7a79d6663634f6924c3bf7da755356579a291511161d2e4f53013e931792f3e1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe
Size 344KB
Sample240404-3p3jlaee88
SHA256 7a79d6663634f6924c3bf7da755356579a291511161d2e4f53013e931792f3e1
MD5 c5c33e5848e5ba6d6a236c36ee01ab98
SHA1 903fe9bd93eec53bab3b692697588249d7d5db79
SHA512 8631d54fb28ceb3121112b425e2cfe7fa2c4a09066df5a1a4a791e4b826eb2c00a1d9402795df051c9c90ba1736924b8aaed75ed8bc1c35ebede16112e61a182
SSDEEP 3072:mEGh0oUlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGSlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023327-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002342b-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000167e1-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000235b2-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001e58d-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000235b2-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e58d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000235b2-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000230f4-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001db7a-76.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000230f4-79.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000235b3-83.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD65208B-A07B-499b-86AF-0AD596C550C6}\stubpath = "C:\\Windows\\{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe"	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}\stubpath = "C:\\Windows\\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe"	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}\stubpath = "C:\\Windows\\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe"	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}	{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}\stubpath = "C:\\Windows\\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe"	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D731174-8E2D-4ff9-A387-F458BB2375B2}\stubpath = "C:\\Windows\\{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe"	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}\stubpath = "C:\\Windows\\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe"	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96132C7A-7E13-4380-8B94-8DE49455230A}\stubpath = "C:\\Windows\\{96132C7A-7E13-4380-8B94-8DE49455230A}.exe"	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C3E480D-8DE9-4955-B983-0A800F18D721}	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D731174-8E2D-4ff9-A387-F458BB2375B2}	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}\stubpath = "C:\\Windows\\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe"	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}\stubpath = "C:\\Windows\\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe"	{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}\stubpath = "C:\\Windows\\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe"	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD65208B-A07B-499b-86AF-0AD596C550C6}	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96132C7A-7E13-4380-8B94-8DE49455230A}	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C3E480D-8DE9-4955-B983-0A800F18D721}\stubpath = "C:\\Windows\\{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe"	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBBF105C-7226-4b5e-8B43-74E8144F2206}	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBBF105C-7226-4b5e-8B43-74E8144F2206}\stubpath = "C:\\Windows\\{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe"	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe

Executes dropped EXE 12 IoCs

pid	Process
4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
4716	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
2404	{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe
3024	{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
File created	C:\Windows\{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
File created	C:\Windows\{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
File created	C:\Windows\{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
File created	C:\Windows\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
File created	C:\Windows\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe
File created	C:\Windows\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
File created	C:\Windows\{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
File created	C:\Windows\{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
File created	C:\Windows\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
File created	C:\Windows\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
File created	C:\Windows\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe	{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
Token: SeIncBasePriorityPrivilege	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
Token: SeIncBasePriorityPrivilege	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
Token: SeIncBasePriorityPrivilege	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
Token: SeIncBasePriorityPrivilege	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
Token: SeIncBasePriorityPrivilege	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
Token: SeIncBasePriorityPrivilege	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
Token: SeIncBasePriorityPrivilege	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
Token: SeManageVolumePrivilege	3364	svchost.exe
Token: SeIncBasePriorityPrivilege	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
Token: SeIncBasePriorityPrivilege	4716	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
Token: SeIncBasePriorityPrivilege	2404	{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4940	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe	108
PID 2948 wrote to memory of 4940	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe	108
PID 2948 wrote to memory of 4940	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe	108
PID 2948 wrote to memory of 2272	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe	109
PID 2948 wrote to memory of 2272	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe	109
PID 2948 wrote to memory of 2272	2948	2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe	109
PID 4940 wrote to memory of 1264	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	110
PID 4940 wrote to memory of 1264	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	110
PID 4940 wrote to memory of 1264	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	110
PID 4940 wrote to memory of 2264	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	111
PID 4940 wrote to memory of 2264	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	111
PID 4940 wrote to memory of 2264	4940	{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe	111
PID 1264 wrote to memory of 4388	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	114
PID 1264 wrote to memory of 4388	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	114
PID 1264 wrote to memory of 4388	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	114
PID 1264 wrote to memory of 3980	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	115
PID 1264 wrote to memory of 3980	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	115
PID 1264 wrote to memory of 3980	1264	{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe	115
PID 4388 wrote to memory of 220	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	117
PID 4388 wrote to memory of 220	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	117
PID 4388 wrote to memory of 220	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	117
PID 4388 wrote to memory of 2156	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	118
PID 4388 wrote to memory of 2156	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	118
PID 4388 wrote to memory of 2156	4388	{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe	118
PID 220 wrote to memory of 1880	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	119
PID 220 wrote to memory of 1880	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	119
PID 220 wrote to memory of 1880	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	119
PID 220 wrote to memory of 1708	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	120
PID 220 wrote to memory of 1708	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	120
PID 220 wrote to memory of 1708	220	{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe	120
PID 1880 wrote to memory of 4640	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	122
PID 1880 wrote to memory of 4640	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	122
PID 1880 wrote to memory of 4640	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	122
PID 1880 wrote to memory of 3832	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	123
PID 1880 wrote to memory of 3832	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	123
PID 1880 wrote to memory of 3832	1880	{96132C7A-7E13-4380-8B94-8DE49455230A}.exe	123
PID 4640 wrote to memory of 3024	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	124
PID 4640 wrote to memory of 3024	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	124
PID 4640 wrote to memory of 3024	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	124
PID 4640 wrote to memory of 2624	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	125
PID 4640 wrote to memory of 2624	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	125
PID 4640 wrote to memory of 2624	4640	{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe	125
PID 3024 wrote to memory of 1708	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	126
PID 3024 wrote to memory of 1708	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	126
PID 3024 wrote to memory of 1708	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	126
PID 3024 wrote to memory of 1328	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	127
PID 3024 wrote to memory of 1328	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	127
PID 3024 wrote to memory of 1328	3024	{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe	127
PID 1708 wrote to memory of 1744	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	135
PID 1708 wrote to memory of 1744	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	135
PID 1708 wrote to memory of 1744	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	135
PID 1708 wrote to memory of 4332	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	136
PID 1708 wrote to memory of 4332	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	136
PID 1708 wrote to memory of 4332	1708	{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe	136
PID 1744 wrote to memory of 4716	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	142
PID 1744 wrote to memory of 4716	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	142
PID 1744 wrote to memory of 4716	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	142
PID 1744 wrote to memory of 3296	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	143
PID 1744 wrote to memory of 3296	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	143
PID 1744 wrote to memory of 3296	1744	{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe	143
PID 4716 wrote to memory of 2404	4716	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe	145
PID 4716 wrote to memory of 2404	4716	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe	145
PID 4716 wrote to memory of 2404	4716	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe	145
PID 4716 wrote to memory of 880	4716	{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe	146

C:\Users\Admin\AppData\Local\Temp\2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_c5c33e5848e5ba6d6a236c36ee01ab98_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
  C:\Windows\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
    C:\Windows\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
      C:\Windows\{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Windows\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
        
        C:\Windows\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
        
        C:\Windows\{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
        
        C:\Windows\{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
        
        C:\Windows\{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
        
        C:\Windows\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
        
        C:\Windows\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
        
        C:\Windows\{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe
        
        C:\Windows\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe
        
        C:\Windows\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe
        13⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D524B~1.EXE > nul
        13⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BBBF1~1.EXE > nul
        12⤵
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16E72~1.EXE > nul
        11⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CAD07~1.EXE > nul
        10⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8D731~1.EXE > nul
        9⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1C3E4~1.EXE > nul
        8⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96132~1.EXE > nul
        7⤵
        
        PID:3832
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ECC08~1.EXE > nul
        6⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AD652~1.EXE > nul
        5⤵
        
        PID:2156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C861E~1.EXE > nul
      4⤵
      PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{33462~1.EXE > nul
    3⤵
    PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:3660

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe

Path C:\Windows\{16E72CA5-300E-4725-A5D8-C0B5D3FB5EAE}.exe
Size 344KB
SHA256 545c2ddca751a99b25e74b46eb41cc1513ce2af7c0430ebae19e910c47a02c0f
MD5 675ca880eb96ce9771abacd5c44ed147
SHA1 1d0cbf58d7951e7d123b81f4a0e621b9d3096c55
SHA512 96514c719f732bced07f219fd5cef3fbb4fa1326af8b1df10c3a2e0704bae68af73bd752d5da38904cb971c78962b8276b09b9f86f7a6d59a7b83af5b7b1b357
SSDEEP 3072:mEGh0oZlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGTlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe

Path C:\Windows\{1C3E480D-8DE9-4955-B983-0A800F18D721}.exe
Size 344KB
SHA256 c2ba6cf3671ba41e179cb43c0b678b40c556f18ac9503544e5131a8c503846a5
MD5 97b8836777f633be1dff4e5b4b1db7c9
SHA1 f05413dc5ead586041d36636ed3d7d615cead601
SHA512 d3cb1afb8e913ac8f408eb81e468e18461fdb0c0b69a05595e9678997eb8e58daace28f823f94f94ed043c11dd08a80ec2e958ff6e337963ffaaa66a06f078c7
SSDEEP 3072:mEGh0oplEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGHlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe

Path C:\Windows\{334627D0-EC8A-472e-9B70-8F6111EAD6E4}.exe
Size 344KB
SHA256 99beed982cad4cbdb2ed3a84280838a0e9c7ff9d7b0916bfafd035f284191f90
MD5 df05b90efb07b9219ddcec4607eb1514
SHA1 5ef71df59025101dfe72a08250b630899b2d7825
SHA512 d01898f78ac8781bc4e1dc6136cadfa29154309643ca55779bc6f5a0ca80189be0b7291b1dc21d110146f7c1de93417db84956fce9522fde5bd532abe00c41fc
SSDEEP 3072:mEGh0oSlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGwlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe

Path C:\Windows\{4158C3AD-C927-4dbe-BF42-C0BC730C2445}.exe
Size 344KB
SHA256 1a76c5a7bb51c9f4181568c134a71aa71aa600911904f5c68495f8b751184ac2
MD5 41fdddd6ff4d239eedeeb48e4f41849f
SHA1 390f78e4b209809668e03cbe56da022e2d96b518
SHA512 c0a601d1295aabe82662256df44d607f97b94304bc2f244a5d12cb9844f6583ff399f34d5437efcbe2d9238bd5364a54f0cf9f8af981202ae16cda8f0ab0aa2e
SSDEEP 3072:mEGh0ovlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGBlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe

Path C:\Windows\{8D731174-8E2D-4ff9-A387-F458BB2375B2}.exe
Size 344KB
SHA256 17251291b4c7b4ce3076000e8538e1d9b365ea19d3e23d6d83db1cb0e0082ae1
MD5 67656672c5933fb376eb7aa16d7b9849
SHA1 fa77b287dc7e66c56528747cea540c34b1e45363
SHA512 619d0675659cb33adbb188935c0dfa2027176c9f3713dbab1b8c8c425a6f843838f1871eb7bb31dd43684c840e36f6f930edc926b0caf62e194e44188ade908c
SSDEEP 3072:mEGh0oElEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG+lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{96132C7A-7E13-4380-8B94-8DE49455230A}.exe

Path C:\Windows\{96132C7A-7E13-4380-8B94-8DE49455230A}.exe
Size 344KB
SHA256 eb162459ecfbdff2f8b25dcbe08d3d6a15d47962a0372f7d975578bd3d37cb52
MD5 5538980aebace224db029324fc429d13
SHA1 df5d2b7739b8e590034cdc99f67069aefa68df0b
SHA512 0cce53335d13d54df2a0aace33e49cacc0d899df5f08f06f7ce7dfdd614b76151116ae618e284038aad0e7fb5f0bd198d9ef9734c1c095fc6d7393fd2064b0a8
SSDEEP 3072:mEGh0oelEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe

Path C:\Windows\{AD65208B-A07B-499b-86AF-0AD596C550C6}.exe
Size 344KB
SHA256 3b00042a3d1b41d975ffaa58f090b68a50510b8dbf7c5d9999c04ab8fb16de5a
MD5 c9b4edfc426966505abf5d6221e16ab3
SHA1 d16e1bbecf910c2f89f007268aa263d13886f09d
SHA512 59aac51782e0342b5583cd524f6107faf28fbdf2c99fedeb6b6eb6b449dfa7d283901f171afce64fefe9bad6348f6b2f7ab1d2371992a4ef57665ddc869af5c5
SSDEEP 3072:mEGh0oslEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG2lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe

Path C:\Windows\{BBBF105C-7226-4b5e-8B43-74E8144F2206}.exe
Size 344KB
SHA256 1cd22990f33e4da469ca63f6f404ace550e72a5af80285adc8f2bbfe44dcfe88
MD5 a0f22ed29e444657b927d9de69705bab
SHA1 20ba8fdd1a939c69ee03c1c1df910cbd622336a6
SHA512 deef37c6b4c3231158cfffce64ebe88e8064d8f0ed55c55b233f244e93d4aa9c19858c9bbfa6961152a8e53efcfe584d143e932b04a245db0ab88bae97a81fef
SSDEEP 3072:mEGh0oUlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe

Path C:\Windows\{C861EAEB-0A72-4b72-888C-1E3024C7BD9D}.exe
Size 344KB
SHA256 38e36050bb3ec5ba1e1d059610d562bdde23b30b5844ae93e3d62bac2993f3bc
MD5 6d04545efac3cba612c27fd1266c1b99
SHA1 426a9db0bfcf062ec02377ee094e9f03b69e24cc
SHA512 99c3b729d8fef8dfc17b73790d1b8d852cacb3f992f7e7d778393ac4043a1b129fdaf6964eeae0b2c62a67d74c4557388273ea1566fd7627b8171afdfd0f69d7
SSDEEP 3072:mEGh0oZlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGjlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe

Path C:\Windows\{CAD07406-B8B2-4b03-8FC4-F7ADCF72616A}.exe
Size 344KB
SHA256 f84de800a330842b11c7d6ea3cfe393592581a748208425eeec45b9fc64ff5c4
MD5 574a6a4e23d14ca0499a4ccfe73b79aa
SHA1 38b39fa3c0c8bf557b5aac0222f772da0b03c089
SHA512 5c7945e6afdcd665a12fe87efa4d279cf97bca7267160a028555ca91293aea4ea028347a418ba03ea79d4a7c375995ccc828c4a7cf89764c4aa3ac33ebefe7c5
SSDEEP 3072:mEGh0ovlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGJlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe

Path C:\Windows\{D524BBEC-E476-4ce6-B2C5-38D1D7E09E9A}.exe
Size 344KB
SHA256 94600ea1534cd5b7e99cfc055f07c4a580b14667cd65f656941a257401eb9fb9
MD5 ed0d8d048c2c56ac211bf5b583cdc6fb
SHA1 08705a73ca1ec60efcc3ef52816781ada748c3ae
SHA512 53b49f7f768891fa6339239c5762d64538c902e5e26de869a4e10eba7b4f9bd0e6495f59bf3ce8ccb9cb9c234986db521a4204a3a8ed4e89cfab31779583fc57
SSDEEP 3072:mEGh0oZlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGnlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe

Path C:\Windows\{ECC0858F-7FE0-4da9-B5AF-1D25F9DE6228}.exe
Size 344KB
SHA256 490e9d55878110b43cfb436fbf5050e3346d2d4f8f4bf7905444d831e2a5ff40
MD5 a3e66c996b400db7debb9dbf004f482d
SHA1 520efd8778a7836e79cc300d10d09167ebc158d1
SHA512 c28fefc6bb13f06692b6c55fcdb18074142afa1f7e37e655893438f6f3a7c5a7051c1d0831e4a8134ee7158019f788aa43b0ab8447780c96d723dd4aae23629a
SSDEEP 3072:mEGh0oSlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3364-36-0x000002557ED40000-0x000002557ED50000-memory.dmp

Download

memory/3364-52-0x000002557EE40000-0x000002557EE50000-memory.dmp

Download

memory/3364-68-0x000002557F160000-0x000002557F161000-memory.dmp

Download

memory/3364-70-0x000002557F190000-0x000002557F191000-memory.dmp

Download

memory/3364-71-0x000002557F190000-0x000002557F191000-memory.dmp

Download

memory/3364-72-0x000002557F2A0000-0x000002557F2A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads