71cece2a13efc8762f2c239258842d63ef37ea8320e8db5e31f38f71e55bd9b9

Analysis

max time kernel
149s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
Size

408KB
MD5

7e107f0862a535d54cd39f599a3b6b65
SHA1

c0c578fb73ed28a69be9260a08c493569a63972a
SHA256

71cece2a13efc8762f2c239258842d63ef37ea8320e8db5e31f38f71e55bd9b9
SHA512

6e9b69139bab418c5f6ef427d12fac08790b2f09bf6dfeeb7c469918a6fa2c620ee85b85860b070b9bce194e2825d2f210df4e03b2cf25dff3f0afb75705410d
SSDEEP

3072:CEGh0oZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGvldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233ed-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233ee-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233f6-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023354-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233f6-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023354-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000233f6-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023354-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000233f6-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023354-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233f2-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023354-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}\stubpath = "C:\\Windows\\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe"	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}\stubpath = "C:\\Windows\\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe"	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}\stubpath = "C:\\Windows\\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe"	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{458B6765-5598-40fc-92F1-9A760BFAE7D0}	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{458B6765-5598-40fc-92F1-9A760BFAE7D0}\stubpath = "C:\\Windows\\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe"	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2F9DB37-7593-4308-897D-475FC629C08F}	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}\stubpath = "C:\\Windows\\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe"	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}\stubpath = "C:\\Windows\\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe"	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8DA02C3-6643-4747-B224-314AD65F6F24}\stubpath = "C:\\Windows\\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe"	{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}\stubpath = "C:\\Windows\\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe"	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}\stubpath = "C:\\Windows\\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe"	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8DA02C3-6643-4747-B224-314AD65F6F24}	{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}\stubpath = "C:\\Windows\\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe"	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2F9DB37-7593-4308-897D-475FC629C08F}\stubpath = "C:\\Windows\\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe"	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}\stubpath = "C:\\Windows\\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe"	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe

Executes dropped EXE 12 IoCs

pid	Process
3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe
4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
3264	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe
1548	{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe
3772	{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
File created	C:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
File created	C:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
File created	C:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe
File created	C:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe	{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe
File created	C:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
File created	C:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
File created	C:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
File created	C:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
File created	C:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
File created	C:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
File created	C:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
Token: SeIncBasePriorityPrivilege	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
Token: SeIncBasePriorityPrivilege	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
Token: SeIncBasePriorityPrivilege	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
Token: SeIncBasePriorityPrivilege	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe
Token: SeIncBasePriorityPrivilege	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
Token: SeIncBasePriorityPrivilege	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
Token: SeIncBasePriorityPrivilege	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
Token: SeIncBasePriorityPrivilege	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
Token: SeIncBasePriorityPrivilege	3264	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe
Token: SeIncBasePriorityPrivilege	1548	{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 3248	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe	91
PID 980 wrote to memory of 3248	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe	91
PID 980 wrote to memory of 3248	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe	91
PID 980 wrote to memory of 1988	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe	92
PID 980 wrote to memory of 1988	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe	92
PID 980 wrote to memory of 1988	980	2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe	92
PID 3248 wrote to memory of 4748	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	93
PID 3248 wrote to memory of 4748	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	93
PID 3248 wrote to memory of 4748	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	93
PID 3248 wrote to memory of 624	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	94
PID 3248 wrote to memory of 624	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	94
PID 3248 wrote to memory of 624	3248	{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe	94
PID 4748 wrote to memory of 4536	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	97
PID 4748 wrote to memory of 4536	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	97
PID 4748 wrote to memory of 4536	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	97
PID 4748 wrote to memory of 2612	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	98
PID 4748 wrote to memory of 2612	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	98
PID 4748 wrote to memory of 2612	4748	{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe	98
PID 4536 wrote to memory of 4316	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	100
PID 4536 wrote to memory of 4316	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	100
PID 4536 wrote to memory of 4316	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	100
PID 4536 wrote to memory of 4520	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	101
PID 4536 wrote to memory of 4520	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	101
PID 4536 wrote to memory of 4520	4536	{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe	101
PID 4316 wrote to memory of 2640	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	102
PID 4316 wrote to memory of 2640	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	102
PID 4316 wrote to memory of 2640	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	102
PID 4316 wrote to memory of 332	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	103
PID 4316 wrote to memory of 332	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	103
PID 4316 wrote to memory of 332	4316	{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe	103
PID 2640 wrote to memory of 4584	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	104
PID 2640 wrote to memory of 4584	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	104
PID 2640 wrote to memory of 4584	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	104
PID 2640 wrote to memory of 2528	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	105
PID 2640 wrote to memory of 2528	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	105
PID 2640 wrote to memory of 2528	2640	{D2F9DB37-7593-4308-897D-475FC629C08F}.exe	105
PID 4584 wrote to memory of 2320	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	106
PID 4584 wrote to memory of 2320	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	106
PID 4584 wrote to memory of 2320	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	106
PID 4584 wrote to memory of 2768	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	107
PID 4584 wrote to memory of 2768	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	107
PID 4584 wrote to memory of 2768	4584	{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe	107
PID 2320 wrote to memory of 4912	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	108
PID 2320 wrote to memory of 4912	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	108
PID 2320 wrote to memory of 4912	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	108
PID 2320 wrote to memory of 4176	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	109
PID 2320 wrote to memory of 4176	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	109
PID 2320 wrote to memory of 4176	2320	{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe	109
PID 4912 wrote to memory of 4744	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	110
PID 4912 wrote to memory of 4744	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	110
PID 4912 wrote to memory of 4744	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	110
PID 4912 wrote to memory of 2412	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	111
PID 4912 wrote to memory of 2412	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	111
PID 4912 wrote to memory of 2412	4912	{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe	111
PID 4744 wrote to memory of 3264	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	112
PID 4744 wrote to memory of 3264	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	112
PID 4744 wrote to memory of 3264	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	112
PID 4744 wrote to memory of 2864	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	113
PID 4744 wrote to memory of 2864	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	113
PID 4744 wrote to memory of 2864	4744	{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe	113
PID 3264 wrote to memory of 1548	3264	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe	114
PID 3264 wrote to memory of 1548	3264	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe	114
PID 3264 wrote to memory of 1548	3264	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe	114
PID 3264 wrote to memory of 1180	3264	{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe	115

C:\Users\Admin\AppData\Local\Temp\2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_7e107f0862a535d54cd39f599a3b6b65_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
  C:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
    C:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
      C:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
        
        C:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4316
      - C:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe
        
        C:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
        
        C:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
        
        C:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
        
        C:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
        
        C:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe
        
        C:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe
        
        C:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
        
        C:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe
        
        C:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe
        13⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB1E6~1.EXE > nul
        13⤵
        
        PID:64
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C5DC1~1.EXE > nul
        12⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBA52~1.EXE > nul
        11⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B4967~1.EXE > nul
        10⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AA756~1.EXE > nul
        9⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3995F~1.EXE > nul
        8⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D2F9D~1.EXE > nul
        7⤵
        
        PID:2528
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13C92~1.EXE > nul
        6⤵
        
        PID:332
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{844A6~1.EXE > nul
        5⤵
        
        PID:4520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6CE0E~1.EXE > nul
      4⤵
      PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{458B6~1.EXE > nul
    3⤵
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{13C92C66-0EEF-4f0a-B4CA-C86B9D2E60BF}.exe

Filesize
408KB

MD5
41be3dfd551e016341d911ce0c8a0288

SHA1
f1eba11500aa1360a562e8ab310da3503c8df3e9

SHA256
c1b425f7359965d2edc7f4f59017e81e0f9834026b01c2da1b2eb03e9b9e046a

SHA512
bcadcdf1b5f449b661ce3f4fd120e0c3d014c7210f866b2ab153bf1a7ed9be3e729d076b2ef06c5b2a0a4f9cea80be2f5fe4e71ce9e40d48873f2cd54e08bc27

Download Submit
C:\Windows\{3995F2D6-FBAC-4a7c-9FDE-D61F55D40636}.exe

Filesize
408KB

MD5
ee92b0392a323ccf8a8519fbde417bab

SHA1
bfa3e78097f4844a8bbfe15a164634d5867c6bae

SHA256
e54047207104513d8886a23d350a1db25ba7d848ae4dd304220c9b453d47d108

SHA512
ef8118f7121a16227b571b4c7449e5b8c7cbed68c912fadef25e653271bfd89688d971de96a29aad52cc36a98be541d4049f806fd2ab3994f24966966ae8c8aa

Download Submit
C:\Windows\{458B6765-5598-40fc-92F1-9A760BFAE7D0}.exe

Filesize
408KB

MD5
7fb2bb628556ff1d9dcc564d38dbf2fb

SHA1
cce8e81fbab2828c47e29d8b345f451f4f2733e4

SHA256
f48f1b60a64e1914872f6e5029055eb3ee79ab49fbced44414dc3fc2f9bbf269

SHA512
c2e066620f24e205e2e0ac847f0627cbcfc200138af4ef5b064c8928b47b1140e5e62770a51e804bc550827d981b849aa071bc074c2280c7e7b9884496030869

Download Submit
C:\Windows\{6CE0E040-33FD-4b02-A57A-CBFC0D4F9592}.exe

Filesize
408KB

MD5
0946a047355a5c297f57f2126a6da988

SHA1
8f4aaa77230216820f37a6f360df8e2957e7015c

SHA256
519486fbad72ab54463f54981af81bc6f653ea00fe6cc24a05f50bb03dc321c2

SHA512
23514ba6d608197fb5407362c96454bc81af26724fccb3f4926a87d720a2e30bc1d9d3b9fb2caae1df6c85d79b216f19d14eec1cab85607ec9540fbcc88f6293

Download Submit
C:\Windows\{844A6CBA-EAA0-4071-B668-3E3E5360FC21}.exe

Filesize
408KB

MD5
204a7a5d187bafbf56ff28fdf7d7f7a5

SHA1
62a478190c355ad006a38a7daf43ad4f4d2d4ba9

SHA256
175d32eae2f211c859aeee654a2e0b69d0cacf9089c59a9c6b5cb7a110af1cb0

SHA512
92c97aa7de3c6a01817ac28aaa34801cdf4f237637f668e8fc556a8987f7ded00723086e18ad59cac7d10fdd4e14d017ab14aae7e45dadd6d13e7ed7486023b9

Download Submit
C:\Windows\{A8DA02C3-6643-4747-B224-314AD65F6F24}.exe

Filesize
408KB

MD5
ff3c8b8ca08c3cd5455bf2f60d0b7403

SHA1
57c57722d22635a49479356292b2b26ec09d8fa9

SHA256
52af0259088541f44ccb02c1390f34124fe4d90f087d5bd51aa60148833cd935

SHA512
c58614a42db047b6a9857394bde199880fbce838491d69515e8dd560e77132fb4251d23d60b28c1ef63caa15278a99b5c7b4778928af2fca1cb6078253faf9c7

Download Submit
C:\Windows\{AA756A37-C8AA-4f08-BBB5-FAFF3299EC96}.exe

Filesize
408KB

MD5
3aa7951b47014fe7be3c240deb71ff17

SHA1
803a7e11c497a5d27cf7ff23c146094e0f8abdb1

SHA256
014583d1e7daf8e2daa8845305f4ab65027b271ac736737e23961b5c8af28d9c

SHA512
dbe00169317c2e38e4add7fdd062dc88fbad004fe63a95551ab48b0fe7ecb3eae75db8fb092533799b723a767724c55eb76053519303398caeee5a8cb19c101b

Download Submit
C:\Windows\{B4967BFF-CCBF-4d22-B51E-9D2F3AAF2769}.exe

Filesize
408KB

MD5
0853097067159c07150ba93d2bb7c5a5

SHA1
1f5889f984bfa59f2d5a6276f7aa89164042a6a5

SHA256
63dc3886c43149d98c5ef3cb51d4d7ace5611a265b844172228ca017a51d825d

SHA512
9c7a16f390a6fb21351f986d0bbae67c5654d718e0cce62c167745e09ba3acae738846f8507f6a7048166928619e76685ed0df9a73b63e1b8d884386b57f91ca

Download Submit
C:\Windows\{C5DC1149-B2D1-45c2-9DA1-A18194C761AF}.exe

Filesize
408KB

MD5
e48019b7f1bac265a86a04e148aa3fef

SHA1
ff89eba4fa0c9bddf57d57759d217606af683c76

SHA256
ed53306232b1d836667197c8881ee903f5d1b64250d1e5b16a3c64b0c39bbb21

SHA512
b1439dc8b821ff575d81f97f3caad4deb8d480af02c72f5ad6cb433350e247be21a9ea8c6e974eb00497bca47b072ef4613ec5de72ff35586a0ab8ef5c01dc78

Download Submit
C:\Windows\{CBA524F0-D48C-4a44-ADAC-7FE147CC023D}.exe

Filesize
408KB

MD5
5b1ad44501cd1f51161de80db1d2a534

SHA1
7154bbe0ac961f429742cd8715e1b4fb070753d4

SHA256
fbb2c1c519d35ade340f415d00bcbeb9b515e840ec96df60606353d736f6ece1

SHA512
23eb4cf1295220f7613ab20cf0560658f9fd08f319266da1cf5d67b6e1fa6c1dfbe896024a8213cbcf219cd01287d72c0c1c12ac7054a2df1a98d47db190a7b8

Download Submit
C:\Windows\{D2F9DB37-7593-4308-897D-475FC629C08F}.exe

Filesize
408KB

MD5
d219c5bd699c95c3b96e7d910b855fab

SHA1
69b2bac1335b595b1cb63d3bcf19693ab3997b8b

SHA256
961701e8bc62d1c532b72bc8903a00de24bc7e8bd85c29238ea48a7a25f64562

SHA512
7bc1bede9d2e74715e4f3c57ab11dc57a754908bbf1caddac9c3d90a981ae3e3312d3f4c72985bb29dacdd4a1aabf2200f3e5b2d96121178317c1d9dd9402bd8

Download Submit
C:\Windows\{DB1E690D-EE19-4cfc-AF6A-AF5A13C5514A}.exe

Filesize
408KB

MD5
b39c4c6e7265c551625339bb708b39ad

SHA1
be1337b72c9b582223e9c3f2d383a0a53088840a

SHA256
30e4f44df91e4d6c64964cd4c49c68b24e261e394514649be021ffb05ef67add

SHA512
c9bd6a7aa0753e0d89d8b43c6a59c7f4eac04b942923782947dd49d110e71d029b188b240f22ea84bc766187fbad411f4e818db90247a1f2024683e37c510f4e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads