794b4549ba0282dfda2ed7c7e64c19f55fe5d06953ea59d7b789bb13d4ed6dbc0acb07dda048e018d59e4ce
SSDEEP

3072:CEGh0oElMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGSlkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002335a-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233f8-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002340e-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023506-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000200000001e4db-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023507-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001db28-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001db58-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023521-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db58-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db72-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000022985-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}\stubpath = "C:\\Windows\\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe"	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{323CD168-C967-4769-8D46-00CFFA464962}	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{323CD168-C967-4769-8D46-00CFFA464962}\stubpath = "C:\\Windows\\{323CD168-C967-4769-8D46-00CFFA464962}.exe"	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E45ECB32-E87E-4377-81F8-70201D54B405}\stubpath = "C:\\Windows\\{E45ECB32-E87E-4377-81F8-70201D54B405}.exe"	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}\stubpath = "C:\\Windows\\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}.exe"	{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E45ECB32-E87E-4377-81F8-70201D54B405}	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}\stubpath = "C:\\Windows\\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe"	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}\stubpath = "C:\\Windows\\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe"	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AA61394-0718-47fe-9207-274448E10D6D}	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA006A96-D40D-482e-8638-E4DB0906D2DA}	{6AA61394-0718-47fe-9207-274448E10D6D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}\stubpath = "C:\\Windows\\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe"	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}	{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}\stubpath = "C:\\Windows\\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe"	{323CD168-C967-4769-8D46-00CFFA464962}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}	{323CD168-C967-4769-8D46-00CFFA464962}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AA61394-0718-47fe-9207-274448E10D6D}\stubpath = "C:\\Windows\\{6AA61394-0718-47fe-9207-274448E10D6D}.exe"	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA006A96-D40D-482e-8638-E4DB0906D2DA}\stubpath = "C:\\Windows\\{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe"	{6AA61394-0718-47fe-9207-274448E10D6D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}\stubpath = "C:\\Windows\\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe"	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}\stubpath = "C:\\Windows\\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe"	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe

Executes dropped EXE 12 IoCs

pid	Process
2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe
3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe
1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe
3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe
380	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
3660	{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe
2444	{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe
File created	C:\Windows\{6AA61394-0718-47fe-9207-274448E10D6D}.exe	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
File created	C:\Windows\{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	{6AA61394-0718-47fe-9207-274448E10D6D}.exe
File created	C:\Windows\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
File created	C:\Windows\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
File created	C:\Windows\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
File created	C:\Windows\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}.exe	{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe
File created	C:\Windows\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
File created	C:\Windows\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe
File created	C:\Windows\{323CD168-C967-4769-8D46-00CFFA464962}.exe	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
File created	C:\Windows\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	{323CD168-C967-4769-8D46-00CFFA464962}.exe
File created	C:\Windows\{E45ECB32-E87E-4377-81F8-70201D54B405}.exe	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
Token: SeIncBasePriorityPrivilege	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
Token: SeIncBasePriorityPrivilege	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe
Token: SeIncBasePriorityPrivilege	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
Token: SeIncBasePriorityPrivilege	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
Token: SeIncBasePriorityPrivilege	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe
Token: SeIncBasePriorityPrivilege	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
Token: SeIncBasePriorityPrivilege	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe
Token: SeIncBasePriorityPrivilege	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe
Token: SeIncBasePriorityPrivilege	380	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
Token: SeIncBasePriorityPrivilege	3660	{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2968	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe	95
PID 4800 wrote to memory of 2968	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe	95
PID 4800 wrote to memory of 2968	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe	95
PID 4800 wrote to memory of 4620	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe	96
PID 4800 wrote to memory of 4620	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe	96
PID 4800 wrote to memory of 4620	4800	2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe	96
PID 2968 wrote to memory of 4584	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	99
PID 2968 wrote to memory of 4584	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	99
PID 2968 wrote to memory of 4584	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	99
PID 2968 wrote to memory of 3396	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	100
PID 2968 wrote to memory of 3396	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	100
PID 2968 wrote to memory of 3396	2968	{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe	100
PID 4584 wrote to memory of 4348	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	103
PID 4584 wrote to memory of 4348	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	103
PID 4584 wrote to memory of 4348	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	103
PID 4584 wrote to memory of 4316	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	104
PID 4584 wrote to memory of 4316	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	104
PID 4584 wrote to memory of 4316	4584	{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe	104
PID 4348 wrote to memory of 3932	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe	106
PID 4348 wrote to memory of 3932	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe	106
PID 4348 wrote to memory of 3932	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe	106
PID 4348 wrote to memory of 1912	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe	107
PID 4348 wrote to memory of 1912	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe	107
PID 4348 wrote to memory of 1912	4348	{6AA61394-0718-47fe-9207-274448E10D6D}.exe	107
PID 3932 wrote to memory of 3280	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	108
PID 3932 wrote to memory of 3280	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	108
PID 3932 wrote to memory of 3280	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	108
PID 3932 wrote to memory of 632	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	109
PID 3932 wrote to memory of 632	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	109
PID 3932 wrote to memory of 632	3932	{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe	109
PID 3280 wrote to memory of 1012	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	114
PID 3280 wrote to memory of 1012	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	114
PID 3280 wrote to memory of 1012	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	114
PID 3280 wrote to memory of 1888	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	115
PID 3280 wrote to memory of 1888	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	115
PID 3280 wrote to memory of 1888	3280	{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe	115
PID 1012 wrote to memory of 1700	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	116
PID 1012 wrote to memory of 1700	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	116
PID 1012 wrote to memory of 1700	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	116
PID 1012 wrote to memory of 4472	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	117
PID 1012 wrote to memory of 4472	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	117
PID 1012 wrote to memory of 4472	1012	{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe	117
PID 1700 wrote to memory of 1264	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	118
PID 1700 wrote to memory of 1264	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	118
PID 1700 wrote to memory of 1264	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	118
PID 1700 wrote to memory of 5004	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	119
PID 1700 wrote to memory of 5004	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	119
PID 1700 wrote to memory of 5004	1700	{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe	119
PID 1264 wrote to memory of 3380	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe	124
PID 1264 wrote to memory of 3380	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe	124
PID 1264 wrote to memory of 3380	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe	124
PID 1264 wrote to memory of 3096	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe	125
PID 1264 wrote to memory of 3096	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe	125
PID 1264 wrote to memory of 3096	1264	{323CD168-C967-4769-8D46-00CFFA464962}.exe	125
PID 3380 wrote to memory of 380	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	130
PID 3380 wrote to memory of 380	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	130
PID 3380 wrote to memory of 380	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	130
PID 3380 wrote to memory of 1492	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	131
PID 3380 wrote to memory of 1492	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	131
PID 3380 wrote to memory of 1492	3380	{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe	131
PID 380 wrote to memory of 3660	380	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe	132
PID 380 wrote to memory of 3660	380	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe	132
PID 380 wrote to memory of 3660	380	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe	132
PID 380 wrote to memory of 1904	380	{E45ECB32-E87E-4377-81F8-70201D54B405}.exe	133

C:\Users\Admin\AppData\Local\Temp\2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_e7f1c3896573ef34cb8235b21598ade3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
  C:\Windows\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
    C:\Windows\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\{6AA61394-0718-47fe-9207-274448E10D6D}.exe
      C:\Windows\{6AA61394-0718-47fe-9207-274448E10D6D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\Windows\{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
        
        C:\Windows\{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3932
      - C:\Windows\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
        
        C:\Windows\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe
        
        C:\Windows\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
        
        C:\Windows\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\{323CD168-C967-4769-8D46-00CFFA464962}.exe
        
        C:\Windows\{323CD168-C967-4769-8D46-00CFFA464962}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe
        
        C:\Windows\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
        
        C:\Windows\{E45ECB32-E87E-4377-81F8-70201D54B405}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe
        
        C:\Windows\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
        
        C:\Windows\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}.exe
        
        C:\Windows\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}.exe
        13⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA54C~1.EXE > nul
        13⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E45EC~1.EXE > nul
        12⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A4A2~1.EXE > nul
        11⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{323CD~1.EXE > nul
        10⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A6A6~1.EXE > nul
        9⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0EDE8~1.EXE > nul
        8⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AD454~1.EXE > nul
        7⤵
        
        PID:1888
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA006~1.EXE > nul
        6⤵
        
        PID:632
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6AA61~1.EXE > nul
        5⤵
        
        PID:1912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A3933~1.EXE > nul
      4⤵
      PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E6256~1.EXE > nul
    3⤵
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0EDE82AF-A64C-4490-8F58-381E243B0DB4}.exe

Filesize
372KB

MD5
b72a76c3168180b8826a63e330caf9cb

SHA1
67651fe98c4a86c763a6db625df4ef098a32488f

SHA256
35cd99a6e369bb0c87c6f18a9740054853190aff2b68ea648e40f4a81fbdfcfc

SHA512
98b89fd47995e56710c8c534f3c5161dec2d438d831a9ad0658f4ea308687fdd531f63c87b264544df844bf7dabc8a0bbd654a7019df765f028ab6ada781bcf3

Download Submit
C:\Windows\{2A6A6B0C-0AF2-4726-94ED-9B6C60A58C58}.exe

Filesize
372KB

MD5
57679ccece2162ac47b2626d51d5f2c7

SHA1
6d4ef5738f7ba8259cc99c4a5f897508cc7dfbab

SHA256
f2f632c11a3016184588c22604c50a73424b5eaffa5aab4c59deebbe02db7bcd

SHA512
ae3e31f055cbbbea3a4aa74f77fc1f3801eafef5e4eae35a8b8b7518cb14fbc2e90db1a285f9b602debd2b98640107b30e7b72d9091b5637df6fa92e655954ce

Download Submit
C:\Windows\{323CD168-C967-4769-8D46-00CFFA464962}.exe

Filesize
372KB

MD5
8bc41ed07a2bc511a46afafbc5b18b4d

SHA1
0d5ee475b570d7dec20edf63cb926712601c78bb

SHA256
3a79ece5b23646793c85f30400de3ee1510d9036ee8e0ab389f2619b9dc34ad2

SHA512
fc6f6f7a10cdb9fa7e6f1f0d050049e682587fbae19fb18f645a8f0e5b01134b4be7097b12ed3687f31a1fe70192bd69d65d748206f0e6c0e516c163f3cbf44a

Download Submit
C:\Windows\{6AA61394-0718-47fe-9207-274448E10D6D}.exe

Filesize
372KB

MD5
4012e0c895224f65a601c0b831950695

SHA1
293df117c1e974d6799fa7571c9a96ccb6d0a602

SHA256
69585496a9243beb97a1fc4da633d262672ea4705a3d80aac4cd01c8414a2970

SHA512
2562a83a1317210b01589360aca81b63443ce4bf907ac8331f7e467e1c76c2877e02b4dce6f860029b4e0e1be61b0b0e05ab467bba9a818af4621022c0382a15

Download Submit
C:\Windows\{9A4A2B8F-F1B2-4e3e-998E-D64A710EDF2D}.exe

Filesize
372KB

MD5
6089032b0e8279db8a7a3fbf2be9665f

SHA1
f2960058216016d20131abdd83b88cf293ddc944

SHA256
0519eb7ff4bbeac42aaabfae2eefaa9fc1a06485fe23fe56121ef063d47bbbf0

SHA512
6cb0fcece4fc38bbd83f51702f78afbe8a6f1d960e9411713e5ea041b3a5cd998fba2bece8ae20ee9f62ca47fafc11539456daa464950642509b75c059f97df5

Download Submit
C:\Windows\{A393395E-28D5-43fb-8EBC-F2A53725E2D9}.exe

Filesize
372KB

MD5
d2bbeea92e5bbbf4044e1c347a791442

SHA1
18a3e241c864e4b439e7398cc804cf5b959482f8

SHA256
72dc93c16a4baed1f50a5400ef8b83e2aa4f7e60f2298895bcfd67ddee14b781

SHA512
a0c7208b285ffdc520f2d905982994a5fec9b2fccf5f1a75cde26aa43ca7beeac9b11464d8505ef5d69f1f23736753fa874e86ffd8c74cef6537f09c2d51a612

Download Submit
C:\Windows\{AD4544EC-81DA-4522-B384-52F13DFBC6D7}.exe

Filesize
372KB

MD5
b31c1b84e7af713ba98831ee3e5b96cb

SHA1
5b1c085b212d4555f6bb39c2a5f334d9f2f8b8f2

SHA256
034f2148a1b3bcdf41004cf022af0606ea047711c90e7b8d239c4ca0dca82628

SHA512
ee93bee1a08e72a3ae435fda01c9c684216235ac1d572e63fdf290e94a52712b26d6e9a03dfc990becc2c696c4d1b10ec9dabc8123d6452fd926e23a5cd0c700

Download Submit
C:\Windows\{CA006A96-D40D-482e-8638-E4DB0906D2DA}.exe

Filesize
372KB

MD5
ace5fafcf3bee977f41bc7412f6a85a4

SHA1
18b4871f7d22d2a9e89dd9fcb8590ea634ba47aa

SHA256
c10d7e4ed161a196af838f24702828f2208308213cd862c7166124fce5b3c386

SHA512
6d6721c2276c25028baa2194399dc593c1d3f481924901c800140a33ed7baf4817e32d736a159dec158f3ed9cd263760491df06ef42e9997070d955f59ea223b

Download Submit
C:\Windows\{DCA0E4E2-16F3-40f7-BDA0-1BDEE62DA470}.exe

Filesize
372KB

MD5
646d4240d9a54a13f2cd450873504669

SHA1
45d1187f2e74dafe2d0b59e943a5f9f5a20108d8

SHA256
6410ba898a9495c729cae727daae8eb40082b207e41ca4d049a2bbf8f8165541

SHA512
502c7ad2d714f05b07ca9607ca5837b2bca3b5237237fef7aa0cba9c3de728a9866f390231e3862c72da94b839faedc46e329af89ba30bb197bf4a95717b5f56

Download Submit
C:\Windows\{E45ECB32-E87E-4377-81F8-70201D54B405}.exe

Filesize
372KB

MD5
597ba6706aa5c0a5e570c34200137028

SHA1
33f0f3e36c8aedfedb8873d36fc607c3e65a363c

SHA256
cf51752f7702ab3cbc8fa7d09eaf47b167559e05040022aea45bbe7ce2c2ea97

SHA512
29479ce34f14ec645cdce553a2c929fdaad463bfbc62a8cd99b35119d84ad115d47edb9cf2ce967d2d60bb8b5d06b9262522c7c0ba5805391310a85356787771

Download Submit
C:\Windows\{E6256916-B069-4bcb-9CE5-7F5B7BC62D01}.exe

Filesize
372KB

MD5
cc73028fec803dffa13a41b7b883d0d0

SHA1
ad105458065863725e71369bd387b2138ebf1d6d

SHA256
b99d8dca23fc99a600a10443591e326e19e3db7714eb12f596453f9381f63ee4

SHA512
5cc5c262c283ec21c37540bfc92dd5851c0ba627647d155f3503a38411ad7f1a8b882b14a4d02dbe41f7319f2d6c25682f7b8b7dd057cdcdf8bc277e42770f74

Download Submit
C:\Windows\{FA54C8CD-C277-430a-B8A6-B8BFE6F65058}.exe

Filesize
372KB

MD5
6a319addc66c0839fdffed9b5d5cabac

SHA1
7e89207d17455f144780da915d86bb0b9b3b7ec9

SHA256
67316b1a124a037419838341ac8a4b9f354f3ee304fec352366f9af79515d76e

SHA512
5b785ad8dd694dd263cccb76e3e27ec9601104ff314351e05b37d651f7fb5596646664d4bc3c5f62f470a6d8276868060ccebea9c17f38d0a829ca43310dba90

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads