59c874961a973e2e3938866d754a75ccc433bab965195d625386a0962965a1d1

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe
Size

204KB
MD5

aa9fb36300872c9e0d08768c17d1fc3b
SHA1

3426b622382c50eadca454d5e00349000834613b
SHA256

59c874961a973e2e3938866d754a75ccc433bab965195d625386a0962965a1d1
SHA512

6e9d56aae2e01cdc3d728dfb562290b944f118b8145d83a3b868dd0a60cd929a96a876dff517a0bb1d90c1a732d75b2b2a105d3187966e76a7b1949a6f2a2a61
SSDEEP

1536:1EGh0o/l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o/l1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00110000000231f3-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231ec-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000231fa-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002304c-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d05-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d06-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021d05-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{114390B9-F60D-46c5-9D45-0A15CE9DA905}	{360F78D8-1696-42ef-8823-448887F558BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9288709-645F-485b-BCEA-DA6B20870EDA}	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}\stubpath = "C:\\Windows\\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe"	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}	{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}\stubpath = "C:\\Windows\\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe"	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE1A7C28-C186-4159-990F-BA25A3B175CF}\stubpath = "C:\\Windows\\{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe"	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}\stubpath = "C:\\Windows\\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe"	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{360F78D8-1696-42ef-8823-448887F558BE}\stubpath = "C:\\Windows\\{360F78D8-1696-42ef-8823-448887F558BE}.exe"	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{114390B9-F60D-46c5-9D45-0A15CE9DA905}\stubpath = "C:\\Windows\\{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe"	{360F78D8-1696-42ef-8823-448887F558BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}	{DF860BB3-7102-4ad7-B164-940459742752}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9288709-645F-485b-BCEA-DA6B20870EDA}\stubpath = "C:\\Windows\\{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe"	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{360F78D8-1696-42ef-8823-448887F558BE}	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF860BB3-7102-4ad7-B164-940459742752}	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF860BB3-7102-4ad7-B164-940459742752}\stubpath = "C:\\Windows\\{DF860BB3-7102-4ad7-B164-940459742752}.exe"	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}\stubpath = "C:\\Windows\\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe"	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE1A7C28-C186-4159-990F-BA25A3B175CF}	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}\stubpath = "C:\\Windows\\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe"	{DF860BB3-7102-4ad7-B164-940459742752}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}\stubpath = "C:\\Windows\\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe"	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}\stubpath = "C:\\Windows\\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}.exe"	{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe

Executes dropped EXE 12 IoCs

pid	Process
4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe
4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe
4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe
4024	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
4228	{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe
4548	{92E141C5-271C-4c62-A9E5-2B5B52F56B50}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{360F78D8-1696-42ef-8823-448887F558BE}.exe	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
File created	C:\Windows\{DF860BB3-7102-4ad7-B164-940459742752}.exe	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
File created	C:\Windows\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	{DF860BB3-7102-4ad7-B164-940459742752}.exe
File created	C:\Windows\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
File created	C:\Windows\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}.exe	{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe
File created	C:\Windows\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
File created	C:\Windows\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe
File created	C:\Windows\{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	{360F78D8-1696-42ef-8823-448887F558BE}.exe
File created	C:\Windows\{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
File created	C:\Windows\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
File created	C:\Windows\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
File created	C:\Windows\{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
Token: SeIncBasePriorityPrivilege	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe
Token: SeIncBasePriorityPrivilege	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
Token: SeIncBasePriorityPrivilege	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe
Token: SeIncBasePriorityPrivilege	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
Token: SeIncBasePriorityPrivilege	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
Token: SeIncBasePriorityPrivilege	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
Token: SeIncBasePriorityPrivilege	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
Token: SeIncBasePriorityPrivilege	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe
Token: SeIncBasePriorityPrivilege	4024	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
Token: SeIncBasePriorityPrivilege	4228	{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4412	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe	96
PID 2364 wrote to memory of 4412	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe	96
PID 2364 wrote to memory of 4412	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe	96
PID 2364 wrote to memory of 2044	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe	97
PID 2364 wrote to memory of 2044	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe	97
PID 2364 wrote to memory of 2044	2364	2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe	97
PID 4412 wrote to memory of 1256	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	98
PID 4412 wrote to memory of 1256	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	98
PID 4412 wrote to memory of 1256	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	98
PID 4412 wrote to memory of 1372	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	99
PID 4412 wrote to memory of 1372	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	99
PID 4412 wrote to memory of 1372	4412	{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe	99
PID 1256 wrote to memory of 4820	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe	101
PID 1256 wrote to memory of 4820	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe	101
PID 1256 wrote to memory of 4820	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe	101
PID 1256 wrote to memory of 3924	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe	102
PID 1256 wrote to memory of 3924	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe	102
PID 1256 wrote to memory of 3924	1256	{360F78D8-1696-42ef-8823-448887F558BE}.exe	102
PID 4820 wrote to memory of 4080	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	103
PID 4820 wrote to memory of 4080	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	103
PID 4820 wrote to memory of 4080	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	103
PID 4820 wrote to memory of 3312	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	104
PID 4820 wrote to memory of 3312	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	104
PID 4820 wrote to memory of 3312	4820	{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe	104
PID 4080 wrote to memory of 4876	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe	105
PID 4080 wrote to memory of 4876	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe	105
PID 4080 wrote to memory of 4876	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe	105
PID 4080 wrote to memory of 3756	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe	106
PID 4080 wrote to memory of 3756	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe	106
PID 4080 wrote to memory of 3756	4080	{DF860BB3-7102-4ad7-B164-940459742752}.exe	106
PID 4876 wrote to memory of 2748	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	107
PID 4876 wrote to memory of 2748	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	107
PID 4876 wrote to memory of 2748	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	107
PID 4876 wrote to memory of 4796	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	108
PID 4876 wrote to memory of 4796	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	108
PID 4876 wrote to memory of 4796	4876	{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe	108
PID 2748 wrote to memory of 2712	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	109
PID 2748 wrote to memory of 2712	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	109
PID 2748 wrote to memory of 2712	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	109
PID 2748 wrote to memory of 1888	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	110
PID 2748 wrote to memory of 1888	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	110
PID 2748 wrote to memory of 1888	2748	{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe	110
PID 2712 wrote to memory of 392	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	111
PID 2712 wrote to memory of 392	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	111
PID 2712 wrote to memory of 392	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	111
PID 2712 wrote to memory of 1268	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	112
PID 2712 wrote to memory of 1268	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	112
PID 2712 wrote to memory of 1268	2712	{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe	112
PID 392 wrote to memory of 4600	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	113
PID 392 wrote to memory of 4600	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	113
PID 392 wrote to memory of 4600	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	113
PID 392 wrote to memory of 3548	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	114
PID 392 wrote to memory of 3548	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	114
PID 392 wrote to memory of 3548	392	{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe	114
PID 4600 wrote to memory of 4024	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	115
PID 4600 wrote to memory of 4024	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	115
PID 4600 wrote to memory of 4024	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	115
PID 4600 wrote to memory of 2808	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	116
PID 4600 wrote to memory of 2808	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	116
PID 4600 wrote to memory of 2808	4600	{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe	116
PID 4024 wrote to memory of 4228	4024	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe	117
PID 4024 wrote to memory of 4228	4024	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe	117
PID 4024 wrote to memory of 4228	4024	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe	117
PID 4024 wrote to memory of 1920	4024	{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_aa9fb36300872c9e0d08768c17d1fc3b_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
  C:\Windows\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\{360F78D8-1696-42ef-8823-448887F558BE}.exe
    C:\Windows\{360F78D8-1696-42ef-8823-448887F558BE}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
      C:\Windows\{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\{DF860BB3-7102-4ad7-B164-940459742752}.exe
        
        C:\Windows\{DF860BB3-7102-4ad7-B164-940459742752}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4080
      - C:\Windows\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
        
        C:\Windows\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
        
        C:\Windows\{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
        
        C:\Windows\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
        
        C:\Windows\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe
        
        C:\Windows\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
        
        C:\Windows\{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe
        
        C:\Windows\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4228
        
        C:\Windows\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}.exe
        
        C:\Windows\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}.exe
        13⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A1F5D~1.EXE > nul
        13⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE1A7~1.EXE > nul
        12⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80B50~1.EXE > nul
        11⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8FED3~1.EXE > nul
        10⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5C73C~1.EXE > nul
        9⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A9288~1.EXE > nul
        8⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CC94~1.EXE > nul
        7⤵
        
        PID:4796
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DF860~1.EXE > nul
        6⤵
        
        PID:3756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{11439~1.EXE > nul
        5⤵
        
        PID:3312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{360F7~1.EXE > nul
      4⤵
      PID:3924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{902BE~1.EXE > nul
    3⤵
    PID:1372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{114390B9-F60D-46c5-9D45-0A15CE9DA905}.exe

Filesize
204KB

MD5
27d6038e77f0a33d811bf06ad7f88696

SHA1
15d93784b30b61d2bb65ed818b162b30a15dbac6

SHA256
f5761e94f4d9967fafab6b2c41d3dc310558069d1caa7f96958c936494d35b2d

SHA512
beea406f9f7c421ebc86242037b31a93d870068457670d9100c29554388c985de0183740aa1b2c7f8ab092bfe49a1407efc46634bc1dacdff54ebe5847b6d7fa

Download Submit
C:\Windows\{360F78D8-1696-42ef-8823-448887F558BE}.exe

Filesize
204KB

MD5
bb9e5c250d61a7a5e3dc38dc8f64b4c1

SHA1
7d556a25a06cb8258988205bde01d91eb0f1fe4e

SHA256
8aa3603f51503cc2834606a3e2c2b82165bc3139f6f57cae7a760964a08470ed

SHA512
213dfd43518fff75887eb3b53cbf5e4e2c3354dc790bdc736e39fd746bfd010f9d300cddaa2733c7e61aa2ebfccf527fd8ea715e9851a29a673d9a1fcb5fb136

Download Submit
C:\Windows\{5C73C3BC-889C-49ec-8277-DBE296FCDACB}.exe

Filesize
204KB

MD5
9f06c1e55a57c09edc80745a151302d2

SHA1
92555fe08b165c975b5c8452d1af177093178553

SHA256
737ce84c275d9fa9bc9f6a4ebe94c9dd8e06cb38b1d065ff8e70bbcf1ad9b8c4

SHA512
4f37d76c205e1da6ac476cebdbbf5be0ecd9618333bf0396aecd17b57ae2984c537184bc27fb8bef48188c03a4fd4124ff3c5b803debee6270a475ced0225ef2

Download Submit
C:\Windows\{6CC94C21-CFF2-4b58-9388-4A27E3BC5F4F}.exe

Filesize
204KB

MD5
952009ac4ddc8e6c2ee937b67aff7d20

SHA1
9c76af8e456f062dcfd7f9f95d30023721a9000d

SHA256
2b20081ab7f558cb25510a599ce933294176a5aa01f6c2c12018456200057f50

SHA512
7089f4ebc9c497e518b30a660aa360f734952c869e6d406fcd32099f17326c3bc89e473149ecb17e2dd3795fd15198178b02943a69f86f53ac75e2ed0f44c54e

Download Submit
C:\Windows\{80B505BB-B82C-4b81-9C8E-0EDF7EDB4E7F}.exe

Filesize
204KB

MD5
a591e83c87c6f6e492e210f0cf9f3d4a

SHA1
96f7e4c958c5bb50e6c5bc7fcdc50cb1c3392aa6

SHA256
21465d01357636ab101c51358cabcfb7a8a67ad823af7225b46e13beff52c1f8

SHA512
79bdb877a1e557eaedb1764411971baf2e1b1bcd2a763572b60afd3e97c63a0c0f42c006d92d7c106c95cda5999f614e465fc0dace495159b6bdad44bec2e07b

Download Submit
C:\Windows\{8FED34EE-9B0F-4af4-BE8C-CD89C31BCD19}.exe

Filesize
204KB

MD5
d93847cc1395529290c6229293aebc3b

SHA1
6ececbb0df1eb5f49a88c15cff420ad982eaf13a

SHA256
2e34039cb7ec1d3d52644e9e151097c073dde6852b6025d9ba9fcdade4907dcd

SHA512
5371dfc3996376e95720f11c04e340fc9adfa63d836e5d70dcea557e9b42e7769dabc616f743464793786c3f9902ce147400366dd5af83e2cb6b6cfa3e2954bc

Download Submit
C:\Windows\{902BE5D1-5140-4e59-B90F-6E2D8DDFDE6D}.exe

Filesize
204KB

MD5
9a0179c049d2ad8ffb25b8854dadc8d5

SHA1
2c51f85defe82cefeedcba696e05438daff1c335

SHA256
19b9ebae7b28e40c74a7bea56012c77733ed7196718e44b0d150b4bf0faf4df4

SHA512
d7741f51f5fd45aeff9268339635b65b29e41b57f54b1994391f05d99573ad5c51fb1063aefc042c03b125df7dbc09b876c5062ea3e290d8ce4682f58d12cb2b

Download Submit
C:\Windows\{92E141C5-271C-4c62-A9E5-2B5B52F56B50}.exe

Filesize
204KB

MD5
13283aba4bfa8195d59affd0e349afae

SHA1
1751804a495f361980d66218e7047ae48cf3fc68

SHA256
44cfd0c4eaa83a97557da67b395a655bff27b6b3da9d09de9f1b783ab6f126d9

SHA512
1d75b00e61d8d4d44aab0e6eb291e52bbceda5b320bb0f69bccb3628242474109dffdf630f511ae31196102f9027b9d1141b5c56c7227cccb6deb90a3a93a937

Download Submit
C:\Windows\{A1F5D2F3-62AC-450d-A14C-E9DAADA86AB2}.exe

Filesize
204KB

MD5
e45677602caef6145a707cc665985766

SHA1
78c26ca66363ce36ac3de3bfce8e7bc450648fc3

SHA256
84335555977566732be9d4d5b6db5d403853d86c5e2e0cfb479941a0ba5b237d

SHA512
eef18fd11c3bd08ee3bcbc8061b586dd08b8085740f68b42f88b46c309a9d94721bd21bec8d48b089aedd84609a69dae6646ff3df2b742c08611001f0dc5e591

Download Submit
C:\Windows\{A9288709-645F-485b-BCEA-DA6B20870EDA}.exe

Filesize
204KB

MD5
a3fe8952e2246c110aa541be3f9344fe

SHA1
917c6535d911a34d823c6b5ca5f0b36d91496f4b

SHA256
2f01f0199c4df7469917adfbb0dffe30304aff1afbf92deaf3de7f7d85975d10

SHA512
0d06a7e528d824a5f6a4a6548f48a28dc7565c197c3c54c8b87939ff95d23d8c2833e6eab49af04569ebbb7480b926a8e3b284b6bdad4c6d012ef83c26281be7

Download Submit
C:\Windows\{DF860BB3-7102-4ad7-B164-940459742752}.exe

Filesize
204KB

MD5
8565829dc7bda1da6105f2c35d7156ab

SHA1
66af2351c2116ca7e06da1f80d76c20682448c0e

SHA256
9a4a6f3d5477bf2b26e8a68dcc1cde955ec72584f367dc104205ae0cc64b9f32

SHA512
b245ea5a5c2727dfca145e83a91a63555b07ac18f9b5f230558391ec6bcdf78cf5d6b92fd7eefd05a698c6733043a7211f9a8d4115efea879496870048b0fa8f

Download Submit
C:\Windows\{EE1A7C28-C186-4159-990F-BA25A3B175CF}.exe

Filesize
204KB

MD5
c0bd6b9ca7242f13fb7047d240c0e59c

SHA1
b247d801c2a0ea38a738ee4bee7eadffd8df7bf7

SHA256
4ff05d185ae59c254bb3939d9b53d33f772a8987d4f02f3f4c5bdc76c614937f

SHA512
776a489dff0e6baa5e937e5a1dc06665056b32f8040c461c8ab5afa591f0cd1511c874b2d5b54ef2949565c996ac14fdf8512e7669a6fa8db9aeb8005c6b70ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads