e135817364bb619c797be1cf321e92579387f36170b7d696d246ddae6e143ed8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Size

168KB
MD5

f495162d79908d0f44e3802b4f30d6ff
SHA1

24761d93baa01fb00e0937c0c2d848388125c4c9
SHA256

e135817364bb619c797be1cf321e92579387f36170b7d696d246ddae6e143ed8
SHA512

4cfa6b52b8dc629ae6138f0a0cd2aeedd21fa436b7c1083dd5de83c03e013a488bae371a231af24cd2307aedd7af14ed17354d4f92714953400eea8ee9206a34
SSDEEP

1536:1EGh0oSlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oSlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023212-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023212-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002320b-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023219-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002320b-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e70-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e71-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021e70-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5F120D9-9B41-4665-ACD5-C8215F43E084}\stubpath = "C:\\Windows\\{F5F120D9-9B41-4665-ACD5-C8215F43E084}.exe"	{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}\stubpath = "C:\\Windows\\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe"	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17ED1227-E548-422d-9490-887FAE9871AF}	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}\stubpath = "C:\\Windows\\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe"	{17ED1227-E548-422d-9490-887FAE9871AF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}\stubpath = "C:\\Windows\\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe"	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}\stubpath = "C:\\Windows\\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe"	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}\stubpath = "C:\\Windows\\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe"	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17ED1227-E548-422d-9490-887FAE9871AF}\stubpath = "C:\\Windows\\{17ED1227-E548-422d-9490-887FAE9871AF}.exe"	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}	{17ED1227-E548-422d-9490-887FAE9871AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}\stubpath = "C:\\Windows\\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe"	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}\stubpath = "C:\\Windows\\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe"	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5F120D9-9B41-4665-ACD5-C8215F43E084}	{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5005DFE4-5E50-4bef-B6D5-901E5269763D}	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5005DFE4-5E50-4bef-B6D5-901E5269763D}\stubpath = "C:\\Windows\\{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe"	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2380C26F-80A2-4763-AB5F-FF425C28772D}	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2380C26F-80A2-4763-AB5F-FF425C28772D}\stubpath = "C:\\Windows\\{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe"	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}\stubpath = "C:\\Windows\\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe"	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe

Executes dropped EXE 12 IoCs

pid	Process
5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe
852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe
3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
2716	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
3972	{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe
1508	{F5F120D9-9B41-4665-ACD5-C8215F43E084}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{17ED1227-E548-422d-9490-887FAE9871AF}.exe	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
File created	C:\Windows\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	{17ED1227-E548-422d-9490-887FAE9871AF}.exe
File created	C:\Windows\{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
File created	C:\Windows\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
File created	C:\Windows\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
File created	C:\Windows\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
File created	C:\Windows\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
File created	C:\Windows\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
File created	C:\Windows\{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
File created	C:\Windows\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
File created	C:\Windows\{F5F120D9-9B41-4665-ACD5-C8215F43E084}.exe	{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe
File created	C:\Windows\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
Token: SeIncBasePriorityPrivilege	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe
Token: SeIncBasePriorityPrivilege	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe
Token: SeIncBasePriorityPrivilege	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
Token: SeIncBasePriorityPrivilege	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
Token: SeIncBasePriorityPrivilege	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
Token: SeIncBasePriorityPrivilege	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
Token: SeIncBasePriorityPrivilege	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
Token: SeIncBasePriorityPrivilege	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
Token: SeIncBasePriorityPrivilege	2716	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
Token: SeIncBasePriorityPrivilege	3972	{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 5084	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	98
PID 4988 wrote to memory of 5084	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	98
PID 4988 wrote to memory of 5084	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	98
PID 4988 wrote to memory of 4492	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	97
PID 4988 wrote to memory of 4492	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	97
PID 4988 wrote to memory of 4492	4988	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	97
PID 5084 wrote to memory of 392	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	100
PID 5084 wrote to memory of 392	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	100
PID 5084 wrote to memory of 392	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	100
PID 5084 wrote to memory of 4616	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	99
PID 5084 wrote to memory of 4616	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	99
PID 5084 wrote to memory of 4616	5084	{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe	99
PID 392 wrote to memory of 852	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe	103
PID 392 wrote to memory of 852	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe	103
PID 392 wrote to memory of 852	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe	103
PID 392 wrote to memory of 1844	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe	102
PID 392 wrote to memory of 1844	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe	102
PID 392 wrote to memory of 1844	392	{17ED1227-E548-422d-9490-887FAE9871AF}.exe	102
PID 852 wrote to memory of 3636	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	104
PID 852 wrote to memory of 3636	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	104
PID 852 wrote to memory of 3636	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	104
PID 852 wrote to memory of 3656	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	105
PID 852 wrote to memory of 3656	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	105
PID 852 wrote to memory of 3656	852	{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe	105
PID 3636 wrote to memory of 4968	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	106
PID 3636 wrote to memory of 4968	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	106
PID 3636 wrote to memory of 4968	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	106
PID 3636 wrote to memory of 3212	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	107
PID 3636 wrote to memory of 3212	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	107
PID 3636 wrote to memory of 3212	3636	{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe	107
PID 4968 wrote to memory of 376	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	109
PID 4968 wrote to memory of 376	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	109
PID 4968 wrote to memory of 376	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	109
PID 4968 wrote to memory of 1936	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	108
PID 4968 wrote to memory of 1936	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	108
PID 4968 wrote to memory of 1936	4968	{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe	108
PID 376 wrote to memory of 3644	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	111
PID 376 wrote to memory of 3644	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	111
PID 376 wrote to memory of 3644	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	111
PID 376 wrote to memory of 4276	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	110
PID 376 wrote to memory of 4276	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	110
PID 376 wrote to memory of 4276	376	{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe	110
PID 3644 wrote to memory of 4328	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	113
PID 3644 wrote to memory of 4328	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	113
PID 3644 wrote to memory of 4328	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	113
PID 3644 wrote to memory of 4528	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	112
PID 3644 wrote to memory of 4528	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	112
PID 3644 wrote to memory of 4528	3644	{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe	112
PID 4328 wrote to memory of 4532	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	115
PID 4328 wrote to memory of 4532	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	115
PID 4328 wrote to memory of 4532	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	115
PID 4328 wrote to memory of 4524	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	114
PID 4328 wrote to memory of 4524	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	114
PID 4328 wrote to memory of 4524	4328	{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe	114
PID 4532 wrote to memory of 2716	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	117
PID 4532 wrote to memory of 2716	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	117
PID 4532 wrote to memory of 2716	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	117
PID 4532 wrote to memory of 4456	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	116
PID 4532 wrote to memory of 4456	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	116
PID 4532 wrote to memory of 4456	4532	{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe	116
PID 2716 wrote to memory of 3972	2716	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe	119
PID 2716 wrote to memory of 3972	2716	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe	119
PID 2716 wrote to memory of 3972	2716	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe	119
PID 2716 wrote to memory of 1512	2716	{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4492
- C:\Windows\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
  C:\Windows\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{08D19~1.EXE > nul
    3⤵
    PID:4616
- - C:\Windows\{17ED1227-E548-422d-9490-887FAE9871AF}.exe
    C:\Windows\{17ED1227-E548-422d-9490-887FAE9871AF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{17ED1~1.EXE > nul
      4⤵
      PID:1844
  - - C:\Windows\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe
      C:\Windows\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:852
    - - C:\Windows\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
        
        C:\Windows\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3636
      - C:\Windows\{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
        
        C:\Windows\{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5005D~1.EXE > nul
        7⤵
        
        PID:1936
        
        C:\Windows\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
        
        C:\Windows\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{26990~1.EXE > nul
        8⤵
        
        PID:4276
        
        C:\Windows\{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
        
        C:\Windows\{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2380C~1.EXE > nul
        9⤵
        
        PID:4528
        
        C:\Windows\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
        
        C:\Windows\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48ECE~1.EXE > nul
        10⤵
        
        PID:4524
        
        C:\Windows\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
        
        C:\Windows\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F6DCB~1.EXE > nul
        11⤵
        
        PID:4456
        
        C:\Windows\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
        
        C:\Windows\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3DCF9~1.EXE > nul
        12⤵
        
        PID:1512
        
        C:\Windows\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe
        
        C:\Windows\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A1A6C~1.EXE > nul
        13⤵
        
        PID:4908
        
        C:\Windows\{F5F120D9-9B41-4665-ACD5-C8215F43E084}.exe
        
        C:\Windows\{F5F120D9-9B41-4665-ACD5-C8215F43E084}.exe
        13⤵
        Executes dropped EXE
        
        PID:1508
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F2664~1.EXE > nul
        6⤵
        
        PID:3212
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B3AB~1.EXE > nul
        5⤵
        
        PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe

Filesize
168KB

MD5
c3fc52cb8efe80a7790f47a2275bd473

SHA1
36a2faca7cad8a091e7b90ba6fe04bcdea61dc30

SHA256
b75a66c6fd015acd04c4311816847974c367948d2ee2eb5457c792dd91fb486b

SHA512
5b51c3d9c5c87f09709f74ee744a5144d281ca32c03f2e5c0c7159e908adea656adc0840566a9cfffd931d3b42b53a171aa0006d4ec25bb1b1255e77f40f1f8c

Download Submit
C:\Windows\{08D197BF-A22D-4a2d-9AF3-3C62E1DB4AF5}.exe

Filesize
64KB

MD5
77815dcaa5665ebb7be396f643d492c7

SHA1
5184a31c5fbfe0be25687ce39a403dc308bfdd12

SHA256
541d40090cfdd5e3edf5f52de8d59c2d102247fd0bf28d2bc6bc470af7c4a12a

SHA512
3b6ce836eaa5ec8ed446258efe76be69e670c792c0c85c8d12852ef0ed31e72d0147376a575b5cd48f2b7317ba8ae8e4153292389cdaa1b62ae79fcc18ec4c99

Download Submit
C:\Windows\{17ED1227-E548-422d-9490-887FAE9871AF}.exe

Filesize
168KB

MD5
962b0db05b7743d7c0ed14f2231b73f9

SHA1
156c91dc06f9f7d41be45d791af3385f12f7f747

SHA256
5d0d6ca723cc142c19d1ae8aee1ccd914d96dbddb0bfce673b5ff08582c77365

SHA512
e6cbe4e892cf74bb678c14a810b31f904b0397438e28fc30622fa5990b4b2b93e5fe60d62c26240489c3e915a7aa768ae264cefb6b7faf6c1fbca15dfe30d0b9

Download Submit
C:\Windows\{2380C26F-80A2-4763-AB5F-FF425C28772D}.exe

Filesize
168KB

MD5
feb1dbb42fb75dbd5f2fd6deb91a4c03

SHA1
fac0d2dd0b39d5e791be8146727ea4bed2320de5

SHA256
e2f6ff3ee47deb41feea1d694c4b5bfb2a793b05a41b41ab6460360e0948c40e

SHA512
0e9416692ca56013a3cc22b8a8740034ca7598ddb4ce66045ca5906d958cfc94098b31cc28d3154781f98bdc1fbce04b5f11c67737bab2f6ab1b05c5b42e9065

Download Submit
C:\Windows\{26990CDE-DB35-46e0-BDC2-0B1D18E52EFE}.exe

Filesize
168KB

MD5
cfa37667dacd98b5ffce2ff488729711

SHA1
c3eff00743baa327908fa89309ed920afc644f55

SHA256
185885116afe3467a7b39732458755473b2b8a4d3ab1ee16fcf288b1160f52f5

SHA512
8dfe0329be281aec66ae85e1a336c87fcc352ce9c43a68fc02b67219d1e466feef359ffa61b824b22b5a0d29052d876b1be9500bfd580e3ceecfd6ef121dea46

Download Submit
C:\Windows\{3B3AB392-9EF5-4a66-9818-FF0C44688AB9}.exe

Filesize
168KB

MD5
a2d9925b99d74e58f3ac3a3588b9d276

SHA1
f2a8982f7d5c53a6dde6787e96689df4b3ed6cf4

SHA256
57c1366bb9e087360bf6d019b0218aa01a8af99b5b393811e042b7f373ffa334

SHA512
6006765fc408d108510246002985a783d08efd64c344ebfe75e1ed9586fb974f1a4d9ad65622c2d84c0f12b8bacd399e51582eea2e1f0605fa0ce9b5c4ea09c7

Download Submit
C:\Windows\{3DCF9AF5-6C7A-45e9-A7D3-258BDF08D449}.exe

Filesize
168KB

MD5
b2806c7c304c68d05aef51ed54cbf9cb

SHA1
99c5ea24fae58b326d4c65b65b54e2b5c8a97662

SHA256
ef0ad466884699f32e0f880fa93a2794be4186dda745e442c697d4b254fb5252

SHA512
32be7c2174d7d023fb0a0c53d3c04753bb3b50a6fd7fc36529332ad71e56161960c7a6b144149822ad6ce6034ebfef5a02a579c5beba804625bf07eac135941f

Download Submit
C:\Windows\{48ECEC00-DCEA-40b4-A8E2-AD2105C5CA7E}.exe

Filesize
168KB

MD5
a89bb886c33a22ef0e7779da3e8348b0

SHA1
7c5ae1f7458d6eee9186767fa10d68e210a2438e

SHA256
ce19e34adffb97e59d0dbe02fb110d66d46b4c35ae4ad0649d2757fac162f131

SHA512
bc088fe9d359034d38e3823d2a418be58a76cb23a65df6123b68211980e9b960ec12680e0f76c0c3ca4c30a7ed9bc920f7acd5f2baf0495bebef7d47d828119e

Download Submit
C:\Windows\{5005DFE4-5E50-4bef-B6D5-901E5269763D}.exe

Filesize
168KB

MD5
e571600adf7af482121c93671975b4a7

SHA1
18074e8b25a8871b776f9d7a7e8676d62f574048

SHA256
7af7651ff0236a913d711f6e734b1bf7f673247c34de0d6972fd48dfab1e861e

SHA512
0c903e2694b4254e694669485ae49fe007574c3ab03a76d365af2bfbe5bf6269771aed8bb1d6360970e85ec72666f6a6eba4ab6642b969e2829be9ebd89677d7

Download Submit
C:\Windows\{A1A6CCD9-EFD5-4429-A23B-7627A89726F3}.exe

Filesize
168KB

MD5
d09cd2c7b89b66fbd665418dd45fe2dc

SHA1
72509de87aa3df57ae19ca4a66d392a7d180b063

SHA256
6e99637ad9b9cf3f6c5b89beed881e5d5aeaaa9035bf0c41a89d52c9582be3b4

SHA512
b28a6a3e4d39015d56b6c146f40c869b10aa823ce02ff62af24c83acc99f5d17bdf7a9395b9d446354fbecad984754953bf08c3c5387b33aaf52ae7746b09834

Download Submit
C:\Windows\{F2664A9A-C0EE-4356-97E3-6EE47947A2C7}.exe

Filesize
168KB

MD5
a8306604013293ea9ee787861d66d2a7

SHA1
61adcd0cede35769f8cdf7f752e5e25093baf132

SHA256
ce9c390d2c9f0a3dec158a3b5eb965efa0c5ea414bfd42d9d36bee5c5c6e7126

SHA512
5d7115804a395b5871959778e86d8eaad698b14579add8efc9b49c01d3f663c3f1f0d95f36bf44a5ce8f19295ff2046b2283084a2cca76cb5ec804ef3e53b6f8

Download Submit
C:\Windows\{F5F120D9-9B41-4665-ACD5-C8215F43E084}.exe

Filesize
168KB

MD5
853c365a5dc19774332b799abe3b21be

SHA1
d49ae32e2e0fca777fc52022c991e59efe01867d

SHA256
23e6052bcac88f4eb7bd9c7d404804eee913abc90e37c92349b3eaff496b4bac

SHA512
b0a0bb1aeb2725a051f69da17b5c8c0244e5d4695e04a2b4dab4ca7c14d44c3e73d1c8178036569cae5f06fad76e45a10b9aae5cb99e47ee4b1df6f34024e550

Download Submit
C:\Windows\{F6DCBBA5-AE32-4625-80F4-A0735C5411F2}.exe

Filesize
168KB

MD5
54397b5ef97aba440d7a0ce84ca81a95

SHA1
1c3c956c02bd0de4bca33cc8136cf3a80f82817c

SHA256
9c6216ba98b05121821c12127207a910164008c62acf0869f9c43f66fadcadbf

SHA512
c56cecacc6bd1eee02582984168506ba8138a751720e4cf7266297f98bb876891378efd553d5127312d7dc219ef40f8603aab96be14367a7e66039ac297c76f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads