07795fde550faab731c69cbe8e565cbe5b7025b584db0fe7432d1ce29e35b6c4

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe
Size 344KB
Sample240305-vyym1adb78
SHA256 07795fde550faab731c69cbe8e565cbe5b7025b584db0fe7432d1ce29e35b6c4
MD5 064b7a166c45c658219a769bc43289cb
SHA1 d2e5ac28a48af7d2943bc7736048d34f1877327d
SHA512 b9ddc2a7a9480eabb99711a180056e0d4f6d89963c7c4f487691813b1f78abd6f02b5ae8961bb40683517495e86fc56aa8fbe6cd8e63e563fb3818c46ee419a6
SSDEEP 3072:mEGh0o2lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320f-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023217-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023220-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000230d0-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000230f0-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023387-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000230f1-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002338c-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233a7-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002338c-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000234aa-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002338c-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{642C9079-39C3-4962-AA7F-53DB733BF390}\stubpath = "C:\\Windows\\{642C9079-39C3-4962-AA7F-53DB733BF390}.exe"	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}\stubpath = "C:\\Windows\\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe"	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}\stubpath = "C:\\Windows\\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe"	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{804DC732-8740-4537-82BD-D815842B3464}	{4D399133-1A11-4f17-9348-306E83D269A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}\stubpath = "C:\\Windows\\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe"	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17B73FA4-8388-482d-B5F8-A4297ACC3211}\stubpath = "C:\\Windows\\{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe"	{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}\stubpath = "C:\\Windows\\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe"	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{642C9079-39C3-4962-AA7F-53DB733BF390}	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D399133-1A11-4f17-9348-306E83D269A2}	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D399133-1A11-4f17-9348-306E83D269A2}\stubpath = "C:\\Windows\\{4D399133-1A11-4f17-9348-306E83D269A2}.exe"	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{804DC732-8740-4537-82BD-D815842B3464}\stubpath = "C:\\Windows\\{804DC732-8740-4537-82BD-D815842B3464}.exe"	{4D399133-1A11-4f17-9348-306E83D269A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}\stubpath = "C:\\Windows\\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe"	{804DC732-8740-4537-82BD-D815842B3464}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}\stubpath = "C:\\Windows\\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe"	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}\stubpath = "C:\\Windows\\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe"	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}\stubpath = "C:\\Windows\\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe"	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}	{804DC732-8740-4537-82BD-D815842B3464}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17B73FA4-8388-482d-B5F8-A4297ACC3211}	{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe

Executes dropped EXE 12 IoCs

pid	Process
932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe
2200	{804DC732-8740-4537-82BD-D815842B3464}.exe
1724	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
2516	{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
788	{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
File created	C:\Windows\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
File created	C:\Windows\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe	{804DC732-8740-4537-82BD-D815842B3464}.exe
File created	C:\Windows\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe
File created	C:\Windows\{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
File created	C:\Windows\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
File created	C:\Windows\{4D399133-1A11-4f17-9348-306E83D269A2}.exe	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
File created	C:\Windows\{804DC732-8740-4537-82BD-D815842B3464}.exe	{4D399133-1A11-4f17-9348-306E83D269A2}.exe
File created	C:\Windows\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
File created	C:\Windows\{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe	{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
File created	C:\Windows\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
File created	C:\Windows\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe
Token: SeIncBasePriorityPrivilege	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
Token: SeIncBasePriorityPrivilege	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
Token: SeIncBasePriorityPrivilege	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
Token: SeIncBasePriorityPrivilege	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
Token: SeIncBasePriorityPrivilege	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
Token: SeIncBasePriorityPrivilege	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
Token: SeIncBasePriorityPrivilege	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
Token: SeIncBasePriorityPrivilege	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe
Token: SeIncBasePriorityPrivilege	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe
Token: SeIncBasePriorityPrivilege	1724	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
Token: SeIncBasePriorityPrivilege	2516	{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 932	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe	97
PID 1216 wrote to memory of 932	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe	97
PID 1216 wrote to memory of 932	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe	97
PID 1216 wrote to memory of 996	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe	98
PID 1216 wrote to memory of 996	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe	98
PID 1216 wrote to memory of 996	1216	2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe	98
PID 932 wrote to memory of 1600	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	100
PID 932 wrote to memory of 1600	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	100
PID 932 wrote to memory of 1600	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	100
PID 932 wrote to memory of 4300	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	101
PID 932 wrote to memory of 4300	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	101
PID 932 wrote to memory of 4300	932	{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe	101
PID 1600 wrote to memory of 2772	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	105
PID 1600 wrote to memory of 2772	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	105
PID 1600 wrote to memory of 2772	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	105
PID 1600 wrote to memory of 3128	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	106
PID 1600 wrote to memory of 3128	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	106
PID 1600 wrote to memory of 3128	1600	{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe	106
PID 2772 wrote to memory of 4828	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	114
PID 2772 wrote to memory of 4828	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	114
PID 2772 wrote to memory of 4828	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	114
PID 2772 wrote to memory of 5020	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	115
PID 2772 wrote to memory of 5020	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	115
PID 2772 wrote to memory of 5020	2772	{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe	115
PID 4828 wrote to memory of 3300	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	116
PID 4828 wrote to memory of 3300	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	116
PID 4828 wrote to memory of 3300	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	116
PID 4828 wrote to memory of 3184	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	117
PID 4828 wrote to memory of 3184	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	117
PID 4828 wrote to memory of 3184	4828	{642C9079-39C3-4962-AA7F-53DB733BF390}.exe	117
PID 3300 wrote to memory of 1908	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	118
PID 3300 wrote to memory of 1908	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	118
PID 3300 wrote to memory of 1908	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	118
PID 3300 wrote to memory of 4852	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	119
PID 3300 wrote to memory of 4852	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	119
PID 3300 wrote to memory of 4852	3300	{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe	119
PID 1908 wrote to memory of 1164	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	121
PID 1908 wrote to memory of 1164	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	121
PID 1908 wrote to memory of 1164	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	121
PID 1908 wrote to memory of 3536	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	122
PID 1908 wrote to memory of 3536	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	122
PID 1908 wrote to memory of 3536	1908	{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe	122
PID 1164 wrote to memory of 4576	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	123
PID 1164 wrote to memory of 4576	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	123
PID 1164 wrote to memory of 4576	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	123
PID 1164 wrote to memory of 4716	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	124
PID 1164 wrote to memory of 4716	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	124
PID 1164 wrote to memory of 4716	1164	{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe	124
PID 4576 wrote to memory of 2200	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe	125
PID 4576 wrote to memory of 2200	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe	125
PID 4576 wrote to memory of 2200	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe	125
PID 4576 wrote to memory of 1988	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe	126
PID 4576 wrote to memory of 1988	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe	126
PID 4576 wrote to memory of 1988	4576	{4D399133-1A11-4f17-9348-306E83D269A2}.exe	126
PID 2200 wrote to memory of 1724	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe	127
PID 2200 wrote to memory of 1724	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe	127
PID 2200 wrote to memory of 1724	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe	127
PID 2200 wrote to memory of 964	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe	128
PID 2200 wrote to memory of 964	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe	128
PID 2200 wrote to memory of 964	2200	{804DC732-8740-4537-82BD-D815842B3464}.exe	128
PID 1724 wrote to memory of 2516	1724	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe	129
PID 1724 wrote to memory of 2516	1724	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe	129
PID 1724 wrote to memory of 2516	1724	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe	129
PID 1724 wrote to memory of 1140	1724	{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe	130

C:\Users\Admin\AppData\Local\Temp\2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_064b7a166c45c658219a769bc43289cb_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
  C:\Windows\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
    C:\Windows\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
      C:\Windows\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
        
        C:\Windows\{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4828
      - C:\Windows\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
        
        C:\Windows\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
        
        C:\Windows\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
        
        C:\Windows\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\{4D399133-1A11-4f17-9348-306E83D269A2}.exe
        
        C:\Windows\{4D399133-1A11-4f17-9348-306E83D269A2}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\{804DC732-8740-4537-82BD-D815842B3464}.exe
        
        C:\Windows\{804DC732-8740-4537-82BD-D815842B3464}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
        
        C:\Windows\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
        
        C:\Windows\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe
        
        C:\Windows\{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe
        13⤵
        Executes dropped EXE
        
        PID:788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{99335~1.EXE > nul
        13⤵
        
        PID:224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{305B3~1.EXE > nul
        12⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{804DC~1.EXE > nul
        11⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4D399~1.EXE > nul
        10⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{610B3~1.EXE > nul
        9⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A8E4~1.EXE > nul
        8⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EDC75~1.EXE > nul
        7⤵
        
        PID:4852
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{642C9~1.EXE > nul
        6⤵
        
        PID:3184
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0527C~1.EXE > nul
        5⤵
        
        PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{84A8B~1.EXE > nul
      4⤵
      PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3C2DB~1.EXE > nul
    3⤵
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe

Path C:\Windows\{0527CD17-FB4C-4674-8FB7-AA6FACC6D436}.exe
Size 344KB
SHA256 b0bd94509b75cf87f0f9101f0d471bd44c61b552ab84b009b58923fa056cfef6
MD5 8b70b5adf54c46ac50b0e1fc688c5a9e
SHA1 a4ebb7a49d0f11869eb3d6edb7e59cb3dcc3c6d0
SHA512 8dd2d64ff8ab961cd10ea699ea27dbcd4bd2fd6c50c5ca6c27437bda8877258ecdd0cdfd53b28cca68ab25950a4a38d6bf65ec4724f2c8e2f351832253d4147c
SSDEEP 3072:mEGh0o4lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGOlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe

Path C:\Windows\{17B73FA4-8388-482d-B5F8-A4297ACC3211}.exe
Size 344KB
SHA256 e8c81a725dfdad1bc4fa119536ecdc7495adc5812327ebe8ec9000b52d243841
MD5 81501876a3e6d4b40c79813a28c697e3
SHA1 e6c7157fe65478e3c15d536a103b86063d8c0f12
SHA512 4f307e5968ec5ba413331ed495f364acfc6633a80137322ad0126896d6cf950dd2e21b854e07e72dae4020b0e9b3d883934b6fc0bde62260abbe301561d6f6d0
SSDEEP 3072:mEGh0oWlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe

Path C:\Windows\{305B3C60-C98F-4812-B30E-AFDBFAF06CAB}.exe
Size 344KB
SHA256 3b28456671aefe826865b7881edd9aa7287e5fcd7a07f37df48cbead87f866df
MD5 72127c0e7260c1a3a51a3eb2bece5cf0
SHA1 727e88d7e90b25882109d99ca0d6f5f20ed6453a
SHA512 7238c67e3bc78d0b9d8f020c97b6b9bdc46320acd47c3a5ff2ea2f2edbabe985f3b0967332b2730bddbf8e324c3ba0d4500765b867fd446918112eaa90794765
SSDEEP 3072:mEGh0otlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGLlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe

Path C:\Windows\{3C2DB7B5-FCD5-469c-89A2-04257401A7BE}.exe
Size 344KB
SHA256 466b69c1cd2318390642dbf5c3df69ee36f76766175eb59d56be70dde6cb34d3
MD5 0eaf581a1dd3310cf29baaf378caa5a3
SHA1 b6e4ee394ed6f20beed91c19688d338827536b46
SHA512 e5c9367b46284743775e04faf10cf7c3fe30b6e7e13c348e6c88076e77b1a9fccec976db31c38b6b52c45f1ffc1974886df5831c52a4a286cce5d6d5fba73fd3
SSDEEP 3072:mEGh0oolEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGOlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4D399133-1A11-4f17-9348-306E83D269A2}.exe

Path C:\Windows\{4D399133-1A11-4f17-9348-306E83D269A2}.exe
Size 344KB
SHA256 88e3c73f376f0e6020eb5736589d17832ea919143091de864b80898270948be3
MD5 1af57a7efacee763c251e627b797089f
SHA1 499660d89ef6d5497208ebb7cca64634c393be82
SHA512 6ee757925f1e9fe4a4dc6539f588b6f3f04a9e919dfcb462f2968c2b7de19aa1312b39965a9be80b1226684fc055f62e3e8880d4839a72999920dd18b74e4509
SSDEEP 3072:mEGh0oDlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG9lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe

Path C:\Windows\{610B33D8-C826-4bdd-9D4B-DF58DB1E1B3D}.exe
Size 344KB
SHA256 1cf9929f8255dc39cb32cf6074855ed92012a03bcd48179780e2391c890afd66
MD5 100bb54c14cf73ca7d37bd9229ce9dc4
SHA1 bbcaf3756831fc9fe12561bc6e08c14faa69842d
SHA512 9c25e63926d0fed0666e9e5b04be206c270411af299be2f01f0bbed17315a9e114912f10cab005f82434da4f011b236fd304aa600c7c553d9ae638ba5cb5ba28
SSDEEP 3072:mEGh0o8lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG6lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{642C9079-39C3-4962-AA7F-53DB733BF390}.exe

Path C:\Windows\{642C9079-39C3-4962-AA7F-53DB733BF390}.exe
Size 344KB
SHA256 fb374ecaed6aa8af52ed24a4da7afe96ca8bc97456f3b4a2ba77adfde61f7d1b
MD5 328480d08ee42451fd899388e518e896
SHA1 204cdc64f0e6c24ca6e6bed8499798caffccea50
SHA512 aecc591d55aa4d4095edabc4fe686667e0bbcd83d0866417581c097625eb58d019e07c7a316c55fc1754a90d7fabc87cfb96ad1b5ec41689ee154b402d777f4d
SSDEEP 3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{804DC732-8740-4537-82BD-D815842B3464}.exe

Path C:\Windows\{804DC732-8740-4537-82BD-D815842B3464}.exe
Size 344KB
SHA256 f9921b140a59874727e616db5c24ff151f17b60d5975e2df035bb6feab053799
MD5 7e37fa7009536646ee91f06258f99f63
SHA1 db700f362a9d7ec7bbc315a3972657abe3b7d925
SHA512 09a2d7160939569ccc72062bd6f349b5fc665e994f3fab45777d562215dc740a4d380fc0155409cb5e287bd59442c12f27e15bb9273a035d8e44bc92c6a1f571
SSDEEP 3072:mEGh0oylEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGYlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe

Path C:\Windows\{84A8B958-E1F0-4fb6-860E-730D3D7CB3C4}.exe
Size 344KB
SHA256 1b24ef999d92f8e55f4a81549998b4e5bb77a10113b2b762aebfc6e7f51c62fd
MD5 42cf34905eeff66eefef2bd7afbd2f1f
SHA1 be519bc62438e7481680b5a403d9132969b90722
SHA512 48b6f726b7545aa2eac1801063c6a641b5b5f04a8d0f1cbe210eb036ae1046647c7b88c66a1f63c26f986a70e9b6f9defa581155c296ea22a90b0500fd606010
SSDEEP 3072:mEGh0oJlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGjlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe

Path C:\Windows\{99335B7B-65DA-4727-BF96-DA3EF1814AD7}.exe
Size 344KB
SHA256 d8366b0a884190d152fc3c5d325bc8dfc81b14d713f720b863301982f52dbfbe
MD5 aec7091e4c8d441056a70849d73783f6
SHA1 b0f851dc1791ed4ee3cf46be5c91b6b06e7a9f78
SHA512 0bbef91bf19da05b4f2bde05d1720b0c97df1f08d58b6a17e2ec6b3123d4a8352c3a20fadfa12d9aef514d471718c262a1b5746e999cbd8228d195b4dfcb9094
SSDEEP 3072:mEGh0oAlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGulqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe

Path C:\Windows\{9A8E4AD8-37EF-404c-A5C4-BBF19D1F456A}.exe
Size 344KB
SHA256 74b1ffa09eed870b73bf3f362ce415c29fd09deceff248fd3ed2bbbaa591c488
MD5 853ef12cc7cce7745e6df099fec416fe
SHA1 88a6835156f885bbd8b71d15df7fab8d0b155924
SHA512 3938c6496432b608a781c4ee31d892f2f816f2e162f9496cc13044e3be8e016e35045ef4613b842484a07adae7d3bdea8494e6e88140a6eb3e7cbfea532fd852
SSDEEP 3072:mEGh0omlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGQlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe

Path C:\Windows\{EDC750BC-52D8-4cbd-BA39-2E3FC1D2D5E2}.exe
Size 344KB
SHA256 5d7c3b6f1b0f4a093d87c847ebdfbc6bde398a696caa8f13787cef4da8d2e6db
MD5 96c6644545c954609aafc9ea85494fb9
SHA1 27dc92bcfefd93c1a3e67807dafce4f10581ab87
SHA512 8f3639129994b9e011d73dc3599359690d4ad00cdb9d49143a6ca89c0bd20a7cdda597321d0659c4b325c81559c1068e87fd917cb124b47b179992a8e488e6e8
SSDEEP 3072:mEGh0oelEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGUlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads