88823641a1cd1e9989acaabd71dce2a1c2297e5a5075c323bef6feb88e3555cc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe
Size

197KB
MD5

df791a96419e19c6634fd1dccd7ca66d
SHA1

add891511bfe7f9ae9e8e26c4a248193487895ed
SHA256

88823641a1cd1e9989acaabd71dce2a1c2297e5a5075c323bef6feb88e3555cc
SHA512

8f7b06adda8bb3a3010c808c3bb8db6a720249843f0e5f4b1384bd3431c88c4c4b52fc6550e5dbc38f972280bdc4577c56d2f1c59bfb6691db2625497a482583
SSDEEP

3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGUlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 16 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231c0-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002320a-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002320a-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023317-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023317-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001db8d-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002320a-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db8d-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002337f-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002338e-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00060000000234af-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002338e-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002338e-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023116-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002311b-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002311b-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A9B6652-6817-46c2-9D65-7032906C3F25}	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20015EEE-B113-4839-94D0-556015DB0B44}\stubpath = "C:\\Windows\\{20015EEE-B113-4839-94D0-556015DB0B44}.exe"	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B357AE8A-2157-4ae4-8013-1741C81CD59F}	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B357AE8A-2157-4ae4-8013-1741C81CD59F}\stubpath = "C:\\Windows\\{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe"	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91119144-BA47-4a71-8A15-6419EB5C4D99}\stubpath = "C:\\Windows\\{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe"	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}\stubpath = "C:\\Windows\\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe"	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C94B436-AE81-4e74-93A2-9D287686F5C2}\stubpath = "C:\\Windows\\{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe"	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}	{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}\stubpath = "C:\\Windows\\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe"	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}	{20015EEE-B113-4839-94D0-556015DB0B44}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}\stubpath = "C:\\Windows\\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe"	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91119144-BA47-4a71-8A15-6419EB5C4D99}	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C94B436-AE81-4e74-93A2-9D287686F5C2}	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A9B6652-6817-46c2-9D65-7032906C3F25}\stubpath = "C:\\Windows\\{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe"	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20015EEE-B113-4839-94D0-556015DB0B44}	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}\stubpath = "C:\\Windows\\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe"	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B8167D4-96B6-431f-89C1-4CA17486BABF}\stubpath = "C:\\Windows\\{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe"	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}\stubpath = "C:\\Windows\\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}.exe"	{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}\stubpath = "C:\\Windows\\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe"	{20015EEE-B113-4839-94D0-556015DB0B44}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B8167D4-96B6-431f-89C1-4CA17486BABF}	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe

Executes dropped EXE 11 IoCs

pid	Process
3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe
1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe
3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
636	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe
4460	{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
File created	C:\Windows\{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe
File created	C:\Windows\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}.exe	{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe
File created	C:\Windows\{20015EEE-B113-4839-94D0-556015DB0B44}.exe	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
File created	C:\Windows\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	{20015EEE-B113-4839-94D0-556015DB0B44}.exe
File created	C:\Windows\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
File created	C:\Windows\{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
File created	C:\Windows\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
File created	C:\Windows\{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe
File created	C:\Windows\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
File created	C:\Windows\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
File created	C:\Windows\{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
Token: SeIncBasePriorityPrivilege	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
Token: SeIncBasePriorityPrivilege	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe
Token: SeIncBasePriorityPrivilege	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
Token: SeIncBasePriorityPrivilege	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
Token: SeIncBasePriorityPrivilege	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
Token: SeIncBasePriorityPrivilege	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe
Token: SeIncBasePriorityPrivilege	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
Token: SeIncBasePriorityPrivilege	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
Token: SeIncBasePriorityPrivilege	636	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3148	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe	98
PID 2536 wrote to memory of 3148	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe	98
PID 2536 wrote to memory of 3148	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe	98
PID 2536 wrote to memory of 2400	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe	99
PID 2536 wrote to memory of 2400	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe	99
PID 2536 wrote to memory of 2400	2536	2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe	99
PID 3148 wrote to memory of 1056	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	101
PID 3148 wrote to memory of 1056	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	101
PID 3148 wrote to memory of 1056	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	101
PID 3148 wrote to memory of 2388	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	100
PID 3148 wrote to memory of 2388	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	100
PID 3148 wrote to memory of 2388	3148	{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe	100
PID 1056 wrote to memory of 4872	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	105
PID 1056 wrote to memory of 4872	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	105
PID 1056 wrote to memory of 4872	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	105
PID 1056 wrote to memory of 2168	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	104
PID 1056 wrote to memory of 2168	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	104
PID 1056 wrote to memory of 2168	1056	{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe	104
PID 4872 wrote to memory of 1484	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe	107
PID 4872 wrote to memory of 1484	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe	107
PID 4872 wrote to memory of 1484	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe	107
PID 4872 wrote to memory of 632	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe	106
PID 4872 wrote to memory of 632	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe	106
PID 4872 wrote to memory of 632	4872	{20015EEE-B113-4839-94D0-556015DB0B44}.exe	106
PID 1484 wrote to memory of 3004	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	109
PID 1484 wrote to memory of 3004	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	109
PID 1484 wrote to memory of 3004	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	109
PID 1484 wrote to memory of 2388	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	108
PID 1484 wrote to memory of 2388	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	108
PID 1484 wrote to memory of 2388	1484	{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe	108
PID 3004 wrote to memory of 208	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	110
PID 3004 wrote to memory of 208	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	110
PID 3004 wrote to memory of 208	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	110
PID 3004 wrote to memory of 2288	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	111
PID 3004 wrote to memory of 2288	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	111
PID 3004 wrote to memory of 2288	3004	{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe	111
PID 208 wrote to memory of 5016	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	113
PID 208 wrote to memory of 5016	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	113
PID 208 wrote to memory of 5016	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	113
PID 208 wrote to memory of 552	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	112
PID 208 wrote to memory of 552	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	112
PID 208 wrote to memory of 552	208	{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe	112
PID 5016 wrote to memory of 3528	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	123
PID 5016 wrote to memory of 3528	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	123
PID 5016 wrote to memory of 3528	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	123
PID 5016 wrote to memory of 1840	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	122
PID 5016 wrote to memory of 1840	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	122
PID 5016 wrote to memory of 1840	5016	{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe	122
PID 3528 wrote to memory of 4204	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	128
PID 3528 wrote to memory of 4204	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	128
PID 3528 wrote to memory of 4204	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	128
PID 3528 wrote to memory of 1708	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	129
PID 3528 wrote to memory of 1708	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	129
PID 3528 wrote to memory of 1708	3528	{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe	129
PID 4204 wrote to memory of 636	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	130
PID 4204 wrote to memory of 636	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	130
PID 4204 wrote to memory of 636	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	130
PID 4204 wrote to memory of 1308	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	131
PID 4204 wrote to memory of 1308	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	131
PID 4204 wrote to memory of 1308	4204	{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe	131
PID 636 wrote to memory of 4460	636	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe	133
PID 636 wrote to memory of 4460	636	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe	133
PID 636 wrote to memory of 4460	636	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe	133
PID 636 wrote to memory of 3744	636	{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe	134

C:\Users\Admin\AppData\Local\Temp\2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_df791a96419e19c6634fd1dccd7ca66d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
  C:\Windows\{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4A9B6~1.EXE > nul
    3⤵
    PID:2388
- - C:\Windows\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
    C:\Windows\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DEFD6~1.EXE > nul
      4⤵
      PID:2168
  - - C:\Windows\{20015EEE-B113-4839-94D0-556015DB0B44}.exe
      C:\Windows\{20015EEE-B113-4839-94D0-556015DB0B44}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20015~1.EXE > nul
        5⤵
        
        PID:632
    - - C:\Windows\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
        
        C:\Windows\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F7799~1.EXE > nul
        6⤵
        
        PID:2388
      - C:\Windows\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
        
        C:\Windows\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
        
        C:\Windows\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CD04~1.EXE > nul
        8⤵
        
        PID:552
        
        C:\Windows\{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe
        
        C:\Windows\{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B357A~1.EXE > nul
        9⤵
        
        PID:1840
        
        C:\Windows\{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
        
        C:\Windows\{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
        
        C:\Windows\{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe
        
        C:\Windows\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe
        
        C:\Windows\{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2C94B~1.EXE > nul
        13⤵
        
        PID:1436
        
        C:\Windows\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}.exe
        
        C:\Windows\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}.exe
        13⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8F647~1.EXE > nul
        12⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{91119~1.EXE > nul
        11⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B816~1.EXE > nul
        10⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6CD3~1.EXE > nul
        7⤵
        
        PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{20015EEE-B113-4839-94D0-556015DB0B44}.exe

Filesize
197KB

MD5
653c7da224b050d8bb4efcc48dc46235

SHA1
135345d4d2cfa5493a0c8b9b4af63f764d765f32

SHA256
5109a9b21f1d455735f05436fc8b4bf90e90a5c70ccb59e303ae752fc0c19094

SHA512
6e7cbad54a8fc985282157d4b306101399fdab719cd5a601517a2af4bacb67805310922db08d7119ce6eb67d8164f59566f0ffb826cd8051dbaa3803cfffc7d9

Download Submit
C:\Windows\{20015EEE-B113-4839-94D0-556015DB0B44}.exe

Filesize
9KB

MD5
495d6f760d8a339e3b49bbce35db1029

SHA1
34591c014786b24543840b16de2a68a773a700e2

SHA256
f8104f50f203a03199dcea1b1640fb3c66fe94771d7ff79c921f49a72abb9c4e

SHA512
dbc4b4d8b5a2c68ce60a50828568bb1c6eb2f096aaf26167e3acdd4e11fd77be6e5d16767cfe9e2ebfec67cc89e3044b18dc69b5190c64bfab924ab56f7531a0

Download Submit
C:\Windows\{2C94B436-AE81-4e74-93A2-9D287686F5C2}.exe

Filesize
197KB

MD5
474a8e824c92abd005f3bb5181c63618

SHA1
d9bf832f1793e0ae4e95237e25b0dedc3394cfec

SHA256
952ad1c656096063484935ff98fc004ba138242eff84aecf2253d81b05a60e90

SHA512
ab90c00b2b3347b5e9d49af057c7fe7460b7319503dbdd450b69c2e76e9906403370a8ef0a4c933c23561f24e736b7d16717faef08101e0d4634425feb4524c3

Download Submit
C:\Windows\{4A9B6652-6817-46c2-9D65-7032906C3F25}.exe

Filesize
197KB

MD5
8e10d9ef84236a635cea3787656ac157

SHA1
7ca06a15af176c5638e59087ca36c8bdac5450ed

SHA256
92e21ef9d9dcdb1c632c1bc4e07740c846d645db58bac9d4ad94515a32e4c401

SHA512
c9eab893967e71e27ef780e8d0b0ba18355e7b36bca51cf63b80c49b702ddc860b4e5fd996b94c32b75665065be0ad27f8e700101a657217b45ffb235fc36785

Download Submit
C:\Windows\{7B8167D4-96B6-431f-89C1-4CA17486BABF}.exe

Filesize
197KB

MD5
cee8cac4b00bf086efa700ed5ab3c1be

SHA1
cf0bb079a39bc548b4da7aa6b33b7425954e332f

SHA256
c15bc4a779ed6fa13be796eba2ae8b05267c2de0ebc894f2a4cd0a0935d15936

SHA512
12d65602f5c6e210cb052feb6867baae7bb943dc804c7aa24da74f21557e0d12ca301222fbcc48b010b1228d2a57f4380b9010f42b6fa20ccb2585ffa52b833a

Download Submit
C:\Windows\{7CD04AD3-D4D8-4228-BE87-C21EBA4B0422}.exe

Filesize
197KB

MD5
3cc13df2e02cbdfdf0f7c87ce1f2cee8

SHA1
1d79c7f92c1c4ab3103f0372d3aaa5445d35b1c5

SHA256
78f1cc0390923a397d16d4d62d930374482b453e2bfd65747fc2b4a87127aa61

SHA512
ccbdd30e14a8121265a535273ac9cb6767cd53e9287a9a46cce6fc1e1e107c00447056b341819ad2ea9a0fa3c8b4e85cb257a646bdd4b995870501850880780d

Download Submit
C:\Windows\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe

Filesize
50KB

MD5
d30dab0062adbd50520c6d50e386b9d8

SHA1
fab5f567e547ba08a4299cdf4504baac9c4ebcfd

SHA256
a6c1e52b3e1cb23d605c36b99569eaa6c0943117d0faff6b238ba60c672bf04c

SHA512
fc421215eadd09e810c255396d99fb7e94c18c1509587f479fdb6ecc18ae89b6f4d51f75af522d1de3e7908cf316c9966a3cf22134b586f4b2eaf19fae43416d

Download Submit
C:\Windows\{8F647DFC-2750-40cf-8DC5-16BE065F00A7}.exe

Filesize
161KB

MD5
570ef701fcb6699ba0ab46a7ea291a0b

SHA1
fa5b007593b5f1a99ac8dfd03582227ef0ffce59

SHA256
27e9ec9f124ab2566b93d83195fa49be2b44c188438c844433e828e0d439cd57

SHA512
d2f69defc048dca9c2fe7c215d7b79b46520b24118a19c45162a856b9b10ee37eeb664bd24c500c748478930b871e95c499dfc7125192ffc5c2f909df900af70

Download Submit
C:\Windows\{91119144-BA47-4a71-8A15-6419EB5C4D99}.exe

Filesize
197KB

MD5
700bb0944bd91a1cf05c1891c9e4ec0c

SHA1
f9bed33f44384623000aaf71b09a3d9496b2fd2e

SHA256
1761ad44cbb76f9dd770d63add6c90468be1d4c3edebee1a1476b720bc991821

SHA512
23269aec84763e291b53b0b61387bad761fb9523ea05f5ebff9641c5dd1e49021fb41180664957645e3c3e8710adf988bb1b9cc2890f346c9f413855d0b9b132

Download Submit
C:\Windows\{B357AE8A-2157-4ae4-8013-1741C81CD59F}.exe

Filesize
197KB

MD5
034686f71dcc5f8fcfb947c50fca8152

SHA1
40b9165b4d04d45a4be7e0c10c9ee1d55c1cbd3b

SHA256
8c6af831291041d676dba9d95e73112c60c7851ae5c13dfdc496066719da5246

SHA512
77c45a6e1c8df551aad246738e3fa3a93609203e796acc7fabacc9b7379a2e0d46e293fc6a4b82e349ac30ce158044b9ba3f597d8cc65622e993aaebc645fcbb

Download Submit
C:\Windows\{D6CD30FE-92D8-4c73-8A7E-882D47820A6D}.exe

Filesize
197KB

MD5
7c8a0ff4f1d422c1b6ceb728098770aa

SHA1
f6497e27c6e5e12e6a5a0c57edb46ebf76a04831

SHA256
f840e2c12094a02df1219f6a177db43164f1ab297c60c41312bc30a4e562b4af

SHA512
7aa411c696b78d359bdb1312f4e40978f0a1306547ad9cec1d7147e5390bd6214264c511ab257bbe6433789707605e2ad2cd6bcb583dd021f7dedfe50baa3828

Download Submit
C:\Windows\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe

Filesize
57KB

MD5
19795dc47b127458fbd7b1d1d093e182

SHA1
1340037ddbd78f0b364eccdb01128619fe164faf

SHA256
231bb27287b74b4e73466abfe32d87fd31847d89f1ea916ee6e7bbed595a07ed

SHA512
c07ffacf12ef41e1561c7ba056aa44e23c6a481dc736dba5b5114caebc22410ba390581f3bafdd2f7d57afb30e0112002b845ce0aec3efc6e42cf5de01010b73

Download Submit
C:\Windows\{DEFD62FB-BFF0-406e-8C32-3D1AF9E08EE9}.exe

Filesize
11KB

MD5
906e04706ab3573908a6aa583a546f34

SHA1
d01060d5a6466e28df9f0f46ee43261bcefb8ca3

SHA256
f97a763d13f99df43f7afaf0dde1995bcf0d5eaa1e4bcce9e86a98e01b415591

SHA512
7e109510acf39f2b45650451f04b0c62f9ce7c1086a57c032be67992cdd6e07d50406bb9a0d7365450ff8cedb10b069640ea990bb63316fdd27c6fa0400cb235

Download Submit
C:\Windows\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}.exe

Filesize
197KB

MD5
f3c7b0723df3dc9e0b1eac4ba2759436

SHA1
e00861883a469b0244b9d02b021ec14e2707dde6

SHA256
b19d1e13958f4216bcf2492cf10b8a386c1e7a95f3ccb3255adbaba29ca74813

SHA512
f899cf67c7ffdc673fb7db328c0dc7fe35e8b2752bf73c36a310f306ba0c3e9af457e8cb502b16c00dde36b682901e840abf04e48bf635d043f2f5049ddcfa7b

Download Submit
C:\Windows\{F0980F49-B17D-41e2-8B67-A25FAEBF952E}.exe

Filesize
175KB

MD5
de163b95fec44ff24a3b96f77d8863ce

SHA1
1a00be4c91ef916e0c31b0a39b8e7818ecb5e4eb

SHA256
a8db7ab481de684ba32aafbb6028fee2415b16498c79f76fea44402db04c4085

SHA512
a23f7c673474a6794dbb0d03532a223cc6d345f90de14f7d0f9bf97b21be2af04b15a66beca44a90a800bdf5d26f116db9ffca0cebd3975d0c7d662d02175593

Download Submit
C:\Windows\{F7799EAD-EB03-4f22-BA59-779DC36D49DC}.exe

Filesize
197KB

MD5
b803848b6753faf1e268870135ac517f

SHA1
c0c0abe835d65cc9e0f99393823ee21dc25093fd

SHA256
200ac50f4e3a813e94f1148dad54c332afaa64defe8fb1fc3a8728c05c971df3

SHA512
86cd9d4fbc0e595e964706493f96de087e2f8775604b22346900196fd266682d91c81fcd61994fa7e9373e3d2f1a08ecb17340f8ed0ab47671d02a844225ba91

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads