0b6dd330e8c6e6cc332e773da4202bae05f330911b12ec2eef46c1821b2bc1d6

Analysis

max time kernel
149s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe
Size

197KB
MD5

6275e1e7326b27a78f0ff08a478ebc8c
SHA1

2c078870212d09d3e2ed8dc9e1c0ff68641e5650
SHA256

0b6dd330e8c6e6cc332e773da4202bae05f330911b12ec2eef46c1821b2bc1d6
SHA512

e831058f36fda0e1b1ddd9588443560fb8aa6fc5cffaaf684df151fd5d4ebe85e2b012c00441766550a962d0b33ecb44a0f8fbdec57b432aeaf43f85af050502
SSDEEP

3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGnlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023219-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001300000002320c-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023220-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001400000002320c-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d41-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d42-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000021d41-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000707-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99EAD643-5239-4737-A0C7-46299D711A42}\stubpath = "C:\\Windows\\{99EAD643-5239-4737-A0C7-46299D711A42}.exe"	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E054EF53-44EB-4847-B802-37BFC722E5CF}	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}\stubpath = "C:\\Windows\\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe"	{99EAD643-5239-4737-A0C7-46299D711A42}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}\stubpath = "C:\\Windows\\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe"	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}\stubpath = "C:\\Windows\\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe"	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}\stubpath = "C:\\Windows\\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe"	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}\stubpath = "C:\\Windows\\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe"	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6252B5A-F83A-45c0-A393-611CDE1C4444}	{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}\stubpath = "C:\\Windows\\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe"	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79B3FE83-5C54-46d8-B132-A84F27A5113F}	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79B3FE83-5C54-46d8-B132-A84F27A5113F}\stubpath = "C:\\Windows\\{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe"	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6252B5A-F83A-45c0-A393-611CDE1C4444}\stubpath = "C:\\Windows\\{A6252B5A-F83A-45c0-A393-611CDE1C4444}.exe"	{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}	{99EAD643-5239-4737-A0C7-46299D711A42}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6798E2B-9731-4664-84C3-35D9FD213523}\stubpath = "C:\\Windows\\{A6798E2B-9731-4664-84C3-35D9FD213523}.exe"	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6798E2B-9731-4664-84C3-35D9FD213523}	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}\stubpath = "C:\\Windows\\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe"	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E054EF53-44EB-4847-B802-37BFC722E5CF}\stubpath = "C:\\Windows\\{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe"	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99EAD643-5239-4737-A0C7-46299D711A42}	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe

Executes dropped EXE 12 IoCs

pid	Process
2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe
2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe
1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
3020	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe
724	{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe
4988	{A6252B5A-F83A-45c0-A393-611CDE1C4444}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{99EAD643-5239-4737-A0C7-46299D711A42}.exe	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe
File created	C:\Windows\{A6252B5A-F83A-45c0-A393-611CDE1C4444}.exe	{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe
File created	C:\Windows\{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
File created	C:\Windows\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
File created	C:\Windows\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
File created	C:\Windows\{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
File created	C:\Windows\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
File created	C:\Windows\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe
File created	C:\Windows\{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
File created	C:\Windows\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	{99EAD643-5239-4737-A0C7-46299D711A42}.exe
File created	C:\Windows\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
File created	C:\Windows\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
Token: SeIncBasePriorityPrivilege	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe
Token: SeIncBasePriorityPrivilege	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe
Token: SeIncBasePriorityPrivilege	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
Token: SeIncBasePriorityPrivilege	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
Token: SeIncBasePriorityPrivilege	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
Token: SeIncBasePriorityPrivilege	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
Token: SeIncBasePriorityPrivilege	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
Token: SeIncBasePriorityPrivilege	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
Token: SeIncBasePriorityPrivilege	3020	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe
Token: SeIncBasePriorityPrivilege	724	{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2480	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe	91
PID 3864 wrote to memory of 2480	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe	91
PID 3864 wrote to memory of 2480	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe	91
PID 3864 wrote to memory of 3016	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe	92
PID 3864 wrote to memory of 3016	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe	92
PID 3864 wrote to memory of 3016	3864	2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe	92
PID 2480 wrote to memory of 1960	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	93
PID 2480 wrote to memory of 1960	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	93
PID 2480 wrote to memory of 1960	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	93
PID 2480 wrote to memory of 3144	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	94
PID 2480 wrote to memory of 3144	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	94
PID 2480 wrote to memory of 3144	2480	{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe	94
PID 1960 wrote to memory of 2632	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	96
PID 1960 wrote to memory of 2632	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	96
PID 1960 wrote to memory of 2632	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	96
PID 1960 wrote to memory of 5096	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	97
PID 1960 wrote to memory of 5096	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	97
PID 1960 wrote to memory of 5096	1960	{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe	97
PID 2632 wrote to memory of 1856	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe	98
PID 2632 wrote to memory of 1856	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe	98
PID 2632 wrote to memory of 1856	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe	98
PID 2632 wrote to memory of 2440	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe	99
PID 2632 wrote to memory of 2440	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe	99
PID 2632 wrote to memory of 2440	2632	{99EAD643-5239-4737-A0C7-46299D711A42}.exe	99
PID 1856 wrote to memory of 4620	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	100
PID 1856 wrote to memory of 4620	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	100
PID 1856 wrote to memory of 4620	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	100
PID 1856 wrote to memory of 1516	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	101
PID 1856 wrote to memory of 1516	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	101
PID 1856 wrote to memory of 1516	1856	{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe	101
PID 4620 wrote to memory of 4896	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	102
PID 4620 wrote to memory of 4896	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	102
PID 4620 wrote to memory of 4896	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	102
PID 4620 wrote to memory of 512	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	103
PID 4620 wrote to memory of 512	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	103
PID 4620 wrote to memory of 512	4620	{A6798E2B-9731-4664-84C3-35D9FD213523}.exe	103
PID 4896 wrote to memory of 4440	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	104
PID 4896 wrote to memory of 4440	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	104
PID 4896 wrote to memory of 4440	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	104
PID 4896 wrote to memory of 4792	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	105
PID 4896 wrote to memory of 4792	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	105
PID 4896 wrote to memory of 4792	4896	{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe	105
PID 4440 wrote to memory of 4496	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	106
PID 4440 wrote to memory of 4496	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	106
PID 4440 wrote to memory of 4496	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	106
PID 4440 wrote to memory of 4188	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	107
PID 4440 wrote to memory of 4188	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	107
PID 4440 wrote to memory of 4188	4440	{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe	107
PID 4496 wrote to memory of 2416	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	108
PID 4496 wrote to memory of 2416	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	108
PID 4496 wrote to memory of 2416	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	108
PID 4496 wrote to memory of 5092	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	109
PID 4496 wrote to memory of 5092	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	109
PID 4496 wrote to memory of 5092	4496	{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe	109
PID 2416 wrote to memory of 3020	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	110
PID 2416 wrote to memory of 3020	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	110
PID 2416 wrote to memory of 3020	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	110
PID 2416 wrote to memory of 1980	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	111
PID 2416 wrote to memory of 1980	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	111
PID 2416 wrote to memory of 1980	2416	{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe	111
PID 3020 wrote to memory of 724	3020	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe	112
PID 3020 wrote to memory of 724	3020	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe	112
PID 3020 wrote to memory of 724	3020	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe	112
PID 3020 wrote to memory of 2396	3020	{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_6275e1e7326b27a78f0ff08a478ebc8c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
  C:\Windows\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe
    C:\Windows\{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\{99EAD643-5239-4737-A0C7-46299D711A42}.exe
      C:\Windows\{99EAD643-5239-4737-A0C7-46299D711A42}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
        
        C:\Windows\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1856
      - C:\Windows\{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
        
        C:\Windows\{A6798E2B-9731-4664-84C3-35D9FD213523}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
        
        C:\Windows\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
        
        C:\Windows\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
        
        C:\Windows\{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
        
        C:\Windows\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe
        
        C:\Windows\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe
        
        C:\Windows\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:724
        
        C:\Windows\{A6252B5A-F83A-45c0-A393-611CDE1C4444}.exe
        
        C:\Windows\{A6252B5A-F83A-45c0-A393-611CDE1C4444}.exe
        13⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8E88~1.EXE > nul
        13⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DC700~1.EXE > nul
        12⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDF0F~1.EXE > nul
        11⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79B3F~1.EXE > nul
        10⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{760D3~1.EXE > nul
        9⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BCCDB~1.EXE > nul
        8⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A6798~1.EXE > nul
        7⤵
        
        PID:512
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7EA7~1.EXE > nul
        6⤵
        
        PID:1516
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{99EAD~1.EXE > nul
        5⤵
        
        PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E054E~1.EXE > nul
      4⤵
      PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DACE5~1.EXE > nul
    3⤵
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{760D3618-3D96-4e5c-BD40-714F94BDAB6F}.exe

Filesize
197KB

MD5
e1802f5c3814c37a0dab97cc4c6b6f49

SHA1
c65a75037db5aa517d326755b1407431fe09fa68

SHA256
ebd2458b50487a3bd4a494fac1ad93792de0463670d485ff6847306b4b1e820d

SHA512
a4890bab2faaa5b0666fee432eb390090f1a166b143e8f0305e7503cc231028113d64516f62434f4ccea9cf3e613e2df5a330752278364099c8fe6d2d42d767d

Download Submit
C:\Windows\{79B3FE83-5C54-46d8-B132-A84F27A5113F}.exe

Filesize
197KB

MD5
416ed2cd3cba74f82b037446380de79e

SHA1
febaa27ca1c7fd34ecde432a8fa2ee3c407cc23a

SHA256
da17de3542e56e01bc45ba49cf96bcb194b7693826b1597cd61b1422d97b0c4f

SHA512
5042322d9e3521fb7271b6bdc0832b6dfb71e7e8f6064369a8d0c6a33dfbf1904c58a700da56f27ad19c019da61bfae46e7af6ae85d4737c787cc41de10d9a77

Download Submit
C:\Windows\{99EAD643-5239-4737-A0C7-46299D711A42}.exe

Filesize
197KB

MD5
7792181429273ded6fb67c37e0ef1788

SHA1
90b709607f22859992a4f9625cc081b333e7990f

SHA256
86556079f2116f624b2753662fc1f7a7b4390b175f4263e5ceb61a239c73fa31

SHA512
5567e7d77a7e21b5d3bc62bc99920fa102d4cb4984bb92a9b466009be043b52149bfb20e45f96f07a37dc76948f3bb89110edf165e64c8131670dc3269a4384f

Download Submit
C:\Windows\{A6252B5A-F83A-45c0-A393-611CDE1C4444}.exe

Filesize
197KB

MD5
1a3a0c0b6c9378c71c8ed78a4d82eca0

SHA1
cf8cc235c9c65d6d6550f403a558a2eb0469ca57

SHA256
94f16f15b3964bb0340f3e8cf2853bbd788dccd45e1eeb3fe945dafe5e208ef8

SHA512
94c04b87d80d43a0180a780406777db6cfe3fd6117d5f78579968cd6c1b9967a05898a85aaa540b955708d070fc826900de79a489117b3ecd5fa4135e7fdb6f4

Download Submit
C:\Windows\{A6798E2B-9731-4664-84C3-35D9FD213523}.exe

Filesize
197KB

MD5
3958df24b3e3d87aa5824685a2b14e09

SHA1
3c60b27b60caff8b534672c012374d68255a9d44

SHA256
bf169ec40f4f7549d7a5e5af761a43b6dee25fdfc6f295be67e2e71ae9b6e4ac

SHA512
f88be89cc62e47519cd34504afaae5df471ef0b4eff7a1b55500aa7a40f3f1072a6113cf68c036e9d2e92aaa4a5706f4537669985dbea116620f0daf1db7730a

Download Submit
C:\Windows\{B8E88F95-D8D2-49c0-88A4-34CBA463ED7C}.exe

Filesize
197KB

MD5
c12026b7218c9ec83c1369825587badc

SHA1
12af1118c8d4478e97d680849ced1f4ad05291c0

SHA256
7d2c619bc95480855526fd77b5e342c53e282e3d144445bc4a0284dd3e00f926

SHA512
71eb0838b39f2c01f5e1556964f9722585115e70f32f026995412d1d391225ab561d3a30e80a69aedbf32154c60ba92336ef3738ec5d162602f99114b7d49bce

Download Submit
C:\Windows\{BCCDB5FE-B85A-4c14-BBEF-F5C725DCAFCF}.exe

Filesize
197KB

MD5
6b1ca1eb14581fd01efdc146c4f14f1f

SHA1
e8b8832f181b59475b84c9a36340007dd3bb8f4a

SHA256
ab7a438ace41f2e71ddc8ca5ff4c32487ba15c43cc5c4cb8dcb73db90c2b0b7e

SHA512
906de9951935df6d419fe81c521adf16f60d15b96bdc56d9c79edbe5e5992577242accf1943f3713903b165bb5b4d56eab95f570a5301f98e85b82b8320b8e60

Download Submit
C:\Windows\{BDF0FD16-0610-4bd6-A8E0-8ECFF05F8DF7}.exe

Filesize
197KB

MD5
779cec8b706bf1bfc67c6836eca93cd1

SHA1
80f506c2065612c74b98e8108f0abc6d17d67349

SHA256
9415c9dfc8345d0f0dbdd68f1938cf818b9d2a98b3c689932ad54958357e5ed2

SHA512
5450fb3700035437c8fcb9bf10207818d195b5bec0edf74447c77c94a979b71380d64e6fd6a29ed7b83878ab6d9153c9377a0230d16f538eb0b4468920323a20

Download Submit
C:\Windows\{D7EA78E9-DE6D-4e2a-BFEB-1283E68F39E0}.exe

Filesize
197KB

MD5
e499e68ca62e8a6cf4bf4f5f1a5b8993

SHA1
13e943d2eaf1897040171697b4cfe4e30c1f7386

SHA256
6f2dbb3feaabe54fc9caeceeeafa7b7c01fb7c4b8af1b0a67c387235f5f9d8c7

SHA512
64a0572aea137edadd68b10ced96a0f4339aec9089f7fb41afe47d8af493135cfc10caa2fcaf125303d32be5976dc5fc7b9799c03afad8e33c82d4d35a555220

Download Submit
C:\Windows\{DACE5578-AB3D-49ac-B5D4-115C6AB43D63}.exe

Filesize
197KB

MD5
5e3b65d3d831bb7b8eab62b9b7852769

SHA1
5e990d2feadc25c26df0fae57ee96bc49c806571

SHA256
6a33eb473ecfbca56cf6dedec256e8ec6d6b27d504aaa2a4f714be7ed195e841

SHA512
71ad148e1227836cf1c4c67673c86edaf8a56b76872757108e2b92c487cebbf65d6f896bffcdfbf7bb3807ab0b4bf9844be4c4716d4c7e9d1f421bf53b02662d

Download Submit
C:\Windows\{DC700BC8-4C7F-4e74-A1C2-6C52AF3C27EA}.exe

Filesize
197KB

MD5
28da4580ed8fc60c67332a1eb6959558

SHA1
5a0384a0e2439203739c17abb758805d9a0b531f

SHA256
f9e84c54d8262c4dd3fc20538489adb7be3b3fa90500d60ad4209b9b47bc9128

SHA512
14d95318680bb5300ff7f5e218cc16bdcbb865733d086510ed7f59f4285eb38484fdc9041b79319f0f5578a382f1fedd7d59d65f7c81efa7b927fb575f626caa

Download Submit
C:\Windows\{E054EF53-44EB-4847-B802-37BFC722E5CF}.exe

Filesize
197KB

MD5
4df65f939c809ee14160597d6c8b5251

SHA1
b84efbfaedabcf75827381adb2571f94e94d3fad

SHA256
41d4ffb350d5f48c7ff1545ffd6bc68ce62b8f07c1f9895bdfb5e1ee4fbd6728

SHA512
9b51260f928b01c7359ad80234cba3c9972ffb7118671cdee1de0d231c9af25fef4cc64e8b22672e045b3b7d94c93369c7b77135c2d4f969a4ff7e564770f52d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads