4c00122619923c9063862cdf89e238f9cfa8d931224fc687b0069a780a84ca40

Analysis

max time kernel
149s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Size

197KB
MD5

857d91c625b67d4a6f3e670e8932b4a8
SHA1

218ab8bee6ee1e4499aa701fc3a0b4c52e7096a2
SHA256

4c00122619923c9063862cdf89e238f9cfa8d931224fc687b0069a780a84ca40
SHA512

19c80f633fdbfd13c8e198e5c881b63c530c04cc7867f8ffbf31bb3bdbe67952603fa1c732c5624b3afe2f577bc8ea99117e751817b166a4361858a6c0dca61c
SSDEEP

3072:jEGh0ogl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG+lEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000e000000023b90-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023b96-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00180000000239ca-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023a49-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023b9e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023a13-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0027000000023a40-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0014000000023a13-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0028000000023a40-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0015000000023a13-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0029000000023a40-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0016000000023a13-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B11040F-1062-4601-81E7-452EF4925AD4}\stubpath = "C:\\Windows\\{7B11040F-1062-4601-81E7-452EF4925AD4}.exe"	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}\stubpath = "C:\\Windows\\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe"	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FEAE160-AA13-4fb3-8590-5285177E4B28}\stubpath = "C:\\Windows\\{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe"	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}\stubpath = "C:\\Windows\\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}.exe"	{029E9221-6479-4f4e-85B0-AC395C46C358}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6939073D-6028-4e89-888C-0DC7C04B3713}\stubpath = "C:\\Windows\\{6939073D-6028-4e89-888C-0DC7C04B3713}.exe"	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}\stubpath = "C:\\Windows\\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe"	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{029E9221-6479-4f4e-85B0-AC395C46C358}\stubpath = "C:\\Windows\\{029E9221-6479-4f4e-85B0-AC395C46C358}.exe"	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6939073D-6028-4e89-888C-0DC7C04B3713}	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{029E9221-6479-4f4e-85B0-AC395C46C358}	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}\stubpath = "C:\\Windows\\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe"	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FEAE160-AA13-4fb3-8590-5285177E4B28}	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}\stubpath = "C:\\Windows\\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe"	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}\stubpath = "C:\\Windows\\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe"	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B11040F-1062-4601-81E7-452EF4925AD4}	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}\stubpath = "C:\\Windows\\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe"	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B1A7896-2234-473a-AE30-DEF44C571863}	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B1A7896-2234-473a-AE30-DEF44C571863}\stubpath = "C:\\Windows\\{3B1A7896-2234-473a-AE30-DEF44C571863}.exe"	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}	{029E9221-6479-4f4e-85B0-AC395C46C358}.exe

Executes dropped EXE 12 IoCs

pid	Process
3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
3620	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe
3016	{029E9221-6479-4f4e-85B0-AC395C46C358}.exe
1420	{44FDEED2-4812-4f42-AC3A-7EE078210DDD}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
File created	C:\Windows\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
File created	C:\Windows\{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
File created	C:\Windows\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
File created	C:\Windows\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}.exe	{029E9221-6479-4f4e-85B0-AC395C46C358}.exe
File created	C:\Windows\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
File created	C:\Windows\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
File created	C:\Windows\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
File created	C:\Windows\{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
File created	C:\Windows\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
File created	C:\Windows\{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
File created	C:\Windows\{029E9221-6479-4f4e-85B0-AC395C46C358}.exe	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
Token: SeIncBasePriorityPrivilege	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
Token: SeIncBasePriorityPrivilege	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
Token: SeIncBasePriorityPrivilege	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
Token: SeIncBasePriorityPrivilege	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
Token: SeIncBasePriorityPrivilege	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
Token: SeIncBasePriorityPrivilege	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
Token: SeIncBasePriorityPrivilege	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
Token: SeIncBasePriorityPrivilege	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
Token: SeIncBasePriorityPrivilege	3620	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe
Token: SeIncBasePriorityPrivilege	3016	{029E9221-6479-4f4e-85B0-AC395C46C358}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3216	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	88
PID 2836 wrote to memory of 3216	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	88
PID 2836 wrote to memory of 3216	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	88
PID 2836 wrote to memory of 1960	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	89
PID 2836 wrote to memory of 1960	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	89
PID 2836 wrote to memory of 1960	2836	2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe	89
PID 3216 wrote to memory of 2380	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	90
PID 3216 wrote to memory of 2380	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	90
PID 3216 wrote to memory of 2380	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	90
PID 3216 wrote to memory of 4624	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	91
PID 3216 wrote to memory of 4624	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	91
PID 3216 wrote to memory of 4624	3216	{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe	91
PID 2380 wrote to memory of 4940	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	95
PID 2380 wrote to memory of 4940	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	95
PID 2380 wrote to memory of 4940	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	95
PID 2380 wrote to memory of 3636	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	96
PID 2380 wrote to memory of 3636	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	96
PID 2380 wrote to memory of 3636	2380	{6939073D-6028-4e89-888C-0DC7C04B3713}.exe	96
PID 4940 wrote to memory of 4108	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	101
PID 4940 wrote to memory of 4108	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	101
PID 4940 wrote to memory of 4108	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	101
PID 4940 wrote to memory of 388	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	102
PID 4940 wrote to memory of 388	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	102
PID 4940 wrote to memory of 388	4940	{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe	102
PID 4108 wrote to memory of 2820	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	104
PID 4108 wrote to memory of 2820	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	104
PID 4108 wrote to memory of 2820	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	104
PID 4108 wrote to memory of 4628	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	105
PID 4108 wrote to memory of 4628	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	105
PID 4108 wrote to memory of 4628	4108	{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe	105
PID 2820 wrote to memory of 3768	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	107
PID 2820 wrote to memory of 3768	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	107
PID 2820 wrote to memory of 3768	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	107
PID 2820 wrote to memory of 2104	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	108
PID 2820 wrote to memory of 2104	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	108
PID 2820 wrote to memory of 2104	2820	{7B11040F-1062-4601-81E7-452EF4925AD4}.exe	108
PID 3768 wrote to memory of 1756	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	109
PID 3768 wrote to memory of 1756	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	109
PID 3768 wrote to memory of 1756	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	109
PID 3768 wrote to memory of 2144	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	110
PID 3768 wrote to memory of 2144	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	110
PID 3768 wrote to memory of 2144	3768	{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe	110
PID 1756 wrote to memory of 4416	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	111
PID 1756 wrote to memory of 4416	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	111
PID 1756 wrote to memory of 4416	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	111
PID 1756 wrote to memory of 1028	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	112
PID 1756 wrote to memory of 1028	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	112
PID 1756 wrote to memory of 1028	1756	{3B1A7896-2234-473a-AE30-DEF44C571863}.exe	112
PID 4416 wrote to memory of 5032	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	113
PID 4416 wrote to memory of 5032	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	113
PID 4416 wrote to memory of 5032	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	113
PID 4416 wrote to memory of 2372	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	114
PID 4416 wrote to memory of 2372	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	114
PID 4416 wrote to memory of 2372	4416	{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe	114
PID 5032 wrote to memory of 3620	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	115
PID 5032 wrote to memory of 3620	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	115
PID 5032 wrote to memory of 3620	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	115
PID 5032 wrote to memory of 2524	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	116
PID 5032 wrote to memory of 2524	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	116
PID 5032 wrote to memory of 2524	5032	{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe	116
PID 3620 wrote to memory of 3016	3620	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe	117
PID 3620 wrote to memory of 3016	3620	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe	117
PID 3620 wrote to memory of 3016	3620	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe	117
PID 3620 wrote to memory of 4272	3620	{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_857d91c625b67d4a6f3e670e8932b4a8_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
  C:\Windows\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
    C:\Windows\{6939073D-6028-4e89-888C-0DC7C04B3713}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
      C:\Windows\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
        
        C:\Windows\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4108
      - C:\Windows\{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
        
        C:\Windows\{7B11040F-1062-4601-81E7-452EF4925AD4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
        
        C:\Windows\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
        
        C:\Windows\{3B1A7896-2234-473a-AE30-DEF44C571863}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
        
        C:\Windows\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
        
        C:\Windows\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe
        
        C:\Windows\{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\{029E9221-6479-4f4e-85B0-AC395C46C358}.exe
        
        C:\Windows\{029E9221-6479-4f4e-85B0-AC395C46C358}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
        
        C:\Windows\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}.exe
        
        C:\Windows\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}.exe
        13⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{029E9~1.EXE > nul
        13⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FEAE~1.EXE > nul
        12⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50FD0~1.EXE > nul
        11⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9CCD7~1.EXE > nul
        10⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B1A7~1.EXE > nul
        9⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADC53~1.EXE > nul
        8⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B110~1.EXE > nul
        7⤵
        
        PID:2104
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E168~1.EXE > nul
        6⤵
        
        PID:4628
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DF44E~1.EXE > nul
        5⤵
        
        PID:388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{69390~1.EXE > nul
      4⤵
      PID:3636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{43CED~1.EXE > nul
    3⤵
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{029E9221-6479-4f4e-85B0-AC395C46C358}.exe

Filesize
197KB

MD5
9e35c346cd3d91eebb0ec2f83340a114

SHA1
10d4a5ab9e426ba9739e1e012d230f0d5b49af0f

SHA256
b4d929d01468d953ba07133926831bdf888d97916ae72af8dddccea37f7014c6

SHA512
418db411bd23ea0bd9ef747585c47630f412b3dbbd4d374beebb60cb7bfeb6d1b35c51ba6f7fad10c841dbf696fec19c8e90b058c6e1ff5f4cb724d3638288ce

Download Submit
C:\Windows\{1FEAE160-AA13-4fb3-8590-5285177E4B28}.exe

Filesize
197KB

MD5
a754bcf1c61036cbe54f2fbddb7b7854

SHA1
f1dbfb9084a603610a2d4e10852cd5c39ff8c6f7

SHA256
436f89606973eb63b8555ee5ce8a5b3b47248bc2dd8a9c1408df645bf8ac4ffa

SHA512
67f78bdc98c37a711073e0bb9dbf277a4fb89b8249bf356f83a8a665a5d47c981eca5ffce49dc6937e4eb2b22e9d3582f575b950dca1ea169662b4a228a20a51

Download Submit
C:\Windows\{3B1A7896-2234-473a-AE30-DEF44C571863}.exe

Filesize
197KB

MD5
e45939b6560782a1ff1192b21f9e423d

SHA1
ec3ffd5ce458bf4fb09751f4dd477432411314d0

SHA256
0b168600018365a86f77d577fa689bae1d59eb49476b7fb37d1c00906e63bd5e

SHA512
6b7fee4de19a103ff4ff69169b473abbc5cfaabd66500bf514a738bc922508c9b856aac0c70ded15a2cf38e7403aa46c1b16b0a3fa2b0e06154898d9b15b429e

Download Submit
C:\Windows\{43CED3BC-73ED-4674-8DA2-2CED1AD5E0D3}.exe

Filesize
197KB

MD5
927e9e399d1a846b73beab2027d1ffe5

SHA1
71edfeff1311b3ef6d3a0acf2c454e84c7fd4adc

SHA256
c8279bc43024b2fb6d422f60b4dcba262187b6a05f940c6cc4d111d0e8a6c4cb

SHA512
c2aa83b5b3b091d57816afea63134795f04aae8c87b8318049bc2b5001de5ee66713c3e943c9c1b21b7efcec2085117d74c7487a74efb00308af05ce9b1e3b54

Download Submit
C:\Windows\{44FDEED2-4812-4f42-AC3A-7EE078210DDD}.exe

Filesize
197KB

MD5
9bafb7358895f15ba704acd1b530c405

SHA1
42e7aed9f71fd0af56eb00b8e2ef7dc35829fb07

SHA256
71f2fa2639e8bfbf163e97d14e6a721d580092a5335d1ea8344a518487850d1b

SHA512
34acd3365bd7276710285794abaadeeb3542f5ae28fdf7dda113bca843cf5fbf3a15d46b5b01589e3b7978ff2d21aeb1794e1c44ded47c07dbf198e819ff6c85

Download Submit
C:\Windows\{4E168911-8FCC-4e73-8F78-3DF7982E1D28}.exe

Filesize
197KB

MD5
328b96b2bfbe9d2b88f6ae833ffbe928

SHA1
a0a2047439f43d43a89606aa35c2d3a9a1d212fb

SHA256
ff49420ccd29376c12ff0f343916240a1cc1aab47393502e3d22015298cf7f93

SHA512
02d4e52f0086ddec16dcf0ca7eb2de9fb5f27a01c4cb89e9290ea248f7606f7921054644cb96f59fb4123bb46bd1dd3bafe859071b73c0d337ebe99a2e61ef13

Download Submit
C:\Windows\{50FD04BD-639A-427a-A0DB-0D8EAA349ECC}.exe

Filesize
197KB

MD5
e8ab4e9819534ab454e1614afea1649c

SHA1
fbffcb94213ef0f76239c75a5fbad5746b09878f

SHA256
2bb4c7efd7602641c35ba3c01d7f5e81f8bf7627c34b4120d31e997c06b9976c

SHA512
b5d765639afaaf27ff965a4be9c165c7a305f31875cde5954732ba63925a068f304ec27ddd28da16df0ff9dbdbc10b18423f6537783276ad6a4b19f5aafe4538

Download Submit
C:\Windows\{6939073D-6028-4e89-888C-0DC7C04B3713}.exe

Filesize
197KB

MD5
9257fc036579ebd2e3e97477fbde087b

SHA1
c750fad064744ddd10eb061886bf16989941a600

SHA256
92404692f643eee11583ce4a958fa42b69b019bde1ce225ce406b606cde7aeba

SHA512
34714f03e745f91e9a85905104353d57539086100b06dd216019d1e9ee4c27707867dd1b588d5879d853b0f1f40dabc6cbcb9558012c80c89e3383e89c2ac299

Download Submit
C:\Windows\{7B11040F-1062-4601-81E7-452EF4925AD4}.exe

Filesize
197KB

MD5
b1bc88b7a815211c86e05511e413d9c1

SHA1
2a8d54c71b5dd86be33a4daefd6bf9697f4b749c

SHA256
02071b39c30f80e9af5e0c077bb84b37209be67f741a0a9ccdcac562c6f704f5

SHA512
dcf1299dc75a7e4c473a8a555db4bd92baf610c4421df2dea7f269d4bdd9e75f1ae0ff967c27718f177a76ce753629f435040dbddf89cee2991a8b2f386aadf5

Download Submit
C:\Windows\{9CCD71E2-10C0-4331-B11C-4DFF3FB5E68F}.exe

Filesize
197KB

MD5
5d3d38fa7f25af898972ae4f511c21fd

SHA1
4c90d09d9883e7ed4340329db523e4608a87a691

SHA256
3c062e02ffb2a3b2209a87090cf75c7469220aaf6f1671a2d263846fd61fb0a5

SHA512
a370b055d28cd0e18dc900f451e94971b51804b5d7bb2e18d57216e44c55101210b344352a4e866f6407666266336d18cc0a4d74ae0a7f7be8f3d0b5c8b51763

Download Submit
C:\Windows\{ADC53D83-DEEE-47b2-B03F-F76DB21B43C7}.exe

Filesize
197KB

MD5
a7e22d1b4f24deb8462be0ca538d6660

SHA1
415091e6283823384ff787829b2eca3fae788c1d

SHA256
2c22d064db0acc9254d267288230cd280ff035cfaa16fec5e8ed57d7ada116ad

SHA512
c7da8ed08d73166974e64c000551ece0a50eff239a95c5f0b3fa5100ea7e9823b64ad7a665042d5bc3c43cbc54b1929646d998cb6308aac9589ef427fe5b949b

Download Submit
C:\Windows\{DF44E349-AEE4-4ad1-9733-D0EA23E375F6}.exe

Filesize
197KB

MD5
c35d3d95d496a0505350415d7cfd0b9c

SHA1
da0134b3dc31a221f118a91e663b1227693116e7

SHA256
694308f0dd2a2af716edc71cadaa37f3e511ee864174accda4d0a87beade90ef

SHA512
528b79c10da146460e1feb98b2325fec9fb8bc7a7e34edd0888e2604415ca06e38b92c02b7b048ac55304d7c7a931cce2a1d473dce4708db8456ba0889453cd8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads