dd46791d814092e05c038466f15fe0f1e42d3d3ac970b9303818c285d7540b98

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe
Size

344KB
MD5

0a0efc974b1ac4880f1a20096083d274
SHA1

9cee64ef5cf546c9a271194d1fc054fdbc15d294
SHA256

dd46791d814092e05c038466f15fe0f1e42d3d3ac970b9303818c285d7540b98
SHA512

cd8fe0de04c06add65e9e027816681d5a3979938550a0e5359e438d0be6d14b27061e1b337fd3972dcb5f205097a5c98def734b4fe3b99aebf3fa0d3b799d9ef
SSDEEP

3072:mEGh0oolEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGmlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023266-1.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002326a-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001e2e1-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002326a-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000016fa5-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219e9-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000016fa5-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000733-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070f-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006e3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}\stubpath = "C:\\Windows\\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe"	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08BE9600-653F-48ce-9B8E-AF62011DFF64}	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08BE9600-653F-48ce-9B8E-AF62011DFF64}\stubpath = "C:\\Windows\\{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe"	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D298372-03C2-4895-A6AD-5E97518D08A4}	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51107584-3D02-42bb-86E4-1C427A060CA5}\stubpath = "C:\\Windows\\{51107584-3D02-42bb-86E4-1C427A060CA5}.exe"	{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D298372-03C2-4895-A6AD-5E97518D08A4}\stubpath = "C:\\Windows\\{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe"	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51107584-3D02-42bb-86E4-1C427A060CA5}	{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51F1D3D2-26CC-484f-9213-E0B72583A93A}\stubpath = "C:\\Windows\\{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe"	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}\stubpath = "C:\\Windows\\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe"	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C162FEF-C04A-401c-B4E3-424168F11D81}\stubpath = "C:\\Windows\\{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe"	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA34CB45-82B1-4437-8B65-C075A37AE48F}\stubpath = "C:\\Windows\\{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe"	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CAF2583-097E-490a-B859-364B849CBDAA}	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}\stubpath = "C:\\Windows\\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe"	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C162FEF-C04A-401c-B4E3-424168F11D81}	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA34CB45-82B1-4437-8B65-C075A37AE48F}	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51F1D3D2-26CC-484f-9213-E0B72583A93A}	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CAF2583-097E-490a-B859-364B849CBDAA}\stubpath = "C:\\Windows\\{2CAF2583-097E-490a-B859-364B849CBDAA}.exe"	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}\stubpath = "C:\\Windows\\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe"	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}\stubpath = "C:\\Windows\\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe"	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe

Executes dropped EXE 12 IoCs

pid	Process
544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe
4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe
2380	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
1876	{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe
3776	{51107584-3D02-42bb-86E4-1C427A060CA5}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
File created	C:\Windows\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
File created	C:\Windows\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
File created	C:\Windows\{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
File created	C:\Windows\{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
File created	C:\Windows\{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
File created	C:\Windows\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
File created	C:\Windows\{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
File created	C:\Windows\{51107584-3D02-42bb-86E4-1C427A060CA5}.exe	{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe
File created	C:\Windows\{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe
File created	C:\Windows\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe
File created	C:\Windows\{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe
Token: SeIncBasePriorityPrivilege	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
Token: SeIncBasePriorityPrivilege	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
Token: SeIncBasePriorityPrivilege	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
Token: SeIncBasePriorityPrivilege	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
Token: SeIncBasePriorityPrivilege	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
Token: SeIncBasePriorityPrivilege	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
Token: SeIncBasePriorityPrivilege	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe
Token: SeIncBasePriorityPrivilege	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
Token: SeIncBasePriorityPrivilege	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe
Token: SeIncBasePriorityPrivilege	2380	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
Token: SeIncBasePriorityPrivilege	1876	{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 544	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe	93
PID 3660 wrote to memory of 544	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe	93
PID 3660 wrote to memory of 544	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe	93
PID 3660 wrote to memory of 844	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe	94
PID 3660 wrote to memory of 844	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe	94
PID 3660 wrote to memory of 844	3660	2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe	94
PID 544 wrote to memory of 2268	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	100
PID 544 wrote to memory of 2268	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	100
PID 544 wrote to memory of 2268	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	100
PID 544 wrote to memory of 1136	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	101
PID 544 wrote to memory of 1136	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	101
PID 544 wrote to memory of 1136	544	{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe	101
PID 2268 wrote to memory of 4636	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	105
PID 2268 wrote to memory of 4636	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	105
PID 2268 wrote to memory of 4636	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	105
PID 2268 wrote to memory of 2916	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	106
PID 2268 wrote to memory of 2916	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	106
PID 2268 wrote to memory of 2916	2268	{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe	106
PID 4636 wrote to memory of 2452	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	108
PID 4636 wrote to memory of 2452	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	108
PID 4636 wrote to memory of 2452	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	108
PID 4636 wrote to memory of 4020	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	109
PID 4636 wrote to memory of 4020	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	109
PID 4636 wrote to memory of 4020	4636	{2CAF2583-097E-490a-B859-364B849CBDAA}.exe	109
PID 2452 wrote to memory of 3356	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	110
PID 2452 wrote to memory of 3356	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	110
PID 2452 wrote to memory of 3356	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	110
PID 2452 wrote to memory of 3016	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	111
PID 2452 wrote to memory of 3016	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	111
PID 2452 wrote to memory of 3016	2452	{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe	111
PID 3356 wrote to memory of 4360	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	112
PID 3356 wrote to memory of 4360	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	112
PID 3356 wrote to memory of 4360	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	112
PID 3356 wrote to memory of 2392	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	113
PID 3356 wrote to memory of 2392	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	113
PID 3356 wrote to memory of 2392	3356	{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe	113
PID 4360 wrote to memory of 2496	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	114
PID 4360 wrote to memory of 2496	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	114
PID 4360 wrote to memory of 2496	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	114
PID 4360 wrote to memory of 1384	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	115
PID 4360 wrote to memory of 1384	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	115
PID 4360 wrote to memory of 1384	4360	{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe	115
PID 2496 wrote to memory of 4468	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	116
PID 2496 wrote to memory of 4468	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	116
PID 2496 wrote to memory of 4468	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	116
PID 2496 wrote to memory of 1020	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	117
PID 2496 wrote to memory of 1020	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	117
PID 2496 wrote to memory of 1020	2496	{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe	117
PID 4468 wrote to memory of 4212	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	118
PID 4468 wrote to memory of 4212	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	118
PID 4468 wrote to memory of 4212	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	118
PID 4468 wrote to memory of 4076	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	119
PID 4468 wrote to memory of 4076	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	119
PID 4468 wrote to memory of 4076	4468	{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe	119
PID 4212 wrote to memory of 2380	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	120
PID 4212 wrote to memory of 2380	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	120
PID 4212 wrote to memory of 2380	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	120
PID 4212 wrote to memory of 1264	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	121
PID 4212 wrote to memory of 1264	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	121
PID 4212 wrote to memory of 1264	4212	{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe	121
PID 2380 wrote to memory of 1876	2380	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe	122
PID 2380 wrote to memory of 1876	2380	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe	122
PID 2380 wrote to memory of 1876	2380	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe	122
PID 2380 wrote to memory of 1048	2380	{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe	123

C:\Users\Admin\AppData\Local\Temp\2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_0a0efc974b1ac4880f1a20096083d274_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
  C:\Windows\{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
    C:\Windows\{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
      C:\Windows\{2CAF2583-097E-490a-B859-364B849CBDAA}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Windows\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
        
        C:\Windows\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Windows\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
        
        C:\Windows\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
        
        C:\Windows\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe
        
        C:\Windows\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
        
        C:\Windows\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe
        
        C:\Windows\{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
        
        C:\Windows\{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe
        
        C:\Windows\{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
        
        C:\Windows\{51107584-3D02-42bb-86E4-1C427A060CA5}.exe
        
        C:\Windows\{51107584-3D02-42bb-86E4-1C427A060CA5}.exe
        13⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D298~1.EXE > nul
        13⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2C162~1.EXE > nul
        12⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{08BE9~1.EXE > nul
        11⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AA608~1.EXE > nul
        10⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AF896~1.EXE > nul
        9⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0C1BE~1.EXE > nul
        8⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9686D~1.EXE > nul
        7⤵
        
        PID:2392
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50474~1.EXE > nul
        6⤵
        
        PID:3016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2CAF2~1.EXE > nul
        5⤵
        
        PID:4020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{51F1D~1.EXE > nul
      4⤵
      PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FA34C~1.EXE > nul
    3⤵
    PID:1136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{08BE9600-653F-48ce-9B8E-AF62011DFF64}.exe

Filesize
344KB

MD5
2b39a417b7e2cf839f5528b067f172e1

SHA1
1ed09c212d0b02b6b8f780869c3b63b39f468943

SHA256
b5445c4e7f14db9f23040fbc04658ef09a8c742cf024d5e1c9e445edb6b99f56

SHA512
1b43b505475984a33b61c188b0f0e701ae514af2f061946642b53279673a380f56bc496be6f46f2ba4ec18bb6e48f8f8557543b31e066652aa583d90c2da4763

Download Submit
C:\Windows\{0C1BE75A-944E-496b-B00D-FA2CA72B4105}.exe

Filesize
344KB

MD5
addcd635bc484221bdcc4a4a0d404881

SHA1
50df03d63ef22b02682519fd51f2ce28fbaf940d

SHA256
dde26d116c934f70034745e289bde77f7d7ab6de478aad54116ccae93608be1d

SHA512
d4c0c7a4b0fdf120b831931a13a2b59a96b933d2f83147859f3663f91d2220cc1acb82d4c0b5bba545c8df229311b4f780d8b0f2f4e14bec53691eba109f515f

Download Submit
C:\Windows\{2C162FEF-C04A-401c-B4E3-424168F11D81}.exe

Filesize
344KB

MD5
b3bbd250efcf76af90a95e99cd5fe2a0

SHA1
bb9dbfb46f3c6f371aabd67e7cf2fe3f57e36fce

SHA256
59d81acddef70c10d1b0e0ac04f2001e2a83598fb1ccb3e0f662520734e7d2f7

SHA512
792d14b905ea0162fa2bd979319726efc0429f7c3f40aaaa1620b20c50a781fc1380a0f5c4738e3c493fd174c7a85bb4ef5b38f9dbc6566a183cea9a5bb98dff

Download Submit
C:\Windows\{2CAF2583-097E-490a-B859-364B849CBDAA}.exe

Filesize
344KB

MD5
f71e5ea4befee56a4f2346b84bd6f2e7

SHA1
7fc8ceed370e0f51720915988494b164569f41b4

SHA256
763ce1ba88f9ca820c8bbabc51984b2319d21f25f8dced201d4a3ad66fa3bea3

SHA512
752ac76ff387697d0e0df146c04712473aa82f9899e17adebc8057f06852c54389df133d162124021802f4cf46b1ad38c113b8b8d009030d183ba1b56e1a4c71

Download Submit
C:\Windows\{50474564-6CD1-46a6-B3F2-D4D937FADD9E}.exe

Filesize
344KB

MD5
d9c74b314d8c72c76ff25c37db7ac4f4

SHA1
9d35807bdf4b9be664eed9bbe353a94423459120

SHA256
7a9d93824f6714a1c0eb843807502150161926dd7499233b6d70c2757efa43b6

SHA512
5548c045444fff986351a1be7fcb6f98c2ab10d1e61d5c621cfdff531986c6647d0aefca57e6c980d673f00e00bdaecd4e874d7e57804799a94304d0077072d4

Download Submit
C:\Windows\{51107584-3D02-42bb-86E4-1C427A060CA5}.exe

Filesize
344KB

MD5
d0d7ef65d9f54fcf863daa5522620f4e

SHA1
8ac662158d7515909046281adb5f48f83a9119e0

SHA256
28a9f0886e9ed6be850a3ca4dd6cc9f485b68ecf235fac96fa52aa9773631cc2

SHA512
394bbc8a87476de71d5f31b708e9cf205e1227d6bb91b4a801dd20b2781c4cc17b7aeeaaaed092125d2945a7cd309d26c7c26e5619dfd0ea245ce391455b1c42

Download Submit
C:\Windows\{51F1D3D2-26CC-484f-9213-E0B72583A93A}.exe

Filesize
344KB

MD5
828a2456b383cce1bb0adf26adba7f01

SHA1
c493aa82e51ec72925c0cd0e1f091e240a523efc

SHA256
2980d8450ff3efe1f4eb7d3bf6dc308bf2275fb93387c103fd4c6a36fe1bfd44

SHA512
78ac125fa16eda78f3721d92434cd4ce4ad5f48f0b06fa8ca9d0191ee3f1aed5688b91de0f0a31ad46a7d0374c897986df338a22e00f03aa69e006e6b9dcf6f2

Download Submit
C:\Windows\{5D298372-03C2-4895-A6AD-5E97518D08A4}.exe

Filesize
344KB

MD5
6854fbeceddaa64ce43f996a765a8042

SHA1
1887ee36c50e7b26b283ee26231824041f9f36a6

SHA256
4d1c2ee1a3eacdcfc3cb285766213e17714e03e9d5d06fe300b5ef386f927565

SHA512
46801938cf7f785dc882ec08bdfde32034ad3504d8bc6005ce73f39f3f87fda5a3416f8eb42fdb668c6ae8af5bed31ccc91cfd1e97d2aa00667a71f60430a059

Download Submit
C:\Windows\{9686D3A1-48E9-4c6f-A8EC-27E5C83D8477}.exe

Filesize
344KB

MD5
8ac9ff6eec5bfc03a9a2e06d3a6bcae6

SHA1
36122be8616b7ace93736138cda105bb450a2792

SHA256
26d205084cb5f4f4f28886887e246f5f06127a97955aa1183f01a173ef4b3326

SHA512
3b131c5721cc72c3f807cc332d6f960f7eec07dd97dc54228fdc91b7c1573fedfb054921d8ff95f70353f0ffac2838ec6383671daeb4ded950726437bd56cfbf

Download Submit
C:\Windows\{AA6083AB-2D9E-40f3-B2B6-371E5973FF23}.exe

Filesize
344KB

MD5
45c6979a0a907dd898baeddb9b49e53d

SHA1
d11ddda88035903824f429b5c0637f1d89774839

SHA256
304c733e40b718e7d03273e48b473f08a565835a8e08ec78ad701756a1568553

SHA512
54c007f3beb3d37aa6047b91289abe2a53f17869fa6c95befd25db734d89ebf5c05a7e5d07bc4a8249977b1629697fb85815f569bb7b28ef5841e4b5833ee93b

Download Submit
C:\Windows\{AF896E15-9AB0-45ba-80D6-97E9844D8DC9}.exe

Filesize
344KB

MD5
3cfebe3dca24e6905fe647eded8f1519

SHA1
96256a8f3751e94e8562b84411641ec2e95c4299

SHA256
f0d27c0f6d68f7c38489ba74189e9c04f55e2f288de399199f89063163814dec

SHA512
1db1cfa72ed4df9c6cc2c4525d59f6e135783b9c4ac345f38dab822811426a3fb3784e4120a1c0be46918876ee2b901ea9a1d71a1298722e14e058cdd4a9bee6

Download Submit
C:\Windows\{FA34CB45-82B1-4437-8B65-C075A37AE48F}.exe

Filesize
344KB

MD5
c8e6a9ed9f23ead0e22c6df359884fdd

SHA1
d16ea44787ce11036e20dd02c2360c0e35a3de52

SHA256
98e5cfd8afeba7207484004b87234e8c5d6ad47fee9bc1c4495657f95adec842

SHA512
a03b40e1b4ebf56acef10752e34add4dda1f6a5d76cc585ae8b2bea8498e2b39fd6c100281f08d3dd25c3bf9fcd3def792d25b4d1f49b44effb6be302b4257ec

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads