7ca8ed7d655a9bf6eda8c9a9abb91a130a53c31defe89626033d90d632ecce34

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe
Size 408KB
Sample240404-v3cw4aec23
SHA256 7ca8ed7d655a9bf6eda8c9a9abb91a130a53c31defe89626033d90d632ecce34
MD5 498ace753812e87f79e29e76b6247e99
SHA1 67f81c148f3a43c735cb0ad4b41f70820788505e
SHA512 e6d44a8fe9b32b2be2d53caccd1aaebbc99489eaaf90e2af061dc4c8547195838ea7a828b0f45f96bb6b4e375de619f85571f7fdd931febe17eed2e34a15f8a5
SSDEEP 3072:CEGh0oRl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG3ldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023201-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023208-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002320f-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023208-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002320f-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021fa2-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021fa3-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000703-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000703-37.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000703-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAEA0122-EF93-454c-8104-B2336050F79E}\stubpath = "C:\\Windows\\{AAEA0122-EF93-454c-8104-B2336050F79E}.exe"	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25E8A399-848A-451a-B706-7BBDDD559911}	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}	{25E8A399-848A-451a-B706-7BBDDD559911}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}\stubpath = "C:\\Windows\\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe"	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}\stubpath = "C:\\Windows\\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe"	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}\stubpath = "C:\\Windows\\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe"	{25E8A399-848A-451a-B706-7BBDDD559911}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F66FD688-19B0-4fd0-8E06-94DB7434597F}\stubpath = "C:\\Windows\\{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe"	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE7EE3A6-306A-4456-9198-BC9029D5B165}	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}\stubpath = "C:\\Windows\\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe"	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F66FD688-19B0-4fd0-8E06-94DB7434597F}	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24867C31-A0B2-4108-9235-AFFCE70B4174}\stubpath = "C:\\Windows\\{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe"	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4723501-1C37-4b11-BDAE-72800D7DF220}	{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}\stubpath = "C:\\Windows\\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe"	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}\stubpath = "C:\\Windows\\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe"	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAEA0122-EF93-454c-8104-B2336050F79E}	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25E8A399-848A-451a-B706-7BBDDD559911}\stubpath = "C:\\Windows\\{25E8A399-848A-451a-B706-7BBDDD559911}.exe"	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24867C31-A0B2-4108-9235-AFFCE70B4174}	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE7EE3A6-306A-4456-9198-BC9029D5B165}\stubpath = "C:\\Windows\\{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe"	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4723501-1C37-4b11-BDAE-72800D7DF220}\stubpath = "C:\\Windows\\{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe"	{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe

Executes dropped EXE 12 IoCs

pid	Process
3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe
4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
3560	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
4876	{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe
2712	{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe
File created	C:\Windows\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
File created	C:\Windows\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
File created	C:\Windows\{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
File created	C:\Windows\{25E8A399-848A-451a-B706-7BBDDD559911}.exe	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
File created	C:\Windows\{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
File created	C:\Windows\{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
File created	C:\Windows\{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
File created	C:\Windows\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
File created	C:\Windows\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
File created	C:\Windows\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	{25E8A399-848A-451a-B706-7BBDDD559911}.exe
File created	C:\Windows\{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe	{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
Token: SeIncBasePriorityPrivilege	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
Token: SeIncBasePriorityPrivilege	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
Token: SeIncBasePriorityPrivilege	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
Token: SeIncBasePriorityPrivilege	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
Token: SeIncBasePriorityPrivilege	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe
Token: SeIncBasePriorityPrivilege	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
Token: SeIncBasePriorityPrivilege	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
Token: SeIncBasePriorityPrivilege	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
Token: SeIncBasePriorityPrivilege	3560	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
Token: SeIncBasePriorityPrivilege	4876	{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 3724	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe	97
PID 1824 wrote to memory of 3724	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe	97
PID 1824 wrote to memory of 3724	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe	97
PID 1824 wrote to memory of 1588	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe	98
PID 1824 wrote to memory of 1588	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe	98
PID 1824 wrote to memory of 1588	1824	2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe	98
PID 3724 wrote to memory of 3972	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	99
PID 3724 wrote to memory of 3972	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	99
PID 3724 wrote to memory of 3972	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	99
PID 3724 wrote to memory of 3240	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	100
PID 3724 wrote to memory of 3240	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	100
PID 3724 wrote to memory of 3240	3724	{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe	100
PID 3972 wrote to memory of 3256	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	102
PID 3972 wrote to memory of 3256	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	102
PID 3972 wrote to memory of 3256	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	102
PID 3972 wrote to memory of 2732	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	103
PID 3972 wrote to memory of 2732	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	103
PID 3972 wrote to memory of 2732	3972	{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe	103
PID 3256 wrote to memory of 3064	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	104
PID 3256 wrote to memory of 3064	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	104
PID 3256 wrote to memory of 3064	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	104
PID 3256 wrote to memory of 5072	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	105
PID 3256 wrote to memory of 5072	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	105
PID 3256 wrote to memory of 5072	3256	{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe	105
PID 3064 wrote to memory of 4968	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	106
PID 3064 wrote to memory of 4968	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	106
PID 3064 wrote to memory of 4968	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	106
PID 3064 wrote to memory of 4776	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	107
PID 3064 wrote to memory of 4776	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	107
PID 3064 wrote to memory of 4776	3064	{AAEA0122-EF93-454c-8104-B2336050F79E}.exe	107
PID 4968 wrote to memory of 4624	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	108
PID 4968 wrote to memory of 4624	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	108
PID 4968 wrote to memory of 4624	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	108
PID 4968 wrote to memory of 3776	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	109
PID 4968 wrote to memory of 3776	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	109
PID 4968 wrote to memory of 3776	4968	{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe	109
PID 4624 wrote to memory of 4912	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe	110
PID 4624 wrote to memory of 4912	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe	110
PID 4624 wrote to memory of 4912	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe	110
PID 4624 wrote to memory of 1840	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe	111
PID 4624 wrote to memory of 1840	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe	111
PID 4624 wrote to memory of 1840	4624	{25E8A399-848A-451a-B706-7BBDDD559911}.exe	111
PID 4912 wrote to memory of 4904	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	112
PID 4912 wrote to memory of 4904	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	112
PID 4912 wrote to memory of 4904	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	112
PID 4912 wrote to memory of 2512	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	113
PID 4912 wrote to memory of 2512	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	113
PID 4912 wrote to memory of 2512	4912	{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe	113
PID 4904 wrote to memory of 2556	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	114
PID 4904 wrote to memory of 2556	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	114
PID 4904 wrote to memory of 2556	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	114
PID 4904 wrote to memory of 3968	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	115
PID 4904 wrote to memory of 3968	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	115
PID 4904 wrote to memory of 3968	4904	{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe	115
PID 2556 wrote to memory of 3560	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	116
PID 2556 wrote to memory of 3560	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	116
PID 2556 wrote to memory of 3560	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	116
PID 2556 wrote to memory of 1832	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	117
PID 2556 wrote to memory of 1832	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	117
PID 2556 wrote to memory of 1832	2556	{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe	117
PID 3560 wrote to memory of 4876	3560	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe	118
PID 3560 wrote to memory of 4876	3560	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe	118
PID 3560 wrote to memory of 4876	3560	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe	118
PID 3560 wrote to memory of 3120	3560	{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_498ace753812e87f79e29e76b6247e99_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
  C:\Windows\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
    C:\Windows\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
      C:\Windows\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
        
        C:\Windows\{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
        
        C:\Windows\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\{25E8A399-848A-451a-B706-7BBDDD559911}.exe
        
        C:\Windows\{25E8A399-848A-451a-B706-7BBDDD559911}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
        
        C:\Windows\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
        
        C:\Windows\{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
        
        C:\Windows\{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
        
        C:\Windows\{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe
        
        C:\Windows\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
        
        C:\Windows\{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe
        
        C:\Windows\{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe
        13⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E750B~1.EXE > nul
        13⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE7EE~1.EXE > nul
        12⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24867~1.EXE > nul
        11⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F66FD~1.EXE > nul
        10⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0C77~1.EXE > nul
        9⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25E8A~1.EXE > nul
        8⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{030A0~1.EXE > nul
        7⤵
        
        PID:3776
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AAEA0~1.EXE > nul
        6⤵
        
        PID:4776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D0EEF~1.EXE > nul
        5⤵
        
        PID:5072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F8ABA~1.EXE > nul
      4⤵
      PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BE0A2~1.EXE > nul
    3⤵
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe

Path C:\Windows\{030A0717-ED2A-4ed7-BF06-029ACF5B1E0D}.exe
Size 408KB
SHA256 a777d68190b574e231cb4638f0466b701541cb497b45cd80923cd1ada920eee5
MD5 6e6e48432ae094da8706b7498b6850c0
SHA1 88476717f390deab20e9c0c38a4ab8384cdc239d
SHA512 913709c35b271f1bfe632fe85ad7174e3c292541cc6c3278d234fc0495b6ab16f5e078753177c8f45d4117585945b9182ee0e5c61758225d7a1f9d92252f14f6
SSDEEP 3072:CEGh0o/l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGFldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe

Path C:\Windows\{24867C31-A0B2-4108-9235-AFFCE70B4174}.exe
Size 408KB
SHA256 cad5e1085e935de3c2e4968172eb3bac03af0172badf50f1f554caf7b9b9368b
MD5 2442b42a1c6e3ac9779153fe3f1d9b87
SHA1 1e5e89fecbaec1fb3ffc9fc4ab4be968698d9aa3
SHA512 c54bfedba0dc2a89f0b9124ddd81a2e9498ad53e3ad1df1c4806d9235923e0c1700eb522ecdab4b8edd28c40ca13a0df48d6c8579b38b710a2d59198e2f8153d
SSDEEP 3072:CEGh0oBl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGDldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{25E8A399-848A-451a-B706-7BBDDD559911}.exe

Path C:\Windows\{25E8A399-848A-451a-B706-7BBDDD559911}.exe
Size 408KB
SHA256 32526ab01fb4aaf899bc783f0ad83382c380332e02a6480bbc5d77cc3c3bea16
MD5 33d6ca8cb0bc1671fca1232f91a1a35d
SHA1 af9a084c50a8540562160c17a4eef52bf5a24cfe
SHA512 cae027f53471785b3c585649cb05616f19b69b05a551f7cc19cbb5cd13b8fa28fb9566ad1b21b08d2ec73904cb9b38701d31618231f1a842840b74d0d5081d15
SSDEEP 3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AAEA0122-EF93-454c-8104-B2336050F79E}.exe

Path C:\Windows\{AAEA0122-EF93-454c-8104-B2336050F79E}.exe
Size 408KB
SHA256 63a86eed57a9135274a84290f0724b1c4f6a17f21f4231840066789e1c70c7c9
MD5 bf2b0ef8fdc2e7f6000d5bb5dd0863cc
SHA1 21810e90cfbe97c44ad12a6e39dc95134a17c84e
SHA512 d28ea2d50290a2e667d1cc570edeaac1b429d8e144070477592de41e15a6387a513204c7d21526d7eada4234005b49824d0a0e651ae7ac3609771e0463ac154e
SSDEEP 3072:CEGh0odl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGzldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe

Path C:\Windows\{BE0A257B-79F9-401e-B383-B1626BD8B6D4}.exe
Size 408KB
SHA256 ca600b83fafd88009956de12bb8a4fbfb48d4c45c8999cd95f91f71e4eb71662
MD5 4c9b240ed9be7dafb3dc57049223ba2e
SHA1 9fee43e12e9a56b08375349f22628ff1f58c8d67
SHA512 ca32bbb4d58a472a07bd900ffa1ef48801cb87ab4147c29056349f6a2713f367bac0a1c5a3979d7eec8cd888ad045834b63952f3103cfb02208a1df69775ba26
SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe

Path C:\Windows\{BE7EE3A6-306A-4456-9198-BC9029D5B165}.exe
Size 408KB
SHA256 8599256893a88447c8ee7bc2f3ae39ae5092e9b3eee169052dc86533fff47945
MD5 666a066d7704254e7bac7688559aa9db
SHA1 10c78e6436bec75a6aa01dd8a26db20725f754d3
SHA512 9bff2894284a9cbc96707e651f8727c4305d44df342f4c89cb8f6a27a830d539607b9d393862c41d3501c06a35b2374c0e683b380d257f0c874f44ae5f1acd12
SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGSldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe

Path C:\Windows\{D0EEF727-6FC0-48a0-AD54-27BA5093B34A}.exe
Size 408KB
SHA256 0aa990f54b15bd492d4c92882a192eb40a0799a542dc5dafdc4220ffc4e3dc55
MD5 02f04394cbcc76c75536f719aadcc151
SHA1 5edd1b462acf512a16bc0600f9fe58258084cffd
SHA512 411a34d3e8e9222424a8bfb7b605d23b9b54f1a50910b869af45d6a3882f9bc0e1f6a34a8931aaa02211ddcf70adfa6028a76d11409ae1a28c047c16a7bda25a
SSDEEP 3072:CEGh0o1l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG/ldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe

Path C:\Windows\{D4723501-1C37-4b11-BDAE-72800D7DF220}.exe
Size 408KB
SHA256 99d69aadcc0233995343517960d52286deb6c952dc25c89f0948fa3c64a3d17b
MD5 f62cb2ef31fab9040ad6517b15ca14bf
SHA1 a07deea656a975673ce04fdb77e754b1392ee8a0
SHA512 b99be5bc1b04cc8345458f6074b6e0626d2b75a0af5683be64a7cdbb3f73084a68ce549a36a8072e5845cfa94b0b81170a75de1d914816cde0e60564773e54b0
SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGIldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe

Path C:\Windows\{E0C771A4-FECA-439e-8ACE-CCBEFFB556B1}.exe
Size 408KB
SHA256 1e52a931f8aa03b756fc2f19ab69831e494884ad4150d04279745ad0dc401085
MD5 cfca8901b75742abce12d573daa73dc3
SHA1 2e44b8255a770d8128e972de16eb23e8db9a2a8a
SHA512 68ed41518d9763ea0076569233fd3071f4f3e24ed51b1c7dabeba8f248e15f6a15b2925293f6ce907677b4db5c53edca436765ce256815ff68dc8a5ca111282a
SSDEEP 3072:CEGh0oHl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGhldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe

Path C:\Windows\{E750B4CA-A7E1-4e2c-BF96-3039CFA7CCE5}.exe
Size 408KB
SHA256 8dc9e5237e419cdbfa760f3f8a8c420b9bad70c0d0fe45173d0f366e33d3f913
MD5 d7385dfaf55dceebc884a7e8bfb31a0b
SHA1 e9432a9fb8cc0aff04a9f476a40f851a28c06a55
SHA512 0ba9a6ce8cce047e0b5dba1fca0e887d32b9cfde6062f3103ddf199c9b25a35a45f04aa94d17650396323183452da219f4c0aa2c7ba1dd0da19e4bd1fae3789c
SSDEEP 3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG+ldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe

Path C:\Windows\{F66FD688-19B0-4fd0-8E06-94DB7434597F}.exe
Size 408KB
SHA256 326d153678a71af86f13113f0f8f1a33c6f15bbf1cf99a34608e33b728a09de3
MD5 24b04a3c00d706a1b335beb4fd3a577c
SHA1 bab9b170c6ddb5db19ba91b61f7ae93c775997bc
SHA512 c99a2d252d9fcfd77f4df09180351dfc1bba6cbfd1585373550191b5089312bee66e1ceff8984eacc26c552bc2afcb21c437892f698b127c566c3fe57a2f074c
SSDEEP 3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGdldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe

Path C:\Windows\{F8ABA0F5-DCE1-4af5-A5C5-2B4EB3EFD2A7}.exe
Size 408KB
SHA256 230828d14700dea870b530420302f3d3363df7f12b200c17a2b73c85f04faf97
MD5 8fb7cb96d20c399f6aaadb72ffec286f
SHA1 acf62c008986326ddcb58693c7c3bce19088b69d
SHA512 cc3c5ba2dd8728144dd07edccb36db2aaf88d9f370529aef782f4942d179c83bbb5f81bb14ddceb54e513bb5b25dae1770c84879c5e6bd0bfca79f445e638cd4
SSDEEP 3072:CEGh0o1l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGvldOe2MUVg3vTeKcAEciTBqr3jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads