e1a8ae76a860d0ed762222ed64d6e9f6b3a8d1be52a83b4d448087f6c428c1da

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe
Size

216KB
MD5

af9e0517c70c6cd8a3bbadd478ceb2d0
SHA1

3f34dfcea92cc8b68eab4233cb98aa3855a024d1
SHA256

e1a8ae76a860d0ed762222ed64d6e9f6b3a8d1be52a83b4d448087f6c428c1da
SHA512

b99c9c32a3040b691964978d98dd31c7aa51d5cdf510a1bacc4b5a22b6ae7d195c12b110b39548d1324a17c54244fe3058b15ffadfe5527fc2bca4334684e574
SSDEEP

3072:jEGh0o5l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGLlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023350-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023355-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00040000000167e1-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0013000000023355-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000167e1-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0015000000023355-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00060000000167e1-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0016000000023355-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000230e1-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000230e2-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000230ee-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000230e2-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F872377-138E-4635-9A4C-E4F25BE5B097}	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F872377-138E-4635-9A4C-E4F25BE5B097}\stubpath = "C:\\Windows\\{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe"	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}\stubpath = "C:\\Windows\\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe"	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85119707-EC19-4481-A0D1-A45773258884}\stubpath = "C:\\Windows\\{85119707-EC19-4481-A0D1-A45773258884}.exe"	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}	{85119707-EC19-4481-A0D1-A45773258884}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}\stubpath = "C:\\Windows\\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe"	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDBA8388-16DB-4f68-8835-F30770307F17}	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21710C6A-335D-4157-AEB1-EC211CAFDE44}	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21710C6A-335D-4157-AEB1-EC211CAFDE44}\stubpath = "C:\\Windows\\{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe"	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85119707-EC19-4481-A0D1-A45773258884}	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDBA8388-16DB-4f68-8835-F30770307F17}\stubpath = "C:\\Windows\\{EDBA8388-16DB-4f68-8835-F30770307F17}.exe"	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}\stubpath = "C:\\Windows\\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe"	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}\stubpath = "C:\\Windows\\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe"	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}\stubpath = "C:\\Windows\\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}.exe"	{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}	{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}\stubpath = "C:\\Windows\\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe"	{85119707-EC19-4481-A0D1-A45773258884}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}\stubpath = "C:\\Windows\\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe"	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}\stubpath = "C:\\Windows\\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe"	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe

Executes dropped EXE 12 IoCs

pid	Process
4972	{85119707-EC19-4481-A0D1-A45773258884}.exe
2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
4528	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe
2592	{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe
4540	{D59951A5-B514-499d-BB7B-4BDCD0D22C12}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{85119707-EC19-4481-A0D1-A45773258884}.exe	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe
File created	C:\Windows\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
File created	C:\Windows\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
File created	C:\Windows\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
File created	C:\Windows\{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
File created	C:\Windows\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}.exe	{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe
File created	C:\Windows\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	{85119707-EC19-4481-A0D1-A45773258884}.exe
File created	C:\Windows\{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
File created	C:\Windows\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
File created	C:\Windows\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
File created	C:\Windows\{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
File created	C:\Windows\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe
Token: SeIncBasePriorityPrivilege	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
Token: SeIncBasePriorityPrivilege	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
Token: SeIncBasePriorityPrivilege	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
Token: SeIncBasePriorityPrivilege	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
Token: SeIncBasePriorityPrivilege	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
Token: SeIncBasePriorityPrivilege	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
Token: SeIncBasePriorityPrivilege	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
Token: SeIncBasePriorityPrivilege	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
Token: SeIncBasePriorityPrivilege	4528	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe
Token: SeIncBasePriorityPrivilege	2592	{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4972	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe	108
PID 5064 wrote to memory of 4972	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe	108
PID 5064 wrote to memory of 4972	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe	108
PID 5064 wrote to memory of 1896	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe	109
PID 5064 wrote to memory of 1896	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe	109
PID 5064 wrote to memory of 1896	5064	2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe	109
PID 4972 wrote to memory of 2504	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe	110
PID 4972 wrote to memory of 2504	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe	110
PID 4972 wrote to memory of 2504	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe	110
PID 4972 wrote to memory of 3264	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe	111
PID 4972 wrote to memory of 3264	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe	111
PID 4972 wrote to memory of 3264	4972	{85119707-EC19-4481-A0D1-A45773258884}.exe	111
PID 2504 wrote to memory of 2136	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	114
PID 2504 wrote to memory of 2136	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	114
PID 2504 wrote to memory of 2136	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	114
PID 2504 wrote to memory of 2104	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	115
PID 2504 wrote to memory of 2104	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	115
PID 2504 wrote to memory of 2104	2504	{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe	115
PID 2136 wrote to memory of 1472	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	117
PID 2136 wrote to memory of 1472	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	117
PID 2136 wrote to memory of 1472	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	117
PID 2136 wrote to memory of 1716	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	118
PID 2136 wrote to memory of 1716	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	118
PID 2136 wrote to memory of 1716	2136	{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe	118
PID 1472 wrote to memory of 4424	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	119
PID 1472 wrote to memory of 4424	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	119
PID 1472 wrote to memory of 4424	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	119
PID 1472 wrote to memory of 624	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	120
PID 1472 wrote to memory of 624	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	120
PID 1472 wrote to memory of 624	1472	{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe	120
PID 4424 wrote to memory of 2504	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	122
PID 4424 wrote to memory of 2504	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	122
PID 4424 wrote to memory of 2504	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	122
PID 4424 wrote to memory of 3128	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	123
PID 4424 wrote to memory of 3128	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	123
PID 4424 wrote to memory of 3128	4424	{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe	123
PID 2504 wrote to memory of 3836	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	124
PID 2504 wrote to memory of 3836	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	124
PID 2504 wrote to memory of 3836	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	124
PID 2504 wrote to memory of 2252	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	125
PID 2504 wrote to memory of 2252	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	125
PID 2504 wrote to memory of 2252	2504	{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe	125
PID 3836 wrote to memory of 2484	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	126
PID 3836 wrote to memory of 2484	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	126
PID 3836 wrote to memory of 2484	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	126
PID 3836 wrote to memory of 1388	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	127
PID 3836 wrote to memory of 1388	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	127
PID 3836 wrote to memory of 1388	3836	{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe	127
PID 2484 wrote to memory of 4148	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	135
PID 2484 wrote to memory of 4148	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	135
PID 2484 wrote to memory of 4148	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	135
PID 2484 wrote to memory of 3216	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	136
PID 2484 wrote to memory of 3216	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	136
PID 2484 wrote to memory of 3216	2484	{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe	136
PID 4148 wrote to memory of 4528	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	137
PID 4148 wrote to memory of 4528	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	137
PID 4148 wrote to memory of 4528	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	137
PID 4148 wrote to memory of 4668	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	138
PID 4148 wrote to memory of 4668	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	138
PID 4148 wrote to memory of 4668	4148	{EDBA8388-16DB-4f68-8835-F30770307F17}.exe	138
PID 4528 wrote to memory of 2592	4528	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe	142
PID 4528 wrote to memory of 2592	4528	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe	142
PID 4528 wrote to memory of 2592	4528	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe	142
PID 4528 wrote to memory of 4516	4528	{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe	143

C:\Users\Admin\AppData\Local\Temp\2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_af9e0517c70c6cd8a3bbadd478ceb2d0_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\{85119707-EC19-4481-A0D1-A45773258884}.exe
  C:\Windows\{85119707-EC19-4481-A0D1-A45773258884}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
    C:\Windows\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
      C:\Windows\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Windows\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
        
        C:\Windows\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1472
      - C:\Windows\{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
        
        C:\Windows\{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
        
        C:\Windows\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
        
        C:\Windows\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
        
        C:\Windows\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
        
        C:\Windows\{EDBA8388-16DB-4f68-8835-F30770307F17}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe
        
        C:\Windows\{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe
        
        C:\Windows\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}.exe
        
        C:\Windows\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}.exe
        13⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C1EB~1.EXE > nul
        13⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21710~1.EXE > nul
        12⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EDBA8~1.EXE > nul
        11⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D405~1.EXE > nul
        10⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1E7FB~1.EXE > nul
        9⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8E0E~1.EXE > nul
        8⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F872~1.EXE > nul
        7⤵
        
        PID:3128
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{84B6C~1.EXE > nul
        6⤵
        
        PID:624
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5F15C~1.EXE > nul
        5⤵
        
        PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{23595~1.EXE > nul
      4⤵
      PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{85119~1.EXE > nul
    3⤵
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1392 --field-trial-handle=2844,i,5640589924128028832,7963280732661142908,262144 --variations-seed-version /prefetch:8
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1E7FB6C3-4CCB-4189-9701-CD5FF9D0ED98}.exe

Filesize
216KB

MD5
696bc864122e2244fd5a109b5ae306cf

SHA1
30442ef07c44163b62657696adaa5f2ba7b21067

SHA256
708866ba0b889be37aa6cad8b9b4fe0da5128c1fcab5ea4924867b7e1b54e1ad

SHA512
84ecbf224ea5c7ac0eeaaad81e4687691579ee0bfc999f47a20f8ea875df96b5aed46191c3fd640badc21ac41cd2758707f678c8066cb5c374c2b65ab933a041

Download Submit
C:\Windows\{21710C6A-335D-4157-AEB1-EC211CAFDE44}.exe

Filesize
216KB

MD5
e72846592f506a4fdc0c0a6d9b5dcabb

SHA1
d05ec6df5eff3a50ed35efb68a2c726135ac20bd

SHA256
aec5875fb143fd25f6ddfa40bcce66e030837596340c6c58b89a8e12ea1e8fea

SHA512
bf64bbfcbbc9e9c317062a8f2e348ec623c1e1fc92c5e6596fc3cbc4c0806eec127b1d2f97888c607393932daadab7d88ae38cb49863bae88dc4b5b5aad958df

Download Submit
C:\Windows\{23595D03-2C74-41b7-BEA2-6B17FD65C9B4}.exe

Filesize
216KB

MD5
5509f0a49a652ec8efd03426eb300d8e

SHA1
cb9ed63ddc4307ddf7e95ea22c5d03ec3f162e0a

SHA256
2e54ded42d58d3490170e3872e9898a8ae08418700113ccdf4da7cad3c269b99

SHA512
c6901be43529a1eb804425bf38ad08d6c37b974c3ce6403f93fafcc944f53ff224b536f0f49ce263d0549c7d9f306da2210dbae0c299a2e4f68d5dbd94f6d833

Download Submit
C:\Windows\{3D4059AE-79B5-4650-AFFC-2C1AE9631E44}.exe

Filesize
216KB

MD5
1a91d5cf8757090ea0cc8d94333ee008

SHA1
4e2fdb62aa840a20c1480211d168aa3b022ddddc

SHA256
19666b3952db3f4efbadd05d9b0daf10156d503a71f2292579b328a8c2272097

SHA512
e17a2704d4194a0a82f130662c23e541b0debafb3d086abaa7d32915272170825ef3a116342cdd1e36cf118fc1ec0eaebf3312fc8edf4d42151461c2c38c1b8a

Download Submit
C:\Windows\{5F15C657-55D9-4cb3-BA76-E2A111703BC0}.exe

Filesize
216KB

MD5
6824590e5f0eb6f14947f352a49a05f2

SHA1
00cb45633819b66f5b5743081e6974bdf2857303

SHA256
de4e074dfd19d0b5d518f640c5897d17a316483e866d43347d64275fab28e641

SHA512
d7ecded99ff9074e67dec5413b2d536b9ae59df7bb09226d46e84b6829aa4d3cb7754f40b79b20bd6474c5c58644ff4868da649818a09b2431d243590dc0f8f2

Download Submit
C:\Windows\{6C1EB56A-5C49-41d5-8669-7BDF14AACC0B}.exe

Filesize
216KB

MD5
86e66b3f6f16e7777e2494069b4fdf49

SHA1
41bd83a5cf884c1bd23b028e64b0663654c265de

SHA256
3f0501b5011b880e2a6d023ccb34d445627a3854a7d6d3fc37b57dbb12ab3648

SHA512
a3deee56a702871e5a070c82bd5b14784dc74e0be8a68c54070536cdd33083fb397ec247c15deb9a16da6966aca4957f25760cb749d0766633d70d84b35002b4

Download Submit
C:\Windows\{6F872377-138E-4635-9A4C-E4F25BE5B097}.exe

Filesize
216KB

MD5
3bc5c336deb08e0cff1aa8ee701d3228

SHA1
596bee382e6a6b97862390c1732d59652bab640f

SHA256
1e4e701f435958b59e10532dd8c7fe0dc512cf5fc699493b03d2911b86512fbe

SHA512
c331470ca4afe8722c316e5868d0f852c49f31400ad073a560c10971ce1deb3d23f51eaf6db06b3682306a8f97d626a44cfae87b597886d35d660c9d532edb86

Download Submit
C:\Windows\{84B6C964-C4E1-4c64-8C58-0046EA10F5DA}.exe

Filesize
216KB

MD5
e6f01412bbd729fcf77139d42a8df3a8

SHA1
5630a0e84fa26eee7ef30b717cf85760bbeb0c8f

SHA256
1877e34c47dff729a44e339f1c4b8567c9fb701de59d6be103c9d5e6050de522

SHA512
7465c3f50a7a8b5e10c416286ea224b1c2c318b358b2dcd24958428928b59ef99b885b99563ba7382940db700f911832e6b06823cd9ff3df9675597038bfe1b4

Download Submit
C:\Windows\{85119707-EC19-4481-A0D1-A45773258884}.exe

Filesize
216KB

MD5
094ec8250f38620fa2fff83fcbfba2a9

SHA1
5970164576b7c5ec1b2026936300b392be48eefe

SHA256
d36cf3b71089948ba556cf5ae8a500f3b443a3ba86306936a171d3ebb59b78c9

SHA512
596865532dfe443c58df2b2080ee465e84c80ec1d7f9be43bb0bf00826fa41c1578339db0dca49621849ccf7ffd8a944ddb6494bbd47ef945f3013e1e162d7f8

Download Submit
C:\Windows\{A8E0EEF1-57BD-476f-A5D6-079B3F12F385}.exe

Filesize
216KB

MD5
01b2bb060abfc0c8e107c83add629c26

SHA1
8b06f383988b5fcf209621338858d6d8ca7d345b

SHA256
0938d38130fa0e2b97ee4dca206f7b4b3a51ebe6e9ebedffe75a04a209f30e5a

SHA512
00693b4380ad2d15b95dc58e1eb97dfeeaf859c3787e9edbb8fcd15821940ba20ed388af6562be40434ea14a705e1fef49735f73a323e774f0c328fa2c7fd760

Download Submit
C:\Windows\{D59951A5-B514-499d-BB7B-4BDCD0D22C12}.exe

Filesize
216KB

MD5
a0d58e8035557102f83a09a4647c9cc6

SHA1
410d563fc1a5657b838c885f306ad662e20c5403

SHA256
b3fc3831291add6d86813793dbdbb71053cd937dbace34e0349a6f5170c6db1e

SHA512
8c6edf71d07501d33e55432c51ef477d1385401eededca7c7359b7c6e970ac3c842df28c6f81f55c1e618ee171ac678214e9dd79ba52ec80435ee4eb91b632c0

Download Submit
C:\Windows\{EDBA8388-16DB-4f68-8835-F30770307F17}.exe

Filesize
216KB

MD5
5a47f21c89ca16aaae48365ef3762995

SHA1
4b99c340c6afa32d489389dbd416e4878b874546

SHA256
b5a5e14da2af35f74527748df9f46e6c242ffda92a1b4119011db9c01cd4621d

SHA512
223f2450d35f2d73cc693d1b97cf22a988072045d7aa1344b779699918b04ceda0f80e8cc02fd45d2160f0edec596b575f48838eaf562d6274b48c79315110fe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads