726ad4976c5a73933c4c68e37d62af3a8ff039762c02769da26bd952d430b613

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe
Size

380KB
MD5

925db37e64ce50f8464d24e057f580cc
SHA1

0cd316396f158653171f720bbe0d8dd42fd4577f
SHA256

726ad4976c5a73933c4c68e37d62af3a8ff039762c02769da26bd952d430b613
SHA512

a42b81bc02cc728a66c6b2fa56aa45187e3bfd2167a5262321554f98a8a328b73b8cc77651422d17fdbcf1478ba15a5527955eac5d923feb7dfff46eeeea0169
SSDEEP

3072:mEGh0oXlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG5l7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023359-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023362-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000167e1-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023204-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000167e1-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023204-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00060000000167e1-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e590-29.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023105-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001e590-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023105-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023107-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}\stubpath = "C:\\Windows\\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe"	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA7B83FA-8529-467d-AAA1-A2528149205C}\stubpath = "C:\\Windows\\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe"	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{129822DA-159C-4a9c-AF28-643E1E85189C}	{CDF85273-B026-48e8-896F-1340726C28E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CDF85273-B026-48e8-896F-1340726C28E1}	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}\stubpath = "C:\\Windows\\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe"	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}\stubpath = "C:\\Windows\\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe"	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{799562EA-6B33-4459-83AC-1A8853559BB9}	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}\stubpath = "C:\\Windows\\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe"	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}\stubpath = "C:\\Windows\\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe"	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}\stubpath = "C:\\Windows\\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe"	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}\stubpath = "C:\\Windows\\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe"	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CDF85273-B026-48e8-896F-1340726C28E1}\stubpath = "C:\\Windows\\{CDF85273-B026-48e8-896F-1340726C28E1}.exe"	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{799562EA-6B33-4459-83AC-1A8853559BB9}\stubpath = "C:\\Windows\\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe"	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}\stubpath = "C:\\Windows\\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe"	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA7B83FA-8529-467d-AAA1-A2528149205C}	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{129822DA-159C-4a9c-AF28-643E1E85189C}\stubpath = "C:\\Windows\\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe"	{CDF85273-B026-48e8-896F-1340726C28E1}.exe

Executes dropped EXE 12 IoCs

pid	Process
2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
2052	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
3080	{CDF85273-B026-48e8-896F-1340726C28E1}.exe
4780	{129822DA-159C-4a9c-AF28-643E1E85189C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
File created	C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
File created	C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
File created	C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
File created	C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
File created	C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
File created	C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
File created	C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
File created	C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
File created	C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
File created	C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe	{CDF85273-B026-48e8-896F-1340726C28E1}.exe
File created	C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
Token: SeIncBasePriorityPrivilege	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
Token: SeIncBasePriorityPrivilege	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
Token: SeIncBasePriorityPrivilege	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
Token: SeIncBasePriorityPrivilege	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
Token: SeIncBasePriorityPrivilege	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
Token: SeIncBasePriorityPrivilege	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
Token: SeIncBasePriorityPrivilege	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
Token: SeIncBasePriorityPrivilege	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
Token: SeIncBasePriorityPrivilege	2052	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
Token: SeIncBasePriorityPrivilege	3080	{CDF85273-B026-48e8-896F-1340726C28E1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2224	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe	104
PID 1116 wrote to memory of 2224	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe	104
PID 1116 wrote to memory of 2224	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe	104
PID 1116 wrote to memory of 404	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe	105
PID 1116 wrote to memory of 404	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe	105
PID 1116 wrote to memory of 404	1116	2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe	105
PID 2224 wrote to memory of 2972	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	107
PID 2224 wrote to memory of 2972	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	107
PID 2224 wrote to memory of 2972	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	107
PID 2224 wrote to memory of 2488	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	108
PID 2224 wrote to memory of 2488	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	108
PID 2224 wrote to memory of 2488	2224	{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe	108
PID 2972 wrote to memory of 3904	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	111
PID 2972 wrote to memory of 3904	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	111
PID 2972 wrote to memory of 3904	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	111
PID 2972 wrote to memory of 4424	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	112
PID 2972 wrote to memory of 4424	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	112
PID 2972 wrote to memory of 4424	2972	{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe	112
PID 3904 wrote to memory of 3592	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	114
PID 3904 wrote to memory of 3592	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	114
PID 3904 wrote to memory of 3592	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	114
PID 3904 wrote to memory of 4008	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	115
PID 3904 wrote to memory of 4008	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	115
PID 3904 wrote to memory of 4008	3904	{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe	115
PID 3592 wrote to memory of 1912	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	116
PID 3592 wrote to memory of 1912	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	116
PID 3592 wrote to memory of 1912	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	116
PID 3592 wrote to memory of 2708	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	117
PID 3592 wrote to memory of 2708	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	117
PID 3592 wrote to memory of 2708	3592	{799562EA-6B33-4459-83AC-1A8853559BB9}.exe	117
PID 1912 wrote to memory of 4452	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	119
PID 1912 wrote to memory of 4452	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	119
PID 1912 wrote to memory of 4452	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	119
PID 1912 wrote to memory of 5040	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	120
PID 1912 wrote to memory of 5040	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	120
PID 1912 wrote to memory of 5040	1912	{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe	120
PID 4452 wrote to memory of 4352	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	121
PID 4452 wrote to memory of 4352	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	121
PID 4452 wrote to memory of 4352	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	121
PID 4452 wrote to memory of 4548	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	122
PID 4452 wrote to memory of 4548	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	122
PID 4452 wrote to memory of 4548	4452	{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe	122
PID 4352 wrote to memory of 868	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	123
PID 4352 wrote to memory of 868	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	123
PID 4352 wrote to memory of 868	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	123
PID 4352 wrote to memory of 2816	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	124
PID 4352 wrote to memory of 2816	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	124
PID 4352 wrote to memory of 2816	4352	{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe	124
PID 868 wrote to memory of 4408	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	133
PID 868 wrote to memory of 4408	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	133
PID 868 wrote to memory of 4408	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	133
PID 868 wrote to memory of 4752	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	134
PID 868 wrote to memory of 4752	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	134
PID 868 wrote to memory of 4752	868	{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe	134
PID 4408 wrote to memory of 2052	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	135
PID 4408 wrote to memory of 2052	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	135
PID 4408 wrote to memory of 2052	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	135
PID 4408 wrote to memory of 3952	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	136
PID 4408 wrote to memory of 3952	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	136
PID 4408 wrote to memory of 3952	4408	{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe	136
PID 2052 wrote to memory of 3080	2052	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe	137
PID 2052 wrote to memory of 3080	2052	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe	137
PID 2052 wrote to memory of 3080	2052	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe	137
PID 2052 wrote to memory of 4844	2052	{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe	138

C:\Users\Admin\AppData\Local\Temp\2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
  C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
    C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
      C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
        
        C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3592
      - C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
        
        C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
        
        C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
        
        C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
        
        C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
        
        C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
        
        C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe
        
        C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
        
        C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe
        
        C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe
        13⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CDF85~1.EXE > nul
        13⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA7B8~1.EXE > nul
        12⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BD3BE~1.EXE > nul
        11⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0DAB4~1.EXE > nul
        10⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E5001~1.EXE > nul
        9⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5EC2~1.EXE > nul
        8⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56577~1.EXE > nul
        7⤵
        
        PID:5040
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79956~1.EXE > nul
        6⤵
        
        PID:2708
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A4C2F~1.EXE > nul
        5⤵
        
        PID:4008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AB478~1.EXE > nul
      4⤵
      PID:4424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BFE2C~1.EXE > nul
    3⤵
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe

Filesize
380KB

MD5
a76f6ac017157853286f74b4b803c6d6

SHA1
62a2914e36b5cb43100a4fffba72fd9943f0dcee

SHA256
a58c1f18f7c6a8dbb0a491f7b1411166683047690d737f9cca7047690c898c0d

SHA512
fa5d3b8d5377c07adc4a239c2de34ce5686070bf064cde47a4be135db315c9f1e2164663fa485596e3e84ba568ab431be295cc23ce8e97ad14f08497c9cfb102

Download Submit
C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe

Filesize
380KB

MD5
5dabf115c2b16ed5d864d7214a3255f2

SHA1
6bb2da33b7ab5e642d39f01778419ac96b932236

SHA256
2649d247dea48292ea4ff72f5c39ccd8297f788f37861efa4d49b6d1a2aec96c

SHA512
8a84fc812905fcc920232cd9b7f747c8819039963a07d4f4ac4fd6df6b21ecbc7c09a8318a594dbafc821ecef3e8e834be40c7ff223d50a77ab2c04f2a72176a

Download Submit
C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe

Filesize
380KB

MD5
865047b0d2df69154e127ed41c898c9f

SHA1
c62073beeebb14c98b1ed45181905ce60971802d

SHA256
51c923b4af2f1bd9f9b97ffdd0c673a43740227eb9632aaf264b38b68f7417cb

SHA512
8f0b8f7d56e9f75bc09605d013682d6e27c7307b8110e2967db04065de2ddab3a7028fc1f29c858212f7b949adecdb3b7e7040839cc296e6992eb052a2072997

Download Submit
C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe

Filesize
380KB

MD5
b5e9ed335c458429894d52af9a9e7e8a

SHA1
269cf61feb2c9674d642b4dd9eedd019bafa120c

SHA256
398564c91c4f4ae1eee16fddb5fd59202011645e05a9861b633e627275ceb3c4

SHA512
cf4b20c0fe92ad4a6f9f13a723be08a768a2460d6201c9a25d1f3d80393fe73f8d713da8303d62742fd845a1bb7e9cb77873f75633529fb384f13598dfa38a26

Download Submit
C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe

Filesize
380KB

MD5
4c87b6dc16f2e998b4ccde468e347e04

SHA1
191538cefe6f173648c0e07a2ac96b58d8b32eee

SHA256
8deef616ba2a35d8c65955d831dd1e4eaca7e66705755010e115c7f5a78f7694

SHA512
0d7085c659e1e80809ff40ed17fbf4679d1ccb3e82aafbcf330134570d06520e5a6bcccc720cff9b0ed19fefd9e5c97f2ed7ab508a93ea1eb5ad2928779c5d40

Download Submit
C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe

Filesize
380KB

MD5
e805050ccc427f3cce4ab9c93831f301

SHA1
0ddb64fb4ca964e3db05a18dea5513b5522cec6f

SHA256
8015f7e6f8cd4b5e20554e75d1df856b8322d840f9767f9ab889124a24532d19

SHA512
e7fa07e394a4367ecd8bb0b6124eab77d7aea98e7fb49c351fb7596b85b30ef7a7452cbc914cd70e071bb6c90f6e37d86d5aa0d4eed367d4f020ee55c3ee4f90

Download Submit
C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe

Filesize
380KB

MD5
dd5700b59c0d694e5d9b4f05644c8d00

SHA1
975142f6ebfdd4e0503cd129cba165bc6064cf19

SHA256
74e066f9ce4b67228f48a204978eab37b2e2519474e4c2cce0c194d9765e438f

SHA512
9dd9fdb3fe8639f2785eacac2465ec50e1c2def6c8831f1aeb36f0e1d35d8de8e7f506703addb786d145d20708d843e814c26aef88c2ac69ccb398a182768d3e

Download Submit
C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe

Filesize
380KB

MD5
1ca919c371885bd6782f8a821081a9be

SHA1
dccabd986c17c5e93df78d10ba61b1f18f52ab48

SHA256
20c8727d9ada2512107609b075c537b90134dad00667d215b2c4ec5b2ced7912

SHA512
418a87082cf2df6a01f80d970ce1292a479dcad9732a37b21958695e1ddcce1370fb6201d30aac337d023c4e53c90aef733033b6df3ba5cff55b0381b978656d

Download Submit
C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe

Filesize
380KB

MD5
63099603362d4ddefcbf13209573d2e5

SHA1
c316730f694828f5f07966c17d190f616b25ae2c

SHA256
dc4f1449123c7cc6d8e2097c7b88262cd1d06a7957d47f006b2150d7d79b22e1

SHA512
fd9c3aa618ea7f7ad0dd6ef38e3aa342f78a7195e9be28a531e5edfdbd8cb6d401cf4c0c2a0d16393cbbb1b02d4f02f5b00036b2f26f26c15f1d7011ed45bf33

Download Submit
C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe

Filesize
380KB

MD5
160180ae22c3605f6c77e109f05e79ce

SHA1
38b940c132e73aef63dd8117130ddfe9267205be

SHA256
7175b2de6c5a1f369e2b39fad3fea5b37791173a7b16762eca1cbb1e2a3274ce

SHA512
6abf66fc45e8687bd5d40f537a28fa8075a50028cb79dc22787151b61f1a23e3c6b76964337d66cc73915415a1ba41e1d5da76036567f0827f579796e9709489

Download Submit
C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe

Filesize
380KB

MD5
156035a9ea5c11d90195d5765d9ebf3d

SHA1
0836c0e490bd4366a00adf8e8b2c052b2c42c2a1

SHA256
e5d0b55a4fb40166229beb7436545151eb80123caa5d6f75c1fc3da37d6b0e8f

SHA512
c7ca4aee83a8bf9f2aac0fa99bcca9138275f9b4261a7aedb5991f5bec6534597ee450cb7ce72a186bbe62f98f8623003c601566882008c97d65dd357537ba76

Download Submit
C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe

Filesize
380KB

MD5
fb751c559dfcfe238f835945f4d0bec6

SHA1
d538c39c545c222d810f2a56cd49c67cdf2d7070

SHA256
4af800c1265e2c5409d86bcee1164e1e839aad3b4bc999cc319aa18dc6708e0e

SHA512
b81a855c5ef6965c0a83146e5e865b7bba0aaa37c9f31d883def10f3c58626a2d81186c457dbd57d26d5166eccca20835a57c240f4a0b6f3e8da434e00dda13e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads