c4620e100313332590d64d43ef6c42de6f6e09bf5350236854345d945a61504a

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe
Size 380KB
Sample240613-mgd82avcpb
SHA256 c4620e100313332590d64d43ef6c42de6f6e09bf5350236854345d945a61504a
MD5 28ed6ceaff90be103a31aa67a5c1934e
SHA1 cb91bcb4ba244af7aea0ba24af6caab26bd16429
SHA512 5af5fb0d976c570cbe562dfbc4b22cf0cd94ca432b9f5774a570e1470bd60165b187ddaa6b1f3c519c7d39ad3da6862db6e6e1d6569b3a03bb44e8a5bf81aae2
SSDEEP 3072:mEGh0o6lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGkl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000e0000000232fc-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023302-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023552-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023556-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002355c-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023556-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002355c-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023556-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000000002f-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006dd-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000713-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000006dd-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C34580AB-B6E8-4d12-9907-79762CCE84C9}\stubpath = "C:\\Windows\\{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe"	{4539A08B-A73C-4447-B41A-639800534B80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C070D4B-C4D3-4198-907D-8069479BBB36}	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FCE6071-6806-4aec-BC1E-270512C50E9B}\stubpath = "C:\\Windows\\{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe"	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{298DAB12-9172-4783-B1A3-E4ACBD615D46}	{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C34580AB-B6E8-4d12-9907-79762CCE84C9}	{4539A08B-A73C-4447-B41A-639800534B80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}\stubpath = "C:\\Windows\\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe"	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}\stubpath = "C:\\Windows\\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe"	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B13F0A32-ABB3-4adf-A113-D0DE38330195}\stubpath = "C:\\Windows\\{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe"	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}\stubpath = "C:\\Windows\\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe"	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C070D4B-C4D3-4198-907D-8069479BBB36}\stubpath = "C:\\Windows\\{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe"	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FCE6071-6806-4aec-BC1E-270512C50E9B}	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}\stubpath = "C:\\Windows\\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe"	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4539A08B-A73C-4447-B41A-639800534B80}	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{298DAB12-9172-4783-B1A3-E4ACBD615D46}\stubpath = "C:\\Windows\\{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe"	{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}\stubpath = "C:\\Windows\\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe"	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B13F0A32-ABB3-4adf-A113-D0DE38330195}	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}\stubpath = "C:\\Windows\\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe"	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4539A08B-A73C-4447-B41A-639800534B80}\stubpath = "C:\\Windows\\{4539A08B-A73C-4447-B41A-639800534B80}.exe"	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe

Executes dropped EXE 12 IoCs

pid	Process
3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe
2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
3912	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
4460	{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
4608	{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
File created	C:\Windows\{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
File created	C:\Windows\{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
File created	C:\Windows\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
File created	C:\Windows\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
File created	C:\Windows\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
File created	C:\Windows\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
File created	C:\Windows\{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe	{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
File created	C:\Windows\{4539A08B-A73C-4447-B41A-639800534B80}.exe	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe
File created	C:\Windows\{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	{4539A08B-A73C-4447-B41A-639800534B80}.exe
File created	C:\Windows\{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
File created	C:\Windows\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe
Token: SeIncBasePriorityPrivilege	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
Token: SeIncBasePriorityPrivilege	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
Token: SeIncBasePriorityPrivilege	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
Token: SeIncBasePriorityPrivilege	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
Token: SeIncBasePriorityPrivilege	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
Token: SeIncBasePriorityPrivilege	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
Token: SeIncBasePriorityPrivilege	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
Token: SeIncBasePriorityPrivilege	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
Token: SeIncBasePriorityPrivilege	3912	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
Token: SeIncBasePriorityPrivilege	4460	{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3100	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe	95
PID 3188 wrote to memory of 3100	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe	95
PID 3188 wrote to memory of 3100	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe	95
PID 3188 wrote to memory of 452	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe	96
PID 3188 wrote to memory of 452	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe	96
PID 3188 wrote to memory of 452	3188	2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe	96
PID 3100 wrote to memory of 2752	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe	97
PID 3100 wrote to memory of 2752	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe	97
PID 3100 wrote to memory of 2752	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe	97
PID 3100 wrote to memory of 3064	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe	98
PID 3100 wrote to memory of 3064	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe	98
PID 3100 wrote to memory of 3064	3100	{4539A08B-A73C-4447-B41A-639800534B80}.exe	98
PID 2752 wrote to memory of 3616	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	101
PID 2752 wrote to memory of 3616	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	101
PID 2752 wrote to memory of 3616	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	101
PID 2752 wrote to memory of 1760	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	102
PID 2752 wrote to memory of 1760	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	102
PID 2752 wrote to memory of 1760	2752	{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe	102
PID 3616 wrote to memory of 4332	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	107
PID 3616 wrote to memory of 4332	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	107
PID 3616 wrote to memory of 4332	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	107
PID 3616 wrote to memory of 4440	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	108
PID 3616 wrote to memory of 4440	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	108
PID 3616 wrote to memory of 4440	3616	{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe	108
PID 4332 wrote to memory of 392	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	110
PID 4332 wrote to memory of 392	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	110
PID 4332 wrote to memory of 392	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	110
PID 4332 wrote to memory of 1596	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	111
PID 4332 wrote to memory of 1596	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	111
PID 4332 wrote to memory of 1596	4332	{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe	111
PID 392 wrote to memory of 4508	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	112
PID 392 wrote to memory of 4508	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	112
PID 392 wrote to memory of 4508	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	112
PID 392 wrote to memory of 1188	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	113
PID 392 wrote to memory of 1188	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	113
PID 392 wrote to memory of 1188	392	{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe	113
PID 4508 wrote to memory of 4876	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	114
PID 4508 wrote to memory of 4876	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	114
PID 4508 wrote to memory of 4876	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	114
PID 4508 wrote to memory of 968	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	115
PID 4508 wrote to memory of 968	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	115
PID 4508 wrote to memory of 968	4508	{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe	115
PID 4876 wrote to memory of 2672	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	116
PID 4876 wrote to memory of 2672	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	116
PID 4876 wrote to memory of 2672	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	116
PID 4876 wrote to memory of 5116	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	117
PID 4876 wrote to memory of 5116	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	117
PID 4876 wrote to memory of 5116	4876	{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe	117
PID 2672 wrote to memory of 3320	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	118
PID 2672 wrote to memory of 3320	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	118
PID 2672 wrote to memory of 3320	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	118
PID 2672 wrote to memory of 3008	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	119
PID 2672 wrote to memory of 3008	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	119
PID 2672 wrote to memory of 3008	2672	{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe	119
PID 3320 wrote to memory of 3912	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	120
PID 3320 wrote to memory of 3912	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	120
PID 3320 wrote to memory of 3912	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	120
PID 3320 wrote to memory of 2528	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	121
PID 3320 wrote to memory of 2528	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	121
PID 3320 wrote to memory of 2528	3320	{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe	121
PID 3912 wrote to memory of 4460	3912	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe	122
PID 3912 wrote to memory of 4460	3912	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe	122
PID 3912 wrote to memory of 4460	3912	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe	122
PID 3912 wrote to memory of 2752	3912	{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe	123

C:\Users\Admin\AppData\Local\Temp\2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_28ed6ceaff90be103a31aa67a5c1934e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\{4539A08B-A73C-4447-B41A-639800534B80}.exe
  C:\Windows\{4539A08B-A73C-4447-B41A-639800534B80}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
    C:\Windows\{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
      C:\Windows\{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
        
        C:\Windows\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4332
      - C:\Windows\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
        
        C:\Windows\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
        
        C:\Windows\{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
        
        C:\Windows\{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
        
        C:\Windows\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
        
        C:\Windows\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
        
        C:\Windows\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
        
        C:\Windows\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Windows\{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe
        
        C:\Windows\{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe
        13⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8A28A~1.EXE > nul
        13⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F3441~1.EXE > nul
        12⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B6C45~1.EXE > nul
        11⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F2101~1.EXE > nul
        10⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9FCE6~1.EXE > nul
        9⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1C070~1.EXE > nul
        8⤵
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{72DEC~1.EXE > nul
        7⤵
        
        PID:1188
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C72DD~1.EXE > nul
        6⤵
        
        PID:1596
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B13F0~1.EXE > nul
        5⤵
        
        PID:4440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C3458~1.EXE > nul
      4⤵
      PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4539A~1.EXE > nul
    3⤵
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4328,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe

Path C:\Windows\{1C070D4B-C4D3-4198-907D-8069479BBB36}.exe
Size 380KB
SHA256 1d34fa331cf40b0e0a07a34f0459c9560a5477d23a558b4cc254c16735f594b4
MD5 b3c5b4a670f5fe03340f7cef682519d8
SHA1 027988cc8541ef625796676c22c200a53d829511
SHA512 e6756a73558ccfe8165069397e91c8450bdac92ef4b4d7483cb1f747dd39e605b00b6b9b1336bf94614533927f2b525c1f1d5d79df2cffd74d199022c6e9a8a5
SSDEEP 3072:mEGh0oLlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGVl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe

Path C:\Windows\{298DAB12-9172-4783-B1A3-E4ACBD615D46}.exe
Size 380KB
SHA256 9f2af8f83f8fef1cbc4629fb6a5de3f7111e092b8b4cac705c0c16b8b312a6fd
MD5 6b7424f3fe33d0eb1c7141964e82487e
SHA1 827adee53ab25766e6ea5481563eb45ecf5494a1
SHA512 ef2d7b16df5d79145d791d5f23d05e18f01eb34a9ac8dc4ec57ea01993b8626e57fd7e0f628f69c860e571b014f791019d7121655cc1d92f356bcfa081b34fd8
SSDEEP 3072:mEGh0owlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGCl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4539A08B-A73C-4447-B41A-639800534B80}.exe

Path C:\Windows\{4539A08B-A73C-4447-B41A-639800534B80}.exe
Size 380KB
SHA256 8c67569ead486184dcc1e22d8bdf254baaffd57b3c14cb634a20fc0fe21e7e9f
MD5 033f7d0192cebc6f56edbb86af190b14
SHA1 6beeb6b0580d8011197b1afad4e82627d05a8236
SHA512 4ceb616e3ef86f4022fb7920397037de40fff90b88c89b0f637ee83dfe8639198e79f2a898c853fd0260e6b313bf976525bf60bbd50b418dda84cd23d7f5ae2f
SSDEEP 3072:mEGh0o7lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGdl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe

Path C:\Windows\{72DECF4E-45AF-4440-8DBB-E5104DE2F5B0}.exe
Size 380KB
SHA256 76a390aed474fd66e4b427dce8894e4f589fdf08e769fd5c54a9bed012571dc7
MD5 aa4f354225e5b3326989fb0e3031a28c
SHA1 2f2abcd4411fdf120349860fb640aaf4a9120d93
SHA512 64231d37a5905fd52a7b9dd7b678da3db7713451249f345ba18c1cdd26fed3c5efd424e442908caf6b65b8d1825e868c40c5c89dfb55e382daf589134af74289
SSDEEP 3072:mEGh0onlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGdl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe

Path C:\Windows\{8A28A3E1-9E34-40ac-A588-4FAF18E9F969}.exe
Size 380KB
SHA256 7b4524f6b4ac19e70049b960c2ed545a0322a43ed2b77beb99e04990e5800864
MD5 0a27d3fa10a75e25496103dfd38ca317
SHA1 df1d4bfba64047d4a0ede9f0546c72e50f93689f
SHA512 4f9b72ba469279fc2b9eb4cfeac4c939042c8292fd8a3667530eff992dd9303dc22c38753df0fc2df9a055c4e68f16b7ba7adfd6c9686e0116cfff853067dd25
SSDEEP 3072:mEGh0oilPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGQl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe

Path C:\Windows\{9FCE6071-6806-4aec-BC1E-270512C50E9B}.exe
Size 380KB
SHA256 4b214e899d5685d39aef454073d1160a70df508338d40578f948c33ee000c098
MD5 0aba8e0932d9b5723c21855024a9ee34
SHA1 4a9d67e59ce6e0b94e9a8ba7fa8cf16080b42989
SHA512 2c45a419adfbfab01eac2b63beb5f95bd758dc880cba2ffa711e16d08f07f74d4ab5d7e0fc3fc287006124c78475b7635292fd051beab5f5df3c1ab576374ef9
SSDEEP 3072:mEGh0oIlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGel7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe

Path C:\Windows\{B13F0A32-ABB3-4adf-A113-D0DE38330195}.exe
Size 380KB
SHA256 b0f8a3e7cc32fe3a9e1dd3c9f9cd68a3e422a3a9f12a3d345591eba0572c82ff
MD5 71f376c3340ece569cd8de5eef00ede8
SHA1 c6d210f1ed9ddeeacf09f7fbdd7d515162c72f64
SHA512 ea501b3f94d25f9779a8b1a7bb447e84d02138053a5f4a3c7c168f688e546a5eaee1cb62e21ff8afb393599f73d9f9f0919170ee51cd9a490a58fdab059df8c6
SSDEEP 3072:mEGh0oIlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGSl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe

Path C:\Windows\{B6C458E1-B0DC-4a38-9CAD-E4EE68D2035B}.exe
Size 380KB
SHA256 7a0f624ff81d7b14855a58301484a9e07542baac7eb9f93eb39ad08f5838f343
MD5 b2bf94af8ee71246f059da6434a2a5a8
SHA1 d31f55a1455f4f915074abc92c7f681dc3eb5b3d
SHA512 7409ba4aa4cc6d11c6b1cda4124e2783904c18b1527ac27eca5ff3f187c626dc98066fc4dc6978ac3681300c024e049fbde07352b84b833d70422d27f7b7e6ae
SSDEEP 3072:mEGh0o9ZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEct:mEGNl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe

Path C:\Windows\{C34580AB-B6E8-4d12-9907-79762CCE84C9}.exe
Size 380KB
SHA256 d8461f762b15eab87874831e2047e6fff8b9b15f39a86c214227a8cc3e93302e
MD5 b8e40aae6eadb6fddf33f08cdcb7ca9e
SHA1 6a06f15ae82a287d7cf0d0bb63382e2df3958b2a
SHA512 fb0a7ecf4d92d27ba21456f623b840fa41fa9e774978d379b207700cc29b83a13c766ae4556e4cbb439cf3b71fd6fc8a270ee2d22f9761b237abb32a1a67c8a5
SSDEEP 3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG/l7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe

Path C:\Windows\{C72DD18D-A12B-4acc-9C5A-02315F01D03A}.exe
Size 380KB
SHA256 4ac7ab10798356595e456388b32c30bef75a5c655977396271b0da5a871bb94d
MD5 9a9feb15f91b74c9098729c667dc56d4
SHA1 c0a3d0fcb883c85153bf61dca769273a3a8c1110
SHA512 070fa211ade294c93cf215e69155a02547b99966b918e5c81d80b793262f5e5fa6cae76bfb04847e7fc4843ba37d3a934c4d44cd880fe06d55149173b31b6540
SSDEEP 3072:mEGh0oalPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGol7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe

Path C:\Windows\{F21012D9-4ED9-49e1-A888-6B90AC46FEE6}.exe
Size 380KB
SHA256 c9072acb208cc09d01f17847a8bc077be6386dcf881067cb179e5a6504a9e98f
MD5 ba44681dc7ed5d3e478c784bdf64430c
SHA1 f7d2c6ba56110075ed99e108146e90ff0682792e
SHA512 84c242bcfbf6af084999b3920bdee6a3d468c862e73c1a180229f76a388892387aba9debe7a19341caf79fe2b75233086f3a59dc1f66bd3d0f3d5c603346be28
SSDEEP 3072:mEGh0oElPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGel7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe

Path C:\Windows\{F3441C78-1CDC-4736-800F-5C2EA3E026F5}.exe
Size 380KB
SHA256 590e16bb37378bf5be6983754a3966b36e447cb7cf3ea893bab6646abe9a623d
MD5 3592955cb0a67e67888310d11aac4e03
SHA1 3b7e8ba8074ad1e56151cb0b60da47e123552813
SHA512 239c07d23aeb6d3fb200336408e5d22ac0b1f106934644cd1391fb27a6ebc4edf4e5284c7254f71ef0ec03b7e2ef30386faf8aa9712cd9f37f34cd80baa2046e
SSDEEP 3072:mEGh0oOlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGMl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads