7d969909277d6dc541e11218ab1b447e45d46684efa92ac8d889bfff96c9de37

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe
Size

344KB
MD5

d10212723e61ed24909b906e620a767e
SHA1

acbd4a21b5e0679d8971151e0092514f6cfe3dc9
SHA256

7d969909277d6dc541e11218ab1b447e45d46684efa92ac8d889bfff96c9de37
SHA512

c3a371b8266ee8597a24f390b8b3117f088b9534e29ee7b805023c33917888856183d0fd4c755e8d2621c7a5e20ccd58c04c170f9e218109ba25819369fa03b6
SSDEEP

3072:mEGh0oIlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGSlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 14 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320a-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023212-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023219-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023212-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023212-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000217f9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000021805-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000217f9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000717-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{552A19B5-190C-4b4b-91F4-542FFD9709A6}	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E876B941-636A-4f21-9204-12EA3ED031F6}	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C2AA87-AF0A-4896-8387-382F35408FA8}	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B418DC06-864D-49bc-A47B-84C1326F010D}	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E74D03B-FC65-476a-90E2-0395B4F5775D}\stubpath = "C:\\Windows\\{9E74D03B-FC65-476a-90E2-0395B4F5775D}.exe"	{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}\stubpath = "C:\\Windows\\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe"	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}\stubpath = "C:\\Windows\\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe"	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CC6E494-119E-4103-B27F-8C32333F6DB9}\stubpath = "C:\\Windows\\{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe"	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}\stubpath = "C:\\Windows\\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe"	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A52A0877-9C83-4112-987D-3D790C0EE872}	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B418DC06-864D-49bc-A47B-84C1326F010D}\stubpath = "C:\\Windows\\{B418DC06-864D-49bc-A47B-84C1326F010D}.exe"	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E876B941-636A-4f21-9204-12EA3ED031F6}\stubpath = "C:\\Windows\\{E876B941-636A-4f21-9204-12EA3ED031F6}.exe"	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C2AA87-AF0A-4896-8387-382F35408FA8}\stubpath = "C:\\Windows\\{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe"	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}\stubpath = "C:\\Windows\\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe"	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{552A19B5-190C-4b4b-91F4-542FFD9709A6}\stubpath = "C:\\Windows\\{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe"	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A52A0877-9C83-4112-987D-3D790C0EE872}\stubpath = "C:\\Windows\\{A52A0877-9C83-4112-987D-3D790C0EE872}.exe"	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E74D03B-FC65-476a-90E2-0395B4F5775D}	{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}\stubpath = "C:\\Windows\\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe"	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CC6E494-119E-4103-B27F-8C32333F6DB9}	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe

Executes dropped EXE 12 IoCs

pid	Process
1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe
4252	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe
4628	{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe
4100	{9E74D03B-FC65-476a-90E2-0395B4F5775D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
File created	C:\Windows\{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
File created	C:\Windows\{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
File created	C:\Windows\{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
File created	C:\Windows\{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe
File created	C:\Windows\{9E74D03B-FC65-476a-90E2-0395B4F5775D}.exe	{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe
File created	C:\Windows\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe
File created	C:\Windows\{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
File created	C:\Windows\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
File created	C:\Windows\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
File created	C:\Windows\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
File created	C:\Windows\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
Token: SeIncBasePriorityPrivilege	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
Token: SeIncBasePriorityPrivilege	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
Token: SeIncBasePriorityPrivilege	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
Token: SeIncBasePriorityPrivilege	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
Token: SeIncBasePriorityPrivilege	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
Token: SeIncBasePriorityPrivilege	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
Token: SeIncBasePriorityPrivilege	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
Token: SeIncBasePriorityPrivilege	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe
Token: SeIncBasePriorityPrivilege	4252	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe
Token: SeIncBasePriorityPrivilege	4628	{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1616	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe	95
PID 1376 wrote to memory of 1616	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe	95
PID 1376 wrote to memory of 1616	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe	95
PID 1376 wrote to memory of 452	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe	96
PID 1376 wrote to memory of 452	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe	96
PID 1376 wrote to memory of 452	1376	2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe	96
PID 1616 wrote to memory of 1016	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	97
PID 1616 wrote to memory of 1016	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	97
PID 1616 wrote to memory of 1016	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	97
PID 1616 wrote to memory of 692	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	98
PID 1616 wrote to memory of 692	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	98
PID 1616 wrote to memory of 692	1616	{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe	98
PID 1016 wrote to memory of 3452	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	101
PID 1016 wrote to memory of 3452	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	101
PID 1016 wrote to memory of 3452	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	101
PID 1016 wrote to memory of 3100	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	100
PID 1016 wrote to memory of 3100	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	100
PID 1016 wrote to memory of 3100	1016	{A52A0877-9C83-4112-987D-3D790C0EE872}.exe	100
PID 3452 wrote to memory of 1304	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	103
PID 3452 wrote to memory of 1304	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	103
PID 3452 wrote to memory of 1304	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	103
PID 3452 wrote to memory of 2820	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	102
PID 3452 wrote to memory of 2820	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	102
PID 3452 wrote to memory of 2820	3452	{B418DC06-864D-49bc-A47B-84C1326F010D}.exe	102
PID 1304 wrote to memory of 3540	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	104
PID 1304 wrote to memory of 3540	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	104
PID 1304 wrote to memory of 3540	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	104
PID 1304 wrote to memory of 2904	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	105
PID 1304 wrote to memory of 2904	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	105
PID 1304 wrote to memory of 2904	1304	{E876B941-636A-4f21-9204-12EA3ED031F6}.exe	105
PID 3540 wrote to memory of 2156	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	106
PID 3540 wrote to memory of 2156	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	106
PID 3540 wrote to memory of 2156	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	106
PID 3540 wrote to memory of 4824	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	107
PID 3540 wrote to memory of 4824	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	107
PID 3540 wrote to memory of 4824	3540	{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe	107
PID 2156 wrote to memory of 3352	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	109
PID 2156 wrote to memory of 3352	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	109
PID 2156 wrote to memory of 3352	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	109
PID 2156 wrote to memory of 1136	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	108
PID 2156 wrote to memory of 1136	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	108
PID 2156 wrote to memory of 1136	2156	{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe	108
PID 3352 wrote to memory of 1520	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	110
PID 3352 wrote to memory of 1520	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	110
PID 3352 wrote to memory of 1520	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	110
PID 3352 wrote to memory of 3888	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	111
PID 3352 wrote to memory of 3888	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	111
PID 3352 wrote to memory of 3888	3352	{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe	111
PID 1520 wrote to memory of 2400	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	112
PID 1520 wrote to memory of 2400	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	112
PID 1520 wrote to memory of 2400	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	112
PID 1520 wrote to memory of 3164	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	113
PID 1520 wrote to memory of 3164	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	113
PID 1520 wrote to memory of 3164	1520	{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe	113
PID 2400 wrote to memory of 4252	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	114
PID 2400 wrote to memory of 4252	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	114
PID 2400 wrote to memory of 4252	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	114
PID 2400 wrote to memory of 3720	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	115
PID 2400 wrote to memory of 3720	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	115
PID 2400 wrote to memory of 3720	2400	{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe	115
PID 4252 wrote to memory of 4628	4252	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe	116
PID 4252 wrote to memory of 4628	4252	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe	116
PID 4252 wrote to memory of 4628	4252	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe	116
PID 4252 wrote to memory of 5064	4252	{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_d10212723e61ed24909b906e620a767e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
  C:\Windows\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
    C:\Windows\{A52A0877-9C83-4112-987D-3D790C0EE872}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A52A0~1.EXE > nul
      4⤵
      PID:3100
  - - C:\Windows\{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
      C:\Windows\{B418DC06-864D-49bc-A47B-84C1326F010D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B418D~1.EXE > nul
        5⤵
        
        PID:2820
    - - C:\Windows\{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
        
        C:\Windows\{E876B941-636A-4f21-9204-12EA3ED031F6}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Windows\{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
        
        C:\Windows\{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
        
        C:\Windows\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7AA6E~1.EXE > nul
        8⤵
        
        PID:1136
        
        C:\Windows\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
        
        C:\Windows\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
        
        C:\Windows\{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe
        
        C:\Windows\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe
        
        C:\Windows\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe
        
        C:\Windows\{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
        
        C:\Windows\{9E74D03B-FC65-476a-90E2-0395B4F5775D}.exe
        
        C:\Windows\{9E74D03B-FC65-476a-90E2-0395B4F5775D}.exe
        13⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1CC6E~1.EXE > nul
        13⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E800C~1.EXE > nul
        12⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6FAE7~1.EXE > nul
        11⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{552A1~1.EXE > nul
        10⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8B9DD~1.EXE > nul
        9⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58C2A~1.EXE > nul
        7⤵
        
        PID:4824
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E876B~1.EXE > nul
        6⤵
        
        PID:2904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{AF736~1.EXE > nul
    3⤵
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1CC6E494-119E-4103-B27F-8C32333F6DB9}.exe

Filesize
344KB

MD5
80e965300d73a45a48f6de2766f41d91

SHA1
f4e9c45f4644d778361434a3783af81c03ad30dc

SHA256
c9a36f9a19c7d0ba4f805522cab675d70a5fe8b8427ba7a2d02a20b2300c53da

SHA512
0adf04f9b96d75fc6c8de349af6ef5b2786addba9964fa293b989d040225667be84b6d060d5dd2ffb67bd701a876f4707f94c8bd88bb942198a879e9edbb7ec7

Download Submit
C:\Windows\{552A19B5-190C-4b4b-91F4-542FFD9709A6}.exe

Filesize
344KB

MD5
663be42c11c70e89b85c5852aa80733d

SHA1
65950f4712ea0c3dfeac751ce0966a1c0edf7a62

SHA256
0c2546b1603b6e7b0b5c8ddf30079403ce729687ab16d530f533c39564c70cbb

SHA512
d3354b49dd2469766145a8b9afcebde800701cb7021b8730c0ab438ff02350a0fdbadf687a0153c05e8e2cf619a418614cecbcc5df74b83019b5089f61e3eb32

Download Submit
C:\Windows\{58C2AA87-AF0A-4896-8387-382F35408FA8}.exe

Filesize
344KB

MD5
486671a6ffc2bce4d2050a6d34ab8771

SHA1
443ba298f5a1a6157be5c0bee0c85e1b18e22b45

SHA256
727f89d2e396943017a3172db990502242aa190268ed22b4d842b4cd08a6fe58

SHA512
8db3705c1705c906c8d5584ec09f2b508cb1a88d5c4fa74b0796ecd1e62050b954f375ba1bc7664c3b9cf53e947b8191822591bd9d7bbdb1e516a70f3301cd94

Download Submit
C:\Windows\{6FAE7A44-E12D-4c2e-B2F8-9EA481590F72}.exe

Filesize
344KB

MD5
5e795ea07f2621294d00bb1dd83c18b8

SHA1
3e1deb8381bff64d9267157ad4877f302275a9c6

SHA256
fd13c0b156562c8e4acf10442e7f8ede71233504c27d5077d69944ce78753fec

SHA512
e8b0ec53057a0406a4ca23224b02463830b211813d55357ce10cd68e93087f4095aff764bbe3a1e939850d881eea101dc436d0ddc91729dc105609c23e5e3b4b

Download Submit
C:\Windows\{7AA6EC20-0ED2-47c7-A78E-8532E08DD2E7}.exe

Filesize
344KB

MD5
1b9dd92f70336a29b9894cb0ae589322

SHA1
fd83f983e1526b6e0aeb0426623970ce22529f14

SHA256
8bbd8109f386daa6b7cde4eb479af1310900820f6a05dbd96b0e522ec156c1e6

SHA512
b2c3b5a227433c4b9082f8f5c29f2543d4e75f9642cb77c94274ff54fe1a3db8bacc4d15ceb2b99d8c774516b989ed0a2c50e05d375d34687b24ff0e650a56d4

Download Submit
C:\Windows\{8B9DD611-5CB1-4d1e-A874-6E25FABA5170}.exe

Filesize
344KB

MD5
4afbd3905b5c91960227f8fad29de3a5

SHA1
03cad8a132d3bace5f0ef5a8a6b00c155903384b

SHA256
a7c4c819ce9a21f4bf95d538031d95deb39169f9123c8c0623c5c7751945b803

SHA512
807ddb8a16942ec3ff562955d972d5699cf5c6bacaf4965d03f32730d3a516b6f94fa8f20875225cd8f982d788d91bca424d4d911fae9f7e6d6cfeac9be24db8

Download Submit
C:\Windows\{9E74D03B-FC65-476a-90E2-0395B4F5775D}.exe

Filesize
344KB

MD5
5542213877a0b321e2c024d525539ad0

SHA1
a7f718c21672323d8796633c731133b2fd07a2c7

SHA256
fe94623946b737220bb64c1b5a944f17fabbba1b341460008e0f71c121aac779

SHA512
46af290b6f72c54a9003679b882dc346f20c2586b5ca52b05126d97a92ba9a0f842c1e9ac6298f8601077fcd642a2f613aa03249e0bde55e5606cad35535e543

Download Submit
C:\Windows\{A52A0877-9C83-4112-987D-3D790C0EE872}.exe

Filesize
344KB

MD5
a6bb4be6c6c29913ca18d462928b9b1c

SHA1
301856400452372eb44e5bab59ddedb977eb013a

SHA256
b86539a479cda691ffc6884f7dc16a5848207e7399bf6d0b0415db0593860333

SHA512
2e2615fef10b1027ae175aba233783b8bca28a5f9130923507b510cb44538ae22d82f6a4b322b2862c2d8cfd45adc4000e9dcd09b409a18454dd78d6b082f2c6

Download Submit
C:\Windows\{AF7360A8-6E6D-4a58-9A0B-6CD03D056B36}.exe

Filesize
344KB

MD5
af6828701c06ea92048821e45d2a496f

SHA1
1f3d9676089535ede27fea70507953631c36fcff

SHA256
bd095addad02a1db9b680e2e1523790014f1ac1c40792e5e0ae69662fdb18d7c

SHA512
1ca8f84894bf794c17e09fb71f9957bd9760bf640aacd69d714e40ca3fadb478f7d084de2e3c7a836fee493e9ddf281ec878003c4af097e54b8d6e18a0a81bae

Download Submit
C:\Windows\{B418DC06-864D-49bc-A47B-84C1326F010D}.exe

Filesize
344KB

MD5
c1944e4f352c303a34d66a9a9bf5b60c

SHA1
58808e9a3481a7362c9d9ad9d126474db567bfae

SHA256
6313c6b29da046b4625ae03da3e7480e786c9d874675eb7ddb4c5878eca42409

SHA512
035d34c22dfa59951507d79196a02cb7bcae337e6a6149e61bc7c65b58926cf32f1717c9c45a5d628d45f693d303e02623dbce8c64d832fdf03c335a45ccc48b

Download Submit
C:\Windows\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe

Filesize
33KB

MD5
3bb4d0aff650f69f1179c9447388454c

SHA1
5ee94f039b8e338c41f9d6ed1016f23615c651be

SHA256
659274af196056ab5b37387967575cbc6c8c1b68d88b363584f6284b22ca0f21

SHA512
194d0bc5773da5be0e81dd22c881b826380cb00901b7c23570cf8a017496af6cbda2f7c52f3f4cf8b6ec770c79178c77e673a0dabce09e0213afed322821fab7

Download Submit
C:\Windows\{E800C65E-E28D-4bfd-BF89-BE7B7AA6119B}.exe

Filesize
344KB

MD5
93ccbba4c83c39cdd6ba520fbc55dd3c

SHA1
93889c9841fd0573c1cb363c5afe47a1937d4ece

SHA256
27a1d82f6b099c9c2664e06d0a258e50aaeeb2a2ae9c4b87bd4ae4ac0a1ce0c4

SHA512
10816d37a5e70e79cabd123cf31131270552b76402ee3104d1efdd03d0dc69a7e194921bd09eb27228333b526c24f020c263002902d8970f894c4320fb0dc615

Download Submit
C:\Windows\{E876B941-636A-4f21-9204-12EA3ED031F6}.exe

Filesize
299KB

MD5
bfcf9d589a590da10f6e2a7a76f21e02

SHA1
3da04f504d1e2637606ca5112d728f5bd3846ae3

SHA256
b41fa5803178f603d527d20291eb1681c48a326dcbbc94a14470e6a039c96130

SHA512
2db041174ab1aadee9b2e2d59ec94aa6b8397002908aeb738f4c58a4ddc73284ccd1551dabec8966da4ec8e8ff11441afe379f89c0e4fd7f967a34ad83201ea8

Download Submit
C:\Windows\{E876B941-636A-4f21-9204-12EA3ED031F6}.exe

Filesize
315KB

MD5
cac8c56b04d8e1d91e140cf495f49b3d

SHA1
d2febe040b84690c5af1c049cd11d2ffb956ac17

SHA256
dcf13b898cbf760d8a1b6eb5d329fab531a72583cc98a191f0e0ea37563574e8

SHA512
2a039433305c454cedea73a215a96d10c4070e92b5c72cff8c9f1e12700c09a999c17fc371f17399e8fb4e3dddcf693b2de132e05fc7154cf473f9239fcc2e3f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads