7fc90c8d85d42019ba02a6f78821d958407a03e3b4f3f4ce603c74d61bca8710

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe
Size

372KB
MD5

0d50bd0f87c9504e51c0778962808fef
SHA1

7679eaebf1b5434d4f4c40ee01de4e0d6b6aa374
SHA256

7fc90c8d85d42019ba02a6f78821d958407a03e3b4f3f4ce603c74d61bca8710
SHA512

6dedc26dac798c06e041d5f7ea1b99a14e608f3549d04f026a6b129ab5a62af0a2998f44213299a166b864046eb15baf193ae4222d468aa424eda7696cf70091
SSDEEP

3072:CEGh0o1lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG/lkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000700000002343d-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002352f-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023537-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002352f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001dadb-17.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db5a-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001dadb-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002353f-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000001db54-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000001db62-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001db54-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023572-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}\stubpath = "C:\\Windows\\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe"	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{940B579E-9637-4cfa-95A7-88F8C1683EE0}\stubpath = "C:\\Windows\\{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe"	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C6812BA-A895-4934-A350-3BD9CF181402}\stubpath = "C:\\Windows\\{4C6812BA-A895-4934-A350-3BD9CF181402}.exe"	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}\stubpath = "C:\\Windows\\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe"	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}\stubpath = "C:\\Windows\\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe"	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF3C0B92-0E17-4c01-8194-32966F260C7F}	{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF3C0B92-0E17-4c01-8194-32966F260C7F}\stubpath = "C:\\Windows\\{BF3C0B92-0E17-4c01-8194-32966F260C7F}.exe"	{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{940B579E-9637-4cfa-95A7-88F8C1683EE0}	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}\stubpath = "C:\\Windows\\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe"	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9E5F774-E51F-4b5e-B277-388867EC2560}	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9E5F774-E51F-4b5e-B277-388867EC2560}\stubpath = "C:\\Windows\\{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe"	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C6812BA-A895-4934-A350-3BD9CF181402}	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}\stubpath = "C:\\Windows\\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe"	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}\stubpath = "C:\\Windows\\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe"	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}\stubpath = "C:\\Windows\\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe"	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9485E62-D493-4853-AA04-92AE2FB3D27B}	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9485E62-D493-4853-AA04-92AE2FB3D27B}\stubpath = "C:\\Windows\\{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe"	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe

Executes dropped EXE 12 IoCs

pid	Process
3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe
4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
1348	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
3412	{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe
880	{BF3C0B92-0E17-4c01-8194-32966F260C7F}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
File created	C:\Windows\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
File created	C:\Windows\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
File created	C:\Windows\{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
File created	C:\Windows\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
File created	C:\Windows\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
File created	C:\Windows\{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe
File created	C:\Windows\{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
File created	C:\Windows\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe
File created	C:\Windows\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
File created	C:\Windows\{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
File created	C:\Windows\{BF3C0B92-0E17-4c01-8194-32966F260C7F}.exe	{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
Token: SeIncBasePriorityPrivilege	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
Token: SeIncBasePriorityPrivilege	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe
Token: SeIncBasePriorityPrivilege	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
Token: SeIncBasePriorityPrivilege	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
Token: SeIncBasePriorityPrivilege	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
Token: SeIncBasePriorityPrivilege	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
Token: SeIncBasePriorityPrivilege	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
Token: SeIncBasePriorityPrivilege	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
Token: SeIncBasePriorityPrivilege	1348	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
Token: SeIncBasePriorityPrivilege	3412	{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3336	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe	98
PID 1948 wrote to memory of 3336	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe	98
PID 1948 wrote to memory of 3336	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe	98
PID 1948 wrote to memory of 4916	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe	99
PID 1948 wrote to memory of 4916	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe	99
PID 1948 wrote to memory of 4916	1948	2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe	99
PID 3336 wrote to memory of 5004	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	100
PID 3336 wrote to memory of 5004	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	100
PID 3336 wrote to memory of 5004	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	100
PID 3336 wrote to memory of 4400	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	101
PID 3336 wrote to memory of 4400	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	101
PID 3336 wrote to memory of 4400	3336	{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe	101
PID 5004 wrote to memory of 3088	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	104
PID 5004 wrote to memory of 3088	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	104
PID 5004 wrote to memory of 3088	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	104
PID 5004 wrote to memory of 1668	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	105
PID 5004 wrote to memory of 1668	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	105
PID 5004 wrote to memory of 1668	5004	{4C6812BA-A895-4934-A350-3BD9CF181402}.exe	105
PID 3088 wrote to memory of 4312	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	106
PID 3088 wrote to memory of 4312	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	106
PID 3088 wrote to memory of 4312	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	106
PID 3088 wrote to memory of 2672	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	107
PID 3088 wrote to memory of 2672	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	107
PID 3088 wrote to memory of 2672	3088	{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe	107
PID 4312 wrote to memory of 1596	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	108
PID 4312 wrote to memory of 1596	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	108
PID 4312 wrote to memory of 1596	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	108
PID 4312 wrote to memory of 680	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	109
PID 4312 wrote to memory of 680	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	109
PID 4312 wrote to memory of 680	4312	{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe	109
PID 1596 wrote to memory of 2792	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	114
PID 1596 wrote to memory of 2792	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	114
PID 1596 wrote to memory of 2792	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	114
PID 1596 wrote to memory of 3172	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	115
PID 1596 wrote to memory of 3172	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	115
PID 1596 wrote to memory of 3172	1596	{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe	115
PID 2792 wrote to memory of 3804	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	116
PID 2792 wrote to memory of 3804	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	116
PID 2792 wrote to memory of 3804	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	116
PID 2792 wrote to memory of 1424	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	117
PID 2792 wrote to memory of 1424	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	117
PID 2792 wrote to memory of 1424	2792	{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe	117
PID 3804 wrote to memory of 1484	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	122
PID 3804 wrote to memory of 1484	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	122
PID 3804 wrote to memory of 1484	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	122
PID 3804 wrote to memory of 2220	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	123
PID 3804 wrote to memory of 2220	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	123
PID 3804 wrote to memory of 2220	3804	{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe	123
PID 1484 wrote to memory of 1764	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	128
PID 1484 wrote to memory of 1764	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	128
PID 1484 wrote to memory of 1764	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	128
PID 1484 wrote to memory of 2232	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	129
PID 1484 wrote to memory of 2232	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	129
PID 1484 wrote to memory of 2232	1484	{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe	129
PID 1764 wrote to memory of 1348	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	130
PID 1764 wrote to memory of 1348	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	130
PID 1764 wrote to memory of 1348	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	130
PID 1764 wrote to memory of 2832	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	131
PID 1764 wrote to memory of 2832	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	131
PID 1764 wrote to memory of 2832	1764	{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe	131
PID 1348 wrote to memory of 3412	1348	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe	132
PID 1348 wrote to memory of 3412	1348	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe	132
PID 1348 wrote to memory of 3412	1348	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe	132
PID 1348 wrote to memory of 4588	1348	{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe	133

C:\Users\Admin\AppData\Local\Temp\2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_0d50bd0f87c9504e51c0778962808fef_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
  C:\Windows\{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
    C:\Windows\{4C6812BA-A895-4934-A350-3BD9CF181402}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe
      C:\Windows\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Windows\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
        
        C:\Windows\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4312
      - C:\Windows\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
        
        C:\Windows\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
        
        C:\Windows\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
        
        C:\Windows\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
        
        C:\Windows\{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
        
        C:\Windows\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
        
        C:\Windows\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe
        
        C:\Windows\{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3412
        
        C:\Windows\{BF3C0B92-0E17-4c01-8194-32966F260C7F}.exe
        
        C:\Windows\{BF3C0B92-0E17-4c01-8194-32966F260C7F}.exe
        13⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9E5F~1.EXE > nul
        13⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9D9E0~1.EXE > nul
        12⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7F20A~1.EXE > nul
        11⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9485~1.EXE > nul
        10⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C0C0C~1.EXE > nul
        9⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B537E~1.EXE > nul
        8⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D9942~1.EXE > nul
        7⤵
        
        PID:3172
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58C1F~1.EXE > nul
        6⤵
        
        PID:680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A497E~1.EXE > nul
        5⤵
        
        PID:2672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{4C681~1.EXE > nul
      4⤵
      PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{940B5~1.EXE > nul
    3⤵
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{4C6812BA-A895-4934-A350-3BD9CF181402}.exe

Filesize
372KB

MD5
024c6a4f66836fdd89a92cce0291470d

SHA1
0ea149e4dad2b3a5b7107114a8727ef7686d9f88

SHA256
ff8c771da26d433df44ef4a6b644a85268ed561625396bf749747e8ba63effa2

SHA512
c776bdcb2ab89d805f1ce7efbb4188486f8b01f0b99d43cc7d014065c88baafeb95bf6333c168d521a91288bd23d5d567fa10593b6619e7aa81c5837f0d9ef1e

Download Submit
C:\Windows\{58C1FE9B-E980-41a4-A34A-6942F5FB6C1E}.exe

Filesize
372KB

MD5
54e6d142202ccdfad6130e8bf9f607c4

SHA1
e170b5c5895412317329bea3de6ed1cad7b1b36f

SHA256
1f242754250d263e243e75de6e11e0e478d37b415dcd4f7e37093e29d85a99a2

SHA512
fbff359deb05e05da43147b6bcd0b494812e7917a3be0a587a6e7685860e2739537748e71a2f5a3a11391c0e47068048e099de44e91165383f9e531a14eaeee1

Download Submit
C:\Windows\{7F20A7B7-8BB7-494b-B9E2-5D1CC43D0041}.exe

Filesize
372KB

MD5
a6dbfcf4df6950d3bb6702b4fa277d3d

SHA1
eab2545c5014152679d5444e3441026e5f1f07dd

SHA256
53e17f0da041b13441b261712e83dc7f921aea16a91490e99a1a2f39d1ffac33

SHA512
791856f1b2f72b77561df46bd6004e71c428261c191889173ebcae6c2d11d745345aa8a820ee893b48c29fb885564a3fc3f38dff18c316992973240fbb19240f

Download Submit
C:\Windows\{940B579E-9637-4cfa-95A7-88F8C1683EE0}.exe

Filesize
372KB

MD5
0787ad6329917cddc65681b3449e6700

SHA1
1815171e0a830240ddcdc61d868781aee0d777c5

SHA256
ca56aea2f39e37ba066c6525b065198d1c67c522aef03ef208e6ccc34b112415

SHA512
508b241bc978333d05d3d18f981026bb77c5c74025770f5aede26774d032a31a88df375eb63bbeb4e1bf7f309eace19804af73a1d262f9e3a512012b1909ad33

Download Submit
C:\Windows\{9D9E019E-A8A0-4341-88BB-701DE4540B7D}.exe

Filesize
372KB

MD5
869f1bdc7b7bdc672f3606a6904a8d54

SHA1
15d9c7527605c29e9e05965c00b51d261560512a

SHA256
4a05cfca66fc53f3c9a78ebd3ffa3814e258bfb0cc1903139e3bc04e950c3e99

SHA512
b97424d21ca251dc9780eb2aba9fb17a25ac1838fe226f4ae7ab4363ba09992bb234338657033d1d05fa166ab882067f8c5dee22cf28ddf56bce677c4f38c00a

Download Submit
C:\Windows\{A497E50D-B4FE-4c5d-8B20-403DB199F52D}.exe

Filesize
372KB

MD5
d63f96e1a685f8a524f67d39b0d7ef94

SHA1
54a514e172773cde75470509df1137f06a98f464

SHA256
4c14da4dd291c039672370afc6d7e2b8b3983eb758640d0b59cd3adad3e7eedb

SHA512
c35718852f5e60be5f96a78d0b00b49d5a6eb8719fc7a10988511e67c94182f5e7eb4a25687f58f7323cbc01f249f953efb96d782bf103815e97b593eeda3e51

Download Submit
C:\Windows\{B537EFF5-1F21-4af7-A4B7-9FC88FE9C18D}.exe

Filesize
372KB

MD5
3d4dd00a72e916028dc3183993f5d84d

SHA1
b36a33d6c340292a164d960290a372f61414e09d

SHA256
a91cccf78664d5bb6b20a40f63f91ae4e0325ffab752fc2f2986320cb00a2e29

SHA512
a3ab624b4af4e01230f59329956ee7c31fa0d6179a10f52acbc1770f9a782bac0ef65d390f3546a68084832e2c10b6bbfbc39d0393903bdc47b5d47f759017b8

Download Submit
C:\Windows\{BF3C0B92-0E17-4c01-8194-32966F260C7F}.exe

Filesize
372KB

MD5
e2833d1b645f74e37f6c77a1c374d5f1

SHA1
21c28597e8b9ce1459e78d02c87b621277f19777

SHA256
97ba624f0b9ddb6db53c189f525193b5b349fab3b5f5104c2032cff75600a5ff

SHA512
03b24d7f31a78d823a92e9042b5311766dd0f729bddbe34cd6f25729c7a47a717afb090afd74a6f010dd874c9a07a4d04e561ebd92ba8cf8d61e60029164faf4

Download Submit
C:\Windows\{C0C0CE2B-33F8-4b09-84B7-3D54DE1A46E3}.exe

Filesize
372KB

MD5
ba8b77f40ed1ebef894029d08ff1caff

SHA1
121509984c27097bfa1e0d14abb3bca8c79edb26

SHA256
8d6373b17a0bd3be1084aeaf6f468a25b7891e4cf562ed85a33cbb33de2e5673

SHA512
9303f47ba3219839208648482e22e97909b22f638f29cbe8a04dd8dd5eb1be1050498a7f2ea1448fb636c873449edbd994106ae42764c1c867d8b94853f0ac95

Download Submit
C:\Windows\{D99426A6-EE41-4573-83CE-A9D66FAB97D4}.exe

Filesize
372KB

MD5
84fd538035f07dcc929216c2bb02f14a

SHA1
40fdfcefcfebd0821723aed37d116f2ffb65ec47

SHA256
5034790f429a5beb86c796fa4d38e095698e3df59f0bcbd6248f9c394a1899fd

SHA512
28c3174fbcc7ad50598fe302d36e764447131883f28f016e4ac9e64ee198541797865df96157b5c71c9f144fa12e4a42b9b8c1a3a4508f9012d8714140a37fd1

Download Submit
C:\Windows\{F9485E62-D493-4853-AA04-92AE2FB3D27B}.exe

Filesize
372KB

MD5
c91a181256338da0bd150a539a86d998

SHA1
ba6a3029d6130973a6b27bafe0b116cb91e13b59

SHA256
cd6d6394e5df147ce1b2f2809d02058fb44e9dc85aeb25d688e297ff88ca8180

SHA512
c89fee5798fa9070ef1658a5d95db32691d26cba6d81c8fc7bc85606ca21b12cee681db50f5d8daa719eaf202cc9b9e62c40b21be0b34507df3167a5c71564c8

Download Submit
C:\Windows\{F9E5F774-E51F-4b5e-B277-388867EC2560}.exe

Filesize
372KB

MD5
50bc2b99060e280f931c75d61eacacb7

SHA1
c7e881fc47cce1b343a93d9f93a39c381a829935

SHA256
f8c4a47a581b09c34bc0bace1b9305da1abf5e66bba9df64e9730fb733a4757e

SHA512
f70cf30bbcb42962395d833d0bff5bf303774ed3ac4a1ddbf9e466a06cd21f649a7280c0716cd1618795a5614e7d20257de53f8d4d07757aac22801df7da8231

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads