c7f7a7ddc0c84f60366206b41c11ec34c73094fc8718a3c358dadec33ba5a837

Resubmissions

17/10/2024, 23:31

241017-3h5elssfqg 8

31/05/2024, 04:49

240531-ffsxgagf35 10

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Size

180KB
MD5

325ad5cab02211ba043f6a1ec096bc26
SHA1

50d54c83f2a838652bef7e12981a8576527d2113
SHA256

c7f7a7ddc0c84f60366206b41c11ec34c73094fc8718a3c358dadec33ba5a837
SHA512

e08b85acb7fcf1845d5b2194db1591c3ebf1c98fad8c174fa7e86807407a382dc8a876fe990eff7e35d762e6e69ab71d1c5604d0402934339a2678fddc816ab1
SSDEEP

3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGVl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023255-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002325f-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023265-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001200000002325f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023265-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000016fa5-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219ea-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000000026-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000507-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2F071F2-B353-4cb0-8036-9CF52260162D}\stubpath = "C:\\Windows\\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe"	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}\stubpath = "C:\\Windows\\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe"	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{525E4A82-DC86-4c4a-8F00-F99791820440}\stubpath = "C:\\Windows\\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe"	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{409E57DE-3362-4722-B0D7-8AC9FBD91320}\stubpath = "C:\\Windows\\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe"	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22733B27-4FDD-4f97-B060-FDB7D27811E5}	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22733B27-4FDD-4f97-B060-FDB7D27811E5}\stubpath = "C:\\Windows\\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe"	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2F071F2-B353-4cb0-8036-9CF52260162D}	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}\stubpath = "C:\\Windows\\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe"	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C33332C-36DE-4e23-8B20-F5569518FE02}	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B15B89B-748F-4bfa-97A0-220B326DD01F}\stubpath = "C:\\Windows\\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe"	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3305248C-2B82-4839-AA3D-9B68836D751F}\stubpath = "C:\\Windows\\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe"	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C545106-F38C-4d32-96B1-2235E4953089}\stubpath = "C:\\Windows\\{0C545106-F38C-4d32-96B1-2235E4953089}.exe"	{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}\stubpath = "C:\\Windows\\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe"	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C33332C-36DE-4e23-8B20-F5569518FE02}\stubpath = "C:\\Windows\\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe"	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}\stubpath = "C:\\Windows\\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe"	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B15B89B-748F-4bfa-97A0-220B326DD01F}	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3305248C-2B82-4839-AA3D-9B68836D751F}	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C545106-F38C-4d32-96B1-2235E4953089}	{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{525E4A82-DC86-4c4a-8F00-F99791820440}	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{409E57DE-3362-4722-B0D7-8AC9FBD91320}	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe

Executes dropped EXE 12 IoCs

pid	Process
3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
3152	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
4452	{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
4856	{0C545106-F38C-4d32-96B1-2235E4953089}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
File created	C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
File created	C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
File created	C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
File created	C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
File created	C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
File created	C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
File created	C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
File created	C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
File created	C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
File created	C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe	{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
File created	C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
Token: SeIncBasePriorityPrivilege	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
Token: SeIncBasePriorityPrivilege	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
Token: SeIncBasePriorityPrivilege	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
Token: SeIncBasePriorityPrivilege	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
Token: SeIncBasePriorityPrivilege	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
Token: SeIncBasePriorityPrivilege	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
Token: SeIncBasePriorityPrivilege	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
Token: SeIncBasePriorityPrivilege	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
Token: SeIncBasePriorityPrivilege	3152	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
Token: SeIncBasePriorityPrivilege	4452	{3305248C-2B82-4839-AA3D-9B68836D751F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3852	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe	96
PID 2412 wrote to memory of 3852	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe	96
PID 2412 wrote to memory of 3852	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe	96
PID 2412 wrote to memory of 3476	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe	97
PID 2412 wrote to memory of 3476	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe	97
PID 2412 wrote to memory of 3476	2412	2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe	97
PID 3852 wrote to memory of 2344	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	101
PID 3852 wrote to memory of 2344	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	101
PID 3852 wrote to memory of 2344	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	101
PID 3852 wrote to memory of 4208	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	102
PID 3852 wrote to memory of 4208	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	102
PID 3852 wrote to memory of 4208	3852	{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe	102
PID 2344 wrote to memory of 3948	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	104
PID 2344 wrote to memory of 3948	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	104
PID 2344 wrote to memory of 3948	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	104
PID 2344 wrote to memory of 3624	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	105
PID 2344 wrote to memory of 3624	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	105
PID 2344 wrote to memory of 3624	2344	{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe	105
PID 3948 wrote to memory of 400	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	107
PID 3948 wrote to memory of 400	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	107
PID 3948 wrote to memory of 400	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	107
PID 3948 wrote to memory of 4620	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	108
PID 3948 wrote to memory of 4620	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	108
PID 3948 wrote to memory of 4620	3948	{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe	108
PID 400 wrote to memory of 1536	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	109
PID 400 wrote to memory of 1536	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	109
PID 400 wrote to memory of 1536	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	109
PID 400 wrote to memory of 2532	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	110
PID 400 wrote to memory of 2532	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	110
PID 400 wrote to memory of 2532	400	{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe	110
PID 1536 wrote to memory of 2664	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	111
PID 1536 wrote to memory of 2664	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	111
PID 1536 wrote to memory of 2664	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	111
PID 1536 wrote to memory of 2332	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	112
PID 1536 wrote to memory of 2332	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	112
PID 1536 wrote to memory of 2332	1536	{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe	112
PID 2664 wrote to memory of 4308	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	113
PID 2664 wrote to memory of 4308	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	113
PID 2664 wrote to memory of 4308	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	113
PID 2664 wrote to memory of 1588	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	114
PID 2664 wrote to memory of 1588	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	114
PID 2664 wrote to memory of 1588	2664	{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe	114
PID 4308 wrote to memory of 3388	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	115
PID 4308 wrote to memory of 3388	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	115
PID 4308 wrote to memory of 3388	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	115
PID 4308 wrote to memory of 3220	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	116
PID 4308 wrote to memory of 3220	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	116
PID 4308 wrote to memory of 3220	4308	{525E4A82-DC86-4c4a-8F00-F99791820440}.exe	116
PID 3388 wrote to memory of 5072	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	117
PID 3388 wrote to memory of 5072	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	117
PID 3388 wrote to memory of 5072	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	117
PID 3388 wrote to memory of 5028	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	118
PID 3388 wrote to memory of 5028	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	118
PID 3388 wrote to memory of 5028	3388	{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe	118
PID 5072 wrote to memory of 3152	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	119
PID 5072 wrote to memory of 3152	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	119
PID 5072 wrote to memory of 3152	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	119
PID 5072 wrote to memory of 3232	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	120
PID 5072 wrote to memory of 3232	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	120
PID 5072 wrote to memory of 3232	5072	{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe	120
PID 3152 wrote to memory of 4452	3152	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe	121
PID 3152 wrote to memory of 4452	3152	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe	121
PID 3152 wrote to memory of 4452	3152	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe	121
PID 3152 wrote to memory of 4432	3152	{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe	122

C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
  C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
    C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
      C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
        
        C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:400
      - C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
        
        C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
        
        C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
        
        C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
        
        C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
        
        C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
        
        C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
        
        C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
        
        C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe
        
        C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe
        13⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{33052~1.EXE > nul
        13⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{22733~1.EXE > nul
        12⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{409E5~1.EXE > nul
        11⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B15B~1.EXE > nul
        10⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{525E4~1.EXE > nul
        9⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE8B3~1.EXE > nul
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C333~1.EXE > nul
        7⤵
        
        PID:2332
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94A22~1.EXE > nul
        6⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{47022~1.EXE > nul
        5⤵
        
        PID:4620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B2F07~1.EXE > nul
      4⤵
      PID:3624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D4AF0~1.EXE > nul
    3⤵
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe

Filesize
180KB

MD5
39a9888ea7d625351497b110200d40e8

SHA1
0e2f3d444068688fe524cb5c69844c6c53f77111

SHA256
f93e5de1c85a56411f6209bbd91bfb8d9183574f29d7d3e559f73334b24d40f2

SHA512
def6c49abb95e7992878fc12f3e8f27cc9c5d0f9088d6ff0c1a712abfd2e0f36428ee7588510870ff987e5fc6d2274dc322cd6c1eae51b1f35a1087eaee5fcb8

Download Submit
C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe

Filesize
180KB

MD5
533ec6109a92dd2d9d91b38ea66227ea

SHA1
62209b8b1c91ab314587e9403a6dc0c479e92b1a

SHA256
7c6ff16c422d84c9b96b230dfee10ad096f69ed4ebcaba19abffc2816e3f12b0

SHA512
b9a7f71d56fa91ec602876091bef58b965f22fb6b95b33652a24ec8492cf01557a835de3e46688333eec87b8233871243526d372083a8cf6c824f3c0c2d3304e

Download Submit
C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe

Filesize
180KB

MD5
ac7041106f3e65c4dac328b123946e50

SHA1
9111cc017ce177aab4381771cdfbc84cef73a3c3

SHA256
c6999e3c429ddc27b5dc4eb6df4acc37c461d840291469968c4ebb73501ec5ec

SHA512
f17bf7a3ff9af22c6c095b58ecf27bfb42fbe2afb2b1bf4d0a266a01c7a7acedf7270776fbbbd2e07c21aa0cb2c8a969a1b78080f9074797c6d0868b03cf2486

Download Submit
C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe

Filesize
180KB

MD5
77ca970601bbaa9a23b6f49411cae72e

SHA1
ac2c7003e0fd8ec0f3de252dd3e30bdc9c766aba

SHA256
efc7b7651b38827bd8d25c39b874566ed54a60e0668bd5f1f93a2e3d55c0883e

SHA512
59221c24ad1af6cd155e1abb51d7ddf943606b55d2843507cafeb4d1ae1cf8e91f9d5c955877d05f3c484f94783cc4f7a82fc25e3b775ac4d696d46e4b7f08dc

Download Submit
C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe

Filesize
180KB

MD5
352400cf5b738b7c46c4f9851e29a703

SHA1
379712375f6c3f7466c5d16b4f5d89d20af4ec44

SHA256
80342f731754278549fc7e3df27d10217d0a7fed380f7f437f88544f7300cefb

SHA512
02a90f07568afb3b6cbfbd1366f04c65983765c9515ec2c431577a11005fe9210a265433bb303efab30af95b8f31e54bedff37e9f5613449f176500b84bda751

Download Submit
C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe

Filesize
180KB

MD5
00d6ccb49e70a325959de7faffa4e58c

SHA1
51ef40ff84eeff7c5edfffddb9c4de211c060e72

SHA256
8b280e16d40d32ca947fa5fed9e8a3a60dff4e0431f780840625ff03c30b6118

SHA512
cbc9300b9b5622e5070f5ff689f5bc6f57b4bc81ba489e10d820760d46fdd20b2ce18cf8ceb547957853e77efca5eb81a0268783ba43a68955d6b7cf028ff340

Download Submit
C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe

Filesize
180KB

MD5
9ee774934793940ba560f56dad0a0073

SHA1
1c72d67e6a1462a4e638a538159f06dcb3b1cc2f

SHA256
3adc267eb7eed91b15c39897367462f339152789d5aa76db53abc9359d07ed4e

SHA512
62098afd8c564a0aca13bb26bcd2155f4ced133f19318cdd9aae9af77385bd944196bbaecefe0c61ad202eeb07464093cd6033243b67637498e69b4f24fab3ea

Download Submit
C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe

Filesize
180KB

MD5
ac69ba365bd7c3308cb049fac93562b0

SHA1
53d6e416f87aa08f9879f8538ac2d012a50af139

SHA256
1372f1552ee95cc4c35947e3233f33bf8a5128babf5da2c1f63dc1f68a0f7fda

SHA512
2f7c7c1bf3eb9c60c09319f81aa0d888f529266841f24169c9dba60ad1b3fba03af0af2f1bf0c52c18ebf8bed1733c23a3701246b833f4ea2041888806e575b0

Download Submit
C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe

Filesize
180KB

MD5
51f51449cc769d19208f15fb8bcaf34b

SHA1
d7c39a77c25c90c01cf3de0ec383fbc3ba5b5ce5

SHA256
e64f6290e726a2db87dcec2900aef3f059111a39fbb95015009e1d6a4030ddb7

SHA512
2d2b72c1ee9c70ddc9f6101c194547e1eb2cd7247680573c906ae45143fcb930fa81515f01d2b1ccdeb2182bdd522db0f48da847f9505f349b78068fb1e8e8a5

Download Submit
C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe

Filesize
180KB

MD5
0a60aad11dcebb8bfa23633702a7d79a

SHA1
b360644da327803302daca4ebca48a324c895f3b

SHA256
ef342ab0e5fc33e47aeac3f00a8da0361931d335dea42e285db9eb6b0fc678e1

SHA512
a34b09862e9aee15afaefff013283000070ce0acb105099d5d7488fee0e8777572698b3054d959828b0ef9589e193c12848601a8ec982dbcd2093664bacddbbb

Download Submit
C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe

Filesize
180KB

MD5
64ac67fe88ab4a59eacfeb51b96e3a3f

SHA1
63025829d17117a39af6d8a26b501a40fcbae654

SHA256
e3eb660d740b5c93b5de0a53fa48fa5f02d2a80e8be98cd4b7db5f5dae6ab0c1

SHA512
f706aa56bc5838710c87ecac48c8d8799d3db2eff5947555e8eea01e33bf7a31ffc47152afdafcd7e3886403a5fc99d4c2f9555b355722dbf3c95ac24332aa39

Download Submit
C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe

Filesize
180KB

MD5
479908d6f9e12826ed4e4577705da4bc

SHA1
62db8706e355428c95b6166f9ef8e5b2e77c6715

SHA256
818b7691ace8f1e3f6c83e54fd9d089ee82c90cf4ab1653643eec92d02e61278

SHA512
f453efb7d5ff7a8d0fb00ed7d2020a68e9a795234707c03462bb22fd233ec4a5a40f737a840104f3d615d7ad24bc13f36b0f42be785d74a66243ab1205482376

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads