1c79a8b69b7bbd2045fe0be9b51fcbe008c28a8e60be0188489e04ad12261b3b

Analysis

max time kernel
163s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Size

197KB
MD5

386057845b1cf6cb6bb2135e02f1b81b
SHA1

600d0cbd701643815c26eaa246ddce2aa37cab44
SHA256

1c79a8b69b7bbd2045fe0be9b51fcbe008c28a8e60be0188489e04ad12261b3b
SHA512

3941e616d9f4958726f29e69fbb64158b753fcc5d8a8d900449b0251ccccfd1c3cdac4c3c6eec9e7c190e4adb613463d0f0279281662665f285a4f1e684e706f
SSDEEP

3072:jEGh0oJl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGDlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001225f-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000b1f5-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000b1f5-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000b1f5-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001300000000b1f5-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001400000000b1f5-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001225f-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015c8d-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}\stubpath = "C:\\Windows\\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe"	{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}\stubpath = "C:\\Windows\\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe"	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}\stubpath = "C:\\Windows\\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe"	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}\stubpath = "C:\\Windows\\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe"	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}\stubpath = "C:\\Windows\\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe"	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}	{F2165AA7-2375-4378-932F-4B76402C977B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}\stubpath = "C:\\Windows\\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}.exe"	{F2165AA7-2375-4378-932F-4B76402C977B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}\stubpath = "C:\\Windows\\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe"	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}	{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}\stubpath = "C:\\Windows\\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe"	{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77B3070F-CC62-4e25-BE7A-BF48A040F647}	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}\stubpath = "C:\\Windows\\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe"	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}	{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77B3070F-CC62-4e25-BE7A-BF48A040F647}\stubpath = "C:\\Windows\\{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe"	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}\stubpath = "C:\\Windows\\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe"	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2165AA7-2375-4378-932F-4B76402C977B}	{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2165AA7-2375-4378-932F-4B76402C977B}\stubpath = "C:\\Windows\\{F2165AA7-2375-4378-932F-4B76402C977B}.exe"	{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe

Deletes itself 1 IoCs

pid	Process
2848	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
328	{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
2156	{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
2480	{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe
2900	{F2165AA7-2375-4378-932F-4B76402C977B}.exe
1876	{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
File created	C:\Windows\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe	{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
File created	C:\Windows\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
File created	C:\Windows\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
File created	C:\Windows\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
File created	C:\Windows\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
File created	C:\Windows\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
File created	C:\Windows\{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
File created	C:\Windows\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
File created	C:\Windows\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe	{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
File created	C:\Windows\{F2165AA7-2375-4378-932F-4B76402C977B}.exe	{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe
File created	C:\Windows\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}.exe	{F2165AA7-2375-4378-932F-4B76402C977B}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
Token: SeIncBasePriorityPrivilege	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
Token: SeIncBasePriorityPrivilege	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
Token: SeIncBasePriorityPrivilege	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
Token: SeIncBasePriorityPrivilege	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
Token: SeIncBasePriorityPrivilege	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
Token: SeIncBasePriorityPrivilege	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
Token: SeIncBasePriorityPrivilege	328	{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
Token: SeIncBasePriorityPrivilege	2156	{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
Token: SeIncBasePriorityPrivilege	2480	{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe
Token: SeIncBasePriorityPrivilege	2900	{F2165AA7-2375-4378-932F-4B76402C977B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2784	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	27
PID 2744 wrote to memory of 2784	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	27
PID 2744 wrote to memory of 2784	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	27
PID 2744 wrote to memory of 2784	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	27
PID 2744 wrote to memory of 2848	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	28
PID 2744 wrote to memory of 2848	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	28
PID 2744 wrote to memory of 2848	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	28
PID 2744 wrote to memory of 2848	2744	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	28
PID 2784 wrote to memory of 2576	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	31
PID 2784 wrote to memory of 2576	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	31
PID 2784 wrote to memory of 2576	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	31
PID 2784 wrote to memory of 2576	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	31
PID 2784 wrote to memory of 2636	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	32
PID 2784 wrote to memory of 2636	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	32
PID 2784 wrote to memory of 2636	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	32
PID 2784 wrote to memory of 2636	2784	{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe	32
PID 2576 wrote to memory of 2736	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	33
PID 2576 wrote to memory of 2736	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	33
PID 2576 wrote to memory of 2736	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	33
PID 2576 wrote to memory of 2736	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	33
PID 2576 wrote to memory of 1988	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	34
PID 2576 wrote to memory of 1988	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	34
PID 2576 wrote to memory of 1988	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	34
PID 2576 wrote to memory of 1988	2576	{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe	34
PID 2736 wrote to memory of 2920	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	35
PID 2736 wrote to memory of 2920	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	35
PID 2736 wrote to memory of 2920	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	35
PID 2736 wrote to memory of 2920	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	35
PID 2736 wrote to memory of 2944	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	36
PID 2736 wrote to memory of 2944	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	36
PID 2736 wrote to memory of 2944	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	36
PID 2736 wrote to memory of 2944	2736	{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe	36
PID 2920 wrote to memory of 748	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	37
PID 2920 wrote to memory of 748	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	37
PID 2920 wrote to memory of 748	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	37
PID 2920 wrote to memory of 748	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	37
PID 2920 wrote to memory of 1452	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	38
PID 2920 wrote to memory of 1452	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	38
PID 2920 wrote to memory of 1452	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	38
PID 2920 wrote to memory of 1452	2920	{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe	38
PID 748 wrote to memory of 1720	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	39
PID 748 wrote to memory of 1720	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	39
PID 748 wrote to memory of 1720	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	39
PID 748 wrote to memory of 1720	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	39
PID 748 wrote to memory of 1704	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	40
PID 748 wrote to memory of 1704	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	40
PID 748 wrote to memory of 1704	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	40
PID 748 wrote to memory of 1704	748	{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe	40
PID 1720 wrote to memory of 2384	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	41
PID 1720 wrote to memory of 2384	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	41
PID 1720 wrote to memory of 2384	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	41
PID 1720 wrote to memory of 2384	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	41
PID 1720 wrote to memory of 2748	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	42
PID 1720 wrote to memory of 2748	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	42
PID 1720 wrote to memory of 2748	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	42
PID 1720 wrote to memory of 2748	1720	{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe	42
PID 2384 wrote to memory of 328	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	43
PID 2384 wrote to memory of 328	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	43
PID 2384 wrote to memory of 328	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	43
PID 2384 wrote to memory of 328	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	43
PID 2384 wrote to memory of 1612	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	44
PID 2384 wrote to memory of 1612	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	44
PID 2384 wrote to memory of 1612	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	44
PID 2384 wrote to memory of 1612	2384	{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
  C:\Windows\{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
    C:\Windows\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
      C:\Windows\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
        
        C:\Windows\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
      - C:\Windows\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
        
        C:\Windows\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
        
        C:\Windows\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
        
        C:\Windows\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
        
        C:\Windows\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:328
        
        C:\Windows\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
        
        C:\Windows\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe
        
        C:\Windows\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\{F2165AA7-2375-4378-932F-4B76402C977B}.exe
        
        C:\Windows\{F2165AA7-2375-4378-932F-4B76402C977B}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}.exe
        
        C:\Windows\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}.exe
        13⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F2165~1.EXE > nul
        13⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EF6EF~1.EXE > nul
        12⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0641B~1.EXE > nul
        11⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AA2D9~1.EXE > nul
        10⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AFE45~1.EXE > nul
        9⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{109FC~1.EXE > nul
        8⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9558~1.EXE > nul
        7⤵
        
        PID:1704
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7065F~1.EXE > nul
        6⤵
        
        PID:1452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CCB68~1.EXE > nul
        5⤵
        
        PID:2944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{80B65~1.EXE > nul
      4⤵
      PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{77B30~1.EXE > nul
    3⤵
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0641BCFD-FE95-41e2-AEBC-91C61B7E5302}.exe

Filesize
197KB

MD5
37201058c452892f62181b0b6a67015e

SHA1
2d3ae7c469cfb2d5e704f6265e3acf7a64245abd

SHA256
0e45c14590d957946ff04c7606047cba66c629e17088e05a92eec70b0b86fd52

SHA512
81a90a22cc2f29bf63163ce6462db5b3f898e7202edfb694af3301f72a95b5aa4da20824d539ce7f00c04ac7e7548fd1bc507425526be1cfba2746db819f104f

Download Submit
C:\Windows\{109FC62D-C546-44f4-9FC5-6C21C6E54C78}.exe

Filesize
197KB

MD5
9ed06286e9f2aab9722671d9dd08ff06

SHA1
1c90caf9c96bf00f345a245d52ef8f7257ff47ee

SHA256
d77f617a33c46694d6795fe987912b26acf03202905d69573a8765daeb64e1de

SHA512
6b63d0410874b3a4a1a465ed41e20c1338b1d8397a75b644b5b40a58b533392e212be8857268c094f82558c11356756ff7bfa893c6403e4c4460b3aac5fc56d1

Download Submit
C:\Windows\{622CC4DE-CE8C-4e71-A7DF-808D6FB5C0B7}.exe

Filesize
197KB

MD5
be0b6d7a687f8a636afeaf75f37beb96

SHA1
008ea5f9d9e64c482b85cc2537f3d5e78d6412dd

SHA256
af6771653ca58414c9e834600ce429f256a808f6339ebc56cfc1f1ee7439ce59

SHA512
42c9ec900c9cef8f76f253af8cc41e788f92a21608a3170e49bc59deee6348e398783ce149cf5f966038aeefa29834863b5afdf2e580e52ad1afdcabb1afe481

Download Submit
C:\Windows\{7065F0A4-FA6C-416a-B4BA-9522C1128E1C}.exe

Filesize
197KB

MD5
7484b17ffee82cd211e30ea5534431a0

SHA1
fca38ba15e0b2d34c0e0693dff96201763cebbc6

SHA256
4be00f98037fe4020627ac53c9b20e133bf18b57930108b8b24cce0a26d44b59

SHA512
55ab1d5787e92440295cd2b4c81122c18e7df684b0301195cca0d86a4e171482bc222c72bda2ab0938021be1526d6a14f91721217938476b1f0f0a2b7ab7097b

Download Submit
C:\Windows\{77B3070F-CC62-4e25-BE7A-BF48A040F647}.exe

Filesize
197KB

MD5
b59206e3dc615eff87197b31143ece88

SHA1
d8f9b11948fd96659be5b62ed5a561ad3d583a02

SHA256
73a60962c79e603e7202a919a7eb5ebb5176b3a97d8a40d7a90cd290fc9c30fe

SHA512
e2a0e6a77f8755a38c9bea6e34d33469a91feda20c37fe55b8cfe95f9057c2a4ca497e87f70f69b7635eacd5b936bac42e85a8525a1b0adc9fb5d5d105951f13

Download Submit
C:\Windows\{80B656C0-E9DA-4926-9DE3-7DDF9C1C1E71}.exe

Filesize
197KB

MD5
cacfc0982cc3e2bc13deb040b93eb6da

SHA1
c6291b991184d7bb4336499a10a0e3db1760aea1

SHA256
b91437869fd429dfb7ebee723f4bd2ff9eb0b4d7ccd11b7087e43f5e3687bc6a

SHA512
cbeaca889e4e5152ce304f7b277457a11bdc90b22e06c84959cfa9a79270050c066f598838f8b42016b99d23db9fecc62632a96d2cdcfcb40455e3af28b1fd22

Download Submit
C:\Windows\{AA2D935D-C594-49de-98A6-A45E57FE6D8B}.exe

Filesize
197KB

MD5
a470afabde04afab9fa34099b53e5832

SHA1
7891765a4eddf5ae1d3f7626095d60855d33fab6

SHA256
cae9355242fbfdc22f1c04d1b9072c7ff1e65739a1e4aadcfa05ef79f0f301d1

SHA512
4b2d7fab1fb0bc8707e5a502a8b82237eb85b740e6f496f054edacd53d473059a66b9e500b58b408785fba923406edcd65b9a640b3b245972dc32a640c7105b5

Download Submit
C:\Windows\{AFE45CE7-296C-4c1e-BD13-2E5525DCA9C3}.exe

Filesize
197KB

MD5
a2a97468f56b85a7c4eddb89b4ba6a03

SHA1
2dac71f523981e6b4a3854e542c4855ae3de3703

SHA256
aff864dc018be14cf82153f69484f0a08f56673e4ff62206a8a8a2980421fb60

SHA512
864d9e55f621d4b10cfd5d49a43360a09f9893e3c3620b8ac7f6e7c8e8ecd70f22e972654ef459511ccf338523fe54df39f608b6bc28d366364f56bab9216718

Download Submit
C:\Windows\{CCB68175-FD61-46f0-9286-4A1A71A9CECB}.exe

Filesize
197KB

MD5
a2770daed550bb2fead12eb7c0351cc0

SHA1
e0505e029e55736e44663aa500f91c9c89b64073

SHA256
ceb7b422a9b71d20cb14ec48ea48fece5860ac78887366c25355538ba5a8b30d

SHA512
3da21805f6ff8feebb2051c490f317f00daef45bc2bccbc2c64085fb846ed8804f4384704ebcc6852089872faaf41072e23b14e0282277af1f948f566a03e173

Download Submit
C:\Windows\{EF6EF530-03D7-4f9c-80B1-9DC8B1F2AA09}.exe

Filesize
197KB

MD5
fcb4ea03b43dc2e7acd833e7a9383004

SHA1
7bb87fe1c25456441b3942e008e9eecfc786f9f2

SHA256
82bb0d45ec77ac79ecf28410eada9adeef2704d549d085efcca831a9e864de3e

SHA512
a5b16b65ddb833d9085e74a7540fb14e0c97559ec39aa8aeb9810be77b9d5ec9b4536aab933ce89bb7c16b8e9bec0ced349446d83a89c95c164f3c6465041575

Download Submit
C:\Windows\{F2165AA7-2375-4378-932F-4B76402C977B}.exe

Filesize
197KB

MD5
2244b9c5528101ad1b5c5eaa726399c0

SHA1
a7e7d551311a103d3e0f4b624970098eda69f871

SHA256
05e1aaf6db38527b35dc3c53f193192f28b31b44280eada3493d488c0b19a3b4

SHA512
9bf2f4296b65edba8c4461ec3992c69f1613573a05228cd32e89c97014939e4c1e57103266c6cb371bbabde82129c34ae179f36245fdd447bd135b91ae199a73

Download Submit
C:\Windows\{F9558DC1-B8F7-4179-9822-27BD76D68CDF}.exe

Filesize
197KB

MD5
97ea389457b230f7588aef3600df3f81

SHA1
bc5bd8e0b614a77d7f775f45c699425ed9205083

SHA256
03728fe02366e198b4d70c721c0ef512041ae72f71ee91c8e6640b43a7c41b6d

SHA512
67d1a1aef17351e752882956f6e6dd787f4ed19cfa2a83015c9e26f8fce8e9a0f6eee2ca7315e345c8df00fb6da596329af4044bf98e08f4e285d103ca37084f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads