9b51f4d68fbd1578e08837cdcf4bf84b1c61fdb75fad82ba1e1ebf6df905742d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Size

180KB
MD5

9d48b85ba24e21c2043b38a2c8e6b03c
SHA1

f746d7414adc3189cb7415e9c4b246e34ca022e4
SHA256

9b51f4d68fbd1578e08837cdcf4bf84b1c61fdb75fad82ba1e1ebf6df905742d
SHA512

9b485ace8c7937747a25a695c74cd1e78dead2de57e603c431538be8ac9bb0adab27e20e40df2422bd96c246531117c0f87436c6096da311f1ef9c96fbf663ee
SSDEEP

3072:jEGh0o5lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGnl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000b0000000232f0-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233f2-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002336d-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002336f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002336d-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002336f-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002336d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002336f-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002336d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023379-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002336d-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023379-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}\stubpath = "C:\\Windows\\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe"	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}\stubpath = "C:\\Windows\\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe"	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97574B86-9321-4e54-973B-8748B1232599}	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}	{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}\stubpath = "C:\\Windows\\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe"	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}\stubpath = "C:\\Windows\\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe"	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}	{97574B86-9321-4e54-973B-8748B1232599}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}\stubpath = "C:\\Windows\\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe"	{97574B86-9321-4e54-973B-8748B1232599}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}\stubpath = "C:\\Windows\\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe"	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}\stubpath = "C:\\Windows\\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe"	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}\stubpath = "C:\\Windows\\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe"	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}\stubpath = "C:\\Windows\\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe"	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}\stubpath = "C:\\Windows\\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe"	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97574B86-9321-4e54-973B-8748B1232599}\stubpath = "C:\\Windows\\{97574B86-9321-4e54-973B-8748B1232599}.exe"	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}\stubpath = "C:\\Windows\\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}.exe"	{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe

Executes dropped EXE 12 IoCs

pid	Process
3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe
4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe
2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
2988	{97574B86-9321-4e54-973B-8748B1232599}.exe
5052	{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe
2984	{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe	{97574B86-9321-4e54-973B-8748B1232599}.exe
File created	C:\Windows\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
File created	C:\Windows\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
File created	C:\Windows\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe
File created	C:\Windows\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
File created	C:\Windows\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
File created	C:\Windows\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
File created	C:\Windows\{97574B86-9321-4e54-973B-8748B1232599}.exe	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
File created	C:\Windows\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}.exe	{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe
File created	C:\Windows\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
File created	C:\Windows\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
File created	C:\Windows\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
Token: SeIncBasePriorityPrivilege	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
Token: SeIncBasePriorityPrivilege	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe
Token: SeIncBasePriorityPrivilege	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
Token: SeIncBasePriorityPrivilege	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
Token: SeIncBasePriorityPrivilege	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
Token: SeIncBasePriorityPrivilege	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe
Token: SeIncBasePriorityPrivilege	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
Token: SeIncBasePriorityPrivilege	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
Token: SeIncBasePriorityPrivilege	2988	{97574B86-9321-4e54-973B-8748B1232599}.exe
Token: SeIncBasePriorityPrivilege	5052	{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3948	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	84
PID 5004 wrote to memory of 3948	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	84
PID 5004 wrote to memory of 3948	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	84
PID 5004 wrote to memory of 4816	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	85
PID 5004 wrote to memory of 4816	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	85
PID 5004 wrote to memory of 4816	5004	2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe	85
PID 3948 wrote to memory of 4880	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	86
PID 3948 wrote to memory of 4880	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	86
PID 3948 wrote to memory of 4880	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	86
PID 3948 wrote to memory of 4236	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	87
PID 3948 wrote to memory of 4236	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	87
PID 3948 wrote to memory of 4236	3948	{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe	87
PID 4880 wrote to memory of 4932	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	92
PID 4880 wrote to memory of 4932	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	92
PID 4880 wrote to memory of 4932	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	92
PID 4880 wrote to memory of 3412	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	93
PID 4880 wrote to memory of 3412	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	93
PID 4880 wrote to memory of 3412	4880	{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe	93
PID 4932 wrote to memory of 4420	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	94
PID 4932 wrote to memory of 4420	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	94
PID 4932 wrote to memory of 4420	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	94
PID 4932 wrote to memory of 4792	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	95
PID 4932 wrote to memory of 4792	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	95
PID 4932 wrote to memory of 4792	4932	{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe	95
PID 4420 wrote to memory of 640	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	96
PID 4420 wrote to memory of 640	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	96
PID 4420 wrote to memory of 640	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	96
PID 4420 wrote to memory of 4844	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	97
PID 4420 wrote to memory of 4844	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	97
PID 4420 wrote to memory of 4844	4420	{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe	97
PID 640 wrote to memory of 4144	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	98
PID 640 wrote to memory of 4144	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	98
PID 640 wrote to memory of 4144	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	98
PID 640 wrote to memory of 724	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	99
PID 640 wrote to memory of 724	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	99
PID 640 wrote to memory of 724	640	{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe	99
PID 4144 wrote to memory of 2476	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	100
PID 4144 wrote to memory of 2476	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	100
PID 4144 wrote to memory of 2476	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	100
PID 4144 wrote to memory of 1744	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	101
PID 4144 wrote to memory of 1744	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	101
PID 4144 wrote to memory of 1744	4144	{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe	101
PID 2476 wrote to memory of 2320	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	102
PID 2476 wrote to memory of 2320	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	102
PID 2476 wrote to memory of 2320	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	102
PID 2476 wrote to memory of 2604	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	103
PID 2476 wrote to memory of 2604	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	103
PID 2476 wrote to memory of 2604	2476	{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe	103
PID 2320 wrote to memory of 264	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	104
PID 2320 wrote to memory of 264	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	104
PID 2320 wrote to memory of 264	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	104
PID 2320 wrote to memory of 2380	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	105
PID 2320 wrote to memory of 2380	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	105
PID 2320 wrote to memory of 2380	2320	{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe	105
PID 264 wrote to memory of 2988	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	110
PID 264 wrote to memory of 2988	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	110
PID 264 wrote to memory of 2988	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	110
PID 264 wrote to memory of 2008	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	111
PID 264 wrote to memory of 2008	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	111
PID 264 wrote to memory of 2008	264	{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe	111
PID 2988 wrote to memory of 5052	2988	{97574B86-9321-4e54-973B-8748B1232599}.exe	112
PID 2988 wrote to memory of 5052	2988	{97574B86-9321-4e54-973B-8748B1232599}.exe	112
PID 2988 wrote to memory of 5052	2988	{97574B86-9321-4e54-973B-8748B1232599}.exe	112
PID 2988 wrote to memory of 5004	2988	{97574B86-9321-4e54-973B-8748B1232599}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_9d48b85ba24e21c2043b38a2c8e6b03c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
  C:\Windows\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
    C:\Windows\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe
      C:\Windows\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Windows\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
        
        C:\Windows\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
      - C:\Windows\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
        
        C:\Windows\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
        
        C:\Windows\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe
        
        C:\Windows\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
        
        C:\Windows\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
        
        C:\Windows\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\{97574B86-9321-4e54-973B-8748B1232599}.exe
        
        C:\Windows\{97574B86-9321-4e54-973B-8748B1232599}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe
        
        C:\Windows\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}.exe
        
        C:\Windows\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}.exe
        13⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3FF00~1.EXE > nul
        13⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97574~1.EXE > nul
        12⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB457~1.EXE > nul
        11⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{421CE~1.EXE > nul
        10⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{68F73~1.EXE > nul
        9⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA4B4~1.EXE > nul
        8⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7D366~1.EXE > nul
        7⤵
        
        PID:724
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7FB8C~1.EXE > nul
        6⤵
        
        PID:4844
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F78F5~1.EXE > nul
        5⤵
        
        PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{578B6~1.EXE > nul
      4⤵
      PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7E39C~1.EXE > nul
    3⤵
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3FF00FF0-1093-4a14-A539-6C47BC83A7CC}.exe

Filesize
180KB

MD5
11e0b65952220797be71e1cefe789a33

SHA1
724ad79c8ef3a5028821a0db01d537656dea7cd5

SHA256
c884472d1ab5eb5d1f27226e0b47d0a27ebef54010bc7c27cdaf9b6e25471e95

SHA512
9212c47e2ddffe4d0ca741a7866c9f74e07124d5f5d3063ea3f8c174d7a6d1121a725b8e84ce98cf1645337f46a0b33bc6517236a43a1fd789369be19174b98c

Download Submit
C:\Windows\{421CE38F-DD63-4c9c-98D9-7BB08E5B73A1}.exe

Filesize
180KB

MD5
a4d6f68819b5e6248d96019a6fb3fb9e

SHA1
5f33fefd4daacc442939deccf725a0ecb2f4ed93

SHA256
411e94b42635cfc28de0077c33005d90b003b8b8c33f70046a98692a98217174

SHA512
e428e44c6c2eb5b33f44e2d8e762591e3fd785817066e014a2b01a83924b0df20236d892764dfa8d56cb95815037bafc3fb7e22f0d55b5c09b564ae93db5d2a2

Download Submit
C:\Windows\{45CBE0B5-11C6-43c3-BF01-064CDCF18CD3}.exe

Filesize
180KB

MD5
01942b9bd4af905349bb2ec2b0f3c563

SHA1
c352bc74762dcc66125dd6ee62994cf54cdd5184

SHA256
2391e96e7566c5715559d9371550d4339aaf3f1591c66d787482dd02f612c966

SHA512
8e4783de52828d4e39d0cfbde779d281d0fc6c406d66d90a01632163634857a1748d6541194aa7641963d54d37a9aa8d8c4b82e3915623bea61d0a49b1c4521b

Download Submit
C:\Windows\{578B65E2-CD04-4162-AEFE-EE35D2905E5E}.exe

Filesize
180KB

MD5
d1c6e84a18d20f8bfc2542751d4b18fc

SHA1
dec9602cd045e5708735686a787e79a027bfb3ee

SHA256
9828216f366c1a91ab9fde52c53b48a0eb27e1ddcf85970980970e41a33630de

SHA512
de10559cdd1d923a691860b963761566a3e11fa8ef1b582dbfc619f2a6245c236d4144f047fcb687021948b34bb045b631c8e5ba703210652a5847ffcdad1855

Download Submit
C:\Windows\{68F73E29-EFC2-4613-BB85-916F3A57AE0C}.exe

Filesize
180KB

MD5
e78c653369985637cfeb08e759af5bb5

SHA1
bf4dc2cbc055c06be2e423b3c11a8e96d0769411

SHA256
2b48f733800ff66917cffb3384ba5c225f887110bee89901e0413738c0be63f5

SHA512
6533b35c5454ec08bb41eae02505b383e0282b7d3c3cd12db3bd07563d9be2ae9c67fcae7c366d1f06d86cdecc5ffad63ca3f37461e1e8ce0efbaae426393801

Download Submit
C:\Windows\{7D36662F-9BD5-4be0-8DAB-FA3B7DAE9160}.exe

Filesize
180KB

MD5
03f7e0dae17c4977da100dd3055b66bd

SHA1
9ad6e82cbae99e6823e67e53793a59f46b8f8f8d

SHA256
c3dab3d32a3c4a1c64524ac65fda64b0f7a72e4f306730a4e2e79b09b0ebf13e

SHA512
d7fd87207278bcfe3d0d7e783b1d4ac973426163e0704237c20ebb31aeb671ab3b2f0ad87a518d26b32f0a588f231ccfdc28dc57f73ace9cae236e510632794d

Download Submit
C:\Windows\{7E39C429-A5DC-4658-80A5-73FBBE3D198A}.exe

Filesize
180KB

MD5
375cfb27279ea59e8768f7c58f63b4c5

SHA1
4c85129a838069538445482da4183414d7aed441

SHA256
073260c9bf2eb407f30eacbc25da4ba6ec17a90a823d02136b668ea1094841d6

SHA512
69570760361e8499f7dcf53d02309240439dc9b45db353a3c119c326fd1fe4bcdcbaa001052910696dcf4cb94a5fd71ec6e9016141eabcb11156e2a3e8f2bf5c

Download Submit
C:\Windows\{7FB8CF3A-66B1-41e0-9D3C-81A36A5BFB47}.exe

Filesize
180KB

MD5
f7e82fdb2e57bd37115bb37c98e6880d

SHA1
05cbaf06ee860a081cf80cdc1c609b08c1c3ebce

SHA256
a54573c06a96754f4ed3be1d4a02e156d0603ced7b9ba60f2a94abb176a66daf

SHA512
49befa23f555cb61809f260a174367853cf8277b1b9264bd57842620cc1fd3c0135b9cd79a9d5091470f3640607d4bcd2ffb244ad020a2d68d8e4f0f9735d1fa

Download Submit
C:\Windows\{97574B86-9321-4e54-973B-8748B1232599}.exe

Filesize
180KB

MD5
2a497baebff6db1d9b918c4143c5f026

SHA1
c2aff31d032c40e8c289a6c32b2e602e07042324

SHA256
17620cbc1730be2841d9e8a9553e32a31eacb47ce19fa66ba1d84d16b49dfb6a

SHA512
56c7a4a19a36364d02b41cb1247fbddb7df30a7406ec1df8783bcf143ab08fa01a05f8bee9e76a2df35cc30086c2d9fe31cb0def3d40fcdac3529419d4337379

Download Submit
C:\Windows\{DA4B430B-D753-4aaf-B28D-F96D53A71B4F}.exe

Filesize
180KB

MD5
009acb5bbc8e15e1dc047844e96cecca

SHA1
e1bcc9a11d1fc8777bb21906d442dd4289100196

SHA256
51fe2bdcfb011eff77bf072d5685145b1062d774dae8ca44507f227092d5bf29

SHA512
9ad35d5173d72028528920a71c19595e182368165ec8f0a15576495c5346cb307fa60c83638997d099aca65d1a9c1e7c035f72a2486eeddb0af0348939d90560

Download Submit
C:\Windows\{F78F59FB-4BCE-4a60-9EED-B3839A779FE4}.exe

Filesize
180KB

MD5
fb004c4d1ba010d23dd27977f53592c5

SHA1
57793e470064f533f460d74ec752df179d23778b

SHA256
ed9a1dfd1ebbc53d1886682fd442cb889de82d6933bca29927e8b70a6c4aa629

SHA512
b74015e38008beac2a3950d6c8addef6cdb3ed433f047f6213b03972db5a8b5fb7b5154f017337e1672045c1ee826f3815a97ff2a5d51fd863750f47d86075f5

Download Submit
C:\Windows\{FB457770-E532-4f1c-8791-AF0FDFA4ADEB}.exe

Filesize
180KB

MD5
234091b1d4b8e996f1653cb01ec729fc

SHA1
a6c8e41be279ad1d753842a4a4a746f8529fc5c4

SHA256
1d55c41919acc25d4aa644601de7609a0d5ac172aaceba39fa25344bb7eb3ced

SHA512
34ce9c3ca894afbd289d9e3adb5f4774732dcabac29db9b707c6b596e62a5c20412d99b84c7d85cd2dda12f097dfab73d468d8577c3dba368ecd2a377b130689

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads