65dfe93f9ae2492bdbf77a9dc610971d6fa431aa7a2660463893e2bf566c5178

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe
Size

408KB
MD5

e6a4ee78c5550985322b380aa761b815
SHA1

917f1e3b88f00dfb3e04c04cfb1722cd2b2a49fc
SHA256

65dfe93f9ae2492bdbf77a9dc610971d6fa431aa7a2660463893e2bf566c5178
SHA512

3e06710b57016a9246d39a3f35e7ee9041e5a4f828120916682220499e95e2c0dacf0b8c001a495c58d884b83e510254b06f71f1fc00a912e658c519d65a9460
SSDEEP

3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023139-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002313c-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023139-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002313c-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023139-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002313c-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023139-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002313c-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023139-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002313c-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023139-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002313c-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002313c-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}\stubpath = "C:\\Windows\\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe"	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A6FAE11-1D58-4387-963E-B2DC375AF273}	{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87311CFE-4922-4f99-B723-FF7E469A06D2}\stubpath = "C:\\Windows\\{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe"	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}\stubpath = "C:\\Windows\\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe"	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64032E43-AD2F-47a2-8834-470F630CAC5C}\stubpath = "C:\\Windows\\{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe"	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{340355EB-E6BA-4f42-96CD-DF87E79A8965}\stubpath = "C:\\Windows\\{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe"	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}\stubpath = "C:\\Windows\\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe"	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2FE72A7-5E1B-47b1-972E-71F787D40026}\stubpath = "C:\\Windows\\{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe"	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}\stubpath = "C:\\Windows\\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe"	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}\stubpath = "C:\\Windows\\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe"	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{340355EB-E6BA-4f42-96CD-DF87E79A8965}	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87311CFE-4922-4f99-B723-FF7E469A06D2}	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64032E43-AD2F-47a2-8834-470F630CAC5C}	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A6FAE11-1D58-4387-963E-B2DC375AF273}\stubpath = "C:\\Windows\\{4A6FAE11-1D58-4387-963E-B2DC375AF273}.exe"	{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2621028-F31D-41d5-B5FB-CE3D44845F18}	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2621028-F31D-41d5-B5FB-CE3D44845F18}\stubpath = "C:\\Windows\\{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe"	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}\stubpath = "C:\\Windows\\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe"	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2FE72A7-5E1B-47b1-972E-71F787D40026}	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe

Executes dropped EXE 11 IoCs

pid	Process
4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe
5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe
1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
2016	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
1860	{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
File created	C:\Windows\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
File created	C:\Windows\{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
File created	C:\Windows\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
File created	C:\Windows\{4A6FAE11-1D58-4387-963E-B2DC375AF273}.exe	{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe
File created	C:\Windows\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
File created	C:\Windows\{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe
File created	C:\Windows\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
File created	C:\Windows\{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
File created	C:\Windows\{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe
File created	C:\Windows\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
File created	C:\Windows\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
Token: SeIncBasePriorityPrivilege	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
Token: SeIncBasePriorityPrivilege	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe
Token: SeIncBasePriorityPrivilege	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
Token: SeIncBasePriorityPrivilege	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
Token: SeIncBasePriorityPrivilege	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
Token: SeIncBasePriorityPrivilege	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
Token: SeIncBasePriorityPrivilege	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe
Token: SeIncBasePriorityPrivilege	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
Token: SeIncBasePriorityPrivilege	2016	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
Token: SeIncBasePriorityPrivilege	1860	{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4288	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe	81
PID 3600 wrote to memory of 4288	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe	81
PID 3600 wrote to memory of 4288	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe	81
PID 3600 wrote to memory of 848	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe	82
PID 3600 wrote to memory of 848	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe	82
PID 3600 wrote to memory of 848	3600	2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe	82
PID 4288 wrote to memory of 4704	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	83
PID 4288 wrote to memory of 4704	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	83
PID 4288 wrote to memory of 4704	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	83
PID 4288 wrote to memory of 2144	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	84
PID 4288 wrote to memory of 2144	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	84
PID 4288 wrote to memory of 2144	4288	{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe	84
PID 4704 wrote to memory of 1476	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	86
PID 4704 wrote to memory of 1476	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	86
PID 4704 wrote to memory of 1476	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	86
PID 4704 wrote to memory of 3692	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	85
PID 4704 wrote to memory of 3692	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	85
PID 4704 wrote to memory of 3692	4704	{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe	85
PID 1476 wrote to memory of 5084	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	87
PID 1476 wrote to memory of 5084	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	87
PID 1476 wrote to memory of 5084	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	87
PID 1476 wrote to memory of 3712	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	88
PID 1476 wrote to memory of 3712	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	88
PID 1476 wrote to memory of 3712	1476	{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe	88
PID 5084 wrote to memory of 2560	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	89
PID 5084 wrote to memory of 2560	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	89
PID 5084 wrote to memory of 2560	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	89
PID 5084 wrote to memory of 1128	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	90
PID 5084 wrote to memory of 1128	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	90
PID 5084 wrote to memory of 1128	5084	{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe	90
PID 2560 wrote to memory of 1908	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	91
PID 2560 wrote to memory of 1908	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	91
PID 2560 wrote to memory of 1908	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	91
PID 2560 wrote to memory of 4980	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	92
PID 2560 wrote to memory of 4980	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	92
PID 2560 wrote to memory of 4980	2560	{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe	92
PID 1908 wrote to memory of 1720	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	93
PID 1908 wrote to memory of 1720	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	93
PID 1908 wrote to memory of 1720	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	93
PID 1908 wrote to memory of 4532	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	94
PID 1908 wrote to memory of 4532	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	94
PID 1908 wrote to memory of 4532	1908	{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe	94
PID 1720 wrote to memory of 4984	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	95
PID 1720 wrote to memory of 4984	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	95
PID 1720 wrote to memory of 4984	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	95
PID 1720 wrote to memory of 2500	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	96
PID 1720 wrote to memory of 2500	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	96
PID 1720 wrote to memory of 2500	1720	{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe	96
PID 4984 wrote to memory of 1608	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	97
PID 4984 wrote to memory of 1608	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	97
PID 4984 wrote to memory of 1608	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	97
PID 4984 wrote to memory of 2044	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	98
PID 4984 wrote to memory of 2044	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	98
PID 4984 wrote to memory of 2044	4984	{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe	98
PID 1608 wrote to memory of 2016	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	99
PID 1608 wrote to memory of 2016	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	99
PID 1608 wrote to memory of 2016	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	99
PID 1608 wrote to memory of 3680	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	100
PID 1608 wrote to memory of 3680	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	100
PID 1608 wrote to memory of 3680	1608	{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe	100
PID 2016 wrote to memory of 1860	2016	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe	101
PID 2016 wrote to memory of 1860	2016	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe	101
PID 2016 wrote to memory of 1860	2016	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe	101
PID 2016 wrote to memory of 1524	2016	{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_e6a4ee78c5550985322b380aa761b815_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
  C:\Windows\{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
    C:\Windows\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DE2F4~1.EXE > nul
      4⤵
      PID:3692
  - - C:\Windows\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe
      C:\Windows\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
        
        C:\Windows\{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5084
      - C:\Windows\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
        
        C:\Windows\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
        
        C:\Windows\{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
        
        C:\Windows\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe
        
        C:\Windows\{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
        
        C:\Windows\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
        
        C:\Windows\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe
        
        C:\Windows\{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Windows\{4A6FAE11-1D58-4387-963E-B2DC375AF273}.exe
        
        C:\Windows\{4A6FAE11-1D58-4387-963E-B2DC375AF273}.exe
        13⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64032~1.EXE > nul
        13⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9FBDD~1.EXE > nul
        12⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7D451~1.EXE > nul
        11⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{34035~1.EXE > nul
        10⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D3AE~1.EXE > nul
        9⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87311~1.EXE > nul
        8⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ABBEF~1.EXE > nul
        7⤵
        
        PID:4980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F2FE7~1.EXE > nul
        6⤵
        
        PID:1128
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3F004~1.EXE > nul
        5⤵
        
        PID:3712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F2621~1.EXE > nul
    3⤵
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1D3AE3D7-CCDB-470e-92AD-53FE994AA774}.exe

Filesize
408KB

MD5
2b94de515b16d7c601e1ac4aeb1bee14

SHA1
b889781b5f6a6279d35f7fda88ee1cb79f3351da

SHA256
58724663f0dd5622abb6589b84315b4f7be83858d55104641b47d156cc18a834

SHA512
74a0b8c8ffa20f4b0c49531148273ca00d667f3a7ac2076eb51ea84e1e851d2fc2ba390b9a242ca29abd22b095fc820c8246905a0596620b5f7c2773f1cfcd26

Download Submit
C:\Windows\{340355EB-E6BA-4f42-96CD-DF87E79A8965}.exe

Filesize
408KB

MD5
4a946388d377875c31671538a93e2805

SHA1
49a7f49f75f030604ab1007b806cfff71644fd2c

SHA256
3083da309afb88a7b08f5aaa0e93b334dc0f51df259dd2213809dae49d419305

SHA512
90b1587ca501ca93fe6ce9f169930448b9079e1f613fb1ef5cc91eefa097d5526b897751c1f2412ed0cfd8e9271d73531a6efd1678a5566e64cf04d8cd7ac2d7

Download Submit
C:\Windows\{3F004E00-AEC0-4d3f-B49B-4E2876B91DC0}.exe

Filesize
408KB

MD5
4088645f4a1df4f9e2d83d994c434c34

SHA1
01b92a11af33c6e75eb026f28d8b6ffce7df8ada

SHA256
bc797145de2b6baa540390451282fb2f2cc9295c0adea4632310b91538ad8622

SHA512
6349d56475c2cb753bda91702baa73d23e57d1632dcbb58ae95269d1ba76ceff09bb32d1ce4ff1c4d03011d449dd86b1fb14d2f4a447a73460b7b9197a3833cf

Download Submit
C:\Windows\{4A6FAE11-1D58-4387-963E-B2DC375AF273}.exe

Filesize
408KB

MD5
ba92d4365112c1f63ae501210e7df69e

SHA1
a913abaff194c0912b1abda97507761c22c4685d

SHA256
fce6758cf840da8e8d54189d82d26d733a9d549cfac1443af3cd3e39ff1328c6

SHA512
9c4e6dc8046ceedaaac8276f70d91694f3201ff967e6ff06b20c11c44efcf3c3d5cc7d635028f926cef951199729df44bcb09cc8686a063d7edb2e9e996b1d93

Download Submit
C:\Windows\{4A6FAE11-1D58-4387-963E-B2DC375AF273}.exe

Filesize
266KB

MD5
20392b977f1db073b41cc75e492eee51

SHA1
236421d358a1867bb487dc82fdde77f76608f1e9

SHA256
c586b6e00e6425d457a018bcbc18bb08cf1652b254ed80d7a7870a2901053585

SHA512
c12a8e3371104f613125c1b3e8bb257f10e0f796f32d1a97177425a3cdee3be88a4a135e4977da509f7e15d431cd6ebc7a8e06b2d2e6e9780859e9ca3dde4733

Download Submit
C:\Windows\{64032E43-AD2F-47a2-8834-470F630CAC5C}.exe

Filesize
408KB

MD5
81efd5cc374ec51dabd38c2353974a2c

SHA1
32e68a1bc576f8c269af34adc17711600391989a

SHA256
953817fcd718ffcbf37593fb6dec8cb86ffa70d1c2cd3a0ca6885c1c657a4756

SHA512
a2929916501d93e5048a5a758a7736039fe983f40662a9efcdc70218a916e10370d04018f12959a84fe61f1ae99613b1d1d3e3f882219aac69d47e20991931b2

Download Submit
C:\Windows\{7D4510E6-887D-4bd0-A3D9-31B7CC2CA747}.exe

Filesize
408KB

MD5
e758a3f59145cb0689f4cdaabfccd506

SHA1
01518b115e0234d0450f9bf939118fa79c56ae55

SHA256
2c888f6e2abcdfc10d8cca2bee65eb58c77f217998e7a423046ff1b5cf8d100e

SHA512
520e67075302834d3ad92b4382499394c0cfeab1c48597e55869ebe16a49f0edb89e82dd721c9b8f2efc92e608b8f682ed263c8454e99d6d4e8900b1190b8640

Download Submit
C:\Windows\{87311CFE-4922-4f99-B723-FF7E469A06D2}.exe

Filesize
408KB

MD5
0d835f4b15701abaf6012d9aed7997a0

SHA1
c26ce228dd100cf2e7058228dfa131151d899396

SHA256
f6fd01682e4143bc6ffde13ceb88fd0df82f53da556eaed99653f014c165c336

SHA512
93e28de14129edf024b9d5180860300c2789c56cb4e1f7574ee1c447d08086b1c4ed6c0dc6b9bbdad2bd34af17f1e68b1dcd41ed6f7bd8b1a55c301f292c2acf

Download Submit
C:\Windows\{9FBDDED6-7BE4-49f6-8D72-DE31402E0D93}.exe

Filesize
408KB

MD5
f6d6c09a726b00e14c4769483fe6678b

SHA1
ece897719734bfad752fab9696e9ee4b29cb91c4

SHA256
50f4c52c7c59b61db886acbe991c101d6e5fd9e79679ae30f40895d6f80e7006

SHA512
bd97d943f218b378b0282d04863855f0dd8b5e0a4a5637790100e869add3cd34ae2da03c486bf9ad1bf5a12fed26b15404963ec8a29321417b334d657cb690d1

Download Submit
C:\Windows\{ABBEF32C-6A43-43b3-80EB-EBAF0DB455E4}.exe

Filesize
408KB

MD5
385e4107ddf11dca076bf4955ca94a46

SHA1
df195d71b21cc513abdeae640f2c495e0e8720b0

SHA256
1c1768f5e13500d852c70d8901107fe4304ea4fa670302249677bfe00e27c93b

SHA512
ef1bc618b6a3ea7b684d6c31653b84fa970cb0b2078801fb83707cd7c2c02ffd1491b4788fa62a256298bd9e2e1ea6e9f1847a1435b286ff7408037965f9f951

Download Submit
C:\Windows\{DE2F4FD9-8068-4e5c-9C52-7BF3BC0C91A1}.exe

Filesize
408KB

MD5
5c64dee463c3a67fe64d59c1d2af9605

SHA1
4ab26c3da3452e1750b8fde4afcd139f207fe116

SHA256
1dd626fb4d3c54c94a17c6d2a539989ed48db552e002f5096a7e10a3dcc9d561

SHA512
4a01707154277e859b175705fe192fa3b3f768308c9bae8d03860ac13f40fadbbad2e56db95f8bb6d9ce182fa15f37e1a3f386d4621e57e061957c378e8a6963

Download Submit
C:\Windows\{F2621028-F31D-41d5-B5FB-CE3D44845F18}.exe

Filesize
408KB

MD5
f20985d3553632d018590db2c6c41697

SHA1
973736ce6e96929f70d18d0eb6519a0c6d08847e

SHA256
64f270bf71f997548a42c2b9c2eafb9d79334fe7ec84bcbe94188829604fa38b

SHA512
6a792f3f47917401a3101d30f5c687eac64e61d4b731255fef18a0807198a4cead98ba196851d06b6ca279acae7574c4782c5927b2d09e2a7fabf64a889bd7e1

Download Submit
C:\Windows\{F2FE72A7-5E1B-47b1-972E-71F787D40026}.exe

Filesize
408KB

MD5
d9785df20eac95a309b009b3e08a171d

SHA1
7b022194603ac95b1d377ac8a848d8844a8e4715

SHA256
89e1803ba273a7f8db78786ebb156b0fc625327fac553bfb322f3a1553d8a495

SHA512
3653c76fbcd010842a76dbc930d2449dea0d9a9a4d31659ae45e4be9a5a0ca35c7a0b1f61d9e10f4f7814dd757a7c5ae9740dbdb0ecb9db7f2e5fc98e4181edd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads