ccfc924e49c1c1ec37335861308b0613149f962a781b5c09349ed103b89f83e1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Size

197KB
MD5

d6bca638be27d6006bb3b2558e8a729a
SHA1

488da09abdcd0f5c389629aa18d69cb612906395
SHA256

ccfc924e49c1c1ec37335861308b0613149f962a781b5c09349ed103b89f83e1
SHA512

080d6e481f0f36ed898e6af5c33196b86d9e7c4eab8000425794f0229413c333d7f28656de1466d49fb30b6d5401803689779d5f75d907e109c8c21e87691305
SSDEEP

3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGtlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 17 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023218-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e75f-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023226-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023226-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023226-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001e75f-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001e75f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e70-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021e70-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000001e75f-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021e70-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{284F07A1-2165-4eae-AD04-9620714561F5}	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}\stubpath = "C:\\Windows\\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe"	{284F07A1-2165-4eae-AD04-9620714561F5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1209A776-4196-4983-BDB2-9FF00A17D348}\stubpath = "C:\\Windows\\{1209A776-4196-4983-BDB2-9FF00A17D348}.exe"	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23B8E389-594D-46c6-A053-15153AEE4F64}\stubpath = "C:\\Windows\\{23B8E389-594D-46c6-A053-15153AEE4F64}.exe"	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1616A13-3A19-44dd-86BC-72C27C7CF672}\stubpath = "C:\\Windows\\{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe"	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0BB2B74-CD94-477a-BB9C-80F19F745963}\stubpath = "C:\\Windows\\{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe"	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}\stubpath = "C:\\Windows\\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe"	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{284F07A1-2165-4eae-AD04-9620714561F5}\stubpath = "C:\\Windows\\{284F07A1-2165-4eae-AD04-9620714561F5}.exe"	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}\stubpath = "C:\\Windows\\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe"	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23B8E389-594D-46c6-A053-15153AEE4F64}	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}\stubpath = "C:\\Windows\\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe"	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37F1EA66-7288-4933-BB6B-6EFE487D063F}\stubpath = "C:\\Windows\\{37F1EA66-7288-4933-BB6B-6EFE487D063F}.exe"	{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37F1EA66-7288-4933-BB6B-6EFE487D063F}	{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}	{284F07A1-2165-4eae-AD04-9620714561F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1616A13-3A19-44dd-86BC-72C27C7CF672}	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0BB2B74-CD94-477a-BB9C-80F19F745963}	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}\stubpath = "C:\\Windows\\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe"	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1209A776-4196-4983-BDB2-9FF00A17D348}	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}\stubpath = "C:\\Windows\\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe"	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe

Executes dropped EXE 12 IoCs

pid	Process
5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe
4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe
2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
8	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
1144	{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe
3276	{37F1EA66-7288-4933-BB6B-6EFE487D063F}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
File created	C:\Windows\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	{284F07A1-2165-4eae-AD04-9620714561F5}.exe
File created	C:\Windows\{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
File created	C:\Windows\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe
File created	C:\Windows\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
File created	C:\Windows\{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
File created	C:\Windows\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
File created	C:\Windows\{1209A776-4196-4983-BDB2-9FF00A17D348}.exe	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
File created	C:\Windows\{284F07A1-2165-4eae-AD04-9620714561F5}.exe	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
File created	C:\Windows\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
File created	C:\Windows\{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
File created	C:\Windows\{37F1EA66-7288-4933-BB6B-6EFE487D063F}.exe	{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe
Token: SeIncBasePriorityPrivilege	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
Token: SeIncBasePriorityPrivilege	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
Token: SeIncBasePriorityPrivilege	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe
Token: SeIncBasePriorityPrivilege	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
Token: SeIncBasePriorityPrivilege	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
Token: SeIncBasePriorityPrivilege	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
Token: SeIncBasePriorityPrivilege	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
Token: SeIncBasePriorityPrivilege	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
Token: SeIncBasePriorityPrivilege	8	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
Token: SeIncBasePriorityPrivilege	1144	{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 5008	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	93
PID 1640 wrote to memory of 5008	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	93
PID 1640 wrote to memory of 5008	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	93
PID 1640 wrote to memory of 3352	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	92
PID 1640 wrote to memory of 3352	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	92
PID 1640 wrote to memory of 3352	1640	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	92
PID 5008 wrote to memory of 4644	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe	95
PID 5008 wrote to memory of 4644	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe	95
PID 5008 wrote to memory of 4644	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe	95
PID 5008 wrote to memory of 1532	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe	94
PID 5008 wrote to memory of 1532	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe	94
PID 5008 wrote to memory of 1532	5008	{284F07A1-2165-4eae-AD04-9620714561F5}.exe	94
PID 4644 wrote to memory of 636	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	98
PID 4644 wrote to memory of 636	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	98
PID 4644 wrote to memory of 636	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	98
PID 4644 wrote to memory of 1960	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	97
PID 4644 wrote to memory of 1960	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	97
PID 4644 wrote to memory of 1960	4644	{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe	97
PID 636 wrote to memory of 2276	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	100
PID 636 wrote to memory of 2276	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	100
PID 636 wrote to memory of 2276	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	100
PID 636 wrote to memory of 2496	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	99
PID 636 wrote to memory of 2496	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	99
PID 636 wrote to memory of 2496	636	{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe	99
PID 2276 wrote to memory of 2576	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	102
PID 2276 wrote to memory of 2576	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	102
PID 2276 wrote to memory of 2576	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	102
PID 2276 wrote to memory of 732	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	101
PID 2276 wrote to memory of 732	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	101
PID 2276 wrote to memory of 732	2276	{23B8E389-594D-46c6-A053-15153AEE4F64}.exe	101
PID 2576 wrote to memory of 4572	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	103
PID 2576 wrote to memory of 4572	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	103
PID 2576 wrote to memory of 4572	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	103
PID 2576 wrote to memory of 3984	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	104
PID 2576 wrote to memory of 3984	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	104
PID 2576 wrote to memory of 3984	2576	{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe	104
PID 4572 wrote to memory of 4812	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	105
PID 4572 wrote to memory of 4812	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	105
PID 4572 wrote to memory of 4812	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	105
PID 4572 wrote to memory of 1480	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	106
PID 4572 wrote to memory of 1480	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	106
PID 4572 wrote to memory of 1480	4572	{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe	106
PID 4812 wrote to memory of 4308	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	108
PID 4812 wrote to memory of 4308	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	108
PID 4812 wrote to memory of 4308	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	108
PID 4812 wrote to memory of 2064	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	107
PID 4812 wrote to memory of 2064	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	107
PID 4812 wrote to memory of 2064	4812	{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe	107
PID 4308 wrote to memory of 2172	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	110
PID 4308 wrote to memory of 2172	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	110
PID 4308 wrote to memory of 2172	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	110
PID 4308 wrote to memory of 1420	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	109
PID 4308 wrote to memory of 1420	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	109
PID 4308 wrote to memory of 1420	4308	{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe	109
PID 2172 wrote to memory of 8	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	111
PID 2172 wrote to memory of 8	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	111
PID 2172 wrote to memory of 8	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	111
PID 2172 wrote to memory of 224	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	112
PID 2172 wrote to memory of 224	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	112
PID 2172 wrote to memory of 224	2172	{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe	112
PID 8 wrote to memory of 1144	8	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe	113
PID 8 wrote to memory of 1144	8	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe	113
PID 8 wrote to memory of 1144	8	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe	113
PID 8 wrote to memory of 1640	8	{1209A776-4196-4983-BDB2-9FF00A17D348}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3352
- C:\Windows\{284F07A1-2165-4eae-AD04-9620714561F5}.exe
  C:\Windows\{284F07A1-2165-4eae-AD04-9620714561F5}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{284F0~1.EXE > nul
    3⤵
    PID:1532
- - C:\Windows\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
    C:\Windows\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BE7F1~1.EXE > nul
      4⤵
      PID:1960
  - - C:\Windows\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
      C:\Windows\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2E3AF~1.EXE > nul
        5⤵
        
        PID:2496
    - - C:\Windows\{23B8E389-594D-46c6-A053-15153AEE4F64}.exe
        
        C:\Windows\{23B8E389-594D-46c6-A053-15153AEE4F64}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2276
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{23B8E~1.EXE > nul
        6⤵
        
        PID:732
      - C:\Windows\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
        
        C:\Windows\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
        
        C:\Windows\{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
        
        C:\Windows\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EBA55~1.EXE > nul
        9⤵
        
        PID:2064
        
        C:\Windows\{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
        
        C:\Windows\{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D0BB2~1.EXE > nul
        10⤵
        
        PID:1420
        
        C:\Windows\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
        
        C:\Windows\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
        
        C:\Windows\{1209A776-4196-4983-BDB2-9FF00A17D348}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe
        
        C:\Windows\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
        
        C:\Windows\{37F1EA66-7288-4933-BB6B-6EFE487D063F}.exe
        
        C:\Windows\{37F1EA66-7288-4933-BB6B-6EFE487D063F}.exe
        13⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8BD1~1.EXE > nul
        13⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1209A~1.EXE > nul
        12⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A934~1.EXE > nul
        11⤵
        
        PID:224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1616~1.EXE > nul
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B2FDF~1.EXE > nul
        7⤵
        
        PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1209A776-4196-4983-BDB2-9FF00A17D348}.exe

Filesize
197KB

MD5
f440e40726f1228016900fe074c871d9

SHA1
c5fc5ea83cc59b26c98d33f70a6429bb550c9181

SHA256
d8a6c63233b356f9feabe0bf9cc316140329cff4d4826c15ce95ecfb8f49fc45

SHA512
dd66a074805165ffd1bca2ac4d689ea3d44bea9a34b748a127848f4028ac569b61d1e699e5b993fcd7a6779145dba2340a9f064b080dcbe0d5aaccd96cc09e51

Download Submit
C:\Windows\{23B8E389-594D-46c6-A053-15153AEE4F64}.exe

Filesize
155KB

MD5
6463bdd97d10944dbbec83dde5c56493

SHA1
c9a6e1bed8a8c513dc5a32942148ebcd9a718a25

SHA256
66623f59830fecdb5f56f40928fae5c461d73aace6d3fe99758caa76426191a4

SHA512
e3ad37f7781c21215b340ccd858c4ba02f7bf1d32b7a7f14202077c44a9d70422c9dba7ecf7ed8de01aa40bc9e2bd3a7c01bf70f7d8f317044c8941383ddd40c

Download Submit
C:\Windows\{23B8E389-594D-46c6-A053-15153AEE4F64}.exe

Filesize
132KB

MD5
a125e13a33a5c20d23444bcaff851df3

SHA1
8bcf5bf5db6252ec0820485c3a706a85778bc820

SHA256
c0f09725394c33235c1f40b57dc1a7d64a44198dc89b8c09f725a9788f6250bd

SHA512
d3fb002df2b9a962e333612e1015d482a1e109ab64cf1d1205934102b3c27092d7bc92675e30ab8138abcb2e7bec288416d9dffc44acdfe8e69d884f60f7ddde

Download Submit
C:\Windows\{284F07A1-2165-4eae-AD04-9620714561F5}.exe

Filesize
197KB

MD5
26780e5866bd41fc81369f3b79f43934

SHA1
19fe17503ce773e1a89b10a40384e6829906fc85

SHA256
8316d6d8179a1dafd2e839f65ca829dc8608d14e3ed22cc38accdd4a1473d9e3

SHA512
0b032066d547b3b6ab9d59da4eba347b3ce146bf3d66ccc95b246d61a0b0fca7beb22e32e268f901977268755aab90013ec6634884240fef332df9e345c88627

Download Submit
C:\Windows\{2A9347FB-B0A6-44ef-B953-EFE12F70AE31}.exe

Filesize
197KB

MD5
ab85f11a2b2f63de78ae593425d002e3

SHA1
40d79c035cc63fc52559d934b6f881db9d672476

SHA256
a4c73f076d684ff30ff0f9e906c09264b918d24e200743a044091dfb73b9a73f

SHA512
7c24474107946e024a6d5a38962d2e5f93361bbd8cb42101aeba8ea4d673598862b610f3a3e686a3eb88a2698de747cc84fa2153d164ba6a5c2e8f973f886783

Download Submit
C:\Windows\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe

Filesize
62KB

MD5
23aa26b84f7068be0346f1225db19edf

SHA1
1e91b17ec58c6386d7b5af5e656a3c9a20980e57

SHA256
fff106ea69057360986afd70e61c55f170412c9cb9e487a01ff2a0b8efbf0e2f

SHA512
efeb3239e0781707e2d2b33c3e270530609c23100ef237181c1f7fb5a73e98f1bcc1fb662d8061edfc49378091dbaebffdd5ba2bd767b1a0198527819d8bb166

Download Submit
C:\Windows\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe

Filesize
1KB

MD5
4bc0c8a9188ba80b6b1d123f1538b01c

SHA1
f970f1d1eb981593f5dce6c92a843c45a5c93db2

SHA256
8d808b2a37d78acca7fb3cf18ce2a6c378433f6f09a1700955074eec9d0673ec

SHA512
c9ee2ff3915c0df23c16a774bcd2e4a8584e4d938b10e998e95e7095975d88c825c7d1d681916823e64f9076d739769afadff629f6aa608e4e14a41b9d5b5bd4

Download Submit
C:\Windows\{2E3AFD84-0F88-40c3-A079-12C840C7E3C8}.exe

Filesize
41KB

MD5
047f2a1e78f252b4bae0be1bbf9159e3

SHA1
e7778f889c875024aa4c795f41cb8c04d8bf9364

SHA256
02526af39cd467ca86f0817833187df3e844130f2a208b5b60df84257f01ef81

SHA512
12b213218e1dca08e13367604753d7f9a25d5247750dcc312245d0e87d76b66e0c1d0e0e4fe100ec9bf0f628027b5b1592679f45a597f711b159afc2d668e61e

Download Submit
C:\Windows\{37F1EA66-7288-4933-BB6B-6EFE487D063F}.exe

Filesize
197KB

MD5
9bd0e14da1c138e26d60db6ff8e39204

SHA1
a1cd711afc4da33ab703232ecbd70bf360787b86

SHA256
1173b0208c03290f64f2a1da5be7832d7a55057ec8594309893dbd59ed75fcb4

SHA512
1bb8ad057728c7e247404853c3d0592505aa09e63804fbc3e8be0b36b7879f6f669964a5ce0f6bebdd081c322298b7bc30f6078e551fde64b686c58945d6b056

Download Submit
C:\Windows\{B1616A13-3A19-44dd-86BC-72C27C7CF672}.exe

Filesize
197KB

MD5
d44c167bff5bd9c83accd88aa8248ba5

SHA1
f69ca059a1ccf89b7486606a9e359710d92d1858

SHA256
f9031f5a439e494a891c405a74b29f2a49e113c34ba75d71f67a701331e7ac60

SHA512
cd288e0ea0edb892a963c8e15a03048349dc7d5c6c819a49d55abbd76d62dfec6949a70f58a994d71f633e624822f982eae6746c77b3a8d087f9b8aa74448eb3

Download Submit
C:\Windows\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe

Filesize
197KB

MD5
f23ebb3747711d24cab6c99f9b485440

SHA1
43b44276f9ced3c970a1195b1ead9fc3973b756b

SHA256
27d4611220567aeb06164cb337bac3c590d0b9dd040c2deb1257ec9b84322213

SHA512
aee170ee7b5024e666663da7bffae744fd5b9fe9eab02f80ef244a00f99964352c4eb21ffac7da9359fea374308fd1bc203c46b384f3643be12566c899a9ec25

Download Submit
C:\Windows\{B2FDF832-5597-4291-86C2-4D65FA8FC2A7}.exe

Filesize
24KB

MD5
511a68197d5eb1704189055b49154847

SHA1
9d0c5e9878c765282510491c20de237506ac4d9a

SHA256
91525ce1b9c80dcabb6c39c9b4339e8bf4270f7cbf676208252f56e983460284

SHA512
fa485c3d7b07d54fb3f518c33a97cc1197539faddae59885c5a71a6418322c21106f5df1db348d11e2ad0a88424080dc244114644a683ce3daa763b63bc93867

Download Submit
C:\Windows\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe

Filesize
197KB

MD5
42f51482a80203ce87a4bb0c9c3725a5

SHA1
f2f191033d539b2a761dd1f663133b09669c49bd

SHA256
46f5cd683075c5abb232e6b05fbad69bcb6171b39b0492e9d0b04e4c822d3a4c

SHA512
05593f73cf88cc76519383505e1ef63d75232bca590d83ec2f130c3669012d99589a73fa8e830e6b7b0a5dc949a6393bb11474e4479f376af95167caae4ddf3e

Download Submit
C:\Windows\{B8BD19B3-BCAF-47db-B7D9-8EE3559A439F}.exe

Filesize
190KB

MD5
83b6bc6967b7096491ec28b3195014bb

SHA1
8c0d1c52037156a3c7adf7b79432203503037860

SHA256
801632fb2f42b6198a98b7a8eebeed112dfc39a7b766a44144de3ff33ab925f5

SHA512
1c66c0606a995b254876e007736ce203cc82dd982678c13a1e9ec744bf9ee765fc4f5458f83e8d7b38a3cbc676b59711a6435a5229147c5b523e72f8190882aa

Download Submit
C:\Windows\{BE7F113F-72CB-4f58-A4EF-D903A55BDD0B}.exe

Filesize
197KB

MD5
aa0a341b276e3635caedae885ef9dbef

SHA1
862200df1047be92654df836b9bb61e5cfcf8faf

SHA256
88bc639e5381b817c4f810f6937bb7a77ee552fb4b24da1abcb7efa4f03ec2f9

SHA512
9d947988dc5685898af91e853bfacf4313f6cc6c75a5e9b83247df417d4b336b78f6a398e733cc86a542c6cd736af1dceadc92002dfb551a3b24bf3341906e93

Download Submit
C:\Windows\{D0BB2B74-CD94-477a-BB9C-80F19F745963}.exe

Filesize
197KB

MD5
80166a9b6ed2b17d61e0843c858f5f3b

SHA1
dd4b21453c2013b39bca8ec2af63c91f9843cd65

SHA256
1ea979fbc9530afdd5b530a24aeb75f79b942b18b2e33b52bf96f70ce4301ff8

SHA512
8846521985e3c77f282b6abcfe7f44d7a0244adafde4c645064a927e515953b2bb31791421c8a065cd725c83e772ec93bed28ebc5a48f6593dd4c4e92d4f3a09

Download Submit
C:\Windows\{EBA55B8C-45DA-4839-9FD6-88D932CF9186}.exe

Filesize
197KB

MD5
e72500d82b4958b5f03b19fba803ca95

SHA1
62e970904b3dedb3a4405373bca9bcc737e14b36

SHA256
84c51e17a1976afed8df4d553adcbd351e822b25453007f973dc6523ee0039ae

SHA512
76ed33388115a8cbbfa926b491c47de9f35ff174a1e5bcd97701a595aa1d35a5a800ffc4a6dc8eb072be2b9dfe5b98159d86b87592d90fb7b126fb389dc32037

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads