982f72417d879885855a2ee5df32c587dcdc7019227f83869d2a81982f0f5eda

Analysis

max time kernel
63s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe
Size

192KB
MD5

b0bc7bff58787ec7beb45155d3d49acc
SHA1

fa2254804db93f7035ff8b009929cee4eee176de
SHA256

982f72417d879885855a2ee5df32c587dcdc7019227f83869d2a81982f0f5eda
SHA512

93a18f35869f1745afd56e773aeda31fc8a98d29d87a86a8fbd81fcaca7c97664a9a6daaf1c069b5eb7d19048649aafdc36aeb073f9006ca8a038ac88e9b9230
SSDEEP

1536:1EGh0o2l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o2l1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13E7B173-A794-4611-A3A2-23486B43F8DA}	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13E7B173-A794-4611-A3A2-23486B43F8DA}\stubpath = "C:\\Windows\\{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe"	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}\stubpath = "C:\\Windows\\{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe"	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}\stubpath = "C:\\Windows\\{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe"	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}\stubpath = "C:\\Windows\\{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe"	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D265360A-F07D-40bf-8E6A-007C86DFFA0F}	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D265360A-F07D-40bf-8E6A-007C86DFFA0F}\stubpath = "C:\\Windows\\{D265360A-F07D-40bf-8E6A-007C86DFFA0F}.exe"	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe

Executes dropped EXE 5 IoCs

pid	Process
2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe
3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe
4820	{D265360A-F07D-40bf-8E6A-007C86DFFA0F}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
File created	C:\Windows\{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
File created	C:\Windows\{D265360A-F07D-40bf-8E6A-007C86DFFA0F}.exe	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe
File created	C:\Windows\{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe
File created	C:\Windows\{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe
Token: SeIncBasePriorityPrivilege	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
Token: SeIncBasePriorityPrivilege	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
Token: SeIncBasePriorityPrivilege	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2508	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe	98
PID 2372 wrote to memory of 2508	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe	98
PID 2372 wrote to memory of 2508	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe	98
PID 2372 wrote to memory of 1792	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe	99
PID 2372 wrote to memory of 1792	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe	99
PID 2372 wrote to memory of 1792	2372	2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe	99
PID 2508 wrote to memory of 3196	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	102
PID 2508 wrote to memory of 3196	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	102
PID 2508 wrote to memory of 3196	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	102
PID 2508 wrote to memory of 5088	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	101
PID 2508 wrote to memory of 5088	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	101
PID 2508 wrote to memory of 5088	2508	{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe	101
PID 3196 wrote to memory of 4676	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	106
PID 3196 wrote to memory of 4676	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	106
PID 3196 wrote to memory of 4676	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	106
PID 3196 wrote to memory of 488	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	105
PID 3196 wrote to memory of 488	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	105
PID 3196 wrote to memory of 488	3196	{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe	105
PID 4676 wrote to memory of 3968	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	107
PID 4676 wrote to memory of 3968	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	107
PID 4676 wrote to memory of 3968	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	107
PID 4676 wrote to memory of 1888	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	108
PID 4676 wrote to memory of 1888	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	108
PID 4676 wrote to memory of 1888	4676	{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe	108
PID 3968 wrote to memory of 4820	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	109
PID 3968 wrote to memory of 4820	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	109
PID 3968 wrote to memory of 4820	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	109
PID 3968 wrote to memory of 4448	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	110
PID 3968 wrote to memory of 4448	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	110
PID 3968 wrote to memory of 4448	3968	{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_b0bc7bff58787ec7beb45155d3d49acc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe
  C:\Windows\{9467132E-8DB5-4ef2-8D35-FBDB5E3A30A1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{94671~1.EXE > nul
    3⤵
    PID:5088
- - C:\Windows\{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
    C:\Windows\{13E7B173-A794-4611-A3A2-23486B43F8DA}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{13E7B~1.EXE > nul
      4⤵
      PID:488
  - - C:\Windows\{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
      C:\Windows\{139C7C7C-6F7E-49c4-9566-35614ED9CDE0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Windows\{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe
        
        C:\Windows\{0F7F5ADE-93FB-4f4b-A196-311B6679BB4A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Windows\{D265360A-F07D-40bf-8E6A-007C86DFFA0F}.exe
        
        C:\Windows\{D265360A-F07D-40bf-8E6A-007C86DFFA0F}.exe
        6⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D2653~1.EXE > nul
        7⤵
        
        PID:2208
        
        C:\Windows\{0AAB8A54-E823-43db-8069-10EB684CBB0F}.exe
        
        C:\Windows\{0AAB8A54-E823-43db-8069-10EB684CBB0F}.exe
        7⤵
        
        PID:5024
        
        C:\Windows\{46674780-AEA8-4b97-93F1-B193424DAF8E}.exe
        
        C:\Windows\{46674780-AEA8-4b97-93F1-B193424DAF8E}.exe
        8⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46674~1.EXE > nul
        9⤵
        
        PID:5016
        
        C:\Windows\{E845E29C-5861-4bf5-BF3C-7F57AE5BE384}.exe
        
        C:\Windows\{E845E29C-5861-4bf5-BF3C-7F57AE5BE384}.exe
        9⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E845E~1.EXE > nul
        10⤵
        
        PID:2468
        
        C:\Windows\{75ECE747-CF72-4e60-BA11-10E67BAFC8F5}.exe
        
        C:\Windows\{75ECE747-CF72-4e60-BA11-10E67BAFC8F5}.exe
        10⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75ECE~1.EXE > nul
        11⤵
        
        PID:4056
        
        C:\Windows\{56A41B04-962B-4998-8F8C-48751323F2A9}.exe
        
        C:\Windows\{56A41B04-962B-4998-8F8C-48751323F2A9}.exe
        11⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56A41~1.EXE > nul
        12⤵
        
        PID:976
        
        C:\Windows\{5644DF50-9464-4369-8D6C-1D359FFC4174}.exe
        
        C:\Windows\{5644DF50-9464-4369-8D6C-1D359FFC4174}.exe
        12⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0AAB8~1.EXE > nul
        8⤵
        
        PID:2280
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0F7F5~1.EXE > nul
        6⤵
        
        PID:4448
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{139C7~1.EXE > nul
        5⤵
        
        PID:1888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{75ECE747-CF72-4e60-BA11-10E67BAFC8F5}.exe

Filesize
5KB

MD5
198c3c0b4fd73918aebca7717fba5730

SHA1
a25f1a366379582cb8e4c001003d689457caccdd

SHA256
7a55bc192800885933e2e38feba5a253e00460ab2e5ac6c3d99167bfe3632674

SHA512
12a03cc383caca11ed0462fc14b3a85ae6a64aa6d6b662ee587d4c00cf682f985e49728f63dd2926c20423791acf6e8a5742e05d62da8a72a5fc185b6f46299b

Download Submit
C:\Windows\{75ECE747-CF72-4e60-BA11-10E67BAFC8F5}.exe

Filesize
18KB

MD5
31fb1b3706d00a93e568cb518d79dea3

SHA1
a748523d6c3b35360cf86fb0710d9f9f240e6cf2

SHA256
f1b755ad17eb4f1b929a989514b616afbfd2ded6b2c5bbdf2be1da3f9c4a1661

SHA512
a6d026006297dccf0713a7397d12b92397a14fe989f04b1b2ccc376580ebb015089bf167ff35f3ec75f81fd9f97b59e9181f767a7114973eb9d873d7c55687f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads