6785e5448df4114c11ce961df33622545e4c06f4381bea27f766168b28253c42

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe
Size

380KB
MD5

675805472f71a27c70e43c8451bf2131
SHA1

8642c22c36087adbf38321f4c0177d5868116850
SHA256

6785e5448df4114c11ce961df33622545e4c06f4381bea27f766168b28253c42
SHA512

2a10295e26aad2f7a7437481701ecb971ee270f1f41c27b2108288e63f56356b238e5192bb058c6318d427b92b66e65b825b22e20659b2a3efeff41c8fc8c2ab
SSDEEP

3072:mEGh0oWlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGsl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231fb-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00120000000231f4-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023202-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00130000000231f4-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e70-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e70-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e71-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021e70-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7022548-10A9-423a-B01D-F4A620833753}\stubpath = "C:\\Windows\\{C7022548-10A9-423a-B01D-F4A620833753}.exe"	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}\stubpath = "C:\\Windows\\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe"	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D51E272C-EA34-4be2-9D32-648860FC19C3}	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAB9183A-30EE-4a90-B9F1-4F826010100C}\stubpath = "C:\\Windows\\{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe"	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7022548-10A9-423a-B01D-F4A620833753}	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{009A1C82-7783-46c6-893C-209F3BD05318}	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D51E272C-EA34-4be2-9D32-648860FC19C3}\stubpath = "C:\\Windows\\{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe"	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}\stubpath = "C:\\Windows\\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe"	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}\stubpath = "C:\\Windows\\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe"	{009A1C82-7783-46c6-893C-209F3BD05318}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}\stubpath = "C:\\Windows\\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe"	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}\stubpath = "C:\\Windows\\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe"	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}\stubpath = "C:\\Windows\\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe"	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}\stubpath = "C:\\Windows\\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe"	{C7022548-10A9-423a-B01D-F4A620833753}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{009A1C82-7783-46c6-893C-209F3BD05318}\stubpath = "C:\\Windows\\{009A1C82-7783-46c6-893C-209F3BD05318}.exe"	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}	{009A1C82-7783-46c6-893C-209F3BD05318}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C70D418C-1108-4087-8C6E-E70FFB322E00}	{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C70D418C-1108-4087-8C6E-E70FFB322E00}\stubpath = "C:\\Windows\\{C70D418C-1108-4087-8C6E-E70FFB322E00}.exe"	{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAB9183A-30EE-4a90-B9F1-4F826010100C}	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}	{C7022548-10A9-423a-B01D-F4A620833753}.exe

Executes dropped EXE 12 IoCs

pid	Process
1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe
5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe
1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
2512	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
2040	{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe
1592	{C70D418C-1108-4087-8C6E-E70FFB322E00}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
File created	C:\Windows\{009A1C82-7783-46c6-893C-209F3BD05318}.exe	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
File created	C:\Windows\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
File created	C:\Windows\{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe
File created	C:\Windows\{C7022548-10A9-423a-B01D-F4A620833753}.exe	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
File created	C:\Windows\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	{C7022548-10A9-423a-B01D-F4A620833753}.exe
File created	C:\Windows\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
File created	C:\Windows\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	{009A1C82-7783-46c6-893C-209F3BD05318}.exe
File created	C:\Windows\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
File created	C:\Windows\{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
File created	C:\Windows\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
File created	C:\Windows\{C70D418C-1108-4087-8C6E-E70FFB322E00}.exe	{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
Token: SeIncBasePriorityPrivilege	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe
Token: SeIncBasePriorityPrivilege	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
Token: SeIncBasePriorityPrivilege	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
Token: SeIncBasePriorityPrivilege	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
Token: SeIncBasePriorityPrivilege	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe
Token: SeIncBasePriorityPrivilege	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
Token: SeIncBasePriorityPrivilege	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
Token: SeIncBasePriorityPrivilege	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
Token: SeIncBasePriorityPrivilege	2512	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
Token: SeIncBasePriorityPrivilege	2040	{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1420	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe	97
PID 1444 wrote to memory of 1420	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe	97
PID 1444 wrote to memory of 1420	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe	97
PID 1444 wrote to memory of 1052	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe	98
PID 1444 wrote to memory of 1052	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe	98
PID 1444 wrote to memory of 1052	1444	2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe	98
PID 1420 wrote to memory of 3400	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	99
PID 1420 wrote to memory of 3400	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	99
PID 1420 wrote to memory of 3400	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	99
PID 1420 wrote to memory of 4372	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	100
PID 1420 wrote to memory of 4372	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	100
PID 1420 wrote to memory of 4372	1420	{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe	100
PID 3400 wrote to memory of 5004	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe	102
PID 3400 wrote to memory of 5004	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe	102
PID 3400 wrote to memory of 5004	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe	102
PID 3400 wrote to memory of 2504	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe	103
PID 3400 wrote to memory of 2504	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe	103
PID 3400 wrote to memory of 2504	3400	{C7022548-10A9-423a-B01D-F4A620833753}.exe	103
PID 5004 wrote to memory of 3564	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	104
PID 5004 wrote to memory of 3564	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	104
PID 5004 wrote to memory of 3564	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	104
PID 5004 wrote to memory of 4248	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	105
PID 5004 wrote to memory of 4248	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	105
PID 5004 wrote to memory of 4248	5004	{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe	105
PID 3564 wrote to memory of 4428	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	106
PID 3564 wrote to memory of 4428	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	106
PID 3564 wrote to memory of 4428	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	106
PID 3564 wrote to memory of 1884	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	107
PID 3564 wrote to memory of 1884	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	107
PID 3564 wrote to memory of 1884	3564	{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe	107
PID 4428 wrote to memory of 2384	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	108
PID 4428 wrote to memory of 2384	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	108
PID 4428 wrote to memory of 2384	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	108
PID 4428 wrote to memory of 1132	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	109
PID 4428 wrote to memory of 1132	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	109
PID 4428 wrote to memory of 1132	4428	{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe	109
PID 2384 wrote to memory of 1100	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe	111
PID 2384 wrote to memory of 1100	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe	111
PID 2384 wrote to memory of 1100	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe	111
PID 2384 wrote to memory of 4292	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe	110
PID 2384 wrote to memory of 4292	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe	110
PID 2384 wrote to memory of 4292	2384	{009A1C82-7783-46c6-893C-209F3BD05318}.exe	110
PID 1100 wrote to memory of 4752	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	112
PID 1100 wrote to memory of 4752	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	112
PID 1100 wrote to memory of 4752	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	112
PID 1100 wrote to memory of 1692	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	113
PID 1100 wrote to memory of 1692	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	113
PID 1100 wrote to memory of 1692	1100	{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe	113
PID 4752 wrote to memory of 1376	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	114
PID 4752 wrote to memory of 1376	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	114
PID 4752 wrote to memory of 1376	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	114
PID 4752 wrote to memory of 2248	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	115
PID 4752 wrote to memory of 2248	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	115
PID 4752 wrote to memory of 2248	4752	{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe	115
PID 1376 wrote to memory of 2512	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	117
PID 1376 wrote to memory of 2512	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	117
PID 1376 wrote to memory of 2512	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	117
PID 1376 wrote to memory of 1940	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	116
PID 1376 wrote to memory of 1940	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	116
PID 1376 wrote to memory of 1940	1376	{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe	116
PID 2512 wrote to memory of 2040	2512	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe	118
PID 2512 wrote to memory of 2040	2512	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe	118
PID 2512 wrote to memory of 2040	2512	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe	118
PID 2512 wrote to memory of 1156	2512	{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_675805472f71a27c70e43c8451bf2131_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
  C:\Windows\{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\{C7022548-10A9-423a-B01D-F4A620833753}.exe
    C:\Windows\{C7022548-10A9-423a-B01D-F4A620833753}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
      C:\Windows\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Windows\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
        
        C:\Windows\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3564
      - C:\Windows\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
        
        C:\Windows\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\{009A1C82-7783-46c6-893C-209F3BD05318}.exe
        
        C:\Windows\{009A1C82-7783-46c6-893C-209F3BD05318}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{009A1~1.EXE > nul
        8⤵
        
        PID:4292
        
        C:\Windows\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
        
        C:\Windows\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
        
        C:\Windows\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
        
        C:\Windows\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8AA90~1.EXE > nul
        11⤵
        
        PID:1940
        
        C:\Windows\{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
        
        C:\Windows\{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe
        
        C:\Windows\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
        
        C:\Windows\{C70D418C-1108-4087-8C6E-E70FFB322E00}.exe
        
        C:\Windows\{C70D418C-1108-4087-8C6E-E70FFB322E00}.exe
        13⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8ED1D~1.EXE > nul
        13⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D51E2~1.EXE > nul
        12⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6DA72~1.EXE > nul
        10⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0AE2A~1.EXE > nul
        9⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4166B~1.EXE > nul
        7⤵
        
        PID:1132
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4C85~1.EXE > nul
        6⤵
        
        PID:1884
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E3E6C~1.EXE > nul
        5⤵
        
        PID:4248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C7022~1.EXE > nul
      4⤵
      PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DAB91~1.EXE > nul
    3⤵
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{009A1C82-7783-46c6-893C-209F3BD05318}.exe

Filesize
380KB

MD5
b63802f691f4899de6470c08fc89d3f0

SHA1
98c0bfdaaffedbdf6444d4d46658fc3df6bd7794

SHA256
5518e96b8d2fd6a4ca98b8e7c9f53fafc8a1f41ab39e0a5c10081132d70dcd70

SHA512
40a2202bc3332f130c01fe6c318bacc4dda3d1591f5113ee2580f762d2d4c9749898031e677445a96feef28253da962765aa7a1890494b710a20cccc13808172

Download Submit
C:\Windows\{0AE2AEB5-92C8-4c0e-B2AF-30988F5167DE}.exe

Filesize
380KB

MD5
9b0da1ff217f12c16c3f42a4054692e7

SHA1
315f7e93eddcd2d1e35c6acfee45e2eff824cc37

SHA256
d3402b40868e000b3a53f91a61f69dcfe6097a819011bfab8a74e33e49e145ec

SHA512
a2047a45f55bc3eedaa578005b6e87c240ea46c0aee09828ae3faacee8101bda0eb0c1260a11909c56e6891a67209ba5e6d888bc6741acfc3a7986e6c4ad1c8f

Download Submit
C:\Windows\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe

Filesize
380KB

MD5
eb619faf42d78158c9e9cdedb31a976b

SHA1
13aad340f4c572b53f6d5f7123a0c8aca86bc197

SHA256
e808121b0bfe0dc9de62ab6686cd18f1d547f180d859d7fac97d826f108855a7

SHA512
227a9d1aa67449aaa665a81f671db198544b35a435461810b90b5580cd2096545806b256d53684b1914e9ca9b13aaea626acd89a9cb8ccc40e769f19fad5af02

Download Submit
C:\Windows\{4166BD14-EBD4-4b9b-B8E9-6893161F4B8E}.exe

Filesize
329KB

MD5
f6fbb32c98e72f80a213a960f68d18c2

SHA1
3a37432c98020ecc96333a2cad6749eecedf0e0a

SHA256
b80e4d9013e169683984b659daf8f151be3d7fb5d94d5edc26f46693efcfb6d9

SHA512
c9e3ddb1777afb482f4a7a65e66e771c907f6433ba9ee234e94ec5901b4bf478f23b31032e35682a5578472e7a4db2fb76db9211776401fdbd39b6c7c64a0010

Download Submit
C:\Windows\{6DA72A8F-5355-4d8c-86C1-7AB62F1D2EB6}.exe

Filesize
380KB

MD5
132463575b5edeac50779ee51a848d16

SHA1
bb298f98095974244534589b0cca46fe682258cd

SHA256
759beee670fd6f72af9b3e296b186b036178f7d44317818095364ccb7a2d70fc

SHA512
bc64fd7fbd7c108650a113bb2ba699617b78f70236deb9323ed67cdbfcede68fefa49ed18fb682728854a59b72e26eee040d35902d5c952eceef1bcfe6b7e654

Download Submit
C:\Windows\{8AA90812-E711-4cb5-A69D-7ADDF6990B0B}.exe

Filesize
380KB

MD5
5b3748d4d3f12b134a8b93ca76069b20

SHA1
0929bf8e4f590519fafcc529fa9d9039e9423e99

SHA256
a072f5a2c8bf6a584d83de54083da153885039c72bb7c343dfad12e1c3c74025

SHA512
a837b4c46c55b3b870ad12a31a04e254a0904c5e4e7419950cf4b59089f70f6f0d8e66cd59a2a6715e0d5da62623df55beef767a7f016cad9715819b89525a06

Download Submit
C:\Windows\{8ED1DDCB-8354-4c16-A244-AB937C0A0EDA}.exe

Filesize
380KB

MD5
cd172b8712f1f060e3730c5499d2661e

SHA1
fe9748e69a7618175489e80aad1ac33286a0db44

SHA256
276deb60dac045689b8ee73b92ff8898c2436811a2f93fb06493be5811f717d9

SHA512
bdde2a382b890434c382fd4df15ad2c3fb87a8ba8d17bfab28b9f609276898b32c90193c18229ca549de8533ddfa29d1bf365a7ce76f0e21701565ff06ca0a32

Download Submit
C:\Windows\{C7022548-10A9-423a-B01D-F4A620833753}.exe

Filesize
380KB

MD5
c4bd069488042e272ef7e9c64a3be257

SHA1
22122dadf899c9a9e4078ad4504a1703802b619b

SHA256
3781dc96fb7a0e85d17f7c159012974edfed7afb75def1d06ab7e75a2264e7d3

SHA512
d0386e7c69154b753eb50119d0805db55f4682c9cd65a290a65e30e96b9646b2cf38b7130cb26109789e33107739e152e48f6ee5881d5616efaa612094cce5ff

Download Submit
C:\Windows\{C70D418C-1108-4087-8C6E-E70FFB322E00}.exe

Filesize
380KB

MD5
a7982ad12fa4cb3b5ec9abf2ad9ec2d7

SHA1
37dbd85d3e31d16bd10a23bd1b6d8e1b4dc2da48

SHA256
3072f27f471898e88fbcc35ef359cd0eec51a85cd4afd95945600d70faaaee4b

SHA512
b85a57bd263d4b9c07f76147228f6e3ba5bce1aa57125d07fddd2c2edb3d43c0b9f5bfb51a3e1ce01932d71f37d8868d7bee06a46efc4e6b3501845b307c9670

Download Submit
C:\Windows\{D51E272C-EA34-4be2-9D32-648860FC19C3}.exe

Filesize
380KB

MD5
231599a076a7f157c6bfb54de3265645

SHA1
e2cf7d7416274cde9b928c067949367bfd20c57f

SHA256
605ce12a3155125441a9c9464b552e12f349944fd3c76785e1f890a9e6c1650a

SHA512
40592a574b2a5a86c49da7d7426c140f6742c0d8e8d456d6e0c3b4ed73b24f8a6a632e8b7b7eb63db805f58ae9a25f41b8de29351ebe2bb4e72e166019367ccc

Download Submit
C:\Windows\{DAB9183A-30EE-4a90-B9F1-4F826010100C}.exe

Filesize
380KB

MD5
ba4c7e05ec30e7f7c76374e2edba0d7a

SHA1
33d2778aee969f089cfe91b866410c32dec72ea6

SHA256
c5ac9bbb78fd41e21afa24225963d2c0c13c7f42b865eb5502710375f65655bb

SHA512
2e1f124868f09cd8c82b83ef4a4cccc502b3018849aae45100f7c716d5e83811de1af68b883daf4854ed6903cd638e9d559b34b2189efbb48a17862037c43c47

Download Submit
C:\Windows\{E3E6C029-308A-4542-BF5D-1CC8C6D30546}.exe

Filesize
380KB

MD5
5b22c2c308a3f54ca0c94edef059aa73

SHA1
e0a934661604ec11b27205972e63a75ba6ef80e4

SHA256
25b5305dcf70bc880470b09e3a25bb08c87651dfba088581e15d5f5c56dc1b3d

SHA512
4082c517841a2dfc1fa21468d8547048e95105f6aa789c00287144ee8b3c08bdb54766dbef6caf7611c0af334c5dce350a5fe619aab6d640db34b318baefc9f9

Download Submit
C:\Windows\{E4C85171-F8B8-4071-A9CD-7D57AEF25451}.exe

Filesize
380KB

MD5
236eb93339d8d84a762b0281f68c3a2e

SHA1
6ef25e63877da9337d3d0eb3d1b10faa95e8a5e3

SHA256
0460b7f4d29a2fe27fc7023adc955f4f25136c2cabe41501dc6d7de759f576af

SHA512
52c5294e2c9c99859d3ecac57af63c7637cc4f57e57ba10b43ab42cbe985c43410720340efb8b053c9ab54232f03d6b247a5d509e8cd06381e4b757ed011a9c8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads