5ae09916c42d2d06c2c47d092d8631ad4119db9d26c1ba109c381a3205e5ba09

Analysis

max time kernel
156s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe
Size

216KB
MD5

5277f5718a9a5c41ed4a324c2b2132fa
SHA1

f2fdc39b32d11b67fc86a122fc37b65a7491ff22
SHA256

5ae09916c42d2d06c2c47d092d8631ad4119db9d26c1ba109c381a3205e5ba09
SHA512

65d41485876a82b341a2cbbc18c4a61386868b865fdea27d95c5f71693c0a3c94a96613f58caa4c9859e6f96b72420dd4a22e349a87fbd70df40072faf7be695
SSDEEP

3072:jEGh0o0l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGelEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023101-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023345-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023347-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023345-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023347-17.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023345-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000072f-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000731-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000072f-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000731-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000000072f-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000038-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7974CDA-6887-4bfa-A266-23B526721063}	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}\stubpath = "C:\\Windows\\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe"	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}\stubpath = "C:\\Windows\\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe"	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}	{A7974CDA-6887-4bfa-A266-23B526721063}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}\stubpath = "C:\\Windows\\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe"	{A7974CDA-6887-4bfa-A266-23B526721063}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92338BAB-12FA-47d4-A6A9-B008A57BE720}	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{799FE159-1A5B-4b82-B9A9-E865E78C052E}\stubpath = "C:\\Windows\\{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe"	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92338BAB-12FA-47d4-A6A9-B008A57BE720}\stubpath = "C:\\Windows\\{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe"	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}\stubpath = "C:\\Windows\\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe"	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}\stubpath = "C:\\Windows\\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}.exe"	{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}\stubpath = "C:\\Windows\\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe"	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE9E197F-92D0-4d35-93A2-0585F7C70399}	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{799FE159-1A5B-4b82-B9A9-E865E78C052E}	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}\stubpath = "C:\\Windows\\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe"	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7974CDA-6887-4bfa-A266-23B526721063}\stubpath = "C:\\Windows\\{A7974CDA-6887-4bfa-A266-23B526721063}.exe"	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}	{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE9E197F-92D0-4d35-93A2-0585F7C70399}\stubpath = "C:\\Windows\\{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe"	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}\stubpath = "C:\\Windows\\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe"	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe

Executes dropped EXE 12 IoCs

pid	Process
3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe
408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
3604	{A7974CDA-6887-4bfa-A266-23B526721063}.exe
3772	{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe
4644	{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe
File created	C:\Windows\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
File created	C:\Windows\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
File created	C:\Windows\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
File created	C:\Windows\{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
File created	C:\Windows\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
File created	C:\Windows\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe	{A7974CDA-6887-4bfa-A266-23B526721063}.exe
File created	C:\Windows\{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
File created	C:\Windows\{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
File created	C:\Windows\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe
File created	C:\Windows\{A7974CDA-6887-4bfa-A266-23B526721063}.exe	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
File created	C:\Windows\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}.exe	{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
Token: SeIncBasePriorityPrivilege	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
Token: SeIncBasePriorityPrivilege	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
Token: SeIncBasePriorityPrivilege	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
Token: SeIncBasePriorityPrivilege	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe
Token: SeIncBasePriorityPrivilege	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
Token: SeIncBasePriorityPrivilege	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
Token: SeIncBasePriorityPrivilege	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
Token: SeIncBasePriorityPrivilege	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
Token: SeIncBasePriorityPrivilege	3604	{A7974CDA-6887-4bfa-A266-23B526721063}.exe
Token: SeIncBasePriorityPrivilege	3772	{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 3924	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe	99
PID 1928 wrote to memory of 3924	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe	99
PID 1928 wrote to memory of 3924	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe	99
PID 1928 wrote to memory of 2160	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe	100
PID 1928 wrote to memory of 2160	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe	100
PID 1928 wrote to memory of 2160	1928	2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe	100
PID 3924 wrote to memory of 3164	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	104
PID 3924 wrote to memory of 3164	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	104
PID 3924 wrote to memory of 3164	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	104
PID 3924 wrote to memory of 3500	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	105
PID 3924 wrote to memory of 3500	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	105
PID 3924 wrote to memory of 3500	3924	{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe	105
PID 3164 wrote to memory of 4396	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	106
PID 3164 wrote to memory of 4396	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	106
PID 3164 wrote to memory of 4396	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	106
PID 3164 wrote to memory of 4404	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	107
PID 3164 wrote to memory of 4404	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	107
PID 3164 wrote to memory of 4404	3164	{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe	107
PID 4396 wrote to memory of 4172	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	109
PID 4396 wrote to memory of 4172	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	109
PID 4396 wrote to memory of 4172	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	109
PID 4396 wrote to memory of 4792	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	110
PID 4396 wrote to memory of 4792	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	110
PID 4396 wrote to memory of 4792	4396	{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe	110
PID 4172 wrote to memory of 972	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	111
PID 4172 wrote to memory of 972	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	111
PID 4172 wrote to memory of 972	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	111
PID 4172 wrote to memory of 4428	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	112
PID 4172 wrote to memory of 4428	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	112
PID 4172 wrote to memory of 4428	4172	{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe	112
PID 972 wrote to memory of 408	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	113
PID 972 wrote to memory of 408	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	113
PID 972 wrote to memory of 408	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	113
PID 972 wrote to memory of 4588	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	114
PID 972 wrote to memory of 4588	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	114
PID 972 wrote to memory of 4588	972	{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe	114
PID 408 wrote to memory of 3384	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	115
PID 408 wrote to memory of 3384	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	115
PID 408 wrote to memory of 3384	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	115
PID 408 wrote to memory of 4240	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	116
PID 408 wrote to memory of 4240	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	116
PID 408 wrote to memory of 4240	408	{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe	116
PID 3384 wrote to memory of 4424	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	117
PID 3384 wrote to memory of 4424	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	117
PID 3384 wrote to memory of 4424	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	117
PID 3384 wrote to memory of 4960	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	118
PID 3384 wrote to memory of 4960	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	118
PID 3384 wrote to memory of 4960	3384	{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe	118
PID 4424 wrote to memory of 1920	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	119
PID 4424 wrote to memory of 1920	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	119
PID 4424 wrote to memory of 1920	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	119
PID 4424 wrote to memory of 2244	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	120
PID 4424 wrote to memory of 2244	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	120
PID 4424 wrote to memory of 2244	4424	{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe	120
PID 1920 wrote to memory of 3604	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	121
PID 1920 wrote to memory of 3604	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	121
PID 1920 wrote to memory of 3604	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	121
PID 1920 wrote to memory of 5024	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	122
PID 1920 wrote to memory of 5024	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	122
PID 1920 wrote to memory of 5024	1920	{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe	122
PID 3604 wrote to memory of 3772	3604	{A7974CDA-6887-4bfa-A266-23B526721063}.exe	123
PID 3604 wrote to memory of 3772	3604	{A7974CDA-6887-4bfa-A266-23B526721063}.exe	123
PID 3604 wrote to memory of 3772	3604	{A7974CDA-6887-4bfa-A266-23B526721063}.exe	123
PID 3604 wrote to memory of 824	3604	{A7974CDA-6887-4bfa-A266-23B526721063}.exe	124

C:\Users\Admin\AppData\Local\Temp\2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_5277f5718a9a5c41ed4a324c2b2132fa_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
  C:\Windows\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
    C:\Windows\{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
      C:\Windows\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
        
        C:\Windows\{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Windows\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe
        
        C:\Windows\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
        
        C:\Windows\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
        
        C:\Windows\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
        
        C:\Windows\{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
        
        C:\Windows\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\{A7974CDA-6887-4bfa-A266-23B526721063}.exe
        
        C:\Windows\{A7974CDA-6887-4bfa-A266-23B526721063}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe
        
        C:\Windows\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
        
        C:\Windows\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}.exe
        
        C:\Windows\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}.exe
        13⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDE51~1.EXE > nul
        13⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A7974~1.EXE > nul
        12⤵
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0ABDE~1.EXE > nul
        11⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{799FE~1.EXE > nul
        10⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E4C9~1.EXE > nul
        9⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{112CA~1.EXE > nul
        8⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8107E~1.EXE > nul
        7⤵
        
        PID:4588
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92338~1.EXE > nul
        6⤵
        
        PID:4428
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{939A0~1.EXE > nul
        5⤵
        
        PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CE9E1~1.EXE > nul
      4⤵
      PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8BFAA~1.EXE > nul
    3⤵
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0ABDE4F6-66BD-4a6c-9B14-DCD8D4ED7C0D}.exe

Filesize
216KB

MD5
802b012e6460a1b7c9c4eaae0ea9af69

SHA1
b67c88099a1041da27b024732e6d2414703a9ae7

SHA256
cf93fc97fd10e83c7b256d7cab753d955ae85a4d53cd60587355c00d41ff5e89

SHA512
d0cff512900eb6b72a1b777ca68c672de4344fa0a58470e4dea91f4f193626e073fef4fb695d3eb84fe3bf0f9aab4885e17c864d374339d13b9037ad1ad00c81

Download Submit
C:\Windows\{112CA2E0-5E8D-401f-AAED-99C0CFF4317D}.exe

Filesize
216KB

MD5
3b13e917a02c5a133cecbf23522e3034

SHA1
6a0b8a054436d4aecf49afab4ebfbb1a08de0467

SHA256
a5d69c08391afd52e8c93abcbff9164aaf85369b4b5d653df5928a78d0d27fc7

SHA512
93b9fb65e466625713a78a7c90f9481735be012a3c740474fed95c888460bc50ea03c50819fc19785a2d968bb924fe006f805d01d132d36f571a3edc6379b1ef

Download Submit
C:\Windows\{799FE159-1A5B-4b82-B9A9-E865E78C052E}.exe

Filesize
216KB

MD5
584141b1e0192ca0e7cde96dcb78e256

SHA1
f1150e4a81aaa86fef701565bfeec7d624e8bc80

SHA256
f2cdb188de836913d18c49f77b8f55f1db61f749e30b74d3af53eaa9c690c1df

SHA512
d98eefde26e699b963a0e98b328284587fd35aefd6b962947d6f5838372c5d831a71a828c51d1e1766590aec55e268063f27a08b38866ad6a2d9e18244d1690c

Download Submit
C:\Windows\{7E4C9E80-2034-4d5f-8CE2-E9BEE8A32EBB}.exe

Filesize
216KB

MD5
79c96d915c2a6235a4174dbba22063b1

SHA1
6b2a2217d0f1f12f366e2cf007a21eeb2895a048

SHA256
dcd741c0097309e2662d29a43b3a8e6482f7da7a66361ab871d2b958c204afba

SHA512
110eb34856a5e2a985e83b78cf8754338134bf90ad06f29cd5012defd7cece1e0538b2558fbf7259e6e3d33265060078f2d301838bd6918069a9117e2a7773a3

Download Submit
C:\Windows\{8107E6C6-AB70-4d2d-85A8-0438C2D0CCE6}.exe

Filesize
216KB

MD5
ef9c8d7665d0c3f6f9b9bf20c0fb3c1b

SHA1
5ab72d6eb58bf9df78da3cea38cca71511ee095b

SHA256
b7c967ebac93d102019d78825a0a0a145a46bb22f6ccbf1734344620ab0a4ddf

SHA512
378018fe93d1bb7c249a32a88dcfb46fa1d497b97114ea2b75b58a2342d022209b07bcd9c9794c81313e3bb81f5cda74b564cfb03713e94cd51414ba9d5ae4c1

Download Submit
C:\Windows\{890AA959-12E7-41bb-A79E-32DCF6CB6FAE}.exe

Filesize
216KB

MD5
dbf6c559dca739cc316c44d67cabc942

SHA1
a78af5607cc6766eb5506df4f116a5da1ccd67a7

SHA256
7bc2a6f5152850854ef78b2a98aedb6ae39f95dd97a8b03a115b11ce42ef5d91

SHA512
1edf1b30dcc9a26d7ff38b80469ef1681a06fa0ef3560a660c8fcc9ace1a4a6581fbe7ce87c0138b4e599810b53ab64d4875138262ca77656b4d194c79029a54

Download Submit
C:\Windows\{8BFAADEC-8A2F-4b1d-A8F6-19BC5805A32B}.exe

Filesize
216KB

MD5
ef7fe278905b57f08b8e25ae7299e26f

SHA1
01ace93a0db6ee904caf7550fc9e348a906ccaf5

SHA256
80f048eab8d19e205a3e856681637692ec4c3dd6e1fbe347b872413c11708f38

SHA512
5e61fdee23a5314d24386b86ee5cc43c82e638984620b41196a0ee54165596595f9575f9c7bb3929097ed486cbb3a82013c992d8168d95de6aa7c79d97b2f1c2

Download Submit
C:\Windows\{92338BAB-12FA-47d4-A6A9-B008A57BE720}.exe

Filesize
216KB

MD5
6e86e4103a8a47b433f8939796ed7354

SHA1
4e742e7a2fa0ada87087eea73b95efa51432bea4

SHA256
b06e0926d0497cdc6620711a0827fc9213c9c5774ace1d08fdc74cc9e8e1bf63

SHA512
fe1aff305357548e77be2639db46a912042de1d0e76e184b63af25e4a32e589e72398ed6eab124bc11998d9ed88f42b596ef3beceee022be73c792d1a2ace36e

Download Submit
C:\Windows\{939A033C-DCA5-4af2-884F-1126B3CAF7FD}.exe

Filesize
216KB

MD5
638ab3555292a6bfcaba92f8125e97d8

SHA1
1411f4be4f2318fb06acb0831ef6931393656aef

SHA256
0feeca4972e18523964cb84946e7b6dde1e3c27d088ee0fc920199e41deca725

SHA512
86d97426773496f26638cb225c8229b1fb74d5457d3612ec60fd917a95b003cbf71c592d0aab907a18792d5c6b1a1e645fdf3011f42225df5446b1f8b312929a

Download Submit
C:\Windows\{A7974CDA-6887-4bfa-A266-23B526721063}.exe

Filesize
216KB

MD5
9acc1f8aa2ab3245f87530ea19438a06

SHA1
74536bdc2feeacc81039cb3a38cc986c361bcfc4

SHA256
2ec9473e3aeb455f9d8d5a49b25d1b6c7255ec7e7eabfd0fa2de94ea8c05af97

SHA512
533c0f45c03a2f3fea1223440f09cf3e9a906c2468a0754ef3029c3657b1c75e0511f53b809595eca847df0354cb0b4c29f400b9d9034da9301f116a544676dd

Download Submit
C:\Windows\{BDE51928-CFCF-4c62-9DEA-9CAD82333ED2}.exe

Filesize
216KB

MD5
e0a8521848dfca093f09a66d79032095

SHA1
08e952fff3cd8cf40ccbef4a2b727928221c59b2

SHA256
3921e450b5978ac9e9ce8defd68fc26b39aa06a060ff264287d41029db0d69ed

SHA512
30f196b33967df7835c51c2dc514720a428df46451abaff01d8803fc018ba9f3b716df0954fc5d927618f9973862c04bebe32ae6f3b4c8fc1f9cf32c88c3485b

Download Submit
C:\Windows\{CE9E197F-92D0-4d35-93A2-0585F7C70399}.exe

Filesize
216KB

MD5
e4eba3552008ced826d0699540406d47

SHA1
8e6e334df171a4b88e313a9251ec8ead1572b70a

SHA256
c1e59fa16ae75901c2f568644a5fbe1f59f8eb7c1b8717832f4ab14d97ffc54e

SHA512
dba8917985b3e92ffeff0864e2470dedfbec8d9d46a6b073a5dbaf42c052a0b62cbda6326f1a2d9b24cc27e02c5705ce8afc816a626202d1734141a78fe2344d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads