be6df662535773e6f3cff293eb2c7b824bfb086830b4af47ec11550c6896349d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe
Size

372KB
MD5

93e0c1d832fea2fb903ddd630164c459
SHA1

386054b00e63833efd992ab1dda83b4a698d5080
SHA256

be6df662535773e6f3cff293eb2c7b824bfb086830b4af47ec11550c6896349d
SHA512

950fb97148c2b7114f0f261e37aa9963ee38f819b5477a1403fe8b7b553c8023e5ee030713c0b3b8af1c0833fa5793c27909272ff7cda8e266b304c0a7e6e7f7
SSDEEP

3072:CEGh0oqlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGMlkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f2-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002311d-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023219-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002311d-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001300000001d887-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001300000001d887-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000021558-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001400000001d887-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000006cf-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{155B07BD-9829-41c6-B8E5-D032CB942A71}\stubpath = "C:\\Windows\\{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe"	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B87C578-C8AD-41e9-B0CE-895A018363BC}	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D812DB20-2891-41d3-89B9-0CED5BD39763}	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B8E0847-349C-4cf0-B698-FC803ADF3969}\stubpath = "C:\\Windows\\{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe"	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}\stubpath = "C:\\Windows\\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe"	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}\stubpath = "C:\\Windows\\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe"	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B8E0847-349C-4cf0-B698-FC803ADF3969}	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A89775B-440D-47b7-8439-C74B3E5FB88B}\stubpath = "C:\\Windows\\{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe"	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}\stubpath = "C:\\Windows\\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe"	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C22D9285-7BFD-4948-9630-3FB4B634DD66}	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C22D9285-7BFD-4948-9630-3FB4B634DD66}\stubpath = "C:\\Windows\\{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe"	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}\stubpath = "C:\\Windows\\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe"	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D812DB20-2891-41d3-89B9-0CED5BD39763}\stubpath = "C:\\Windows\\{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe"	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{155B07BD-9829-41c6-B8E5-D032CB942A71}	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}\stubpath = "C:\\Windows\\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe"	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B87C578-C8AD-41e9-B0CE-895A018363BC}\stubpath = "C:\\Windows\\{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe"	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A89775B-440D-47b7-8439-C74B3E5FB88B}	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}	{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}\stubpath = "C:\\Windows\\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}.exe"	{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe

Executes dropped EXE 12 IoCs

pid	Process
4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
432	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
3952	{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe
2128	{8F511633-90B0-4dff-9BDC-CC2FC5170D68}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
File created	C:\Windows\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
File created	C:\Windows\{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
File created	C:\Windows\{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
File created	C:\Windows\{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
File created	C:\Windows\{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
File created	C:\Windows\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
File created	C:\Windows\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe
File created	C:\Windows\{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
File created	C:\Windows\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
File created	C:\Windows\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
File created	C:\Windows\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}.exe	{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
Token: SeIncBasePriorityPrivilege	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
Token: SeIncBasePriorityPrivilege	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
Token: SeIncBasePriorityPrivilege	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
Token: SeIncBasePriorityPrivilege	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
Token: SeIncBasePriorityPrivilege	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
Token: SeIncBasePriorityPrivilege	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
Token: SeIncBasePriorityPrivilege	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
Token: SeIncBasePriorityPrivilege	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
Token: SeIncBasePriorityPrivilege	432	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
Token: SeIncBasePriorityPrivilege	3952	{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4444	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe	90
PID 3328 wrote to memory of 4444	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe	90
PID 3328 wrote to memory of 4444	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe	90
PID 3328 wrote to memory of 4368	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe	91
PID 3328 wrote to memory of 4368	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe	91
PID 3328 wrote to memory of 4368	3328	2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe	91
PID 4444 wrote to memory of 4320	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	94
PID 4444 wrote to memory of 4320	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	94
PID 4444 wrote to memory of 4320	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	94
PID 4444 wrote to memory of 864	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	95
PID 4444 wrote to memory of 864	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	95
PID 4444 wrote to memory of 864	4444	{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe	95
PID 4320 wrote to memory of 3044	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	97
PID 4320 wrote to memory of 3044	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	97
PID 4320 wrote to memory of 3044	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	97
PID 4320 wrote to memory of 1960	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	98
PID 4320 wrote to memory of 1960	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	98
PID 4320 wrote to memory of 1960	4320	{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe	98
PID 3044 wrote to memory of 1912	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	99
PID 3044 wrote to memory of 1912	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	99
PID 3044 wrote to memory of 1912	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	99
PID 3044 wrote to memory of 4832	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	100
PID 3044 wrote to memory of 4832	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	100
PID 3044 wrote to memory of 4832	3044	{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe	100
PID 1912 wrote to memory of 3856	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	102
PID 1912 wrote to memory of 3856	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	102
PID 1912 wrote to memory of 3856	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	102
PID 1912 wrote to memory of 2192	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	101
PID 1912 wrote to memory of 2192	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	101
PID 1912 wrote to memory of 2192	1912	{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe	101
PID 3856 wrote to memory of 3936	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	103
PID 3856 wrote to memory of 3936	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	103
PID 3856 wrote to memory of 3936	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	103
PID 3856 wrote to memory of 4620	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	104
PID 3856 wrote to memory of 4620	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	104
PID 3856 wrote to memory of 4620	3856	{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe	104
PID 3936 wrote to memory of 4800	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	105
PID 3936 wrote to memory of 4800	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	105
PID 3936 wrote to memory of 4800	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	105
PID 3936 wrote to memory of 1604	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	106
PID 3936 wrote to memory of 1604	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	106
PID 3936 wrote to memory of 1604	3936	{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe	106
PID 4800 wrote to memory of 4604	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	107
PID 4800 wrote to memory of 4604	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	107
PID 4800 wrote to memory of 4604	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	107
PID 4800 wrote to memory of 3048	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	108
PID 4800 wrote to memory of 3048	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	108
PID 4800 wrote to memory of 3048	4800	{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe	108
PID 4604 wrote to memory of 3724	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	109
PID 4604 wrote to memory of 3724	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	109
PID 4604 wrote to memory of 3724	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	109
PID 4604 wrote to memory of 3740	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	110
PID 4604 wrote to memory of 3740	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	110
PID 4604 wrote to memory of 3740	4604	{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe	110
PID 3724 wrote to memory of 432	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	111
PID 3724 wrote to memory of 432	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	111
PID 3724 wrote to memory of 432	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	111
PID 3724 wrote to memory of 544	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	112
PID 3724 wrote to memory of 544	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	112
PID 3724 wrote to memory of 544	3724	{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe	112
PID 432 wrote to memory of 3952	432	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe	113
PID 432 wrote to memory of 3952	432	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe	113
PID 432 wrote to memory of 3952	432	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe	113
PID 432 wrote to memory of 860	432	{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_93e0c1d832fea2fb903ddd630164c459_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
  C:\Windows\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
    C:\Windows\{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
      C:\Windows\{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
        
        C:\Windows\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0B7CD~1.EXE > nul
        6⤵
        
        PID:2192
      - C:\Windows\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
        
        C:\Windows\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
        
        C:\Windows\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
        
        C:\Windows\{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
        
        C:\Windows\{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
        
        C:\Windows\{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
        
        C:\Windows\{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe
        
        C:\Windows\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
        
        C:\Windows\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}.exe
        
        C:\Windows\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}.exe
        13⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F2DB~1.EXE > nul
        13⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A897~1.EXE > nul
        12⤵
        
        PID:860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0B87C~1.EXE > nul
        11⤵
        
        PID:544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B8E0~1.EXE > nul
        10⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C22D9~1.EXE > nul
        9⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{69A83~1.EXE > nul
        8⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8F0B0~1.EXE > nul
        7⤵
        
        PID:4620
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{155B0~1.EXE > nul
        5⤵
        
        PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D812D~1.EXE > nul
      4⤵
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C676E~1.EXE > nul
    3⤵
    PID:864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0B7CDEE1-68EB-4831-B7AD-466995CB0979}.exe

Filesize
372KB

MD5
29f45d70096eecf5f4bfc076bffd4a02

SHA1
c2b958a94fdd6384dfb78c2870c2b9e22ca5a0b2

SHA256
c79f5b3d7b258f22d2fd84b10b84c550e29a814db5eeb33c0c4e9a3a87328860

SHA512
190fca87585d82294e767549f27603676e3cf7b5166465a61a2c15fdbcc329eb74a42ed184899b79d3ebd38329a2cef18340e04cf330e7f235e9382b687c7b4a

Download Submit
C:\Windows\{0B87C578-C8AD-41e9-B0CE-895A018363BC}.exe

Filesize
372KB

MD5
ae1a6d430822f3a589e7a2741cfdea70

SHA1
3500d9abc2efd6defd1e507c8d9c365fb605df91

SHA256
5db64b5c2d7c7ba7c9a97146ad5406801cdbe26d9bb7a0c4def1c2c6e5a9760d

SHA512
29b8b80993ed540c2fe244f26e3e0d55b256cf07e9da332b68b042f45144c339c67a56ca95071682a3dc6ab3f4fd582536e1db9aa8cd957130a40b896f6d2fce

Download Submit
C:\Windows\{155B07BD-9829-41c6-B8E5-D032CB942A71}.exe

Filesize
372KB

MD5
0a2d0e9c0b40bd50ebb1e4c07755f059

SHA1
9ec3d6a03713350272ef220badea2b128e07e924

SHA256
8185ebe9e61d3c24eccc425b4b901a5cbdbef773b6ca198cbfea3df72e0963af

SHA512
201874b9a30852511b670e43f719714ea28336864b039bf0c1a4b137dd06f446b928b5b5a9708fd9dc3853d50fedbf15c015257568fcb188c8b632c1f4fd2340

Download Submit
C:\Windows\{1B8E0847-349C-4cf0-B698-FC803ADF3969}.exe

Filesize
372KB

MD5
73174e2390b9dadc592c65cfaaed8619

SHA1
cc5c8188e36d088b2511d479c6e445dd4cf974e5

SHA256
d989a11b68c6063ee18caf96bbc57f5001dcf8d9212c636674cc0a97cd31c6d5

SHA512
d8474daea24c8dc1ed55cc64a7f98270fc7d88e3cfd2b34648968beb1255c72af5da33626559e934c43a7806476b1b0f448cbfe3219120a7221f49a606c98ec8

Download Submit
C:\Windows\{69A83BD5-D9C5-4842-9FAB-56BFF3B892F0}.exe

Filesize
372KB

MD5
0a3645edfac25f9b1d82f70c7f508180

SHA1
7845bf29bdf2c277b13668a83a21759e3039ffdc

SHA256
7ba265b25fef7488bd2db477f937d11e86d64308b27db8839e9b1b35bc3665d9

SHA512
5839608b04eb68ee0c01d18b6a5c5a0022131e046aa88b0e122e5b36d59621690ae139106751046ded9f80ccc61c0a985a6288c91bfa767c715b288924bba2a8

Download Submit
C:\Windows\{6F2DBA5E-0AE9-48bd-8029-3808EA9554FB}.exe

Filesize
372KB

MD5
8690e020337fcbef717320ced2dda6ec

SHA1
67e634ebd5bf0ff9ec0c51814aabfa03a0df44ea

SHA256
aa297f1b70dfedfdfa2e26cee66f3468883404334c4f13dd65d9984ecdaccb15

SHA512
06418447d6eb27fe66d7799b5d1ac0efd6e67aa4549143b2d993c975e666afc5c1558d449b1ae5027139edbbb85bfb74768ec003a4be56404d421064eadfbbc0

Download Submit
C:\Windows\{7A89775B-440D-47b7-8439-C74B3E5FB88B}.exe

Filesize
372KB

MD5
95af1f978543cb4dcfe4a650afeca0ad

SHA1
7c78e2211e96c22c1406ad2f34e48095785c3c1e

SHA256
ccd8d9dda433acb36df735946e43d243dbf7f6e0be80fd6fa134e36098ae4cd6

SHA512
c0c668537f712535c43fc32554ec1a169ef46b3e414d39319b5a4770ee1a2bcafea9a7c7b63a0dbab6cfa5480a4f91a6406d5aa5b1b5da43b053a2777f94ab6e

Download Submit
C:\Windows\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe

Filesize
61KB

MD5
24cccd6a92ded4f08274f3106e98e028

SHA1
1daece8f630e99a0979aa9ae648814ee45b70d17

SHA256
64c3d55303b553faaab2f03cce59154c1a365e3241bd4db129154d5706c9ed5e

SHA512
f24500d4175f90a22e1d4f176a9a3f40274eb15c83cbca42936a1fcd27ed75216b34a915b3c2ed8f3b56300cf97309eec1c1a3ab5de5dd5142107edcd801b101

Download Submit
C:\Windows\{8F0B02D0-DCB5-418c-B5C1-91AA51D4E9CC}.exe

Filesize
372KB

MD5
618e2c212e917549f5993f15e4896ea3

SHA1
aaa477f17486cf8ddaa6029ceefa2674e6727cde

SHA256
62ddf789f5ce99184f601b0fa93856e2afc054e6004f07b1901c2c491f18361c

SHA512
8d68f31c6af45b3216a82fbff249ec0ac26bc5af68c24f96cc48592d11f108fdfbb501e56c35b669c6d41a34241ebb73e8b4149ee24733d6aff610baee92e2ad

Download Submit
C:\Windows\{8F511633-90B0-4dff-9BDC-CC2FC5170D68}.exe

Filesize
372KB

MD5
b291de24363977a95b05fe6aab30854f

SHA1
8f08623ea1ffcfe2df6972d0a929c1d25085e464

SHA256
4c4818fedf7e7931bfe6f7ce0279c82cb8d2abf0937802914f2b41fec0e7599d

SHA512
5c50028e82e740d01a39750e1ef49d12a7a164652d2cd5b2d0fa5e306b929dedd63575bdc7b7461bf0627847eeb622cfdd4a8fc1dc5f98ed4727cf4c412d8241

Download Submit
C:\Windows\{C22D9285-7BFD-4948-9630-3FB4B634DD66}.exe

Filesize
372KB

MD5
18580709402fc75a29c0c0bb9670d573

SHA1
3aa96ea80bd3e2a83b1276661297b48d3427b55c

SHA256
2c4dbefc1904cf293e388d53733de31b8bf8c382ac5ce171a1d49fbe440eb3aa

SHA512
5f4a155c235ac1b56b34a4e45f5fa9d870caa95af2f91f4557ac0238a67e65f602ff0da044c9f1745e07d7700ea8648adfa004f2a08b8ef13e49c020dc14c944

Download Submit
C:\Windows\{C676EE48-1E49-4f1c-89D0-5ADB7CE6ED0E}.exe

Filesize
372KB

MD5
d769275c41aa1293a8d7d65616c36194

SHA1
50a838b0da0c3b77665cd7ab8ee08deaf3a66ff6

SHA256
220580f645acd734a1a24b5b4673d794acbc32e092617e81d7a56028aa697785

SHA512
a92f1598aae1f4a047d76b4cb9d7b04a17e9035c123144ab9295a2e64e6f3a64f923e5095d57b13066f336b8290145311232df37f161460c60e8aabe6bf6ec0f

Download Submit
C:\Windows\{D812DB20-2891-41d3-89B9-0CED5BD39763}.exe

Filesize
372KB

MD5
fe5a6b76b6d42c830830938d2d968624

SHA1
9d4391442c54cd8b400c029f9027a1280885a698

SHA256
17ff0453abc12e5841e3a59a3ebea5d5c2e0eb3e6eb225b34475602ff90e2f1a

SHA512
000f14be020563c839838121f574ee1373dd99075ed2b3a674721eee92935da98e9a676c49d06ca768dc6cca822ee901e8e2557bcd5fd708abacef41312110d1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads