48b98791455a8ab063992a86fb34dcc66aae1ae689f60c2ac0079f8d7be6ae38

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe
Size

408KB
MD5

3e12ceb3b4c42a693159562cf68f3470
SHA1

1110cef0f6bafa3c719b487e13b944cfe8d45163
SHA256

48b98791455a8ab063992a86fb34dcc66aae1ae689f60c2ac0079f8d7be6ae38
SHA512

76b202110f5ffd9d419520f878fcda70781624b404afe549416b5dd9dd7cf9761aebef11ffe41f84282283e5feb94003b86f60f7356855a34078d1bf89019ac9
SSDEEP

3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGjldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233e2-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000233f5-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000200000001e52d-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e743-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e52d-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001db0f-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001db43-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000001e41e-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023508-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000001e41e-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001e4cf-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023354-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}\stubpath = "C:\\Windows\\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe"	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}	{B084329E-7597-4ff9-A408-D6689F42AED4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F415C85F-3665-462f-8ADD-80233CDC7E58}	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B084329E-7597-4ff9-A408-D6689F42AED4}	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36E306F7-9534-4095-86CE-16EB5B29353B}	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}\stubpath = "C:\\Windows\\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe"	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36E306F7-9534-4095-86CE-16EB5B29353B}\stubpath = "C:\\Windows\\{36E306F7-9534-4095-86CE-16EB5B29353B}.exe"	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}\stubpath = "C:\\Windows\\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe"	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}\stubpath = "C:\\Windows\\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe"	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}\stubpath = "C:\\Windows\\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}.exe"	{B084329E-7597-4ff9-A408-D6689F42AED4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5174534D-EDC3-4421-BC63-E033B41C722D}	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}\stubpath = "C:\\Windows\\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe"	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}\stubpath = "C:\\Windows\\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe"	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}\stubpath = "C:\\Windows\\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe"	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B084329E-7597-4ff9-A408-D6689F42AED4}\stubpath = "C:\\Windows\\{B084329E-7597-4ff9-A408-D6689F42AED4}.exe"	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5174534D-EDC3-4421-BC63-E033B41C722D}\stubpath = "C:\\Windows\\{5174534D-EDC3-4421-BC63-E033B41C722D}.exe"	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F415C85F-3665-462f-8ADD-80233CDC7E58}\stubpath = "C:\\Windows\\{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe"	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe

Executes dropped EXE 12 IoCs

pid	Process
1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe
2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe
2584	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
1388	{B084329E-7597-4ff9-A408-D6689F42AED4}.exe
3500	{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
File created	C:\Windows\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
File created	C:\Windows\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
File created	C:\Windows\{B084329E-7597-4ff9-A408-D6689F42AED4}.exe	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
File created	C:\Windows\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}.exe	{B084329E-7597-4ff9-A408-D6689F42AED4}.exe
File created	C:\Windows\{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe
File created	C:\Windows\{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe
File created	C:\Windows\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
File created	C:\Windows\{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
File created	C:\Windows\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
File created	C:\Windows\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
File created	C:\Windows\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe
Token: SeIncBasePriorityPrivilege	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
Token: SeIncBasePriorityPrivilege	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
Token: SeIncBasePriorityPrivilege	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
Token: SeIncBasePriorityPrivilege	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
Token: SeIncBasePriorityPrivilege	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
Token: SeIncBasePriorityPrivilege	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
Token: SeIncBasePriorityPrivilege	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
Token: SeIncBasePriorityPrivilege	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe
Token: SeIncBasePriorityPrivilege	2584	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
Token: SeIncBasePriorityPrivilege	1388	{B084329E-7597-4ff9-A408-D6689F42AED4}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1548	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe	96
PID 4868 wrote to memory of 1548	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe	96
PID 4868 wrote to memory of 1548	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe	96
PID 4868 wrote to memory of 2140	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe	97
PID 4868 wrote to memory of 2140	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe	97
PID 4868 wrote to memory of 2140	4868	2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe	97
PID 1548 wrote to memory of 2712	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	100
PID 1548 wrote to memory of 2712	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	100
PID 1548 wrote to memory of 2712	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	100
PID 1548 wrote to memory of 2500	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	101
PID 1548 wrote to memory of 2500	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	101
PID 1548 wrote to memory of 2500	1548	{5174534D-EDC3-4421-BC63-E033B41C722D}.exe	101
PID 2712 wrote to memory of 1432	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	104
PID 2712 wrote to memory of 1432	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	104
PID 2712 wrote to memory of 1432	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	104
PID 2712 wrote to memory of 1480	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	105
PID 2712 wrote to memory of 1480	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	105
PID 2712 wrote to memory of 1480	2712	{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe	105
PID 1432 wrote to memory of 1364	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	106
PID 1432 wrote to memory of 1364	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	106
PID 1432 wrote to memory of 1364	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	106
PID 1432 wrote to memory of 3508	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	107
PID 1432 wrote to memory of 3508	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	107
PID 1432 wrote to memory of 3508	1432	{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe	107
PID 1364 wrote to memory of 2028	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	108
PID 1364 wrote to memory of 2028	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	108
PID 1364 wrote to memory of 2028	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	108
PID 1364 wrote to memory of 4948	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	109
PID 1364 wrote to memory of 4948	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	109
PID 1364 wrote to memory of 4948	1364	{36E306F7-9534-4095-86CE-16EB5B29353B}.exe	109
PID 2028 wrote to memory of 224	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	114
PID 2028 wrote to memory of 224	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	114
PID 2028 wrote to memory of 224	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	114
PID 2028 wrote to memory of 4408	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	115
PID 2028 wrote to memory of 4408	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	115
PID 2028 wrote to memory of 4408	2028	{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe	115
PID 224 wrote to memory of 4728	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	116
PID 224 wrote to memory of 4728	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	116
PID 224 wrote to memory of 4728	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	116
PID 224 wrote to memory of 2876	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	117
PID 224 wrote to memory of 2876	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	117
PID 224 wrote to memory of 2876	224	{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe	117
PID 4728 wrote to memory of 3008	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	120
PID 4728 wrote to memory of 3008	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	120
PID 4728 wrote to memory of 3008	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	120
PID 4728 wrote to memory of 2252	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	121
PID 4728 wrote to memory of 2252	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	121
PID 4728 wrote to memory of 2252	4728	{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe	121
PID 3008 wrote to memory of 1376	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	124
PID 3008 wrote to memory of 1376	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	124
PID 3008 wrote to memory of 1376	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	124
PID 3008 wrote to memory of 3156	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	125
PID 3008 wrote to memory of 3156	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	125
PID 3008 wrote to memory of 3156	3008	{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe	125
PID 1376 wrote to memory of 2584	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	129
PID 1376 wrote to memory of 2584	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	129
PID 1376 wrote to memory of 2584	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	129
PID 1376 wrote to memory of 3260	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	130
PID 1376 wrote to memory of 3260	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	130
PID 1376 wrote to memory of 3260	1376	{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe	130
PID 2584 wrote to memory of 1388	2584	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe	131
PID 2584 wrote to memory of 1388	2584	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe	131
PID 2584 wrote to memory of 1388	2584	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe	131
PID 2584 wrote to memory of 4788	2584	{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe	132

C:\Users\Admin\AppData\Local\Temp\2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_3e12ceb3b4c42a693159562cf68f3470_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\{5174534D-EDC3-4421-BC63-E033B41C722D}.exe
  C:\Windows\{5174534D-EDC3-4421-BC63-E033B41C722D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
    C:\Windows\{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
      C:\Windows\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Windows\{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
        
        C:\Windows\{36E306F7-9534-4095-86CE-16EB5B29353B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
        
        C:\Windows\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
        
        C:\Windows\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
        
        C:\Windows\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
        
        C:\Windows\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe
        
        C:\Windows\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
        
        C:\Windows\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\{B084329E-7597-4ff9-A408-D6689F42AED4}.exe
        
        C:\Windows\{B084329E-7597-4ff9-A408-D6689F42AED4}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
        
        C:\Windows\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}.exe
        
        C:\Windows\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}.exe
        13⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B0843~1.EXE > nul
        13⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4DFA5~1.EXE > nul
        12⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA7C2~1.EXE > nul
        11⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BF6AE~1.EXE > nul
        10⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D519~1.EXE > nul
        9⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D1663~1.EXE > nul
        8⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C4F49~1.EXE > nul
        7⤵
        
        PID:4408
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36E30~1.EXE > nul
        6⤵
        
        PID:4948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{988E6~1.EXE > nul
        5⤵
        
        PID:3508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F415C~1.EXE > nul
      4⤵
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{51745~1.EXE > nul
    3⤵
    PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1267965C-7767-4cc1-ACF4-D5FEC8D7B5E3}.exe

Filesize
408KB

MD5
f4b59ef5c97524af34bb8ed36396304c

SHA1
2d4b4af2f776397f0d6464a7aff14be5960b281f

SHA256
6d4c36d3de2b289661ce38a8f1a4d9a459645af0f5b36a495b3bbca61f136917

SHA512
d3b01a6dace1eb23a9a2ef2275c9e4d5f849f904a1a6857c44b4f5bab4703ffa8b8c538aba49718e1d227e22e1d381ef5e91e5fea0d3852c3673c74a92812fe8

Download Submit
C:\Windows\{1D51984D-2EB8-4b3b-B84E-D4F0D35CC76A}.exe

Filesize
408KB

MD5
e500497e75bef9846f28ee9531a0b5db

SHA1
f18509ced5de1a76d2c318e76e8f56bb504c2c78

SHA256
6e7602189afc044222b5e4f25d6482b5be7d9c69b341897ed04296fb5f7165d2

SHA512
9c88fb47a75e14a5ce8b2338987948aca02c2c351435b82a9795cf67a81f3b0f84491a3cc86674ecd1bef1406a9648574b3bcfefbd80b09e64c742d51a835664

Download Submit
C:\Windows\{36E306F7-9534-4095-86CE-16EB5B29353B}.exe

Filesize
408KB

MD5
bd39583773929770d46ab4deb5c0d3e8

SHA1
008cb07caa3f8cbf85a2fa1c9a716d1930de4878

SHA256
ce89f7d26c8b5040f94b5d3ef92859ee4ac755df89a23b8373cf05f61e87641f

SHA512
21a3d663991399b416325de9da799c1a3037ac3e19f804b3caffa6e684110effe287a59c0728a9f321738f905bb4dca942aee083521352e9e96a55fb321d7525

Download Submit
C:\Windows\{4DFA526C-00E8-48c4-9673-F9ECCAE138B2}.exe

Filesize
408KB

MD5
e514ae9396c032d90f14e5937f6ee36b

SHA1
bec835d7c35ccb0f3180e535edd0fd19911ae4d4

SHA256
6049f0416c074d0dfac64b39ff772b25bd4442602bac66b4084736a00f4577d6

SHA512
49dbefef08566c16202a8062ae93b47ab202b943951b4a1b44e326ef71c7844a703597d625eeccdd88cf0dfdbc16cd49ab1ea0066b3e583a0d22d2bf2d6fcfdd

Download Submit
C:\Windows\{5174534D-EDC3-4421-BC63-E033B41C722D}.exe

Filesize
408KB

MD5
d4d8aecd8a634fa24aba6fb08fb1396a

SHA1
27e9a12a4b1f7a4bbc503de980679ddde171ce57

SHA256
28848a190c593a7d0d80086f6508d2a287d2596541b8a9f8c6910f54b55e590a

SHA512
725a02a975f36df61efa79e6d8436fb4f4046ee8c1e2862deb4c1ae6eddb6bdb27265ba3593844bfad6205fd64e5d2867badd45fb79333bfe0c0dcc3425d26e2

Download Submit
C:\Windows\{988E61EF-7CC3-46ea-B1F6-65970451B1B6}.exe

Filesize
408KB

MD5
ca107df2bad78ca03de9b61964748927

SHA1
1508e529c183cd6b255c87419e6bae101e078322

SHA256
78cc9e9115c6db3ed218cf8ddc4c6a19a1d287ae39823c85007cad03687bce68

SHA512
2d58ce718cde5dcdf2377a3c18cccf348f8d4acdef14f895449f3b8728147acfd795a0a786657c581f73795bc7e808759c176a3973a313b8100574e51b0361da

Download Submit
C:\Windows\{B084329E-7597-4ff9-A408-D6689F42AED4}.exe

Filesize
408KB

MD5
615303d847205fcd5eb920060a214a35

SHA1
fd02f39c7acd613890c088047cc50b4ee690b6cf

SHA256
d333bb0eeb664d6df154ae9f8bc6265ce32d91677f03da4643e30b0cd0810bab

SHA512
80e08e6c121fe2a7b4a481f78afab6f090a3f031b4fd3d4483d900e53ab609db4ca5827b9ef0924b0c3734d13f7ae158a03e196975c76b1f1815e28d1fa740de

Download Submit
C:\Windows\{BF6AEC5D-81AC-4f6c-899F-CC437E8B8C88}.exe

Filesize
408KB

MD5
a2c47b16cfaa647585f021df56b60d91

SHA1
ae854f1b1121a3446d7436eb1b4de5d764673f13

SHA256
02207889d992dc1aba104f2ede14355b34c66f2b7a003ea954dd792eca56512d

SHA512
c068af3fd67c246e44ff1cc29048e2c2882fe3eedc7f7da01b180e2bd9e16e40f2486a918ca80b2abd38fe08400c06cdedbe8bda01ad9f69c378ce944a594cb2

Download Submit
C:\Windows\{C4F49FF3-5D88-4bc4-86D7-B5129AE32D5A}.exe

Filesize
408KB

MD5
122af368a3432612986edfb04f8aae64

SHA1
b9484caac42c87dec8db9e1246cd22775703c9c5

SHA256
2103782414b2694ec884932ba6a758f6a2841a8724857a3d8f887919b7dfc78b

SHA512
1605f63e6d7f091c7df82e6b19187a897c04153475fafc927fe6add7246d718106af4b736ea1ebcd52c4a355eb6951ab274a735e1112c98866be5148c829ba34

Download Submit
C:\Windows\{D1663169-0C26-4aee-917E-11FBFD7F1DB9}.exe

Filesize
408KB

MD5
84c51205f8ec36666145ef41a58e6f93

SHA1
2bafb5f27582c9e2657cdbc49a00c8ac159016b4

SHA256
77849de6358b3d714d57093cc08f4ba503627c80923ca55e91e8606def00e4e9

SHA512
d8c6f33a2eb1734e1751d13f07710fad54c439ef74fd2a225ec98997bdd5b1a4e188d19432c57e509f8d37975af58f48d928a42ca74142e49f691ee21e082faf

Download Submit
C:\Windows\{F415C85F-3665-462f-8ADD-80233CDC7E58}.exe

Filesize
408KB

MD5
dd7b36cb16159dcbb35eed581ad09b2a

SHA1
a1c1f9914b39eeb25e8a60f603109864fe423118

SHA256
761f3f5802c1830e42073a5b20ae63eeb51cc68e2a7f6424bfe23306f317a291

SHA512
b47c2f90721a0eb003182d479bf42c994c0d55c370a1dc3d5a9b69c6cf9bd1ac8c0b8642553cc32d4dbd09b9b616e9ca15ce1804b19a0c7d62958a8b67237afe

Download Submit
C:\Windows\{FA7C2034-0D21-41c1-91E7-E431E2BC4CE7}.exe

Filesize
408KB

MD5
da795b052f04113e0c1a7fea83b9316c

SHA1
e5dc72d5d9c5f5ca5ee725c1e7debe75c4125b49

SHA256
14992d239d309dc3038ec74951774f644ea8f8f5e5907f9a4e3872f0599c077f

SHA512
3ab84719018d76006aef93db16f08355bb58fbf5c64369ef5144afcbd805ad97155a5f946a346b8a82a5a3ae3cb85a1dbe894700be84f15d727e7b383ade03ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads