8c3d1cbad4a040ad37d5815b9ce29f993f1e9865916e4a5fbf11df5b73e782d9

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe
Size

216KB
MD5

a161ab4f8de0391157483a332987ec09
SHA1

de7742f0f332cef0718fcd1daab32c7d40410403
SHA256

8c3d1cbad4a040ad37d5815b9ce29f993f1e9865916e4a5fbf11df5b73e782d9
SHA512

db1391de93f919b11bfdc8e16fba743865b25001d3dc84aaabb51e4f603e0855a922b826ddf4b40e1e0a95681a8cb3d1b8c0b81d4800017cfe80e6afd7354d2d
SSDEEP

3072:jEGh0otMl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG8lEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023469-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023470-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023479-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023470-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023479-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00110000000233e4-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023479-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023483-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023479-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023483-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000022b23-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023483-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30730575-FB09-49b3-8FCA-92AB751D6C8B}	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}\stubpath = "C:\\Windows\\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe"	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55E954D9-F52F-4138-BA32-081B7E304B21}	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55E954D9-F52F-4138-BA32-081B7E304B21}\stubpath = "C:\\Windows\\{55E954D9-F52F-4138-BA32-081B7E304B21}.exe"	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16CE7770-0C19-4803-AABD-943A36DE1EAF}	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D9A0507-8E66-4914-970F-C8333749AE20}	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D9A0507-8E66-4914-970F-C8333749AE20}\stubpath = "C:\\Windows\\{4D9A0507-8E66-4914-970F-C8333749AE20}.exe"	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}\stubpath = "C:\\Windows\\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe"	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49988062-1410-44c1-8D3B-C0162737894F}	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49988062-1410-44c1-8D3B-C0162737894F}\stubpath = "C:\\Windows\\{49988062-1410-44c1-8D3B-C0162737894F}.exe"	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90D02207-14A3-4461-B424-26A1FE8DFD83}	{49988062-1410-44c1-8D3B-C0162737894F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}\stubpath = "C:\\Windows\\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}.exe"	{4D9A0507-8E66-4914-970F-C8333749AE20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30730575-FB09-49b3-8FCA-92AB751D6C8B}\stubpath = "C:\\Windows\\{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe"	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}\stubpath = "C:\\Windows\\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe"	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}\stubpath = "C:\\Windows\\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe"	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90D02207-14A3-4461-B424-26A1FE8DFD83}\stubpath = "C:\\Windows\\{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe"	{49988062-1410-44c1-8D3B-C0162737894F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}\stubpath = "C:\\Windows\\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe"	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16CE7770-0C19-4803-AABD-943A36DE1EAF}\stubpath = "C:\\Windows\\{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe"	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}	{4D9A0507-8E66-4914-970F-C8333749AE20}.exe

Executes dropped EXE 12 IoCs

pid	Process
4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe
1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
412	{49988062-1410-44c1-8D3B-C0162737894F}.exe
1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
912	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
2008	{4D9A0507-8E66-4914-970F-C8333749AE20}.exe
2128	{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
File created	C:\Windows\{4D9A0507-8E66-4914-970F-C8333749AE20}.exe	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
File created	C:\Windows\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}.exe	{4D9A0507-8E66-4914-970F-C8333749AE20}.exe
File created	C:\Windows\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
File created	C:\Windows\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
File created	C:\Windows\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
File created	C:\Windows\{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
File created	C:\Windows\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
File created	C:\Windows\{49988062-1410-44c1-8D3B-C0162737894F}.exe	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
File created	C:\Windows\{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	{49988062-1410-44c1-8D3B-C0162737894F}.exe
File created	C:\Windows\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe
File created	C:\Windows\{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe
Token: SeIncBasePriorityPrivilege	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
Token: SeIncBasePriorityPrivilege	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
Token: SeIncBasePriorityPrivilege	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
Token: SeIncBasePriorityPrivilege	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
Token: SeIncBasePriorityPrivilege	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
Token: SeIncBasePriorityPrivilege	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
Token: SeIncBasePriorityPrivilege	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe
Token: SeIncBasePriorityPrivilege	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
Token: SeIncBasePriorityPrivilege	912	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
Token: SeIncBasePriorityPrivilege	2008	{4D9A0507-8E66-4914-970F-C8333749AE20}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4240	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe	91
PID 116 wrote to memory of 4240	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe	91
PID 116 wrote to memory of 4240	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe	91
PID 116 wrote to memory of 4764	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe	92
PID 116 wrote to memory of 4764	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe	92
PID 116 wrote to memory of 4764	116	2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe	92
PID 4240 wrote to memory of 1352	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	94
PID 4240 wrote to memory of 1352	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	94
PID 4240 wrote to memory of 1352	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	94
PID 4240 wrote to memory of 4040	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	95
PID 4240 wrote to memory of 4040	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	95
PID 4240 wrote to memory of 4040	4240	{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe	95
PID 1352 wrote to memory of 3044	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	98
PID 1352 wrote to memory of 3044	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	98
PID 1352 wrote to memory of 3044	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	98
PID 1352 wrote to memory of 1456	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	99
PID 1352 wrote to memory of 1456	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	99
PID 1352 wrote to memory of 1456	1352	{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe	99
PID 3044 wrote to memory of 2236	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	100
PID 3044 wrote to memory of 2236	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	100
PID 3044 wrote to memory of 2236	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	100
PID 3044 wrote to memory of 1832	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	101
PID 3044 wrote to memory of 1832	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	101
PID 3044 wrote to memory of 1832	3044	{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe	101
PID 2236 wrote to memory of 4656	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	103
PID 2236 wrote to memory of 4656	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	103
PID 2236 wrote to memory of 4656	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	103
PID 2236 wrote to memory of 3592	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	104
PID 2236 wrote to memory of 3592	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	104
PID 2236 wrote to memory of 3592	2236	{55E954D9-F52F-4138-BA32-081B7E304B21}.exe	104
PID 4656 wrote to memory of 1356	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	105
PID 4656 wrote to memory of 1356	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	105
PID 4656 wrote to memory of 1356	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	105
PID 4656 wrote to memory of 3052	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	106
PID 4656 wrote to memory of 3052	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	106
PID 4656 wrote to memory of 3052	4656	{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe	106
PID 1356 wrote to memory of 388	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	107
PID 1356 wrote to memory of 388	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	107
PID 1356 wrote to memory of 388	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	107
PID 1356 wrote to memory of 1100	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	108
PID 1356 wrote to memory of 1100	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	108
PID 1356 wrote to memory of 1100	1356	{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe	108
PID 388 wrote to memory of 412	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	115
PID 388 wrote to memory of 412	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	115
PID 388 wrote to memory of 412	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	115
PID 388 wrote to memory of 3972	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	116
PID 388 wrote to memory of 3972	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	116
PID 388 wrote to memory of 3972	388	{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe	116
PID 412 wrote to memory of 1720	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe	117
PID 412 wrote to memory of 1720	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe	117
PID 412 wrote to memory of 1720	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe	117
PID 412 wrote to memory of 808	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe	118
PID 412 wrote to memory of 808	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe	118
PID 412 wrote to memory of 808	412	{49988062-1410-44c1-8D3B-C0162737894F}.exe	118
PID 1720 wrote to memory of 912	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	119
PID 1720 wrote to memory of 912	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	119
PID 1720 wrote to memory of 912	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	119
PID 1720 wrote to memory of 1624	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	120
PID 1720 wrote to memory of 1624	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	120
PID 1720 wrote to memory of 1624	1720	{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe	120
PID 912 wrote to memory of 2008	912	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe	124
PID 912 wrote to memory of 2008	912	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe	124
PID 912 wrote to memory of 2008	912	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe	124
PID 912 wrote to memory of 3592	912	{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe	125

C:\Users\Admin\AppData\Local\Temp\2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_a161ab4f8de0391157483a332987ec09_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe
  C:\Windows\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
    C:\Windows\{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
      C:\Windows\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
        
        C:\Windows\{55E954D9-F52F-4138-BA32-081B7E304B21}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
      - C:\Windows\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
        
        C:\Windows\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
        
        C:\Windows\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
        
        C:\Windows\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\{49988062-1410-44c1-8D3B-C0162737894F}.exe
        
        C:\Windows\{49988062-1410-44c1-8D3B-C0162737894F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
        
        C:\Windows\{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
        
        C:\Windows\{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\{4D9A0507-8E66-4914-970F-C8333749AE20}.exe
        
        C:\Windows\{4D9A0507-8E66-4914-970F-C8333749AE20}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}.exe
        
        C:\Windows\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}.exe
        13⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4D9A0~1.EXE > nul
        13⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16CE7~1.EXE > nul
        12⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{90D02~1.EXE > nul
        11⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49988~1.EXE > nul
        10⤵
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3F8C~1.EXE > nul
        9⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{68396~1.EXE > nul
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE6EA~1.EXE > nul
        7⤵
        
        PID:3052
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{55E95~1.EXE > nul
        6⤵
        
        PID:3592
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE9F8~1.EXE > nul
        5⤵
        
        PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{30730~1.EXE > nul
      4⤵
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F7B8A~1.EXE > nul
    3⤵
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{16CE7770-0C19-4803-AABD-943A36DE1EAF}.exe

Filesize
216KB

MD5
40cfd73be8f26358627ffb1e7cca3893

SHA1
7f81ae0425b489db181b14b6c1b91764e001428c

SHA256
141f0747a994298af497ce923a63967d66b75d4e63aa4c386181eb492428373a

SHA512
f843ee6eb3baf51cba7c24c696354035f1760ed2c4ab957d776b1fd6cabf06e8b7df83f9091f447c937a540e1ccb579c1968a63c92fb30efcab68ca5fb2d5145

Download Submit
C:\Windows\{30730575-FB09-49b3-8FCA-92AB751D6C8B}.exe

Filesize
216KB

MD5
238f4b4db12aba827d8f28b879ef211f

SHA1
04566bf3d924400d0a6f5c64a873702a3e62415c

SHA256
3f546f94e0414b184fbb05eb1e6c5e9a7634000123b66f0249bf23e6fadff6da

SHA512
c7d50057e11f55a50db35c4a911430bb3e12abc9eb3335b7a9baade286d4fa88f844aed219b00ec0ded8930b79ad9a35c36d50b8a50c3ef022b843afe511d3cc

Download Submit
C:\Windows\{49988062-1410-44c1-8D3B-C0162737894F}.exe

Filesize
216KB

MD5
4847ea802767d55286d180b1606399bd

SHA1
b49c9cd5bd540fac559782ee1fbc1d3ad4362edf

SHA256
93d5a69c15cbf3eca609919126b886e92244fec0db072c52957401c161b29fdc

SHA512
517036f7475389986f8ca9523a0534ad8ecd1e132f0ead19b30cc134d3a6b05c3b7d981bfec16b7f3cd6ea9e575533f69216d4ec586e1d2ee0a17acc726a0287

Download Submit
C:\Windows\{4D9A0507-8E66-4914-970F-C8333749AE20}.exe

Filesize
216KB

MD5
580aca238e2b489dfa3d5df391d9da01

SHA1
75a07133354ac1903ee8f3bc4902a81913074b5d

SHA256
57e930307840626a29371107e961edd0b0f914c44a6a51406c8de36fb962b027

SHA512
102c1e388f232d545806ec04007299158a141e659b70279b9ca08e2e004d322c8cca68cea694c50c2612d3bc7a787b1c19188b004f3192682ff1ca905d151824

Download Submit
C:\Windows\{55E954D9-F52F-4138-BA32-081B7E304B21}.exe

Filesize
216KB

MD5
6958a88f8320481e2a38c3f0e5eb6965

SHA1
be9a6e00fb1c4385a8edcba30d8fa0e17cf94575

SHA256
d305117ca00366c88ebc353fc5e790661290c580a42987344a20717d045aaeab

SHA512
c0d695e1ddd3074915bfedbbdeb13b9a7411d05ac97bf29ff59f8bf7691d36f792709e5b1902d2d334003d0cda7def0f34b84cd3af8685f71ec6c518408e3b36

Download Submit
C:\Windows\{68396ECD-E25B-45ea-AA0F-CF54CDFB512B}.exe

Filesize
216KB

MD5
85743ba0755e699690e2357cfcdce4d2

SHA1
44a80fca1ef54bb3c6699297588d1ecb9a09c0b3

SHA256
439b026793be4abc65f676f5859e27153d48c14afd4f3abcfadbef621b390c7a

SHA512
264f736733453e5a57314ad6c999425d02721d7732af112f1ba14c6456f809fe8e259f976d684ddc4acb5154755fe715fc5ec20f4eaff74e6593c629d52b2302

Download Submit
C:\Windows\{90D02207-14A3-4461-B424-26A1FE8DFD83}.exe

Filesize
216KB

MD5
81ce6235a3c39485bdaf0306a37b7860

SHA1
c665f2844f1b85cf61baa21818d862671014edec

SHA256
9bf63b7db89e400e3b011078e12f5edc0e3c43eaf1627274c861fba0caabe8d4

SHA512
4b9eed6b1cf2d1a3ace578bdcf5434a5899204595e3fefd77588aab1a10eadc94bee4c2a584e584c609f2e4ff945149cf89d20ce8a47b4533df8ccf77297e814

Download Submit
C:\Windows\{9C31A56F-5B2F-4a47-B3A3-B773FD6E2768}.exe

Filesize
216KB

MD5
93d23aed5320ddce57c3442d2037dfd0

SHA1
26d959e808c7bb32a4061a0bf345a684f0bee418

SHA256
39e253bf9f709fdc8ec70a307b4320dbcf9813b16cb095919f2a9f8c30a162c7

SHA512
98a1873f4f1b5034247d4f1c072155d7ddeebf4f0f27897cc29bcee34474402e1cfee3c01b2b0663f7590c8b29dcc2b7baaddf9a86ec97d48c0aeab01159c65a

Download Submit
C:\Windows\{A3F8CAEA-4AEA-4578-9A05-C6E7F18AF11A}.exe

Filesize
216KB

MD5
a9ec7fe270c9ebe52c32dbcba06fd2f2

SHA1
ac931fb84ff967c41f5fba462e4e801bfec153da

SHA256
3dda03079217a3cdc00c1909bbe812706bd303a885e419ccf6c604e58132b949

SHA512
760b6b61f9afdb3e29006a18e72781029a8fb17b9d11feac92d40b1c1e9f1b98237ef0ddd0359e1c594357433f5d953354f828805228ccbaf4e3ddb29c93c4d9

Download Submit
C:\Windows\{BE6EA39F-A539-4ad0-85C8-6E2ACBDF7751}.exe

Filesize
216KB

MD5
d677004a87674c557ad0e3baef5b4123

SHA1
2ab19b75dc0c2944152eb5d196cf570a39b5056e

SHA256
f2eeb6ed56c8b01070d60c65471f3a79fcbfea83b4de36ff4bd0b6afae416bf5

SHA512
36f5138984aa2a39421c78729efba2a62438a12ebdd9c23d0bed63711ff8340ff5ed5c77f3d6f8397e6b119e21ce8823c99506fda614753a09c01cfbcc5a6694

Download Submit
C:\Windows\{BE9F80A6-EB43-47b3-AD82-6D3C7E3633F3}.exe

Filesize
216KB

MD5
601cf29bfd27ee01c18931675cb7c76f

SHA1
c19fa8049150befc6920937c5cfd7e19028c5774

SHA256
156b8803172770f4bcdceb23fb4b441b5908139e076bf4092459d4a633cde32c

SHA512
fb0d921dbf93c51f0cc4694a8310362a55c82a88f636a297867d9b2ca05f879f3d48e1d7706de342ea096b37ed97466ff0409567372afa3197486bb57d40d61c

Download Submit
C:\Windows\{F7B8A393-FA72-4138-8A48-7B71D59C6CD7}.exe

Filesize
216KB

MD5
cc721738909d4fcaea55a37ad663259c

SHA1
48939fe47d48a96de2b68045b6a8a97f58311ea8

SHA256
29e83d1b7c781c793fd4f1a7e2e4400a18c9655370f9e3152d7515b13f3aab66

SHA512
11d57ca8d29666ffc0087ac537e691ce7971f6a4b00c61bfc0b5b97df675f1fe7e9946ab295eead13360032b988ad5c82feb97542368289a5baabd23163d51e0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads