07a0cc54e1a1c41d50eb5158096f70701772cd86ea1455b194453df919b1dcc4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe
Size 408KB
Sample240302-q2zx1sec33
SHA256 07a0cc54e1a1c41d50eb5158096f70701772cd86ea1455b194453df919b1dcc4
MD5 bbdb76c4a8d98e6b8fcaba3796980b38
SHA1 2880b3a25a6b2cb656b180711ff73b4b2e0ff996
SHA512 82722f7ccddfac44f8cb0527737353371ef3edf99b9d48d9779d020c2b7af26cd0d7a8489834915d868855f2968ce2e14afdf742a50d8f0b75d74cd4dc5681b8
SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGlldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f7-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231f7-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231f0-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002310a-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002310b-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002310a-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002310b-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002310a-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023100-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002310a-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023100-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002310a-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023100-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}\stubpath = "C:\\Windows\\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe"	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C0CE608-F1A9-424b-8D37-09839E60A018}\stubpath = "C:\\Windows\\{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe"	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}\stubpath = "C:\\Windows\\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe"	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E60178AB-A81E-42fd-A504-D7D83CD17130}	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}	{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4023B232-955D-41ae-998F-6E12841DA114}	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4023B232-955D-41ae-998F-6E12841DA114}\stubpath = "C:\\Windows\\{4023B232-955D-41ae-998F-6E12841DA114}.exe"	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}\stubpath = "C:\\Windows\\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe"	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D84D418F-9451-4928-85E6-8B6717B87F8E}	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D84D418F-9451-4928-85E6-8B6717B87F8E}\stubpath = "C:\\Windows\\{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe"	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}\stubpath = "C:\\Windows\\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe"	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE50DD89-A208-42cf-85FC-CE69A282D850}	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E60178AB-A81E-42fd-A504-D7D83CD17130}\stubpath = "C:\\Windows\\{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe"	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1666159C-0FC1-4329-AA95-5BA13E968938}	{4023B232-955D-41ae-998F-6E12841DA114}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE50DD89-A208-42cf-85FC-CE69A282D850}\stubpath = "C:\\Windows\\{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe"	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}\stubpath = "C:\\Windows\\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe"	{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1666159C-0FC1-4329-AA95-5BA13E968938}\stubpath = "C:\\Windows\\{1666159C-0FC1-4329-AA95-5BA13E968938}.exe"	{4023B232-955D-41ae-998F-6E12841DA114}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}\stubpath = "C:\\Windows\\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe"	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C0CE608-F1A9-424b-8D37-09839E60A018}	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe

Executes dropped EXE 12 IoCs

pid	Process
3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe
3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
3996	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
1448	{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
940	{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
File created	C:\Windows\{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
File created	C:\Windows\{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
File created	C:\Windows\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
File created	C:\Windows\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe
File created	C:\Windows\{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	{4023B232-955D-41ae-998F-6E12841DA114}.exe
File created	C:\Windows\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
File created	C:\Windows\{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
File created	C:\Windows\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe	{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
File created	C:\Windows\{4023B232-955D-41ae-998F-6E12841DA114}.exe	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
File created	C:\Windows\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
File created	C:\Windows\{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
Token: SeIncBasePriorityPrivilege	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe
Token: SeIncBasePriorityPrivilege	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
Token: SeIncBasePriorityPrivilege	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
Token: SeIncBasePriorityPrivilege	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
Token: SeIncBasePriorityPrivilege	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
Token: SeIncBasePriorityPrivilege	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
Token: SeIncBasePriorityPrivilege	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
Token: SeIncBasePriorityPrivilege	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
Token: SeIncBasePriorityPrivilege	3996	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
Token: SeIncBasePriorityPrivilege	1448	{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3856	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe	92
PID 3676 wrote to memory of 3856	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe	92
PID 3676 wrote to memory of 3856	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe	92
PID 3676 wrote to memory of 3508	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe	93
PID 3676 wrote to memory of 3508	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe	93
PID 3676 wrote to memory of 3508	3676	2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe	93
PID 3856 wrote to memory of 4484	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	94
PID 3856 wrote to memory of 4484	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	94
PID 3856 wrote to memory of 4484	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	94
PID 3856 wrote to memory of 3628	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	95
PID 3856 wrote to memory of 3628	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	95
PID 3856 wrote to memory of 3628	3856	{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe	95
PID 4484 wrote to memory of 3712	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe	100
PID 4484 wrote to memory of 3712	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe	100
PID 4484 wrote to memory of 3712	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe	100
PID 4484 wrote to memory of 2732	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe	101
PID 4484 wrote to memory of 2732	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe	101
PID 4484 wrote to memory of 2732	4484	{4023B232-955D-41ae-998F-6E12841DA114}.exe	101
PID 3712 wrote to memory of 4368	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	102
PID 3712 wrote to memory of 4368	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	102
PID 3712 wrote to memory of 4368	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	102
PID 3712 wrote to memory of 4012	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	103
PID 3712 wrote to memory of 4012	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	103
PID 3712 wrote to memory of 4012	3712	{1666159C-0FC1-4329-AA95-5BA13E968938}.exe	103
PID 4368 wrote to memory of 2896	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	104
PID 4368 wrote to memory of 2896	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	104
PID 4368 wrote to memory of 2896	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	104
PID 4368 wrote to memory of 3956	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	105
PID 4368 wrote to memory of 3956	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	105
PID 4368 wrote to memory of 3956	4368	{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe	105
PID 2896 wrote to memory of 3088	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	106
PID 2896 wrote to memory of 3088	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	106
PID 2896 wrote to memory of 3088	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	106
PID 2896 wrote to memory of 2152	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	107
PID 2896 wrote to memory of 2152	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	107
PID 2896 wrote to memory of 2152	2896	{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe	107
PID 3088 wrote to memory of 3644	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	108
PID 3088 wrote to memory of 3644	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	108
PID 3088 wrote to memory of 3644	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	108
PID 3088 wrote to memory of 4088	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	109
PID 3088 wrote to memory of 4088	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	109
PID 3088 wrote to memory of 4088	3088	{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe	109
PID 3644 wrote to memory of 1476	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	113
PID 3644 wrote to memory of 1476	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	113
PID 3644 wrote to memory of 1476	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	113
PID 3644 wrote to memory of 1292	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	114
PID 3644 wrote to memory of 1292	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	114
PID 3644 wrote to memory of 1292	3644	{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe	114
PID 1476 wrote to memory of 1508	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	115
PID 1476 wrote to memory of 1508	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	115
PID 1476 wrote to memory of 1508	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	115
PID 1476 wrote to memory of 4152	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	116
PID 1476 wrote to memory of 4152	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	116
PID 1476 wrote to memory of 4152	1476	{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe	116
PID 1508 wrote to memory of 3996	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	117
PID 1508 wrote to memory of 3996	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	117
PID 1508 wrote to memory of 3996	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	117
PID 1508 wrote to memory of 2460	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	118
PID 1508 wrote to memory of 2460	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	118
PID 1508 wrote to memory of 2460	1508	{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe	118
PID 3996 wrote to memory of 1448	3996	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe	119
PID 3996 wrote to memory of 1448	3996	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe	119
PID 3996 wrote to memory of 1448	3996	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe	119
PID 3996 wrote to memory of 3716	3996	{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe	120

C:\Users\Admin\AppData\Local\Temp\2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-02_bbdb76c4a8d98e6b8fcaba3796980b38_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
  C:\Windows\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\{4023B232-955D-41ae-998F-6E12841DA114}.exe
    C:\Windows\{4023B232-955D-41ae-998F-6E12841DA114}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
      C:\Windows\{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
        
        C:\Windows\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
      - C:\Windows\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
        
        C:\Windows\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
        
        C:\Windows\{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
        
        C:\Windows\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
        
        C:\Windows\{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
        
        C:\Windows\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
        
        C:\Windows\{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
        
        C:\Windows\{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Windows\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe
        
        C:\Windows\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe
        13⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E6017~1.EXE > nul
        13⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE50D~1.EXE > nul
        12⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EF1F0~1.EXE > nul
        11⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D84D4~1.EXE > nul
        10⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2BD53~1.EXE > nul
        9⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9C0CE~1.EXE > nul
        8⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DCDBD~1.EXE > nul
        7⤵
        
        PID:2152
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDC2F~1.EXE > nul
        6⤵
        
        PID:3956
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16661~1.EXE > nul
        5⤵
        
        PID:4012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{4023B~1.EXE > nul
      4⤵
      PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FF80A~1.EXE > nul
    3⤵
    PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1666159C-0FC1-4329-AA95-5BA13E968938}.exe

Path C:\Windows\{1666159C-0FC1-4329-AA95-5BA13E968938}.exe
Size 408KB
SHA256 d372c5d83c112fbc4e1b8ed7cca68dbfd76a2c9fef79843ed28dc472a8519dc4
MD5 513b252991f83df36e89b9cd831b2536
SHA1 567d9e9efa113d80c4f84cf3a88ed191e51ef53b
SHA512 12462a9bf0455b9435b7b88c4c02c7faf9d2c7c5d7437775887c494374d601815482f26c83abe49051b83af59bd19d9e5fa82283bff70c72927c6484e74acba1
SSDEEP 3072:CEGh0oFl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGLldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe

Path C:\Windows\{2BD53DE2-8307-42c8-BF1B-76D1430BFA89}.exe
Size 408KB
SHA256 d36395f4799d7e1775c95de490404c7bbfb19c8ed312f65b2305d684dcfb91c2
MD5 51f67112e300ebb6f66fb2ad6168ec3b
SHA1 5562355a19dd79dbc22c7b8827aa1ff5c60e4953
SHA512 af8befeac3b17e992c689e232fa803e0f4dbf6b11145cd1fd812dbb5d4e58dfe630c31310649b69598e56ee92070949db6b299a65ee855d78dd8f152229bbc70
SSDEEP 3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe

Path C:\Windows\{34F9A2AF-0DFB-4e7f-A527-99E04E9FE5B1}.exe
Size 408KB
SHA256 b45c91f1b593b747d3231ebd14e1917a30d67ff5b8c18681de6acb98a7600449
MD5 60705d918c0ed2d6391d9a8eb53b39fd
SHA1 e6cc835b92f5851115ce418852318925740b13a0
SHA512 0081ba2177e67c264ced79794bc9773a045e566c9e894c8254889f93128cfed39f857a7f2b66d2284d47eb46b403116db000168600e5517d396154b8447ed13a
SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGlldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4023B232-955D-41ae-998F-6E12841DA114}.exe

Path C:\Windows\{4023B232-955D-41ae-998F-6E12841DA114}.exe
Size 408KB
SHA256 2ccfa13b6d4a170c41656e485c2c18aae3fefd362338079135fc0bc75010d20e
MD5 3f8f53161c14fba69bc9917f5a8fc1c1
SHA1 278847231748237f761df79618b36217446112c6
SHA512 7ec94efaa9d3a2b6708c2e8efbae2cd2420cbdddbcfce13ba90da70e5d0a2b7091088388b022de090849bdc45e7e8dcebca5680a477fa8dc27502af24fa86952
SSDEEP 3072:CEGh0o8l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGGldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe

Path C:\Windows\{9C0CE608-F1A9-424b-8D37-09839E60A018}.exe
Size 408KB
SHA256 e1a00f95e241b4f640c909d3e3fd5670efe8384808e49ec7ba4bf6e159aa9747
MD5 121e8fbb4bc5721e9374f70557d3fa5e
SHA1 b9b9b1df8c7cc7b2bd1dd4cb40514575c36d8ade
SHA512 97afc1a1c4bbc806dfe5b63c01bb2193d6e335725c6f3d21154d5e99607be9494e5e7bdace61b3f55b557b1157af6f53b83c8ead9129d3218b9bae833970a546
SSDEEP 3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe

Path C:\Windows\{BDC2FA7A-A1ED-43e8-B3FB-BE24404AAE05}.exe
Size 408KB
SHA256 5cf421f1834265f8020e326c659c8434c87c066f691ac716bed117f752aa04f8
MD5 0556b4a8ba282c43394cbe6c07ae6745
SHA1 9743701ee6f27022c9ad53785bb86f886d5388cd
SHA512 f6dfdef56dae349d8f406a010a52bb0cef9cc16d8c643cceb5106161876f988b7152e79d8a954e6fefaaded22a5d3aab81a2aed1a4afa3cb2a1665b566bead10
SSDEEP 3072:CEGh0onl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGFldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe

Path C:\Windows\{CE50DD89-A208-42cf-85FC-CE69A282D850}.exe
Size 408KB
SHA256 fe103c46373bbcfc438c23456074b419dc29ece21e624f044a5a2a5ade65ba4d
MD5 20fac57bf0771bd0ada3e3e09247f58f
SHA1 8bdffc7c98e1c0270367f221dd8b5e8422c06c15
SHA512 0d5a4acd57d0512e6dd6d250711550a730cb2a4187675cdd573044f1bb214d84850b4ac4474956ce0eb91b77e884ca24255d77f541927daacfa81b65a0e5e2b0
SSDEEP 3072:CEGh0o5l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGzldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe

Path C:\Windows\{D84D418F-9451-4928-85E6-8B6717B87F8E}.exe
Size 408KB
SHA256 b1d6ccfbd15a6c4818d0453cea0e39dcdceb0f7da95ec2f6e77c6c0863d35937
MD5 deb426a46ae69517ed3ecee13d8d27ce
SHA1 3de2ba489bd279a8eb62d071104dcaba4bc3c36b
SHA512 d4884f38129b3dab4f9dfa1af6f703db6ab0a2850fec6984d44d9b8ad032f115130cae1bdccfec28e1e63e3762010afe5a3e14f2743bd2d6703a4848404fd27d
SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGEldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe

Path C:\Windows\{DCDBDC04-718F-457f-A1BE-4C83C80F5A5C}.exe
Size 408KB
SHA256 aac8176428af3c482cc522ff468b1f08b32876904b6f943c3b93d88bd2eed4bb
MD5 3c326239440aedc9f9939c5233009d17
SHA1 9283400be5f48e24d3a7eb6b29dc6134067fff2a
SHA512 f5126faf96f030a4343e124ee01908c50b422e0a6d7e9174345f38e1425628ca49e9c6e1eed7892b7ad862d620b3d8207ae300669bd4c9fe2c466b42ac6ae8ab
SSDEEP 3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGMldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe

Path C:\Windows\{E60178AB-A81E-42fd-A504-D7D83CD17130}.exe
Size 408KB
SHA256 9f32eb1164e3b61b1d4b6f28fecda14fc890e58713d82fdcb612e93ca3a843d9
MD5 885ef0f84c8e8387891e4c8b209a93d2
SHA1 e9c3a2f9c32612366a99ac266455f958ca97a4ce
SHA512 2f550d1dd129d3966821ed3b7b61fdea72423bfd9ce850c784959f161eaa33f378c2aa4803c28c972ea1833d5d94c4dde1f75a6178d1b77e6900f39a98bbbf35
SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGoldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe

Path C:\Windows\{EF1F0F2C-2F6A-4456-ABBE-BDDF01A27E11}.exe
Size 408KB
SHA256 74e3b339e45c1893a81f3b17d33cb51dc56726ffecb4e7c37d88cbd16994b235
MD5 7a9af669d35b0aff58cd42c867cb8d2f
SHA1 1279b525795927dce50e2f703d923b13651fa0a7
SHA512 83f408a7794a133561d9c380f95719200177d3ec1642df0c6a86343d8bcdc542589b0676e238ca95e8546cedadebf871f1ded1b60b6981790246ea4fc0d4f14a
SSDEEP 3072:CEGh0otl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe

Path C:\Windows\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
Size 408KB
SHA256 f274efc718eb46e9832629a11e90e12b8899ce9e437f1e23f31a6b9fc3595e73
MD5 20b60274956335a4ad2d4c9bb1e1883f
SHA1 0d92de6890ec6345c51f084aed31a487f12668b3
SHA512 bc0c489214ff40c81b29bbb5fde15201a74c630d45a95a92592d109a375a9e918eeb90fe1095c1b26f67ba3698e700f214c206c9b56c1f4f55ed82e50eeb6090
SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGMldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe

Path C:\Windows\{FF80A7F4-6FF4-4fd8-915B-5FEF77C85E82}.exe
Size 192KB
SHA256 3989f179119bbda0e85b1708098a6f41fdb0dcb8a775ea2b0b49bd700084803a
MD5 4d111eb44795ee1148d49f2be375287b
SHA1 e195931064206eef0520f4d4612dd2c09bf19b18
SHA512 69e09cee7bb00f80600d83d3df7bc325965bc4b413c073c350e7b87e5036f76e23262e6940f49e1ce0b21afc694994db72132238d3d32942b62efe007ba9ff84
SSDEEP 1536:CEGh0o6l35IRVhLc5nvNseJ5Qef7BudMeNzVg355Hill5IPrH/HqOYGmT:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads