78d320e633b10211de023005590ca1979a1df04433a974d2c97ed68075d46d38

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe
Size

408KB
MD5

9f13e057abeea18150362726c2f01e98
SHA1

b1202caa194d5b1a59452e51d9021c620a79f45a
SHA256

78d320e633b10211de023005590ca1979a1df04433a974d2c97ed68075d46d38
SHA512

f2239f07c8c511a44bbb9469d72f50e334cfcac1754c4480b10cc56fa7634dded4f62dae14d3b3e4000ae8ca6b69f2f3651e419c937b1b72e4489632c86e95c0
SSDEEP

3072:CEGh0ovl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGBldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023240-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023245-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023253-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023245-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023253-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219e9-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219ea-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000000026-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000000070d-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}	{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}\stubpath = "C:\\Windows\\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe"	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C27E9E05-6695-4e07-B936-24ACD2E51707}	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}\stubpath = "C:\\Windows\\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe"	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5A0D6E-B691-4fd2-A077-9900BF242971}	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A948C7C1-0456-420f-9835-A567553D281E}\stubpath = "C:\\Windows\\{A948C7C1-0456-420f-9835-A567553D281E}.exe"	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C27E9E05-6695-4e07-B936-24ACD2E51707}\stubpath = "C:\\Windows\\{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe"	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5AC59C2-195B-4565-857B-EFF61498DA8D}	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}\stubpath = "C:\\Windows\\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe"	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5A0D6E-B691-4fd2-A077-9900BF242971}\stubpath = "C:\\Windows\\{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe"	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}\stubpath = "C:\\Windows\\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}.exe"	{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A948C7C1-0456-420f-9835-A567553D281E}	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}\stubpath = "C:\\Windows\\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe"	{A948C7C1-0456-420f-9835-A567553D281E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}\stubpath = "C:\\Windows\\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe"	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}\stubpath = "C:\\Windows\\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe"	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5AC59C2-195B-4565-857B-EFF61498DA8D}\stubpath = "C:\\Windows\\{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe"	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}	{A948C7C1-0456-420f-9835-A567553D281E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EE3C71-FE64-40dc-96E1-14C160C9094B}	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EE3C71-FE64-40dc-96E1-14C160C9094B}\stubpath = "C:\\Windows\\{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe"	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe

Executes dropped EXE 12 IoCs

pid	Process
2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe
4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe
988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
3476	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
3128	{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe
4660	{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
File created	C:\Windows\{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
File created	C:\Windows\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
File created	C:\Windows\{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
File created	C:\Windows\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
File created	C:\Windows\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	{A948C7C1-0456-420f-9835-A567553D281E}.exe
File created	C:\Windows\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe
File created	C:\Windows\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
File created	C:\Windows\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
File created	C:\Windows\{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
File created	C:\Windows\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}.exe	{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe
File created	C:\Windows\{A948C7C1-0456-420f-9835-A567553D281E}.exe	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe
Token: SeIncBasePriorityPrivilege	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
Token: SeIncBasePriorityPrivilege	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe
Token: SeIncBasePriorityPrivilege	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
Token: SeIncBasePriorityPrivilege	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
Token: SeIncBasePriorityPrivilege	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
Token: SeIncBasePriorityPrivilege	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
Token: SeIncBasePriorityPrivilege	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
Token: SeIncBasePriorityPrivilege	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
Token: SeIncBasePriorityPrivilege	3476	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
Token: SeIncBasePriorityPrivilege	3128	{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2772	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe	90
PID 4140 wrote to memory of 2772	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe	90
PID 4140 wrote to memory of 2772	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe	90
PID 4140 wrote to memory of 5084	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe	91
PID 4140 wrote to memory of 5084	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe	91
PID 4140 wrote to memory of 5084	4140	2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe	91
PID 2772 wrote to memory of 4252	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe	97
PID 2772 wrote to memory of 4252	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe	97
PID 2772 wrote to memory of 4252	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe	97
PID 2772 wrote to memory of 1952	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe	98
PID 2772 wrote to memory of 1952	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe	98
PID 2772 wrote to memory of 1952	2772	{A948C7C1-0456-420f-9835-A567553D281E}.exe	98
PID 4252 wrote to memory of 2516	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	102
PID 4252 wrote to memory of 2516	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	102
PID 4252 wrote to memory of 2516	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	102
PID 4252 wrote to memory of 3564	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	103
PID 4252 wrote to memory of 3564	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	103
PID 4252 wrote to memory of 3564	4252	{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe	103
PID 2516 wrote to memory of 988	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	105
PID 2516 wrote to memory of 988	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	105
PID 2516 wrote to memory of 988	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	105
PID 2516 wrote to memory of 3352	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	106
PID 2516 wrote to memory of 3352	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	106
PID 2516 wrote to memory of 3352	2516	{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe	106
PID 988 wrote to memory of 452	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	107
PID 988 wrote to memory of 452	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	107
PID 988 wrote to memory of 452	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	107
PID 988 wrote to memory of 3896	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	108
PID 988 wrote to memory of 3896	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	108
PID 988 wrote to memory of 3896	988	{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe	108
PID 452 wrote to memory of 4680	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	109
PID 452 wrote to memory of 4680	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	109
PID 452 wrote to memory of 4680	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	109
PID 452 wrote to memory of 4860	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	110
PID 452 wrote to memory of 4860	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	110
PID 452 wrote to memory of 4860	452	{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe	110
PID 4680 wrote to memory of 1836	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	111
PID 4680 wrote to memory of 1836	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	111
PID 4680 wrote to memory of 1836	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	111
PID 4680 wrote to memory of 2656	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	112
PID 4680 wrote to memory of 2656	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	112
PID 4680 wrote to memory of 2656	4680	{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe	112
PID 1836 wrote to memory of 2748	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	113
PID 1836 wrote to memory of 2748	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	113
PID 1836 wrote to memory of 2748	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	113
PID 1836 wrote to memory of 3532	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	114
PID 1836 wrote to memory of 3532	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	114
PID 1836 wrote to memory of 3532	1836	{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe	114
PID 2748 wrote to memory of 1112	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	115
PID 2748 wrote to memory of 1112	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	115
PID 2748 wrote to memory of 1112	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	115
PID 2748 wrote to memory of 4672	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	116
PID 2748 wrote to memory of 4672	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	116
PID 2748 wrote to memory of 4672	2748	{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe	116
PID 1112 wrote to memory of 3476	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	117
PID 1112 wrote to memory of 3476	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	117
PID 1112 wrote to memory of 3476	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	117
PID 1112 wrote to memory of 4988	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	118
PID 1112 wrote to memory of 4988	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	118
PID 1112 wrote to memory of 4988	1112	{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe	118
PID 3476 wrote to memory of 3128	3476	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe	119
PID 3476 wrote to memory of 3128	3476	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe	119
PID 3476 wrote to memory of 3128	3476	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe	119
PID 3476 wrote to memory of 5064	3476	{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe	120

C:\Users\Admin\AppData\Local\Temp\2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_9f13e057abeea18150362726c2f01e98_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\{A948C7C1-0456-420f-9835-A567553D281E}.exe
  C:\Windows\{A948C7C1-0456-420f-9835-A567553D281E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
    C:\Windows\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe
      C:\Windows\{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
        
        C:\Windows\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:988
      - C:\Windows\{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
        
        C:\Windows\{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
        
        C:\Windows\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
        
        C:\Windows\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
        
        C:\Windows\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
        
        C:\Windows\{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
        
        C:\Windows\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe
        
        C:\Windows\{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
        
        C:\Windows\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}.exe
        
        C:\Windows\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}.exe
        13⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2B5A0~1.EXE > nul
        13⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3448E~1.EXE > nul
        12⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F5AC5~1.EXE > nul
        11⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A3F4~1.EXE > nul
        10⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E2B0~1.EXE > nul
        9⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F61F~1.EXE > nul
        8⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C27E9~1.EXE > nul
        7⤵
        
        PID:4860
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B3DC9~1.EXE > nul
        6⤵
        
        PID:3896
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{86EE3~1.EXE > nul
        5⤵
        
        PID:3352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{096EF~1.EXE > nul
      4⤵
      PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A948C~1.EXE > nul
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{096EFFA6-F6D5-4ccd-9744-B8295A08019E}.exe

Filesize
408KB

MD5
32dd596d482ec26d23ed29a2036615de

SHA1
e2cb98b1bebff3b403de6aabf11f94da66b3a6a7

SHA256
ffeada717593fa90ec1f53352216287b6368f8b14fd5bce0f24fbbec2854bf6d

SHA512
52716bddeb25bf657bd29f142f43500d238778b5553bd923423733c2f242977e13e9bebf05638d58824f5412fc27ce97991d1c6eea40cf6f7cb116d31af3224c

Download Submit
C:\Windows\{2B5A0D6E-B691-4fd2-A077-9900BF242971}.exe

Filesize
408KB

MD5
bb5e4a595d190da5be33b444840ed81f

SHA1
5b373a443571627ff9fe349fd81ebcb430aae1df

SHA256
59217bdb54f267154abddf642fdb184c1b55d546da5445341333c3a482334917

SHA512
d058be38f33fdcebcf87907eda4ba2e050523d46298c5a97433f8d685fd8999666c7f9a10db2ca110ab2abd3fabbae0db9613cf4b535b0cb6ab47be9157a5182

Download Submit
C:\Windows\{3448E3EC-AA7B-4085-855C-1DBB2E3EA641}.exe

Filesize
408KB

MD5
3f35e2188f74dee4098def75cd7af4f4

SHA1
02a5fbd4245d73a4fd41016b624cbe64ca0c1ba8

SHA256
3e755bb49e3052067c2f8207e43a3c2138b7035c73e1bdbdfbf2b62741ab4bdd

SHA512
116eaf0f4817d1109fd1f27191f6cfb105a8dff13dc51be9f9128bd8c1c1a52d11ee6091a92dd413977c3960c30a0e367d2c8ba10b679b3772d82981684efddb

Download Submit
C:\Windows\{6A3F4E34-CF1B-481d-99FA-537EC0AC360A}.exe

Filesize
408KB

MD5
89d47a0168738a018063b285ae4c16a5

SHA1
be4b2f544919539bb31f1d81b1a2e289d2aaa38e

SHA256
17f1975820766d24bcb38b68a24d2c15c12eb924ef182b52b845d29358146c7e

SHA512
22666dd769e424dc30b7182ac2566cda2efb24443d7ee9711c6400d40fc704ceda461b0d2054620c496e44bcddb4db75198d99789c4cbfaf5d944bbb821167d7

Download Submit
C:\Windows\{6F61F833-C3BB-40ae-A35C-0BCF5DF35896}.exe

Filesize
408KB

MD5
1cc5f0e1ed27962dcb5d334aaa14fee0

SHA1
6f5479086762db1b3ec1126f3c17bed5b8fbba4f

SHA256
c865b864d0d665a7c31a24cf3e35fb6b8ead11a4e0901a71f31bf4c1e8eb1174

SHA512
893b2d47c0ea26238203a5d43a7cbb9312e6a33ff5838a0d0797ebeb4c69da56fb61c3407270467159ed45346026af727c0c6d7233e1072a021770fda95ebeee

Download Submit
C:\Windows\{86EE3C71-FE64-40dc-96E1-14C160C9094B}.exe

Filesize
408KB

MD5
5ad4495413a092bebbcc6fb2b00a3762

SHA1
e9481240f7de9771958fd16bf6350fe5e5725eb1

SHA256
b4a39b843f8b300bac647faa8366bc937ffc705a6fe204378417897058690c1a

SHA512
c4c5c7ad955cd3146dd4873be67ab7da7d60e7ed7aa4066d6cf43ab50d7946d413b8df719abe6384aea4ce352906aed08dfb1940a4ff130daca8b78a57ab789f

Download Submit
C:\Windows\{9E2B0F0A-D315-4fe1-93BB-CEF70F828324}.exe

Filesize
408KB

MD5
6a571cc5997fd47096589cd2aa4a3cf0

SHA1
bb02ccc425509329d010af6198191c5042db6698

SHA256
0da8c1f6293e8033752b51e06d123ee63065d5634f066f06f6f09e8f0bb2bb76

SHA512
cc63a43cdd8ff4a42fa0c2a8b9f9b1a314b6459249d4f97cec308cdd6c59b355faf4cc3d142e9011dfd00a848060923a188ff5533b7b8724a20b4d38e7757856

Download Submit
C:\Windows\{A948C7C1-0456-420f-9835-A567553D281E}.exe

Filesize
408KB

MD5
5fcdb54cba70d2120c234fe35f70a4b8

SHA1
9d2b94c5b8c613fcbe7b2d321d1c052a1da30606

SHA256
78b8b50683051296bd1ac08a3c689682284b0be88bcb66b5c393d78649f0a369

SHA512
d9a30744dc8d8938e94eb7b6c46b194bdfb588131d4193a4fd138bf57368d101d3b7ccf1ba25d114116e0e26e0af1732db8f617e376b3cb61d97305a06068fce

Download Submit
C:\Windows\{B3DC9073-D1A8-4670-A4C6-D6E63525EC42}.exe

Filesize
408KB

MD5
2b7a5c3eee586f7615587759a68ad6a6

SHA1
6c659037cbd48c8bfcaa6b896d5b87e78fa83714

SHA256
3dd0a927861146ac3f53ea514245f335b358951172a871326864d899338eb2b3

SHA512
83b12f8baaf0586587d3139cc5d2dbab6421ff3606f277176ad54be848574e3360708b167489f6cbd16f7b3dae749e8c2cee67ac8fda5ec4c11545d8ef7fe1c9

Download Submit
C:\Windows\{C27E9E05-6695-4e07-B936-24ACD2E51707}.exe

Filesize
408KB

MD5
10c4bca65f3ffcf15fb1272864a35292

SHA1
16d3983db4bd77b8f3805da9ce303f359a6b9dbc

SHA256
ddd94b449010d0c9bf873fd1e24b559289fca50edaeef611b64ed46af263b570

SHA512
a4bd5a36ebb022dbe1f840cf2f98ede76971d8172bc64f1f48a0de6cedf7c01831d16777ebe04f89493766882dd0b14f75098a59c4a02ac8fe9d4759927d2a13

Download Submit
C:\Windows\{F5AC59C2-195B-4565-857B-EFF61498DA8D}.exe

Filesize
408KB

MD5
f2c5d0bf02945535f3f30fa5a40e43c2

SHA1
d253c1ad61a8904bc6c3370f1e07336300cf1b4b

SHA256
1e7e6112f61f3311c42473f79b6e39f05743a3b130c4d8f2ddc5fe46494510e2

SHA512
be454960a9c7d89ad87da3c348463e1dab9d14585c570b477abc615b92da58ecf2e28538afb654d892e5cc5eef722b53002b730d6033fad21879c95b3719afcf

Download Submit
C:\Windows\{FA6C8600-8DD4-40cb-834F-7C7A211E3C5A}.exe

Filesize
408KB

MD5
d8442af12945f3479920d541408c05f3

SHA1
3901ec0375ad9814aa533eefee649c0f910d3a32

SHA256
7be1955d7babeafacf9219490bd9957ebcc8da2a1cf92bec67aa7c38f2dd819e

SHA512
b006adec34cb7bb664c340dbcb577f1796ab661cb8c87065d41f75a70fb436cb30b977339766407035b3981e10d4f4295e4afa21f8044d22972e9da21411f80c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads