a23208cbf7ee4c3562fd3edb4a740cb351446aae94a0646fa6cd50fdac374c07

Analysis

max time kernel
149s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe
Size 197KB
Sample240302-3k618aah29
SHA256 a23208cbf7ee4c3562fd3edb4a740cb351446aae94a0646fa6cd50fdac374c07
MD5 b0232d37fe2b51b95b47c38521700130
SHA1 6afec0481585464c8c8c2a719ec2d180e87d34ca
SHA512 9252a036b68c724915689abd75eaebfa2ddd240d0b12323c0b14072bb69080492abd00a7293d4c2b1de34ca50f432cd6a9f8b9abc1d54c89c366ed133e8acd12
SSDEEP 3072:jEGh0odl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG3lEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f0-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231e9-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231f8-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023024-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000231f8-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023024-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000231f8-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023024-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000231f8-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023024-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231f5-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231f5-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023024-45.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}\stubpath = "C:\\Windows\\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe"	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DF877D-6092-42a7-BAF6-D0EBC037C134}\stubpath = "C:\\Windows\\{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe"	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A5D30CC-F159-48fc-92CB-2839525750B7}	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A5D30CC-F159-48fc-92CB-2839525750B7}\stubpath = "C:\\Windows\\{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe"	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}\stubpath = "C:\\Windows\\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe"	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B53B7FF7-2795-4412-9D51-2FF25376877E}	{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DF877D-6092-42a7-BAF6-D0EBC037C134}	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}\stubpath = "C:\\Windows\\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe"	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{353C65B5-3363-4428-8D39-BC0EEDB92087}	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B53B7FF7-2795-4412-9D51-2FF25376877E}\stubpath = "C:\\Windows\\{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe"	{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{353C65B5-3363-4428-8D39-BC0EEDB92087}\stubpath = "C:\\Windows\\{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe"	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C238249A-F528-48d4-A7FD-569CBDF54E7B}	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}\stubpath = "C:\\Windows\\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe"	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}\stubpath = "C:\\Windows\\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe"	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E06402C-8A72-49fb-B66F-C3BC9065E669}	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E06402C-8A72-49fb-B66F-C3BC9065E669}\stubpath = "C:\\Windows\\{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe"	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}\stubpath = "C:\\Windows\\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe"	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C238249A-F528-48d4-A7FD-569CBDF54E7B}\stubpath = "C:\\Windows\\{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe"	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe

Executes dropped EXE 12 IoCs

pid	Process
3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
3704	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
2416	{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
2536	{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
File created	C:\Windows\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
File created	C:\Windows\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
File created	C:\Windows\{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
File created	C:\Windows\{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe	{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
File created	C:\Windows\{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
File created	C:\Windows\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
File created	C:\Windows\{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
File created	C:\Windows\{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
File created	C:\Windows\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
File created	C:\Windows\{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe
File created	C:\Windows\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
Token: SeIncBasePriorityPrivilege	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
Token: SeIncBasePriorityPrivilege	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
Token: SeIncBasePriorityPrivilege	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
Token: SeIncBasePriorityPrivilege	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
Token: SeIncBasePriorityPrivilege	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
Token: SeIncBasePriorityPrivilege	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
Token: SeIncBasePriorityPrivilege	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
Token: SeIncBasePriorityPrivilege	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
Token: SeIncBasePriorityPrivilege	3704	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
Token: SeIncBasePriorityPrivilege	2416	{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3164	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe	92
PID 1972 wrote to memory of 3164	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe	92
PID 1972 wrote to memory of 3164	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe	92
PID 1972 wrote to memory of 4244	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe	93
PID 1972 wrote to memory of 4244	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe	93
PID 1972 wrote to memory of 4244	1972	2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe	93
PID 3164 wrote to memory of 3524	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	94
PID 3164 wrote to memory of 3524	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	94
PID 3164 wrote to memory of 3524	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	94
PID 3164 wrote to memory of 3988	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	95
PID 3164 wrote to memory of 3988	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	95
PID 3164 wrote to memory of 3988	3164	{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe	95
PID 3524 wrote to memory of 4464	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	98
PID 3524 wrote to memory of 4464	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	98
PID 3524 wrote to memory of 4464	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	98
PID 3524 wrote to memory of 2720	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	99
PID 3524 wrote to memory of 2720	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	99
PID 3524 wrote to memory of 2720	3524	{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe	99
PID 4464 wrote to memory of 3956	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	101
PID 4464 wrote to memory of 3956	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	101
PID 4464 wrote to memory of 3956	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	101
PID 4464 wrote to memory of 948	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	102
PID 4464 wrote to memory of 948	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	102
PID 4464 wrote to memory of 948	4464	{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe	102
PID 3956 wrote to memory of 4764	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	103
PID 3956 wrote to memory of 4764	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	103
PID 3956 wrote to memory of 4764	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	103
PID 3956 wrote to memory of 2616	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	104
PID 3956 wrote to memory of 2616	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	104
PID 3956 wrote to memory of 2616	3956	{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe	104
PID 4764 wrote to memory of 432	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	105
PID 4764 wrote to memory of 432	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	105
PID 4764 wrote to memory of 432	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	105
PID 4764 wrote to memory of 1924	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	106
PID 4764 wrote to memory of 1924	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	106
PID 4764 wrote to memory of 1924	4764	{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe	106
PID 432 wrote to memory of 3188	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	107
PID 432 wrote to memory of 3188	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	107
PID 432 wrote to memory of 3188	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	107
PID 432 wrote to memory of 3888	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	108
PID 432 wrote to memory of 3888	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	108
PID 432 wrote to memory of 3888	432	{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe	108
PID 3188 wrote to memory of 2444	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	109
PID 3188 wrote to memory of 2444	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	109
PID 3188 wrote to memory of 2444	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	109
PID 3188 wrote to memory of 4380	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	110
PID 3188 wrote to memory of 4380	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	110
PID 3188 wrote to memory of 4380	3188	{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe	110
PID 2444 wrote to memory of 1884	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	111
PID 2444 wrote to memory of 1884	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	111
PID 2444 wrote to memory of 1884	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	111
PID 2444 wrote to memory of 708	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	112
PID 2444 wrote to memory of 708	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	112
PID 2444 wrote to memory of 708	2444	{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe	112
PID 1884 wrote to memory of 3704	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	113
PID 1884 wrote to memory of 3704	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	113
PID 1884 wrote to memory of 3704	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	113
PID 1884 wrote to memory of 2068	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	114
PID 1884 wrote to memory of 2068	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	114
PID 1884 wrote to memory of 2068	1884	{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe	114
PID 3704 wrote to memory of 2416	3704	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe	115
PID 3704 wrote to memory of 2416	3704	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe	115
PID 3704 wrote to memory of 2416	3704	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe	115
PID 3704 wrote to memory of 3084	3704	{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe	116

C:\Users\Admin\AppData\Local\Temp\2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-02_b0232d37fe2b51b95b47c38521700130_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
  C:\Windows\{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
    C:\Windows\{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
      C:\Windows\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Windows\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
        
        C:\Windows\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Windows\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
        
        C:\Windows\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
        
        C:\Windows\{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
        
        C:\Windows\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
        
        C:\Windows\{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
        
        C:\Windows\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
        
        C:\Windows\{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
        
        C:\Windows\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Windows\{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe
        
        C:\Windows\{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe
        13⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F1C16~1.EXE > nul
        13⤵
        
        PID:436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{353C6~1.EXE > nul
        12⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A9DAD~1.EXE > nul
        11⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A5D3~1.EXE > nul
        10⤵
        
        PID:708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0579E~1.EXE > nul
        9⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E064~1.EXE > nul
        8⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D2D4~1.EXE > nul
        7⤵
        
        PID:1924
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7023~1.EXE > nul
        6⤵
        
        PID:2616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BC815~1.EXE > nul
        5⤵
        
        PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C2382~1.EXE > nul
      4⤵
      PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{67DF8~1.EXE > nul
    3⤵
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe

Path C:\Windows\{0579EF20-28AE-487d-AE47-0E19EC75DC3B}.exe
Size 197KB
SHA256 918af9c37a84580c53b76ed7210bfc774e11df5ecd2a3a606b9f43964793dff8
MD5 a7fae826f80a6cd15d2cf53a2d146267
SHA1 1c5c1488727e497f1b706204d88da75fa7375cc6
SHA512 2462af8c44eab433917bfaaeadafb59f46d3900f3108e25f7fe673e86678dcd175eea09ceebea43a01429769fcd00cf4cb3269dad40eefe1745529d0f9d480f3
SSDEEP 3072:jEGh0oMIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGyIlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe

Path C:\Windows\{1A5D30CC-F159-48fc-92CB-2839525750B7}.exe
Size 197KB
SHA256 3de52456c346f96fc40db9bdd1d5f46e234ecb6bc1e5fe2dda8f348b9b7953d9
MD5 512fb2b3cbeb203549e8f68104a6e949
SHA1 e4723a21ab55f65dcc36623950bd099f33d91426
SHA512 dc654a989afd6931be55485a13165e1c4e75a555c95afc690980dc9baec652de24266dbad92b6453ac008d847d4cb9b2dea258561233b13669c5c48f0ce3c919
SSDEEP 3072:jEGh0otl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGvlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe

Path C:\Windows\{353C65B5-3363-4428-8D39-BC0EEDB92087}.exe
Size 197KB
SHA256 1d21a02e0b20a5b65db486252736882208acf653159612dd6847b2bae2b75ab9
MD5 b51e5628bbc4aa206c8fa4c18400f9be
SHA1 fb3d8577b5e34a70eff10846ba495e5b8fb2426d
SHA512 25c883f7d47c6086bbca3209f55951517ace211ef307dfe349897cb43f6bb167bfd4b45942abf8259e94794932fad60c60d4abff18a83f59a3b73330cea2b16a
SSDEEP 3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGglEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe

Path C:\Windows\{67DF877D-6092-42a7-BAF6-D0EBC037C134}.exe
Size 197KB
SHA256 fcf00749db5cfc67397997450b65b31022272d82f140310f41e1424a91a5fc1c
MD5 80f85480f03c56ce0687b85ba2517b0a
SHA1 577e31d90daebef2376ddb351722d987dc645cda
SHA512 be578682173f47b7a0ad9055f7db1a111d653731f237c469d7389456a9a5aed68b73218c9f4eb70488ace7a940d35de3352885504184decf7ec18cbc64245d24
SSDEEP 3072:jEGh0o2l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGslEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe

Path C:\Windows\{6D2D4148-36FC-4cca-B9C5-C70B334F9F5A}.exe
Size 197KB
SHA256 dc20c5f53d3591a0a490787c851bc1f64ab0b0bc26aed56eba16c39f541001f4
MD5 37aaa97b5cc7c96083af562658ff754b
SHA1 86a29fea616ae79a6a75a036052aadb1abb35aab
SHA512 708814e6416c9116475c321179a7112e0f34f224a4c22f0eec41576bd93a85fe03dbb91a2aae25b3a3ab21e14169d19513ea6e83b8189d42cbb4386d002be3e0
SSDEEP 3072:jEGh0oAl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGilEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe

Path C:\Windows\{9E06402C-8A72-49fb-B66F-C3BC9065E669}.exe
Size 197KB
SHA256 f888e4596872a2bfb52c0441eb77590ee3674a56e85a0b265aca85131bce5ca6
MD5 a02a73e95d6eecc4d443b209d1cfa7a8
SHA1 f9a09fd8cb05e21987bd96b7b5aeb9a098f781d2
SHA512 81b81031d47a270a28a8ecb1ebf7670f023f3dcacd0efba6986a54f83ed5183adf0a49ec3b6b53df4960d7a4c91d9cb7714b9324d52d85b9aa35c0763902dac5
SSDEEP 3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGTlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe

Path C:\Windows\{A9DAD539-7C68-4db7-87DB-32F0A94FDDC5}.exe
Size 197KB
SHA256 09a9dbdd879aaafef6123f85b643ecf6e4c5d1e62e868e455eed05dfc9b2eff9
MD5 11d50477e3435454e8b4b71a7fc9f7ee
SHA1 9f064e0eb0d10724aabcccb9b2960f293982df97
SHA512 b27cecad35be609b7cac69d14310f0d13d2b6f7b086c3271734a2ef75130a141bddc0927e46bb364c984940f1fdf6f894bbec24be30e7452e680d37e5934a50a
SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGdlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe

Path C:\Windows\{B53B7FF7-2795-4412-9D51-2FF25376877E}.exe
Size 197KB
SHA256 8e1db1c0d6bc868dd1cd1285834d04ecc6e1e69038c723343762c0a7170ee7c9
MD5 1066cd035892aaa2aefa593243967da2
SHA1 5fa42e1346b3221baaf228335790d5685dcf13af
SHA512 bcf833ef7dd13939b45e2efdc79da21882ff08834e889a66179270f303227fd604cd987047b128a7067e25e6534506a5666d9ec4bb60f9d66a3f28eab538f315
SSDEEP 3072:jEGh0orl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG1lEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe

Path C:\Windows\{BC8158DF-8D6A-4f7a-84DC-7C35CBFCB9D9}.exe
Size 197KB
SHA256 4de5b19839e1a5fc4d4e554855faddb8ee8ef46d6c6351017c3660263da5c92d
MD5 10aa26026429358bff5cc91d38c1c0f5
SHA1 50e5059fdd3239fb35659e154593e58f35394959
SHA512 cb6c3f0401e8fa782b2ed30e828a7032f937fa10ebac027fa3fd447d2228522bdd585bb5af25cd6b06d40c5c6cd75ab05883a81fe14cc5e48ffb5678f2749915
SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGVlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe

Path C:\Windows\{C238249A-F528-48d4-A7FD-569CBDF54E7B}.exe
Size 197KB
SHA256 0265e212c9861b2cde66c47b96f893bc66e9ada1730b9c8a7279f404bb42e565
MD5 931deae4dfb8dfe66d6d3146e9c9de87
SHA1 cfe6e21163a13d9019831b4a2c749edc2959b1b6
SHA512 58be9ded67830126ba7bb52a3ee77f90039a88ddbab9327b00a6298276adc41b59ae05f48f9ebfb88228f695a2f2bf588a75925118e4b8109edc270945e2f41d
SSDEEP 3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGxlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe

Path C:\Windows\{D7023F25-7179-4c19-A7EA-B63099C2A6CA}.exe
Size 197KB
SHA256 997a3a9ed2fcd9723e69b9ad48e9c570de5ea8b4e4c4b125071f21d325fd8135
MD5 bc165d8c26b609d9d98a21c6246cb33d
SHA1 a12eee5a8c6319860ef6229a7d3dced1862cce0f
SHA512 5c9b799c226ebad1a09b642a74db2f200fe350f2099d76fd0cec5d77ebffcd5cf7f44ddc8f64747ea14f866757e686e5a1e43837bcae2f84f65766bd4dbfd9b8
SSDEEP 3072:jEGh0oBl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGvlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe

Path C:\Windows\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
Size 197KB
SHA256 e59803d02e26b50b4b17b708227dd88bc2e3fb0aaba6acf74ea8c03c918a2108
MD5 09c81eacd7adabced0d7f9fb9b3edc73
SHA1 706f997a914ac8c822c36efa0b1e843502b7720d
SHA512 e8933be67df90718ca08486a8c04afad39b52b74dfbd2f0d984f6f5debd6fcd75da0e848455311a7eb9a3c89cc5a86aceabf431d6cdc732f14b6f310e7464086
SSDEEP 3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGAlEeKcAEca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe

Path C:\Windows\{F1C16EFE-8924-496e-8C55-C2C8AC8A3140}.exe
Size 52KB
SHA256 3f9af5b75c379fb9d50c0338c0eb698c8cbdda0683f4467fc8688f390178e502
MD5 d6d37c13203a56e0be5902fd17a5026f
SHA1 eeb6ba18a2729f8f2d3384b515c560779f9aba13
SHA512 ca83b6a4a64657055e2cc9c01bb2c6e7ea94384ac21462c1183acb2f52952510da2ef9de68a0573eedec5618c56cc7efa9977c0f994e15d8058522c37a3ff928
SSDEEP 192:DbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEY04/CFxyNhoy5t:DbLwOs8AHsc4sMfwhKQLroy4/CFsrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads