6ecaed0eae401893c6dc6dc89e6eb170faeee2fb85299311fb6824a8e434ba71

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe
Size 408KB
Sample240302-q95s8sec93
SHA256 6ecaed0eae401893c6dc6dc89e6eb170faeee2fb85299311fb6824a8e434ba71
MD5 eb1867d29a1b338ee1d85d7fd9ea18f6
SHA1 c326c1b34ed645777b5ea7364fbb69752519294e
SHA512 2415084c1d2dccde462934df483b885844d6299d8832afd7e7e76b5bffd1becd4f885699c55fb1105262d77b046434cc5d8cbf5dd2a0f23fc93ce3a1f3d4328e
SSDEEP 3072:CEGh0oel3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGUldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 14 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023206-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023207-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002320f-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023207-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002320f-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023207-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023207-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002320f-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023207-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002320f-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023207-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002320b-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002320b-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023207-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51741513-8E42-4298-9808-BD2D50D6AAA0}\stubpath = "C:\\Windows\\{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe"	{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A3C2CC3-1936-41d4-B323-220E6205C21E}\stubpath = "C:\\Windows\\{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe"	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78165623-3897-474c-A8AA-AE7C9861FEBF}	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51741513-8E42-4298-9808-BD2D50D6AAA0}	{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}\stubpath = "C:\\Windows\\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe"	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}\stubpath = "C:\\Windows\\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe"	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{188DD06F-A1EB-4b73-A6CD-EF594882C350}	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{188DD06F-A1EB-4b73-A6CD-EF594882C350}\stubpath = "C:\\Windows\\{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe"	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}\stubpath = "C:\\Windows\\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe"	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFA8894E-A617-4e5f-B042-7B2441D210E7}\stubpath = "C:\\Windows\\{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe"	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}\stubpath = "C:\\Windows\\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe"	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A3C2CC3-1936-41d4-B323-220E6205C21E}	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}\stubpath = "C:\\Windows\\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe"	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}\stubpath = "C:\\Windows\\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe"	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFA8894E-A617-4e5f-B042-7B2441D210E7}	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78165623-3897-474c-A8AA-AE7C9861FEBF}\stubpath = "C:\\Windows\\{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe"	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}\stubpath = "C:\\Windows\\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe"	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe

Executes dropped EXE 12 IoCs

pid	Process
4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
4088	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
4024	{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
1276	{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
File created	C:\Windows\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
File created	C:\Windows\{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
File created	C:\Windows\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
File created	C:\Windows\{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
File created	C:\Windows\{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe	{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
File created	C:\Windows\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe
File created	C:\Windows\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
File created	C:\Windows\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
File created	C:\Windows\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
File created	C:\Windows\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
File created	C:\Windows\{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
Token: SeIncBasePriorityPrivilege	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
Token: SeIncBasePriorityPrivilege	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
Token: SeIncBasePriorityPrivilege	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
Token: SeIncBasePriorityPrivilege	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
Token: SeIncBasePriorityPrivilege	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
Token: SeIncBasePriorityPrivilege	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
Token: SeIncBasePriorityPrivilege	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
Token: SeIncBasePriorityPrivilege	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
Token: SeIncBasePriorityPrivilege	4088	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
Token: SeIncBasePriorityPrivilege	4024	{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4940	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe	95
PID 3708 wrote to memory of 4940	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe	95
PID 3708 wrote to memory of 4940	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe	95
PID 3708 wrote to memory of 5092	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe	96
PID 3708 wrote to memory of 5092	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe	96
PID 3708 wrote to memory of 5092	3708	2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe	96
PID 4940 wrote to memory of 2036	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	97
PID 4940 wrote to memory of 2036	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	97
PID 4940 wrote to memory of 2036	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	97
PID 4940 wrote to memory of 1012	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	98
PID 4940 wrote to memory of 1012	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	98
PID 4940 wrote to memory of 1012	4940	{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe	98
PID 2036 wrote to memory of 1008	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	102
PID 2036 wrote to memory of 1008	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	102
PID 2036 wrote to memory of 1008	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	102
PID 2036 wrote to memory of 4700	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	103
PID 2036 wrote to memory of 4700	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	103
PID 2036 wrote to memory of 4700	2036	{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe	103
PID 1008 wrote to memory of 4576	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	104
PID 1008 wrote to memory of 4576	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	104
PID 1008 wrote to memory of 4576	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	104
PID 1008 wrote to memory of 2892	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	105
PID 1008 wrote to memory of 2892	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	105
PID 1008 wrote to memory of 2892	1008	{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe	105
PID 4576 wrote to memory of 3288	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	106
PID 4576 wrote to memory of 3288	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	106
PID 4576 wrote to memory of 3288	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	106
PID 4576 wrote to memory of 4340	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	107
PID 4576 wrote to memory of 4340	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	107
PID 4576 wrote to memory of 4340	4576	{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe	107
PID 3288 wrote to memory of 3716	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	108
PID 3288 wrote to memory of 3716	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	108
PID 3288 wrote to memory of 3716	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	108
PID 3288 wrote to memory of 3876	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	109
PID 3288 wrote to memory of 3876	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	109
PID 3288 wrote to memory of 3876	3288	{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe	109
PID 3716 wrote to memory of 996	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	110
PID 3716 wrote to memory of 996	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	110
PID 3716 wrote to memory of 996	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	110
PID 3716 wrote to memory of 4188	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	111
PID 3716 wrote to memory of 4188	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	111
PID 3716 wrote to memory of 4188	3716	{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe	111
PID 996 wrote to memory of 3660	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	112
PID 996 wrote to memory of 3660	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	112
PID 996 wrote to memory of 3660	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	112
PID 996 wrote to memory of 2676	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	113
PID 996 wrote to memory of 2676	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	113
PID 996 wrote to memory of 2676	996	{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe	113
PID 3660 wrote to memory of 4000	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	114
PID 3660 wrote to memory of 4000	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	114
PID 3660 wrote to memory of 4000	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	114
PID 3660 wrote to memory of 3100	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	115
PID 3660 wrote to memory of 3100	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	115
PID 3660 wrote to memory of 3100	3660	{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe	115
PID 4000 wrote to memory of 4088	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	116
PID 4000 wrote to memory of 4088	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	116
PID 4000 wrote to memory of 4088	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	116
PID 4000 wrote to memory of 740	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	117
PID 4000 wrote to memory of 740	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	117
PID 4000 wrote to memory of 740	4000	{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe	117
PID 4088 wrote to memory of 4024	4088	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe	118
PID 4088 wrote to memory of 4024	4088	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe	118
PID 4088 wrote to memory of 4024	4088	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe	118
PID 4088 wrote to memory of 3220	4088	{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-02_eb1867d29a1b338ee1d85d7fd9ea18f6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
  C:\Windows\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
    C:\Windows\{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
      C:\Windows\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Windows\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
        
        C:\Windows\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4576
      - C:\Windows\{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
        
        C:\Windows\{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
        
        C:\Windows\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
        
        C:\Windows\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
        
        C:\Windows\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
        
        C:\Windows\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
        
        C:\Windows\{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
        
        C:\Windows\{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
        
        C:\Windows\{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe
        
        C:\Windows\{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe
        13⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{78165~1.EXE > nul
        13⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DFA88~1.EXE > nul
        12⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A95AE~1.EXE > nul
        11⤵
        
        PID:740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5581E~1.EXE > nul
        10⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D44D~1.EXE > nul
        9⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{871C4~1.EXE > nul
        8⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3A3C2~1.EXE > nul
        7⤵
        
        PID:3876
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F66FE~1.EXE > nul
        6⤵
        
        PID:4340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA141~1.EXE > nul
        5⤵
        
        PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{188DD~1.EXE > nul
      4⤵
      PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{20C27~1.EXE > nul
    3⤵
    PID:1012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe

Path C:\Windows\{188DD06F-A1EB-4b73-A6CD-EF594882C350}.exe
Size 408KB
SHA256 69bab3060d7d189753e19bcb63b3a0d00bfdaafbdec58a7e113eaad2661fa747
MD5 27c26c1f892ff3358f966c263fd863e5
SHA1 3dfe259460691f45c69b8a3704b9f9af3b1764ec
SHA512 97763887baafa54a7e6791e07c8d072fa79df0524bf19cb1df4959a73e5683a0f3233b3f583d9c3b71b08050aef0747d32e9fe9de2315c06363eb6702b427a9b
SSDEEP 3072:CEGh0o8l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGSldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe

Path C:\Windows\{1D44DFAE-25CA-4f94-978F-F34A8A3D386D}.exe
Size 408KB
SHA256 358cd7fe810b58666f7aaee1e2b7de822f1064e8eaeb6f95dbe4a142c927e9df
MD5 1acd3157b13ace41632a0c0e5f442d8c
SHA1 0e293241cd8d668e534b202b9b61f2fb9629e0fd
SHA512 9f34aa76c945c2e01d22d3739aabaa822161f9f5dbf386382ff8b71bde32bb4b73d56949cd5faf858d460b37b82bdb016de558b1347c91d711e57817aabd3aa8
SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe

Path C:\Windows\{20C27253-A6FD-462d-AFB2-BFC4FD794BC0}.exe
Size 408KB
SHA256 9344aa9f156436d1af151a74e55d9332086152627f6d61185e5703be1364ca07
MD5 13d209ad217f674f212410a77c467690
SHA1 1fe33b54a55dc52b98324768fa62b33065cc6abf
SHA512 a76a161fc1898c4d0616dbb07c2c1dec9e45699022dee1123a974f7b3a18a2b877abceba3d6bb5063940727ff0f8b21098604decf54478877dfe93682280cca3
SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGgldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe

Path C:\Windows\{3A3C2CC3-1936-41d4-B323-220E6205C21E}.exe
Size 408KB
SHA256 b5c4f1183a29236ba119882a2d7c0a635a06f339b024b44c9fff7a3e07d2c421
MD5 ea7634743b09b24fbcfa4b50e64f8054
SHA1 fec83a985bee25f6ce874108f6f841ae6ab486db
SHA512 e7427124417389f23b71ccac04eb9afcca7c942f954fbb5bdabd7cb861f16b61f36eef8718d2d0dc84bff887861ff17a8f55528c91aff58b883ea708bfe575e6
SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGuldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe

Path C:\Windows\{51741513-8E42-4298-9808-BD2D50D6AAA0}.exe
Size 408KB
SHA256 1f4b6129a78ee54153b9dc0966a5cc78b6f5ac48f95aae97bc2f0964c755689c
MD5 d7f3609b6089c2a4c2a77c0d8a684b66
SHA1 565dd96f72b4305ca03161e1d9e0036c397d6718
SHA512 fe4eedc1df9eb916b678c0030cfa9e4c659cc216e05900de064039238acdded8a4637f8ca0731e16731c8bb8011a2a3fee11e1ffcba7691fe11ea4d5f6cd21e9
SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGoldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe

Path C:\Windows\{5581E2B5-5E2F-428b-A1EC-DDB748D55E1A}.exe
Size 408KB
SHA256 657d17acf6a92c0cf98ff90e4782bd8a2729036a4c22ba047b95b725c9adb612
MD5 3b0f76ea2519158659cf5b926af90517
SHA1 16c2aada0ed78759826fa641e0bd6a6b095c05d7
SHA512 ed43b75ae90d27066184f3956e2c75b5d927e21585b5dfa69cf930d68a6f6b8eb9d0c5a963b621868f6a000cffc5cee2a3efe414da7121c5defbf29df345b87d
SSDEEP 3072:CEGh0oPl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGRldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe

Path C:\Windows\{78165623-3897-474c-A8AA-AE7C9861FEBF}.exe
Size 408KB
SHA256 8f8ec09c546fce4a492e35d6b9edab878474b01d0c1f8010d6714b8b4127e3d6
MD5 f2e5af8207baae3f2a39e344cfeea897
SHA1 42bc32c952c5413a8293e89a8b1da42ea6f55222
SHA512 5f86d4d6cb59a1d7612bed19f538e2ab31112cd53fffe87a8274cfa00ecd51ed5b6ce4da4721f2b973f38364973a087eee3452d9c91a549eab2861952379f17d
SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGbldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe

Path C:\Windows\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
Size 256KB
SHA256 104a3bd6ea4efc318808ca4ae00f8c177b4258396469e293ed7266cf20a6409a
MD5 a8eb5699ea437c60e5aca621884cb454
SHA1 9d175cd4c525eee4e00e1c12f8e1943b68631f2c
SHA512 2c60cc6183a660787d291aca1ca09f43704fb18bd740c945b83f62b190fc21263388773f534f271b104ff1582f277d6d999dfb0754489b021b263c5ea552dcf7
SSDEEP 3072:CEGh0osl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQED:CEGKldOe2MUVg3vTeKcAED
MD5 SHA1 SHA512 SSDEEP

Submit Download

{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe

Path C:\Windows\{871C4DDE-F43C-42b7-8FE0-835B73CF52E9}.exe
Size 130KB
SHA256 95e899366d0d3ef8a39f81c105da4afe96c7395b00416f3393e31ca73f462b26
MD5 6558436f3753c51129d9b27e59a39671
SHA1 d9dff110909324d956bc35e57419bb67cc7cfc43
SHA512 5295b0682475572160f29f16a682dd4a68dbfa326b97adbbc922d4ee261d790122bb01fe7b2819511c00f3295f3c84b9412d588f7a592da528dd8247a7699685
SSDEEP 768:Gvw9816vhKQLroQL4/wQgf5DAXYq/JTvlK8OI3BpgI6adWiNKkc5ya8ebnendUDQ:CEGh0oQLl35IRVhLc5nvNseJ5Qef7Bup
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe

Path C:\Windows\{A95AE75F-4654-4a69-BC99-0B5AF1881FDC}.exe
Size 408KB
SHA256 384806285db7144913e013da1106fcb2d5902bbd88459d77e264dfb2048d7257
MD5 1fe3d4710bf492642e18fe59080e1d52
SHA1 e452d914dda3ab8397e491fe3a83bdfe393edfb6
SHA512 b950c5e7ebe837152ee30131348a868d766f13248482d1c71832b93822eafc7078475824e167cd2b09e3ecee6ccf20f09b7094f2d4aa2bd118bc47093d2252ea
SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGIldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe

Path C:\Windows\{CA141FD4-E57C-4e55-8B59-09C00E9E0DD3}.exe
Size 408KB
SHA256 969a38cfe03c3fe8b5e2913fe5f141011bb12473372883fabdd6aaae4085aef4
MD5 7e6f3ee8acbf1bd8d42d097c2b17e676
SHA1 b410448ec1970a052c64e77e4d1bba8559ca1d95
SHA512 f1fb9b0bfe91a35c48e74981b3bf1590c6ed083b937caf4c77dc1c556261d1d8ca71cc0faa447322aa95afc5b9883ed7b7f962b12ed1bae2546ccca48bc05271
SSDEEP 3072:CEGh0oTl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe

Path C:\Windows\{DFA8894E-A617-4e5f-B042-7B2441D210E7}.exe
Size 408KB
SHA256 fe82ce51883469c1301f2495e5e7ef0d411044b2e66971adc6e19b2266ae59f0
MD5 a18c6353b82dd3abb132f2fed514aabc
SHA1 01a683544750e8c88f30ea3281a503e201109f22
SHA512 f33a3010ff1d12d68cef9d00c5dc61b9c27cb61cd5876522e4b480b80e296513aac1a5f70a3d984ff6235a1e99dd51101f1cad0e3957518de5757eb7e9c5409d
SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGDldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe

Path C:\Windows\{F66FE0BD-7066-4634-BB8B-B056A848ADA5}.exe
Size 408KB
SHA256 03a3735965bdf5bfa49e49f57d9f0a568ecdc5bb0cff3f58edb139d691efcba2
MD5 75b66126effae5499d0d791cf72763f7
SHA1 7a0c197f55290d32da4e43f7d16b4751d11beac5
SHA512 6fb5802ca634d0dc7a82d9dfd123360d2d08ce80122032db8af4bfbe42e0152b112ef6c88b6fa38d540872305afe907db950f95cfd81368c2ce7c6ffec969022
SSDEEP 3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGyldOe2MUVg3vTeKcAEciTBqr3jy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads