4ebf7ebf8d69d2f4f266f12424424acc8e876b6f0cc5697137f205a0e9aae6fc

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Size

344KB
MD5

9d2c783cb14279201d52177459fe9b69
SHA1

343287523da81b036d0c67e144532dbe6e7b29e4
SHA256

4ebf7ebf8d69d2f4f266f12424424acc8e876b6f0cc5697137f205a0e9aae6fc
SHA512

3a4f09184b9bb8746d01216d38f41d3d3f5bd912eb18d43913daa8d5fb8a5c8b9bb18731224f9d8d32d546083e2fafe5fedb39286fc574a3f76363dd9235d355
SSDEEP

3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023217-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023210-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002313e-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023210-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000002313e-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023210-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000002313e-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000002313e-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023210-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001000000002313e-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023210-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001100000002313e-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023210-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56C619BA-F002-427c-A2C1-F42AF0B63936}\stubpath = "C:\\Windows\\{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe"	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E475593E-1AF8-4486-BEFA-8730008E9BF8}\stubpath = "C:\\Windows\\{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe"	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}\stubpath = "C:\\Windows\\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe"	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C50F48FD-EACF-4167-8915-EFA71CDF7412}	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A070875-AAE8-4585-9C75-805029F224E1}	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}\stubpath = "C:\\Windows\\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe"	{3A070875-AAE8-4585-9C75-805029F224E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E475593E-1AF8-4486-BEFA-8730008E9BF8}	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3827A06-C69F-4784-9C70-227432E8BD78}	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}\stubpath = "C:\\Windows\\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe"	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}	{3A070875-AAE8-4585-9C75-805029F224E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45820615-1B5D-42f4-963D-2A4F3BF04A10}\stubpath = "C:\\Windows\\{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe"	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56C619BA-F002-427c-A2C1-F42AF0B63936}	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3827A06-C69F-4784-9C70-227432E8BD78}\stubpath = "C:\\Windows\\{A3827A06-C69F-4784-9C70-227432E8BD78}.exe"	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}\stubpath = "C:\\Windows\\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}.exe"	{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C50F48FD-EACF-4167-8915-EFA71CDF7412}\stubpath = "C:\\Windows\\{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe"	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A070875-AAE8-4585-9C75-805029F224E1}\stubpath = "C:\\Windows\\{3A070875-AAE8-4585-9C75-805029F224E1}.exe"	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}\stubpath = "C:\\Windows\\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe"	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}\stubpath = "C:\\Windows\\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe"	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}	{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45820615-1B5D-42f4-963D-2A4F3BF04A10}	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe

Deletes itself 1 IoCs

pid	Process
1488	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe
3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe
2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe
1072	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
4200	{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe
4472	{F40D2EB2-B210-463c-8779-3B7EB8745CAB}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
File created	C:\Windows\{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
File created	C:\Windows\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe
File created	C:\Windows\{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
File created	C:\Windows\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}.exe	{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe
File created	C:\Windows\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
File created	C:\Windows\{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
File created	C:\Windows\{3A070875-AAE8-4585-9C75-805029F224E1}.exe	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
File created	C:\Windows\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	{3A070875-AAE8-4585-9C75-805029F224E1}.exe
File created	C:\Windows\{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
File created	C:\Windows\{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
File created	C:\Windows\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
Token: SeIncBasePriorityPrivilege	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
Token: SeIncBasePriorityPrivilege	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe
Token: SeIncBasePriorityPrivilege	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
Token: SeIncBasePriorityPrivilege	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe
Token: SeIncBasePriorityPrivilege	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
Token: SeIncBasePriorityPrivilege	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
Token: SeIncBasePriorityPrivilege	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
Token: SeIncBasePriorityPrivilege	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe
Token: SeIncBasePriorityPrivilege	1072	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
Token: SeIncBasePriorityPrivilege	4200	{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2404	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	94
PID 1612 wrote to memory of 2404	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	94
PID 1612 wrote to memory of 2404	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	94
PID 1612 wrote to memory of 1488	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	95
PID 1612 wrote to memory of 1488	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	95
PID 1612 wrote to memory of 1488	1612	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	95
PID 2404 wrote to memory of 5076	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	96
PID 2404 wrote to memory of 5076	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	96
PID 2404 wrote to memory of 5076	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	96
PID 2404 wrote to memory of 3180	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	97
PID 2404 wrote to memory of 3180	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	97
PID 2404 wrote to memory of 3180	2404	{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe	97
PID 5076 wrote to memory of 2396	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	101
PID 5076 wrote to memory of 2396	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	101
PID 5076 wrote to memory of 2396	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	101
PID 5076 wrote to memory of 2108	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	102
PID 5076 wrote to memory of 2108	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	102
PID 5076 wrote to memory of 2108	5076	{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe	102
PID 2396 wrote to memory of 3028	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe	103
PID 2396 wrote to memory of 3028	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe	103
PID 2396 wrote to memory of 3028	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe	103
PID 2396 wrote to memory of 3100	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe	104
PID 2396 wrote to memory of 3100	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe	104
PID 2396 wrote to memory of 3100	2396	{3A070875-AAE8-4585-9C75-805029F224E1}.exe	104
PID 3028 wrote to memory of 2564	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	105
PID 3028 wrote to memory of 2564	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	105
PID 3028 wrote to memory of 2564	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	105
PID 3028 wrote to memory of 4616	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	106
PID 3028 wrote to memory of 4616	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	106
PID 3028 wrote to memory of 4616	3028	{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe	106
PID 2564 wrote to memory of 2720	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	107
PID 2564 wrote to memory of 2720	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	107
PID 2564 wrote to memory of 2720	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	107
PID 2564 wrote to memory of 3564	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	108
PID 2564 wrote to memory of 3564	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	108
PID 2564 wrote to memory of 3564	2564	{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe	108
PID 2720 wrote to memory of 4244	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	109
PID 2720 wrote to memory of 4244	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	109
PID 2720 wrote to memory of 4244	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	109
PID 2720 wrote to memory of 3420	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	110
PID 2720 wrote to memory of 3420	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	110
PID 2720 wrote to memory of 3420	2720	{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe	110
PID 4244 wrote to memory of 3772	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	111
PID 4244 wrote to memory of 3772	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	111
PID 4244 wrote to memory of 3772	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	111
PID 4244 wrote to memory of 908	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	112
PID 4244 wrote to memory of 908	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	112
PID 4244 wrote to memory of 908	4244	{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe	112
PID 3772 wrote to memory of 2172	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	113
PID 3772 wrote to memory of 2172	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	113
PID 3772 wrote to memory of 2172	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	113
PID 3772 wrote to memory of 1664	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	114
PID 3772 wrote to memory of 1664	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	114
PID 3772 wrote to memory of 1664	3772	{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe	114
PID 2172 wrote to memory of 1072	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	115
PID 2172 wrote to memory of 1072	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	115
PID 2172 wrote to memory of 1072	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	115
PID 2172 wrote to memory of 2360	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	116
PID 2172 wrote to memory of 2360	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	116
PID 2172 wrote to memory of 2360	2172	{A3827A06-C69F-4784-9C70-227432E8BD78}.exe	116
PID 1072 wrote to memory of 4200	1072	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe	117
PID 1072 wrote to memory of 4200	1072	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe	117
PID 1072 wrote to memory of 4200	1072	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe	117
PID 1072 wrote to memory of 4216	1072	{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
  C:\Windows\{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
    C:\Windows\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\{3A070875-AAE8-4585-9C75-805029F224E1}.exe
      C:\Windows\{3A070875-AAE8-4585-9C75-805029F224E1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
        
        C:\Windows\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Windows\{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe
        
        C:\Windows\{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
        
        C:\Windows\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
        
        C:\Windows\{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
        
        C:\Windows\{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\{A3827A06-C69F-4784-9C70-227432E8BD78}.exe
        
        C:\Windows\{A3827A06-C69F-4784-9C70-227432E8BD78}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
        
        C:\Windows\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe
        
        C:\Windows\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
        
        C:\Windows\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}.exe
        
        C:\Windows\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}.exe
        13⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C16F2~1.EXE > nul
        13⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A9B3~1.EXE > nul
        12⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3827~1.EXE > nul
        11⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4755~1.EXE > nul
        10⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56C61~1.EXE > nul
        9⤵
        
        PID:908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0CC31~1.EXE > nul
        8⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45820~1.EXE > nul
        7⤵
        
        PID:3564
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F23D9~1.EXE > nul
        6⤵
        
        PID:4616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3A070~1.EXE > nul
        5⤵
        
        PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{11AB8~1.EXE > nul
      4⤵
      PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C50F4~1.EXE > nul
    3⤵
    PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0CC31BC8-AE7E-4b81-A97C-170934EBE8E7}.exe

Filesize
344KB

MD5
14942ba2a2d0915becbc50f7e28cdd51

SHA1
23b6e99f225b899ad9d74534459bef8c5f35cf25

SHA256
19d795b45bc798c04f0e06debe2f1490c7b9be1a217a7eb1e265c8a0672f10e0

SHA512
2a07e460011aed8423e4197b9f8a6683bf16f3514e1d595ff41b67b9947067c28a11f7a08a9ffd19d1f9a090e2f785c205a951acd6b53d95ce73cf1f70c11ef0

Download Submit
C:\Windows\{11AB8D00-4F58-42d2-B7E4-8C602D0CE6F8}.exe

Filesize
344KB

MD5
da3571773eb14a081277e0f78b506d70

SHA1
b29f0650e48e8aae40209e91f9c52159acdcea79

SHA256
b4852440faf0acbb3a6a7fcd91b46d5c8783dcb78900c551eeb739cc2dfc9f8a

SHA512
f9557c1f1df09fe91da8520c462ff1b24029be0436d1a394d73c44b1a0e4a8c6bf4197f1bff4cb566aa382bd6312cef71f3755aa6bf01493650112de6acccf4d

Download Submit
C:\Windows\{2A9B3FCD-0264-446b-B541-91D1AEF0E128}.exe

Filesize
344KB

MD5
58adef916377d635330598e3267fa042

SHA1
2cb3886a00a2c938ce940845e701a43d5b31648c

SHA256
77cbf7d75ab104f460e0f6741331cf0fff2bc1ef42abf67e84c9f9aba8c1d8e7

SHA512
986c3942a3843f149c509f25528152b094f4c4634f7f84154522bb131b2a4573f766601933a57fd471a4383d899e929e23b8537a17ad0deae1373f1ce3e55514

Download Submit
C:\Windows\{3A070875-AAE8-4585-9C75-805029F224E1}.exe

Filesize
344KB

MD5
7927aa3956e346c10fe781f21e2cd0de

SHA1
9d7845c872bc8817824c7a19b383adf6395b37ee

SHA256
0eacb50f1c2e1252d500b68b01011708436651ce9099284ad39dd42171cae526

SHA512
8002d57126a45c4a779e63c265e24d938f8345f025077ed511b2bcc7c5aa43c7da3ff9949e5fc1536cea3d49167bea2e3c01a346ffe5ddfc3bf0c764afa60f95

Download Submit
C:\Windows\{45820615-1B5D-42f4-963D-2A4F3BF04A10}.exe

Filesize
344KB

MD5
b05b526f2b36c11b5eb9edf08bbcd559

SHA1
d997817ef48bbe982dcb6c10306745ce77162b7c

SHA256
02b69304f6bd3a8c07a77181d33be1b827ebde9d232fc718f5ba5453b131173e

SHA512
518b7de950572495eed1aaf608810937c46162265ab1dc415a82834798f3dc08a706d9664380f231da3410e6c5f71f039ffaad9b2f7a2c77fc48ad9732261061

Download Submit
C:\Windows\{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe

Filesize
17KB

MD5
8d0debb93f131ee5bbac65f2c72cc8f1

SHA1
3a4d36cda94fd3be7cfe40fda5f73bca5dea706a

SHA256
3f8bd1646bd1736909aac057b48edaef66a503ac7dc1f3dae1c7c5ccfcdc3145

SHA512
f53ca09e8f15d6dee5f396da2fbc4f708264b688332beece0f7c8d6fde25451ba023f1c7583561b67deb91ebe2139275d5a9a0ca2b6e510d949c8c12d36c0587

Download Submit
C:\Windows\{56C619BA-F002-427c-A2C1-F42AF0B63936}.exe

Filesize
5KB

MD5
ddf99a755c84c3165e4bd64c40aab227

SHA1
732a9bbf7cfe1af8a40c1f6fdfae18f0afdb76c1

SHA256
fe00758f9f9c6d3c526dac1a915ea4acc7bee89d5a546c373e3f2688085c63a2

SHA512
4f59a66a6aa358c1febec8d8a18e03b1974030e5a8ba5a102bfc2d7eef90b6d4a7ac039f2c8003fd9f1f2c046d4d9ed0fb095a50aead757da9f589480770cd8a

Download Submit
C:\Windows\{A3827A06-C69F-4784-9C70-227432E8BD78}.exe

Filesize
344KB

MD5
796b2de2d891631e5da1b395f57cbacf

SHA1
cd40322acb1f316f2bcce180178d70cd1098858c

SHA256
ad290f949ca81f841b944318b77408f74e69a56b24b07741028edefb53438bd4

SHA512
5446494fe028a4f6ffcd3880f702a8977ab13349e72c3cce2e286d4d12823b730738e1ce39f41d1d906c5529bb4702c76cdd370b90c10db97520f7a34e35983d

Download Submit
C:\Windows\{C16F2E0D-FE38-4ce1-9C1E-F711BA765B1E}.exe

Filesize
344KB

MD5
a7e3fa83ee1681f66c3537c3b2f9cf80

SHA1
96c2c421ba550628d48871432d7c95179964e1fb

SHA256
1c6b5340c8a3a6dc14b9410326d79a5d21557e52397c6238f50f1d96cd9a0223

SHA512
9e247d17fdb37b8175419321866935bf1ee57202dcaeec4712081c7daa81c63c640b1c9aad3dbe0c7d17321b7bddce29c83f920a7b02490cd8d4b944f0d39d2f

Download Submit
C:\Windows\{C50F48FD-EACF-4167-8915-EFA71CDF7412}.exe

Filesize
344KB

MD5
66f83c589433aedef766a06a4c298b36

SHA1
281446d58be1cca8c33b0b12aa2973c10d4b7be1

SHA256
49cf6a9e17d97dfa39b3e44e203a164219ba883479b2edaf155697bf27dcb358

SHA512
a991857bc37facd1476b72413d09551e8cef966ce8bab9ca369abaab4c0875746cc61bb80938df7a06c579071b3be5832330583a4af75f49b13ab49edd5eaf23

Download Submit
C:\Windows\{E475593E-1AF8-4486-BEFA-8730008E9BF8}.exe

Filesize
344KB

MD5
be565a4ccb1653d10b8d8f3709631810

SHA1
99c0257f0f206a5c8cd09c008963286e141052d1

SHA256
08265357a5e752da1c274683ba868a036ce731dcf741303a54ccbc67828d27e8

SHA512
e85599ee0bc34103912a121107d053e5a6752a9daeba57ae50e9de70f4f4fecaa8e6699e89fd046ff6e3ea2669d3e011eabd4fbd970319d1661bd3b2c975acc1

Download Submit
C:\Windows\{F23D9E66-5864-42b8-BCA1-FFEE0AD44067}.exe

Filesize
344KB

MD5
31af047df3d54f2a2fe02e762fd5d9cc

SHA1
ee06f7aaab1bc229dd0acc56eda9f3776521d620

SHA256
9d79b1c4db90b9ddc0be1574cc8a6ee23bb9a301a61f045a33af91c773714d7c

SHA512
636c06baf111e2afa8fe361cac29bc5620e25b01af7042915b7aef841fd5f71736b151e85c3a199e8e22480759278b4d64522c0f4d31cc88d40e459e2de10824

Download Submit
C:\Windows\{F40D2EB2-B210-463c-8779-3B7EB8745CAB}.exe

Filesize
344KB

MD5
ee4a3163104ff39ed0936fe86a79d0e1

SHA1
a50f09e740f9c56108f34c518afc7507d1d5e113

SHA256
a88b3237cc1bc6c7391d66860377c14cf3659ae606b251a80fd30e69deec14fe

SHA512
c09df0bf54522cf57b4e79c886e5c126bc1eb7e31eb2f6e17ebf7483f87a4dda6784bc570a6d57a24bdcde9b399281d061c6562df2c30d69712b1e29b058af35

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads