233228c058e7d781ac3dbd1454c15866c8b119e0c2192f3669fe508894e4ae29

Analysis

max time kernel
149s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe
Size

408KB
MD5

fe36d8ce492c3f40e76142f204eeb01a
SHA1

f097c782dbde1070e893fcdbd1cc82daf56b05d9
SHA256

233228c058e7d781ac3dbd1454c15866c8b119e0c2192f3669fe508894e4ae29
SHA512

e960100f5c2ffed2e8a47777882ebd841d31c4b8db69936d6d1301d24c144f33e399ac23a07c9e142fc0c48f1e42ae964ef1c244f906015ff8180d1bbcb5b571
SSDEEP

3072:CEGh0oil3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGAldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023217-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023218-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002321f-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023024-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021fa2-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021fa3-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021fa2-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000703-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000703-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000703-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}\stubpath = "C:\\Windows\\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe"	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA81C678-1378-489b-A151-A40B3F6D32A8}\stubpath = "C:\\Windows\\{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe"	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}\stubpath = "C:\\Windows\\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe"	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A71552E8-5773-4d64-9BAF-FEC75885EADA}\stubpath = "C:\\Windows\\{A71552E8-5773-4d64-9BAF-FEC75885EADA}.exe"	{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}\stubpath = "C:\\Windows\\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe"	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}\stubpath = "C:\\Windows\\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe"	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}\stubpath = "C:\\Windows\\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe"	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A71552E8-5773-4d64-9BAF-FEC75885EADA}	{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D536208-337D-4f09-8985-5726BE144C2B}	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D536208-337D-4f09-8985-5726BE144C2B}\stubpath = "C:\\Windows\\{6D536208-337D-4f09-8985-5726BE144C2B}.exe"	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED70740D-2128-413b-89CD-E64196FF50A4}	{6D536208-337D-4f09-8985-5726BE144C2B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED70740D-2128-413b-89CD-E64196FF50A4}\stubpath = "C:\\Windows\\{ED70740D-2128-413b-89CD-E64196FF50A4}.exe"	{6D536208-337D-4f09-8985-5726BE144C2B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}\stubpath = "C:\\Windows\\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe"	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39D16589-2C66-4b1e-8A53-7A42074542C2}	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39D16589-2C66-4b1e-8A53-7A42074542C2}\stubpath = "C:\\Windows\\{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe"	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}\stubpath = "C:\\Windows\\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe"	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA81C678-1378-489b-A151-A40B3F6D32A8}	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe

Executes dropped EXE 12 IoCs

pid	Process
1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe
2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe
2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe
4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
4972	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
740	{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe
380	{A71552E8-5773-4d64-9BAF-FEC75885EADA}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
File created	C:\Windows\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe
File created	C:\Windows\{6D536208-337D-4f09-8985-5726BE144C2B}.exe	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
File created	C:\Windows\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
File created	C:\Windows\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe
File created	C:\Windows\{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
File created	C:\Windows\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
File created	C:\Windows\{A71552E8-5773-4d64-9BAF-FEC75885EADA}.exe	{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe
File created	C:\Windows\{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	{6D536208-337D-4f09-8985-5726BE144C2B}.exe
File created	C:\Windows\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
File created	C:\Windows\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
File created	C:\Windows\{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
Token: SeIncBasePriorityPrivilege	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe
Token: SeIncBasePriorityPrivilege	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
Token: SeIncBasePriorityPrivilege	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
Token: SeIncBasePriorityPrivilege	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
Token: SeIncBasePriorityPrivilege	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe
Token: SeIncBasePriorityPrivilege	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe
Token: SeIncBasePriorityPrivilege	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
Token: SeIncBasePriorityPrivilege	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
Token: SeIncBasePriorityPrivilege	4972	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
Token: SeIncBasePriorityPrivilege	740	{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1868	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe	97
PID 4116 wrote to memory of 1868	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe	97
PID 4116 wrote to memory of 1868	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe	97
PID 4116 wrote to memory of 1236	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe	98
PID 4116 wrote to memory of 1236	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe	98
PID 4116 wrote to memory of 1236	4116	2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe	98
PID 1868 wrote to memory of 2200	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	99
PID 1868 wrote to memory of 2200	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	99
PID 1868 wrote to memory of 2200	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	99
PID 1868 wrote to memory of 3848	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	100
PID 1868 wrote to memory of 3848	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	100
PID 1868 wrote to memory of 3848	1868	{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe	100
PID 2200 wrote to memory of 2528	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe	102
PID 2200 wrote to memory of 2528	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe	102
PID 2200 wrote to memory of 2528	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe	102
PID 2200 wrote to memory of 716	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe	103
PID 2200 wrote to memory of 716	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe	103
PID 2200 wrote to memory of 716	2200	{6D536208-337D-4f09-8985-5726BE144C2B}.exe	103
PID 2528 wrote to memory of 2916	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	104
PID 2528 wrote to memory of 2916	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	104
PID 2528 wrote to memory of 2916	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	104
PID 2528 wrote to memory of 728	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	105
PID 2528 wrote to memory of 728	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	105
PID 2528 wrote to memory of 728	2528	{ED70740D-2128-413b-89CD-E64196FF50A4}.exe	105
PID 2916 wrote to memory of 3272	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	106
PID 2916 wrote to memory of 3272	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	106
PID 2916 wrote to memory of 3272	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	106
PID 2916 wrote to memory of 1280	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	107
PID 2916 wrote to memory of 1280	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	107
PID 2916 wrote to memory of 1280	2916	{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe	107
PID 3272 wrote to memory of 2008	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	108
PID 3272 wrote to memory of 2008	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	108
PID 3272 wrote to memory of 2008	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	108
PID 3272 wrote to memory of 2980	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	109
PID 3272 wrote to memory of 2980	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	109
PID 3272 wrote to memory of 2980	3272	{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe	109
PID 2008 wrote to memory of 2316	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	110
PID 2008 wrote to memory of 2316	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	110
PID 2008 wrote to memory of 2316	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	110
PID 2008 wrote to memory of 4688	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	111
PID 2008 wrote to memory of 4688	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	111
PID 2008 wrote to memory of 4688	2008	{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe	111
PID 2316 wrote to memory of 4728	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	112
PID 2316 wrote to memory of 4728	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	112
PID 2316 wrote to memory of 4728	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	112
PID 2316 wrote to memory of 1964	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	113
PID 2316 wrote to memory of 1964	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	113
PID 2316 wrote to memory of 1964	2316	{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe	113
PID 4728 wrote to memory of 3260	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	114
PID 4728 wrote to memory of 3260	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	114
PID 4728 wrote to memory of 3260	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	114
PID 4728 wrote to memory of 3656	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	115
PID 4728 wrote to memory of 3656	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	115
PID 4728 wrote to memory of 3656	4728	{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe	115
PID 3260 wrote to memory of 4972	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	116
PID 3260 wrote to memory of 4972	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	116
PID 3260 wrote to memory of 4972	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	116
PID 3260 wrote to memory of 3812	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	117
PID 3260 wrote to memory of 3812	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	117
PID 3260 wrote to memory of 3812	3260	{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe	117
PID 4972 wrote to memory of 740	4972	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe	118
PID 4972 wrote to memory of 740	4972	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe	118
PID 4972 wrote to memory of 740	4972	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe	118
PID 4972 wrote to memory of 3580	4972	{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_fe36d8ce492c3f40e76142f204eeb01a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
  C:\Windows\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\{6D536208-337D-4f09-8985-5726BE144C2B}.exe
    C:\Windows\{6D536208-337D-4f09-8985-5726BE144C2B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
      C:\Windows\{ED70740D-2128-413b-89CD-E64196FF50A4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
        
        C:\Windows\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
        
        C:\Windows\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe
        
        C:\Windows\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe
        
        C:\Windows\{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
        
        C:\Windows\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
        
        C:\Windows\{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
        
        C:\Windows\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe
        
        C:\Windows\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
        
        C:\Windows\{A71552E8-5773-4d64-9BAF-FEC75885EADA}.exe
        
        C:\Windows\{A71552E8-5773-4d64-9BAF-FEC75885EADA}.exe
        13⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5ADD4~1.EXE > nul
        13⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0300B~1.EXE > nul
        12⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA81C~1.EXE > nul
        11⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E00A~1.EXE > nul
        10⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{39D16~1.EXE > nul
        9⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7AE24~1.EXE > nul
        8⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05CEC~1.EXE > nul
        7⤵
        
        PID:2980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B96C~1.EXE > nul
        6⤵
        
        PID:1280
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED707~1.EXE > nul
        5⤵
        
        PID:728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6D536~1.EXE > nul
      4⤵
      PID:716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6FF2D~1.EXE > nul
    3⤵
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0300B3AD-0BE3-4299-B57D-BC19D7821B39}.exe

Filesize
408KB

MD5
528e8f578d99dee1bee3dacca7f9bdc5

SHA1
e28808233661e6fd5473eab74fa339925c27eebe

SHA256
84400eb351e909639b71b1bf04a180a8c926ebcd688ac88cb315f49cff76ca70

SHA512
b96180e15b666948742334047590a2c30b6da31ca92f88204ac80c6587d53b5557bd4c6e5dd796f1ad1a917f6bac4f41b43b5b92b85320265b97cddb8f91b976

Download Submit
C:\Windows\{05CEC650-7F09-4b1b-9BD6-5D0DFEF672F0}.exe

Filesize
408KB

MD5
9b574b5627f1db9d5e0a24baaf4aed4f

SHA1
79f97c2e2e78a5866d3d8f173e7ab92c6142c1ef

SHA256
cd2c003cf1673929a06e7304ea541e65c6e5d923963a0f810eb9732aa66488d0

SHA512
5a9ff60b4909ee0843b908db4cda76898e09ae5d86d7092e99e80ea59f2ed942054826c5e7de144e19aeb82b5af8354db58fbaa4ed46dbdc140fffd645d7ba0c

Download Submit
C:\Windows\{0E00ADA9-9A81-4b50-99E7-20200A1CF656}.exe

Filesize
408KB

MD5
204f6e8590a8e7a1dc439a7ad01a58e2

SHA1
d7b19aff991de2af6290b7999d9e4dc31e7016cd

SHA256
faa7be635067cf549a07e9211e1e6a3cbf9faedb27e70c945768db39deaca501

SHA512
8b650d9ceded5fcfbba27de0f1f309a54a22cb3a0d6cf9d02a3bb61784fa774feaad6aeccfdbc1040036e6acc070ccf40a2b96b9b532aad2dcaf9a0e93aa02d0

Download Submit
C:\Windows\{39D16589-2C66-4b1e-8A53-7A42074542C2}.exe

Filesize
408KB

MD5
aefa2b17d18625532a57e3a380a40f62

SHA1
34d76cef9d4bbaba0aea11ddc4f422cdb18753ce

SHA256
1bda3f07dc1efc1cb1b5982de20d21aa8a9dc971d1a319e06153d37e76583ac2

SHA512
c16dd0c229f1a555cb80bc1385ae50d3927eae625927da93cf1f7f1d85ee2d98fd64b3734a6978f1be931853cd1dc4a3301adeefcc7a11aecc5080044fa6db37

Download Submit
C:\Windows\{5ADD42D9-7A92-417b-BC4A-5C4ADD5C4800}.exe

Filesize
408KB

MD5
01d9727a3f2cc48db1ab8b182eacbbab

SHA1
edea5969bb7cc9e97da4a5039c1b129763d1e550

SHA256
47478b20f71fede9fe715a1001a52c221ae95e07710492f9cc50554af47870a7

SHA512
6478692aa9c9e3e2838fdb1f306a853c7611bec52ded646125c3d2c38fc062ee9b1ef5880f95ef8b2d112b17d83818c01298c50044553922a6746d13463efc4b

Download Submit
C:\Windows\{6D536208-337D-4f09-8985-5726BE144C2B}.exe

Filesize
408KB

MD5
9ec18e47647d52d5d4bdc4a636b472e9

SHA1
9cf93d8a51364d7764e2da4be9df576bf2951c22

SHA256
a06ac23a70bd28bc68a51a9dc97cbd39fcc5b406323d97ddd3d048926adeb0e7

SHA512
ec8fedf73d7e2a0b39a0f8376d1b9dcf2407c24129f51c6c4523adfa409e71bc9dbd9778bb87401c788404b4d7e3a0b6f396157f5ac2a017514ef09dad970e53

Download Submit
C:\Windows\{6FF2D9AF-3F90-46ec-9A81-B2099B20C028}.exe

Filesize
408KB

MD5
01a94354ee0b86652bd8d5a29166edfb

SHA1
f121282e23a3665ef405855eda53d54fd1ec32d0

SHA256
ff579401460943a21b552efbde1bb0b192f9d322a94cd4f1c6d19e55ba16ecb2

SHA512
90ef6736984bb028f640408e6ea0986a004199d1e13d0a658d5209c7d755d068916e16198cc44f8105bd11aafde95a1d2189fb207ba19365f45b37b1684bb2e7

Download Submit
C:\Windows\{7AE244D8-5AD8-4fd3-92E7-DB3D00B56711}.exe

Filesize
408KB

MD5
50a3f40300c2de01e4fe66ecfa3f11bb

SHA1
376681692fe55b1309272d1e0449eea4eeade34f

SHA256
fd82c042211f5fa2e955e325214d4165a7ae39945e15ab2fe01f7f4f554c4a12

SHA512
b38b14b11d9a8cc266302efecb7f32baaf252c89c06294ad31735ec5fa09332b63566064ee3410d3c1074fede800e7e1dcd8041fc58d1469ab9047a7aaa41892

Download Submit
C:\Windows\{7B96CDD0-BC9D-4c39-BB26-6A3A40E1895A}.exe

Filesize
408KB

MD5
219ffb3c0056a13b2c0f411137f6ed64

SHA1
f021baa36144158435d73f61a05bd72956c44489

SHA256
aa913380fee444f9ecf70e0d7967fd05c62354eab0a1900313fd9e6ba932e662

SHA512
3df736d7e788ded368f476b75114fa05549b19e1891e77c5d56ce781877c94870f41dba1fe8aa31ef4f90544272add9f4325ccf03159a65e8432d065507813bf

Download Submit
C:\Windows\{A71552E8-5773-4d64-9BAF-FEC75885EADA}.exe

Filesize
408KB

MD5
1a8d10a2dfd3ab1fb5d900b07abb9c3a

SHA1
d06307b4f93e4dc8646e68334b1d511ad3c8a514

SHA256
ff48964fb4c301ab1669a059e454a303a0e5d2940c92be1821c98cf087ff3dec

SHA512
8fc79c0b96069cc271c4b092da5e076e1da511ac402906dd96bc738c8ffed62d95f387a14c65a7352a589a5a591326e2b68d0d4e18d8252d16d2cb784c626d82

Download Submit
C:\Windows\{ED70740D-2128-413b-89CD-E64196FF50A4}.exe

Filesize
408KB

MD5
c633eedd39c483fdb764c7c4ffb0cf06

SHA1
a046b4d02afae1cc8d3ef9e3b9f68e3c69a31866

SHA256
25f6cc59eb7460392a7c0b95ad156d9e3fed2074626fd2eb5cac6e9f0a9f9a53

SHA512
c27be93fdf8f51106da0f482f71648b6e452bfcfb896416fea9ca0f0708facbe0aa4b0effe9a6230d748ced8c0fd61ac89fe9594cf9d5b2b488318d4e97aa2e6

Download Submit
C:\Windows\{FA81C678-1378-489b-A151-A40B3F6D32A8}.exe

Filesize
408KB

MD5
4332c5eff917ada9aafaeb79c70533cc

SHA1
814071ff4ae449e20bcb3385189c2f036071dee1

SHA256
93548329dc2afcfdb0a6dcd469271c25a026d1e3bb00ec63319d9bded6c0ba30

SHA512
a1ca2a43d1c0f30a7decee04a117cd9c0965c63b36201db042d2ebc31edc1c9ef91105e09c94f9e830309609cc360d8996ab5ed6b8956a0ebbbcad2c77670b5c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads