e1ab510a47c92417cc73f75cceebee803ab1d8d879b0230531b8768f9b49e9e9

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe
Size 408KB
Sample240504-hhbgbahe76
SHA256 e1ab510a47c92417cc73f75cceebee803ab1d8d879b0230531b8768f9b49e9e9
MD5 4b1426f950856ab87f85fdad7cc67616
SHA1 eac9f8d69c09058926ff196de4396c60a87e6bf1
SHA512 4d3068cfcb39d1f907f84997b23ec9983075710f1c21a6069ced4f6f44b6cb757dadd6478055268fb3b16186ad0288cf4b7e1ce2b0442877a0726cabc4fa5947
SSDEEP 3072:CEGh0ovl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGZldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023a53-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023a54-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023a18-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023a19-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023a74-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023b93-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023a74-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0016000000023a19-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023a74-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0017000000023a19-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023ba1-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0018000000023a19-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}\stubpath = "C:\\Windows\\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe"	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74663A84-59E0-493e-8825-5264B53CA6C3}	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E440207-E040-4c5e-B0B0-F42A06ED070C}	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}\stubpath = "C:\\Windows\\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe"	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}	{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}\stubpath = "C:\\Windows\\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe"	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B438F572-9AB5-4c34-A81A-927F001D619C}\stubpath = "C:\\Windows\\{B438F572-9AB5-4c34-A81A-927F001D619C}.exe"	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E440207-E040-4c5e-B0B0-F42A06ED070C}\stubpath = "C:\\Windows\\{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe"	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81E1871E-F43B-42f9-9926-4CFE53565A3F}\stubpath = "C:\\Windows\\{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe"	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2396902A-6D6D-4691-9B36-F8C5659DE31E}	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}\stubpath = "C:\\Windows\\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe"	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85E26793-04DD-4c1b-8CC7-76E958556D59}	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85E26793-04DD-4c1b-8CC7-76E958556D59}\stubpath = "C:\\Windows\\{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe"	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}\stubpath = "C:\\Windows\\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe"	{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B438F572-9AB5-4c34-A81A-927F001D619C}	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}\stubpath = "C:\\Windows\\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe"	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2396902A-6D6D-4691-9B36-F8C5659DE31E}\stubpath = "C:\\Windows\\{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe"	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81E1871E-F43B-42f9-9926-4CFE53565A3F}	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74663A84-59E0-493e-8825-5264B53CA6C3}\stubpath = "C:\\Windows\\{74663A84-59E0-493e-8825-5264B53CA6C3}.exe"	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe

Executes dropped EXE 12 IoCs

pid	Process
3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe
4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
1816	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
4892	{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
3048	{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe	{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
File created	C:\Windows\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe
File created	C:\Windows\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
File created	C:\Windows\{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
File created	C:\Windows\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
File created	C:\Windows\{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
File created	C:\Windows\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
File created	C:\Windows\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
File created	C:\Windows\{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
File created	C:\Windows\{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
File created	C:\Windows\{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
File created	C:\Windows\{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
Token: SeIncBasePriorityPrivilege	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
Token: SeIncBasePriorityPrivilege	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
Token: SeIncBasePriorityPrivilege	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe
Token: SeIncBasePriorityPrivilege	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
Token: SeIncBasePriorityPrivilege	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
Token: SeIncBasePriorityPrivilege	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
Token: SeIncBasePriorityPrivilege	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
Token: SeIncBasePriorityPrivilege	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
Token: SeIncBasePriorityPrivilege	1816	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
Token: SeIncBasePriorityPrivilege	4892	{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3568	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe	96
PID 4664 wrote to memory of 3568	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe	96
PID 4664 wrote to memory of 3568	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe	96
PID 4664 wrote to memory of 4540	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe	97
PID 4664 wrote to memory of 4540	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe	97
PID 4664 wrote to memory of 4540	4664	2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe	97
PID 3568 wrote to memory of 536	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	98
PID 3568 wrote to memory of 536	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	98
PID 3568 wrote to memory of 536	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	98
PID 3568 wrote to memory of 3940	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	99
PID 3568 wrote to memory of 3940	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	99
PID 3568 wrote to memory of 3940	3568	{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe	99
PID 536 wrote to memory of 3900	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	102
PID 536 wrote to memory of 3900	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	102
PID 536 wrote to memory of 3900	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	102
PID 536 wrote to memory of 3208	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	103
PID 536 wrote to memory of 3208	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	103
PID 536 wrote to memory of 3208	536	{B438F572-9AB5-4c34-A81A-927F001D619C}.exe	103
PID 3900 wrote to memory of 396	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	104
PID 3900 wrote to memory of 396	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	104
PID 3900 wrote to memory of 396	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	104
PID 3900 wrote to memory of 2312	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	105
PID 3900 wrote to memory of 2312	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	105
PID 3900 wrote to memory of 2312	3900	{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe	105
PID 396 wrote to memory of 4676	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	107
PID 396 wrote to memory of 4676	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	107
PID 396 wrote to memory of 4676	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	107
PID 396 wrote to memory of 1344	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	108
PID 396 wrote to memory of 1344	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	108
PID 396 wrote to memory of 1344	396	{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe	108
PID 4676 wrote to memory of 1080	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	112
PID 4676 wrote to memory of 1080	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	112
PID 4676 wrote to memory of 1080	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	112
PID 4676 wrote to memory of 2264	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	113
PID 4676 wrote to memory of 2264	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	113
PID 4676 wrote to memory of 2264	4676	{74663A84-59E0-493e-8825-5264B53CA6C3}.exe	113
PID 1080 wrote to memory of 2076	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	114
PID 1080 wrote to memory of 2076	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	114
PID 1080 wrote to memory of 2076	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	114
PID 1080 wrote to memory of 4004	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	115
PID 1080 wrote to memory of 4004	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	115
PID 1080 wrote to memory of 4004	1080	{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe	115
PID 2076 wrote to memory of 4988	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	124
PID 2076 wrote to memory of 4988	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	124
PID 2076 wrote to memory of 4988	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	124
PID 2076 wrote to memory of 1600	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	125
PID 2076 wrote to memory of 1600	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	125
PID 2076 wrote to memory of 1600	2076	{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe	125
PID 4988 wrote to memory of 2040	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	126
PID 4988 wrote to memory of 2040	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	126
PID 4988 wrote to memory of 2040	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	126
PID 4988 wrote to memory of 2332	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	127
PID 4988 wrote to memory of 2332	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	127
PID 4988 wrote to memory of 2332	4988	{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe	127
PID 2040 wrote to memory of 1816	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	128
PID 2040 wrote to memory of 1816	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	128
PID 2040 wrote to memory of 1816	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	128
PID 2040 wrote to memory of 2500	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	129
PID 2040 wrote to memory of 2500	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	129
PID 2040 wrote to memory of 2500	2040	{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe	129
PID 1816 wrote to memory of 4892	1816	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe	132
PID 1816 wrote to memory of 4892	1816	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe	132
PID 1816 wrote to memory of 4892	1816	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe	132
PID 1816 wrote to memory of 368	1816	{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe	133

C:\Users\Admin\AppData\Local\Temp\2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_4b1426f950856ab87f85fdad7cc67616_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
  C:\Windows\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
    C:\Windows\{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
      C:\Windows\{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe
        
        C:\Windows\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:396
      - C:\Windows\{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
        
        C:\Windows\{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
        
        C:\Windows\{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
        
        C:\Windows\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
        
        C:\Windows\{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
        
        C:\Windows\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
        
        C:\Windows\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
        
        C:\Windows\{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
        
        C:\Windows\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe
        
        C:\Windows\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe
        13⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85E26~1.EXE > nul
        13⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45F4E~1.EXE > nul
        12⤵
        
        PID:368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1FD6~1.EXE > nul
        11⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{23969~1.EXE > nul
        10⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A88B~1.EXE > nul
        9⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E440~1.EXE > nul
        8⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{74663~1.EXE > nul
        7⤵
        
        PID:2264
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A36B4~1.EXE > nul
        6⤵
        
        PID:1344
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81E18~1.EXE > nul
        5⤵
        
        PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B438F~1.EXE > nul
      4⤵
      PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{68EDD~1.EXE > nul
    3⤵
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe

Path C:\Windows\{2396902A-6D6D-4691-9B36-F8C5659DE31E}.exe
Size 408KB
SHA256 409acc9227f3bfa7d50815bed721cb722c618267a4f1ee8d44cc11cd5652f6ee
MD5 4c1a0f49dbeab5b3c1a8228f099a622e
SHA1 0e678d1e70bd7797fd0f67c3d49ead0aa659271e
SHA512 d4b8d27ef5ec643dbd5956a460bc3c0a3310f9caa28656f38ffa8767f5bf5f290b7629a798032615c33076288de1fd8340e4b0c19aef3d9f9a43cf8fe418b518
SSDEEP 3072:CEGh0ool3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe

Path C:\Windows\{45F4E35E-1151-4768-946B-DCBA23B2B1E1}.exe
Size 408KB
SHA256 093bd3662b7caa3c1f981025a31df9c05c97ceacfd5bf790fc3b4cfa1991f13c
MD5 4e30a566b12a5e4712c3f999ba1a83c0
SHA1 57b9026aff53f45a361d8e14b28ed89c3b312095
SHA512 de3e089eea1f537be81ae134f16478c161f37f6969ebe7ded3e712d6e26deef13922e4667d1cfe6fbaf13e194cbabbd48cb1e3a80deb1139e35540ae0a0f591c
SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGtldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe

Path C:\Windows\{4A88B10C-0809-4f65-97A0-062ECE0E9BAC}.exe
Size 408KB
SHA256 86a92adf10bc7c26772f7eb09ccf453c0001696f471b369729a5a90220058614
MD5 5ce8ddd8753928dcd5b47d4da5be943a
SHA1 dd82816b420819457d365d5d55cc50a9d6c9e6e6
SHA512 135ecf35d45dc7a7469f224c6e8b6716859876d3e1d23475f33eb319f5cc89065a6e5f2afcfa8da113f30bb570f76df913194de45fd9bdc354415832620b6b6c
SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG/ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe

Path C:\Windows\{68EDD7F0-F373-4d3e-9AD8-405E46E73ED7}.exe
Size 408KB
SHA256 1cb5cb8d1d244a8166bbe8cbb4888ef570adcc258586a7c7f68ddf2651d13117
MD5 f8fe213717e7fde5bf02a98f3eb75c0c
SHA1 d3a4382f697cd78569505b26f156bcd58b6e2ea4
SHA512 e6219393d893388684dda5052802d5a12186df25e738422598b2d008e7312c68fc89b09f9ba0bef7fa30f1e4cd1d37e456701738c5479df8e3f876456a7074e0
SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGwldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{74663A84-59E0-493e-8825-5264B53CA6C3}.exe

Path C:\Windows\{74663A84-59E0-493e-8825-5264B53CA6C3}.exe
Size 408KB
SHA256 a07bf2a861fb7d09194438f88569ba789478ca9e1ca6fa3753398281dc95621b
MD5 ae412565cb26a30a8d5e74b2458efaae
SHA1 895ea8ead5b2b77362b8209edc7ad84ae717a3f6
SHA512 ce611d65f87bc2140eada3c930140d66c4e72d65cb8eb560def3b39dbb9068e0bd7c27aece1a01241df0c1794449769992a153914062f5915447cba808b981b6
SSDEEP 3072:CEGh0otl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGrldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe

Path C:\Windows\{7E440207-E040-4c5e-B0B0-F42A06ED070C}.exe
Size 408KB
SHA256 f5645f92cce85f900841fdba1ce66dce0c14d9162f62670b0975a7b88572ede6
MD5 b2fdca978b4286bac1ec34ed80fa1dac
SHA1 f51241933ec303a55dd0eafc9a48f8a4e1ddf36b
SHA512 e6d4e6b536bbf40b90db8f637d845af6cde7e6273baa0ee8ff0c4d6550989934e0519451ea305fda63b78e5d686da9dc09f334710e37444f4adcce186e1c296f
SSDEEP 3072:CEGh0oDl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGNldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe

Path C:\Windows\{81E1871E-F43B-42f9-9926-4CFE53565A3F}.exe
Size 408KB
SHA256 572479eaa37664c75d17d579c0b74efa03e460e38025aabffa608ae45c0f0e33
MD5 0a7a627c7239cbef212cfc89cffd9222
SHA1 e9445eabad06d6c7f9336e03ffce9d99b186c79a
SHA512 fa8b666efc73e241c9ad55ac14164b9ee4e27cde55b167a49a4e3c049918a7e83ea563ca60acb6f7a7bd720ea32944bc1aca5021a601da8502a87b9f4c6da13b
SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGildOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe

Path C:\Windows\{85E26793-04DD-4c1b-8CC7-76E958556D59}.exe
Size 408KB
SHA256 9b225088520a43b2033602adaf7f0bdd4cdb9c5707a0d7369553856b0153bccd
MD5 4ca7093d205027a9f32262ae016d2914
SHA1 b6a896a78c2284e2a1984606434f4391e3726463
SHA512 028edbfbf53f759d82dacfe76164444ca7afc92dcdfea214ca802b653fd9a8fb4b2036bd48c389c387c8373ca99b41ffcc2ff37bcc39047904129c685c8e9013
SSDEEP 3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe

Path C:\Windows\{A36B4834-6EDD-42ab-BF72-F45A740E66DA}.exe
Size 408KB
SHA256 7f70e8dd2fc3d119c8e49df7651ee32caa4591f4fc7671a96df58b9e43d17a6c
MD5 229ba4cfe8b55b84cbf1644d325ca48b
SHA1 92b8347169134ce5e530c410ea958803abeb3924
SHA512 b92567fcaf581986e905fc4ef03be80a373c0a7aec75798f3bd94cd8bb14bd6e889d853dea4d8e165e0e4e09ed61c7b7a8b1fa02b6422cbe6f45c3328ff98a63
SSDEEP 3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe

Path C:\Windows\{B1FD6730-B0E5-4a2d-98EB-116B69FB17DE}.exe
Size 408KB
SHA256 a378b442d255c4bfd14742559a30ea6d4831c4ca38a818b74f7a0c1c41b68211
MD5 320466fe3af190ce4cbf8f3b53a5e2be
SHA1 d55c149485130332ee20a906653d58b8084b19e0
SHA512 83bed8050af481f1d2eef61b133452e4a022d5e1fa573b8572cf83cf4a7c1ddd9d307b19013e9f42566786672bf52d256c34873b29940c1a75d0528f1fec97be
SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGMldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B438F572-9AB5-4c34-A81A-927F001D619C}.exe

Path C:\Windows\{B438F572-9AB5-4c34-A81A-927F001D619C}.exe
Size 408KB
SHA256 358685c936d4df7b9a2da11f4e504365ced5e44a771ea435475b3f70996903a0
MD5 259675638059f36f47a9a67f8fdc10bd
SHA1 fe85ab88915d897f43d4e3a13d921327d7bc380a
SHA512 090f6e832bcbf72c6932cd9c3768853dc4f13d867bc7f91a8bf720d4716fe26efbf85f1f309384d7ebc45d3191339988389771d28788ec5288f21441fc952410
SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGnldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe

Path C:\Windows\{FF8BE9AE-EFE1-4d8b-94F8-00665F18B08C}.exe
Size 408KB
SHA256 219cb0620bea27369c4e603da35e288bd509bb13e014c3be34be04bb18439949
MD5 7e416b3efee70566095564edf536f5cb
SHA1 6f5677861581cd841776eb817e14afbc921cb396
SHA512 0a149db5f808b53dbbeb7812c75955d8a2413f28f00cdbae99f0ce2f0c60e5d9503d3ffbd8cd753fe42d2d4290a959a5f03753167dab787ef6ca03b3ef1dd080
SSDEEP 3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGpldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads