8e9b9843db40b8a14ff257be3e03daedc0683d3cf78578a7414f11a0c8f9faf4

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe
Size

168KB
MD5

a0ed88629cdf2f6b9e422a4762d7d3a2
SHA1

a58825ef820cd9c0c1ffdd52a6cbfe86a8fa4195
SHA256

8e9b9843db40b8a14ff257be3e03daedc0683d3cf78578a7414f11a0c8f9faf4
SHA512

9b1e014257ae28444a843588a6f5f78b16e15cd4e6bb1a4da02fa1fd08952fa74c44ddfc2b310b5d9a0305e4b4a0cd49fa0d33b48c619fcc7d44731d92f56d78
SSDEEP

1536:1EGh0oUClq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o/lqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023154-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023162-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023169-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023162-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x004600000001e0be-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000021550-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x004700000001e0be-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000000070b-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}\stubpath = "C:\\Windows\\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe"	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A574FA16-4F37-4101-BFBD-67470BB4C26B}\stubpath = "C:\\Windows\\{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe"	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}	{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}\stubpath = "C:\\Windows\\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe"	{4452C26A-B421-4053-9315-7A16E334AB65}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}\stubpath = "C:\\Windows\\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe"	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}\stubpath = "C:\\Windows\\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}.exe"	{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A574FA16-4F37-4101-BFBD-67470BB4C26B}	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE36A15-F127-4e72-977E-B6743744A584}\stubpath = "C:\\Windows\\{1EE36A15-F127-4e72-977E-B6743744A584}.exe"	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}	{4452C26A-B421-4053-9315-7A16E334AB65}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4452C26A-B421-4053-9315-7A16E334AB65}	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}\stubpath = "C:\\Windows\\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe"	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}	{1EE36A15-F127-4e72-977E-B6743744A584}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}\stubpath = "C:\\Windows\\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe"	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}\stubpath = "C:\\Windows\\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe"	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE36A15-F127-4e72-977E-B6743744A584}	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}\stubpath = "C:\\Windows\\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe"	{1EE36A15-F127-4e72-977E-B6743744A584}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4452C26A-B421-4053-9315-7A16E334AB65}\stubpath = "C:\\Windows\\{4452C26A-B421-4053-9315-7A16E334AB65}.exe"	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}\stubpath = "C:\\Windows\\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe"	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe

Executes dropped EXE 12 IoCs

pid	Process
1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe
4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe
2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe
4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe
3968	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
4104	{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe
1456	{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe
File created	C:\Windows\{1EE36A15-F127-4e72-977E-B6743744A584}.exe	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
File created	C:\Windows\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	{4452C26A-B421-4053-9315-7A16E334AB65}.exe
File created	C:\Windows\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
File created	C:\Windows\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}.exe	{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe
File created	C:\Windows\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe
File created	C:\Windows\{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
File created	C:\Windows\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
File created	C:\Windows\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
File created	C:\Windows\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	{1EE36A15-F127-4e72-977E-B6743744A584}.exe
File created	C:\Windows\{4452C26A-B421-4053-9315-7A16E334AB65}.exe	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
File created	C:\Windows\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe
Token: SeIncBasePriorityPrivilege	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
Token: SeIncBasePriorityPrivilege	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
Token: SeIncBasePriorityPrivilege	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
Token: SeIncBasePriorityPrivilege	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
Token: SeIncBasePriorityPrivilege	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe
Token: SeIncBasePriorityPrivilege	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
Token: SeIncBasePriorityPrivilege	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe
Token: SeIncBasePriorityPrivilege	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe
Token: SeIncBasePriorityPrivilege	3968	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
Token: SeIncBasePriorityPrivilege	4104	{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1872	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe	89
PID 1184 wrote to memory of 1872	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe	89
PID 1184 wrote to memory of 1872	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe	89
PID 1184 wrote to memory of 3172	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe	90
PID 1184 wrote to memory of 3172	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe	90
PID 1184 wrote to memory of 3172	1184	2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe	90
PID 1872 wrote to memory of 4340	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	93
PID 1872 wrote to memory of 4340	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	93
PID 1872 wrote to memory of 4340	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	93
PID 1872 wrote to memory of 4804	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	94
PID 1872 wrote to memory of 4804	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	94
PID 1872 wrote to memory of 4804	1872	{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe	94
PID 4340 wrote to memory of 2120	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	97
PID 4340 wrote to memory of 2120	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	97
PID 4340 wrote to memory of 2120	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	97
PID 4340 wrote to memory of 1708	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	96
PID 4340 wrote to memory of 1708	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	96
PID 4340 wrote to memory of 1708	4340	{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe	96
PID 2120 wrote to memory of 3276	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	98
PID 2120 wrote to memory of 3276	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	98
PID 2120 wrote to memory of 3276	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	98
PID 2120 wrote to memory of 868	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	99
PID 2120 wrote to memory of 868	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	99
PID 2120 wrote to memory of 868	2120	{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe	99
PID 3276 wrote to memory of 4356	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	100
PID 3276 wrote to memory of 4356	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	100
PID 3276 wrote to memory of 4356	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	100
PID 3276 wrote to memory of 5064	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	101
PID 3276 wrote to memory of 5064	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	101
PID 3276 wrote to memory of 5064	3276	{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe	101
PID 4356 wrote to memory of 3556	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	102
PID 4356 wrote to memory of 3556	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	102
PID 4356 wrote to memory of 3556	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	102
PID 4356 wrote to memory of 1596	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	103
PID 4356 wrote to memory of 1596	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	103
PID 4356 wrote to memory of 1596	4356	{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe	103
PID 3556 wrote to memory of 2004	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe	105
PID 3556 wrote to memory of 2004	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe	105
PID 3556 wrote to memory of 2004	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe	105
PID 3556 wrote to memory of 4120	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe	104
PID 3556 wrote to memory of 4120	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe	104
PID 3556 wrote to memory of 4120	3556	{1EE36A15-F127-4e72-977E-B6743744A584}.exe	104
PID 2004 wrote to memory of 372	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	106
PID 2004 wrote to memory of 372	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	106
PID 2004 wrote to memory of 372	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	106
PID 2004 wrote to memory of 4556	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	107
PID 2004 wrote to memory of 4556	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	107
PID 2004 wrote to memory of 4556	2004	{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe	107
PID 372 wrote to memory of 4392	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe	108
PID 372 wrote to memory of 4392	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe	108
PID 372 wrote to memory of 4392	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe	108
PID 372 wrote to memory of 5008	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe	109
PID 372 wrote to memory of 5008	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe	109
PID 372 wrote to memory of 5008	372	{4452C26A-B421-4053-9315-7A16E334AB65}.exe	109
PID 4392 wrote to memory of 3968	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	110
PID 4392 wrote to memory of 3968	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	110
PID 4392 wrote to memory of 3968	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	110
PID 4392 wrote to memory of 376	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	111
PID 4392 wrote to memory of 376	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	111
PID 4392 wrote to memory of 376	4392	{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe	111
PID 3968 wrote to memory of 4104	3968	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe	112
PID 3968 wrote to memory of 4104	3968	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe	112
PID 3968 wrote to memory of 4104	3968	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe	112
PID 3968 wrote to memory of 2676	3968	{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_a0ed88629cdf2f6b9e422a4762d7d3a2_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe
  C:\Windows\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
    C:\Windows\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D21E1~1.EXE > nul
      4⤵
      PID:1708
  - - C:\Windows\{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
      C:\Windows\{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
        
        C:\Windows\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3276
      - C:\Windows\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
        
        C:\Windows\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\{1EE36A15-F127-4e72-977E-B6743744A584}.exe
        
        C:\Windows\{1EE36A15-F127-4e72-977E-B6743744A584}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1EE36~1.EXE > nul
        8⤵
        
        PID:4120
        
        C:\Windows\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
        
        C:\Windows\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\{4452C26A-B421-4053-9315-7A16E334AB65}.exe
        
        C:\Windows\{4452C26A-B421-4053-9315-7A16E334AB65}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe
        
        C:\Windows\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
        
        C:\Windows\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe
        
        C:\Windows\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4104
        
        C:\Windows\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}.exe
        
        C:\Windows\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}.exe
        13⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BFF5F~1.EXE > nul
        13⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7753D~1.EXE > nul
        12⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D4C6~1.EXE > nul
        11⤵
        
        PID:376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4452C~1.EXE > nul
        10⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E6FB7~1.EXE > nul
        9⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F55BD~1.EXE > nul
        7⤵
        
        PID:1596
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6043E~1.EXE > nul
        6⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A574F~1.EXE > nul
        5⤵
        
        PID:868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4BF47~1.EXE > nul
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1EE36A15-F127-4e72-977E-B6743744A584}.exe

Filesize
168KB

MD5
78977f2c9a0f2977ccb0f15df7d521ea

SHA1
5c63b7026c347004297ee72197bf490308805ed8

SHA256
69e99e4c557b7d5ad2d87676bfc58210f8b63d25c1f63a55e04afe50dccff99b

SHA512
f71c105ba794636ceb9a550b568dfaa43f528a32f551316cdfb684b8b66cb62b8e187e57515430f429fca73642314ce1592590ae08c8dd61ada7c6ac9bf7dc1c

Download Submit
C:\Windows\{4452C26A-B421-4053-9315-7A16E334AB65}.exe

Filesize
168KB

MD5
3e204ec19ad78a3b0eec39e62c3b83ab

SHA1
32d8e7d297432d10096f7244c423d812a7a3aca4

SHA256
95a62933631f8a690452afcc05d7bf89afc71983d172a15b0e52f232ec8b4a1c

SHA512
0229a14136b0f1f245bedc232a8129bd72e0d3f0a78cabe8ea415ed353bc3413d571b0f10d271c993ad61755855a13c29c2923e08051ac03744a47ac12615a06

Download Submit
C:\Windows\{4BF478D4-A6DA-40ef-8838-F3A0BE017C92}.exe

Filesize
168KB

MD5
4b5a777013e60b49ed0146df720a68bb

SHA1
ee6bbca11cc34e2edc764570fa55d5022b7c4e1a

SHA256
cb957470959c486d23a759cd98a3f6083e775a14478f1e1795a70d5f2056f9fb

SHA512
dc8081bdef6ae24060442d90993db7ef6ff0bf75a2b448e6493850ed13266d083ccfef3574f5e9681c10d7396d2e0e9c10e81e77e3fa9a6846b3236b84f307bd

Download Submit
C:\Windows\{5D4C6386-D7D7-426d-B886-EDEEAB6B833F}.exe

Filesize
168KB

MD5
d452caf584091cfb5a6ebda9e01d54f0

SHA1
a8a371af3410cbfbd54a0082b70f663f80fa6840

SHA256
6b142b0401ecf319876d6d6052ef5187d84e8474280203e042ad26bbc37ddecf

SHA512
0d396b40ac0a1b7b108d93f3960a906f47f43da79e17e2df7fec1f04f8e1192c96b4d2ec34c6e928bb3ebd86e4871084831522b3014721c85ad298f002a3f957

Download Submit
C:\Windows\{6043EE97-02CA-4d5e-9D2C-B601EF1DE578}.exe

Filesize
168KB

MD5
d54b9883b83dd6681f08fbc6e2453206

SHA1
6cac18ee2eb288880b25dc907a953386ee701769

SHA256
a294f1b88efc822ec34283ab02dbb20f9ff4c458f9313d5c1578e7321eab0cbf

SHA512
e9e70a504c8cf51e247c5e6bf9a5475e82bc58b3e1abd351a201c1d9e8a4e41ce4486adc1b88d2eacccb4756b63f281e3c339c0db3076bc6893ab11fde5d0416

Download Submit
C:\Windows\{6B7E91B2-D5E9-483b-AE38-15549D7F15E8}.exe

Filesize
168KB

MD5
bde66e3487bb8c5776209a824f8977af

SHA1
c5150c59b64f6eea81d5f3a7fa84c1f5505eb7d5

SHA256
1828e2cda230d5db140f56caca26a69c9284376e85ea9d9f871e6d047d286994

SHA512
33a5707d41f3a9c4b77972dc9b817d8e452618b92f21d8b3d5cd830c98ac97b2c8f49b4f235d830637a90d0c7a28cdc5e4a2e10694750842bc8cc7d3537dc2f9

Download Submit
C:\Windows\{7753DF7E-8A17-469d-B7FC-D23DAEE3DDB1}.exe

Filesize
168KB

MD5
d956284bb1d26770495a1edd13208b57

SHA1
20201751f18d1a4e6ca69a2cd1af166aed3de790

SHA256
ead78bf5e5ce3adcb2a8131f5086c0ee85ed4b041a2371c6cc290e4beae5ffe9

SHA512
1292b0ad1d7d0708f3bc5dc17d64af9c10c0a82d6dc832afa97c9f974e53ecfdddac3897086fed7402f958d82b70b5324543744241c6dc9f5c76d0fbb689ea87

Download Submit
C:\Windows\{A574FA16-4F37-4101-BFBD-67470BB4C26B}.exe

Filesize
168KB

MD5
cfff172ed393d567db09f17c8847f391

SHA1
b189c5c9f1446aed9e8cb639f746ac2494105f70

SHA256
5a4805562a3aaec3f663496ddac4fe4677431af008c77755dc7d6f4d04e20de8

SHA512
fc156ed9014c2c5127472fa3859dbbc0f7fe54d4008839d91ea5383ec01b7d257c297644f3e04028f8c3e4ed0af3ed0bddfa84935652b6bcc02270a9d18bbd7f

Download Submit
C:\Windows\{BFF5F798-07B1-4153-B8C9-B2C12601AB95}.exe

Filesize
168KB

MD5
e2c4870ee9299db1d9818524a75156ab

SHA1
d0a138532f1c894977b7732bdd9fd39546b392fc

SHA256
fe079b56c76f027b624e30f96e6e4325d976b92dce70b18ef2bbd668049a2d04

SHA512
12e2292b305b2a546a384bd3492a20849101ef87fe229baded227295f00aaaabc70b63e2cd3f2a1b5209ce26eba9a8b7c46639e9ec0563c0f0418165c2ac6086

Download Submit
C:\Windows\{D21E165C-5268-4b2d-9DBB-D62361B4FD0E}.exe

Filesize
168KB

MD5
5c9d4475492d6c3c8a970fa47dce0258

SHA1
42cb64dc5300ddda8d8f194e2f69fae7fef5bf1e

SHA256
d1435c294b7f9bc7d0df19837df2bdb84851c1de502e57d24afa47cfd14e37c3

SHA512
c37fb13d687466428798f3515f44c0b768ae90341a70147530cff1e7339074ad1b455b386411c69632856e967a70c01fdb72803b7f00af2c244551d61848150b

Download Submit
C:\Windows\{E6FB7EA5-BA77-4e38-B68E-FA1358207397}.exe

Filesize
168KB

MD5
fe768e287a21c2a92c9995a5a578d712

SHA1
35a11796eeba5b51b588317f7739e69b637ea07f

SHA256
7312485a6e8eed9bbe7ba3ac201ceb657b7e6c3cb50b89cbceae6fbb80f6b4ae

SHA512
dddd44fc43b940849a28b2ae18867ad41622ab50a7224d858a392069473955f4b0db853f5245014cfdefd396c2a94ec7f7f35dd1b2295811603793b1eac4628c

Download Submit
C:\Windows\{F55BD880-C5CA-46ab-9C33-B06FAD3E0E46}.exe

Filesize
168KB

MD5
cb3e7214368f938702f53aea682a5697

SHA1
1574744d995a31168cddd2ca2df38c2cc0066601

SHA256
d50707ac61cab8a834608403c83ee05d88e78112d064635f569ad2fffa8c9e15

SHA512
9a21a0145d9209b70181d6162744036cde4e0ebdac144c1e98d45d100c2e8460ddc259bb99cf357086a801495df523c177ce23c4aef5f4f77427f8afb643db59

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads