a67882e897555523ecb3e1de3b8dd6b3ace0f5d104a47badb8359d7a50975efd

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
Size

197KB
MD5

cd15fa97891c8af713617ca8c67ba747
SHA1

5f0f18c020b63dc0282197bea8300e42300d7d98
SHA256

a67882e897555523ecb3e1de3b8dd6b3ace0f5d104a47badb8359d7a50975efd
SHA512

c47857c76751b3becf37bdaa59c716c0724ce53393b385bef05e881d5a2cfdabff6c8b93a221fd709ab70664db27a49e8fe908a6d6d9febccb4431a1eac139f7
SSDEEP

3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGvlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231d9-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000231cd-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231df-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000231cd-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d41-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d42-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021d41-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000707-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}\stubpath = "C:\\Windows\\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe"	{1904B375-13DE-449c-BA55-3839E91C4934}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBA54D20-6EF6-47fd-8534-703AF586B86C}	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}\stubpath = "C:\\Windows\\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe"	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}\stubpath = "C:\\Windows\\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe"	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}\stubpath = "C:\\Windows\\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe"	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1904B375-13DE-449c-BA55-3839E91C4934}\stubpath = "C:\\Windows\\{1904B375-13DE-449c-BA55-3839E91C4934}.exe"	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0E3E329-8E9F-487a-857E-74A8546317DF}	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0E3E329-8E9F-487a-857E-74A8546317DF}\stubpath = "C:\\Windows\\{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe"	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}	{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}\stubpath = "C:\\Windows\\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}.exe"	{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05DA7D63-8147-43f6-A535-AB8720D3CC71}	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}\stubpath = "C:\\Windows\\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe"	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}\stubpath = "C:\\Windows\\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe"	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}	{1904B375-13DE-449c-BA55-3839E91C4934}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}\stubpath = "C:\\Windows\\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe"	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05DA7D63-8147-43f6-A535-AB8720D3CC71}\stubpath = "C:\\Windows\\{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe"	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1904B375-13DE-449c-BA55-3839E91C4934}	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBA54D20-6EF6-47fd-8534-703AF586B86C}\stubpath = "C:\\Windows\\{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe"	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe

Executes dropped EXE 12 IoCs

pid	Process
5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe
3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe
1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
464	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
4432	{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe
1480	{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
File created	C:\Windows\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
File created	C:\Windows\{1904B375-13DE-449c-BA55-3839E91C4934}.exe	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
File created	C:\Windows\{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe
File created	C:\Windows\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
File created	C:\Windows\{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
File created	C:\Windows\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}.exe	{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe
File created	C:\Windows\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
File created	C:\Windows\{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
File created	C:\Windows\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
File created	C:\Windows\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
File created	C:\Windows\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	{1904B375-13DE-449c-BA55-3839E91C4934}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
Token: SeIncBasePriorityPrivilege	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
Token: SeIncBasePriorityPrivilege	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
Token: SeIncBasePriorityPrivilege	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
Token: SeIncBasePriorityPrivilege	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
Token: SeIncBasePriorityPrivilege	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
Token: SeIncBasePriorityPrivilege	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe
Token: SeIncBasePriorityPrivilege	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe
Token: SeIncBasePriorityPrivilege	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
Token: SeIncBasePriorityPrivilege	464	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
Token: SeIncBasePriorityPrivilege	4432	{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5072	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe	97
PID 4004 wrote to memory of 5072	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe	97
PID 4004 wrote to memory of 5072	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe	97
PID 4004 wrote to memory of 1540	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe	98
PID 4004 wrote to memory of 1540	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe	98
PID 4004 wrote to memory of 1540	4004	2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe	98
PID 5072 wrote to memory of 1196	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	99
PID 5072 wrote to memory of 1196	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	99
PID 5072 wrote to memory of 1196	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	99
PID 5072 wrote to memory of 1736	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	100
PID 5072 wrote to memory of 1736	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	100
PID 5072 wrote to memory of 1736	5072	{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe	100
PID 1196 wrote to memory of 4348	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	102
PID 1196 wrote to memory of 4348	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	102
PID 1196 wrote to memory of 4348	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	102
PID 1196 wrote to memory of 1804	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	103
PID 1196 wrote to memory of 1804	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	103
PID 1196 wrote to memory of 1804	1196	{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe	103
PID 4348 wrote to memory of 3064	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	104
PID 4348 wrote to memory of 3064	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	104
PID 4348 wrote to memory of 3064	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	104
PID 4348 wrote to memory of 4736	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	105
PID 4348 wrote to memory of 4736	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	105
PID 4348 wrote to memory of 4736	4348	{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe	105
PID 3064 wrote to memory of 4388	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	106
PID 3064 wrote to memory of 4388	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	106
PID 3064 wrote to memory of 4388	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	106
PID 3064 wrote to memory of 4740	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	107
PID 3064 wrote to memory of 4740	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	107
PID 3064 wrote to memory of 4740	3064	{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe	107
PID 4388 wrote to memory of 4304	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	108
PID 4388 wrote to memory of 4304	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	108
PID 4388 wrote to memory of 4304	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	108
PID 4388 wrote to memory of 2152	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	109
PID 4388 wrote to memory of 2152	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	109
PID 4388 wrote to memory of 2152	4388	{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe	109
PID 4304 wrote to memory of 4420	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	110
PID 4304 wrote to memory of 4420	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	110
PID 4304 wrote to memory of 4420	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	110
PID 4304 wrote to memory of 4500	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	111
PID 4304 wrote to memory of 4500	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	111
PID 4304 wrote to memory of 4500	4304	{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe	111
PID 4420 wrote to memory of 3476	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe	112
PID 4420 wrote to memory of 3476	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe	112
PID 4420 wrote to memory of 3476	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe	112
PID 4420 wrote to memory of 2052	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe	113
PID 4420 wrote to memory of 2052	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe	113
PID 4420 wrote to memory of 2052	4420	{1904B375-13DE-449c-BA55-3839E91C4934}.exe	113
PID 3476 wrote to memory of 1128	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	114
PID 3476 wrote to memory of 1128	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	114
PID 3476 wrote to memory of 1128	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	114
PID 3476 wrote to memory of 1060	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	115
PID 3476 wrote to memory of 1060	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	115
PID 3476 wrote to memory of 1060	3476	{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe	115
PID 1128 wrote to memory of 464	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	116
PID 1128 wrote to memory of 464	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	116
PID 1128 wrote to memory of 464	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	116
PID 1128 wrote to memory of 3180	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	117
PID 1128 wrote to memory of 3180	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	117
PID 1128 wrote to memory of 3180	1128	{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe	117
PID 464 wrote to memory of 4432	464	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe	118
PID 464 wrote to memory of 4432	464	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe	118
PID 464 wrote to memory of 4432	464	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe	118
PID 464 wrote to memory of 2336	464	{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
  C:\Windows\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
    C:\Windows\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
      C:\Windows\{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\Windows\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
        
        C:\Windows\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
        
        C:\Windows\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
        
        C:\Windows\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\{1904B375-13DE-449c-BA55-3839E91C4934}.exe
        
        C:\Windows\{1904B375-13DE-449c-BA55-3839E91C4934}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe
        
        C:\Windows\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
        
        C:\Windows\{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
        
        C:\Windows\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe
        
        C:\Windows\{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
        
        C:\Windows\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}.exe
        
        C:\Windows\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}.exe
        13⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C0E3E~1.EXE > nul
        13⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{306A4~1.EXE > nul
        12⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBA54~1.EXE > nul
        11⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BD9E8~1.EXE > nul
        10⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1904B~1.EXE > nul
        9⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97916~1.EXE > nul
        8⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20CB6~1.EXE > nul
        7⤵
        
        PID:2152
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5719E~1.EXE > nul
        6⤵
        
        PID:4740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05DA7~1.EXE > nul
        5⤵
        
        PID:4736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{98C1C~1.EXE > nul
      4⤵
      PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C0816~1.EXE > nul
    3⤵
    PID:1736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05DA7D63-8147-43f6-A535-AB8720D3CC71}.exe

Filesize
197KB

MD5
a7fe982f73dbf6d8f9ec74a29e3b2ecd

SHA1
a0aeeac93f2371aecc74f7cd20bccadf3c29d5a7

SHA256
68cff3b3b981c59fd3b994c58c876b7b73979308649309105d2795f15af8f9b5

SHA512
6db872f8e608d113bd493751aa54faf5b980dff205f5eae47c3499c840203e769b2a5563b9c2ff00825327e9dd36059f01934c0aae7644256abe6821c493a829

Download Submit
C:\Windows\{1904B375-13DE-449c-BA55-3839E91C4934}.exe

Filesize
197KB

MD5
a697b5fc5849bccd628a6a007c9dd0d9

SHA1
ac326e6251f56b24b9590483a8a90ff59f882f28

SHA256
25099038790b97b1d1070dfbb94ffc0d509ad26f0684b038620cafcf6e741027

SHA512
927340374d972901224d95a26155d2e82bed8117775b4316e42c3b181fc05d91ec427c24c3268ef1429c912d703de8f983b1784e733742984f0e3d685c7dbacd

Download Submit
C:\Windows\{20CB6AF4-284A-4e7c-8D41-FD9C906912FA}.exe

Filesize
197KB

MD5
167b181b0e2a392f3a777924d291ebb2

SHA1
50b324763ead0586fddf12dc2dc99661caec7610

SHA256
8fc2da4db1e0f082d88d940e26c2143f9cdd93f6df02d59ab87713f3de43bf65

SHA512
55ab2e05dffb6e72d394801b6d9ba89389f7a0399a50bfd51559c3af32b0b1aa2c921e271f98ec870f754f14c08a710ce55837715e41856b36a5dd31d1bd9d50

Download Submit
C:\Windows\{306A42F9-AE5A-47d4-A6DB-A6467D18F1C6}.exe

Filesize
197KB

MD5
2e8b19d6bbbda91089a5936bb7da8ec8

SHA1
613e1601190ee4431fdf2edba4d8456cb3e2810d

SHA256
84e6aaf08994f85c7027bad88773973d1fe5d363c16432ce034dba8890627acf

SHA512
57d398fc838ef1932316921f327c84964755b022286c261065dce658df1d11f86dd818638e07cae63c6be9a956a2f452c03d1f85277c784bb6499725eb1bdc06

Download Submit
C:\Windows\{5719ED6E-B53F-43f7-8062-D22E13CE0E28}.exe

Filesize
197KB

MD5
4f4de32d5ddcf4c1036abc1ae2065e67

SHA1
9d169a59cb6d5cced598dbbdaedd200fe4f23f1c

SHA256
ffa0b64ec1bde47f500e277888b06f05131cdb4c4910fe1167cb8a0fc0102a65

SHA512
55b48c89f32d969b7d5074380022a89902efedf6c52ccf1518672f3e55fd4697a4aa9b561bb8dcecd6588be5838c793c609483580d1a0a4b800474121d4bd8e5

Download Submit
C:\Windows\{6DE9B601-2433-470f-BDA8-DC21F15B1AE4}.exe

Filesize
197KB

MD5
466502b7b086105e1c3fa90463a987be

SHA1
b7fd29f11ca73e85376b72e800737e1f8db0beaa

SHA256
f17780fd370607fbe94d5681091f0dee4d3e43182007baab1ea9d355817f458c

SHA512
1d7dcaef13472d3e400edaec5d7bf71d1e3cadbfa55de2cb53e78616ff448b272ccbc5cfbab5fa06285d30e3f5e7f001d6d14ee6dbbfa352da4bb96402c80528

Download Submit
C:\Windows\{97916B8A-BB38-4f21-A9EC-5874AB9620B2}.exe

Filesize
197KB

MD5
2cff4618e5a7d83d345c45dadf3f1dfd

SHA1
02dcbab6469406b1d33c50effc2a07e318346eab

SHA256
85f5e18e5e6aaa7091c72042191ba0dab5ad3c1bcae62270b5dd227084005009

SHA512
7f6e4377bfd0778c7d083328e26a4416e7ffc2324baad24fbb4d2061be8f6b7b48ec89bcf272d6068d744c6ee2d7c3b807f79a9bc0fd512e585b680face055cb

Download Submit
C:\Windows\{98C1CE3E-2423-4cb9-8E54-CDBB0B2A6B01}.exe

Filesize
197KB

MD5
b310b7278f16e3d2b9d37fd47f6656e7

SHA1
028b6d40dc65b0f72c7b3c6391ff8f46fd3b1f2e

SHA256
c0f5dfcde5085f5f3df076528626061616930f289e456f3fa12208903c32e466

SHA512
271c1b0184870bb4dbc743ed8a7e77783e496026ff87462c2faa23258317ed834c714894dc00621d886525eb4d85b392dabdeaea5c23d32eead24250b2ef51d7

Download Submit
C:\Windows\{BD9E8244-AFFC-411e-9CF0-3CA78B8E1425}.exe

Filesize
197KB

MD5
50e9859695e1615bc47cf40c425430dc

SHA1
90fee2b9c1aa75feb6bf144cd685e610f4814706

SHA256
1077b5fb874e336b0cf5cd25cade1da46f4fbf7111dcbe084d9037ed029d52d4

SHA512
23c0d91032a99ce802b3492dcca93f4e1e6dc91754c885c00c21db5ef46105b1312fc647da110d22882790627bdc711c814cbae108694bc88dd1ee399a52b913

Download Submit
C:\Windows\{C0816AEC-8AB1-4855-AAF6-2B6E37B30D11}.exe

Filesize
197KB

MD5
d1b76a9a7442ae365dc86add9702dc55

SHA1
8f6e5c2ca830f35860b0d41b9fa8d913e7343968

SHA256
142b545a82d6f1e56230a4b6289bc511afd165738304852b2b15bafc057a501f

SHA512
f6959976bfc37cf900159623f7fa61a95e48a9802c455e655d3bef5fbc01dbc3717ce14d7e2d645a7deeda1b94ae388c5c68dd9f2d100f1a555f9ffce234f31f

Download Submit
C:\Windows\{C0E3E329-8E9F-487a-857E-74A8546317DF}.exe

Filesize
197KB

MD5
febdc79977e438716def48bd85894069

SHA1
861852b0d0be8300f875bae2497866c9860e47d4

SHA256
720e25821d320ff72a9da3191348441dd86d4a2e0efbe7c8be62c3f809886ec8

SHA512
bd667d3ccf851ca4426541370a20f9ea715286a77a75127a30d5e5c460313e17afe8aeab7278472f63eacd2bf7cc450ddcd648e46a41970fd41b93987e182bc7

Download Submit
C:\Windows\{FBA54D20-6EF6-47fd-8534-703AF586B86C}.exe

Filesize
197KB

MD5
d53eff644c2bc00050a04c308c96cb18

SHA1
e6ae6aae4199f9eeff8703791ab8c33f7b8b3425

SHA256
2b56547e61fed2a28f3a3b9ee78422e0a50a249e1093065db23339aa87e60371

SHA512
c2e9878ff0602acc1b649fec84b6e00f5667dbc6d1eedee23a6f23d831a7585655fe33c1e6d897abcf17b93a9db73e75ce2444a781a1b8877ac2d0ce424c754f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads