b70b3663386967bdbccd1f9d7adec8ad97db5465439335ed457fcab17a430c6a

Analysis

max time kernel
75s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe
Size

180KB
MD5

7012a1fa66ee63a0502baa9205a0c8dd
SHA1

ed31ec1270c98f76cfea88141c71862d2e4f0962
SHA256

b70b3663386967bdbccd1f9d7adec8ad97db5465439335ed457fcab17a430c6a
SHA512

7654939c059fa62c614fe60cecaf41b11b34b31673febf8e55aa13ba66b70f49f0174e6c5db191e553192133ac5b945ffb41f0052659cf3fb53337dd450a7f2e
SSDEEP

3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGJl5eKcAEc

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05567006-B21A-406c-8DBB-D1C42EA29A15}\stubpath = "C:\\Windows\\{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe"	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89F2360-EF13-4121-8794-58FCA5328EFE}	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89F2360-EF13-4121-8794-58FCA5328EFE}\stubpath = "C:\\Windows\\{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe"	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}\stubpath = "C:\\Windows\\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe"	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}\stubpath = "C:\\Windows\\{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe"	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}\stubpath = "C:\\Windows\\{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}.exe"	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05567006-B21A-406c-8DBB-D1C42EA29A15}	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}\stubpath = "C:\\Windows\\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe"	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe

Executes dropped EXE 6 IoCs

pid	Process
4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe
3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe
4676	{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe
File created	C:\Windows\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
File created	C:\Windows\{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
File created	C:\Windows\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
File created	C:\Windows\{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe
File created	C:\Windows\{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}.exe	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
Token: SeIncBasePriorityPrivilege	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
Token: SeIncBasePriorityPrivilege	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
Token: SeIncBasePriorityPrivilege	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe
Token: SeIncBasePriorityPrivilege	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 4528	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe	98
PID 1064 wrote to memory of 4528	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe	98
PID 1064 wrote to memory of 4528	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe	98
PID 1064 wrote to memory of 4184	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe	97
PID 1064 wrote to memory of 4184	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe	97
PID 1064 wrote to memory of 4184	1064	2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe	97
PID 4528 wrote to memory of 5000	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	102
PID 4528 wrote to memory of 5000	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	102
PID 4528 wrote to memory of 5000	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	102
PID 4528 wrote to memory of 3896	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	101
PID 4528 wrote to memory of 3896	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	101
PID 4528 wrote to memory of 3896	4528	{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe	101
PID 5000 wrote to memory of 4524	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	105
PID 5000 wrote to memory of 4524	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	105
PID 5000 wrote to memory of 4524	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	105
PID 5000 wrote to memory of 2992	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	104
PID 5000 wrote to memory of 2992	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	104
PID 5000 wrote to memory of 2992	5000	{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe	104
PID 4524 wrote to memory of 2356	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	111
PID 4524 wrote to memory of 2356	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	111
PID 4524 wrote to memory of 2356	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	111
PID 4524 wrote to memory of 812	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	110
PID 4524 wrote to memory of 812	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	110
PID 4524 wrote to memory of 812	4524	{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe	110
PID 2356 wrote to memory of 3028	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	113
PID 2356 wrote to memory of 3028	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	113
PID 2356 wrote to memory of 3028	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	113
PID 2356 wrote to memory of 4344	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	112
PID 2356 wrote to memory of 4344	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	112
PID 2356 wrote to memory of 4344	2356	{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe	112
PID 3028 wrote to memory of 4676	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	115
PID 3028 wrote to memory of 4676	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	115
PID 3028 wrote to memory of 4676	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	115
PID 3028 wrote to memory of 1064	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	114
PID 3028 wrote to memory of 1064	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	114
PID 3028 wrote to memory of 1064	3028	{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_7012a1fa66ee63a0502baa9205a0c8dd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4184
- C:\Windows\{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
  C:\Windows\{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{05567~1.EXE > nul
    3⤵
    PID:3896
- - C:\Windows\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
    C:\Windows\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{032FD~1.EXE > nul
      4⤵
      PID:2992
  - - C:\Windows\{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
      C:\Windows\{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E89F2~1.EXE > nul
        5⤵
        
        PID:812
    - - C:\Windows\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe
        
        C:\Windows\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2356
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{73362~1.EXE > nul
        6⤵
        
        PID:4344
      - C:\Windows\{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe
        
        C:\Windows\{37CAF2A3-3A73-4583-B829-EC9FB89B6BFC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{37CAF~1.EXE > nul
        7⤵
        
        PID:1064
        
        C:\Windows\{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}.exe
        
        C:\Windows\{A937AE2F-4A38-4ac6-A1A5-759BADE1F236}.exe
        7⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A937A~1.EXE > nul
        8⤵
        
        PID:3584
        
        C:\Windows\{5536D38F-833B-47fd-AAE2-20741A7B937B}.exe
        
        C:\Windows\{5536D38F-833B-47fd-AAE2-20741A7B937B}.exe
        8⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5536D~1.EXE > nul
        9⤵
        
        PID:3304
        
        C:\Windows\{E0A8117D-A36C-41af-9014-FDE04A6A3978}.exe
        
        C:\Windows\{E0A8117D-A36C-41af-9014-FDE04A6A3978}.exe
        9⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0A81~1.EXE > nul
        10⤵
        
        PID:2140
        
        C:\Windows\{612FAFFA-DA6A-4836-83F7-3BFBE2A60C75}.exe
        
        C:\Windows\{612FAFFA-DA6A-4836-83F7-3BFBE2A60C75}.exe
        10⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{612FA~1.EXE > nul
        11⤵
        
        PID:5068
        
        C:\Windows\{DA2F3FBC-5F20-4013-90BD-E858CA781EDC}.exe
        
        C:\Windows\{DA2F3FBC-5F20-4013-90BD-E858CA781EDC}.exe
        11⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA2F3~1.EXE > nul
        12⤵
        
        PID:2496
        
        C:\Windows\{BEA99D70-B6F9-4f17-96C0-EF36C0864694}.exe
        
        C:\Windows\{BEA99D70-B6F9-4f17-96C0-EF36C0864694}.exe
        12⤵
        
        PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{032FD2F2-33A9-43a1-B6D2-66EE18A234A2}.exe

Filesize
180KB

MD5
733830bceef6be8829edfa4cc8bc729f

SHA1
ecca1ee9633f38c5530124b09c8346c0a2afbf42

SHA256
ddee262b3110c622d971ae69718aba87226ab44e5cd8ea5188fbeca1b97a1f81

SHA512
d4fba7c21e75d44cd9e3a8fdc1a8588354b10a21441afc2490f0a5a0b2aca099806b9695e16aa2d3259a264ed229a542573a57f2fa004069141d2e01a1103ae1

Download Submit
C:\Windows\{05567006-B21A-406c-8DBB-D1C42EA29A15}.exe

Filesize
180KB

MD5
c0e6b331bc0bd2a51ed7f946bda39de6

SHA1
d3bda868523154d5117136158337b560cd844b49

SHA256
58be64d7525887a7f6f2279a4a870c273f966052e2e0d309c7402afe2197c5df

SHA512
93133d4cc311dfb77fee4a6f25517908d66786240cebb2ab086d6bcc800529be220a3dd7f13554e18943b767e813edfb4feac3cd97c475b0fcf93dde97add844

Download Submit
C:\Windows\{73362BF0-13E1-4f88-8B36-23310E2ADF6A}.exe

Filesize
180KB

MD5
194c428343c34911304df6a1bec5e4f9

SHA1
135dc829aefec3d0219bfbf256f3c11b60d1555c

SHA256
dbf956dc121c214352dd7ff5e1890d5db7401c7ce707026d08fad0cd32120199

SHA512
89b65ed5932e06e28c28a0e69e5ac6773840d377b4bac5454ed485ffb25bcac33c929c5b357f541d651ef0d4193aa3681adcda98d3b647f77a45d059335b6e57

Download Submit
C:\Windows\{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe

Filesize
180KB

MD5
8f145849fa30d324c75da215abcbdf4b

SHA1
a304e6f58b113422aa1526a7893838daa0508d85

SHA256
a0421bbede475d6de2d1bd0c1a6f553ae1f45684008e4c96aa2d8ead15339a6c

SHA512
51ff457b565f28abe4ff1f44fc8fcd3a37f7dc2e1bd1b32c58a667fd24a2e0c149b778375cc3f42ad143b59886ebecb3b2045474b36ececef03c13736007ed12

Download Submit
C:\Windows\{E89F2360-EF13-4121-8794-58FCA5328EFE}.exe

Filesize
92KB

MD5
85e82cec37774c31a7c688f9649a3c0e

SHA1
803ca89953f494e15d7eecc5729d62c5307561cd

SHA256
c128d90f30d9ca8697b8f0ac2a9ba1567de4b5a0372f124cc4c897e6c2d1e809

SHA512
46022704e4a51714ea83838704dc07a6ece660cc130c8c36910dfbc14c53c812684264cc304fcc94ffc7e30026eb4f41c12445e09ace969e36879b22828e1ecf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads