27c7d6c945b165531fa5aa2ea71ebdb83411b26e0af1107105e45c10e6ea120b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe
Size 380KB
Sample240613-dfphyawakk
SHA256 27c7d6c945b165531fa5aa2ea71ebdb83411b26e0af1107105e45c10e6ea120b
MD5 98bd909f2803b46026128c294dbba31e
SHA1 ac5c161c42795cc320ac83b43b1a000e9b8f7fec
SHA512 b338ce4d4879b76e94ffdde1c907bcf47db7a9d6c18860b0bfd8fcea524b57fad1038ecff073955f09e15b0cfce4bc69130109ff39bdf11db73663bf3c104d7e
SSDEEP 3072:mEGh0oilPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG8l7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023420-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023425-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000022937-11.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023425-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000022937-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023425-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000022937-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023425-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000022937-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023425-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000022937-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023425-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD743763-555D-49e2-AEA6-C1BAEA003586}\stubpath = "C:\\Windows\\{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe"	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9B389E9-687F-447d-A044-C47C5AEA9432}	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}\stubpath = "C:\\Windows\\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe"	{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}\stubpath = "C:\\Windows\\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe"	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1DFA0AD-1631-4078-9098-9C73087E2127}\stubpath = "C:\\Windows\\{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe"	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}\stubpath = "C:\\Windows\\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe"	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}\stubpath = "C:\\Windows\\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe"	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C67AB295-7CA8-4aba-89A5-209677EC1D40}	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C67AB295-7CA8-4aba-89A5-209677EC1D40}\stubpath = "C:\\Windows\\{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe"	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}	{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}\stubpath = "C:\\Windows\\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe"	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B960C84D-D1FA-493f-9B24-B236F7ED4808}	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B960C84D-D1FA-493f-9B24-B236F7ED4808}\stubpath = "C:\\Windows\\{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe"	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8EB0103-246D-4b26-B428-181DC6DA35D7}	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8EB0103-246D-4b26-B428-181DC6DA35D7}\stubpath = "C:\\Windows\\{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe"	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD743763-555D-49e2-AEA6-C1BAEA003586}	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9B389E9-687F-447d-A044-C47C5AEA9432}\stubpath = "C:\\Windows\\{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe"	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}\stubpath = "C:\\Windows\\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe"	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1DFA0AD-1631-4078-9098-9C73087E2127}	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe

Executes dropped EXE 12 IoCs

pid	Process
848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
5948	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
5820	{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
4460	{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
File created	C:\Windows\{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
File created	C:\Windows\{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
File created	C:\Windows\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe	{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
File created	C:\Windows\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe
File created	C:\Windows\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
File created	C:\Windows\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
File created	C:\Windows\{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
File created	C:\Windows\{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
File created	C:\Windows\{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
File created	C:\Windows\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
File created	C:\Windows\{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
Token: SeIncBasePriorityPrivilege	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
Token: SeIncBasePriorityPrivilege	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
Token: SeIncBasePriorityPrivilege	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
Token: SeIncBasePriorityPrivilege	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
Token: SeIncBasePriorityPrivilege	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
Token: SeIncBasePriorityPrivilege	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
Token: SeIncBasePriorityPrivilege	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
Token: SeIncBasePriorityPrivilege	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
Token: SeIncBasePriorityPrivilege	5948	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
Token: SeIncBasePriorityPrivilege	5820	{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 848	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe	84
PID 4576 wrote to memory of 848	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe	84
PID 4576 wrote to memory of 848	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe	84
PID 4576 wrote to memory of 3956	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe	85
PID 4576 wrote to memory of 3956	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe	85
PID 4576 wrote to memory of 3956	4576	2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe	85
PID 848 wrote to memory of 1936	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	86
PID 848 wrote to memory of 1936	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	86
PID 848 wrote to memory of 1936	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	86
PID 848 wrote to memory of 2232	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	87
PID 848 wrote to memory of 2232	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	87
PID 848 wrote to memory of 2232	848	{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe	87
PID 1936 wrote to memory of 6000	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	91
PID 1936 wrote to memory of 6000	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	91
PID 1936 wrote to memory of 6000	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	91
PID 1936 wrote to memory of 5252	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	92
PID 1936 wrote to memory of 5252	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	92
PID 1936 wrote to memory of 5252	1936	{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe	92
PID 6000 wrote to memory of 5888	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	93
PID 6000 wrote to memory of 5888	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	93
PID 6000 wrote to memory of 5888	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	93
PID 6000 wrote to memory of 440	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	94
PID 6000 wrote to memory of 440	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	94
PID 6000 wrote to memory of 440	6000	{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe	94
PID 5888 wrote to memory of 2040	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	95
PID 5888 wrote to memory of 2040	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	95
PID 5888 wrote to memory of 2040	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	95
PID 5888 wrote to memory of 4388	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	96
PID 5888 wrote to memory of 4388	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	96
PID 5888 wrote to memory of 4388	5888	{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe	96
PID 2040 wrote to memory of 2264	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	97
PID 2040 wrote to memory of 2264	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	97
PID 2040 wrote to memory of 2264	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	97
PID 2040 wrote to memory of 5868	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	98
PID 2040 wrote to memory of 5868	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	98
PID 2040 wrote to memory of 5868	2040	{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe	98
PID 2264 wrote to memory of 5280	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	99
PID 2264 wrote to memory of 5280	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	99
PID 2264 wrote to memory of 5280	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	99
PID 2264 wrote to memory of 2380	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	100
PID 2264 wrote to memory of 2380	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	100
PID 2264 wrote to memory of 2380	2264	{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe	100
PID 5280 wrote to memory of 2392	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	101
PID 5280 wrote to memory of 2392	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	101
PID 5280 wrote to memory of 2392	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	101
PID 5280 wrote to memory of 3244	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	102
PID 5280 wrote to memory of 3244	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	102
PID 5280 wrote to memory of 3244	5280	{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe	102
PID 2392 wrote to memory of 2844	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	103
PID 2392 wrote to memory of 2844	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	103
PID 2392 wrote to memory of 2844	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	103
PID 2392 wrote to memory of 3672	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	104
PID 2392 wrote to memory of 3672	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	104
PID 2392 wrote to memory of 3672	2392	{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe	104
PID 2844 wrote to memory of 5948	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	105
PID 2844 wrote to memory of 5948	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	105
PID 2844 wrote to memory of 5948	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	105
PID 2844 wrote to memory of 2412	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	106
PID 2844 wrote to memory of 2412	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	106
PID 2844 wrote to memory of 2412	2844	{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe	106
PID 5948 wrote to memory of 5820	5948	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe	107
PID 5948 wrote to memory of 5820	5948	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe	107
PID 5948 wrote to memory of 5820	5948	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe	107
PID 5948 wrote to memory of 5984	5948	{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_98bd909f2803b46026128c294dbba31e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
  C:\Windows\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
    C:\Windows\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
      C:\Windows\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\Windows\{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
        
        C:\Windows\{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5888
      - C:\Windows\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
        
        C:\Windows\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
        
        C:\Windows\{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
        
        C:\Windows\{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5280
        
        C:\Windows\{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
        
        C:\Windows\{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
        
        C:\Windows\{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
        
        C:\Windows\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Windows\{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
        
        C:\Windows\{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5820
        
        C:\Windows\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe
        
        C:\Windows\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe
        13⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C67AB~1.EXE > nul
        13⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CF3BD~1.EXE > nul
        12⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9B38~1.EXE > nul
        11⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B960C~1.EXE > nul
        10⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AD743~1.EXE > nul
        9⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8EB0~1.EXE > nul
        8⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80C8D~1.EXE > nul
        7⤵
        
        PID:5868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1DFA~1.EXE > nul
        6⤵
        
        PID:4388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D497~1.EXE > nul
        5⤵
        
        PID:440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1F8EC~1.EXE > nul
      4⤵
      PID:5252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0814B~1.EXE > nul
    3⤵
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe

Path C:\Windows\{0814BCD2-DED1-4ff8-A3C9-6A94B3828E7F}.exe
Size 380KB
SHA256 2806f1f341107ca6ae2a78013105c08120a8144759221e08c0eedfac1f038798
MD5 52823efbf6aef3d9c326ab6a271e1552
SHA1 317ae1b2d6f25416f9f88a7a62597a14a616fb77
SHA512 21fb7ed1fb19375807ce033ce1dfae2fce5b7c7940018dc4e15ab1539b595884906ae60a318a8a1f523488b4c31be6b48584b671d07aab333aaa2203715a4abb
SSDEEP 3072:mEGh0oDlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGtl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe

Path C:\Windows\{1F8EC8B9-5CA1-417a-9C73-DDAE5507DAA3}.exe
Size 380KB
SHA256 217c9d7970ae121b10c6170036dd59a43d880d6618444b77fe53b2df9a97021f
MD5 78d4bef526e9116d80e7395279c64c08
SHA1 dde80015eff04278e7bfcbe5d02733058309b861
SHA512 19c3c3d7ef422c1cc376c9eab3a362c2736008262b739c17f5d902296dc8dbc38dd10fe93a14ce29d0651475fa2706029ab090d20534e35b3b6c8d364713a9b0
SSDEEP 3072:mEGh0ojlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGpl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe

Path C:\Windows\{3D497C7E-978A-4fc8-8270-7E67924CB8A9}.exe
Size 380KB
SHA256 f06ee8098da205444b0f2e8bf68c1952984734591ea15294c19d839db83098e1
MD5 cb33359000816c8a026d3ddf9528d524
SHA1 c3bb7288eea1920517411e460a4ba860b144ad88
SHA512 38fa916f13e83418ac6db9957dd08d14a939caf4a8fe7229d52d3fa8dddcdb23299f4fbf0711ac5d8fcc34a5a190fb968a37d057cb641838dd788c029c6fb27f
SSDEEP 3072:mEGh0oulPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGAl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe

Path C:\Windows\{80C8D2B4-CCDA-43b8-AACF-1A368D0620B8}.exe
Size 380KB
SHA256 89d27322f07007e6f9fb3563b88ecdadb80e00fd24e644639cda740f0f277f40
MD5 2a5ac109f4062f384b6e29cc14c8f549
SHA1 dd49e0c840db7dca8a7db5703bdd722c4c4c1d59
SHA512 fcd9d0e5f78fe1a214270746ceb1fee749da6b6fc8454e17aa184c6fba2cf4c7a83ea6ad109badd1fc4537b3773e7af612599b5b5d0da811ab1f8fe51c2696b9
SSDEEP 3072:mEGh0onlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGNl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe

Path C:\Windows\{AD743763-555D-49e2-AEA6-C1BAEA003586}.exe
Size 380KB
SHA256 981d82e7dbacbf7cdfd62d460b50f5536268ee8b5890c9e1977a941f711c91aa
MD5 d128ee8d89092eacdc000390015433e5
SHA1 bb5ae6ebb15485a332f93c714bf4ef1c8b096c23
SHA512 672ced2033f208c1682ab740c2156a28e6d28d16fc3bcbbd017ce4d7b693316a233f07004d3ad6205ada050799ece31f774f02c69828513d609d66d3a93e5e8c
SSDEEP 3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGAl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe

Path C:\Windows\{B1DFA0AD-1631-4078-9098-9C73087E2127}.exe
Size 380KB
SHA256 a9581c8715a85deb10a04eca45c02c306231c1e8f2ea576868fc8d3da869136d
MD5 651c7e2defdce533a58eea8c4c5252e4
SHA1 f6c552dd4c0c20fbfbc1fc910f1587fd123a69ca
SHA512 f8052254f99aafcb73886ed59c695c4f90df7aeedeea4ff05a20e2c3dde0d289b9fd5a03816cf9ec1a4a32b4826bc9c837c075f39f04611e4affbcd7bff58ec8
SSDEEP 3072:mEGh0ohlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGHl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe

Path C:\Windows\{B8EB0103-246D-4b26-B428-181DC6DA35D7}.exe
Size 380KB
SHA256 378f3c54c2a6dae11504d1851bf81e25ca0cd603a3a8df59e84254f8620525e4
MD5 6e65a2c44cb0b905d2a91eca637c65e5
SHA1 5d7b6494755dee111b1091ef405d53ae41c7ec32
SHA512 92c24d9ac83920e720ac679f036b4d40cbb01695fe9bbdb9e92e9ae18efcbaf7aad5240dbc9cc22cdd7bdf035cd74e1a439113156f0f5a2ad16432380a73d98b
SSDEEP 3072:mEGh0oElPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGal7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe

Path C:\Windows\{B960C84D-D1FA-493f-9B24-B236F7ED4808}.exe
Size 380KB
SHA256 13d38855c9bc19ba1a127bcd1a0c945b0a9a4a58a50ed3191006efea41a72a01
MD5 79ec7f35f86e7d2aa4fef185cc80db48
SHA1 7311085cd12fca1fe11411d9b3cdc9700672dae5
SHA512 cb64afca2bf3be729bf6eb7fc55446ccfb17277af40870e605a3059e6bf465fb83ee8e85ea856060100044f1eb89b02773b0d250edc8268b62a522dd167bc79a
SSDEEP 3072:mEGh0oClPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGYl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe

Path C:\Windows\{C67AB295-7CA8-4aba-89A5-209677EC1D40}.exe
Size 380KB
SHA256 5b717299ff5f9be0289cdf7208c17d0f313292f3e54365943b8c8f7872aa5cf4
MD5 52cb2e77d3413672a05a92c795772528
SHA1 900b1c9ab4b47183e814352c45ecba32db4f7870
SHA512 404a10c5a679c467d943b7849b4e1cec94307b7466193935814cd670212096676977bd255c99e9100688a6be8e396e3e1059f8c6e240b67610bd39702f13eb62
SSDEEP 3072:mEGh0oZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGLl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe

Path C:\Windows\{CF3BD0A5-AF11-40fc-8B2A-7371016FCE50}.exe
Size 380KB
SHA256 4d443ffab21bb4a9d5bb66d64fc45bfc7961164d7dd802b86072246d020b482c
MD5 daa2522cbd811479c4430d5a8734ad31
SHA1 eb9701c55b213775d6a2338d622f7b13f0c8669f
SHA512 747bbf7bc13cfde6c4ea44cfc864e67f3c33050525b3d506107c947bfbf961dee96938a5bcf3bb79888a01ebdf6542f9b05220e43e06cefabfb0fb14bb7c4c7b
SSDEEP 3072:mEGh0oLlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGNl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe

Path C:\Windows\{F9B389E9-687F-447d-A044-C47C5AEA9432}.exe
Size 380KB
SHA256 40a006823f5dd4655ed5344b6836d115e84ca5e4b8fc81115a152be38903249e
MD5 ae73afcec30ed8b2f0089858b13f1f38
SHA1 cc703f30013dc20a53c4b67bfbe4ab6138c52f31
SHA512 e86d62b3a6f9712d5714e3f335dece6c6d8405a17e7674b6f64903b4468834a0ac89d813f11b751a2466f9a78ea0ce320ee11f69a49c5e329ad1b4b4c7bb865f
SSDEEP 3072:mEGh0oLlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGhl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe

Path C:\Windows\{FA1C9497-2C7E-4219-A4F8-9E73BD2C884C}.exe
Size 380KB
SHA256 988cc4e02773459e80e255a1b3eff392eff96ffc470ee7486fa8593a2725efc4
MD5 3ab199f27449d1436f5b5e7c04de0f65
SHA1 a313928b9c16bd6bcdd6f270f26dad8680a4b974
SHA512 0aba75c12afae2bd0e4e491daaa775f325792ea6f3ae346da534b541c931b416de4a9d7776ae7761311d2828487441f520df4357e4e87f7133249ed8f841fdcb
SSDEEP 3072:mEGh0oKlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGYl7Oe2MUVg3v2IneKcAEcARy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads