bcdef0a8f8bcfa0421d9716cc48cf5b3c88c653171bd61b1ed5d822b46973eed

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe
Size

216KB
MD5

b4b0f4edebab3d2fb68db1d7b1319bea
SHA1

b6219fe62cfa07f910034a10b83dc21e23637faa
SHA256

bcdef0a8f8bcfa0421d9716cc48cf5b3c88c653171bd61b1ed5d822b46973eed
SHA512

6772e20ad0e9e6caf343f67057dde7f8ed92b2436c03f20ead911fa2dc702acdca4a3ba6e6ae08045264d829522afca0e4b5c3147203fe8a9de117553329f93f
SSDEEP

3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGplEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023208-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023209-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002312c-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002312d-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002312c-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002312d-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002312c-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023212-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002312c-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023202-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023120-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023130-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}	{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}\stubpath = "C:\\Windows\\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe"	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}\stubpath = "C:\\Windows\\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe"	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}\stubpath = "C:\\Windows\\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe"	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}\stubpath = "C:\\Windows\\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe"	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A0F66EB-8218-4134-9440-7E0536AC4706}\stubpath = "C:\\Windows\\{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe"	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}\stubpath = "C:\\Windows\\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe"	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A0F66EB-8218-4134-9440-7E0536AC4706}	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F82C359E-2EFC-4067-8348-9AD951A11DEA}	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}\stubpath = "C:\\Windows\\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe"	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}\stubpath = "C:\\Windows\\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}.exe"	{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}\stubpath = "C:\\Windows\\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe"	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}\stubpath = "C:\\Windows\\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe"	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F82C359E-2EFC-4067-8348-9AD951A11DEA}\stubpath = "C:\\Windows\\{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe"	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}\stubpath = "C:\\Windows\\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe"	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe

Executes dropped EXE 12 IoCs

pid	Process
1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe
4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
4940	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe
1412	{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe
2392	{618CA425-0F6A-463b-92A9-9AE3E1AB420B}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
File created	C:\Windows\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
File created	C:\Windows\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
File created	C:\Windows\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe
File created	C:\Windows\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
File created	C:\Windows\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
File created	C:\Windows\{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
File created	C:\Windows\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
File created	C:\Windows\{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
File created	C:\Windows\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe
File created	C:\Windows\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}.exe	{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe
File created	C:\Windows\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe
Token: SeIncBasePriorityPrivilege	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
Token: SeIncBasePriorityPrivilege	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
Token: SeIncBasePriorityPrivilege	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
Token: SeIncBasePriorityPrivilege	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
Token: SeIncBasePriorityPrivilege	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
Token: SeIncBasePriorityPrivilege	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
Token: SeIncBasePriorityPrivilege	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
Token: SeIncBasePriorityPrivilege	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
Token: SeIncBasePriorityPrivilege	4940	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe
Token: SeIncBasePriorityPrivilege	1412	{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1876	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe	101
PID 800 wrote to memory of 1876	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe	101
PID 800 wrote to memory of 1876	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe	101
PID 800 wrote to memory of 1416	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe	102
PID 800 wrote to memory of 1416	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe	102
PID 800 wrote to memory of 1416	800	2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe	102
PID 1876 wrote to memory of 4984	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	103
PID 1876 wrote to memory of 4984	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	103
PID 1876 wrote to memory of 4984	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	103
PID 1876 wrote to memory of 4796	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	104
PID 1876 wrote to memory of 4796	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	104
PID 1876 wrote to memory of 4796	1876	{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe	104
PID 4984 wrote to memory of 4372	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	108
PID 4984 wrote to memory of 4372	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	108
PID 4984 wrote to memory of 4372	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	108
PID 4984 wrote to memory of 968	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	109
PID 4984 wrote to memory of 968	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	109
PID 4984 wrote to memory of 968	4984	{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe	109
PID 4372 wrote to memory of 3692	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	110
PID 4372 wrote to memory of 3692	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	110
PID 4372 wrote to memory of 3692	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	110
PID 4372 wrote to memory of 3876	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	111
PID 4372 wrote to memory of 3876	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	111
PID 4372 wrote to memory of 3876	4372	{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe	111
PID 3692 wrote to memory of 3204	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	113
PID 3692 wrote to memory of 3204	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	113
PID 3692 wrote to memory of 3204	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	113
PID 3692 wrote to memory of 2888	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	114
PID 3692 wrote to memory of 2888	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	114
PID 3692 wrote to memory of 2888	3692	{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe	114
PID 3204 wrote to memory of 2060	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	115
PID 3204 wrote to memory of 2060	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	115
PID 3204 wrote to memory of 2060	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	115
PID 3204 wrote to memory of 2668	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	116
PID 3204 wrote to memory of 2668	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	116
PID 3204 wrote to memory of 2668	3204	{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe	116
PID 2060 wrote to memory of 2608	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	117
PID 2060 wrote to memory of 2608	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	117
PID 2060 wrote to memory of 2608	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	117
PID 2060 wrote to memory of 3096	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	118
PID 2060 wrote to memory of 3096	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	118
PID 2060 wrote to memory of 3096	2060	{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe	118
PID 2608 wrote to memory of 748	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	125
PID 2608 wrote to memory of 748	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	125
PID 2608 wrote to memory of 748	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	125
PID 2608 wrote to memory of 4812	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	126
PID 2608 wrote to memory of 4812	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	126
PID 2608 wrote to memory of 4812	2608	{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe	126
PID 748 wrote to memory of 4576	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	128
PID 748 wrote to memory of 4576	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	128
PID 748 wrote to memory of 4576	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	128
PID 748 wrote to memory of 2300	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	129
PID 748 wrote to memory of 2300	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	129
PID 748 wrote to memory of 2300	748	{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe	129
PID 4576 wrote to memory of 4940	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	130
PID 4576 wrote to memory of 4940	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	130
PID 4576 wrote to memory of 4940	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	130
PID 4576 wrote to memory of 3728	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	131
PID 4576 wrote to memory of 3728	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	131
PID 4576 wrote to memory of 3728	4576	{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe	131
PID 4940 wrote to memory of 1412	4940	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe	135
PID 4940 wrote to memory of 1412	4940	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe	135
PID 4940 wrote to memory of 1412	4940	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe	135
PID 4940 wrote to memory of 512	4940	{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe	136

C:\Users\Admin\AppData\Local\Temp\2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_b4b0f4edebab3d2fb68db1d7b1319bea_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe
  C:\Windows\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
    C:\Windows\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
      C:\Windows\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Windows\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
        
        C:\Windows\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3692
      - C:\Windows\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
        
        C:\Windows\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
        
        C:\Windows\{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
        
        C:\Windows\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
        
        C:\Windows\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
        
        C:\Windows\{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe
        
        C:\Windows\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe
        
        C:\Windows\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
        
        C:\Windows\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}.exe
        
        C:\Windows\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}.exe
        13⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D2EF~1.EXE > nul
        13⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5F9B~1.EXE > nul
        12⤵
        
        PID:512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F82C3~1.EXE > nul
        11⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD2D2~1.EXE > nul
        10⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A688D~1.EXE > nul
        9⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A0F6~1.EXE > nul
        8⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7613D~1.EXE > nul
        7⤵
        
        PID:2668
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80642~1.EXE > nul
        6⤵
        
        PID:2888
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C42BA~1.EXE > nul
        5⤵
        
        PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C4145~1.EXE > nul
      4⤵
      PID:968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0D7CD~1.EXE > nul
    3⤵
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A0F66EB-8218-4134-9440-7E0536AC4706}.exe

Filesize
216KB

MD5
f90aa0980438a2c8641913ea8ea4968b

SHA1
9c71a6ef24e7084eee06e7d44f9cc79bcd0cd3a9

SHA256
39e76282042a4b17a3e3134f9e4eb4d5a221e16db37f6950ed0c63ae7a112897

SHA512
f1e530aba09ed00026a491e857f3d95314cdd1524f9d1ecd68e38b05a467347c91be75bddaea3417356c98a2098f074731a4ab17112a09ab7a111ceccd2737ef

Download Submit
C:\Windows\{0D7CDE35-3EE9-47bf-AC47-BA601E34AC5E}.exe

Filesize
216KB

MD5
b06e40d1cba6d87b44e03fddf094292f

SHA1
226cea2bb8bf48c402f9bd0de58054582058e699

SHA256
9630239413f0437b7a6165264b6489af46dcf0fe935b20f053c90502df3678a5

SHA512
4e18319cd432ce2802e0346882b96818bf3ea3a70a3884dccdcb64c0c321c73625bda2451d65a51766e8f128126a7ee875abc476ef47aba10dd109266749d72e

Download Submit
C:\Windows\{618CA425-0F6A-463b-92A9-9AE3E1AB420B}.exe

Filesize
216KB

MD5
566e66aacc935670be29270ecd138f49

SHA1
fa8528bb04a3f682524df5b295a40e3552d3d1ec

SHA256
5cb9fa54e30abe3d83f17355b95863e024bc57374c63a5c5b309a6da880aa776

SHA512
6ad61bbe2d4f9f4da3c7183c44553c97532262f2ca3b88b8542cfdaf0f84ebc1272be88f581feaf56c314d93a37443c6b87b2a6ebb5b3d9a21d3d63194124704

Download Submit
C:\Windows\{6D2EF0BE-0C09-4877-B12F-1A9BAC11CC9E}.exe

Filesize
216KB

MD5
cd9fd8c4f2f82c052b8a472e800dcfb9

SHA1
513831e505fbc9b4369ed5166edd2db22316cc0e

SHA256
d79900a4280a3ca2e3589ffb4c1c45c74ba9ec6de1e926015ce8cb1ea08a0384

SHA512
b69f427871a6f66c8c9e83575933ce5d7d1f12df271b7034a7bb0842a1ba296ba8620bd4d3ece1b4e75d48ceb701355337e847eb050b2aeb75f081186f625bc7

Download Submit
C:\Windows\{7613DCEF-3B79-4d8c-A4AE-DD27FFED2093}.exe

Filesize
216KB

MD5
71e9792d7cb4a5aea0597ab660d1d0ae

SHA1
32800b6becc3ebd0d45317bcc41181cc000dc8df

SHA256
894d33324f673ecb8f5c3ede77ccb93333b53fae1f93c56d846b5e3a82f82bf5

SHA512
ca94f2b967b60d4908dbac533ca581fe80eca90f1e38f6d91a0abfd17eaea244d60ec6ee261a8a600e2d2dfbe5671fa857efc54d06438486b6ef9a0384c13c99

Download Submit
C:\Windows\{80642CFB-5B07-4a36-8C18-9F30D00B1B84}.exe

Filesize
216KB

MD5
9a7d7c86c90b84f26fd92909105e194c

SHA1
1550f161408cce2d5f4b56da2931d6f7e3dca15e

SHA256
e150d72cc38e0a593ce912cdd88e89218993fc51c6ebea88aec0bdff3f396d6a

SHA512
febdb462e4a62048d3b8206efd28e213687a2cf8c9a9f8010fa506a35ef154d1daa5dbca326db7b6ebdd2ad7733df7473f30be53d84d314a7ae48b6c5fec725e

Download Submit
C:\Windows\{A5F9BA72-6221-4298-A6DD-9E2D72643C26}.exe

Filesize
216KB

MD5
3e1e1b0465347f7cf62f4671e5cb81fc

SHA1
380eadb85fd656df53df8a4b5e5a0ea243e69eff

SHA256
26f26682bed6111fb06040cd36c5139004daf89aefc89a84fad382e50d3a24e1

SHA512
976eb7a1f48d899768efc904a4be13fd03a5a3d27e147d76a2f061d224bd6fbf06483e1643c538ebe2e64a400e1803e2c7e3e0e02a4b99cf49a2aa5147c94014

Download Submit
C:\Windows\{A688D7FD-FCF9-4cec-B7EE-239984FFAE8B}.exe

Filesize
216KB

MD5
7b1adc2146c6c7b08485dea0648359e8

SHA1
1cc2f77a52c41111fd5e5be71962e86a6f17667f

SHA256
b32e0f638e6bb7faa9ce8811be2e698d9c3b3adfc23428f5e46cedbdecc47dda

SHA512
335b8bd8623e48ff5343adeb44ea5d040af021bead72e52fee4a0b80a8479ecf47b9fbb922ecd61e0080dba49a300ce565b5b99d22eec9b578ac9f87ac696476

Download Submit
C:\Windows\{C4145B38-6718-44d4-B5FD-33D1C3C3FA30}.exe

Filesize
216KB

MD5
cb6e10dd6fb018a60127527c0cd1443a

SHA1
344e0c94886d4a7f3246b471be09b42f0d87868b

SHA256
e35a64bcc49aaba85133bfa83fadbf70434de1eecfd54f84c442f394feb0187c

SHA512
26a9110096017850436b987e14a1a6a63c7e90651e7e419b49ca6f948c7e715c49beaf7434ce82452cb7544ba4922cf34dc441360b768eb02c453f120ae86421

Download Submit
C:\Windows\{C42BA89C-FD1B-48c7-A66B-176F6CC3758B}.exe

Filesize
216KB

MD5
42262331e6f1144650bad734ee99c20c

SHA1
5d3d72e842c8ef3309cb317418a4bb8fd7d791a3

SHA256
d1f795ae32759a238ed2f855dbc2bc25081b2bbdbc3ecbddfe0e1a6637935b64

SHA512
e5099a6b039f68f42d0db863fe3329b7cf2507e5348aab71458ad5ffcb189314d83d1141d8e54017c837f4a810d41932e961509f20ea8e42431814adb88820bb

Download Submit
C:\Windows\{F82C359E-2EFC-4067-8348-9AD951A11DEA}.exe

Filesize
216KB

MD5
9abe7de1d69fc5040a5640bf5f8405f7

SHA1
6535c29d40e3dcd0d7377978b9f94d6819bc1c9c

SHA256
ce75d07a3ac037f77652aa29233ab89ce0dfba35b9d77713a86f70aa0894aff0

SHA512
0cf1f40dc779603d21b53eddda5fe27c40be682b9bd45927a832bc5c3becffdd5f80323686603450c5d396dfed09218d03725f4c63596376be22b607cd7bf8cd

Download Submit
C:\Windows\{FD2D2BD2-117C-4ea6-BC4A-68ACBD0E4EBA}.exe

Filesize
216KB

MD5
fd2d856b06ad22b700b26fd6b4e54056

SHA1
85b9d1ca9f7c8f4e11ce40d1a166973387f28e52

SHA256
1650806240ec3a08c31933eea5641fc3d945d673b6dce0e6c8029bf28c626e64

SHA512
7bb34154b332755b995c7856fe6c5b1090bc70b1eef1a18916d66428d95a916e8bad09cfa7e2c18b17a4f9ddcee53ff70058e083c2b60cdfc3df9059228aab5b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads