97c89a5155ae3ade2206c61f62f5fdf430c206f1de545ec11b751d88968eaff2

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe
Size

168KB
MD5

e0c52b168c4d2b29d3740e92e218cf24
SHA1

e937be973538132439cbe85d9f8de4bea34971a2
SHA256

97c89a5155ae3ade2206c61f62f5fdf430c206f1de545ec11b751d88968eaff2
SHA512

4a237e00ff080e458c29412b37bd95671fcdef4f28fa8399c63e3cd650037e7b488d48ec2da5fd4e3b78a2da87e0b81a0a61be3c87d7fbdacc6449d437d4c1ce
SSDEEP

1536:1EGh0o/lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o/lqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000600000002320e-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023208-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023215-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023208-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021f82-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021f83-21.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021f82-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}\stubpath = "C:\\Windows\\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe"	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED92F3C6-E162-4928-9710-4BD821FF75DF}\stubpath = "C:\\Windows\\{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe"	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7644918C-32EE-4de2-946B-A2E0392D5E03}\stubpath = "C:\\Windows\\{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe"	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCED4E57-03A7-4432-AD95-05537625C26F}\stubpath = "C:\\Windows\\{DCED4E57-03A7-4432-AD95-05537625C26F}.exe"	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B285BF06-282E-436b-807F-E00722D1C8F7}	{DCED4E57-03A7-4432-AD95-05537625C26F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}\stubpath = "C:\\Windows\\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe"	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{435DE377-EF85-44b5-A8B9-86B65A3476B9}\stubpath = "C:\\Windows\\{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe"	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}\stubpath = "C:\\Windows\\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe"	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B285BF06-282E-436b-807F-E00722D1C8F7}\stubpath = "C:\\Windows\\{B285BF06-282E-436b-807F-E00722D1C8F7}.exe"	{DCED4E57-03A7-4432-AD95-05537625C26F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}\stubpath = "C:\\Windows\\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe"	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED92F3C6-E162-4928-9710-4BD821FF75DF}	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7644918C-32EE-4de2-946B-A2E0392D5E03}	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCED4E57-03A7-4432-AD95-05537625C26F}	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}\stubpath = "C:\\Windows\\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe"	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{435DE377-EF85-44b5-A8B9-86B65A3476B9}	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}\stubpath = "C:\\Windows\\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe"	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B59DC790-04A9-494f-B02D-F7962E631E2B}	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B59DC790-04A9-494f-B02D-F7962E631E2B}\stubpath = "C:\\Windows\\{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe"	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe

Executes dropped EXE 12 IoCs

pid	Process
4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe
1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe
1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
3544	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
1372	{DCED4E57-03A7-4432-AD95-05537625C26F}.exe
4880	{B285BF06-282E-436b-807F-E00722D1C8F7}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
File created	C:\Windows\{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
File created	C:\Windows\{DCED4E57-03A7-4432-AD95-05537625C26F}.exe	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
File created	C:\Windows\{B285BF06-282E-436b-807F-E00722D1C8F7}.exe	{DCED4E57-03A7-4432-AD95-05537625C26F}.exe
File created	C:\Windows\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe
File created	C:\Windows\{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
File created	C:\Windows\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
File created	C:\Windows\{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
File created	C:\Windows\{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe
File created	C:\Windows\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
File created	C:\Windows\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
File created	C:\Windows\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
Token: SeIncBasePriorityPrivilege	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
Token: SeIncBasePriorityPrivilege	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
Token: SeIncBasePriorityPrivilege	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
Token: SeIncBasePriorityPrivilege	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe
Token: SeIncBasePriorityPrivilege	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
Token: SeIncBasePriorityPrivilege	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
Token: SeIncBasePriorityPrivilege	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe
Token: SeIncBasePriorityPrivilege	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
Token: SeIncBasePriorityPrivilege	3544	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
Token: SeIncBasePriorityPrivilege	1372	{DCED4E57-03A7-4432-AD95-05537625C26F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4552	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe	95
PID 3180 wrote to memory of 4552	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe	95
PID 3180 wrote to memory of 4552	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe	95
PID 3180 wrote to memory of 1372	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe	96
PID 3180 wrote to memory of 1372	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe	96
PID 3180 wrote to memory of 1372	3180	2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe	96
PID 4552 wrote to memory of 2772	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	97
PID 4552 wrote to memory of 2772	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	97
PID 4552 wrote to memory of 2772	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	97
PID 4552 wrote to memory of 4880	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	98
PID 4552 wrote to memory of 4880	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	98
PID 4552 wrote to memory of 4880	4552	{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe	98
PID 2772 wrote to memory of 3208	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	101
PID 2772 wrote to memory of 3208	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	101
PID 2772 wrote to memory of 3208	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	101
PID 2772 wrote to memory of 4160	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	100
PID 2772 wrote to memory of 4160	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	100
PID 2772 wrote to memory of 4160	2772	{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe	100
PID 3208 wrote to memory of 3036	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	102
PID 3208 wrote to memory of 3036	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	102
PID 3208 wrote to memory of 3036	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	102
PID 3208 wrote to memory of 4676	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	103
PID 3208 wrote to memory of 4676	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	103
PID 3208 wrote to memory of 4676	3208	{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe	103
PID 3036 wrote to memory of 4984	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	104
PID 3036 wrote to memory of 4984	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	104
PID 3036 wrote to memory of 4984	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	104
PID 3036 wrote to memory of 1624	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	105
PID 3036 wrote to memory of 1624	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	105
PID 3036 wrote to memory of 1624	3036	{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe	105
PID 4984 wrote to memory of 1916	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	106
PID 4984 wrote to memory of 1916	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	106
PID 4984 wrote to memory of 1916	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	106
PID 4984 wrote to memory of 1368	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	107
PID 4984 wrote to memory of 1368	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	107
PID 4984 wrote to memory of 1368	4984	{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe	107
PID 1916 wrote to memory of 3612	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	108
PID 1916 wrote to memory of 3612	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	108
PID 1916 wrote to memory of 3612	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	108
PID 1916 wrote to memory of 4088	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	109
PID 1916 wrote to memory of 4088	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	109
PID 1916 wrote to memory of 4088	1916	{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe	109
PID 3612 wrote to memory of 2804	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	110
PID 3612 wrote to memory of 2804	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	110
PID 3612 wrote to memory of 2804	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	110
PID 3612 wrote to memory of 2712	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	111
PID 3612 wrote to memory of 2712	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	111
PID 3612 wrote to memory of 2712	3612	{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe	111
PID 2804 wrote to memory of 1468	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	112
PID 2804 wrote to memory of 1468	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	112
PID 2804 wrote to memory of 1468	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	112
PID 2804 wrote to memory of 2708	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	113
PID 2804 wrote to memory of 2708	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	113
PID 2804 wrote to memory of 2708	2804	{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe	113
PID 1468 wrote to memory of 3544	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	115
PID 1468 wrote to memory of 3544	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	115
PID 1468 wrote to memory of 3544	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	115
PID 1468 wrote to memory of 2324	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	114
PID 1468 wrote to memory of 2324	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	114
PID 1468 wrote to memory of 2324	1468	{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe	114
PID 3544 wrote to memory of 1372	3544	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe	116
PID 3544 wrote to memory of 1372	3544	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe	116
PID 3544 wrote to memory of 1372	3544	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe	116
PID 3544 wrote to memory of 4488	3544	{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_e0c52b168c4d2b29d3740e92e218cf24_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
  C:\Windows\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
    C:\Windows\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FD77C~1.EXE > nul
      4⤵
      PID:4160
  - - C:\Windows\{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
      C:\Windows\{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Windows\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
        
        C:\Windows\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
      - C:\Windows\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe
        
        C:\Windows\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
        
        C:\Windows\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
        
        C:\Windows\{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe
        
        C:\Windows\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
        
        C:\Windows\{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B59DC~1.EXE > nul
        11⤵
        
        PID:2324
        
        C:\Windows\{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
        
        C:\Windows\{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\{DCED4E57-03A7-4432-AD95-05537625C26F}.exe
        
        C:\Windows\{DCED4E57-03A7-4432-AD95-05537625C26F}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1372
        
        C:\Windows\{B285BF06-282E-436b-807F-E00722D1C8F7}.exe
        
        C:\Windows\{B285BF06-282E-436b-807F-E00722D1C8F7}.exe
        13⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DCED4~1.EXE > nul
        13⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76449~1.EXE > nul
        12⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95AA0~1.EXE > nul
        10⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED92F~1.EXE > nul
        9⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4BABA~1.EXE > nul
        8⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA746~1.EXE > nul
        7⤵
        
        PID:1368
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FFDB~1.EXE > nul
        6⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{435DE~1.EXE > nul
        5⤵
        
        PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6D0C6~1.EXE > nul
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1FFDBE83-C70B-4241-AD72-D6615BE0729F}.exe

Filesize
168KB

MD5
72256f6ef72b609915c80325e7a5c4a6

SHA1
db53afb2970e84ba878ba6cbffd36e0f77136cbf

SHA256
ed251c4d4efab43f6d07811a05c1b0b8d6d6ea3b3b0e7c18ed374971466592a5

SHA512
7b391d7f37766bba8141e25e97d23f2a9468c4c2f0b3e3a3a10efd1241ad6bfb79ab742f60d3f2a7fd9ed3b0d12e2b8aab5a934a75c5cb0592957e4bf71cd030

Download Submit
C:\Windows\{435DE377-EF85-44b5-A8B9-86B65A3476B9}.exe

Filesize
168KB

MD5
30a2a5f974a984cdcbf433f228df75a3

SHA1
07f42f0da1969678e1bc4aca4a7d104890397218

SHA256
1014e3f4278cd7656a2785b02836ba6a62b05cc3f28e7a15586436095f24f87a

SHA512
5efb7e0515dff71334cd650ddf1444eb6e20d79bb181384a2a3f578ba3ce6f4d0c802a9814c121ec9cf6fe184684e327468fa11fcca77f448811034eeaeb013d

Download Submit
C:\Windows\{4BABA56E-94D8-4fd1-8EA0-5BE68E488101}.exe

Filesize
168KB

MD5
a0eb0930ee664588c68acee9fba755d4

SHA1
4fb28c43e7d403b3c2639133a9534db2ee40071d

SHA256
63b60018adff2b4eaf29ef3ffbb831fdd2adb3b4124a1cb20a7a0c1017f2b4e0

SHA512
d2dc625b8ca039e7494b0a8b346a2b70ba363cba2ce74fbcbb26422ca23b493564d149dbf5629895d6d0f0f7ea68e37696c6f637e899f3d670c6ab091d08d8df

Download Submit
C:\Windows\{6D0C64FA-E8EA-4738-A9E0-6740ECA7B9E3}.exe

Filesize
168KB

MD5
fce95f8fabdffe4e72541c5d1e1fb545

SHA1
ca893c38f813a42eb172539a3a6b2386a40d5564

SHA256
3ff90b0cb7e52cc73745ddd1e76994f63687039bc3632c9ee82881b9c2924cd0

SHA512
cbcefd35d556e311524e657be2df27a8a9b0f26ab429e29880f380cae10279a9f771b7c2ffa15323ffad314d93546b9102dac07ce0b2cd6e14a8b97833e262cd

Download Submit
C:\Windows\{7644918C-32EE-4de2-946B-A2E0392D5E03}.exe

Filesize
168KB

MD5
39eddea3e61e7c28a4aa5fb1f0215563

SHA1
de23adfb09def7bba598ea9e58894ecb67482a6f

SHA256
84e3e3f7cdbd26906b334f6d1b83e068a63eb279d2321e8a97c714effd0a95bc

SHA512
aabf4cdc18acf58f067469cc65cb2a4554792d0079ae0e64e5c87488970e5e8ed53c576f2fb6fce85da8a94682ea14dfed1d3e201c648b7f2590f6d95135a191

Download Submit
C:\Windows\{95AA0AD7-124A-44f1-B7C8-0D6BAD25D8CA}.exe

Filesize
168KB

MD5
ed431bb242ea1de2f4a7437a5e6d0164

SHA1
40a54e164778d4807f5cc1ae4140851068e70413

SHA256
d1cd60a3dbe40a1155ad441f0efaff23a221a2f4f77ed69d94c5b0e7bb4a232d

SHA512
bf295d2a496c3e728e499c5fb1da9053fa91602cfac6c8b8e457a5102e7ba2d872552edd0754731fdb0197160d89243f2cbf6e7502950f238f500a71f9a4ce33

Download Submit
C:\Windows\{B285BF06-282E-436b-807F-E00722D1C8F7}.exe

Filesize
168KB

MD5
0a693a50e31d751b90393448cc9bf9de

SHA1
b3dc5bddefc4b20d912a57f5974e76a3c0fdc475

SHA256
8d5a3699f6c7514bc2ce780090e5190701993ea58c96ac3a0606158a93145097

SHA512
ae9b49b2aed5b2f0a4876b1e75f755a333e2f7a3ea5296ea6be0ca6af93abe49dbd114c25ed52000036354532931aa6c1dc161f2c1f11325121aefa9b7f45a76

Download Submit
C:\Windows\{B59DC790-04A9-494f-B02D-F7962E631E2B}.exe

Filesize
168KB

MD5
b7b4f19da3ca91d21c14e30b443aedf8

SHA1
3569f2cdc2849f4abbe6be5c7748f0d632ad4d13

SHA256
9a462c638205c89ae551a9706b558186a9d4b783ca34b137ff99065c33a1b73f

SHA512
38d169529c4a625c429a83bc4d5dcd529900c91d4028cfa3b16a5b53171b4fda5df1d304e8dbd14027862228aa74faba465f9fce86c6332572a3fb9b783bb06a

Download Submit
C:\Windows\{DA7463FD-9AAA-4bcc-BE04-AA86E05A3B60}.exe

Filesize
168KB

MD5
a3c48df326eb4cf7866ee2ac17914eb4

SHA1
3eb3c5bf3d4c4c966952b3094c781368f465b5f7

SHA256
10b11408d562aff4b90cb8966dbc41e99cc77bf61a9838460fb56e8f51acadc9

SHA512
70aa2b2c5966c8f58395389c79dd894658e58d494b501a3af91817208f8178dca49f5b96a0a8055a2f89f21f8b656ce8337c36c33a748ecd854f7552b396bd1b

Download Submit
C:\Windows\{DCED4E57-03A7-4432-AD95-05537625C26F}.exe

Filesize
168KB

MD5
049057504bb31976fed96fffec04d0e3

SHA1
ea821b064407c1c279a77897706984aeb2126fce

SHA256
852821ea95000a67f9e3f3d08f46b5ec9ee0a9b0c96b007cf6cb2cf4965d985f

SHA512
b968f50743cb134a1d921efa424367683891f888be866b71cfdef551895fb2264ca65c52fd36c14ae3c31939e55b6952c21def4095c33e12017256a3f6fdfbed

Download Submit
C:\Windows\{ED92F3C6-E162-4928-9710-4BD821FF75DF}.exe

Filesize
168KB

MD5
b15bf4257970462e5772059cede7f18d

SHA1
e89f29514d7288a0ea9757ad7f1c31be3f61fe39

SHA256
8d1b0f641b12df985f8699f4593dbacabea90c8f9a6f711269ea423187307d01

SHA512
2c9310902fbf4027e0a9010c1176b2c79560be69e292443a5a881bb38ebb13e4a321650eef41a2c69cca32fab5ea84c1c43afeb68530c02c7d1980607d11a5f4

Download Submit
C:\Windows\{FD77CDF5-1A85-4356-990A-4B72E6A407AB}.exe

Filesize
168KB

MD5
d062e65c23a5ca5882756ff78f4fe452

SHA1
70354496251226d4c61806f6c38aeae82519b58e

SHA256
a51bbca360e69d439fc9527374fc31d90aa5b151977768849c126a10f0afe55c

SHA512
f2d6450629412acfea9301838312b7fd7cc130a4ec959c5850a08856ffc043fd83fd26591efc33c750f43d7bf23a1645827f843ee6d8e1a7cf3823ea5d654ccb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads