efacb24c634c91b214dc4fde1e578971738bdd4049665a6ff1610d1b5e832e13

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe
Size

180KB
MD5

80076a495274e5e9e48358e8ed02831f
SHA1

dffa96fd6a681f15b26ac82f10176231b45ae4c8
SHA256

efacb24c634c91b214dc4fde1e578971738bdd4049665a6ff1610d1b5e832e13
SHA512

8f2d85ce106ca0f8e2901cd1a79ae096bdf1695fa85810def84d71e7d32074d12249609828f8e2ed9312893caff8131fb9f3803fad8616a03ac92246106a1d5a
SSDEEP

3072:jEGh0oIlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG+l5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000700000002333d-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023342-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002345a-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000234bf-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000016864-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001e58d-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000016864-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e58d-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f0000000230d0-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000001e58d-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023226-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001db7a-83.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}\stubpath = "C:\\Windows\\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe"	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1611606-C873-4ac9-81CB-4F67D2ACB903}	{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6903AC7-5C88-4009-A328-58485FCED111}	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6903AC7-5C88-4009-A328-58485FCED111}\stubpath = "C:\\Windows\\{B6903AC7-5C88-4009-A328-58485FCED111}.exe"	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}\stubpath = "C:\\Windows\\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe"	{B6903AC7-5C88-4009-A328-58485FCED111}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1611606-C873-4ac9-81CB-4F67D2ACB903}\stubpath = "C:\\Windows\\{A1611606-C873-4ac9-81CB-4F67D2ACB903}.exe"	{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}\stubpath = "C:\\Windows\\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe"	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D95C6F4-1B27-472f-89EC-E51818DC0762}	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}\stubpath = "C:\\Windows\\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe"	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}\stubpath = "C:\\Windows\\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe"	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}\stubpath = "C:\\Windows\\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe"	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D95C6F4-1B27-472f-89EC-E51818DC0762}\stubpath = "C:\\Windows\\{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe"	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}\stubpath = "C:\\Windows\\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe"	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}	{B6903AC7-5C88-4009-A328-58485FCED111}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}\stubpath = "C:\\Windows\\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe"	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}\stubpath = "C:\\Windows\\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe"	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe

Executes dropped EXE 12 IoCs

pid	Process
4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe
3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe
2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
2656	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe
864	{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe
5092	{A1611606-C873-4ac9-81CB-4F67D2ACB903}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A1611606-C873-4ac9-81CB-4F67D2ACB903}.exe	{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe
File created	C:\Windows\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
File created	C:\Windows\{B6903AC7-5C88-4009-A328-58485FCED111}.exe	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
File created	C:\Windows\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
File created	C:\Windows\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe
File created	C:\Windows\{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
File created	C:\Windows\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	{B6903AC7-5C88-4009-A328-58485FCED111}.exe
File created	C:\Windows\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
File created	C:\Windows\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe
File created	C:\Windows\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
File created	C:\Windows\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
File created	C:\Windows\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
Token: SeIncBasePriorityPrivilege	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
Token: SeIncBasePriorityPrivilege	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe
Token: SeIncBasePriorityPrivilege	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
Token: SeIncBasePriorityPrivilege	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
Token: SeIncBasePriorityPrivilege	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
Token: SeIncBasePriorityPrivilege	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe
Token: SeIncBasePriorityPrivilege	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
Token: SeIncBasePriorityPrivilege	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
Token: SeIncBasePriorityPrivilege	2656	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe
Token: SeManageVolumePrivilege	4476	svchost.exe
Token: SeIncBasePriorityPrivilege	864	{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4476	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe	105
PID 1748 wrote to memory of 4476	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe	105
PID 1748 wrote to memory of 4476	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe	105
PID 1748 wrote to memory of 4284	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe	106
PID 1748 wrote to memory of 4284	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe	106
PID 1748 wrote to memory of 4284	1748	2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe	106
PID 4476 wrote to memory of 2360	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	107
PID 4476 wrote to memory of 2360	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	107
PID 4476 wrote to memory of 2360	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	107
PID 4476 wrote to memory of 1920	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	108
PID 4476 wrote to memory of 1920	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	108
PID 4476 wrote to memory of 1920	4476	{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe	108
PID 2360 wrote to memory of 3532	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	113
PID 2360 wrote to memory of 3532	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	113
PID 2360 wrote to memory of 3532	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	113
PID 2360 wrote to memory of 4232	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	114
PID 2360 wrote to memory of 4232	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	114
PID 2360 wrote to memory of 4232	2360	{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe	114
PID 3532 wrote to memory of 3472	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	116
PID 3532 wrote to memory of 3472	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	116
PID 3532 wrote to memory of 3472	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	116
PID 3532 wrote to memory of 816	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	117
PID 3532 wrote to memory of 816	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	117
PID 3532 wrote to memory of 816	3532	{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe	117
PID 3472 wrote to memory of 1352	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	118
PID 3472 wrote to memory of 1352	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	118
PID 3472 wrote to memory of 1352	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	118
PID 3472 wrote to memory of 4344	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	119
PID 3472 wrote to memory of 4344	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	119
PID 3472 wrote to memory of 4344	3472	{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe	119
PID 1352 wrote to memory of 4824	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	121
PID 1352 wrote to memory of 4824	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	121
PID 1352 wrote to memory of 4824	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	121
PID 1352 wrote to memory of 1820	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	122
PID 1352 wrote to memory of 1820	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	122
PID 1352 wrote to memory of 1820	1352	{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe	122
PID 4824 wrote to memory of 3828	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	123
PID 4824 wrote to memory of 3828	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	123
PID 4824 wrote to memory of 3828	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	123
PID 4824 wrote to memory of 1488	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	124
PID 4824 wrote to memory of 1488	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	124
PID 4824 wrote to memory of 1488	4824	{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe	124
PID 3828 wrote to memory of 2212	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe	125
PID 3828 wrote to memory of 2212	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe	125
PID 3828 wrote to memory of 2212	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe	125
PID 3828 wrote to memory of 3516	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe	126
PID 3828 wrote to memory of 3516	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe	126
PID 3828 wrote to memory of 3516	3828	{B6903AC7-5C88-4009-A328-58485FCED111}.exe	126
PID 2212 wrote to memory of 1408	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	134
PID 2212 wrote to memory of 1408	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	134
PID 2212 wrote to memory of 1408	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	134
PID 2212 wrote to memory of 1504	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	135
PID 2212 wrote to memory of 1504	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	135
PID 2212 wrote to memory of 1504	2212	{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe	135
PID 1408 wrote to memory of 2656	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	136
PID 1408 wrote to memory of 2656	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	136
PID 1408 wrote to memory of 2656	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	136
PID 1408 wrote to memory of 1116	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	137
PID 1408 wrote to memory of 1116	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	137
PID 1408 wrote to memory of 1116	1408	{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe	137
PID 2656 wrote to memory of 864	2656	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe	138
PID 2656 wrote to memory of 864	2656	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe	138
PID 2656 wrote to memory of 864	2656	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe	138
PID 2656 wrote to memory of 3952	2656	{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe	139

C:\Users\Admin\AppData\Local\Temp\2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_80076a495274e5e9e48358e8ed02831f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
  C:\Windows\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
    C:\Windows\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe
      C:\Windows\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Windows\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
        
        C:\Windows\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3472
      - C:\Windows\{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
        
        C:\Windows\{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
        
        C:\Windows\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\{B6903AC7-5C88-4009-A328-58485FCED111}.exe
        
        C:\Windows\{B6903AC7-5C88-4009-A328-58485FCED111}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
        
        C:\Windows\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
        
        C:\Windows\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe
        
        C:\Windows\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe
        
        C:\Windows\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
        
        C:\Windows\{A1611606-C873-4ac9-81CB-4F67D2ACB903}.exe
        
        C:\Windows\{A1611606-C873-4ac9-81CB-4F67D2ACB903}.exe
        13⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{54EC0~1.EXE > nul
        13⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F32FB~1.EXE > nul
        12⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A19B~1.EXE > nul
        11⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9460B~1.EXE > nul
        10⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B6903~1.EXE > nul
        9⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7E21~1.EXE > nul
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D95C~1.EXE > nul
        7⤵
        
        PID:1820
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E88B9~1.EXE > nul
        6⤵
        
        PID:4344
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E11B~1.EXE > nul
        5⤵
        
        PID:816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C6963~1.EXE > nul
      4⤵
      PID:4232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F3CEE~1.EXE > nul
    3⤵
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=3408,i,16599691418790971742,134777455365707676,262144 --variations-seed-version /prefetch:8
1⤵
PID:3424

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0D95C6F4-1B27-472f-89EC-E51818DC0762}.exe

Filesize
180KB

MD5
1357f2aad81fa568643c08efde6e0e28

SHA1
fe4728d6790a967cea197be41caff181441d4f93

SHA256
bec512529c1363388cdce728bdacf8288ab785cb53ec13ebf3fa09a21451f7fa

SHA512
443e9b0b18ae779faf2095bdcc5d4a988dc1cdb26e8b5f6cd2ec0492cd0340ac778dcb2d0408d3a245a5335b061650717dc156ea09d187ed6ad1ee775e12b76e

Download Submit
C:\Windows\{54EC0EE2-D5D9-4840-AC49-21B8C98AAC94}.exe

Filesize
180KB

MD5
08c316ba24cdf7b5f9e2c893a201830c

SHA1
7fbdb42a020e1d42b17346425da0223c06b15d58

SHA256
48562e87c74e522765659eb18bd7981266559749ec422d6b0d67229e4cca51d8

SHA512
0403759b07b67855027dd75ad54c55006cd5450fce08e101095921a4d48ab98cf18cf88190cfa103d56620a0155a8b960f346edb7d3d419e607efe204cd3db36

Download Submit
C:\Windows\{6A19BB58-F7C1-444c-BFD2-8A5CAF4B69CC}.exe

Filesize
180KB

MD5
bd4be91d62e85e0aa7a25752ce477b22

SHA1
8ee9b6cef7ea58f300c2c98e934544e2afb7561a

SHA256
9972e429424b822f0054bd02c9aaa956dbcc1e6229db136dfba6b76a9f1cee3c

SHA512
04b854d82666e581bff6296a4aaf710c9512124c495686301cee1ce340355f543a14dc62260e5c06cf8a8e37ab88321bc894dd742a25b7cf5c87055c6e32a72f

Download Submit
C:\Windows\{9460B3BB-36BC-4c9b-AD47-41E86B26B7D0}.exe

Filesize
180KB

MD5
9eeae3ad30e9a569aa908ec0b09a50e6

SHA1
b2d29438160fe58d6e3c68413b0183177f9e19e0

SHA256
91c8522e96518b2308cde9f880e3062e40f4a4116b4b95eab1456e097d0c58b8

SHA512
ab6ece5b15723d8a4dbe4de5d9b1a2c33a40267a9e6fe9408d6c99b5b3296d960c49e5e2b5305b469315847b062377239fe6f33b17a4e1d4eacfe58bbfc18c20

Download Submit
C:\Windows\{9E11B32F-D93D-4ab3-B857-EAFEEDA8AC08}.exe

Filesize
180KB

MD5
02acdd84862a954c1881e84619038efc

SHA1
3e0a0c497ef0f199265cd88b74a8f4f1de41e7f3

SHA256
d474457ee5ba4421c22eeddec2d515ecc0cbd0d594923523423dc038dd87b473

SHA512
b2cce98c969347690a24cd5e98b681df38c4729548a8ae39931a35ad2cd89fc2b8cc0519190935569ff931edcf9f507ad700a6d75bf943c8d6bbb83db5937d1b

Download Submit
C:\Windows\{A1611606-C873-4ac9-81CB-4F67D2ACB903}.exe

Filesize
180KB

MD5
06350a808aaa6bb598546e62a832539c

SHA1
d19d0bc2a339add5f48bc0f39a7df00b8302862e

SHA256
e97402a504cc4ec0a395b216fda04a66bffebf041a4ba5fd752bd6b4a6c0bd09

SHA512
a1a8b9291b264d2f41e18b22a22541ccdab3fbad3ee0f91c34e59ff9285a7a670428fb6e2f394316f60db216607cd602668e6eb228936b7582e5871eeb57e768

Download Submit
C:\Windows\{B6903AC7-5C88-4009-A328-58485FCED111}.exe

Filesize
180KB

MD5
2d5a029e24beb887ee88eaf7040f2a8f

SHA1
d467a2185e3609c243b90fbb6dee3e32ea24287a

SHA256
4bd90a0e61bc4ccfb729a74a1f70f110fcf0a616b5f67c230d6f8c54da4e4921

SHA512
df598d3700163713d1c647512e319c4c10bcf7edeffe625801545ec3fa722b67c16ed97561414e745d50232417a27fe1e37cf3e5d53db9cd950d3ca9c578634c

Download Submit
C:\Windows\{C696376B-3A36-480f-B161-9BE4BEF7FA3F}.exe

Filesize
180KB

MD5
eed12ad7ed21cd200a62bb46d20b1411

SHA1
26c41de91dd0aa57e2efde2cdf498c3fab75d0db

SHA256
bcad3d95a4d7dc846f1cd0ef85f9f4236d7f39f50810d86d17573aeda59ae73e

SHA512
4b24a06b52bb31ce28dcca6a3dfe7503017156933027b90de68a0458557f21fcc4edc98e6f0c056c140d153105dda2551dbe269272e285a80240c77dc16add51

Download Submit
C:\Windows\{E7E21CE6-7B5F-472f-BFF2-3461599F35C3}.exe

Filesize
180KB

MD5
839545c671b86a2ff451b2b9e02ba058

SHA1
6448f7520152594c0ffa591fd48460f9252aeeb3

SHA256
ed9187851ad4cae533f677c0c7bdb1f39c9daff0eefc3d409e340b69aef8ce4c

SHA512
8391bd68375369a17abde6b9064c64a9433fb841617c762b30875d79ddfd751196264d8da2dc51f9a336bda578f7ce908ecdb790ebb2a5e99f55ac57867b90b1

Download Submit
C:\Windows\{E88B9C3F-E752-43ad-90BA-A4C17007E6BC}.exe

Filesize
180KB

MD5
56b4b9205e34c4670eb3addf3e1f6437

SHA1
2f02688b8e713fec628c1eca796d6dd09d742858

SHA256
ed810590bf275ee7d146cea1cb6d74385729ebcbf7ed4ab4e0e5762ec6fabeb5

SHA512
432c2b0e575921b2668404969b6746013ea86eec09c019a1624280aed0ee0aad6a6c87d9afbe5e0e71a9aca4f22f84df7eb3b5b6bbeeb42af974ebd5d371e9e6

Download Submit
C:\Windows\{F32FB73D-F35A-42c1-A3D6-E92A6AA4286D}.exe

Filesize
180KB

MD5
c9b6fc8dc7c5af5775096f9e313ee6ee

SHA1
d7e5c3660b5911d31a32bb5c00efe7570910887e

SHA256
e6ddb07a7de423e2b02e889e2046a90f96ed33b4ab8e342d07762c807fb3468c

SHA512
c8b2258d5200efe5f4c7131698fee81233c10814ec671681c7a6ec282e09ab94674ac00a45e874a7d938e459392946efe893c9433357ff5d04d182dad4abf5ee

Download Submit
C:\Windows\{F3CEE32F-7EAA-43b6-AE4F-AB3A40D04387}.exe

Filesize
180KB

MD5
a2752f7ae615e590090d293fc58b6f85

SHA1
d9ec2a79b286d199d03f5e6350abe1c5ebe61ae3

SHA256
f87876e9db3104dd97fd1226fbd7cfd13d5f5bd87ae9955f74a1a7f54e71b268

SHA512
03c78761bd405ee7af144b04b257c62b0674c3df1a2a1926f99919ca53fbebad690734e9ad357a6952ffd52a6ae3fa0ba54576e1f7b55b581cc9777f5e0e5a3f

Download Submit
memory/4476-44-0x000001EA44B40000-0x000001EA44B50000-memory.dmp

Filesize
64KB

Download
memory/4476-60-0x000001EA44C40000-0x000001EA44C50000-memory.dmp

Filesize
64KB

Download
memory/4476-76-0x000001EA4CF80000-0x000001EA4CF81000-memory.dmp

Filesize
4KB

Download
memory/4476-78-0x000001EA4CFB0000-0x000001EA4CFB1000-memory.dmp

Filesize
4KB

Download
memory/4476-79-0x000001EA4CFB0000-0x000001EA4CFB1000-memory.dmp

Filesize
4KB

Download
memory/4476-80-0x000001EA4D0C0000-0x000001EA4D0C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads