a7afc3c61c8e6cb4d72840aaa0798de80df154713ff365ce9be6e9fdacf5002f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe
Size

192KB
MD5

3733e770c4d470a7fe4400202d44fd18
SHA1

5867c71323d615bff97a877b3cb4a749803d74c9
SHA256

a7afc3c61c8e6cb4d72840aaa0798de80df154713ff365ce9be6e9fdacf5002f
SHA512

dd6dc6f8106b54c0a5061b27d4174567ddb4d6218b55d1abd43b70bb81e60108947ac80ae06fa4b48e294329256255b666b0f12ecb795d074fd9ec96c288270c
SSDEEP

1536:1EGh0osl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0osl1OPOe2MUVg3Ve+rXfMUa

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023200-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00120000000231fa-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023207-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00130000000231fa-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023207-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00140000000231fa-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023207-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000729-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000072b-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000729-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000072b-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000739-48.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}\stubpath = "C:\\Windows\\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe"	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C136C819-0A88-4509-8D01-F043DAE89383}	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E162399E-94E5-4f29-BBBA-70593CEC1B76}	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}\stubpath = "C:\\Windows\\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe"	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E84799F-2BEE-41be-9398-7B09F2979555}\stubpath = "C:\\Windows\\{0E84799F-2BEE-41be-9398-7B09F2979555}.exe"	{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A266FA32-FF0D-4b4e-8481-84718E5E982F}	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A266FA32-FF0D-4b4e-8481-84718E5E982F}\stubpath = "C:\\Windows\\{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe"	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F29D89F5-328E-4f86-B560-0ED7A85A948F}	{C136C819-0A88-4509-8D01-F043DAE89383}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F29D89F5-328E-4f86-B560-0ED7A85A948F}\stubpath = "C:\\Windows\\{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe"	{C136C819-0A88-4509-8D01-F043DAE89383}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}\stubpath = "C:\\Windows\\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe"	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}\stubpath = "C:\\Windows\\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe"	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E84799F-2BEE-41be-9398-7B09F2979555}	{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C136C819-0A88-4509-8D01-F043DAE89383}\stubpath = "C:\\Windows\\{C136C819-0A88-4509-8D01-F043DAE89383}.exe"	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}\stubpath = "C:\\Windows\\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe"	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}\stubpath = "C:\\Windows\\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe"	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}\stubpath = "C:\\Windows\\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe"	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E162399E-94E5-4f29-BBBA-70593CEC1B76}\stubpath = "C:\\Windows\\{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe"	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe

Executes dropped EXE 12 IoCs

pid	Process
3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe
3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe
372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe
2020	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
3496	{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe
4420	{0E84799F-2BEE-41be-9398-7B09F2979555}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{0E84799F-2BEE-41be-9398-7B09F2979555}.exe	{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe
File created	C:\Windows\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe
File created	C:\Windows\{C136C819-0A88-4509-8D01-F043DAE89383}.exe	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
File created	C:\Windows\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe
File created	C:\Windows\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
File created	C:\Windows\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
File created	C:\Windows\{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
File created	C:\Windows\{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
File created	C:\Windows\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
File created	C:\Windows\{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	{C136C819-0A88-4509-8D01-F043DAE89383}.exe
File created	C:\Windows\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
File created	C:\Windows\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
Token: SeIncBasePriorityPrivilege	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
Token: SeIncBasePriorityPrivilege	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe
Token: SeIncBasePriorityPrivilege	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
Token: SeIncBasePriorityPrivilege	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe
Token: SeIncBasePriorityPrivilege	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
Token: SeIncBasePriorityPrivilege	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
Token: SeIncBasePriorityPrivilege	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
Token: SeIncBasePriorityPrivilege	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe
Token: SeIncBasePriorityPrivilege	2020	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
Token: SeIncBasePriorityPrivilege	3496	{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3236	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe	96
PID 2292 wrote to memory of 3236	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe	96
PID 2292 wrote to memory of 3236	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe	96
PID 2292 wrote to memory of 3872	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe	97
PID 2292 wrote to memory of 3872	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe	97
PID 2292 wrote to memory of 3872	2292	2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe	97
PID 3236 wrote to memory of 964	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	98
PID 3236 wrote to memory of 964	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	98
PID 3236 wrote to memory of 964	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	98
PID 3236 wrote to memory of 2372	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	99
PID 3236 wrote to memory of 2372	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	99
PID 3236 wrote to memory of 2372	3236	{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe	99
PID 964 wrote to memory of 1780	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	101
PID 964 wrote to memory of 1780	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	101
PID 964 wrote to memory of 1780	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	101
PID 964 wrote to memory of 3208	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	102
PID 964 wrote to memory of 3208	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	102
PID 964 wrote to memory of 3208	964	{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe	102
PID 1780 wrote to memory of 3788	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe	103
PID 1780 wrote to memory of 3788	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe	103
PID 1780 wrote to memory of 3788	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe	103
PID 1780 wrote to memory of 4864	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe	104
PID 1780 wrote to memory of 4864	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe	104
PID 1780 wrote to memory of 4864	1780	{C136C819-0A88-4509-8D01-F043DAE89383}.exe	104
PID 3788 wrote to memory of 1868	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	105
PID 3788 wrote to memory of 1868	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	105
PID 3788 wrote to memory of 1868	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	105
PID 3788 wrote to memory of 1356	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	106
PID 3788 wrote to memory of 1356	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	106
PID 3788 wrote to memory of 1356	3788	{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe	106
PID 1868 wrote to memory of 372	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	107
PID 1868 wrote to memory of 372	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	107
PID 1868 wrote to memory of 372	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	107
PID 1868 wrote to memory of 3012	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	108
PID 1868 wrote to memory of 3012	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	108
PID 1868 wrote to memory of 3012	1868	{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe	108
PID 372 wrote to memory of 4200	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	109
PID 372 wrote to memory of 4200	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	109
PID 372 wrote to memory of 4200	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	109
PID 372 wrote to memory of 4088	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	110
PID 372 wrote to memory of 4088	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	110
PID 372 wrote to memory of 4088	372	{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe	110
PID 4200 wrote to memory of 1276	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	111
PID 4200 wrote to memory of 1276	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	111
PID 4200 wrote to memory of 1276	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	111
PID 4200 wrote to memory of 1992	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	112
PID 4200 wrote to memory of 1992	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	112
PID 4200 wrote to memory of 1992	4200	{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe	112
PID 1276 wrote to memory of 1220	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	113
PID 1276 wrote to memory of 1220	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	113
PID 1276 wrote to memory of 1220	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	113
PID 1276 wrote to memory of 4976	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	114
PID 1276 wrote to memory of 4976	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	114
PID 1276 wrote to memory of 4976	1276	{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe	114
PID 1220 wrote to memory of 2020	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	115
PID 1220 wrote to memory of 2020	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	115
PID 1220 wrote to memory of 2020	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	115
PID 1220 wrote to memory of 4020	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	116
PID 1220 wrote to memory of 4020	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	116
PID 1220 wrote to memory of 4020	1220	{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe	116
PID 2020 wrote to memory of 3496	2020	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe	117
PID 2020 wrote to memory of 3496	2020	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe	117
PID 2020 wrote to memory of 3496	2020	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe	117
PID 2020 wrote to memory of 3812	2020	{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_3733e770c4d470a7fe4400202d44fd18_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
  C:\Windows\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
    C:\Windows\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\{C136C819-0A88-4509-8D01-F043DAE89383}.exe
      C:\Windows\{C136C819-0A88-4509-8D01-F043DAE89383}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Windows\{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
        
        C:\Windows\{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3788
      - C:\Windows\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe
        
        C:\Windows\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
        
        C:\Windows\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
        
        C:\Windows\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
        
        C:\Windows\{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe
        
        C:\Windows\{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
        
        C:\Windows\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe
        
        C:\Windows\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3496
        
        C:\Windows\{0E84799F-2BEE-41be-9398-7B09F2979555}.exe
        
        C:\Windows\{0E84799F-2BEE-41be-9398-7B09F2979555}.exe
        13⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E4E4~1.EXE > nul
        13⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBEF5~1.EXE > nul
        12⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E1623~1.EXE > nul
        11⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A266F~1.EXE > nul
        10⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92661~1.EXE > nul
        9⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BFEFB~1.EXE > nul
        8⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6D3A~1.EXE > nul
        7⤵
        
        PID:3012
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F29D8~1.EXE > nul
        6⤵
        
        PID:1356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C136C~1.EXE > nul
        5⤵
        
        PID:4864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1FB1F~1.EXE > nul
      4⤵
      PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0F12B~1.EXE > nul
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0E4E40F7-4515-4dd2-9946-CD3228B763A2}.exe

Filesize
192KB

MD5
4a0e5bb68e7317594503db2ee0a63fea

SHA1
88f9932f6b1a923ee30d281da821257c7481941f

SHA256
6eb8bb3769ccbf0a1f59d750e00217a2782bf1c50b8ac0ead5718f3a311b66c9

SHA512
2016ffb121c59ccffbcbc0245d0ef59c8c5c315a501cc1df6c5da886a0697139d81b010fa282ab7dc09de1e5ad1993ca630cba2bb0e560c3fc1b329d613a4f01

Download Submit
C:\Windows\{0E84799F-2BEE-41be-9398-7B09F2979555}.exe

Filesize
192KB

MD5
97713d3f5da57aa347596879203c71f0

SHA1
761c0070f72b8aa6578fb2e228986013361af162

SHA256
fac428a5f70232a75cd9e3c2c322970a0c512c8e81214226bac6f3bfb04d11ac

SHA512
17fb768d25d3727f945d308f0b642774757483bb46c9a00125303e52a4d3ec83be28bbfae7693e209ee8812f310517742a7ad19fec85b647f5522d9f896e7882

Download Submit
C:\Windows\{0F12B1A1-A9D4-48c6-A394-5A1CEF2A37C0}.exe

Filesize
192KB

MD5
d6f6f81702428849881f9ba89944efb7

SHA1
8466f661f86230bcf7c0584e4587017c6ef4e4d3

SHA256
e5c715ae586b87f351092b0875a6c3f8995f5e3af1d68d813fe3b5733a127c21

SHA512
c3646945ec01a150d85460ce7749cc4a170b8e7c84b9b08f2bb3e1941b41fa215bc3677407530b187b3e9ca2c954b05859587a4623adeb07a4242ee89bc27c60

Download Submit
C:\Windows\{1FB1FB3F-BBF4-432f-A7E2-ECA64EC986C1}.exe

Filesize
192KB

MD5
b7c8966e767978b2697bc86400c8efab

SHA1
ccca7b3363c7699396399aaf2950855867388b74

SHA256
6ff8b01dea21152dc11b925431307afaf500ea7f905a59a804dc1c0bb2b359dc

SHA512
46b9dd39ab38ffe6b824dfc5e39154f1f9dd9de19a30b7057f98a7bf559d55e1f22bec29870dd4fc725816eccfc39c0cbfea781a3ba12036b7e558bbf99536a2

Download Submit
C:\Windows\{926613A2-4B9C-4a97-842C-BE9EB9DC320D}.exe

Filesize
192KB

MD5
18b56a1805105fb4415b2658cad968d5

SHA1
cd00548a7668ad946807aa952907827ccdf71706

SHA256
268fd3befa9b70d9836a21c37362e95b67bd4210e6cd397e658a71c068855888

SHA512
b0000e3866b4d8f3f5a7337ef7d57a4161a34a0be1f46cf83d75b07600e04aea99d26251eabdc942ff07a582420b3e3156cbab6cd56d07dc61ea40e96a921080

Download Submit
C:\Windows\{A266FA32-FF0D-4b4e-8481-84718E5E982F}.exe

Filesize
192KB

MD5
199c14f722356e1a2bbf9dabb7034ae4

SHA1
9de7914742e40605e3f8098e94c884f40295d0d2

SHA256
68f2f1356d5dd80549d7778b4c817984f379f3b7290d70bf749d271edad04867

SHA512
163649c14f9bc708f056b40cce2f4f0e2decc3436b5bee9f5b1fa26d34cea7df0eed640af7543f467e1e8dd2cf673aa83a56e822255d8a09d910ac6c0d129873

Download Submit
C:\Windows\{BFEFB62F-01D7-444d-AFEC-4F15AC3FF88B}.exe

Filesize
192KB

MD5
aecbe4a311e7f799da4fb29c612eaece

SHA1
01570c0f834ac36c96ae134a7b34e44a1f966995

SHA256
611a47d8b58e21e075f7da172f397b36c9310eef0a2c9c8ea81a1a7495a9ace2

SHA512
40b3f6fb3d5ccc43e1b3ef9d0b89fa33ff95ea21de12f75a6ae66b6aff74208e69b4c12dc568f00179d3e5219c772736d2c363b38e69187f6050ce6f46d47f67

Download Submit
C:\Windows\{C136C819-0A88-4509-8D01-F043DAE89383}.exe

Filesize
192KB

MD5
44930b5a6da172bffab87d9e1ebdb553

SHA1
87335c529b060766e97c4d821ba8b495526103f3

SHA256
56c9073f4a24cd01ab00ae4f95a36dcfe57793ee0e7f6d861a174088088b2c2e

SHA512
463dbc06acd76e62283d37598b9e696fb33fdcf3652b9b7d96c114654da9a8e61e6e3023ac999fe7157863c37a82dd7637d9a9f69462eaab261e937df90985e4

Download Submit
C:\Windows\{C6D3AE93-DC58-45c5-89BB-38DD6D489D1E}.exe

Filesize
192KB

MD5
d806678a3ade4ebc288617df3c233348

SHA1
ff7b7ca3a9f24da3f18059e5c665758076814336

SHA256
b884a6cd80039e4a8be778fd0276916ae9ce484e2c030792c04bf0437ca2709f

SHA512
3af0ef327bedcfd5718002c5e86172a56c5909fbfa051e55bfd13c1f0b31fba06d87e70bfc652cd29de262016657bd3e0a2409c2bd0800470df981d0fc71cccf

Download Submit
C:\Windows\{CBEF5DEA-D6A5-4d1d-819B-9F947EAFC735}.exe

Filesize
192KB

MD5
565145a327999651d3e432a755f0058c

SHA1
6ef25eea208aaa0fb991296773cbaf47e6b6beea

SHA256
bb3bd0eb32ad314943026198146ae86655a38410c50cae4df5a0084e1c9b780a

SHA512
e0485f5a19a6573194058b3cfe4d36759c853577a537b3994d02a4e8eabd7ac33797bfd6d092d3945da8e4236abe0ea04da4b88249fecdafe2dfa7a88286cf9e

Download Submit
C:\Windows\{E162399E-94E5-4f29-BBBA-70593CEC1B76}.exe

Filesize
192KB

MD5
52a02f7053219527438ceb815a1188d8

SHA1
9ad6b76d0bba82acda36ad8b7c3bcd03e31e44f9

SHA256
2b50ce62a054514f8ae1e742e65c73ad0930e340ead1edda24f83ac72d7dda9d

SHA512
14d9adda4e509b00ed51445a632683bf360b1f7a77ff7a37cefa5f6d0c06708f501536d2231a67fe34aad13bd3e88c19f6ff88169771acc46600d932f67c2082

Download Submit
C:\Windows\{F29D89F5-328E-4f86-B560-0ED7A85A948F}.exe

Filesize
192KB

MD5
93cdeba1187021575325d84460f52ecb

SHA1
180d2e6db0b5d47a100fdf7131243daad2035cb5

SHA256
982a4160e87469c0a4015ccf37e5929d7bbc44a87912f613b8062d72557878a3

SHA512
bacb113c59ce57bd19f270b9ef312a98f3df836791fcb7506bd8246a50fa3929b0b97e192a941870aaf6ee103ba3c1bd65371dae8a75146f607c5866a438e85d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads