a3413ebe071d4c0b594fd321976c8caba4e1b93b86173bf069fda108305d0ded

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
Size

216KB
MD5

1192bb5f2954b454eee6b0997f14f14e
SHA1

20e60a0cb9f42e7a451ed7165b20464e3278e8aa
SHA256

a3413ebe071d4c0b594fd321976c8caba4e1b93b86173bf069fda108305d0ded
SHA512

0876ac9a970e19fb87b9123a5272c0c122368e17c251765a213c05ae6b617c7e90511ea00ca72fe14ef125837d3fa9d0d199a20d2681cb40b82d99878a459a24
SSDEEP

3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGWlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012265-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00040000000130fc-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012265-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012265-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012265-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012265-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012265-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000004ed7-82.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79A64940-0D94-4387-B64E-466C19340F11}	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}	{79A64940-0D94-4387-B64E-466C19340F11}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}	{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49120BE8-A9B7-48ac-A721-280D79C97D84}	{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}\stubpath = "C:\\Windows\\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe"	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B4F89D4-0701-4757-B67E-C2350747DC3D}	{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0B4F89D4-0701-4757-B67E-C2350747DC3D}\stubpath = "C:\\Windows\\{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe"	{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{540BDF60-4C84-48dc-A112-72A2163322AE}	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}\stubpath = "C:\\Windows\\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe"	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}\stubpath = "C:\\Windows\\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe"	{79A64940-0D94-4387-B64E-466C19340F11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}\stubpath = "C:\\Windows\\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe"	{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}\stubpath = "C:\\Windows\\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe"	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E5EF979-ADFC-4300-8646-74751667D1B4}	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E5EF979-ADFC-4300-8646-74751667D1B4}\stubpath = "C:\\Windows\\{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe"	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}\stubpath = "C:\\Windows\\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe"	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}\stubpath = "C:\\Windows\\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe"	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{540BDF60-4C84-48dc-A112-72A2163322AE}\stubpath = "C:\\Windows\\{540BDF60-4C84-48dc-A112-72A2163322AE}.exe"	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79A64940-0D94-4387-B64E-466C19340F11}\stubpath = "C:\\Windows\\{79A64940-0D94-4387-B64E-466C19340F11}.exe"	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49120BE8-A9B7-48ac-A721-280D79C97D84}\stubpath = "C:\\Windows\\{49120BE8-A9B7-48ac-A721-280D79C97D84}.exe"	{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe

Deletes itself 1 IoCs

pid	Process
2560	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe
1488	{79A64940-0D94-4387-B64E-466C19340F11}.exe
1628	{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
2300	{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
2116	{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe
2252	{49120BE8-A9B7-48ac-A721-280D79C97D84}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
File created	C:\Windows\{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
File created	C:\Windows\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe	{79A64940-0D94-4387-B64E-466C19340F11}.exe
File created	C:\Windows\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe	{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
File created	C:\Windows\{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe	{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
File created	C:\Windows\{49120BE8-A9B7-48ac-A721-280D79C97D84}.exe	{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe
File created	C:\Windows\{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
File created	C:\Windows\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
File created	C:\Windows\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
File created	C:\Windows\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
File created	C:\Windows\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
File created	C:\Windows\{79A64940-0D94-4387-B64E-466C19340F11}.exe	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
Token: SeIncBasePriorityPrivilege	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
Token: SeIncBasePriorityPrivilege	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
Token: SeIncBasePriorityPrivilege	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
Token: SeIncBasePriorityPrivilege	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
Token: SeIncBasePriorityPrivilege	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
Token: SeIncBasePriorityPrivilege	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe
Token: SeIncBasePriorityPrivilege	1488	{79A64940-0D94-4387-B64E-466C19340F11}.exe
Token: SeIncBasePriorityPrivilege	1628	{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
Token: SeIncBasePriorityPrivilege	2300	{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
Token: SeIncBasePriorityPrivilege	2116	{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3036	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	28
PID 2356 wrote to memory of 3036	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	28
PID 2356 wrote to memory of 3036	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	28
PID 2356 wrote to memory of 3036	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	28
PID 2356 wrote to memory of 2560	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	29
PID 2356 wrote to memory of 2560	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	29
PID 2356 wrote to memory of 2560	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	29
PID 2356 wrote to memory of 2560	2356	2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe	29
PID 3036 wrote to memory of 2424	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	30
PID 3036 wrote to memory of 2424	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	30
PID 3036 wrote to memory of 2424	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	30
PID 3036 wrote to memory of 2424	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	30
PID 3036 wrote to memory of 2712	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	31
PID 3036 wrote to memory of 2712	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	31
PID 3036 wrote to memory of 2712	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	31
PID 3036 wrote to memory of 2712	3036	{540BDF60-4C84-48dc-A112-72A2163322AE}.exe	31
PID 2424 wrote to memory of 2416	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	33
PID 2424 wrote to memory of 2416	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	33
PID 2424 wrote to memory of 2416	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	33
PID 2424 wrote to memory of 2416	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	33
PID 2424 wrote to memory of 2448	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	34
PID 2424 wrote to memory of 2448	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	34
PID 2424 wrote to memory of 2448	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	34
PID 2424 wrote to memory of 2448	2424	{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe	34
PID 2416 wrote to memory of 2596	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	36
PID 2416 wrote to memory of 2596	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	36
PID 2416 wrote to memory of 2596	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	36
PID 2416 wrote to memory of 2596	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	36
PID 2416 wrote to memory of 2844	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	37
PID 2416 wrote to memory of 2844	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	37
PID 2416 wrote to memory of 2844	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	37
PID 2416 wrote to memory of 2844	2416	{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe	37
PID 2596 wrote to memory of 3068	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	38
PID 2596 wrote to memory of 3068	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	38
PID 2596 wrote to memory of 3068	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	38
PID 2596 wrote to memory of 3068	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	38
PID 2596 wrote to memory of 1072	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	39
PID 2596 wrote to memory of 1072	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	39
PID 2596 wrote to memory of 1072	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	39
PID 2596 wrote to memory of 1072	2596	{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe	39
PID 3068 wrote to memory of 1976	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	40
PID 3068 wrote to memory of 1976	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	40
PID 3068 wrote to memory of 1976	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	40
PID 3068 wrote to memory of 1976	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	40
PID 3068 wrote to memory of 1688	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	41
PID 3068 wrote to memory of 1688	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	41
PID 3068 wrote to memory of 1688	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	41
PID 3068 wrote to memory of 1688	3068	{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe	41
PID 1976 wrote to memory of 2724	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	42
PID 1976 wrote to memory of 2724	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	42
PID 1976 wrote to memory of 2724	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	42
PID 1976 wrote to memory of 2724	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	42
PID 1976 wrote to memory of 676	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	43
PID 1976 wrote to memory of 676	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	43
PID 1976 wrote to memory of 676	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	43
PID 1976 wrote to memory of 676	1976	{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe	43
PID 2724 wrote to memory of 1488	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	44
PID 2724 wrote to memory of 1488	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	44
PID 2724 wrote to memory of 1488	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	44
PID 2724 wrote to memory of 1488	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	44
PID 2724 wrote to memory of 2772	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	45
PID 2724 wrote to memory of 2772	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	45
PID 2724 wrote to memory of 2772	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	45
PID 2724 wrote to memory of 2772	2724	{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
  C:\Windows\{540BDF60-4C84-48dc-A112-72A2163322AE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
    C:\Windows\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
      C:\Windows\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Windows\{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
        
        C:\Windows\{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
      - C:\Windows\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
        
        C:\Windows\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
        
        C:\Windows\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe
        
        C:\Windows\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\{79A64940-0D94-4387-B64E-466C19340F11}.exe
        
        C:\Windows\{79A64940-0D94-4387-B64E-466C19340F11}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
        
        C:\Windows\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
        
        C:\Windows\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Windows\{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe
        
        C:\Windows\{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\{49120BE8-A9B7-48ac-A721-280D79C97D84}.exe
        
        C:\Windows\{49120BE8-A9B7-48ac-A721-280D79C97D84}.exe
        13⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0B4F8~1.EXE > nul
        13⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D2E4A~1.EXE > nul
        12⤵
        
        PID:912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{639FD~1.EXE > nul
        11⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79A64~1.EXE > nul
        10⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12AB3~1.EXE > nul
        9⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8E6D0~1.EXE > nul
        8⤵
        
        PID:676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AB54D~1.EXE > nul
        7⤵
        
        PID:1688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E5EF~1.EXE > nul
        6⤵
        
        PID:1072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9BDAD~1.EXE > nul
        5⤵
        
        PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6BB3F~1.EXE > nul
      4⤵
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{540BD~1.EXE > nul
    3⤵
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0B4F89D4-0701-4757-B67E-C2350747DC3D}.exe

Filesize
216KB

MD5
d32d5d1da8df8913a66701364a92cdcf

SHA1
19c7321e02ce77757a67e4c070e28b39104369ad

SHA256
5745bc167c6573a9b86e9447571925bb39711ef989a61b3436f6fb72f0b22dfc

SHA512
1c4fd95e782304be401dce09810128df27909c29d899b2bd79c521ca600dfafba65546da9811f8be11ea1fb3e3f8cb3d310f3c3b01f884f5cf835f2da8ec550c

Download Submit
C:\Windows\{12AB3D37-1BD2-433b-A0C9-E49A49D89168}.exe

Filesize
216KB

MD5
d5846a9f72f7011b9098b90c0b40acc4

SHA1
491b87e065e4d08f5be4ef97fd698ceb014aefef

SHA256
f7b077a1850b7ed8bb3c34db936f02ce1003d96d8bcb9840a39d924424b6bef7

SHA512
e0f0dd6a62a8f1d2c6254e0a07f677f4307fedfc5c7c2054d927f09cb5ad1376450ca4f2a7f0eca6e457da153bf837cb0a6048b993b1d5387914469ef0d4affa

Download Submit
C:\Windows\{49120BE8-A9B7-48ac-A721-280D79C97D84}.exe

Filesize
128KB

MD5
f206437babc05f3495645f2605b48f1b

SHA1
a613f55fbab4cf51b7d7a3407bcc0ca0d7135935

SHA256
ed895d9695a7777b6f57a488f65c9482c2c08e9173fec5fc172ef484a1e96ba3

SHA512
189a07c6d7aa25132d150dde7f821ab6eb2780e0886cbda2cab29fa4f7c908cc7a849b354b2698bff65190df168c57c3f0dd87d06917fee8ac984801cd03df72

Download Submit
C:\Windows\{4E5EF979-ADFC-4300-8646-74751667D1B4}.exe

Filesize
216KB

MD5
caff2dc8f8bb071f491cd52243c96748

SHA1
87cf63ba3b0e40ad992f17bf5684053d18e7865c

SHA256
d03596f83de425bf398eceae498cdc2cdd02dbd769dddee35ed3f7d1a999bc8b

SHA512
5c1319cef675a17ea091acc153da6ec50aed7ada7ad42015cd634b9c14ad1b3448f55420e9753a7586c84eee5e9718b566bd180c8ce2c9a6ab8c1db2ddf3e377

Download Submit
C:\Windows\{540BDF60-4C84-48dc-A112-72A2163322AE}.exe

Filesize
216KB

MD5
176c8a82d86c412949eead297e74698c

SHA1
33675a6ef8d655847a9297807259a833dfdefb53

SHA256
8f32ea3f85c3f441185c88b91ff1bcac5a7722b72661c04295976154146f56dd

SHA512
700167fa8a06881d6db9bee52551554846149a408064a4a3d7aebd7b2607aab071a18154a80878ec0bef9a746b5ab686fd6948c01041c724814791bee07e7ded

Download Submit
C:\Windows\{639FD65D-5FDD-42de-ABA4-51FB5D05A7FC}.exe

Filesize
216KB

MD5
631faef3386f8e35b901aacc0a158eca

SHA1
a127b020d9d7f8d9b6f8888ded8b1911836799c7

SHA256
ca1d3c5d0290b652931cd56ce279ceac8445fcbb8ba62ffd6b49a1a9a293ea1b

SHA512
688675e9f192bba2e67aff0b652952429aec90f555e03f2a2a614ab7b43ad8d07d6b3879b675dd08fc54fec37276b6f7547636b788fae68380e1c2d20ef1c017

Download Submit
C:\Windows\{6BB3F229-4761-44b0-8B1B-8F4B9754B685}.exe

Filesize
216KB

MD5
d04d24fbcf90aacf9c123a151c5dc0f9

SHA1
4cc0e6ce61d491b289472fcf580dc4548e631480

SHA256
090bfffe5b7e89e158a86c15fea4e1db34dd8093413d8f93269ccdb3475e593f

SHA512
952a8a6f7efe06e04b0e745768f6bcf8e968a63147b66dcdf2faefad703b7d8c20a0ad2ed774ebc3a61b61f240d08d3cad51e63574e7017e20b4add76bb7da10

Download Submit
C:\Windows\{79A64940-0D94-4387-B64E-466C19340F11}.exe

Filesize
216KB

MD5
4d6452605e8f3ac3e0cf1d73c60ef719

SHA1
82c001106b29287481bb154a2d0585413999dd2b

SHA256
d307819c64925af7a22db3b99438f7e59dfb7151b4f87842f83d9170039f89c3

SHA512
2b9cea5f9ea89867632cdd65b2034effc98c71f7ddb1e034b8c92b55f0aa4c5430f1bbedf3fa01f6c9185bbeac3e65fcf0fcf1fb5e9a950c51a8e8c7e440df07

Download Submit
C:\Windows\{8E6D0F43-BA7D-486a-8D8E-C0519B20A405}.exe

Filesize
216KB

MD5
5ccd5ac73c1859727427124d7d627ebc

SHA1
4c90cba5a0683057e69568aa33325122419ed16e

SHA256
937fff88c86ef487478ee7f725e926e66b7c9b1167f88f8275028bba083f4977

SHA512
97a075e9063258bcb378bdb5888ce451a5731ab4b6eff906ef404b382fb5576ed984edb13c2104a0ddf0e0eb8999fc00336a2d5a95b3cfa3d6f5bbd87e8a1321

Download Submit
C:\Windows\{9BDADA1F-7FD5-4c69-835B-5A6B2F4B6DF9}.exe

Filesize
216KB

MD5
3c1388f02aa6b9006928154392632936

SHA1
422b2224fd4a8cc645e808c05192349f913e9431

SHA256
ef087d057f88fefb99464095afb43a02d1431ab121831d956bab8510bf939d17

SHA512
da03ba9f3f14b088a5fc55163bb5f243d4901ddaf327fe8d06477c90afa0ab9be2de31274df4c6021122adbee32cda17d7dedeeb1cf2b1cc3c4834122bb2452a

Download Submit
C:\Windows\{AB54D5F1-911E-4a18-88D4-DA92F1B6D5C8}.exe

Filesize
216KB

MD5
c29e0fb25ed1ab7d6d4a07952ecce75e

SHA1
d6a71fd59a8ef45f737d91a788ab5905eb9ce7be

SHA256
1cd58a9c769482132daf8baab4a7d9af5ee8f47bca435c5e723b55c37baa494b

SHA512
95ff60da4e0deb54c844d37937ab57d9f74eea0d22aba6399b63be30e87c435a15752b9bbbe3ad2b2637177fdee59657a2eba4b4a5490a7b7a6ea8ae7a15259d

Download Submit
C:\Windows\{D2E4A12D-F64E-42bb-A99C-D6D26901E16B}.exe

Filesize
216KB

MD5
5e4512331ab137c209c4b356d36848aa

SHA1
4eda04b2ccd9f71ceceead4e50798d67f2a980b0

SHA256
a542927dc22431cd11b70141db8ee977b21489525ca68ad64c0a1c7457e4e3ef

SHA512
a526c7d30ee5e7477691966971d6f23d50fb14e9c8b1ce91839b9996470b8e59a2a9b0304e285c7e8c9d81984564544bccc1b0cf15866211c8656e0e50def3f3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads