12578c30957b7c8aafa19086d05ab94875eb937219b9702b938edf11a84b70a5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
Size

408KB
MD5

bea06b806d2df322bbe61ea0b5124726
SHA1

432af0f0e61177c175117e2e41ead19568012aeb
SHA256

12578c30957b7c8aafa19086d05ab94875eb937219b9702b938edf11a84b70a5
SHA512

f27ca686af760c8bd5c2dd74f455597382b4332c2f0694ef932b9817f51752313cab541860b7afb9ac04cf4d16be9983b916a733b6e7223dbe957d3ad677d32f
SSDEEP

3072:CEGh0o5l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGPldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023210-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000006cf-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023315-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001db54-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023396-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023492-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023396-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023495-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023396-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023495-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023396-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002319b-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C758565-7C30-400c-A07A-3A92B5F74BDF}	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C758565-7C30-400c-A07A-3A92B5F74BDF}\stubpath = "C:\\Windows\\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe"	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}\stubpath = "C:\\Windows\\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe"	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59761BBD-3ABA-4738-9C06-E7802B8E8629}	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F7E0654-D82C-4500-BAF0-C5059392DF63}	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F7E0654-D82C-4500-BAF0-C5059392DF63}\stubpath = "C:\\Windows\\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe"	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C290ED1-E136-402c-A12F-1C9722714837}\stubpath = "C:\\Windows\\{6C290ED1-E136-402c-A12F-1C9722714837}.exe"	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}\stubpath = "C:\\Windows\\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe"	{6C290ED1-E136-402c-A12F-1C9722714837}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}\stubpath = "C:\\Windows\\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe"	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C290ED1-E136-402c-A12F-1C9722714837}	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}\stubpath = "C:\\Windows\\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe"	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDA533B7-161C-4493-96C3-821A998821C7}	{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDA533B7-161C-4493-96C3-821A998821C7}\stubpath = "C:\\Windows\\{DDA533B7-161C-4493-96C3-821A998821C7}.exe"	{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}\stubpath = "C:\\Windows\\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe"	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}	{6C290ED1-E136-402c-A12F-1C9722714837}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59761BBD-3ABA-4738-9C06-E7802B8E8629}\stubpath = "C:\\Windows\\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe"	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}\stubpath = "C:\\Windows\\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe"	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}\stubpath = "C:\\Windows\\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe"	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe

Executes dropped EXE 12 IoCs

pid	Process
5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe
4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
4308	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
644	{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
1412	{DDA533B7-161C-4493-96C3-821A998821C7}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
File created	C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
File created	C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
File created	C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
File created	C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
File created	C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
File created	C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
File created	C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe	{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
File created	C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
File created	C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	{6C290ED1-E136-402c-A12F-1C9722714837}.exe
File created	C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
File created	C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
Token: SeIncBasePriorityPrivilege	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe
Token: SeIncBasePriorityPrivilege	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
Token: SeIncBasePriorityPrivilege	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
Token: SeIncBasePriorityPrivilege	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
Token: SeIncBasePriorityPrivilege	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
Token: SeIncBasePriorityPrivilege	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
Token: SeIncBasePriorityPrivilege	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
Token: SeIncBasePriorityPrivilege	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
Token: SeIncBasePriorityPrivilege	4308	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
Token: SeIncBasePriorityPrivilege	644	{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 5044	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe	102
PID 3144 wrote to memory of 5044	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe	102
PID 3144 wrote to memory of 5044	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe	102
PID 3144 wrote to memory of 1492	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe	103
PID 3144 wrote to memory of 1492	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe	103
PID 3144 wrote to memory of 1492	3144	2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe	103
PID 5044 wrote to memory of 4928	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	104
PID 5044 wrote to memory of 4928	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	104
PID 5044 wrote to memory of 4928	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	104
PID 5044 wrote to memory of 2180	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	105
PID 5044 wrote to memory of 2180	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	105
PID 5044 wrote to memory of 2180	5044	{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe	105
PID 4928 wrote to memory of 4964	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe	108
PID 4928 wrote to memory of 4964	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe	108
PID 4928 wrote to memory of 4964	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe	108
PID 4928 wrote to memory of 1404	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe	109
PID 4928 wrote to memory of 1404	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe	109
PID 4928 wrote to memory of 1404	4928	{6C290ED1-E136-402c-A12F-1C9722714837}.exe	109
PID 4964 wrote to memory of 4900	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	110
PID 4964 wrote to memory of 4900	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	110
PID 4964 wrote to memory of 4900	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	110
PID 4964 wrote to memory of 3724	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	111
PID 4964 wrote to memory of 3724	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	111
PID 4964 wrote to memory of 3724	4964	{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe	111
PID 4900 wrote to memory of 4960	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	112
PID 4900 wrote to memory of 4960	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	112
PID 4900 wrote to memory of 4960	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	112
PID 4900 wrote to memory of 1668	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	113
PID 4900 wrote to memory of 1668	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	113
PID 4900 wrote to memory of 1668	4900	{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe	113
PID 4960 wrote to memory of 5064	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	115
PID 4960 wrote to memory of 5064	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	115
PID 4960 wrote to memory of 5064	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	115
PID 4960 wrote to memory of 4236	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	116
PID 4960 wrote to memory of 4236	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	116
PID 4960 wrote to memory of 4236	4960	{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe	116
PID 5064 wrote to memory of 4100	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	117
PID 5064 wrote to memory of 4100	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	117
PID 5064 wrote to memory of 4100	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	117
PID 5064 wrote to memory of 3144	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	118
PID 5064 wrote to memory of 3144	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	118
PID 5064 wrote to memory of 3144	5064	{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe	118
PID 4100 wrote to memory of 1864	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	123
PID 4100 wrote to memory of 1864	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	123
PID 4100 wrote to memory of 1864	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	123
PID 4100 wrote to memory of 3576	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	124
PID 4100 wrote to memory of 3576	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	124
PID 4100 wrote to memory of 3576	4100	{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe	124
PID 1864 wrote to memory of 4552	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	125
PID 1864 wrote to memory of 4552	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	125
PID 1864 wrote to memory of 4552	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	125
PID 1864 wrote to memory of 1724	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	126
PID 1864 wrote to memory of 1724	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	126
PID 1864 wrote to memory of 1724	1864	{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe	126
PID 4552 wrote to memory of 4308	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	127
PID 4552 wrote to memory of 4308	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	127
PID 4552 wrote to memory of 4308	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	127
PID 4552 wrote to memory of 1192	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	128
PID 4552 wrote to memory of 1192	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	128
PID 4552 wrote to memory of 1192	4552	{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe	128
PID 4308 wrote to memory of 644	4308	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe	129
PID 4308 wrote to memory of 644	4308	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe	129
PID 4308 wrote to memory of 644	4308	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe	129
PID 4308 wrote to memory of 2000	4308	{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe	130

C:\Users\Admin\AppData\Local\Temp\2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_bea06b806d2df322bbe61ea0b5124726_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
  C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe
    C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
      C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
        
        C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
        
        C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
        
        C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
        
        C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
        
        C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
        
        C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
        
        C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
        
        C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:644
        
        C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe
        
        C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe
        13⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C758~1.EXE > nul
        13⤵
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BF178~1.EXE > nul
        12⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D8F21~1.EXE > nul
        11⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBAF7~1.EXE > nul
        10⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00A2B~1.EXE > nul
        9⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C2277~1.EXE > nul
        8⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7F7E0~1.EXE > nul
        7⤵
        
        PID:4236
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59761~1.EXE > nul
        6⤵
        
        PID:1668
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42AA8~1.EXE > nul
        5⤵
        
        PID:3724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6C290~1.EXE > nul
      4⤵
      PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{35D17~1.EXE > nul
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00A2B76E-05FA-4e9c-B3A5-14339A3DB233}.exe

Filesize
408KB

MD5
c57a4e5c55f0bb8ad241e48294e4591a

SHA1
aafe291fb738e8052d7e693ac1ee5699af12afae

SHA256
8ed0607f1e2871e4c2dc48401b417674dd83d5c25268ec2f7ba4fe3c59a1887f

SHA512
82fbf97fdf13a3eb0f220dd09e62c8dff58a5a6d02160d1071da662deabbac1716e4b65bf18db3f8e055d4d7a0e5ed3dc6ba706ae2660032e97feec552c31c15

Download Submit
C:\Windows\{35D1719E-47D8-4fc4-8E2A-DE765F5568D7}.exe

Filesize
408KB

MD5
6ab888b90e492cf187a7c725e2053e65

SHA1
5bbae43a644e52cbdc56b6567a319393f134fd39

SHA256
6527cb758f245415e6aeaaa06747d4a34debaf67ed6c4c31677f613926622043

SHA512
a5043ab96eaf4b8b4246ab42647a6f74dba9b67a26a466c5c2ddd3fac71cffbb287a4c3a9440cecb6217d0e8316946f6ae0fc2c87798bd4b153a515e367e67f4

Download Submit
C:\Windows\{42AA86FF-D31B-4c7f-AB10-BFDE7C83EF6A}.exe

Filesize
408KB

MD5
cb9f4850b9e56f3a6c8eab96e5c12aec

SHA1
216413cca0a7223ddaf9ec76fc085f76b81a5f99

SHA256
42d2e2eea05a9bf72d14f2d83bac07f57a1e2e0aab66c4fec55b846060ba95ee

SHA512
35f0a4d4b6832a5af140e0c0be7f8c96f660fe33224486cc68aac53231529b316b500b37d27d65a1e397a57755d83448f3b4657b7c78d19eb332195691483ecf

Download Submit
C:\Windows\{59761BBD-3ABA-4738-9C06-E7802B8E8629}.exe

Filesize
408KB

MD5
29e1fc4cbaaffcc3e025d288a205327a

SHA1
8f11898b9e5f03523bc1fb65a40c0e5a6a4cdfcd

SHA256
ba963eecc3c8dfdfb68b652c95c989151055a92d288633bef892702e9a42a3f7

SHA512
720abc7bd14e60488910bd38e77f5b5dcfab1eec655ed215be6be441ce8311714b631388cf33fe10270f3766bd558580ba62638e50c50847661aa0228cf649ce

Download Submit
C:\Windows\{6C290ED1-E136-402c-A12F-1C9722714837}.exe

Filesize
408KB

MD5
d1af86740d324bff4753b1d9f87a478f

SHA1
51ba266b7a485b8b20a96ff2624bc93adc5657b5

SHA256
b9e3e2adaff05dfe31c6ebaa69f2513adf1861ba998d4d15f8f9c7c0ed2caaa9

SHA512
51fc2f8b7f676d7cde2a411fa839f988c1c1a16680eb82bc7e2b671959ca1baf1af53763544dec97c8aaf4ec365eb476ad277026582e2c515f162872f9a4c0d3

Download Submit
C:\Windows\{7C758565-7C30-400c-A07A-3A92B5F74BDF}.exe

Filesize
408KB

MD5
8d71de44f50816cd2de176a04cdf64dd

SHA1
b78b2bc0f8aea56bef0aeaaa374cb9b7167d77b2

SHA256
1518b6f6b7e5553c6351f540c26b54c32626d7e2587a6770612dbfd1519de0d8

SHA512
590cfe7feaa4ba0585d470889665f5db1232a3c517f0f9a1de05003bdba611f2c072c0e14547bb78c62971775a23d0e0a5c8cad4a95c7c5837126fe21a47c988

Download Submit
C:\Windows\{7F7E0654-D82C-4500-BAF0-C5059392DF63}.exe

Filesize
408KB

MD5
278b3c888fd5db8fa25b751ebae5c329

SHA1
1d512094cfc2a7cf1666d0f4bb378ced6b6b6fa0

SHA256
378399d49a017eec1cc15098b1b0b3448ddaa77d130876dc9e198662dac4bd45

SHA512
0e4906bd8232df97b3e06025634319da8763900794d9aba16a2ab700fb10f949009e25cc737474498cce1e71e684754a32590a5100a9b313953c163af9f53428

Download Submit
C:\Windows\{BF1783B1-7DF6-4834-92D3-DDCC119691E0}.exe

Filesize
408KB

MD5
5fbde14c29d6cfb3e8b7b27401c33b83

SHA1
d31dbeac0a02e26215fc09d59f9044f037c7f32d

SHA256
952d3434f07a50e76ef5bd74f96a152c8c38e4162b44d3f3dcfbcca35514e554

SHA512
e22f86bbbe66df935b0aa7a3d3d4774e307be1dd8c453762b7b6dd38c7a6c9b218ed2166e01816abeefc70060c40c2c2e7c657ace41e0f93dfe2cc13b7e0223b

Download Submit
C:\Windows\{C2277D96-8C2A-47e0-8F15-FB7B9C8C5E22}.exe

Filesize
408KB

MD5
ac01aefd4e0fd2e429ebd93080d45c11

SHA1
fe04386eaf85787a68d7a9ba20fc96e34b05ec0f

SHA256
37f85c788efadbf919553e4761e8e5df6e3997cb95880b7dc83b853c976364b2

SHA512
feb6a19bdbb9b5797d2ad6c1125ea6cee4052ff883d9b2ba06c0410e4bbefa89f01d80f2bd442e591d64b899b4fc84d383703f01bd72d04ce82809ba80af438f

Download Submit
C:\Windows\{D8F21BE2-0F14-441e-A5BC-E0EA96E5B3AF}.exe

Filesize
408KB

MD5
dfa8016b941b51e11d0c0a85f052b206

SHA1
4a702622e2635df2ca421b03184ee32189124cc2

SHA256
126d89d4dc83ec0986edcdfb6e794429dce4b0419735b230865f18e30898c411

SHA512
688e90ebecb051a8541ae1e88eb622977d45acd22d45c93edbcaad46a0870818d048bcc0a968bd84f7c82251a843bf05d13cafdcc8a1e3d53adbd1e3ebc1f1f2

Download Submit
C:\Windows\{DDA533B7-161C-4493-96C3-821A998821C7}.exe

Filesize
408KB

MD5
b8389bd340215fac7ba859cfff598c1f

SHA1
cb025cbe213b74be721e9d85bb508202d2bdbf66

SHA256
3d618e2ba68398656a54b0ac4ec9e674de4b7bc5e2bf4ab180a4db264448d6ac

SHA512
19bd6d9fcd3396ed06be82df71013ea8bf464497e51e2f64c43abcabbbbe267048a1bc686e702856b3e70f7ffd3944f9eb0ce2351eb38ae81abee9d4536a8f14

Download Submit
C:\Windows\{FBAF7A28-CFAE-4377-9FA3-CFA72E59D3B5}.exe

Filesize
408KB

MD5
6ebc778d219aa19fd7a83d9ddd299784

SHA1
06fc9f826eb128f4d40641a0bcd0c6f5fc78e261

SHA256
2d59598eabc6691d7d0c80f8e9fe4235f26ca8d8ddd0b4bf7ede2eaa3c94a2f5

SHA512
d6be5734d6faebda0edf712ababb23df6705ec7dad15d5065731f3ee887fd89710c0d79853e558dc911655d2134c0cff79c143fc353770186f6b5a3ec9f44996

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads