dc5f1066e1dce32eac36ca8ee45db3f9651438ea4ef8dfbff5edf1e178302d35

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe
Size

204KB
MD5

bc3c4626fa812ef45e3e5e791c555dfe
SHA1

809e269db5e0fb317b36c8a65773a7da70e54168
SHA256

dc5f1066e1dce32eac36ca8ee45db3f9651438ea4ef8dfbff5edf1e178302d35
SHA512

c9edb15e8ce69bad467568e95a3dfd9469a1120eea2e7a206d9cdf33552ba3fc5628d6e16b241b0618ea8e941ca7a7d6c8e2d6a9fc4d3a9b4d023e86170eef04
SSDEEP

1536:1EGh0oGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oGl1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x001e00000001629e-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002296f-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233b2-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002296f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000233b2-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002296f-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000233b2-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000022977-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000233b2-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000022977-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000233b2-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233be-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}\stubpath = "C:\\Windows\\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe"	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99DED99C-16B6-422c-B71F-B007BAC3DE44}\stubpath = "C:\\Windows\\{99DED99C-16B6-422c-B71F-B007BAC3DE44}.exe"	{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}\stubpath = "C:\\Windows\\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe"	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{038239E5-38D0-4805-84A5-6B165152675E}	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33704AB7-48ED-4514-9158-D9C79E263FD7}\stubpath = "C:\\Windows\\{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe"	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}	{8D884331-39FC-44b2-B560-2B19A8522069}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}	{038239E5-38D0-4805-84A5-6B165152675E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33704AB7-48ED-4514-9158-D9C79E263FD7}	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}\stubpath = "C:\\Windows\\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe"	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99DED99C-16B6-422c-B71F-B007BAC3DE44}	{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D884331-39FC-44b2-B560-2B19A8522069}\stubpath = "C:\\Windows\\{8D884331-39FC-44b2-B560-2B19A8522069}.exe"	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}\stubpath = "C:\\Windows\\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe"	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{038239E5-38D0-4805-84A5-6B165152675E}\stubpath = "C:\\Windows\\{038239E5-38D0-4805-84A5-6B165152675E}.exe"	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}\stubpath = "C:\\Windows\\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe"	{038239E5-38D0-4805-84A5-6B165152675E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}\stubpath = "C:\\Windows\\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe"	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}\stubpath = "C:\\Windows\\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe"	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D884331-39FC-44b2-B560-2B19A8522069}	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}\stubpath = "C:\\Windows\\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe"	{8D884331-39FC-44b2-B560-2B19A8522069}.exe

Executes dropped EXE 12 IoCs

pid	Process
3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe
4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe
4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
5076	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
4624	{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe
2332	{99DED99C-16B6-422c-B71F-B007BAC3DE44}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
File created	C:\Windows\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
File created	C:\Windows\{038239E5-38D0-4805-84A5-6B165152675E}.exe	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
File created	C:\Windows\{8D884331-39FC-44b2-B560-2B19A8522069}.exe	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
File created	C:\Windows\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	{8D884331-39FC-44b2-B560-2B19A8522069}.exe
File created	C:\Windows\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
File created	C:\Windows\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
File created	C:\Windows\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	{038239E5-38D0-4805-84A5-6B165152675E}.exe
File created	C:\Windows\{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
File created	C:\Windows\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
File created	C:\Windows\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe
File created	C:\Windows\{99DED99C-16B6-422c-B71F-B007BAC3DE44}.exe	{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
Token: SeIncBasePriorityPrivilege	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe
Token: SeIncBasePriorityPrivilege	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
Token: SeIncBasePriorityPrivilege	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
Token: SeIncBasePriorityPrivilege	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
Token: SeIncBasePriorityPrivilege	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe
Token: SeIncBasePriorityPrivilege	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
Token: SeIncBasePriorityPrivilege	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
Token: SeIncBasePriorityPrivilege	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
Token: SeIncBasePriorityPrivilege	5076	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
Token: SeIncBasePriorityPrivilege	4624	{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3468	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe	87
PID 2364 wrote to memory of 3468	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe	87
PID 2364 wrote to memory of 3468	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe	87
PID 2364 wrote to memory of 3232	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe	88
PID 2364 wrote to memory of 3232	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe	88
PID 2364 wrote to memory of 3232	2364	2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe	88
PID 3468 wrote to memory of 2188	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	89
PID 3468 wrote to memory of 2188	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	89
PID 3468 wrote to memory of 2188	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	89
PID 3468 wrote to memory of 2728	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	90
PID 3468 wrote to memory of 2728	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	90
PID 3468 wrote to memory of 2728	3468	{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe	90
PID 2188 wrote to memory of 4640	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe	94
PID 2188 wrote to memory of 4640	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe	94
PID 2188 wrote to memory of 4640	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe	94
PID 2188 wrote to memory of 4652	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe	95
PID 2188 wrote to memory of 4652	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe	95
PID 2188 wrote to memory of 4652	2188	{8D884331-39FC-44b2-B560-2B19A8522069}.exe	95
PID 4640 wrote to memory of 5064	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	96
PID 4640 wrote to memory of 5064	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	96
PID 4640 wrote to memory of 5064	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	96
PID 4640 wrote to memory of 5084	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	97
PID 4640 wrote to memory of 5084	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	97
PID 4640 wrote to memory of 5084	4640	{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe	97
PID 5064 wrote to memory of 1464	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	98
PID 5064 wrote to memory of 1464	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	98
PID 5064 wrote to memory of 1464	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	98
PID 5064 wrote to memory of 4124	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	99
PID 5064 wrote to memory of 4124	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	99
PID 5064 wrote to memory of 4124	5064	{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe	99
PID 1464 wrote to memory of 1824	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	100
PID 1464 wrote to memory of 1824	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	100
PID 1464 wrote to memory of 1824	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	100
PID 1464 wrote to memory of 868	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	101
PID 1464 wrote to memory of 868	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	101
PID 1464 wrote to memory of 868	1464	{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe	101
PID 1824 wrote to memory of 4212	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe	102
PID 1824 wrote to memory of 4212	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe	102
PID 1824 wrote to memory of 4212	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe	102
PID 1824 wrote to memory of 4316	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe	103
PID 1824 wrote to memory of 4316	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe	103
PID 1824 wrote to memory of 4316	1824	{038239E5-38D0-4805-84A5-6B165152675E}.exe	103
PID 4212 wrote to memory of 3792	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	105
PID 4212 wrote to memory of 3792	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	105
PID 4212 wrote to memory of 3792	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	105
PID 4212 wrote to memory of 2872	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	106
PID 4212 wrote to memory of 2872	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	106
PID 4212 wrote to memory of 2872	4212	{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe	106
PID 3792 wrote to memory of 4612	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	107
PID 3792 wrote to memory of 4612	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	107
PID 3792 wrote to memory of 4612	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	107
PID 3792 wrote to memory of 4556	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	108
PID 3792 wrote to memory of 4556	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	108
PID 3792 wrote to memory of 4556	3792	{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe	108
PID 4612 wrote to memory of 5076	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	109
PID 4612 wrote to memory of 5076	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	109
PID 4612 wrote to memory of 5076	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	109
PID 4612 wrote to memory of 4228	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	110
PID 4612 wrote to memory of 4228	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	110
PID 4612 wrote to memory of 4228	4612	{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe	110
PID 5076 wrote to memory of 4624	5076	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe	111
PID 5076 wrote to memory of 4624	5076	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe	111
PID 5076 wrote to memory of 4624	5076	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe	111
PID 5076 wrote to memory of 1044	5076	{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_bc3c4626fa812ef45e3e5e791c555dfe_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
  C:\Windows\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\{8D884331-39FC-44b2-B560-2B19A8522069}.exe
    C:\Windows\{8D884331-39FC-44b2-B560-2B19A8522069}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
      C:\Windows\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
        
        C:\Windows\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Windows\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
        
        C:\Windows\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\{038239E5-38D0-4805-84A5-6B165152675E}.exe
        
        C:\Windows\{038239E5-38D0-4805-84A5-6B165152675E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
        
        C:\Windows\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
        
        C:\Windows\{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
        
        C:\Windows\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
        
        C:\Windows\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe
        
        C:\Windows\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
        
        C:\Windows\{99DED99C-16B6-422c-B71F-B007BAC3DE44}.exe
        
        C:\Windows\{99DED99C-16B6-422c-B71F-B007BAC3DE44}.exe
        13⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{230CA~1.EXE > nul
        13⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9C33~1.EXE > nul
        12⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18A5F~1.EXE > nul
        11⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{33704~1.EXE > nul
        10⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71E8A~1.EXE > nul
        9⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{03823~1.EXE > nul
        8⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00B5F~1.EXE > nul
        7⤵
        
        PID:868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD8FF~1.EXE > nul
        6⤵
        
        PID:4124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A1EF7~1.EXE > nul
        5⤵
        
        PID:5084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8D884~1.EXE > nul
      4⤵
      PID:4652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9ABEA~1.EXE > nul
    3⤵
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00B5F453-3F38-4aac-ACEE-02F494FBF43E}.exe

Filesize
204KB

MD5
66ff0c2abcb17cad8ad2dbc09cf9f818

SHA1
81fbd1a4f64358a4cecaef4a7ed0820efd962e96

SHA256
ab533c9ff74ca8650dc54aaf68edcdd58925b98629551b80e9fd97e09e203350

SHA512
c6929e3b68c9664abbb0daa8a60823a1a32b86ee6f42a50e4aaa4c225dd061ce193bfb78208e3f2a33b1440eda4b9f9840de2c5007140933824878aee48f06d6

Download Submit
C:\Windows\{038239E5-38D0-4805-84A5-6B165152675E}.exe

Filesize
204KB

MD5
35bb92f163aa69963b58cb77986b01e4

SHA1
cc2fac548fabaf53e2df8f3cafd9f5a1198b3270

SHA256
2010b64a6942b3167b912e3e588118ab970697b96b726d425e1e04a0ce982a98

SHA512
5bc555dedf96dc1a1d3eedeb91d1d7b66d3669db6d5243a9b76d663b277ba80defb4a5693949536bf54b81f70943fa28ff99cc30780ca06b836c5dd3087e1d41

Download Submit
C:\Windows\{18A5F8EF-210E-4857-8E27-3EC772D9D38A}.exe

Filesize
204KB

MD5
a4fe1c6c8deed94565fccbe09784efd5

SHA1
13bd813734608d4ed09fecea2a27b5375b736035

SHA256
8ca5dba9e2360999f83a720f71c622a66b59e86b2fb65fe2061689eec6559ad7

SHA512
8b390d39103ed314b8ed6745a2965467a2a219676a40e6e00fa8cce680d7e4ac43d395fa1ef7a4bfc7037efb6321bbfc366612ab39a077295283adbe1f1a36b6

Download Submit
C:\Windows\{230CA7B3-0E1B-4ef3-9124-CB4A60D5A7BE}.exe

Filesize
204KB

MD5
367fafdc372f191b7e83d8a77bb41fb0

SHA1
51b9a708ddf3caa8b7dfefc8133927d533e63802

SHA256
5046f654f513143b64c9476cfbe712f4c4d38883198b203a09ccd96f4bb845e8

SHA512
d89cacc6196316e1eac761189ffec2146d0c891f1e191e130f94719fc9b25b1fe78cecedcdcd5fccdf7a15d3935ff639af1e45b6a0d3652f9ec8340c029e58fb

Download Submit
C:\Windows\{33704AB7-48ED-4514-9158-D9C79E263FD7}.exe

Filesize
204KB

MD5
acc9b405e84c5ea8e0dcc54690b2d725

SHA1
9932361b4273e085f927130b3092d461cf78143f

SHA256
932c874c8378388276792b6f6b998164ef7d4fe214ab28068740c5d7d2cd67b6

SHA512
02b3514894f4bda0cb819a6f0f17153b45f281f07219eb7b9039a173d6083f438203ecae704deb8dfcb1e90d5462fe1da2989c73f02fe5ed9bb4b13476703e7f

Download Submit
C:\Windows\{71E8AA2E-EF1E-4183-A9B6-32AF0ED2C8B5}.exe

Filesize
204KB

MD5
627a842bd2438ea66ed03124413db2a6

SHA1
d1f14f6d796595d2c7d3fefd97a60cafa7bd253e

SHA256
42744a5506c39b3a96bd63fd747d459f775de13fc96a2b5d805c153528057e4f

SHA512
55b80b02ff0b6046015c8817fe33f8bf9631f80cf5e0182daea9da782cd77d6d9cc702a4035b9c6678d68d4e1cef94d2389973966ef3c692adae9e58be5d7822

Download Submit
C:\Windows\{8D884331-39FC-44b2-B560-2B19A8522069}.exe

Filesize
204KB

MD5
411b438df42b42f3d84fd35db1a45778

SHA1
cd314659132547157cd26bb2bd1059f9c9a9ea15

SHA256
272c3765c6ed89ba5d772acd8fdbc8e0bc67d973330384581adc1a81fa614dc6

SHA512
606f245eccf78febce631a930960c9a7e2376315bc77918ff8950e5d96b195914ba2f3ab53fc03700c568cf4c468949800e3b981f0791ac87d56ad9f3fcd4a3e

Download Submit
C:\Windows\{99DED99C-16B6-422c-B71F-B007BAC3DE44}.exe

Filesize
204KB

MD5
66fbb4cfb854c4a1c5be2e87b7203051

SHA1
c757995d6812540ca346bfeaa41042dcf1da558b

SHA256
aa068f4eb0d0aace701347ac5d56934e768ee4ef299e0d183adcca64f96f348b

SHA512
bc8b96d87b0aabb8e83f89761c1675a6a4c5b45e418a82e34f0729c3e01e86826a55368524e8a89bd883420930d59c9b2ea3530575ce409f8f11d730d115cd92

Download Submit
C:\Windows\{9ABEAE29-E299-43de-9E0A-712C38AD3BD0}.exe

Filesize
204KB

MD5
c379339bb330498fdf1f25e2eea35d78

SHA1
c4a7d38487b2fa3571a8a1b3beed583cf67ca285

SHA256
4603c8e94c1371a611eb6be69499f7cceb0b9ee6d9037919b9c736a07ddd5eaf

SHA512
9387363d509c268fea6a9eb2f40abb02095d5722ef8c6d85f70e02413bacc8517b7ae91f0db8d331cd2a6b51c1d6ff67c0b2b15f28e885d4b67b487277d68b1d

Download Submit
C:\Windows\{A1EF7D7E-7C99-4d94-B0F4-C307EB8CC4FA}.exe

Filesize
204KB

MD5
2a2ea6b858b205e0e298c1799547ddbf

SHA1
bbace7ae86d378684a7a4ee236a938ced6b671c3

SHA256
30adfdb63ba989ac63dce3d65c8dc07f0b2034c3510f31534faab04fde540927

SHA512
f7edb26b3a2c30f018560a5eb26047327cc2ccff76f1d4a1bf120ec495c181ed6f783eb87ed1c3c953c507bccb59ead56983912b80d446f25cdb8fb9d8096adc

Download Submit
C:\Windows\{B9C33A0E-3438-4b4f-BF07-AB9842E70F41}.exe

Filesize
204KB

MD5
f7c57fb875c7fe6ed8990f82b41bec16

SHA1
cc6b6d2227568265e20c482fdd8c1e4ddd1ba109

SHA256
11ccbec36424ff34eb71f1fc317c3334459092b5364f14051d1a5034c97a4fa7

SHA512
6571dbb60d2887be9391ec0067662d1e40678c99dddd5cfb2849072de116fa72e6b6b82a62192adc7400b383b52a0e7be49b5073eb8f9aa03e3b881b038e973e

Download Submit
C:\Windows\{CD8FFC46-3616-425b-99A8-EE7866B57FF8}.exe

Filesize
204KB

MD5
c5f03f1bd4cde047ae401511326ac2ed

SHA1
266def164c4938b1276a792349de26d149d6a3bb

SHA256
713b70f48393be02e168ca9d6f04c072c7c261fb5b1d5f4f07efe868944a8c43

SHA512
5950f67fba84ff49c78539721012d47f031b708e4bbf8ad17559ed161a30575b3b3db954bc733b8e6b993b6322e64eef4e3151f2e010d66f08eeaf454e345b14

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads