ab6b955488d9349bba3f8c7cf9add517a2202486a70ab61c2133b88809e266b5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe
Size 180KB
Sample240201-yxz18afgap
SHA256 ab6b955488d9349bba3f8c7cf9add517a2202486a70ab61c2133b88809e266b5
MD5 d2aa9982a9c7e2993bcca68dfd45f45c
SHA1 5020369618913d70c14c1a4b034db64cefd2d61f
SHA512 94bbc8797c7b4302023314c437cb02da7b15775a64965a61871c422740658f226dd44752ce6d1793bfb61ada673827d26557e55682357b8d43d4e1117034d5e1
SSDEEP 3072:jEGh0o9lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGTl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023230-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023235-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002323c-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023235-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000217f9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000021805-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000217f9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006e1-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}\stubpath = "C:\\Windows\\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe"	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}	{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}\stubpath = "C:\\Windows\\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe"	{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EBA99F5-C573-4199-BF3A-1C68D958F253}	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}\stubpath = "C:\\Windows\\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe"	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}\stubpath = "C:\\Windows\\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe"	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}\stubpath = "C:\\Windows\\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe"	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73417569-C0E4-47e3-AD14-DEA7F68D0435}	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}\stubpath = "C:\\Windows\\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe"	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}\stubpath = "C:\\Windows\\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe"	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}\stubpath = "C:\\Windows\\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe"	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73417569-C0E4-47e3-AD14-DEA7F68D0435}\stubpath = "C:\\Windows\\{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe"	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EBA99F5-C573-4199-BF3A-1C68D958F253}\stubpath = "C:\\Windows\\{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe"	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}\stubpath = "C:\\Windows\\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe"	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}\stubpath = "C:\\Windows\\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe"	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe

Executes dropped EXE 12 IoCs

pid	Process
3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
4416	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
3560	{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe
2944	{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe
File created	C:\Windows\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
File created	C:\Windows\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
File created	C:\Windows\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
File created	C:\Windows\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
File created	C:\Windows\{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
File created	C:\Windows\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
File created	C:\Windows\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
File created	C:\Windows\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
File created	C:\Windows\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
File created	C:\Windows\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
File created	C:\Windows\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe	{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
Token: SeIncBasePriorityPrivilege	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
Token: SeIncBasePriorityPrivilege	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
Token: SeIncBasePriorityPrivilege	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
Token: SeIncBasePriorityPrivilege	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
Token: SeIncBasePriorityPrivilege	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
Token: SeIncBasePriorityPrivilege	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
Token: SeIncBasePriorityPrivilege	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
Token: SeIncBasePriorityPrivilege	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
Token: SeIncBasePriorityPrivilege	4416	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
Token: SeIncBasePriorityPrivilege	3560	{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 3884	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe	91
PID 588 wrote to memory of 3884	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe	91
PID 588 wrote to memory of 3884	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe	91
PID 588 wrote to memory of 3864	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe	92
PID 588 wrote to memory of 3864	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe	92
PID 588 wrote to memory of 3864	588	2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe	92
PID 3884 wrote to memory of 4976	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	93
PID 3884 wrote to memory of 4976	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	93
PID 3884 wrote to memory of 4976	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	93
PID 3884 wrote to memory of 5044	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	94
PID 3884 wrote to memory of 5044	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	94
PID 3884 wrote to memory of 5044	3884	{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe	94
PID 4976 wrote to memory of 980	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	96
PID 4976 wrote to memory of 980	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	96
PID 4976 wrote to memory of 980	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	96
PID 4976 wrote to memory of 1812	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	97
PID 4976 wrote to memory of 1812	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	97
PID 4976 wrote to memory of 1812	4976	{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe	97
PID 980 wrote to memory of 2852	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	98
PID 980 wrote to memory of 2852	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	98
PID 980 wrote to memory of 2852	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	98
PID 980 wrote to memory of 3564	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	99
PID 980 wrote to memory of 3564	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	99
PID 980 wrote to memory of 3564	980	{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe	99
PID 2852 wrote to memory of 2360	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	100
PID 2852 wrote to memory of 2360	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	100
PID 2852 wrote to memory of 2360	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	100
PID 2852 wrote to memory of 2508	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	101
PID 2852 wrote to memory of 2508	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	101
PID 2852 wrote to memory of 2508	2852	{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe	101
PID 2360 wrote to memory of 3384	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	102
PID 2360 wrote to memory of 3384	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	102
PID 2360 wrote to memory of 3384	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	102
PID 2360 wrote to memory of 1636	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	103
PID 2360 wrote to memory of 1636	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	103
PID 2360 wrote to memory of 1636	2360	{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe	103
PID 3384 wrote to memory of 2860	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	104
PID 3384 wrote to memory of 2860	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	104
PID 3384 wrote to memory of 2860	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	104
PID 3384 wrote to memory of 3620	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	105
PID 3384 wrote to memory of 3620	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	105
PID 3384 wrote to memory of 3620	3384	{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe	105
PID 2860 wrote to memory of 2476	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	106
PID 2860 wrote to memory of 2476	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	106
PID 2860 wrote to memory of 2476	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	106
PID 2860 wrote to memory of 4700	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	107
PID 2860 wrote to memory of 4700	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	107
PID 2860 wrote to memory of 4700	2860	{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe	107
PID 2476 wrote to memory of 3308	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	109
PID 2476 wrote to memory of 3308	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	109
PID 2476 wrote to memory of 3308	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	109
PID 2476 wrote to memory of 1424	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	108
PID 2476 wrote to memory of 1424	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	108
PID 2476 wrote to memory of 1424	2476	{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe	108
PID 3308 wrote to memory of 4416	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	110
PID 3308 wrote to memory of 4416	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	110
PID 3308 wrote to memory of 4416	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	110
PID 3308 wrote to memory of 1368	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	111
PID 3308 wrote to memory of 1368	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	111
PID 3308 wrote to memory of 1368	3308	{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe	111
PID 4416 wrote to memory of 3560	4416	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe	112
PID 4416 wrote to memory of 3560	4416	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe	112
PID 4416 wrote to memory of 3560	4416	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe	112
PID 4416 wrote to memory of 2136	4416	{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_d2aa9982a9c7e2993bcca68dfd45f45c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
  C:\Windows\{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
    C:\Windows\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
      C:\Windows\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Windows\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
        
        C:\Windows\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Windows\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
        
        C:\Windows\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
        
        C:\Windows\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
        
        C:\Windows\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
        
        C:\Windows\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7402C~1.EXE > nul
        10⤵
        
        PID:1424
        
        C:\Windows\{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
        
        C:\Windows\{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
        
        C:\Windows\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe
        
        C:\Windows\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe
        
        C:\Windows\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe
        13⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{09CE9~1.EXE > nul
        13⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B06E~1.EXE > nul
        12⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{73417~1.EXE > nul
        11⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1E2B7~1.EXE > nul
        9⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3E49D~1.EXE > nul
        8⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8D02~1.EXE > nul
        7⤵
        
        PID:1636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98CC1~1.EXE > nul
        6⤵
        
        PID:2508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E3113~1.EXE > nul
        5⤵
        
        PID:3564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2849C~1.EXE > nul
      4⤵
      PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1EBA9~1.EXE > nul
    3⤵
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe

Path C:\Windows\{09CE90DF-98E2-42b9-A367-CCF83B3F1406}.exe
Size 180KB
SHA256 7d321e41d1d16d0710dfa67c01f29dbab9605570f0fdcc849faf3ab7f23403c3
MD5 1f803b9f3f9f3034fe80e87cbc2ae2d5
SHA1 fe605d150f349fcb9ec5c80d93838cb77ab42a8d
SHA512 28f6eceb183be42cb7a602c705379ea62fc4a34ecc7081e2b8b21296e0b99ff705a6376f26b3b83e24f5aaaca7e532f2350f732afe9bcccf2c37ea93dd416501
SSDEEP 3072:jEGh0oDlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGZl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe

Path C:\Windows\{1E2B76CA-3D72-46d1-AFD6-D2EFF549F4F9}.exe
Size 180KB
SHA256 3b742cd499f8278948a3d4ced3c7b56ee32ad80ed932d98d0d49906f3e07e31b
MD5 80c060819c6a7fa44c4e227e27d39ebb
SHA1 1d88c25aa84df374bb634962628070696450bc40
SHA512 4d3b2f52df814354d249c573851ac07e48f2f0805816b28d44ac5d59e46026e3e62456f83df2a0ee23d730d8ae2c5229c214cc5cba034996ce92e91b42093c8b
SSDEEP 3072:jEGh0onlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe

Path C:\Windows\{1EBA99F5-C573-4199-BF3A-1C68D958F253}.exe
Size 180KB
SHA256 b4b2366bd987c2fe62e8aee401ec287bf52cec57afe7108f65becaa1c0f60506
MD5 0f1bee8bdd79bd89187334049840d540
SHA1 21f9686efd474b4030de35e7951cbef059083f15
SHA512 0b4b2218f787d53f9ba4cab738537ffb98f320e9b6a98d7d6e361acf0d71e7867e796538e7724790c8231b2b7a4eceef78375fdcd0d557f41520bc0dc18d3e2b
SSDEEP 3072:jEGh0o/lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGhl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe

Path C:\Windows\{2588CA7B-20F2-4fce-868D-0FD606A0F4D6}.exe
Size 180KB
SHA256 59ffea9e528d59e55f67b32baebfc814335f8fe4778012f4226a88595ebebc6b
MD5 f302299250db5409b1bcb2a372d5440e
SHA1 b8248e79f8d8c55b8ccefb2642263bd1a8b71254
SHA512 b60fe46195ea0b7dd92bfe851e71e01bfa6068a3ec0261377f9f3c29a4e47712412241c690e6eae8702b647e1e59bacc0228f621b8aca6188ac82838d7b02343
SSDEEP 3072:jEGh0ohlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGzl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe

Path C:\Windows\{2849CA3A-3DE9-405d-A542-D155EDE2AE81}.exe
Size 180KB
SHA256 1f1724ef9ed6f21229de13a17d772f41b1fde3528ecee90d5bf7ea857f2bbae7
MD5 1da546b07910776c93a985d0f6e4462b
SHA1 a2c51f6cc08b436725a2b1a70eb8d44f6d820dfa
SHA512 341c37f277b0ddc27cc7f621157d89fad7c86e7c922a152163934a30fbaaae83fae92c49da9ff8166f4cf5613ff4011dc37c266fd2f221ed2be9cf1a9ed1a963
SSDEEP 3072:jEGh0odlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGzl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe

Path C:\Windows\{3E49D558-7526-4c3d-AEEB-6A731E7F0754}.exe
Size 180KB
SHA256 d1757c9bab5c67a7a49a7bd96cf7bd47aefd3fe34da6a81e00fbaff61e27e9c6
MD5 ff05d1744db8360f98327fb0d404ea36
SHA1 0731be84314c0cc1915572da4b091dba6d24556b
SHA512 eb75870455280286d5e8b85dd602e04e8fa6ada72d36124057c27634307c2a755d89bfa9f2eddef19e1599aed0ba4ae41267f627e9013a46a6f7d25b53e7f52b
SSDEEP 3072:jEGh0o6lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGUl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe

Path C:\Windows\{73417569-C0E4-47e3-AD14-DEA7F68D0435}.exe
Size 180KB
SHA256 93dfe0ea5e724165d46dd965267f094f34d014e6fdfcb20fc052985dc8bfa277
MD5 41a6a93fc08be05676089ab18e308ea7
SHA1 226ac35faf68ba0e7771bca0aa6be01c9c9d4b81
SHA512 7ca731012c90419ffb81e14e8b066cad01ccc74add28f0be40f9b64cc67a9e399de5cc6c7ac9bf52a04f16b8c2ceccb0dff2e57a51f4aa3e312abbe5633d56c5
SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGAl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe

Path C:\Windows\{7402CD93-C1C2-4120-9E3D-5A1CF925B10C}.exe
Size 180KB
SHA256 70afa77b7f667a66f29c4a05cbbd884436430a87dd583ec90db4abe26f3c86d3
MD5 4e7465fd18c61e159d839ccab5b8044a
SHA1 a171a361a398096cc62d2887a731040cde9ded2f
SHA512 45650ac5067ace4ee7b792de2804e0f4ecde50f6c7762410e449c09000d2746ecad2e221db4b74d9cd631d8bf94d347e6fd510a67ca8b87af28475319e8854b0
SSDEEP 3072:jEGh0oVlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGbl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe

Path C:\Windows\{98CC15FC-A143-4ac6-9A49-94C4C171EF22}.exe
Size 180KB
SHA256 105ff2d4a960330321c335e5269132b69ae08623b0b89505c98be7d0fae49b27
MD5 38f81c77acacc9a2fbdaf493669132c6
SHA1 98533122eee8dae1f0be405e261ba449b941279c
SHA512 63fe2aec7b4b1a50b2193b4bf45b911bf1e8c191dd85d8c6af09c22bfd3993dd6ac4d9d6572e08cea6251c25519d041c6f974ce3f6de1b2e4d14e9a604736a2d
SSDEEP 3072:jEGh0oblfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGVl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe

Path C:\Windows\{9B06E548-0F33-437d-A74C-94AB7B4B4E9E}.exe
Size 180KB
SHA256 69cdd3ad34b7ca859b4b8ca29ede9cf212ada0d2db69e34c3cbc661ecd46616f
MD5 8014ed334f43f258725cbba05840c000
SHA1 674875f6dd859efb97d2a672be5bf150d4df25b6
SHA512 ff9792159b58adc7d6a8a9984819be81fbca035d6fbb11e0450331a8414735af131bede7a82a72ea76c3cb9d0c8956b711250e87c962fbdc829402b01824f774
SSDEEP 3072:jEGh0oglfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe

Path C:\Windows\{E3113AEB-CDE0-4180-8D56-6AE3CE2B15DD}.exe
Size 180KB
SHA256 5160146fcb576a4ab8a0722e7c0fc2055832d85b9320e51869077d31395ead64
MD5 09ac20b534de7724afeb92e43de5d927
SHA1 1a2145a5317a383ad3f39caaa03446cc09a40ed0
SHA512 20a4e1787839f582699ab52f857a05ef9c4a8cbfc32619a9c9b492b8d93c70ef690d103f9d337acdf2d2b081affb7d5d011b431a94500a0cd0c0c9cfbf6e7f28
SSDEEP 3072:jEGh0oolfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGel5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe

Path C:\Windows\{F8D02DAA-8927-4d3a-B940-8D1DEB449A5F}.exe
Size 180KB
SHA256 66e9228d011c5a263039b18a3302aa1a14eb7bf650f5fe666a67aa164d0b7387
MD5 869a0264513e72138da95831393516ff
SHA1 9ce3227071d45ff92e0fa10c3ea62abb90f1d67f
SHA512 da02b6353befebe1d064f4aa15e28717c6b62f106899e081f23f5bbd89d9fb895385c80084edf31f5fe9eb02b1087a7153d03c3ac07fd9e132942fb67aa7e78c
SSDEEP 3072:jEGh0oYlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGul5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads