1daa47bb11509b125a3173e44fa06860116369042fcb1cbc557f5921306ae712

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe
Size

180KB
MD5

9b2a1b89bbc7ac2eda545cd8739d71ef
SHA1

0108429243d5748f1306c0409eedcc096e93ed74
SHA256

1daa47bb11509b125a3173e44fa06860116369042fcb1cbc557f5921306ae712
SHA512

3162d92d89c813fe0a73078bb4d262b97456fa154e1c16fe28892c5172ebf816e3cc9f6d01491c689c16779396f4929b3a25e90bb9dfa7d66716c9ecfbb4b51c
SSDEEP

3072:jEGh0oUlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG+l5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023212-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023217-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002321e-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023217-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002321e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000021838-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000021841-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000000037-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000000037-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000072f-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{136C6EB0-AF67-4784-8ABE-775E183F0B50}	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}\stubpath = "C:\\Windows\\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe"	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8592887C-C64B-4471-8A6E-181032DE13D4}\stubpath = "C:\\Windows\\{8592887C-C64B-4471-8A6E-181032DE13D4}.exe"	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7402D816-70A4-4f8a-AD38-9DBFACF15563}\stubpath = "C:\\Windows\\{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe"	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7402D816-70A4-4f8a-AD38-9DBFACF15563}	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}\stubpath = "C:\\Windows\\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe"	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}\stubpath = "C:\\Windows\\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe"	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96F73B34-E93F-481d-8D51-6FEE48076E73}\stubpath = "C:\\Windows\\{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe"	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}\stubpath = "C:\\Windows\\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe"	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}\stubpath = "C:\\Windows\\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe"	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}	{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}\stubpath = "C:\\Windows\\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}.exe"	{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96F73B34-E93F-481d-8D51-6FEE48076E73}	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3683FA-5F61-4076-B896-789D6EC00BA3}	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3683FA-5F61-4076-B896-789D6EC00BA3}\stubpath = "C:\\Windows\\{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe"	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{136C6EB0-AF67-4784-8ABE-775E183F0B50}\stubpath = "C:\\Windows\\{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe"	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}\stubpath = "C:\\Windows\\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe"	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8592887C-C64B-4471-8A6E-181032DE13D4}	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe

Executes dropped EXE 12 IoCs

pid	Process
4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe
2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
8	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe
4916	{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe
3120	{DDF5BC96-9FBC-49c0-B529-672A30BBA876}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe
File created	C:\Windows\{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
File created	C:\Windows\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
File created	C:\Windows\{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
File created	C:\Windows\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
File created	C:\Windows\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}.exe	{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe
File created	C:\Windows\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
File created	C:\Windows\{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
File created	C:\Windows\{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe
File created	C:\Windows\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
File created	C:\Windows\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
File created	C:\Windows\{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
Token: SeIncBasePriorityPrivilege	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
Token: SeIncBasePriorityPrivilege	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
Token: SeIncBasePriorityPrivilege	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
Token: SeIncBasePriorityPrivilege	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
Token: SeIncBasePriorityPrivilege	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
Token: SeIncBasePriorityPrivilege	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe
Token: SeIncBasePriorityPrivilege	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
Token: SeIncBasePriorityPrivilege	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
Token: SeIncBasePriorityPrivilege	8	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe
Token: SeIncBasePriorityPrivilege	4916	{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4000	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe	95
PID 4416 wrote to memory of 4000	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe	95
PID 4416 wrote to memory of 4000	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe	95
PID 4416 wrote to memory of 2236	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe	96
PID 4416 wrote to memory of 2236	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe	96
PID 4416 wrote to memory of 2236	4416	2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe	96
PID 4000 wrote to memory of 1132	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	97
PID 4000 wrote to memory of 1132	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	97
PID 4000 wrote to memory of 1132	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	97
PID 4000 wrote to memory of 3596	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	98
PID 4000 wrote to memory of 3596	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	98
PID 4000 wrote to memory of 3596	4000	{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe	98
PID 1132 wrote to memory of 2352	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	100
PID 1132 wrote to memory of 2352	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	100
PID 1132 wrote to memory of 2352	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	100
PID 1132 wrote to memory of 3940	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	101
PID 1132 wrote to memory of 3940	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	101
PID 1132 wrote to memory of 3940	1132	{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe	101
PID 2352 wrote to memory of 2848	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	102
PID 2352 wrote to memory of 2848	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	102
PID 2352 wrote to memory of 2848	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	102
PID 2352 wrote to memory of 2452	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	103
PID 2352 wrote to memory of 2452	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	103
PID 2352 wrote to memory of 2452	2352	{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe	103
PID 2848 wrote to memory of 2312	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	104
PID 2848 wrote to memory of 2312	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	104
PID 2848 wrote to memory of 2312	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	104
PID 2848 wrote to memory of 1832	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	105
PID 2848 wrote to memory of 1832	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	105
PID 2848 wrote to memory of 1832	2848	{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe	105
PID 2312 wrote to memory of 3668	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	106
PID 2312 wrote to memory of 3668	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	106
PID 2312 wrote to memory of 3668	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	106
PID 2312 wrote to memory of 1312	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	107
PID 2312 wrote to memory of 1312	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	107
PID 2312 wrote to memory of 1312	2312	{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe	107
PID 3668 wrote to memory of 3240	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	108
PID 3668 wrote to memory of 3240	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	108
PID 3668 wrote to memory of 3240	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	108
PID 3668 wrote to memory of 3840	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	109
PID 3668 wrote to memory of 3840	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	109
PID 3668 wrote to memory of 3840	3668	{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe	109
PID 3240 wrote to memory of 2024	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	110
PID 3240 wrote to memory of 2024	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	110
PID 3240 wrote to memory of 2024	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	110
PID 3240 wrote to memory of 3520	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	111
PID 3240 wrote to memory of 3520	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	111
PID 3240 wrote to memory of 3520	3240	{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe	111
PID 2024 wrote to memory of 4368	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	112
PID 2024 wrote to memory of 4368	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	112
PID 2024 wrote to memory of 4368	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	112
PID 2024 wrote to memory of 4872	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	113
PID 2024 wrote to memory of 4872	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	113
PID 2024 wrote to memory of 4872	2024	{8592887C-C64B-4471-8A6E-181032DE13D4}.exe	113
PID 4368 wrote to memory of 8	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	114
PID 4368 wrote to memory of 8	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	114
PID 4368 wrote to memory of 8	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	114
PID 4368 wrote to memory of 3400	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	115
PID 4368 wrote to memory of 3400	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	115
PID 4368 wrote to memory of 3400	4368	{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe	115
PID 8 wrote to memory of 4916	8	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe	116
PID 8 wrote to memory of 4916	8	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe	116
PID 8 wrote to memory of 4916	8	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe	116
PID 8 wrote to memory of 3220	8	{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_9b2a1b89bbc7ac2eda545cd8739d71ef_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
  C:\Windows\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
    C:\Windows\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
      C:\Windows\{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
        
        C:\Windows\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
        
        C:\Windows\{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
        
        C:\Windows\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe
        
        C:\Windows\{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
        
        C:\Windows\{8592887C-C64B-4471-8A6E-181032DE13D4}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
        
        C:\Windows\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe
        
        C:\Windows\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe
        
        C:\Windows\{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
        
        C:\Windows\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}.exe
        
        C:\Windows\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}.exe
        13⤵
        Executes dropped EXE
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7402D~1.EXE > nul
        13⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{77E04~1.EXE > nul
        12⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64FF0~1.EXE > nul
        11⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85928~1.EXE > nul
        10⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B368~1.EXE > nul
        9⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CB807~1.EXE > nul
        8⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96F73~1.EXE > nul
        7⤵
        
        PID:1312
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D52F9~1.EXE > nul
        6⤵
        
        PID:1832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{136C6~1.EXE > nul
        5⤵
        
        PID:2452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E1749~1.EXE > nul
      4⤵
      PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D764D~1.EXE > nul
    3⤵
    PID:3596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{136C6EB0-AF67-4784-8ABE-775E183F0B50}.exe

Filesize
180KB

MD5
7f22cfae44f601e56f75fa740bc04aca

SHA1
4c7e6e9c1474454ba6f50be7b22ec39b183d514d

SHA256
a2965ab066d610ba40f54c32fbd3d387cf82ce036a96e25bc9f4945a28f5dfd6

SHA512
8551397da7537caa9ccbb64286a8738bc36bec99e5e89e05057f664a2e32756ca87439e79e97458391636f2380498650d2a8fdb7aa18ddbe5be09b59b3cb36cd

Download Submit
C:\Windows\{1B3683FA-5F61-4076-B896-789D6EC00BA3}.exe

Filesize
180KB

MD5
8660dd25ca9d16efcd19d556805bc274

SHA1
eb58f57e720ffa63dcfb7ce90455f5e31e8bff49

SHA256
c4250c7c301a204c315199c5ada0989d68e8e59fce703bcf9c1e212ae9f01516

SHA512
85749908401ac05ae940a681f669032628f326fbc60245e51a98f06c8409da62f15f7088ec5fd80b188a6ba48b55350c519a73db016209e30ab982cd7bd22039

Download Submit
C:\Windows\{64FF05FB-1B18-4f3f-A24A-862B3E512BDC}.exe

Filesize
180KB

MD5
9dfeb34a0c968809195307274364af01

SHA1
37acd3af3d21c75b7ff5f2e43f999a86470fc583

SHA256
afba518ca763a6f987addd01d6feee447f40d81f46b4ae62fbb99d4683298473

SHA512
f72d01f477004b7eaf407ad0530c2ae91b35c5dca1519f7d6611e74960b2b8764de91f78ee15247e77a23bda065c10e4c79d9bb15d1162e4ff8ce31efa378fd8

Download Submit
C:\Windows\{7402D816-70A4-4f8a-AD38-9DBFACF15563}.exe

Filesize
180KB

MD5
1257bb52659ff6ba61623e4cbe15c002

SHA1
8f37ed8e0be2ffde742154ce2152f98c8c4c0ef8

SHA256
7ebefccf8563e545e38bd95790399fdc69736be461f9c476ce14faa3645529c4

SHA512
1c707a8617f6848573f4af18b931bc89fae59f1399a8b21a502510e484a972ba009e5250006a32dc457cf27d1b715f92711c933df56e83658cf6efec6f6a7032

Download Submit
C:\Windows\{77E047D3-D435-46cc-9B7F-9D98B6F32E63}.exe

Filesize
180KB

MD5
29cfc5f7460d2c1b2ed1b02f08ef43a8

SHA1
2e37f6546c0adfccb48f55bdc31ff4f4aae24903

SHA256
97e8bb9b2185e3246dc2cd8a210c11e9af1bc02130251d5568e5f45df9b9d51c

SHA512
a859fb38752427faedddc4d81d3508204866723fa1b45776309ad99c08a74f932aade24fd530e63c65baf49ab872494a763e76a39a504e9da13527c0a6c354f5

Download Submit
C:\Windows\{8592887C-C64B-4471-8A6E-181032DE13D4}.exe

Filesize
180KB

MD5
7e094e710e5e48b24fa2d69cc9738258

SHA1
10b1898d2414de12f8a833f9c3f3b0b53ec44d5e

SHA256
1636dc57bcc929a5208591a373a81fbd9eaa922142aff20059fd7f768c046211

SHA512
28890b7d51746d10e8d27ce28d5f9de4bd3ded4dd68bcd8a2a20bf1bed69f1bace9b2311da6b2227271e87c0f602ebb19ed788a28ca5613a0a228f625e37e0e7

Download Submit
C:\Windows\{96F73B34-E93F-481d-8D51-6FEE48076E73}.exe

Filesize
180KB

MD5
5a8765d72d7dd736bb88d17461ccf8b8

SHA1
a2ac2b76ccb14e3ebe7058a35c2256d3f485c31d

SHA256
8dc3a0fab0b93ab9aa1afcde37450905a2abb4486c019ff5251b7ac874bcd3aa

SHA512
7ed226cc86698768b5eddf2d7f8dfcf2b0655bb00d3c8895bbc5be40410af6c7141fb27bd079fd37019468ba9438290cf5f7c0766dc79ccfe5c195bb4312ab8f

Download Submit
C:\Windows\{CB8079CE-ECDE-4277-B4D4-B14F5853C5CC}.exe

Filesize
180KB

MD5
f60a17e70b345e89cbe7fa1ccaf7a169

SHA1
18a2638d92185a4f7f0a0a08faecd29dde4d170a

SHA256
825c2cabe769069b8fe3252704b5aacdf0813eb4c1abb57a7789543b68d3198e

SHA512
53e46019f6d977f7b1e00750ae511e63bd0075dc52ecab3bb96f63d9c6afd465ca81875504b33fa25f6bc16507cabcfc29264167a7de88e2d477d4d8a9683f6d

Download Submit
C:\Windows\{D52F9FD9-24C6-4b5e-B6AF-A4CAE3C8F31F}.exe

Filesize
180KB

MD5
b11e11cd7237a95e76d6958bdfa32e88

SHA1
328e9f70fbc3d80cb6adc9e51423d80aa25430ac

SHA256
05cf7506d6248fcfa51231eb6837cc47b515c0423fe54dab073dbd12cef065db

SHA512
659df8eeeffd58cb8f35e6cf2d11959d2b95af6024ec8c33e6de5d7c74540d81474c6367e43d0afe4f984690fb719cf489891b6d931e96f9312adf4fdea13310

Download Submit
C:\Windows\{D764D45A-7E0F-4e05-899C-7D89989AF2D4}.exe

Filesize
180KB

MD5
bd7d802f45659ebd14677b4cff110d63

SHA1
39d340635a89062213de1b99f3b69846ee6c7ae7

SHA256
32d3f2ad8fb756905e66cf58d986a4a20a0b822d6130d9f995b529a710c8e6f5

SHA512
cbef41421da481b2d8a40ccf9380609d3b059b36da490a20e9eeea1ae0acdd68e59e0060cfd7bd2f15b3e9c889a7a1e177049fc709ed953a1667a6cc5486dfb1

Download Submit
C:\Windows\{DDF5BC96-9FBC-49c0-B529-672A30BBA876}.exe

Filesize
180KB

MD5
5b29c1078a4d5be3856833bec4feb46d

SHA1
df5223c6890b47145772c497478885810ac8d1df

SHA256
58bb6d73105d7674d8f207076c28e6a181fc62be0b715089dcda968a6c3adb46

SHA512
d184270a3b95cb56b01f3ebe226a68a779257934c68da7d2c3d66cbb53ce0745e67095168311f78e19a25f20439a480aaf5bab7ef78637da78cf7362e8c0eec1

Download Submit
C:\Windows\{E1749DAE-518A-4b12-92FD-4B6ECDC32803}.exe

Filesize
180KB

MD5
89ee51d10c5a1b30101f048e879ba038

SHA1
017649903187cc389772220c7b1ed7478ce14a56

SHA256
737115971847e96e79ffe8451a44e41282fb1c907c57e68d5db75e21513694c2

SHA512
6ddb65782c01830740358fb3a294c67d992f679fa61f7e767026c10242875fb76089ee8e541d8ff05c7d09656cff884961975efe9c7953442b4ec446f97d9d5c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads