a85e80f2a561febd622ae23f38e9e8a2bd0e6532b174dda1af3af71f301681c5

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe
Size 168KB
Sample240302-zdn1aahb5t
SHA256 a85e80f2a561febd622ae23f38e9e8a2bd0e6532b174dda1af3af71f301681c5
MD5 45e0f07cf197bd6c326c58ec19df0cbe
SHA1 fbf81b81bd0960bfd6311941622fa8d83c4cb3ff
SHA512 a47884c4b98d18a698bb75ed52274f9667fd7af99cafc66705fdd0a37b0c8da1fe024f5c956bc29e010fb2e798b7106a2e85b367d3dcffadcebdd814bc1fe377
SSDEEP 1536:1EGh0oblq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oblqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x000a000000016fa5-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002325e-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023266-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000022e9f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023266-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000022e9f-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000022e9f-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023266-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e3d2-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023266-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001e3d2-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023260-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e457-45.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61FD570D-D680-471f-9931-E7406808A431}	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}\stubpath = "C:\\Windows\\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe"	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}\stubpath = "C:\\Windows\\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe"	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{074536D1-3329-4751-A80D-738E4668D88B}\stubpath = "C:\\Windows\\{074536D1-3329-4751-A80D-738E4668D88B}.exe"	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}\stubpath = "C:\\Windows\\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe"	{074536D1-3329-4751-A80D-738E4668D88B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{176F9CCF-9E1C-48f6-8D36-3395D5467787}	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61FD570D-D680-471f-9931-E7406808A431}\stubpath = "C:\\Windows\\{61FD570D-D680-471f-9931-E7406808A431}.exe"	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}\stubpath = "C:\\Windows\\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe"	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}\stubpath = "C:\\Windows\\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe"	{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}\stubpath = "C:\\Windows\\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe"	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}	{61FD570D-D680-471f-9931-E7406808A431}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{074536D1-3329-4751-A80D-738E4668D88B}	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{181B7568-BEDE-4664-BCC9-C243FA2EE673}	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}\stubpath = "C:\\Windows\\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe"	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{176F9CCF-9E1C-48f6-8D36-3395D5467787}\stubpath = "C:\\Windows\\{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe"	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}	{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}\stubpath = "C:\\Windows\\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe"	{61FD570D-D680-471f-9931-E7406808A431}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}	{074536D1-3329-4751-A80D-738E4668D88B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{181B7568-BEDE-4664-BCC9-C243FA2EE673}\stubpath = "C:\\Windows\\{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe"	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe

Executes dropped EXE 12 IoCs

pid	Process
5096	{61FD570D-D680-471f-9931-E7406808A431}.exe
4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe
4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
4296	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
2764	{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
3828	{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
File created	C:\Windows\{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
File created	C:\Windows\{61FD570D-D680-471f-9931-E7406808A431}.exe	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe
File created	C:\Windows\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
File created	C:\Windows\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	{074536D1-3329-4751-A80D-738E4668D88B}.exe
File created	C:\Windows\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
File created	C:\Windows\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
File created	C:\Windows\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
File created	C:\Windows\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe	{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
File created	C:\Windows\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	{61FD570D-D680-471f-9931-E7406808A431}.exe
File created	C:\Windows\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
File created	C:\Windows\{074536D1-3329-4751-A80D-738E4668D88B}.exe	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe
Token: SeIncBasePriorityPrivilege	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
Token: SeIncBasePriorityPrivilege	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
Token: SeIncBasePriorityPrivilege	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
Token: SeIncBasePriorityPrivilege	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe
Token: SeIncBasePriorityPrivilege	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
Token: SeIncBasePriorityPrivilege	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
Token: SeIncBasePriorityPrivilege	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
Token: SeIncBasePriorityPrivilege	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
Token: SeIncBasePriorityPrivilege	4296	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
Token: SeIncBasePriorityPrivilege	2764	{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 5096	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe	98
PID 2916 wrote to memory of 5096	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe	98
PID 2916 wrote to memory of 5096	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe	98
PID 2916 wrote to memory of 2752	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe	99
PID 2916 wrote to memory of 2752	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe	99
PID 2916 wrote to memory of 2752	2916	2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe	99
PID 5096 wrote to memory of 4508	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe	100
PID 5096 wrote to memory of 4508	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe	100
PID 5096 wrote to memory of 4508	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe	100
PID 5096 wrote to memory of 3604	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe	101
PID 5096 wrote to memory of 3604	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe	101
PID 5096 wrote to memory of 3604	5096	{61FD570D-D680-471f-9931-E7406808A431}.exe	101
PID 4508 wrote to memory of 2032	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	104
PID 4508 wrote to memory of 2032	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	104
PID 4508 wrote to memory of 2032	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	104
PID 4508 wrote to memory of 216	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	105
PID 4508 wrote to memory of 216	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	105
PID 4508 wrote to memory of 216	4508	{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe	105
PID 2032 wrote to memory of 4664	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	108
PID 2032 wrote to memory of 4664	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	108
PID 2032 wrote to memory of 4664	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	108
PID 2032 wrote to memory of 1904	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	109
PID 2032 wrote to memory of 1904	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	109
PID 2032 wrote to memory of 1904	2032	{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe	109
PID 4664 wrote to memory of 2528	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	110
PID 4664 wrote to memory of 2528	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	110
PID 4664 wrote to memory of 2528	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	110
PID 4664 wrote to memory of 2464	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	111
PID 4664 wrote to memory of 2464	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	111
PID 4664 wrote to memory of 2464	4664	{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe	111
PID 2528 wrote to memory of 4996	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe	112
PID 2528 wrote to memory of 4996	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe	112
PID 2528 wrote to memory of 4996	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe	112
PID 2528 wrote to memory of 2156	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe	113
PID 2528 wrote to memory of 2156	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe	113
PID 2528 wrote to memory of 2156	2528	{074536D1-3329-4751-A80D-738E4668D88B}.exe	113
PID 4996 wrote to memory of 1556	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	114
PID 4996 wrote to memory of 1556	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	114
PID 4996 wrote to memory of 1556	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	114
PID 4996 wrote to memory of 2376	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	115
PID 4996 wrote to memory of 2376	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	115
PID 4996 wrote to memory of 2376	4996	{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe	115
PID 1556 wrote to memory of 5096	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	116
PID 1556 wrote to memory of 5096	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	116
PID 1556 wrote to memory of 5096	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	116
PID 1556 wrote to memory of 1128	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	117
PID 1556 wrote to memory of 1128	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	117
PID 1556 wrote to memory of 1128	1556	{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe	117
PID 5096 wrote to memory of 1196	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	118
PID 5096 wrote to memory of 1196	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	118
PID 5096 wrote to memory of 1196	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	118
PID 5096 wrote to memory of 3584	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	119
PID 5096 wrote to memory of 3584	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	119
PID 5096 wrote to memory of 3584	5096	{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe	119
PID 1196 wrote to memory of 4296	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	120
PID 1196 wrote to memory of 4296	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	120
PID 1196 wrote to memory of 4296	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	120
PID 1196 wrote to memory of 4300	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	121
PID 1196 wrote to memory of 4300	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	121
PID 1196 wrote to memory of 4300	1196	{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe	121
PID 4296 wrote to memory of 2764	4296	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe	122
PID 4296 wrote to memory of 2764	4296	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe	122
PID 4296 wrote to memory of 2764	4296	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe	122
PID 4296 wrote to memory of 1352	4296	{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe	123

C:\Users\Admin\AppData\Local\Temp\2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-02_45e0f07cf197bd6c326c58ec19df0cbe_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\{61FD570D-D680-471f-9931-E7406808A431}.exe
  C:\Windows\{61FD570D-D680-471f-9931-E7406808A431}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
    C:\Windows\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
      C:\Windows\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
        
        C:\Windows\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - C:\Windows\{074536D1-3329-4751-A80D-738E4668D88B}.exe
        
        C:\Windows\{074536D1-3329-4751-A80D-738E4668D88B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
        
        C:\Windows\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
        
        C:\Windows\{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
        
        C:\Windows\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
        
        C:\Windows\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
        
        C:\Windows\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
        
        C:\Windows\{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe
        
        C:\Windows\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe
        13⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{176F9~1.EXE > nul
        13⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A4CAA~1.EXE > nul
        12⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A12F4~1.EXE > nul
        11⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4ED30~1.EXE > nul
        10⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{181B7~1.EXE > nul
        9⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F46A8~1.EXE > nul
        8⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{07453~1.EXE > nul
        7⤵
        
        PID:2156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32BBD~1.EXE > nul
        6⤵
        
        PID:2464
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7245D~1.EXE > nul
        5⤵
        
        PID:1904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{915F3~1.EXE > nul
      4⤵
      PID:216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{61FD5~1.EXE > nul
    3⤵
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{074536D1-3329-4751-A80D-738E4668D88B}.exe

Path C:\Windows\{074536D1-3329-4751-A80D-738E4668D88B}.exe
Size 168KB
SHA256 3a81126781f554b7b3f9bc085393c4668493c1006b5dfd15cd2fcd2f496d290e
MD5 6a41d49a3cad72e82fa6aedadf16dac6
SHA1 f285d9d151a12d938dfc7390ad38c523d4273fd6
SHA512 da6efeec4fe9361f7bdd4a2522158eca6cbf0fbf97caf234264999055e890d7a862529f82f409eface38cbec326a5943e8d233972c2da5e9a3472b508dc6679e
SSDEEP 1536:1EGh0ohlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe

Path C:\Windows\{176F9CCF-9E1C-48f6-8D36-3395D5467787}.exe
Size 168KB
SHA256 64240b52626e774936ccc352ea838280b248e03e9a4f9bdd1b6b94283851c649
MD5 3568384d74eeb1e0e0c233ae21585420
SHA1 7c7c71c2db73d1f862169c9ea45451b90e0928c9
SHA512 aeb9f5a16188ddfa630fb460ec95c27c9a90d4322b2f1636f7c0ab2345c98e5ea9b34313b487c03ae7a261b66685a55033f1d85e9ccb680f1a36daf4e88ec397
SSDEEP 1536:1EGh0ohlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe

Path C:\Windows\{181B7568-BEDE-4664-BCC9-C243FA2EE673}.exe
Size 168KB
SHA256 61c0130addf5ed79b269ba0f77781dfce78d1936340b0ae070203b8d18457fe2
MD5 cb2e09e364aaacf8a9a3e084b08b0f06
SHA1 7e8c293a555d40996103e01227a46aef611dec77
SHA512 273c28aeb83613f27f67a30a5b37554fde9e85d9ee38f16f3a9cd87af1d230da7724a2ca933ed5e35bbff1bfb27b5535b8f3098f924ff7fa01cb84897dbd22d9
SSDEEP 1536:1EGh0oplq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oplqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe

Path C:\Windows\{32BBD90D-1044-4914-B5EA-C49BFE3F5EA5}.exe
Size 168KB
SHA256 abb4cef8810660e3fa32431471fe28a659bea1ef6db7e596326b7c862a4e9a4d
MD5 06dc443da8d2aa66f7d936ab81269b7c
SHA1 e6da7a6fd752286e1ed716fca2b75effa2634347
SHA512 8d0bc3c645bc994f067c81d2bd5fdc8d30bd22497a379e83628c9d0e66310b4f0e6de221f1c8518c7c14742744959bdfa437dd1c7e9d7df6edf28792512c5085
SSDEEP 1536:1EGh0odlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0odlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe

Path C:\Windows\{4ED30B35-025F-4beb-BF82-C45CC6EC9F14}.exe
Size 168KB
SHA256 25db5d1b2cf5ae719bcfb4ea7cbed2261f4f52c877d92366a693d4cb7c485c30
MD5 640b339f90eb46081f624680c791383d
SHA1 c08fc581555ff3f7d3647180d4b85b79a1aa812a
SHA512 c7c811d439bbb16a125b8f53eeb2990a6f52d3fab973f22bba5f49eafc19b9a70ed2d26a96c22b68370b7a4c26f61b5adb0d1343135297949e8f5f50b56af335
SSDEEP 1536:1EGh0oDlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oDlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{61FD570D-D680-471f-9931-E7406808A431}.exe

Path C:\Windows\{61FD570D-D680-471f-9931-E7406808A431}.exe
Size 168KB
SHA256 d255e93664deb7a0ac8f97ea1900873935502ef250e0c9a798ae19c02ed43007
MD5 14956c8608b8be32d95339a00aab8a8e
SHA1 0a4752829d48ef68a5746f408a4172b1ebfb330f
SHA512 dfb9adc5de61576c8e387b2b62eb9f24a749e5a8fcaf16ec3923b14ad01b50efff7417e3ef3ac13c2b0a6ba82106cdc82fd99046cacaa6779d5938527ee40fb8
SSDEEP 1536:1EGh0oxlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oxlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe

Path C:\Windows\{7245D77A-D902-4051-A2EF-4FF1EFAF3802}.exe
Size 168KB
SHA256 99ff02c58973ada0098ef304032525131963cdc704140c3bcf71149bae168e1e
MD5 fee47362070cf159fd1ce0acea005b36
SHA1 9a9d64983e99fbf61599232a00fe9441848c9ac4
SHA512 c853009c792a0c5e3bb28e9430d7b70b374e15bcf9676a8ad8a371f03f868dd75f1f1547fb5704d64efd5a45b2c4b76bbd9909fb3c0e3a8cb28c5f83b53fea83
SSDEEP 1536:1EGh0oblq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oblqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe

Path C:\Windows\{915F38AE-4A43-48ab-A59D-70F2CF2C8205}.exe
Size 168KB
SHA256 12fb8dd674691ffc44a162de9cd57c1e08f18ac53ad1aa0c73bc38a1e7c8a8dd
MD5 711f55082dd19e97202369c0732297af
SHA1 fcc1e282954796b9991fe699b5f3b34409314811
SHA512 7eb9072bd36d0aa9ad81b6e0d5ed03f925c3b81d42c086ea64449ee4477a19d287527a455a52ad0f98dce9d482e0a276f210b2b240f6dc665479e0a854756565
SSDEEP 1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe

Path C:\Windows\{A12F4C2E-BCEB-408d-8AAB-A47214FB15A2}.exe
Size 168KB
SHA256 5804489019ad42be48457ff02d44be1e0a38b1eac559ad8e5d732a0a8e692dec
MD5 728dd5e67bac8820b8b0488217ddf453
SHA1 59b86a53eacac3b4123355ffb81ddcaeee68e5c9
SHA512 ae4d8d4fdf33db534d28c51bdb9c45c57f977c1bf5c350022598002e5116892cc3ba46e4999f98df438c35f362f4a89af9e9476ba04f1d04abb2efa70ec2fcbb
SSDEEP 1536:1EGh0o5lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o5lqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe

Path C:\Windows\{A4CAA2A7-9412-4e4a-AA9E-9792C465C148}.exe
Size 168KB
SHA256 013c965eb01abdab978f398733996661712cd6e7d25b0f88a2038a6d63426e6e
MD5 ff107813898578c021581f1433df9432
SHA1 b64ddd3c89dd5a34fb87ec64f64b704d67e88ecc
SHA512 0acb5052c3cce14abaf52bd28d20f737931c249c850a23d68625c5993cf736925ebd0fcb3f0d38b100673c64628d10c0e59cb0dd7627ecfe48a563e54e7e7b2a
SSDEEP 1536:1EGh0oQlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oQlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe

Path C:\Windows\{B5A8CD65-89E8-4e83-91C1-0C6BB0DBD69F}.exe
Size 168KB
SHA256 31374aaa8f70e522e7219db92c716329830f467358e292e9093bd9fb7a99ec7f
MD5 5334d4e21f74f52431a716e582a10613
SHA1 61b79f956efaf621f1cc2e9a6f46b2c176d78be0
SHA512 321d68357337923917211c17effb49f144c047546eef2aa499097781881b330948d9081f482eaaccc52f587f1b8695363838b041379fe9cacceb283129509b68
SSDEEP 1536:1EGh0oTlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oTlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe

Path C:\Windows\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
Size 25KB
SHA256 75aa7940ae0fbc20bc3e6bd1a98a575b674a8246ab7d1d5e8574524b6de30029
MD5 05eeb14241e95897b507efb33895dd87
SHA1 3d163b79567d8d46784f04cbda3b003c70e20df0
SHA512 c38f80d91bb0405af04a9d98cebe3f2fe66353201e38199efbc7c3214f23e877aadd825211d20d04b53ceef38d4217018938b355d4a7eab4149093835a7f98e0
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwHm4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroHm4/CFsrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe

Path C:\Windows\{F46A8D18-3222-4ed3-B6F9-F71E4D3E7472}.exe
Size 168KB
SHA256 3a844253120397bdcfd228450ae7f34907676c74e0c96d328daba4944d50a98b
MD5 99c106c8aef7b856bf35d6815258a8a8
SHA1 7cb59d66e41c3b71d16f25824b0652215e02b441
SHA512 d9f8b1a843a731f70e7974a2d845abd9e3b4b3686b40efa683c799a404089301fdaffa8c0a1588f0674d72a4250b0344a07d596593ca1b7763c27375a20936b9
SSDEEP 1536:1EGh0oGlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oGlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads