0d4945bd4b657848322f932b3fc3d6c9306dbc2fb0a69b9a65d9d89111afe229

Analysis

max time kernel
157s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe
Size

408KB
MD5

4c30284f6ca1b7bf96a28503f16a4baf
SHA1

6b63c643d7799ebd8e178cd54c8c11e96ca7b62f
SHA256

0d4945bd4b657848322f932b3fc3d6c9306dbc2fb0a69b9a65d9d89111afe229
SHA512

6948102cfdd7cae226f8a36010318dad810933c2603c00d8ec9c12a4ce11d5dad9e9dc66d93aee0c4a1a9495d5a086c0bc1cd6f4d4fbdc7d00cc0e22da5e66de
SSDEEP

3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGJldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x00360000000167ed-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000b1f5-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000016adc-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000b1f5-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0037000000016adc-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000b1f5-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0038000000016adc-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001300000000b1f5-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0039000000016adc-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001400000000b1f5-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003a000000016adc-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}\stubpath = "C:\\Windows\\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe"	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{707BAB72-D21A-484d-910A-B217A1955E52}	{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}	{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E53F846D-EF8D-4eed-A930-4B741B1057DA}	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E672F94-5263-4624-9A50-4BA57A33A154}\stubpath = "C:\\Windows\\{5E672F94-5263-4624-9A50-4BA57A33A154}.exe"	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}\stubpath = "C:\\Windows\\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe"	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E52D65A1-53B7-4fb8-A216-7147FF403094}	{707BAB72-D21A-484d-910A-B217A1955E52}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}	{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E672F94-5263-4624-9A50-4BA57A33A154}	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}\stubpath = "C:\\Windows\\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe"	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{736D8638-6A17-4f8a-BFAE-EE60536664E2}\stubpath = "C:\\Windows\\{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe"	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E53F846D-EF8D-4eed-A930-4B741B1057DA}\stubpath = "C:\\Windows\\{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe"	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}\stubpath = "C:\\Windows\\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe"	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{707BAB72-D21A-484d-910A-B217A1955E52}\stubpath = "C:\\Windows\\{707BAB72-D21A-484d-910A-B217A1955E52}.exe"	{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E52D65A1-53B7-4fb8-A216-7147FF403094}\stubpath = "C:\\Windows\\{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe"	{707BAB72-D21A-484d-910A-B217A1955E52}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}\stubpath = "C:\\Windows\\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}.exe"	{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}\stubpath = "C:\\Windows\\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe"	{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}\stubpath = "C:\\Windows\\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe"	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{736D8638-6A17-4f8a-BFAE-EE60536664E2}	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe

Deletes itself 1 IoCs

pid	Process
2916	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe
2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
332	{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
2316	{707BAB72-D21A-484d-910A-B217A1955E52}.exe
2944	{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe
2248	{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe
860	{3ED3ADDB-3D10-435c-9B3C-8955F957F442}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe
File created	C:\Windows\{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe
File created	C:\Windows\{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
File created	C:\Windows\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
File created	C:\Windows\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
File created	C:\Windows\{707BAB72-D21A-484d-910A-B217A1955E52}.exe	{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
File created	C:\Windows\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}.exe	{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe
File created	C:\Windows\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
File created	C:\Windows\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
File created	C:\Windows\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
File created	C:\Windows\{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe	{707BAB72-D21A-484d-910A-B217A1955E52}.exe
File created	C:\Windows\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe	{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
Token: SeIncBasePriorityPrivilege	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe
Token: SeIncBasePriorityPrivilege	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
Token: SeIncBasePriorityPrivilege	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
Token: SeIncBasePriorityPrivilege	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
Token: SeIncBasePriorityPrivilege	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
Token: SeIncBasePriorityPrivilege	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
Token: SeIncBasePriorityPrivilege	332	{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
Token: SeIncBasePriorityPrivilege	2316	{707BAB72-D21A-484d-910A-B217A1955E52}.exe
Token: SeIncBasePriorityPrivilege	2944	{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe
Token: SeIncBasePriorityPrivilege	2248	{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2464	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	30
PID 2872 wrote to memory of 2464	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	30
PID 2872 wrote to memory of 2464	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	30
PID 2872 wrote to memory of 2464	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	30
PID 2872 wrote to memory of 2916	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	31
PID 2872 wrote to memory of 2916	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	31
PID 2872 wrote to memory of 2916	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	31
PID 2872 wrote to memory of 2916	2872	2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe	31
PID 2464 wrote to memory of 1760	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	32
PID 2464 wrote to memory of 1760	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	32
PID 2464 wrote to memory of 1760	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	32
PID 2464 wrote to memory of 1760	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	32
PID 2464 wrote to memory of 2576	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	33
PID 2464 wrote to memory of 2576	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	33
PID 2464 wrote to memory of 2576	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	33
PID 2464 wrote to memory of 2576	2464	{5E672F94-5263-4624-9A50-4BA57A33A154}.exe	33
PID 1760 wrote to memory of 2384	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	34
PID 1760 wrote to memory of 2384	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	34
PID 1760 wrote to memory of 2384	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	34
PID 1760 wrote to memory of 2384	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	34
PID 1760 wrote to memory of 3016	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	35
PID 1760 wrote to memory of 3016	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	35
PID 1760 wrote to memory of 3016	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	35
PID 1760 wrote to memory of 3016	1760	{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe	35
PID 2384 wrote to memory of 476	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	36
PID 2384 wrote to memory of 476	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	36
PID 2384 wrote to memory of 476	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	36
PID 2384 wrote to memory of 476	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	36
PID 2384 wrote to memory of 1004	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	37
PID 2384 wrote to memory of 1004	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	37
PID 2384 wrote to memory of 1004	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	37
PID 2384 wrote to memory of 1004	2384	{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe	37
PID 476 wrote to memory of 2548	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	39
PID 476 wrote to memory of 2548	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	39
PID 476 wrote to memory of 2548	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	39
PID 476 wrote to memory of 2548	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	39
PID 476 wrote to memory of 2848	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	38
PID 476 wrote to memory of 2848	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	38
PID 476 wrote to memory of 2848	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	38
PID 476 wrote to memory of 2848	476	{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe	38
PID 2548 wrote to memory of 3020	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	40
PID 2548 wrote to memory of 3020	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	40
PID 2548 wrote to memory of 3020	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	40
PID 2548 wrote to memory of 3020	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	40
PID 2548 wrote to memory of 1348	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	41
PID 2548 wrote to memory of 1348	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	41
PID 2548 wrote to memory of 1348	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	41
PID 2548 wrote to memory of 1348	2548	{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe	41
PID 3020 wrote to memory of 2508	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	42
PID 3020 wrote to memory of 2508	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	42
PID 3020 wrote to memory of 2508	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	42
PID 3020 wrote to memory of 2508	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	42
PID 3020 wrote to memory of 2512	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	43
PID 3020 wrote to memory of 2512	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	43
PID 3020 wrote to memory of 2512	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	43
PID 3020 wrote to memory of 2512	3020	{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe	43
PID 2508 wrote to memory of 332	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	44
PID 2508 wrote to memory of 332	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	44
PID 2508 wrote to memory of 332	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	44
PID 2508 wrote to memory of 332	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	44
PID 2508 wrote to memory of 1736	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	45
PID 2508 wrote to memory of 1736	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	45
PID 2508 wrote to memory of 1736	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	45
PID 2508 wrote to memory of 1736	2508	{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_4c30284f6ca1b7bf96a28503f16a4baf_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
  C:\Windows\{5E672F94-5263-4624-9A50-4BA57A33A154}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe
    C:\Windows\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
      C:\Windows\{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
        
        C:\Windows\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B0E1C~1.EXE > nul
        6⤵
        
        PID:2848
      - C:\Windows\{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
        
        C:\Windows\{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
        
        C:\Windows\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
        
        C:\Windows\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
        
        C:\Windows\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
        
        C:\Windows\{707BAB72-D21A-484d-910A-B217A1955E52}.exe
        
        C:\Windows\{707BAB72-D21A-484d-910A-B217A1955E52}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe
        
        C:\Windows\{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
        
        C:\Windows\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe
        
        C:\Windows\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8D9CE~1.EXE > nul
        13⤵
        
        PID:1532
        
        C:\Windows\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}.exe
        
        C:\Windows\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}.exe
        13⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E52D6~1.EXE > nul
        12⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{707BA~1.EXE > nul
        11⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5E1E9~1.EXE > nul
        10⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1539D~1.EXE > nul
        9⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3FC5F~1.EXE > nul
        8⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E53F8~1.EXE > nul
        7⤵
        
        PID:1348
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{736D8~1.EXE > nul
        5⤵
        
        PID:1004
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E145E~1.EXE > nul
      4⤵
      PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5E672~1.EXE > nul
    3⤵
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1539D8F2-5C4A-4d0c-B617-0A5351364D11}.exe

Filesize
408KB

MD5
cd20f94d6b3e2b7ef207d527115e613e

SHA1
f8551b04907d9b2afe1bbf4ec2928104695a626d

SHA256
4bb91e6036b8d642fbb8f86626cb4011c756383523234941bbbf1820dfa70a18

SHA512
f65a1b9c40416ed373840f1c4f08a4e6be37c75b7078daa69af68993a7022472ca658334be68dcf85927a4d0c3dfaa49bdace91be34d3fe3ed1e6096b698d297

Download Submit
C:\Windows\{3ED3ADDB-3D10-435c-9B3C-8955F957F442}.exe

Filesize
408KB

MD5
4f2e9146b2074a55a0418c11398fdf64

SHA1
6ff41026c71cb5aa053cf68cce289590eae0e27f

SHA256
d525b901b81ab6bf0609f6be14bd73fc24ae2cbc6202edc971735889ee516692

SHA512
472fabf772b65ff31b8fd5c2f940729753741268f11427f4c9a42c059ad8fcaa3ab0f3d2a94ec61d00e1b681b276e95d60e6cc4582eb3e4ab72fc60f86d765c1

Download Submit
C:\Windows\{3FC5F60B-FF74-425a-A967-752CE5B7E50D}.exe

Filesize
408KB

MD5
60402a8c89e38ed27959a9569406c4f2

SHA1
3ffd217ad60e6db5370ed726e2a0439b50803e06

SHA256
bd2c8c6c0e8bf7aadcc504520e59f890c76c0d8fb15ca97399fb4781c4c6b5e7

SHA512
505bd086c2f486995a6c83464a01f3266dc124f5e2617e91c34362d3d0adffba3467b22bb1bde41d75e9cad5b915d5b8b9066fe8b9042b6e7c418fd31d8e05b2

Download Submit
C:\Windows\{5E1E9095-582A-4e5c-BDEA-A9B0082A80C1}.exe

Filesize
408KB

MD5
4063ec1bd003575a7cfaf276962e2417

SHA1
ab293094e1bf2fd89eb13cccbc463dee601c183a

SHA256
c5df4d794b0a6c59b9292c6549032e9d989b24b8ca7f31408b5d15edb7436903

SHA512
fb1cb6d6d16ca91011f98d4b7cda53f997ee3e1410a06067f2727e24928f86b266aa55f33dc7b234cc1187a4562c543e6d8ccea2b8995052ddfbdf26d7b0d9d3

Download Submit
C:\Windows\{5E672F94-5263-4624-9A50-4BA57A33A154}.exe

Filesize
408KB

MD5
6ebbf0c9c951ace2e2834f5b6a88553a

SHA1
4d99f34d5c2349be7d204a3709a4090d49e01fce

SHA256
c37c7ee685c2ee62786ed2b679cd5f75bc817048aa1a1261a7aed5f27e8cf7b6

SHA512
92c32600c13b924b38233ce1e17f6aba0048a04b412dc60c7ecd9a1c791c71d7f401349d1bdbbafa7ab3021c114993a2d180160c3deac0a1a8fac4e8955049b7

Download Submit
C:\Windows\{707BAB72-D21A-484d-910A-B217A1955E52}.exe

Filesize
408KB

MD5
181a9ac37e854973439d96f536997246

SHA1
28da899bccf9932ce5c363c27c1ec8a757e77d3b

SHA256
faac070176d94cc0dd9fb35484c7e554279d244b5787a570876889292dd6ce6c

SHA512
b3502c8ffadf0d9ce12e7656a55a489641f75a368b09591187b916094d6896bd62d00497cecb3557844f641c2275edd181bf6677437d62e84f3016107fa54e1a

Download Submit
C:\Windows\{736D8638-6A17-4f8a-BFAE-EE60536664E2}.exe

Filesize
408KB

MD5
23186863ba9acb5128cb4a4a57cc2e14

SHA1
c3913b962698190c8ee2c3bc20635503f8d566a1

SHA256
eb0ee8005aa449649ba50d52489cf213b55a9981579be1c0918d3731dc3b84c1

SHA512
b2c49ebdeeaa4f2048f14ba056cbae0ba21f0a6d7b8fe6d7657eb33ca3b62a4bdd393b9235fbcf81ea81e229313fe04f25ec953760894dba4fd7d4cafcfbe7d1

Download Submit
C:\Windows\{8D9CEF97-56DD-4e4c-88ED-2CCD1E8DEC7F}.exe

Filesize
408KB

MD5
bfaef5f7deeed0a58aa007a7cd6c1d47

SHA1
5d1df3ad9a1e5c0f28703776d64074d781a17dc8

SHA256
0de661de12cf1ed12efadfc54d2b0f56b43d87315c2325ae28391eb83b107dc9

SHA512
9cf5771c139f7ce74c0dd4e7f3aea31d744859f733d9eb27e8f4a2a08a56d42457737d6a8449c1ed175bdd7de00731aaf34acaace1962a0c3a45434490e6a423

Download Submit
C:\Windows\{B0E1C0FD-0662-4f15-8759-826ABB5EB21D}.exe

Filesize
408KB

MD5
9d30508f2bd89c2395bb92a047e8ec4c

SHA1
348d797e6514481df3faace09f77495c9931ca8d

SHA256
a8c7be9a694ccfce9657a9dea91525ea1b634681b570f7197d9cce01d5e48155

SHA512
b003869d28ef5148971cfa4c12feb6edb24c45893d9f686a9fc418985a0a8f036a6cdb47037f36b5cab977584c112b8ab232b51bd6b653d83d643093d0a786a3

Download Submit
C:\Windows\{E145EC8F-A8D3-4725-BF6A-F0D25EB3E5E0}.exe

Filesize
408KB

MD5
890cd0e6577c02cbfc848fc22545adbe

SHA1
736af613b6aa0e27a443e87c0ce434cfa8260439

SHA256
d3b7ab7aadd760dcd4ba486bfb7aae21b13df50093cd74eaaafa08897a53f51f

SHA512
235c7d29c28e988d3a45974023c932310649e233c3068b3910ee7bc2e6b82a18a462901a44c0189f9e382b56b33a7ee7e2b5fb2f6b1c3336d6ae8d49f801a06d

Download Submit
C:\Windows\{E52D65A1-53B7-4fb8-A216-7147FF403094}.exe

Filesize
408KB

MD5
4eee03cc39b411c849d39a95c495f301

SHA1
04666bf9c73fca3c022feea4a35dfdda264d4698

SHA256
4871226c3aef4229f4c0640796d2017ad3bff3d93a486b7d186e1678f935b8b0

SHA512
d480640c205de250097787b0fcbee8473009a1759d85bd0cb5fa784553b514c23d7b1f7bd4cb949cac28c9ff45b6ef18f2a6b23f97a666a182a502465c5b4fc8

Download Submit
C:\Windows\{E53F846D-EF8D-4eed-A930-4B741B1057DA}.exe

Filesize
408KB

MD5
d97892206539d66875f132b93db1e664

SHA1
e71103bbbd276e9532d4d721a2ceead10fadd32c

SHA256
6e7da6007ff37f139bca45912baa00d637065a23fc10ed8978648c1d500bde62

SHA512
8ad4ca67f7d9bfa07fcda89e51eaeae37e86f5379a4408a47565700177fdbc28fd5e335746e757e21b84695497dd8e8b18b3edf90845ce284ae8dcca4b6bf702

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads