a86f6d05696b2b10340ca0c32fded7372746705446cd45f9ffdab26c9e930bfb

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe
Size

197KB
MD5

b6fe91cbbcf2a52896febe876ff76772
SHA1

159f809be35e6f65a958eae1d295e18d90d92544
SHA256

a86f6d05696b2b10340ca0c32fded7372746705446cd45f9ffdab26c9e930bfb
SHA512

c4a26988c2cdb8731d4ee543c35e526239250b66e259b72bc09dd50f83fdb79cf1f311957a6b1df74723746d3a58f5d890c878325a25257b7d6c0d9a4a25e080
SSDEEP

3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG6lEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012240-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002d000000014a55-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002e000000014a55-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002f000000014a55-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000f680-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0030000000014a55-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000f680-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0031000000014a55-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000014a94-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000014a94-76.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}	{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50831535-8F2F-4711-9A5F-37BBED36DB32}	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}\stubpath = "C:\\Windows\\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe"	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BBAEF8CE-786C-44d6-9487-5495AD959905}	{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6EB41B34-8345-4fc2-A179-494DB64E523B}	{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6EB41B34-8345-4fc2-A179-494DB64E523B}\stubpath = "C:\\Windows\\{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe"	{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50831535-8F2F-4711-9A5F-37BBED36DB32}\stubpath = "C:\\Windows\\{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe"	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}\stubpath = "C:\\Windows\\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe"	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BBAEF8CE-786C-44d6-9487-5495AD959905}\stubpath = "C:\\Windows\\{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe"	{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}\stubpath = "C:\\Windows\\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe"	{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A16DD3F3-5378-4d64-9AC8-70B56D8C277F}	{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}\stubpath = "C:\\Windows\\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe"	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}\stubpath = "C:\\Windows\\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe"	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}\stubpath = "C:\\Windows\\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe"	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A16DD3F3-5378-4d64-9AC8-70B56D8C277F}\stubpath = "C:\\Windows\\{A16DD3F3-5378-4d64-9AC8-70B56D8C277F}.exe"	{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}\stubpath = "C:\\Windows\\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe"	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}\stubpath = "C:\\Windows\\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe"	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe

Deletes itself 1 IoCs

pid	Process
2492	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe
2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe
760	{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
840	{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
2756	{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe
1104	{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe
File created	C:\Windows\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
File created	C:\Windows\{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe	{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
File created	C:\Windows\{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe	{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
File created	C:\Windows\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe
File created	C:\Windows\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
File created	C:\Windows\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
File created	C:\Windows\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe	{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe
File created	C:\Windows\{A16DD3F3-5378-4d64-9AC8-70B56D8C277F}.exe	{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe
File created	C:\Windows\{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
File created	C:\Windows\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
File created	C:\Windows\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
Token: SeIncBasePriorityPrivilege	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
Token: SeIncBasePriorityPrivilege	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
Token: SeIncBasePriorityPrivilege	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
Token: SeIncBasePriorityPrivilege	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe
Token: SeIncBasePriorityPrivilege	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
Token: SeIncBasePriorityPrivilege	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe
Token: SeIncBasePriorityPrivilege	760	{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
Token: SeIncBasePriorityPrivilege	840	{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
Token: SeIncBasePriorityPrivilege	2756	{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1940	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	28
PID 2256 wrote to memory of 1940	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	28
PID 2256 wrote to memory of 1940	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	28
PID 2256 wrote to memory of 1940	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	28
PID 2256 wrote to memory of 2492	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	29
PID 2256 wrote to memory of 2492	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	29
PID 2256 wrote to memory of 2492	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	29
PID 2256 wrote to memory of 2492	2256	2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe	29
PID 1940 wrote to memory of 2648	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	32
PID 1940 wrote to memory of 2648	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	32
PID 1940 wrote to memory of 2648	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	32
PID 1940 wrote to memory of 2648	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	32
PID 1940 wrote to memory of 2520	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	33
PID 1940 wrote to memory of 2520	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	33
PID 1940 wrote to memory of 2520	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	33
PID 1940 wrote to memory of 2520	1940	{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe	33
PID 2648 wrote to memory of 2444	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	34
PID 2648 wrote to memory of 2444	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	34
PID 2648 wrote to memory of 2444	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	34
PID 2648 wrote to memory of 2444	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	34
PID 2648 wrote to memory of 2820	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	35
PID 2648 wrote to memory of 2820	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	35
PID 2648 wrote to memory of 2820	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	35
PID 2648 wrote to memory of 2820	2648	{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe	35
PID 2444 wrote to memory of 2364	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	36
PID 2444 wrote to memory of 2364	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	36
PID 2444 wrote to memory of 2364	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	36
PID 2444 wrote to memory of 2364	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	36
PID 2444 wrote to memory of 1344	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	37
PID 2444 wrote to memory of 1344	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	37
PID 2444 wrote to memory of 1344	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	37
PID 2444 wrote to memory of 1344	2444	{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe	37
PID 2364 wrote to memory of 564	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	38
PID 2364 wrote to memory of 564	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	38
PID 2364 wrote to memory of 564	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	38
PID 2364 wrote to memory of 564	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	38
PID 2364 wrote to memory of 2596	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	39
PID 2364 wrote to memory of 2596	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	39
PID 2364 wrote to memory of 2596	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	39
PID 2364 wrote to memory of 2596	2364	{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe	39
PID 564 wrote to memory of 2804	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	40
PID 564 wrote to memory of 2804	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	40
PID 564 wrote to memory of 2804	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	40
PID 564 wrote to memory of 2804	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	40
PID 564 wrote to memory of 2916	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	41
PID 564 wrote to memory of 2916	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	41
PID 564 wrote to memory of 2916	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	41
PID 564 wrote to memory of 2916	564	{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe	41
PID 2804 wrote to memory of 1912	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	42
PID 2804 wrote to memory of 1912	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	42
PID 2804 wrote to memory of 1912	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	42
PID 2804 wrote to memory of 1912	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	42
PID 2804 wrote to memory of 2284	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	43
PID 2804 wrote to memory of 2284	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	43
PID 2804 wrote to memory of 2284	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	43
PID 2804 wrote to memory of 2284	2804	{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe	43
PID 1912 wrote to memory of 760	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	44
PID 1912 wrote to memory of 760	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	44
PID 1912 wrote to memory of 760	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	44
PID 1912 wrote to memory of 760	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	44
PID 1912 wrote to memory of 1628	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	45
PID 1912 wrote to memory of 1628	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	45
PID 1912 wrote to memory of 1628	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	45
PID 1912 wrote to memory of 1628	1912	{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_b6fe91cbbcf2a52896febe876ff76772_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
  C:\Windows\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
    C:\Windows\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
      C:\Windows\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
        
        C:\Windows\{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe
        
        C:\Windows\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
        
        C:\Windows\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe
        
        C:\Windows\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
        
        C:\Windows\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
        
        C:\Windows\{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
        
        C:\Windows\{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe
        
        C:\Windows\{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe
        
        C:\Windows\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BBAEF~1.EXE > nul
        12⤵
        
        PID:620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6EB41~1.EXE > nul
        11⤵
        
        PID:524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2A93~1.EXE > nul
        10⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D69A~1.EXE > nul
        9⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{854C8~1.EXE > nul
        8⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B06F~1.EXE > nul
        7⤵
        
        PID:2916
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50831~1.EXE > nul
        6⤵
        
        PID:2596
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31EA9~1.EXE > nul
        5⤵
        
        PID:1344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{02927~1.EXE > nul
      4⤵
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DE4B2~1.EXE > nul
    3⤵
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{029277C6-E0DE-4bb2-80C6-B3BDC09D20B9}.exe

Filesize
197KB

MD5
3b06065f9d224bf276f2d0b4e1c2d833

SHA1
49d0359cdbfb0fe6f014a7dea285b312d30e5d91

SHA256
9da32d1df47d4a9be013061463fcf124045ea70e6cb5c160fad41278a7f50d38

SHA512
f9558c2ea129917c7227245355c9ce8145b71800dc9093b92b468ec3b8a325ff03d9e56f4cac147ad6efaa6b92f597ae34dc2172b22e329739dd13cee41a87db

Download Submit
C:\Windows\{2D69A496-EB80-4f7b-8B21-8B69E82FC9D8}.exe

Filesize
197KB

MD5
95fb3265c7ccf2a83aa329764e89da06

SHA1
094be02b497926eb0276a95821957d2d695996e2

SHA256
5ac1a0dd283ba7a830e23f2f267d875533a39faed0b9e2abc5f74dd8509bc73c

SHA512
07bb0913013be928422c3b7afe212bfc33ced3d64deda7c0f2ef1037cde138802a8ebdd0edfebd2e187a823041d558eb7815c1f72f0f679c4fc47aba84abea33

Download Submit
C:\Windows\{31EA9C7E-2E05-4eb4-BEE9-6A2998341FAB}.exe

Filesize
197KB

MD5
6bb60607721e2317fc92563dffa194c2

SHA1
44fd8868e2503a961c3786c580fd6ac395bd5563

SHA256
8c141e6fda1a4ca754e5b0a8ffda4925a1bcd5952efa01775ed6f32a76d54264

SHA512
27259e8f9b90baf79e0c12f4c53efd67bc348732ccb12c7c3c36fbedca6f3a206f2a5d2878d1f520566cd64abd5b4d32e2f513b109a54e02883967e9a2516393

Download Submit
C:\Windows\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe

Filesize
197KB

MD5
bfee13780b157d2cdfd11b0d9520d5e2

SHA1
cf6a9ea00cfee5b6a53c088aa62fc0cf58589014

SHA256
27de1227868b3e3db6ffcfc60b5d7f424d64d74460f14de3fe71b28ab9991a3a

SHA512
32adc235b50a65489b616a97913a523d031b339ce1d1f8ebb615ccf001d18229d187232e7bb1319580f96434fa79f35045204360776830f49283d9cfc3664269

Download Submit
C:\Windows\{4F80FAD6-3B13-4a8f-8D32-89BA95779515}.exe

Filesize
190KB

MD5
4124b837b603964863f3b8d92fa2bffe

SHA1
1ae950fd8b1e8a3874415fbebed70cef933ac4f9

SHA256
9289989c0590890cf5c44c1b6643c00504bb278e770215cb725e67313f5c77b3

SHA512
1ef8d8c247bcc27f6861092586e5c2e7ffa1b183ad4ad475394577eaee9e4446b443597c18fe6cc68e12313676abaf9902ed11b390bfca7a0d91356aa6fc56d6

Download Submit
C:\Windows\{50831535-8F2F-4711-9A5F-37BBED36DB32}.exe

Filesize
197KB

MD5
d7b9328f5951316226ef03f6aa29f855

SHA1
f0f8c9cfaf2279d5663182681c153bd5c326b53f

SHA256
e1a1aad5b026b9e98f47bbf9d40fe6181894c4b5e211f1833a97ad2ccc3e5cbc

SHA512
2e5cdbc467ac217303fabf1cbe51a7b0befc275bfee8ca9dbbe453621d284956b9c9932e5d9d09541f7d29671d3500603b82edc306f3f7d46007a460c0857756

Download Submit
C:\Windows\{6EB41B34-8345-4fc2-A179-494DB64E523B}.exe

Filesize
197KB

MD5
935e4ae3e42ee91779f40028cc288329

SHA1
5648aa4db932b3876c85254cf058b388067e314b

SHA256
4312edfd463dbe497d2eb4484a252249a77a3685c6396b1c61acebf900106784

SHA512
c5cba43fa97702ce7de93e1778854223171b4290a9a80e74301c620abaa8c795632155b78bac041dc8d71dc235f94a115db15f5c652a3014074bdfcb9fc11800

Download Submit
C:\Windows\{7B06FD6F-22F5-493a-8D6E-00220EDC03CC}.exe

Filesize
197KB

MD5
ab1112f2db8dd72279d2f3a556219d13

SHA1
496a3ef2a121b884dbcf704e6150bbc7e01c7c8b

SHA256
818250ca17c6b92722aac1a298859576c99fe8aea5ad77aafe9a169e36fb1855

SHA512
60e60e8f5d53c9dfa9ec283507903cbcb1a2dccb3094cf6673c7e7f16154bcc85f1fe478094e5899d028e6d27e80ec536afd5349db2bf692c3797c8a8faabb31

Download Submit
C:\Windows\{854C8C7C-BDDB-4fc7-84C1-31ED3B4B5FAC}.exe

Filesize
197KB

MD5
2699e619c0c6b3c102555a9f8b7ca490

SHA1
8dd2187683fb62168d9e00a19ecd7fca64669671

SHA256
e68de01adcc8df03b562acafb14311628fc08049d128ef05ea27e37d9fb4dc0d

SHA512
85196f4f1e66c1005a944e08e9b50902d629351b108b68182ce490f5f6aa6dea2fc9fc36169afe0a784009c27c57a6337f09199f45448d3b38cb01ed7c0e2ce9

Download Submit
C:\Windows\{BBAEF8CE-786C-44d6-9487-5495AD959905}.exe

Filesize
197KB

MD5
fd611f09bf72aa79a0f21b8a18263828

SHA1
bffa740d2f66e07ffc02b2fbc1fbae68f9bea2d0

SHA256
ce9a42b058c48ea06c323cf33f1823ed96d551d2e3d5fd4999d49e37ecdd452d

SHA512
2681c647f45fb55e8c39b516c2aa5243d90fe0da6484c9eefa83652cbf63bb0d8434d481cbaa4ec6b9800ac5795084d42b3a8410ff53790e9468b3b6685c4230

Download Submit
C:\Windows\{DE4B23A8-C51C-4323-B554-CA94C6A52E0D}.exe

Filesize
197KB

MD5
85f429d02660c2242fdb96fdbd94dfab

SHA1
939d2ec5e4e473f359f6264f3f6051be33fd5467

SHA256
f4fc73c2924cfc3c7e1088e124de5381055d8fef915e745039f83c3f8edfd082

SHA512
ca8cbed5112a14eee7bb106fa77a54893d7d81c3fe1c5959d70cf3d6aa2e18092e0bfa86137203b9b8c7eb723461d74d795a002cb98800cce4620f08f327ba33

Download Submit
C:\Windows\{E2A93B1C-18D1-4f56-BD82-2829AF8B831F}.exe

Filesize
197KB

MD5
39a565de3d52a093ad55a85233034cc4

SHA1
03747d3a73361e2329ceef88d99a00f8025418a6

SHA256
f907e1e1ec3512fbbf108d0df09f2e2fa52d5c5106de663f69c1ca24439244b2

SHA512
e66d7f6795ff8fad0b3fcf7cb6d9283167ee62bd4bf652b5ab952b31ab7202822ced11e1c28467dc8d29d3d01712798a9196ba739b15943682c25d2a2eee2a78

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads