84b1445750574bc4c5aff2a40f5c88cd953b66fabec1321f8ed08b46f1768fc0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
Size

344KB
MD5

e27a0a0b1ba49079e57afae075de9c57
SHA1

34d24e9511f097743831fd29e939a29700f81375
SHA256

84b1445750574bc4c5aff2a40f5c88cd953b66fabec1321f8ed08b46f1768fc0
SHA512

6957c89c48b366447a8a8d3dbafeeacd2342ee40b0b6f34ad38e6f5e24f4f1118c44000ed505d28d2cb37d499b9c0502f7ca7a727df78901295f451b0c44f3f3
SSDEEP

3072:mEGh0ovlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGJlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 14 IoCs

resource	yara_rule
behavioral2/files/0x000800000002320e-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023217-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023235-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023235-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023235-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000230ea-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000230f1-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e0000000230fb-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000230f1-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f0000000230fb-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e0000000230f1-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00100000000230fb-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f0000000230f1-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00110000000230fb-45.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}\stubpath = "C:\\Windows\\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe"	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21CCCA6D-5686-4821-BEA5-8C2B92270244}\stubpath = "C:\\Windows\\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe"	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}\stubpath = "C:\\Windows\\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe"	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}\stubpath = "C:\\Windows\\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe"	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}\stubpath = "C:\\Windows\\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe"	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}\stubpath = "C:\\Windows\\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe"	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}\stubpath = "C:\\Windows\\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe"	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9ABB2D05-47A2-4025-A0CC-991FF5073193}\stubpath = "C:\\Windows\\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe"	{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}\stubpath = "C:\\Windows\\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe"	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9ABB2D05-47A2-4025-A0CC-991FF5073193}	{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}\stubpath = "C:\\Windows\\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe"	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21CCCA6D-5686-4821-BEA5-8C2B92270244}	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}\stubpath = "C:\\Windows\\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe"	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}\stubpath = "C:\\Windows\\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe"	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe

Executes dropped EXE 12 IoCs

pid	Process
4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
4496	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
1928	{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
4916	{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
File created	C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
File created	C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
File created	C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
File created	C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
File created	C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
File created	C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
File created	C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
File created	C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
File created	C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe	{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
File created	C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
File created	C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
Token: SeIncBasePriorityPrivilege	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
Token: SeIncBasePriorityPrivilege	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
Token: SeIncBasePriorityPrivilege	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
Token: SeIncBasePriorityPrivilege	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
Token: SeIncBasePriorityPrivilege	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
Token: SeIncBasePriorityPrivilege	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
Token: SeIncBasePriorityPrivilege	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
Token: SeIncBasePriorityPrivilege	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
Token: SeIncBasePriorityPrivilege	4496	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
Token: SeIncBasePriorityPrivilege	1928	{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4572	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe	97
PID 3840 wrote to memory of 4572	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe	97
PID 3840 wrote to memory of 4572	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe	97
PID 3840 wrote to memory of 2716	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe	98
PID 3840 wrote to memory of 2716	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe	98
PID 3840 wrote to memory of 2716	3840	2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe	98
PID 4572 wrote to memory of 4268	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	101
PID 4572 wrote to memory of 4268	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	101
PID 4572 wrote to memory of 4268	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	101
PID 4572 wrote to memory of 3656	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	102
PID 4572 wrote to memory of 3656	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	102
PID 4572 wrote to memory of 3656	4572	{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe	102
PID 4268 wrote to memory of 3520	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	107
PID 4268 wrote to memory of 3520	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	107
PID 4268 wrote to memory of 3520	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	107
PID 4268 wrote to memory of 800	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	108
PID 4268 wrote to memory of 800	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	108
PID 4268 wrote to memory of 800	4268	{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe	108
PID 3520 wrote to memory of 1364	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	113
PID 3520 wrote to memory of 1364	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	113
PID 3520 wrote to memory of 1364	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	113
PID 3520 wrote to memory of 1988	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	114
PID 3520 wrote to memory of 1988	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	114
PID 3520 wrote to memory of 1988	3520	{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe	114
PID 1364 wrote to memory of 3636	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	115
PID 1364 wrote to memory of 3636	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	115
PID 1364 wrote to memory of 3636	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	115
PID 1364 wrote to memory of 1028	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	116
PID 1364 wrote to memory of 1028	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	116
PID 1364 wrote to memory of 1028	1364	{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe	116
PID 3636 wrote to memory of 2960	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	118
PID 3636 wrote to memory of 2960	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	118
PID 3636 wrote to memory of 2960	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	118
PID 3636 wrote to memory of 768	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	119
PID 3636 wrote to memory of 768	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	119
PID 3636 wrote to memory of 768	3636	{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe	119
PID 2960 wrote to memory of 2628	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	120
PID 2960 wrote to memory of 2628	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	120
PID 2960 wrote to memory of 2628	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	120
PID 2960 wrote to memory of 4268	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	121
PID 2960 wrote to memory of 4268	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	121
PID 2960 wrote to memory of 4268	2960	{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe	121
PID 2628 wrote to memory of 3904	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	122
PID 2628 wrote to memory of 3904	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	122
PID 2628 wrote to memory of 3904	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	122
PID 2628 wrote to memory of 4724	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	123
PID 2628 wrote to memory of 4724	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	123
PID 2628 wrote to memory of 4724	2628	{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe	123
PID 3904 wrote to memory of 3260	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	124
PID 3904 wrote to memory of 3260	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	124
PID 3904 wrote to memory of 3260	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	124
PID 3904 wrote to memory of 4616	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	125
PID 3904 wrote to memory of 4616	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	125
PID 3904 wrote to memory of 4616	3904	{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe	125
PID 3260 wrote to memory of 4496	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	126
PID 3260 wrote to memory of 4496	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	126
PID 3260 wrote to memory of 4496	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	126
PID 3260 wrote to memory of 3812	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	127
PID 3260 wrote to memory of 3812	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	127
PID 3260 wrote to memory of 3812	3260	{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe	127
PID 4496 wrote to memory of 1928	4496	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe	128
PID 4496 wrote to memory of 1928	4496	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe	128
PID 4496 wrote to memory of 1928	4496	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe	128
PID 4496 wrote to memory of 3900	4496	{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe	129

C:\Users\Admin\AppData\Local\Temp\2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
  C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
    C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
      C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
        
        C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
        
        C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
        
        C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
        
        C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
        
        C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
        
        C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
        
        C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
        
        C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe
        
        C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe
        13⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A1B8~1.EXE > nul
        13⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8778E~1.EXE > nul
        12⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4BBF2~1.EXE > nul
        11⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB18A~1.EXE > nul
        10⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92D05~1.EXE > nul
        9⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21CCC~1.EXE > nul
        8⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{883D8~1.EXE > nul
        7⤵
        
        PID:768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7DCDF~1.EXE > nul
        6⤵
        
        PID:1028
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4FB99~1.EXE > nul
        5⤵
        
        PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{41B0A~1.EXE > nul
      4⤵
      PID:800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{65A7F~1.EXE > nul
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe

Filesize
344KB

MD5
98cfdc8dd4ff598b24bf84f2e098ce89

SHA1
f845cafc8b0895e0b85f8d46f51b50d02f0ff711

SHA256
3fd3e247e5fb526371e1bb01d581f6e0e4c06bb9fa18c2d16e079359d2a025df

SHA512
c1aed6be8fae6ed7347969d827f72c0d11f44ab03874e5ac80d62c94f910a046849e67f50a6b16f76e142600ffa35f72153c1bdeda391ce3ad325238bb49faed

Download Submit
C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe

Filesize
344KB

MD5
aadabbe0a224da6c80cbd2f9ae436aa5

SHA1
d8c5292dc672b21060568dea6d9388fc72426e5a

SHA256
27f9cdcb06ea8eb587000f213438b963d036a42954eff2e2b9912092bb0d48ee

SHA512
f0cd7b50e63c270b750ac8f5421bb60498be2a427c7ed6a26601453629b5e75cc7e68c22c24150c8f5a2ce9caa7f9b6af380e973cfa8875482c104245cef7ca0

Download Submit
C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe

Filesize
344KB

MD5
779d3f5d0e84b305dff3aa6b9cdabd52

SHA1
f4f932b4c44c5f7725c3e59687767c1fb3b548c5

SHA256
a940c7f1536110ca7b11b01c251cfba8a2f28d9c0fe4db0d5e5f7c7a652982a4

SHA512
3e32da0b548a12e353214305d77d8364e56919aff26b9440b1230ed0b9f062d3ee03efc91c30a41105cb74f9fa659dc56ebd42ab9ed287baa03c91a0ee43064a

Download Submit
C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe

Filesize
256KB

MD5
0f78be301e9835f3bd4c1ae2c95fc097

SHA1
8b86c4d593952eb2d96e790c67ae4c51b8ab7d97

SHA256
4a4894ef87fa4acf16039217551420c0d189f7ce82febcd461d34c1bf7b0f7af

SHA512
bd49746bce538230c2958fa26a1fa46da5f5a1bc4a5a6894f2fed83e5f2def6a4c0bed8e352ac4e5a392209357a7c1aa349906060532f01cc0d00f0a3d8ad732

Download Submit
C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe

Filesize
209KB

MD5
d0b8f1b99678caa3668499f71d4155e7

SHA1
629d6dbc27a50cc5d6953f36bb4057fcc59d09a1

SHA256
7680a07526f91893e063a5b89a2a60a619b84e9b3fb2d1ba0e84da5f288f85ca

SHA512
22c1c284bad49fb285cb4a235e48ad3696b5ea6e9dc3ab567c5f6c284a2942e1d6309817653dc8202739a01810caf810af31cf68021a96bcb2aca1abaa8fed65

Download Submit
C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe

Filesize
344KB

MD5
7ef19e0a7f0b4985cbb7accfd076d68e

SHA1
94ab44bf0a00de3ceb49e77347744e8129404c28

SHA256
22b69458defa18a0f89640766b350703a2074f39ba37e63a2b69f5875a3c0f96

SHA512
fd9c902a6b250a8c412901d90f7d5a4cb9d67b3340cc736d08a51d1194e0de01c7bd3d3633162804ec980d6a7c70da01eba9017a8d28f01b66cd18530b600c42

Download Submit
C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe

Filesize
344KB

MD5
ef58fd906f80f27c338c37fa8abb38af

SHA1
947f103114adc3b96039381e4da08f3e0ab29561

SHA256
5a379c8ddcc6430e20b05609e310c060652c8bf65cdd655c3644401bbeb73ce3

SHA512
c7a3d5185afc33f837cc909a69c4e783896b4356cb78853fc3ba1655e1eb2fe7d446dad095ff9e6fbb1c6c68d62a5d9ae049e5bace750ab2f461444ea6283990

Download Submit
C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe

Filesize
344KB

MD5
d6b3526d1ba145d7e0660a0c68e83411

SHA1
32b13330133c23022850e89169ae640286005095

SHA256
52a9a2d0951c1aa208a7ef736a27fecfc01fd3ec84195b8c5061f50d25e94a1b

SHA512
16cd45233438b42d0ae84d5375fd1300dc0f216d957453b00f31d37e65f1fe72320002c24c14dc404c2d6f3160bb5bb076ae654987c81fb0bee2c5bd57796e2f

Download Submit
C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe

Filesize
344KB

MD5
9727ffe657f5be0c78eb88fba0e2296a

SHA1
817591d0617f5a6fc39eb8d972b4b0cb91e80996

SHA256
029a580d1bf51d9e6d7dc832a0380bbebf3a3df82220fe5014b9d26e7da8fc09

SHA512
ff94063889f498b4ccf8663828b82e7d7ed4ed6d0eb99f4c90d241f8e5cec941bf7d2fee9c71281a5e01fd6d907542725086aac1616a84570b2deac7c32f65ef

Download Submit
C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe

Filesize
344KB

MD5
62d3aaeb4c6540a7c2336b91ab4f8791

SHA1
72ace4b0a3f74e5d98949c823fdc7dc612f22e48

SHA256
3587c89e598770ac50cacbb610c483f74ad61f9f54187b6f30436948083acc0a

SHA512
400d4c1944587c5f62756525638d8967f2e1bc20fd3537fa48ef19cb68f7174dc1036bfbee8b839fc33fba29e86169b723153eb624dd8b17b5af6f8b558e7e63

Download Submit
C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe

Filesize
344KB

MD5
7baa941cd74121d0a078b1dac893ca93

SHA1
f00e816d55369b0118141e2d2372a5dfd5141e6b

SHA256
148b3ba5ac8837a4ba28a029974095b65bca51df4e41c505d95da771108e7332

SHA512
04bb17ca10057cc375440f8c2752e4a2e0181651f37a52a812388dc0f245d5b73063c0304db0d785aaf5af63447ccab425865d9da3aa266c036f8643d86fc626

Download Submit
C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe

Filesize
344KB

MD5
50bd12f3313fbe5d94cf1633fe82b6fb

SHA1
a770c3b57f8e3badb1cf97028e9e56daff4d888d

SHA256
dfed87c1af3f327e30dd15619c464faf6009833c195b92c1ede8dea7256827b9

SHA512
95c6d025a9cfa8c8a5830308d6c3ae76a61edfd6784114a40a295641e55bdfcef7c044edc89737d2f8565b275e32c2f04aa920aad332944f1ec5b25bacbcf758

Download Submit
C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe

Filesize
344KB

MD5
19437dbf32c5027daeda21d68194f7ac

SHA1
3b626388cc72a536c513fad41ab72a5e30d1f901

SHA256
426c84d56bf1094920cd67f1491ddf03ace19a85e96e68f82d97d7e8fec0db7a

SHA512
b631495be515eb4044f632455f5fdfc18f1c3e85628b8c9125b14ca4df9b5b5cfa1679d3968ee36e6e7f39d4b880b73cf35a04ec39f1413b938a5f0c68a30b48

Download Submit
C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe

Filesize
344KB

MD5
588787ae078abfb2ce801fc4ccb4f5a3

SHA1
516e7c2e79e85aacbe8bd0f69193722de4fdfcdf

SHA256
e53f2e31dcfa891be1c28f53f9b22c92a5c3e5357f574e8e8d44f5127b931d5d

SHA512
629781315ae7c2f6fd169318eb48d63b5f269f7c52a72a6c3cd63717ba1b3d2bd336f417fa963717bcadbce5a18b70eab83aa76dbc526191a71ff094ded544e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads