54595d06b7a42f4579b9451e9c3d7899734d55196be8b198bb393fa43682bb50

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe
Size

372KB
MD5

0b1c3fe30acbd6ad57b6485c6620784b
SHA1

1d840d9652a72ce11ff50bc7a9661535c49a24a8
SHA256

54595d06b7a42f4579b9451e9c3d7899734d55196be8b198bb393fa43682bb50
SHA512

99b4941ecfe2f2be66d30b2c70fe25b88640c300f544a8a01c81a5ac990ac9b75a400ecd2af62160646d4c57b1302bf46a479652837c854c3e9680aa7afa3673
SSDEEP

3072:CEGh0o3lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG9lkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023207-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e7e2-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023210-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023212-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000022043-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000022044-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000022043-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00070000000006cf-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000006cf-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000006cf-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FF5DF80-F735-4e57-812A-651A3059341C}	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70590F06-2182-4df3-A40E-31A249C9BD6E}\stubpath = "C:\\Windows\\{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe"	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}\stubpath = "C:\\Windows\\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe"	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C36B7D2-0543-4e39-9E64-276A1F357D50}\stubpath = "C:\\Windows\\{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe"	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}\stubpath = "C:\\Windows\\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe"	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FF5DF80-F735-4e57-812A-651A3059341C}\stubpath = "C:\\Windows\\{8FF5DF80-F735-4e57-812A-651A3059341C}.exe"	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C36B7D2-0543-4e39-9E64-276A1F357D50}	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}\stubpath = "C:\\Windows\\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe"	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6A3BE98-6131-4965-9475-916D43742065}	{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70590F06-2182-4df3-A40E-31A249C9BD6E}	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}\stubpath = "C:\\Windows\\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe"	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6A3BE98-6131-4965-9475-916D43742065}\stubpath = "C:\\Windows\\{A6A3BE98-6131-4965-9475-916D43742065}.exe"	{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}\stubpath = "C:\\Windows\\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe"	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}\stubpath = "C:\\Windows\\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe"	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}\stubpath = "C:\\Windows\\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe"	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}\stubpath = "C:\\Windows\\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe"	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe

Executes dropped EXE 12 IoCs

pid	Process
6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe
6080	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
5200	{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe
5704	{A6A3BE98-6131-4965-9475-916D43742065}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
File created	C:\Windows\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
File created	C:\Windows\{A6A3BE98-6131-4965-9475-916D43742065}.exe	{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe
File created	C:\Windows\{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
File created	C:\Windows\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
File created	C:\Windows\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
File created	C:\Windows\{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
File created	C:\Windows\{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
File created	C:\Windows\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
File created	C:\Windows\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe
File created	C:\Windows\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
File created	C:\Windows\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe
Token: SeIncBasePriorityPrivilege	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
Token: SeIncBasePriorityPrivilege	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
Token: SeIncBasePriorityPrivilege	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
Token: SeIncBasePriorityPrivilege	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
Token: SeIncBasePriorityPrivilege	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
Token: SeIncBasePriorityPrivilege	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
Token: SeIncBasePriorityPrivilege	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
Token: SeIncBasePriorityPrivilege	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
Token: SeIncBasePriorityPrivilege	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe
Token: SeIncBasePriorityPrivilege	6080	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
Token: SeIncBasePriorityPrivilege	5200	{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 6036	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe	92
PID 5500 wrote to memory of 6036	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe	92
PID 5500 wrote to memory of 6036	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe	92
PID 5500 wrote to memory of 2044	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe	93
PID 5500 wrote to memory of 2044	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe	93
PID 5500 wrote to memory of 2044	5500	2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe	93
PID 6036 wrote to memory of 2640	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	94
PID 6036 wrote to memory of 2640	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	94
PID 6036 wrote to memory of 2640	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	94
PID 6036 wrote to memory of 4688	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	95
PID 6036 wrote to memory of 4688	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	95
PID 6036 wrote to memory of 4688	6036	{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe	95
PID 2640 wrote to memory of 3404	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	97
PID 2640 wrote to memory of 3404	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	97
PID 2640 wrote to memory of 3404	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	97
PID 2640 wrote to memory of 1144	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	98
PID 2640 wrote to memory of 1144	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	98
PID 2640 wrote to memory of 1144	2640	{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe	98
PID 3404 wrote to memory of 3272	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	99
PID 3404 wrote to memory of 3272	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	99
PID 3404 wrote to memory of 3272	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	99
PID 3404 wrote to memory of 3992	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	100
PID 3404 wrote to memory of 3992	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	100
PID 3404 wrote to memory of 3992	3404	{8FF5DF80-F735-4e57-812A-651A3059341C}.exe	100
PID 3272 wrote to memory of 2772	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	102
PID 3272 wrote to memory of 2772	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	102
PID 3272 wrote to memory of 2772	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	102
PID 3272 wrote to memory of 1300	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	101
PID 3272 wrote to memory of 1300	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	101
PID 3272 wrote to memory of 1300	3272	{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe	101
PID 2772 wrote to memory of 4692	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	104
PID 2772 wrote to memory of 4692	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	104
PID 2772 wrote to memory of 4692	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	104
PID 2772 wrote to memory of 2228	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	103
PID 2772 wrote to memory of 2228	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	103
PID 2772 wrote to memory of 2228	2772	{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe	103
PID 4692 wrote to memory of 2372	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	105
PID 4692 wrote to memory of 2372	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	105
PID 4692 wrote to memory of 2372	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	105
PID 4692 wrote to memory of 1696	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	106
PID 4692 wrote to memory of 1696	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	106
PID 4692 wrote to memory of 1696	4692	{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe	106
PID 2372 wrote to memory of 3388	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	107
PID 2372 wrote to memory of 3388	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	107
PID 2372 wrote to memory of 3388	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	107
PID 2372 wrote to memory of 5836	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	108
PID 2372 wrote to memory of 5836	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	108
PID 2372 wrote to memory of 5836	2372	{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe	108
PID 3388 wrote to memory of 5256	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	109
PID 3388 wrote to memory of 5256	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	109
PID 3388 wrote to memory of 5256	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	109
PID 3388 wrote to memory of 5380	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	110
PID 3388 wrote to memory of 5380	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	110
PID 3388 wrote to memory of 5380	3388	{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe	110
PID 5256 wrote to memory of 6080	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	111
PID 5256 wrote to memory of 6080	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	111
PID 5256 wrote to memory of 6080	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	111
PID 5256 wrote to memory of 2336	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	112
PID 5256 wrote to memory of 2336	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	112
PID 5256 wrote to memory of 2336	5256	{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe	112
PID 6080 wrote to memory of 5200	6080	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe	113
PID 6080 wrote to memory of 5200	6080	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe	113
PID 6080 wrote to memory of 5200	6080	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe	113
PID 6080 wrote to memory of 5248	6080	{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_0b1c3fe30acbd6ad57b6485c6620784b_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
  C:\Windows\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
    C:\Windows\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
      C:\Windows\{8FF5DF80-F735-4e57-812A-651A3059341C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
        
        C:\Windows\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3272
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2BD78~1.EXE > nul
        6⤵
        
        PID:1300
      - C:\Windows\{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
        
        C:\Windows\{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70590~1.EXE > nul
        7⤵
        
        PID:2228
        
        C:\Windows\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
        
        C:\Windows\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
        
        C:\Windows\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
        
        C:\Windows\{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe
        
        C:\Windows\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5256
        
        C:\Windows\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
        
        C:\Windows\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Windows\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe
        
        C:\Windows\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5200
        
        C:\Windows\{A6A3BE98-6131-4965-9475-916D43742065}.exe
        
        C:\Windows\{A6A3BE98-6131-4965-9475-916D43742065}.exe
        13⤵
        Executes dropped EXE
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5FA7B~1.EXE > nul
        13⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E69D5~1.EXE > nul
        12⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EBFFD~1.EXE > nul
        11⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C36B~1.EXE > nul
        10⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1F0D4~1.EXE > nul
        9⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93AD1~1.EXE > nul
        8⤵
        
        PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8FF5D~1.EXE > nul
        5⤵
        
        PID:3992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{42ADE~1.EXE > nul
      4⤵
      PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{40867~1.EXE > nul
    3⤵
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1F0D407E-0D68-4c3a-AF06-C0768C8B58EB}.exe

Filesize
372KB

MD5
d78e886fd4fb385b21f2d45884f11bea

SHA1
817a1d4b4bfe1c8481ff87606345da9b88a66cb0

SHA256
599aac2116593f672b4bfebe8fac6e41de016f23be5f0c825a55ed4f7e1fbfa5

SHA512
1562cc8495fd8f8725f03040e6d93e52506ffada0d4a8a7eacd6128bd72972271ef51620b67d876c58227865af81f66f6a8b6d82009cfb0e96dc8a19e018bbff

Download Submit
C:\Windows\{2BD78A25-5AE2-4738-8701-214B48B8F7E4}.exe

Filesize
372KB

MD5
de55d3ad0443b5a02b3a2d28def92db6

SHA1
50f2c3d98a44f066de886b08970876928897e8ad

SHA256
c1c61bd5712e8e0a07bb7dbb4e45e6c3733e4e9c67ff1fcd7dda3fc2165375d4

SHA512
ba2e27e52ff2a60c473cdb1316e54d780516601539f2e83d4384af3e7405c96b14ff4c0f654991ed799aa3d7a3c49f2fa631073620d8308bab0b9e2508283005

Download Submit
C:\Windows\{408676FC-0E9C-4711-A2B9-B8BBADEBE4B0}.exe

Filesize
372KB

MD5
67838af98807ce7b132c8fd8f5decf2e

SHA1
76a7f168823f0df58f6667c6ed93205208543b47

SHA256
3572350ff6bf608145be004e25ca869d6d975036aedd1f7a51d4d421a1f93e69

SHA512
914cd7d6cb7b0aac41abc72d3a7230ecff541f3241c4591c376bb61af39dc7f4c0225d531a13659c5892bf614ac369464348ad07d6e970794b90daa6e3398398

Download Submit
C:\Windows\{42ADEE4B-FFB5-49de-965D-E3F0BE25E526}.exe

Filesize
372KB

MD5
7692a929150c0c2b1efb45a028bc7ace

SHA1
74063aaf8e611f7b62ee9e287896bf93cc23130e

SHA256
fb1e1aafd1511ae913f2984c1f08be9ad74639e59ce86e2ac152135a5efcfe34

SHA512
f7a21dd18006397e173ce6d58caf116153c734f827757d13247bf0d417eddc492ef4e34e51227ed90a9d828cd22a8fe20657af04c63603b90c38637836472920

Download Submit
C:\Windows\{5FA7B9CF-B205-4b98-A4ED-C04FA7923674}.exe

Filesize
372KB

MD5
1a4b0ed45d3722836c8211686b2612f5

SHA1
54c47fece66fb3862a060e3acbfb579cb39fcc70

SHA256
c40be934bd62eb88e9b29ca04e77307e0db1eb3c4c9d95f22c4baa8e99e674f0

SHA512
52309b23c2a4c372f9d62801060d2c921c64ac112a59cce5c7019452d31850f1cde2f4c327ddd6a4793cb0658bf7688e9a2be2c356f4d825b9548fe3f9be50e2

Download Submit
C:\Windows\{6C36B7D2-0543-4e39-9E64-276A1F357D50}.exe

Filesize
372KB

MD5
47c3648a416f5342c9ff85ca4aef458a

SHA1
c497165128d7946e3025bd1b5577bcf0afacaf7c

SHA256
9cc6a6ffc8f62d3f15c48ea32e239b06b20d76db6b5a2133f26094f37d9c2d35

SHA512
b3074742af7489197672487e2877aa3eb6619a0396a0ac6284900b6fadc59801d2079ac579bff651a6e7b1c1a503bc65e2fb03d6b21f1ac0c75665fa9c81cd39

Download Submit
C:\Windows\{70590F06-2182-4df3-A40E-31A249C9BD6E}.exe

Filesize
372KB

MD5
18cdafbceb79f272ec7dbb30b56c8ac1

SHA1
9fca3cfb148cdce173e6d027d536f259f8fce918

SHA256
573428cea6f900f3dedb36025bc556f8ed99350a5ae5273313f4478de942cb1c

SHA512
c9db24c7a79839a168d818e5e5563e82f63666929695900d74b8ec93cc8dc69cebf5a24d8479495aa47ae21185291920b6cd12a9a2612ccf86febff055b1dc52

Download Submit
C:\Windows\{8FF5DF80-F735-4e57-812A-651A3059341C}.exe

Filesize
372KB

MD5
bbd7b4d1034e7dd1145730049f23d828

SHA1
745afe3eeae5d6b8e95966213a16c6f1366593bd

SHA256
261585a62b91bf628c407a3dea6285e75b58c15cde628576c105ffe286ab0d4d

SHA512
e73624102204a0e108bf623ee5bc11d5e672ac5eb1acb841ae403897c235dfcef0857bb8f674a377f5cca4eff31f1151b7d1fd88fb54ce931610f4ecab666876

Download Submit
C:\Windows\{93AD1BEC-FA9C-45e0-8797-FF6BB74958F9}.exe

Filesize
372KB

MD5
8d2e8643d093dd1f980904e7a91dab7c

SHA1
c029eb8393008556fd2d8ed9fe87aba2b9a1b3e5

SHA256
6102aa862499a2cc2795c8bad7d14b1b136172cc635e378b646d629cc407383a

SHA512
fb90f733ea147c297cd0f4ff818db63aa1fc7de3de570b0f62fe20419aad1379a466be0e1f4d209f4754a0d221d9174f97e9357ff32b82057b9979c643cbb4e8

Download Submit
C:\Windows\{A6A3BE98-6131-4965-9475-916D43742065}.exe

Filesize
372KB

MD5
87ad04a99b050ccaf5b8956eaaddf3a5

SHA1
4eba5ecd1f8ba2cff6efbc41fa7970fb536f6031

SHA256
c3396eaaab261ef14bb8d66ac16a1966ab73825a5d8e4b0b9143a23a7b9c7756

SHA512
4891b30b19dfdd0fa371d3376e7fd5502f6b8e51aefc84d0fa577e4e1ba4112a5d91287e5bf4767ab841a4458f0c5198f1d5f384cc562627eec3540c4f82ef0a

Download Submit
C:\Windows\{E69D51E2-5A1F-4429-B0BE-59F4E43545AC}.exe

Filesize
372KB

MD5
b308d5e52fec4f2af75075d96fc6d30b

SHA1
f826914b0730a85fdd8394117225670680c95ab5

SHA256
2a5c6aff71bc6229cfe41ba172c6450f8c1a608c37dfa45adb9f03c49ade6e27

SHA512
e404e8acf7ade4aa72b622da14802d0dea6ae65761117eeeecc31c99b1b82b10abd8eaebee183966f120aa6ab9c69089c12db7638b52093beeae641be0f478d8

Download Submit
C:\Windows\{EBFFD8FF-D5B6-49ff-98DB-CB86B36799C4}.exe

Filesize
372KB

MD5
ed8d35e23bbe54aa212444fc8ab5759b

SHA1
98a446bc05f80e09f34fad0f297d871149357ed4

SHA256
c665e72982336daf64db986c1a364e22ee69704115e42c60e54190df1d3c1ae9

SHA512
472aad6208327a3ff0caf41460c50288d95aa5b9b322cfefa82c74c4ecf8707e5e076f545913934acc588fdf9c364fd0f4dd40a61e67fa0337f1dd018ed6f9cd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads