60e44d118dad1c7a4f2e15ae34f3803858409fbd6af36e856b05f9da67512517

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 04:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe
Size 180KB
Sample240601-fcs33aah83
SHA256 60e44d118dad1c7a4f2e15ae34f3803858409fbd6af36e856b05f9da67512517
MD5 0007c2aaeaaa931aa1c75aff75ef31c7
SHA1 77438b8f2f635cbceba6691f3a72739710b2312e
SHA512 b88f6758c0edf6589b0a7744a4651dddea2b147237bb97bc59f13e1d6ce9f3444a6e7832434f0f65198f842124df2ff13baaab94be7a475902eb1c032af5df4e
SSDEEP 3072:jEGh0oDlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGhl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023419-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023412-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002341f-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023412-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000217e3-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000217e7-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e0000000217e3-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000705-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000705-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000705-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74053887-4868-448f-9F65-C9AFF78CB22E}\stubpath = "C:\\Windows\\{74053887-4868-448f-9F65-C9AFF78CB22E}.exe"	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74053887-4868-448f-9F65-C9AFF78CB22E}	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B56648EF-0E05-4815-8CFB-87C8450E5E15}	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B56648EF-0E05-4815-8CFB-87C8450E5E15}\stubpath = "C:\\Windows\\{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe"	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{351902C6-9E0D-4f35-B8AD-E529C0510361}	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{351902C6-9E0D-4f35-B8AD-E529C0510361}\stubpath = "C:\\Windows\\{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe"	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86332F02-C491-4e8e-A49E-08D103EC83C8}	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}\stubpath = "C:\\Windows\\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe"	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}\stubpath = "C:\\Windows\\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe"	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{555E2C24-1469-42b5-836B-0A26C8F8DF98}\stubpath = "C:\\Windows\\{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe"	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}\stubpath = "C:\\Windows\\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe"	{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}\stubpath = "C:\\Windows\\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe"	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}\stubpath = "C:\\Windows\\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe"	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86332F02-C491-4e8e-A49E-08D103EC83C8}\stubpath = "C:\\Windows\\{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe"	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}\stubpath = "C:\\Windows\\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe"	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}\stubpath = "C:\\Windows\\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe"	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{555E2C24-1469-42b5-836B-0A26C8F8DF98}	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}	{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe

Executes dropped EXE 12 IoCs

pid	Process
4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe
4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
4344	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
620	{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
696	{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
File created	C:\Windows\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
File created	C:\Windows\{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
File created	C:\Windows\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
File created	C:\Windows\{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
File created	C:\Windows\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe	{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
File created	C:\Windows\{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
File created	C:\Windows\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
File created	C:\Windows\{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
File created	C:\Windows\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
File created	C:\Windows\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe
File created	C:\Windows\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
Token: SeIncBasePriorityPrivilege	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe
Token: SeIncBasePriorityPrivilege	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
Token: SeIncBasePriorityPrivilege	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
Token: SeIncBasePriorityPrivilege	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
Token: SeIncBasePriorityPrivilege	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
Token: SeIncBasePriorityPrivilege	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
Token: SeIncBasePriorityPrivilege	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
Token: SeIncBasePriorityPrivilege	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
Token: SeIncBasePriorityPrivilege	4344	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
Token: SeIncBasePriorityPrivilege	620	{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4444	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe	91
PID 536 wrote to memory of 4444	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe	91
PID 536 wrote to memory of 4444	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe	91
PID 536 wrote to memory of 3004	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe	92
PID 536 wrote to memory of 3004	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe	92
PID 536 wrote to memory of 3004	536	2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe	92
PID 4444 wrote to memory of 1944	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	93
PID 4444 wrote to memory of 1944	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	93
PID 4444 wrote to memory of 1944	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	93
PID 4444 wrote to memory of 3188	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	94
PID 4444 wrote to memory of 3188	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	94
PID 4444 wrote to memory of 3188	4444	{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe	94
PID 1944 wrote to memory of 4012	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	96
PID 1944 wrote to memory of 4012	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	96
PID 1944 wrote to memory of 4012	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	96
PID 1944 wrote to memory of 3012	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	97
PID 1944 wrote to memory of 3012	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	97
PID 1944 wrote to memory of 3012	1944	{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe	97
PID 4012 wrote to memory of 2720	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	98
PID 4012 wrote to memory of 2720	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	98
PID 4012 wrote to memory of 2720	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	98
PID 4012 wrote to memory of 4520	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	99
PID 4012 wrote to memory of 4520	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	99
PID 4012 wrote to memory of 4520	4012	{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe	99
PID 2720 wrote to memory of 3296	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	100
PID 2720 wrote to memory of 3296	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	100
PID 2720 wrote to memory of 3296	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	100
PID 2720 wrote to memory of 5080	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	101
PID 2720 wrote to memory of 5080	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	101
PID 2720 wrote to memory of 5080	2720	{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe	101
PID 3296 wrote to memory of 3408	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	102
PID 3296 wrote to memory of 3408	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	102
PID 3296 wrote to memory of 3408	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	102
PID 3296 wrote to memory of 2312	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	103
PID 3296 wrote to memory of 2312	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	103
PID 3296 wrote to memory of 2312	3296	{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe	103
PID 3408 wrote to memory of 1680	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	104
PID 3408 wrote to memory of 1680	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	104
PID 3408 wrote to memory of 1680	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	104
PID 3408 wrote to memory of 3320	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	105
PID 3408 wrote to memory of 3320	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	105
PID 3408 wrote to memory of 3320	3408	{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe	105
PID 1680 wrote to memory of 4908	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	106
PID 1680 wrote to memory of 4908	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	106
PID 1680 wrote to memory of 4908	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	106
PID 1680 wrote to memory of 1072	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	107
PID 1680 wrote to memory of 1072	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	107
PID 1680 wrote to memory of 1072	1680	{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe	107
PID 4908 wrote to memory of 212	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	108
PID 4908 wrote to memory of 212	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	108
PID 4908 wrote to memory of 212	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	108
PID 4908 wrote to memory of 3976	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	109
PID 4908 wrote to memory of 3976	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	109
PID 4908 wrote to memory of 3976	4908	{74053887-4868-448f-9F65-C9AFF78CB22E}.exe	109
PID 212 wrote to memory of 4344	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	110
PID 212 wrote to memory of 4344	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	110
PID 212 wrote to memory of 4344	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	110
PID 212 wrote to memory of 3688	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	111
PID 212 wrote to memory of 3688	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	111
PID 212 wrote to memory of 3688	212	{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe	111
PID 4344 wrote to memory of 620	4344	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe	112
PID 4344 wrote to memory of 620	4344	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe	112
PID 4344 wrote to memory of 620	4344	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe	112
PID 4344 wrote to memory of 2008	4344	{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_0007c2aaeaaa931aa1c75aff75ef31c7_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
  C:\Windows\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe
    C:\Windows\{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
      C:\Windows\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4012
    - - C:\Windows\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
        
        C:\Windows\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
        
        C:\Windows\{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
        
        C:\Windows\{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
        
        C:\Windows\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
        
        C:\Windows\{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
        
        C:\Windows\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
        
        C:\Windows\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
        
        C:\Windows\{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
        
        C:\Windows\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe
        
        C:\Windows\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe
        13⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{555E2~1.EXE > nul
        13⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CFF71~1.EXE > nul
        12⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8C556~1.EXE > nul
        11⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{74053~1.EXE > nul
        10⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0EED5~1.EXE > nul
        9⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{86332~1.EXE > nul
        8⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{35190~1.EXE > nul
        7⤵
        
        PID:2312
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A4D1A~1.EXE > nul
        6⤵
        
        PID:5080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{697FD~1.EXE > nul
        5⤵
        
        PID:4520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B5664~1.EXE > nul
      4⤵
      PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0C8E3~1.EXE > nul
    3⤵
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe

Path C:\Windows\{0C8E376F-93C7-403d-B068-8FF6E356F4F0}.exe
Size 180KB
SHA256 feac2032bcf2df66414ef96499d96fd0747701f1be57d8dc0d96b03d42309715
MD5 82dd01ed2bfb0dede92fd6a043284fd9
SHA1 4bb6fe7f972d86becb5d31d30de1e13a74925793
SHA512 d8a5c0bc808c00b2d22dc03b5a78814c5a064fbc522bc8d79f187302e2e1051c612ca6f40f30a280b6502e62642eac68bab529ebbb970eae01bb66133dd829e8
SSDEEP 3072:jEGh0oulfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGsl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe

Path C:\Windows\{0EED50E9-03E0-4c69-8AE3-EF9A4F50387A}.exe
Size 180KB
SHA256 70dc7025f8fd9446341bd498a224630a32d9bcdd7fdbf4727e408d90a221f918
MD5 06becd6887e220c56e4d9f6ed1dc4f92
SHA1 55b54062363965db8017bd4cf6665a798079c6b5
SHA512 672f22e6fcfbefe92f0a45fe47e568e864e50b8a117a07a02ead14058d78d415b3e3b3cb8fad9d4ae4355bf99783b3f7b7b9f2c49fe0bd10688db2b1dd791fbf
SSDEEP 3072:jEGh0oJlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGPl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe

Path C:\Windows\{351902C6-9E0D-4f35-B8AD-E529C0510361}.exe
Size 180KB
SHA256 a4c7dbe2f5e5141667773439402223f5f767d8303816176eeb80c8b283c1f148
MD5 36270231e722e386995336172c763741
SHA1 ac20a35a56837eb06abec2514504dfd9888987af
SHA512 2abe1d1abb3b13d511b4e617784abfc00680b98beb7f55192b5a6799c144893a1f5d407c985c63123c98d17acd7e8562c22284a9106588f98a0d7f59dffea38f
SSDEEP 3072:jEGh0oklfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGul5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe

Path C:\Windows\{555E2C24-1469-42b5-836B-0A26C8F8DF98}.exe
Size 180KB
SHA256 377ee403d5b8cc6fabf387f7707b6f0ca02ec770662771a8a5b342b76fb002a6
MD5 9f05190ebe57f3a47f509b8786780057
SHA1 d7f5b4b947fa3b8b9d7351f2f23b0882a5b0a7bd
SHA512 ecba1fe7b68cbe4f4f997226590d1d4fc2cd16af10ace2c0d8886de155f38750907f1df87f4872290e1d2a955ab1a13956120577e4bd7e81aff54b1fcccda038
SSDEEP 3072:jEGh0oilfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGYl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe

Path C:\Windows\{697FD9DE-5C77-4ea5-A8E5-61CC92482A38}.exe
Size 180KB
SHA256 1bde72336d61f068ad5863cc5cc3887923b1c8fb44394e1bc13eab478e7a16ea
MD5 379f6efa0b1da22e6b7915c5ec116eb8
SHA1 58668766abeb2439fa4cd7aeaa0f62954c44f384
SHA512 cd2910e0b54b384bcd5dcbdc3add05e564f61488dd1fa4cdda149265424e5e781ebff841f30ac91900d3c62633679fb71a517ba746317d4e011e804002eb6d1b
SSDEEP 3072:jEGh0oqlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGwl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{74053887-4868-448f-9F65-C9AFF78CB22E}.exe

Path C:\Windows\{74053887-4868-448f-9F65-C9AFF78CB22E}.exe
Size 180KB
SHA256 b6621e54c799922442287d1083355d90c53af012343decef41bf070188cf0e45
MD5 c7f5792861bf7467cf1082ff6f2a617d
SHA1 e24f3ddf6115ef9daa7b32da3112b6ec05463a59
SHA512 5511348a5e38022879741ec66567de4fe995284b0e8c04c2e8bf0b37fd10d6f4873163e0af90aefaa3ac9aa3c3dc09a171c0681f633e7dcfc671b2086f1e7e24
SSDEEP 3072:jEGh0oqlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGEl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe

Path C:\Windows\{86332F02-C491-4e8e-A49E-08D103EC83C8}.exe
Size 180KB
SHA256 7232b97e86a14bdd42df7302cb4393d03f498bc001021e4c690c142bfad5c84b
MD5 d5c3fa3240b3b1165ab8d55ec1ebcc15
SHA1 432cab525a16c06e15adc5a22ec36983c67d5fc3
SHA512 fe878af19346e95c55ff0d5fde08141d16287ea354c46ba3409e1902b89c042fad16c542289005c85781f7901aa1a6dc0f7da457e0e8886d69c913da49c7e06c
SSDEEP 3072:jEGh0oelfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG4l5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe

Path C:\Windows\{8C5568FA-3D4A-4ca7-9B11-5DD4E4A3BF67}.exe
Size 180KB
SHA256 10bb894eb63c93efda7a244583062bdd9eedd9927e248fa4b7cf3c0cc27cc938
MD5 2c36cf5d4747f36e0f2db498e2e0d891
SHA1 4b3777ac39dae4cf30f3cf34a6a6b54a69403364
SHA512 86932cf6384bfcbfd6be0480964ead504704f50ae1b89c9085d14b4f30d818a14a50570fe006787051a112504ee41311b048ef00a1b60dd298acfde2e4b9f513
SSDEEP 3072:jEGh0oFlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGDl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe

Path C:\Windows\{A4D1A84D-C122-482c-9890-23E4B3BF95D7}.exe
Size 180KB
SHA256 9375983d7c7f51aed8773f40b2719704834d119b8bfda3ee99b7ce3d1c9b7d0e
MD5 79d96680de33af00e12f78f5a7177a02
SHA1 fc501db1c346efc2e3c22c0f65e1550da23b858b
SHA512 2f27cefa9a131329c4336415bc512fe65f8769e3c1ba20d862de1d650ee9dbccbbe041986253d1f605deef96f676830f7d0e5a8d2f584aee00a2702ae9484635
SSDEEP 3072:jEGh0oglfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGWl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe

Path C:\Windows\{B56648EF-0E05-4815-8CFB-87C8450E5E15}.exe
Size 180KB
SHA256 db59fca4fd3e8ae231dfb6282d63fb6e45c788665fefc298a98b46c3816e6aab
MD5 a667b4e98c4a5d5765ffbf9b5f8a0713
SHA1 852b22f31439e1086aca4d6aecd4756ce05f9d2c
SHA512 cb7ae97c0f0c4e709327ec65b5df6d794cbc062e254dd01ae4c33808cf919c4824c633a8c54b06c291fdf925b8351a2fcc26b7f1570b63b4e1009675a29789bf
SSDEEP 3072:jEGh0otlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG/l5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe

Path C:\Windows\{CFF71207-BA80-451f-AD0D-A534C0A6DFBF}.exe
Size 180KB
SHA256 77f53e13840edf5b4f429df0584ae8d3f90436b3c483a486d28b8fcffdea33fa
MD5 8f1d11abd21d2d4598cb65a446b61725
SHA1 54263939ac7551a0b958c961607cb003cb4b7a16
SHA512 7cd598afbb8b159a656a872183c6a539532536e65742ed8fa2c8f9bf9d382f13691df693a9afe918a3aeeccfb5717735b5033d614e2cf36804e2ffede36d8a3f
SSDEEP 3072:jEGh0o7lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGhl5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe

Path C:\Windows\{E093BB8E-9F73-44c9-BBBA-6C35CBCEFCB1}.exe
Size 180KB
SHA256 ee4622ba3531b7a7f372c6779ffe57b9ac6d61bd0f79dee378b05c5fa8ddd646
MD5 2f32892cb349e69db9fdbfd14d3923e4
SHA1 e17b82d794b58e2ea2cbb89d62a803078653961f
SHA512 d4ef7443a7b0eae94bcbd8b45750b27272ae8fb97aaf048bdba9e49b19902e941553786e90f408d7b7c23afc2cfd01a10c34b6ce69e18095f66f7cbe587109fc
SSDEEP 3072:jEGh0oclfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG+l5eKcAEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads