e61f010f2f8e4e654ad1cd06ccffa17eedde75f3e5e0344fc4b6d632b0632516

Analysis

max time kernel
151s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe
Size

180KB
MD5

c0cc9f2a196d6040261cd5a1d955ae58
SHA1

d684214c89e431e91fcccd0c9a77ba49eb24fdb6
SHA256

e61f010f2f8e4e654ad1cd06ccffa17eedde75f3e5e0344fc4b6d632b0632516
SHA512

a4785dd04a67ec0115a1c4b050849b6cfb2611110087729c578a9b409014af1cc034d0b3e4990b6058b4a3a33c9e6796c805baa06f0765a1e0135427d7ef65c2
SSDEEP

3072:jEGh0oNlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGrl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012236-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000012246-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0015000000012265-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00120000000055a2-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0016000000012265-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00130000000055a2-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0017000000012265-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012700-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000013442-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00080000000135a1-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000013442-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000135a1-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}\stubpath = "C:\\Windows\\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe"	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAFD21EA-F276-4836-85AD-838A50EE3540}\stubpath = "C:\\Windows\\{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe"	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57452709-6F71-42a2-AB7E-20C83C20802B}	{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A344103D-986D-4276-8C10-E8283E7AD0B7}	{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAFD21EA-F276-4836-85AD-838A50EE3540}	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}\stubpath = "C:\\Windows\\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe"	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AACD546C-7E30-4e01-AA27-23057F304DAB}\stubpath = "C:\\Windows\\{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe"	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{319A7A73-0F88-49e2-9139-5C580692A6AC}	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57452709-6F71-42a2-AB7E-20C83C20802B}\stubpath = "C:\\Windows\\{57452709-6F71-42a2-AB7E-20C83C20802B}.exe"	{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A344103D-986D-4276-8C10-E8283E7AD0B7}\stubpath = "C:\\Windows\\{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe"	{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}\stubpath = "C:\\Windows\\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe"	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AACD546C-7E30-4e01-AA27-23057F304DAB}	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}\stubpath = "C:\\Windows\\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe"	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}	{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}\stubpath = "C:\\Windows\\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe"	{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{319A7A73-0F88-49e2-9139-5C580692A6AC}\stubpath = "C:\\Windows\\{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe"	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}\stubpath = "C:\\Windows\\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe"	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{07E11A93-0C32-4791-A05F-711872A2C76E}	{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{07E11A93-0C32-4791-A05F-711872A2C76E}\stubpath = "C:\\Windows\\{07E11A93-0C32-4791-A05F-711872A2C76E}.exe"	{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe

Deletes itself 1 IoCs

pid	Process
2612	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe
1796	{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
2756	{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
1696	{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
2524	{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe
1900	{07E11A93-0C32-4791-A05F-711872A2C76E}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
File created	C:\Windows\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
File created	C:\Windows\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
File created	C:\Windows\{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
File created	C:\Windows\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
File created	C:\Windows\{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
File created	C:\Windows\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe	{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
File created	C:\Windows\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe
File created	C:\Windows\{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe	{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
File created	C:\Windows\{07E11A93-0C32-4791-A05F-711872A2C76E}.exe	{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe
File created	C:\Windows\{57452709-6F71-42a2-AB7E-20C83C20802B}.exe	{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
File created	C:\Windows\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
Token: SeIncBasePriorityPrivilege	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
Token: SeIncBasePriorityPrivilege	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
Token: SeIncBasePriorityPrivilege	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
Token: SeIncBasePriorityPrivilege	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
Token: SeIncBasePriorityPrivilege	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
Token: SeIncBasePriorityPrivilege	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe
Token: SeIncBasePriorityPrivilege	1796	{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
Token: SeIncBasePriorityPrivilege	2756	{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
Token: SeIncBasePriorityPrivilege	1696	{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
Token: SeIncBasePriorityPrivilege	2524	{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3056	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	28
PID 2216 wrote to memory of 3056	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	28
PID 2216 wrote to memory of 3056	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	28
PID 2216 wrote to memory of 3056	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	28
PID 2216 wrote to memory of 2612	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	29
PID 2216 wrote to memory of 2612	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	29
PID 2216 wrote to memory of 2612	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	29
PID 2216 wrote to memory of 2612	2216	2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe	29
PID 3056 wrote to memory of 2688	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	30
PID 3056 wrote to memory of 2688	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	30
PID 3056 wrote to memory of 2688	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	30
PID 3056 wrote to memory of 2688	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	30
PID 3056 wrote to memory of 2820	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	31
PID 3056 wrote to memory of 2820	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	31
PID 3056 wrote to memory of 2820	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	31
PID 3056 wrote to memory of 2820	3056	{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe	31
PID 2688 wrote to memory of 2432	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	32
PID 2688 wrote to memory of 2432	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	32
PID 2688 wrote to memory of 2432	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	32
PID 2688 wrote to memory of 2432	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	32
PID 2688 wrote to memory of 2808	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	33
PID 2688 wrote to memory of 2808	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	33
PID 2688 wrote to memory of 2808	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	33
PID 2688 wrote to memory of 2808	2688	{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe	33
PID 2432 wrote to memory of 2892	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	36
PID 2432 wrote to memory of 2892	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	36
PID 2432 wrote to memory of 2892	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	36
PID 2432 wrote to memory of 2892	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	36
PID 2432 wrote to memory of 2140	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	37
PID 2432 wrote to memory of 2140	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	37
PID 2432 wrote to memory of 2140	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	37
PID 2432 wrote to memory of 2140	2432	{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe	37
PID 2892 wrote to memory of 528	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	38
PID 2892 wrote to memory of 528	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	38
PID 2892 wrote to memory of 528	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	38
PID 2892 wrote to memory of 528	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	38
PID 2892 wrote to memory of 476	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	39
PID 2892 wrote to memory of 476	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	39
PID 2892 wrote to memory of 476	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	39
PID 2892 wrote to memory of 476	2892	{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe	39
PID 528 wrote to memory of 1776	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	40
PID 528 wrote to memory of 1776	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	40
PID 528 wrote to memory of 1776	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	40
PID 528 wrote to memory of 1776	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	40
PID 528 wrote to memory of 1736	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	41
PID 528 wrote to memory of 1736	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	41
PID 528 wrote to memory of 1736	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	41
PID 528 wrote to memory of 1736	528	{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe	41
PID 1776 wrote to memory of 1456	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	42
PID 1776 wrote to memory of 1456	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	42
PID 1776 wrote to memory of 1456	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	42
PID 1776 wrote to memory of 1456	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	42
PID 1776 wrote to memory of 1876	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	43
PID 1776 wrote to memory of 1876	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	43
PID 1776 wrote to memory of 1876	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	43
PID 1776 wrote to memory of 1876	1776	{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe	43
PID 1456 wrote to memory of 1796	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	44
PID 1456 wrote to memory of 1796	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	44
PID 1456 wrote to memory of 1796	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	44
PID 1456 wrote to memory of 1796	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	44
PID 1456 wrote to memory of 1204	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	45
PID 1456 wrote to memory of 1204	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	45
PID 1456 wrote to memory of 1204	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	45
PID 1456 wrote to memory of 1204	1456	{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_c0cc9f2a196d6040261cd5a1d955ae58_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
  C:\Windows\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
    C:\Windows\{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
      C:\Windows\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
        
        C:\Windows\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Windows\{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
        
        C:\Windows\{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
        
        C:\Windows\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe
        
        C:\Windows\{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
        
        C:\Windows\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
        
        C:\Windows\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
        
        C:\Windows\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
        
        C:\Windows\{57452709-6F71-42a2-AB7E-20C83C20802B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe
        
        C:\Windows\{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
        
        C:\Windows\{07E11A93-0C32-4791-A05F-711872A2C76E}.exe
        
        C:\Windows\{07E11A93-0C32-4791-A05F-711872A2C76E}.exe
        13⤵
        Executes dropped EXE
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3441~1.EXE > nul
        13⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{57452~1.EXE > nul
        12⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7CF9~1.EXE > nul
        11⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59E6D~1.EXE > nul
        10⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{319A7~1.EXE > nul
        9⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D5EA~1.EXE > nul
        8⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AACD5~1.EXE > nul
        7⤵
        
        PID:1736
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0DB18~1.EXE > nul
        6⤵
        
        PID:476
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8276~1.EXE > nul
        5⤵
        
        PID:2140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BAFD2~1.EXE > nul
      4⤵
      PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F7D10~1.EXE > nul
    3⤵
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{07E11A93-0C32-4791-A05F-711872A2C76E}.exe

Filesize
180KB

MD5
80273bfc335f8e5555eccaeadd853bef

SHA1
9ee8c1f85d8eb5e8c6607c5a1fd99bb3c5780b85

SHA256
df591bd68c5f75e3ec33f564947df2cf36eb0479348f1b4f5c74cf724a1e7453

SHA512
08b5f00eb8aba20a734dc310b089fea0de97e32a80418c70fa17d1e31b7fc9d952d40a3113d5b1de7d4910aaeb099a4404eb6835e303415914c6e2b7b9d2b2d1

Download Submit
C:\Windows\{0D5EA78F-1A87-4655-82DE-BF52447F3FA6}.exe

Filesize
180KB

MD5
93c38c3636f888bec355ac2b7599b78a

SHA1
aaaa4be8b155a2bb41d445d53cb0ccd5a2018cc2

SHA256
5706ec791c6d1ea57be129de0119f2838c4617d147bfd6e25562ce1d4e3d4933

SHA512
1f9822d130c4686927084907e79013769a727362713ac93f07494eda9ceae63d01bf3ccfe45c0ed9995b510cca4bf850790d83b22d8a293f4abfe69908b7df60

Download Submit
C:\Windows\{0DB18C36-A6B3-4fc2-AEE9-FB41080520B5}.exe

Filesize
180KB

MD5
b7f5bb922e3f93c4783dc07cc7326ba6

SHA1
a14f0dd33555c4b405bc77fec231c306f6e0c1e8

SHA256
534f0673e0a1135e723a2e9442f5f0fe7a1b6233e5a4f03cc27fe65dc57d6025

SHA512
bedd52b79c7919e501841a6c75746d795666b195b604f715cda26fa510523d99a34edf49a6bbc6f4faae383a0fe0caa2b0a2f6e6cac80b66c6b387313a3e1cbc

Download Submit
C:\Windows\{319A7A73-0F88-49e2-9139-5C580692A6AC}.exe

Filesize
180KB

MD5
85d43bc1e7e0af6c6931125f134baf6a

SHA1
81631d891e798223c79c1a8e1a1715df8a82e150

SHA256
3de818398c29b17af2755d8470e09faf3234e97bf60f1f7f56e15cbd6199e2b8

SHA512
616fa26095ad33eff0cc04502d6def5c2001856af8a62b0a1f32605a26dbcccb859afd8ca35089ef2eb354a263fda1ac6e54c1c77425b7cac17b1359170fd546

Download Submit
C:\Windows\{57452709-6F71-42a2-AB7E-20C83C20802B}.exe

Filesize
180KB

MD5
8dbb44136fb50fd2febb730e5572d536

SHA1
6cb56401b3ec585c273f36438ce0026d1e8780ad

SHA256
b72a34dd969c2023c1970862701b557aa9467f4b94548dba9afac5020e9402da

SHA512
ec9408e128a430e7a9977f025c14c7361d9662b6755502ec2d7e91b1181dce7f8a8ef8f80ac7c922fbcc906d3bbbb53c54af2196b033cb761ae6ea00ac227040

Download Submit
C:\Windows\{59E6D0A0-35AF-4a7e-95C5-4993ED5A5400}.exe

Filesize
180KB

MD5
c9f8e3f52abd937c321aae27c7a5722d

SHA1
d37f4b8c00e1fc2182e9e46c2602038774bb4f15

SHA256
6cc72dad352ee241bf19816e329129d32abd9a6b4697396579651e5532837f9a

SHA512
15c4f9f1b4609847bc5cd9e4a0af6e8359ab567168c26ac748eb52b656040e9bec9f21f49ed7d09d8f42cd5cc054711d59ea4d5b7e7a3b888e9c986bbdaeb08d

Download Submit
C:\Windows\{A344103D-986D-4276-8C10-E8283E7AD0B7}.exe

Filesize
180KB

MD5
183ea92e27b2f2d5a143b0a00b9c2bc8

SHA1
2af8176737f782a8ef7f262002e2b766583224eb

SHA256
fb737b3142b0610ce3e3307d2716de5bf5c4e11db8bed6cd44d1020366705fbc

SHA512
b4754c18f824574aec415e22853e9916b34cf8a5b6c457a811e7460add92506e2d8620b2b62266539a1229531d5723c217f878eed1c02c465f7ab656bde30e0b

Download Submit
C:\Windows\{A82761BF-00AC-4af3-94CA-CC7B8EFDB6F3}.exe

Filesize
180KB

MD5
fdf68479c888adcc8e481520790ec6a7

SHA1
f8efb98cc3100cb736a57d06a1672d861ea593c5

SHA256
9f4dabd2839395d10969a5a982f85a46594af57b711e4c4a3848761cd2708cfa

SHA512
0a5f80a9f15fae0fca7862385e8be24c23ac4aa848bb885363e3c722c243115ed5f4f7d454ee222a17abff7242bd8cdb7fc977cdc0bff035ba4b82ae89687b79

Download Submit
C:\Windows\{AACD546C-7E30-4e01-AA27-23057F304DAB}.exe

Filesize
180KB

MD5
33cf5ab2078d3063798b1c10419ca7cd

SHA1
069b9f41209005bff8963f76a29e2435d59911fd

SHA256
9b200bbfd07ad8f3bb17109b5e5596ef1e1ad87db37eef05e4c98c3d2f14a2af

SHA512
e2962b1e755d1d9bbbb3997ab9b4a3bb9c6eb977a1aff50a813d2216c67ecb103821a13072b15e51230e076e7440efe5555f4b1ba36c93c5793c65ddacb8a8ef

Download Submit
C:\Windows\{B7CF915F-EB1E-4993-8BD0-A9DD8546C399}.exe

Filesize
180KB

MD5
0dafbf621ba1ec8704752c609656f136

SHA1
6df09b59372f78a96360d23d1a238ea3688a962e

SHA256
8ed1f70cdf700c468d1835f7becc8482d71a99c0e31db745cb42582373e02401

SHA512
7f76c4688631c02c8a66d6e948e7a7c939157d7a11607bde3c9b3899a4a45537ee228ee7f33974ee693b4b05b14cb087cd8aa17b14ae6632a3750f3ed549bc4f

Download Submit
C:\Windows\{BAFD21EA-F276-4836-85AD-838A50EE3540}.exe

Filesize
180KB

MD5
fea8182d2b786e403869d3e2825f3415

SHA1
3a072166489c9a0a6c51f00edde36f52d274f6fe

SHA256
0aade81fb78a5022bd460376f3fc3a57ed6c7fd5e1519e1cfc8d6b4799d542bb

SHA512
ae8fb17ec1126f8d01a7adaa271ceb6389cbc50166c18a0df31216e2be09ad970cb0b4f35fc6c2b0aed6bf0959e97383cac17bf0638e9e3da1862d212e6072e6

Download Submit
C:\Windows\{F7D1056A-243A-4b1f-9F9B-B02FD6955093}.exe

Filesize
180KB

MD5
fbc407a24d08fa24c27920917e44fe58

SHA1
c1b020d7e373afd288bb59ce4feb2f7fae39948b

SHA256
bcccd13c1422c0f2daa6f9dac3a5139901123d8b6568cf1da5e35d90484389b6

SHA512
528c8ee2fe0594483ebf5dde8624667504c3f0e25beabaff60a375cce9db51ba747398f20ee21e58fc0bee45825b674610c975bb017cbb1d2605475712e4eef1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads