226d7a007c1000e1b980a980ed3c509b00d3c1eab04882137e96fca0a5bd01b5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe
Size 344KB
Sample240613-dgjdbawaml
SHA256 226d7a007c1000e1b980a980ed3c509b00d3c1eab04882137e96fca0a5bd01b5
MD5 a4f58816799dc85ab918be049422948d
SHA1 6ffbd3dc1e45d2f2382846c8e089c6ba09ea2ef4
SHA512 c6283e5712c2fca1326ece7ad1da31eab29bf0d8ee3a052c3e4ec0eb7c4137530dbf789b1d83a62ce98ec4aa1292f9a57250d70bf279cebbbe5a1030cde9ecfe
SSDEEP 3072:mEGh0oqlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGUlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022a48-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000232f4-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002353d-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023541-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023547-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023541-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023547-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023541-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023547-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000000002f-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000713-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7418313-340E-4e65-B422-23BDA7F5D478}\stubpath = "C:\\Windows\\{E7418313-340E-4e65-B422-23BDA7F5D478}.exe"	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B45D6D-A5B9-4a9a-A838-026336B736B1}\stubpath = "C:\\Windows\\{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe"	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}\stubpath = "C:\\Windows\\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe"	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}	{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7418313-340E-4e65-B422-23BDA7F5D478}	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}\stubpath = "C:\\Windows\\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe"	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}\stubpath = "C:\\Windows\\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe"	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}	{C12FD799-A652-4f94-B50E-1A172785B732}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}\stubpath = "C:\\Windows\\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe"	{C12FD799-A652-4f94-B50E-1A172785B732}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}\stubpath = "C:\\Windows\\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe"	{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}\stubpath = "C:\\Windows\\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe"	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B45D6D-A5B9-4a9a-A838-026336B736B1}	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C12FD799-A652-4f94-B50E-1A172785B732}	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}\stubpath = "C:\\Windows\\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe"	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}\stubpath = "C:\\Windows\\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe"	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D08D7448-DAA1-4b10-9101-4367CD06F159}	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D08D7448-DAA1-4b10-9101-4367CD06F159}\stubpath = "C:\\Windows\\{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe"	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C12FD799-A652-4f94-B50E-1A172785B732}\stubpath = "C:\\Windows\\{C12FD799-A652-4f94-B50E-1A172785B732}.exe"	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe

Executes dropped EXE 12 IoCs

pid	Process
1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe
4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
4788	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
1204	{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe
4100	{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
File created	C:\Windows\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	{C12FD799-A652-4f94-B50E-1A172785B732}.exe
File created	C:\Windows\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
File created	C:\Windows\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
File created	C:\Windows\{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe
File created	C:\Windows\{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
File created	C:\Windows\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
File created	C:\Windows\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
File created	C:\Windows\{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
File created	C:\Windows\{C12FD799-A652-4f94-B50E-1A172785B732}.exe	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
File created	C:\Windows\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
File created	C:\Windows\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe	{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
Token: SeIncBasePriorityPrivilege	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
Token: SeIncBasePriorityPrivilege	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
Token: SeIncBasePriorityPrivilege	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
Token: SeIncBasePriorityPrivilege	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
Token: SeIncBasePriorityPrivilege	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
Token: SeIncBasePriorityPrivilege	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe
Token: SeIncBasePriorityPrivilege	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
Token: SeIncBasePriorityPrivilege	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
Token: SeIncBasePriorityPrivilege	4788	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
Token: SeIncBasePriorityPrivilege	1204	{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1220	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe	95
PID 2248 wrote to memory of 1220	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe	95
PID 2248 wrote to memory of 1220	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe	95
PID 2248 wrote to memory of 2520	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe	96
PID 2248 wrote to memory of 2520	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe	96
PID 2248 wrote to memory of 2520	2248	2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe	96
PID 1220 wrote to memory of 3632	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	97
PID 1220 wrote to memory of 3632	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	97
PID 1220 wrote to memory of 3632	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	97
PID 1220 wrote to memory of 3792	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	98
PID 1220 wrote to memory of 3792	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	98
PID 1220 wrote to memory of 3792	1220	{E7418313-340E-4e65-B422-23BDA7F5D478}.exe	98
PID 3632 wrote to memory of 512	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	101
PID 3632 wrote to memory of 512	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	101
PID 3632 wrote to memory of 512	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	101
PID 3632 wrote to memory of 2156	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	102
PID 3632 wrote to memory of 2156	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	102
PID 3632 wrote to memory of 2156	3632	{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe	102
PID 512 wrote to memory of 1724	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	107
PID 512 wrote to memory of 1724	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	107
PID 512 wrote to memory of 1724	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	107
PID 512 wrote to memory of 3812	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	108
PID 512 wrote to memory of 3812	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	108
PID 512 wrote to memory of 3812	512	{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe	108
PID 1724 wrote to memory of 2408	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	110
PID 1724 wrote to memory of 2408	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	110
PID 1724 wrote to memory of 2408	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	110
PID 1724 wrote to memory of 3092	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	111
PID 1724 wrote to memory of 3092	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	111
PID 1724 wrote to memory of 3092	1724	{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe	111
PID 2408 wrote to memory of 1920	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	112
PID 2408 wrote to memory of 1920	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	112
PID 2408 wrote to memory of 1920	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	112
PID 2408 wrote to memory of 2164	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	113
PID 2408 wrote to memory of 2164	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	113
PID 2408 wrote to memory of 2164	2408	{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe	113
PID 1920 wrote to memory of 3876	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	114
PID 1920 wrote to memory of 3876	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	114
PID 1920 wrote to memory of 3876	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	114
PID 1920 wrote to memory of 4108	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	115
PID 1920 wrote to memory of 4108	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	115
PID 1920 wrote to memory of 4108	1920	{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe	115
PID 3876 wrote to memory of 4544	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe	116
PID 3876 wrote to memory of 4544	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe	116
PID 3876 wrote to memory of 4544	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe	116
PID 3876 wrote to memory of 3020	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe	117
PID 3876 wrote to memory of 3020	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe	117
PID 3876 wrote to memory of 3020	3876	{C12FD799-A652-4f94-B50E-1A172785B732}.exe	117
PID 4544 wrote to memory of 1916	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	118
PID 4544 wrote to memory of 1916	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	118
PID 4544 wrote to memory of 1916	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	118
PID 4544 wrote to memory of 2324	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	119
PID 4544 wrote to memory of 2324	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	119
PID 4544 wrote to memory of 2324	4544	{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe	119
PID 1916 wrote to memory of 4788	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	120
PID 1916 wrote to memory of 4788	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	120
PID 1916 wrote to memory of 4788	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	120
PID 1916 wrote to memory of 228	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	121
PID 1916 wrote to memory of 228	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	121
PID 1916 wrote to memory of 228	1916	{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe	121
PID 4788 wrote to memory of 1204	4788	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe	122
PID 4788 wrote to memory of 1204	4788	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe	122
PID 4788 wrote to memory of 1204	4788	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe	122
PID 4788 wrote to memory of 3172	4788	{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe	123

C:\Users\Admin\AppData\Local\Temp\2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_a4f58816799dc85ab918be049422948d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
  C:\Windows\{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
    C:\Windows\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
      C:\Windows\{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:512
    - - C:\Windows\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
        
        C:\Windows\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
      - C:\Windows\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
        
        C:\Windows\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
        
        C:\Windows\{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\{C12FD799-A652-4f94-B50E-1A172785B732}.exe
        
        C:\Windows\{C12FD799-A652-4f94-B50E-1A172785B732}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
        
        C:\Windows\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
        
        C:\Windows\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
        
        C:\Windows\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe
        
        C:\Windows\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
        
        C:\Windows\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe
        
        C:\Windows\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe
        13⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46DF2~1.EXE > nul
        13⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D5BBC~1.EXE > nul
        12⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{676F8~1.EXE > nul
        11⤵
        
        PID:228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{986DB~1.EXE > nul
        10⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C12FD~1.EXE > nul
        9⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89B45~1.EXE > nul
        8⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{07C2C~1.EXE > nul
        7⤵
        
        PID:2164
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36F87~1.EXE > nul
        6⤵
        
        PID:3092
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D08D7~1.EXE > nul
        5⤵
        
        PID:3812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{95AAA~1.EXE > nul
      4⤵
      PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E7418~1.EXE > nul
    3⤵
    PID:3792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe

Path C:\Windows\{07C2C3B8-682D-405d-83EC-CCC77A71FFB6}.exe
Size 344KB
SHA256 a71c97670050cf8f83ecfb26077077986d3141b5c2f234ee49590234fee03f15
MD5 c0407d102d70b880edee5047bb36ee03
SHA1 88478a2a4a0fcc97a68cbc487b9f4a01eeaa5fa3
SHA512 3afb6524093d1bc42e21ce27aa449716dfffa98932c3570eac6d0696c8081c5aee2ba522a45f6c1706b871e92f73009f4d60d134fd7751be3033bb3b0b9678cb
SSDEEP 3072:mEGh0oulEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGAlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe

Path C:\Windows\{36F87F15-A3AB-4bf7-A977-5DD5D423FFAC}.exe
Size 344KB
SHA256 1d139cad0055f06f7645498e758dd7e238e51d20db2a95441f9081e6768e68f4
MD5 2b4da2ec8be22def04c89acd2c23c53e
SHA1 8b494137fcaa277fb8c434677e69e081690d2f98
SHA512 4c6d9855940738188314d0909c64aa993c75a05c4cfdb8df037693af432c3b619ad049d323c29c9b8ddd279eea7ea50bb2e19ccf4268fe2c7f13357cf7b02eb5
SSDEEP 3072:mEGh0oflEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGFlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe

Path C:\Windows\{46DF2CC4-4D8C-433d-8B9D-E1F22250395E}.exe
Size 344KB
SHA256 6d1360adf529fcc34599432f5746d3b06925f9e91a6a094bf206679a6cb92d8e
MD5 68941d215f32810e63d25154f9148112
SHA1 124e2e1b995a8fa3bab2b15500dc55d1f0c74617
SHA512 387f37017995536e6a41092973ea3a26c05da9368ebac356d9cb748d34f761be2ff52c52d0a1e193dff96e1be1183103edef784a8c6c590f9186ebc03d52b026
SSDEEP 3072:mEGh0oblEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGtlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe

Path C:\Windows\{676F84F1-4F75-4900-92FC-70C1F1EE7EA7}.exe
Size 344KB
SHA256 0d2911b0f2a7257226dd512197c925a2ed197ec46362d86a965b6ddecb7ff7c4
MD5 c7d0d4bccc2d91ab6496e76326672879
SHA1 6554c5896250fded38638eb821f76777e9c0aae1
SHA512 a37632ef07bd6f1153be2b40ce7a76b68d269dc7a0732b9b6113edf49cc8a09d30040e8d64443cd51f852adbbdb5ea97edc6beda7d6ff837e5fb4afc7200e122
SSDEEP 3072:mEGh0oVlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGjlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe

Path C:\Windows\{89B45D6D-A5B9-4a9a-A838-026336B736B1}.exe
Size 344KB
SHA256 9c8fdb173d47327c8162f03ff915764ebe7d97b9b6c287870e31a4b62a658139
MD5 685d95207a5ffb546fa85cb250e02296
SHA1 723d79fd4ea1fa68c9f5fda02649e17b820c08d8
SHA512 4c4ed33d4dfcc1ee34103500b43ab7e143d43bf1e1005e45f3fe238dab83e4235b7d78b1c2d14a6ea2954c122d901abb86f82d2e3348446306581d88ec3f733c
SSDEEP 3072:mEGh0ohlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG7lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe

Path C:\Windows\{95AAA117-7740-48b7-ADE0-2BD7DB577B50}.exe
Size 344KB
SHA256 bbd84637e1fa82acab1e4ade10d1e8fa57f197169fcc3fda955dbc347eb8ed9e
MD5 996b1ae84645e7a89562250ddc77038d
SHA1 c4adc9f630eb64a5b158a36113574358f71d0b7a
SHA512 d4e2655780e8f366ad4e74a3a82da85907a4602518ffa70553f7d27e997d347b6ee0aab12d2500909b83d9d2bbc919ac6c835767980251e09d875502a5bd45be
SSDEEP 3072:mEGh0o4lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGilqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe

Path C:\Windows\{986DBD43-9C3F-4d3b-87BB-46F40CB200A0}.exe
Size 344KB
SHA256 ad878f750bb82cf0775b0ff3dd1c2c7a0d1e299a30d7b7a806ef654da5fa7722
MD5 bfb4f583264e9ff93866fe1451e32e31
SHA1 3eae407fbbf696d549bd864992b3d2a84873e493
SHA512 9d656f42385889c96da2dc12e566d7f5ae7f64ac085cd36fb7adc9826a1e04f28b8fd4906a07798ab163ab11bca1632ed1971c4ede032084647ee8e64480f183
SSDEEP 3072:mEGh0o3lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG5lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C12FD799-A652-4f94-B50E-1A172785B732}.exe

Path C:\Windows\{C12FD799-A652-4f94-B50E-1A172785B732}.exe
Size 344KB
SHA256 01704b166f541a31e6888e1e93a915ea120c8c1e327baf3ca0d75f0476414896
MD5 b036c77a481594aba682f16880a3daca
SHA1 3e09686a9cd29094474fbb6e83acefb319fcd10f
SHA512 e0138d3d595c4804c8a99caa4376ce23ad52fb8ccefbe9e248927f7ce08690cb90a4cef0bcef906ed720f3443e219765b97fbe24eda5e96519d3afe5546d3a00
SSDEEP 3072:mEGh0o6lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGIlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe

Path C:\Windows\{D08D7448-DAA1-4b10-9101-4367CD06F159}.exe
Size 344KB
SHA256 6ade7844151633c73aa15b1d5114199c49a92831c5a0ee44f5e47417e5b930be
MD5 7f102a61fce29e2051ee3c7c57c666dc
SHA1 0ba5d65b4edec61345310f638e0a066345c55dac
SHA512 ad720ff3b91b05118178782fcc641c7bef203db1c7f652c1c615d5462474844e62e91cc793f961121cf46f89abf4a514325609b6e332dd1ef2ad67fc4ea8b32b
SSDEEP 3072:mEGh0oMlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG2lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe

Path C:\Windows\{D5BBC0FF-46B8-486b-8F5B-7E52155621ED}.exe
Size 344KB
SHA256 cc8e5e014794fd8ddecc0fdda238f99cf1705f2c2b19bc7db7bdc7134bcfa659
MD5 8421a9e4af141330795d12a75230cda9
SHA1 5076b70bc72dcc1237a99586bf60c19335881782
SHA512 ea6d2fe15389eb5cfb233ec66f922198737cee5cc8ee8a92ce7564e687818ad46249ba7f1235360f03f3656acdf7fdda3022af14ed9e939beab4743ae0e7d00a
SSDEEP 3072:mEGh0orlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGxlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E7418313-340E-4e65-B422-23BDA7F5D478}.exe

Path C:\Windows\{E7418313-340E-4e65-B422-23BDA7F5D478}.exe
Size 344KB
SHA256 055a7c6e12361bd168a05700e45b03fbc423ceac50e4d0a634497a581283623a
MD5 4148abdc35d7c817966df827be430255
SHA1 fb2d2118f0c56d996101c5b4464b9bfabb9280a4
SHA512 f09579aaf0d9f26b02c170991eed7613d8b8808ae06faa2a704572ed5ce0ebda383450af55753c22cf94d78170237e2f03bb94d1bd96ce2ddb3796a07218de16
SSDEEP 3072:mEGh0oPlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGhlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe

Path C:\Windows\{E8C95CAF-42FF-4088-8B83-6D82B63937BE}.exe
Size 344KB
SHA256 9280d244a4bfcb180203fd88b82198159e37c055498f8e49ca8dc60504454214
MD5 ba9cdade2d7a8332888d58a2a273e210
SHA1 4941ad8a2bf7492c1cabbff12a21ccbaea0528c5
SHA512 9b62c032377cc7687b1526f1e90a65e5c1203fd3aac8e27fca9aaf95b53da659d1585351454da47d35010baa378bd84f4bb2669cdaf67cc80efbbfa59b51139e
SSDEEP 3072:mEGh0o2lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG4lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads