fd93e81efba7a7c29fa9486f7424a8c114e044756270d8499de5c4e9119470cf

Analysis

max time kernel
149s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe
Size

180KB
MD5

13f639db9fa7c146634bc40e71d69059
SHA1

65a43f9ffbc8108ee776b8a1970deac84b51bd33
SHA256

fd93e81efba7a7c29fa9486f7424a8c114e044756270d8499de5c4e9119470cf
SHA512

e2a4a068efebf52b7ffef2817103502c66f808d5fbd888686e76c40e0f097f2e6d2bea9ac6ac6509b42af5d6251555e8a46a85b40b5bb45c0b04d184e57e09d3
SSDEEP

3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGAl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000400000002296c-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000022974-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023364-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000233f9-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023400-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000233f9-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023400-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000233f9-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023400-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000233f9-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023400-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000233f9-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}\stubpath = "C:\\Windows\\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe"	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}\stubpath = "C:\\Windows\\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe"	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}\stubpath = "C:\\Windows\\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe"	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}\stubpath = "C:\\Windows\\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe"	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}\stubpath = "C:\\Windows\\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}.exe"	{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02F0B663-1630-4931-910E-5E2CA5A661DF}\stubpath = "C:\\Windows\\{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe"	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}\stubpath = "C:\\Windows\\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe"	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B79A35D-1018-4a35-9B30-F9C22E54F956}\stubpath = "C:\\Windows\\{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe"	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B79A35D-1018-4a35-9B30-F9C22E54F956}	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02F0B663-1630-4931-910E-5E2CA5A661DF}	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}\stubpath = "C:\\Windows\\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe"	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}\stubpath = "C:\\Windows\\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe"	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}\stubpath = "C:\\Windows\\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe"	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}	{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}\stubpath = "C:\\Windows\\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe"	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe

Executes dropped EXE 12 IoCs

pid	Process
3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe
4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe
364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
1136	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
932	{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe
5092	{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe
File created	C:\Windows\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
File created	C:\Windows\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
File created	C:\Windows\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
File created	C:\Windows\{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
File created	C:\Windows\{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
File created	C:\Windows\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}.exe	{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe
File created	C:\Windows\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
File created	C:\Windows\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
File created	C:\Windows\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
File created	C:\Windows\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe
File created	C:\Windows\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
Token: SeIncBasePriorityPrivilege	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
Token: SeIncBasePriorityPrivilege	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
Token: SeIncBasePriorityPrivilege	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
Token: SeIncBasePriorityPrivilege	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe
Token: SeIncBasePriorityPrivilege	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe
Token: SeIncBasePriorityPrivilege	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
Token: SeIncBasePriorityPrivilege	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
Token: SeIncBasePriorityPrivilege	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
Token: SeIncBasePriorityPrivilege	1136	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
Token: SeIncBasePriorityPrivilege	932	{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3872	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe	86
PID 3780 wrote to memory of 3872	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe	86
PID 3780 wrote to memory of 3872	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe	86
PID 3780 wrote to memory of 3676	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe	87
PID 3780 wrote to memory of 3676	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe	87
PID 3780 wrote to memory of 3676	3780	2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe	87
PID 3872 wrote to memory of 1448	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	88
PID 3872 wrote to memory of 1448	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	88
PID 3872 wrote to memory of 1448	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	88
PID 3872 wrote to memory of 1048	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	89
PID 3872 wrote to memory of 1048	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	89
PID 3872 wrote to memory of 1048	3872	{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe	89
PID 1448 wrote to memory of 4928	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	92
PID 1448 wrote to memory of 4928	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	92
PID 1448 wrote to memory of 4928	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	92
PID 1448 wrote to memory of 1456	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	93
PID 1448 wrote to memory of 1456	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	93
PID 1448 wrote to memory of 1456	1448	{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe	93
PID 4928 wrote to memory of 3188	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	98
PID 4928 wrote to memory of 3188	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	98
PID 4928 wrote to memory of 3188	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	98
PID 4928 wrote to memory of 4492	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	99
PID 4928 wrote to memory of 4492	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	99
PID 4928 wrote to memory of 4492	4928	{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe	99
PID 3188 wrote to memory of 4504	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	101
PID 3188 wrote to memory of 4504	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	101
PID 3188 wrote to memory of 4504	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	101
PID 3188 wrote to memory of 1360	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	102
PID 3188 wrote to memory of 1360	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	102
PID 3188 wrote to memory of 1360	3188	{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe	102
PID 4504 wrote to memory of 4028	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	103
PID 4504 wrote to memory of 4028	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	103
PID 4504 wrote to memory of 4028	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	103
PID 4504 wrote to memory of 4780	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	104
PID 4504 wrote to memory of 4780	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	104
PID 4504 wrote to memory of 4780	4504	{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe	104
PID 4028 wrote to memory of 364	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	105
PID 4028 wrote to memory of 364	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	105
PID 4028 wrote to memory of 364	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	105
PID 4028 wrote to memory of 1876	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	106
PID 4028 wrote to memory of 1876	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	106
PID 4028 wrote to memory of 1876	4028	{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe	106
PID 364 wrote to memory of 1636	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	107
PID 364 wrote to memory of 1636	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	107
PID 364 wrote to memory of 1636	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	107
PID 364 wrote to memory of 1592	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	108
PID 364 wrote to memory of 1592	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	108
PID 364 wrote to memory of 1592	364	{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe	108
PID 1636 wrote to memory of 1072	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	109
PID 1636 wrote to memory of 1072	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	109
PID 1636 wrote to memory of 1072	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	109
PID 1636 wrote to memory of 408	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	110
PID 1636 wrote to memory of 408	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	110
PID 1636 wrote to memory of 408	1636	{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe	110
PID 1072 wrote to memory of 1136	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	111
PID 1072 wrote to memory of 1136	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	111
PID 1072 wrote to memory of 1136	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	111
PID 1072 wrote to memory of 3512	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	112
PID 1072 wrote to memory of 3512	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	112
PID 1072 wrote to memory of 3512	1072	{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe	112
PID 1136 wrote to memory of 932	1136	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe	113
PID 1136 wrote to memory of 932	1136	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe	113
PID 1136 wrote to memory of 932	1136	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe	113
PID 1136 wrote to memory of 1524	1136	{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_13f639db9fa7c146634bc40e71d69059_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
  C:\Windows\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
    C:\Windows\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
      C:\Windows\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
        
        C:\Windows\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3188
      - C:\Windows\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe
        
        C:\Windows\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe
        
        C:\Windows\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
        
        C:\Windows\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:364
        
        C:\Windows\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
        
        C:\Windows\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
        
        C:\Windows\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
        
        C:\Windows\{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe
        
        C:\Windows\{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
        
        C:\Windows\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}.exe
        
        C:\Windows\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}.exe
        13⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02F0B~1.EXE > nul
        13⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B79A~1.EXE > nul
        12⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80CC8~1.EXE > nul
        11⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA682~1.EXE > nul
        10⤵
        
        PID:408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{821B6~1.EXE > nul
        9⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D509~1.EXE > nul
        8⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1C038~1.EXE > nul
        7⤵
        
        PID:4780
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{91BFF~1.EXE > nul
        6⤵
        
        PID:1360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FFB0C~1.EXE > nul
        5⤵
        
        PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0CB82~1.EXE > nul
      4⤵
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CD9F3~1.EXE > nul
    3⤵
    PID:1048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{02F0B663-1630-4931-910E-5E2CA5A661DF}.exe

Filesize
180KB

MD5
51fb12d85baa85e7755a793eec50a109

SHA1
90972b9ad19b7128837246f167a71454099530d4

SHA256
6fdef295bb704243d4e18baf4b4071c3ba1631ec64ecf89d351859174ad3da71

SHA512
70734063a0f2c110fa2d0046c80790604a233e386b2d6c4be788be54cec6050e907f308b5715ecf1104a5b989759bd8768830ae17cbd7c19c75ce5cba3018e94

Download Submit
C:\Windows\{0CB82D67-1416-4aa4-BEC9-912D9CF94C85}.exe

Filesize
180KB

MD5
39ea0160d424d95c5b5b6078a97ee184

SHA1
6201fe442c87114a248e3f0d623746f82106bcc8

SHA256
e41bfa1841fcf974786cc65139b337798a396cd7421a669b2259e216b9d28b9b

SHA512
33d680e09f8a148abcf6f2b78b8ce5b7d9d5ba97226cde85e6b8f273405fbc7f11ae75c7256872191e6f334934e0cbafb6948e8fd13adda9ec875cd986181770

Download Submit
C:\Windows\{1C0383A0-83E3-4d05-BA6E-75DE68A32122}.exe

Filesize
180KB

MD5
57536cd855109c23245a1ead684ea1b8

SHA1
a8434a8611e3c5245878e7990e1cdac9196f63c4

SHA256
c8eddfd1dfd72eaa2291507a07b207e831826e4deb19554842f1f31675f0cb06

SHA512
fa57be5add2e4758127db200f7271b5cf6fb96cbc644d87eb548db5bdedbe8a835198aea9887fa3cd400fa4cff7275050738127ea3b94ed043173f3bfa3cf7d2

Download Submit
C:\Windows\{1D50935F-FE8E-4ec9-837A-AA1B3050A74A}.exe

Filesize
180KB

MD5
8ed3bb0792e494536f9903871f3a87e8

SHA1
d92ed2f8af8c4ece556c037882a72d04dd6f10b0

SHA256
03c1839ccaf9915bd0fa1eda79ebe4b6c677394fc7eaf30d125140044fe796e2

SHA512
75f9dd4867c644e9b336ad8f3e42ecba86b8ded9ef6631762f96a512e19e52557e2728bd43e175ebe338df4034feff2474a2fa5b8fee4d32d18ee67012ac1024

Download Submit
C:\Windows\{3B79A35D-1018-4a35-9B30-F9C22E54F956}.exe

Filesize
180KB

MD5
2f22247208c3d8505c47b04e4d96980b

SHA1
bf658709317e52dcce462f02127e99cac6eb14fb

SHA256
ce79d9b1d2028cd401433b6b33eb0a71a76052587612d4e7f6c411a999eba23c

SHA512
35e223af570056a82a5f609c2c6bd0b9f07d3546a3ef036e50b22ff35c66c25aefb02c4478b7890d843e9bc598c393d6a8aed2b48662ef48a6be541344c7143b

Download Submit
C:\Windows\{80CC883E-646D-485b-8EC7-BD6A6014FCAA}.exe

Filesize
180KB

MD5
4de945c708731551b9b7d3f7de6331d1

SHA1
54ef6f37132ef3fd2ae6ed5d957ed1a9f39ed220

SHA256
b802fc740ce291acc0d2e95600b804457e3d5df2dd9f8a145155c090f30f1a3e

SHA512
c8ff21945e8fba01d2724f8851a0fcd480599b0e6c8eea7b92290f9cf372abbb8b63899f00c16caab37c5e26aef5a02eefa5c3f0cf63b49c9ab2811814537864

Download Submit
C:\Windows\{821B64F6-3C9F-4b90-8B12-8A236C8B7D81}.exe

Filesize
180KB

MD5
22300d75bb10d9b1d1108a40d1a5abae

SHA1
8399c5bed535950c1676585514b68072eebc96e3

SHA256
fde668ae5a13581bd59aeeb2fdd4d0cb11a629de949839a34fbfb904a28d8e27

SHA512
f06d53a0ad9dd6c4c63127aeca83096b7914c031d5cd60b1d5fb6de1961997f8ee11f73249f76c95b561b4fc72c3ba8b3378f8ba70a86ec72aa6f45f82dcde42

Download Submit
C:\Windows\{91BFF716-66F3-4cb6-B3D0-E4C731D1A228}.exe

Filesize
180KB

MD5
214c1788f12d567aa185873a6958532b

SHA1
b0f4e49166434d1a73d365c0ea7cb2977bb7a279

SHA256
ed80a64b4259878a58389de40cc00c08743a174880a3170a53ce103a9a3f3b7c

SHA512
6c142c3cf9f6599c9eb34f40befd587ee949988ab4e58c9ff40989479f9209bd8ab624887a185fc080a51ffba51b3345c7c232b86f08e5206e8ac5afb9cc84dc

Download Submit
C:\Windows\{957576BA-14D6-438d-8BFC-FB5ABEE1F1EB}.exe

Filesize
180KB

MD5
176dfefdcaf20cf94f8cb0f524455409

SHA1
7d57b7d46477e9070f52ba8ef143250efdfbfad3

SHA256
df000b938b773fd58bf710eb8dfc1b0fa6759f4a3038db570bb7680770aaa01d

SHA512
c4410700d2aec16a887239faa2b8221eb7f2d0ed8de8f07240609e3123cdbef9705dc0cc690b2905b0d7c6ce00686ba4cee8c2a79ec7ed51298c0293fe306fcf

Download Submit
C:\Windows\{CD9F3BFF-81CE-4c83-A372-4101D7FE905E}.exe

Filesize
180KB

MD5
f60f7687f0d04f13105d6b18ef7bf640

SHA1
55e0aba4349549dbeff89dd836c05df83799c7ee

SHA256
b9c38f8ae84dcab2b5f82729e1d4b603763339237f97d4f7d5c6bf55269f3dc0

SHA512
dc9cb7ea4098b96da765a1dcb75d772db67edb05c7d3a97345974d4e020d86eddf97eb35d09a8c1cbccbf15180c857038324ac493e17c7bd8ce9481806245d84

Download Submit
C:\Windows\{DA6822DE-A10C-4a6a-AB7D-5E2D7B2E05EC}.exe

Filesize
180KB

MD5
0382ef9e8c2a96646361cee4b20726dd

SHA1
f6d81a2c5da17f3c92c1debbb9e52e9559e6d145

SHA256
b8ebdd1a384dfa54daf3271cd8af72ae4cb2c954c6c5d7cc719fcf1385768b0b

SHA512
5f7e1318de115e999a16e73f8aea67aee4c1617935e708d1833f40ccdc7cf0f991b0982ffaf0102e5f973d8f374b4a43f4afe0ebbf2b9219ae8e052619b67050

Download Submit
C:\Windows\{FFB0C9F4-9FB6-4216-A9CA-633E2D5D264B}.exe

Filesize
180KB

MD5
8f5a7532fa0fa00cdc2a46c3bc7dc420

SHA1
dfe299169a701f4adcf92c9dcb1d23ef8fcb296f

SHA256
5df6a7c3c87efa40288942b7906c2439fd5c393b3956044f9edd388c055a11c2

SHA512
f622d983f7591de10972490d4001ba1953f2da8eb444141cc3d405bb1b25615fbccd42ee5f33d5045eb48d7dc16799a42df99d8ad63faa693592adb5ce14a989

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads