187b29670ade317100f8e596e2741b5356152b58c66ada1a8c53bc7398093fdd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe
Size

372KB
MD5

a469ef66b8bfc463f531753e6505b7d7
SHA1

83eb6b237895e2b4018dd0cb49fbb85b3b3c2432
SHA256

187b29670ade317100f8e596e2741b5356152b58c66ada1a8c53bc7398093fdd
SHA512

c9f9a3f6990fa3b91dea75e7c0c8dfa8b0c0cdcf0fd8e7ae6610e9339d4eee0562a0b851c1ec6cf6c4af705aaf5094f440aa80505766761996069c5e8a6ca259
SSDEEP

3072:CEGh0o2mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGNl/Oe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e3d9-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023207-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002320d-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023207-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021f82-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021f83-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021f82-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000006c5-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}\stubpath = "C:\\Windows\\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe"	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}\stubpath = "C:\\Windows\\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe"	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}\stubpath = "C:\\Windows\\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe"	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}\stubpath = "C:\\Windows\\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe"	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}\stubpath = "C:\\Windows\\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe"	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B55FB66F-2656-4532-AE80-80655C9EA9A7}	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}\stubpath = "C:\\Windows\\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe"	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45A5590D-F9B6-49a2-B218-F5182E3BE066}\stubpath = "C:\\Windows\\{45A5590D-F9B6-49a2-B218-F5182E3BE066}.exe"	{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}\stubpath = "C:\\Windows\\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe"	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}\stubpath = "C:\\Windows\\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe"	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}\stubpath = "C:\\Windows\\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe"	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}\stubpath = "C:\\Windows\\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe"	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B55FB66F-2656-4532-AE80-80655C9EA9A7}\stubpath = "C:\\Windows\\{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe"	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45A5590D-F9B6-49a2-B218-F5182E3BE066}	{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe

Executes dropped EXE 12 IoCs

pid	Process
4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe
4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
5048	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
384	{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe
4252	{45A5590D-F9B6-49a2-B218-F5182E3BE066}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
File created	C:\Windows\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
File created	C:\Windows\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
File created	C:\Windows\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
File created	C:\Windows\{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
File created	C:\Windows\{45A5590D-F9B6-49a2-B218-F5182E3BE066}.exe	{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe
File created	C:\Windows\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe
File created	C:\Windows\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
File created	C:\Windows\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
File created	C:\Windows\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
File created	C:\Windows\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
File created	C:\Windows\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
Token: SeIncBasePriorityPrivilege	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe
Token: SeIncBasePriorityPrivilege	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
Token: SeIncBasePriorityPrivilege	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
Token: SeIncBasePriorityPrivilege	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
Token: SeIncBasePriorityPrivilege	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
Token: SeIncBasePriorityPrivilege	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
Token: SeIncBasePriorityPrivilege	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
Token: SeIncBasePriorityPrivilege	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
Token: SeIncBasePriorityPrivilege	5048	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
Token: SeIncBasePriorityPrivilege	384	{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4996	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe	91
PID 2428 wrote to memory of 4996	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe	91
PID 2428 wrote to memory of 4996	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe	91
PID 2428 wrote to memory of 3488	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe	92
PID 2428 wrote to memory of 3488	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe	92
PID 2428 wrote to memory of 3488	2428	2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe	92
PID 4996 wrote to memory of 4836	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	96
PID 4996 wrote to memory of 4836	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	96
PID 4996 wrote to memory of 4836	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	96
PID 4996 wrote to memory of 2372	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	97
PID 4996 wrote to memory of 2372	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	97
PID 4996 wrote to memory of 2372	4996	{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe	97
PID 4836 wrote to memory of 4860	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	99
PID 4836 wrote to memory of 4860	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	99
PID 4836 wrote to memory of 4860	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	99
PID 4836 wrote to memory of 1316	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	100
PID 4836 wrote to memory of 1316	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	100
PID 4836 wrote to memory of 1316	4836	{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe	100
PID 4860 wrote to memory of 4416	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	101
PID 4860 wrote to memory of 4416	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	101
PID 4860 wrote to memory of 4416	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	101
PID 4860 wrote to memory of 208	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	102
PID 4860 wrote to memory of 208	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	102
PID 4860 wrote to memory of 208	4860	{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe	102
PID 4416 wrote to memory of 1400	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	103
PID 4416 wrote to memory of 1400	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	103
PID 4416 wrote to memory of 1400	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	103
PID 4416 wrote to memory of 3272	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	104
PID 4416 wrote to memory of 3272	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	104
PID 4416 wrote to memory of 3272	4416	{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe	104
PID 1400 wrote to memory of 3636	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	105
PID 1400 wrote to memory of 3636	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	105
PID 1400 wrote to memory of 3636	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	105
PID 1400 wrote to memory of 3740	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	106
PID 1400 wrote to memory of 3740	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	106
PID 1400 wrote to memory of 3740	1400	{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe	106
PID 3636 wrote to memory of 4668	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	107
PID 3636 wrote to memory of 4668	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	107
PID 3636 wrote to memory of 4668	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	107
PID 3636 wrote to memory of 4160	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	108
PID 3636 wrote to memory of 4160	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	108
PID 3636 wrote to memory of 4160	3636	{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe	108
PID 4668 wrote to memory of 4468	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	109
PID 4668 wrote to memory of 4468	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	109
PID 4668 wrote to memory of 4468	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	109
PID 4668 wrote to memory of 2644	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	110
PID 4668 wrote to memory of 2644	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	110
PID 4668 wrote to memory of 2644	4668	{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe	110
PID 4468 wrote to memory of 3228	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	111
PID 4468 wrote to memory of 3228	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	111
PID 4468 wrote to memory of 3228	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	111
PID 4468 wrote to memory of 4384	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	112
PID 4468 wrote to memory of 4384	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	112
PID 4468 wrote to memory of 4384	4468	{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe	112
PID 3228 wrote to memory of 5048	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	113
PID 3228 wrote to memory of 5048	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	113
PID 3228 wrote to memory of 5048	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	113
PID 3228 wrote to memory of 2612	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	114
PID 3228 wrote to memory of 2612	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	114
PID 3228 wrote to memory of 2612	3228	{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe	114
PID 5048 wrote to memory of 384	5048	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe	115
PID 5048 wrote to memory of 384	5048	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe	115
PID 5048 wrote to memory of 384	5048	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe	115
PID 5048 wrote to memory of 4440	5048	{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe	116

C:\Users\Admin\AppData\Local\Temp\2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_a469ef66b8bfc463f531753e6505b7d7_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
  C:\Windows\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe
    C:\Windows\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
      C:\Windows\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
        
        C:\Windows\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4416
      - C:\Windows\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
        
        C:\Windows\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
        
        C:\Windows\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
        
        C:\Windows\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
        
        C:\Windows\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
        
        C:\Windows\{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
        
        C:\Windows\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe
        
        C:\Windows\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
        
        C:\Windows\{45A5590D-F9B6-49a2-B218-F5182E3BE066}.exe
        
        C:\Windows\{45A5590D-F9B6-49a2-B218-F5182E3BE066}.exe
        13⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32F28~1.EXE > nul
        13⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D12B4~1.EXE > nul
        12⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B55FB~1.EXE > nul
        11⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58C09~1.EXE > nul
        10⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CB46~1.EXE > nul
        9⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D9B2C~1.EXE > nul
        8⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A9EC~1.EXE > nul
        7⤵
        
        PID:3740
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D10B5~1.EXE > nul
        6⤵
        
        PID:3272
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16A1E~1.EXE > nul
        5⤵
        
        PID:208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{99F5B~1.EXE > nul
      4⤵
      PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5BEB1~1.EXE > nul
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A9EC7E1-1780-4b58-8AE9-04B46F34BE20}.exe

Filesize
372KB

MD5
ccaf1ae71d5b72f6b95c713e31a000f9

SHA1
a4a84a20f427f847577e88b2bb520dcaca5c4a96

SHA256
24dd8214c0536a5b29364242342fc398995f7b3152e0737d106e64d67bcd2ce3

SHA512
b6decde3ef4772522452f1459e5adfd103000fd06beacd6067253adc34e0c1ef93bd68d49b6c49ffe3e07a470c3e650c2d61112a0dd3f3e935579abfe525a104

Download Submit
C:\Windows\{16A1E277-9FD2-42c0-A59E-52653EFDC8F9}.exe

Filesize
372KB

MD5
d71c212c58e763298f9a6f475c1428a2

SHA1
8728dfe42b17fe2e8787b4dbf3ecf00f941e545e

SHA256
51fb8e444142961c20fad53000f412e246ae2b02e0cbbddf6667c42b3972ffea

SHA512
d8c7b18bfa908c6c5874a3893683a5bfd1af688ab9ab85e8f6060f6c7a441008b9f541edce800c0fea470d4e1bdffd3bb3ee0faecd4ee1fbb56c608de6f0d7f6

Download Submit
C:\Windows\{32F28181-1C8B-47d9-A0B5-9E0854AC9D92}.exe

Filesize
372KB

MD5
4ed047d2980f8fa685b4530bf64c70f9

SHA1
44d6b752d9189c41e37e1099285fa2df2fab5759

SHA256
bf21c9343ba329a93d66d3fc5a904cbaac84b25dbaea5b9b2d63999a01513297

SHA512
a44b1914958e42731c60f80d4b847284053b1070138c38f72712adac2aca33c14b96092f74d50e5675f8e2be66be648f0b546596d04a992419d3097a76192743

Download Submit
C:\Windows\{45A5590D-F9B6-49a2-B218-F5182E3BE066}.exe

Filesize
372KB

MD5
0d6aca04642d01a0d54c0ae1c9f35301

SHA1
f81dd57b6cf7b500b66d124c9cd2e044f37aada0

SHA256
07d5ece1c00d39e0aa9ac2403bae56703e41134eed72cf3ddf31fa135b669481

SHA512
5b52c08065d201d6750f9efdf17af70cfab07b5fee44acb7a60e11b564fdd3e394c7365ed707616473ccc5cee787f6337225b845a393a3a85f3f7857ac85b645

Download Submit
C:\Windows\{58C091D5-F705-4651-8FB9-7E906FFA8DCF}.exe

Filesize
372KB

MD5
4994f176ed41487c2b8d9adfb922cc40

SHA1
6fa1c89decdd1e6df309fd419187ae9db6a822aa

SHA256
5762726deb77c1cc71b95353b63e089d17e26ef9eb3d6d63f68ff54fe957319a

SHA512
a18dd731d1f635e91a951120435b603800ae201ae8869de1831793be0be129709598d9b3e5b3aa3b2f170de16349a1026b364b8ffa432d6e8f78b9e5a864d91f

Download Submit
C:\Windows\{5BEB1061-119D-43e6-8F31-5E8D71CF2DE1}.exe

Filesize
372KB

MD5
f7de3116e89f55806d47498eb1b3ebdf

SHA1
0d66d22f1d066201ba161662209e81e23002e29b

SHA256
738891c73d69dbdb125f527ee912805d21a512455331d8c57b369b9a61fcb8ba

SHA512
48564b1d4bdb7976e85b744ccc94200138912be523157a5b7a50acc9c10e24d1a49914b8b06b543fa0fd5ded877a97987bbc0fcc397f1163afeb3dd1c746efda

Download Submit
C:\Windows\{7CB46F70-A27B-423f-ABF4-AE964F5FC748}.exe

Filesize
372KB

MD5
a5cb76099d29489e25e9443d5e77a9c0

SHA1
6052c21fcd9c089286b517f3f8aa854a24755ad2

SHA256
df31c7b14c3023c6a27af2552b203e3525f1cc3f26207598312f71db8999d99e

SHA512
46f827fb386e6b7b9b67b1a711e17f89cfa5fd97c019d8bae3389500fcc3bafb005b7c45b4ae5066382a548ceb35dfd92b3afc35b9c3899abb7f700c11f6818b

Download Submit
C:\Windows\{99F5B675-2796-4ef6-8BEF-F1FBAC971A75}.exe

Filesize
372KB

MD5
18c635db08b97e187353b35caec0a876

SHA1
91655cd8e685b05f904e7d0b8624cf6cc9816518

SHA256
c9e396f6a418669deec95228b587b2de97569d713c5abfa588e3da0af1600d0e

SHA512
5b92760f1ac0bea4f3c76cd3c7c78ba10afa87a7c1754746e4efaa8a2faf5bdbd6c480931e901506233042c5df3cf4a6015cfc399fc3edff9636960fe537f8cf

Download Submit
C:\Windows\{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe

Filesize
128KB

MD5
d431304777fb528293e0ddb458a57f59

SHA1
b86d709b61c50a577a3ef5533f4a68481a655ea5

SHA256
945471e643b9fac256c2ef3b68f25e6b55d586d7d50dce2486e5bf7c15e90112

SHA512
3ab4cafa2f93c13247756a64a79918c80c4521c761a6b1ef0b61f39f9d04b213a0e542ddda5f42dfc7612c048b4d03ae316b471669d3d5e1039b97a231b89bbd

Download Submit
C:\Windows\{B55FB66F-2656-4532-AE80-80655C9EA9A7}.exe

Filesize
47KB

MD5
3c732a56305185aef0a995efbcb40c0f

SHA1
3773b4eba341bcaf880a209ba342099e5bb0f566

SHA256
5748c426ba35ec593652dd79d2950cd8dc5cee131cc2cd2258946e7594aa15fb

SHA512
3ec2304342f439b9664e7e2f77939fef599136bdb52349e74a17bcd3729b6432957af6afde4452b882f401319c461371f831adb376c46d44917c1d97648de178

Download Submit
C:\Windows\{D10B55B8-8F78-4a3f-8A29-51F81331DD3A}.exe

Filesize
372KB

MD5
5955452fc0992774982bf10251f9b5c8

SHA1
1ae27fc9fa741a8ae1d516294960f91a6106336e

SHA256
b610e5ab1c89e42ac07b531fec36ed6992da75df13db0878db69ef8ebf4ab127

SHA512
6c37d97a707f95a5c522c1a80329e5f503ee3a6cc1b08d2094039db2d2979bdef9a199f7745c51369b61ef5e1775cddbe3c225548f1d8308cd062d833305d71b

Download Submit
C:\Windows\{D12B4F4C-1818-4c04-9F8B-9DF4F0BA0B26}.exe

Filesize
372KB

MD5
2042c030759b117d3c510cc45aa2d5b5

SHA1
fd7fee2057f5559bfe6721c3b77e638b0415a7f3

SHA256
856acb406f7b19f70f59903384ed0ccf228edecb4822443168b154d75e9bb679

SHA512
4f2f2b9a4e75fa483f9ae04af6f7fc103dd9ebac640c41857ff15dc58d7b5a0bc5bad200b67be395c039699ba9d9b2c7abfdf01b19daf3a4224179b2b23f7210

Download Submit
C:\Windows\{D9B2C6EE-EECE-460f-B82B-09B37BE146E6}.exe

Filesize
372KB

MD5
81a75c6e01d4eaf10cb56d07b1863a37

SHA1
8cc1bc76b01e814e52ba7a966c5f6a4a3fd08daf

SHA256
cc80e534eaea683eb412338bf4217930ee4e1cf8514adfda1f6fa9dcf18a37dc

SHA512
1e126a898533c5194e798c3ed1b65890284378af488e43f6b1469a67d12d894b625b1a2961c1af361786ef9239b212232ffa72e8b4215eec06f958516a0f1c2d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads