1e50e434b8fc65bd928a978763b4ea4cbaa75245ea0303321e6eaba9cf56804a

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
Size

168KB
MD5

8e1430dc238ca16665bc1c5fcc240dad
SHA1

89784187ffa7de327edfa66c24e09fbf356bbdbc
SHA256

1e50e434b8fc65bd928a978763b4ea4cbaa75245ea0303321e6eaba9cf56804a
SHA512

954542911cc106d3c714c5e37011059d9847014d7f8c353ba969a68e08e026147ada799b85813bc7d865756132757302454b585cf7fa38aafc45495f079736e8
SSDEEP

1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4AFDDDFE-D848-439a-A2C9-906183874C0A}\stubpath = "C:\\Windows\\{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe"	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7578ED56-4607-4ac6-831D-7256B2330B92}\stubpath = "C:\\Windows\\{7578ED56-4607-4ac6-831D-7256B2330B92}.exe"	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}	{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9641D220-FD3F-4cde-BC27-845012B6D2F1}\stubpath = "C:\\Windows\\{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe"	{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9641D220-FD3F-4cde-BC27-845012B6D2F1}	{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E3902196-96D7-4a6b-BD67-27F909B6D36B}\stubpath = "C:\\Windows\\{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe"	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87D989EA-92EF-426f-9BE6-923A3C5E3102}	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87D989EA-92EF-426f-9BE6-923A3C5E3102}\stubpath = "C:\\Windows\\{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe"	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8227467-FF08-4289-B0EF-A142914EA51D}\stubpath = "C:\\Windows\\{C8227467-FF08-4289-B0EF-A142914EA51D}.exe"	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}\stubpath = "C:\\Windows\\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe"	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7578ED56-4607-4ac6-831D-7256B2330B92}	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}\stubpath = "C:\\Windows\\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe"	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4AFDDDFE-D848-439a-A2C9-906183874C0A}	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8227467-FF08-4289-B0EF-A142914EA51D}	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5C85A42-800F-4b06-864F-4985C6201AA2}\stubpath = "C:\\Windows\\{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe"	{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}\stubpath = "C:\\Windows\\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe"	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E3902196-96D7-4a6b-BD67-27F909B6D36B}	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}\stubpath = "C:\\Windows\\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe"	{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5C85A42-800F-4b06-864F-4985C6201AA2}	{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe

Deletes itself 1 IoCs

pid	Process
2116	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
1988	{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
1536	{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
2184	{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe
904	{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
File created	C:\Windows\{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
File created	C:\Windows\{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
File created	C:\Windows\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
File created	C:\Windows\{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe	{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
File created	C:\Windows\{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
File created	C:\Windows\{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
File created	C:\Windows\{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
File created	C:\Windows\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
File created	C:\Windows\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe	{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
File created	C:\Windows\{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe	{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
Token: SeIncBasePriorityPrivilege	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
Token: SeIncBasePriorityPrivilege	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
Token: SeIncBasePriorityPrivilege	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
Token: SeIncBasePriorityPrivilege	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
Token: SeIncBasePriorityPrivilege	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
Token: SeIncBasePriorityPrivilege	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
Token: SeIncBasePriorityPrivilege	1988	{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
Token: SeIncBasePriorityPrivilege	1536	{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
Token: SeIncBasePriorityPrivilege	2184	{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2236	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	31
PID 1420 wrote to memory of 2236	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	31
PID 1420 wrote to memory of 2236	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	31
PID 1420 wrote to memory of 2236	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	31
PID 1420 wrote to memory of 2116	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	32
PID 1420 wrote to memory of 2116	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	32
PID 1420 wrote to memory of 2116	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	32
PID 1420 wrote to memory of 2116	1420	2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe	32
PID 2236 wrote to memory of 2760	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	33
PID 2236 wrote to memory of 2760	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	33
PID 2236 wrote to memory of 2760	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	33
PID 2236 wrote to memory of 2760	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	33
PID 2236 wrote to memory of 2820	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	34
PID 2236 wrote to memory of 2820	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	34
PID 2236 wrote to memory of 2820	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	34
PID 2236 wrote to memory of 2820	2236	{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe	34
PID 2760 wrote to memory of 2620	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	35
PID 2760 wrote to memory of 2620	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	35
PID 2760 wrote to memory of 2620	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	35
PID 2760 wrote to memory of 2620	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	35
PID 2760 wrote to memory of 2924	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	36
PID 2760 wrote to memory of 2924	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	36
PID 2760 wrote to memory of 2924	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	36
PID 2760 wrote to memory of 2924	2760	{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe	36
PID 2620 wrote to memory of 2168	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	37
PID 2620 wrote to memory of 2168	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	37
PID 2620 wrote to memory of 2168	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	37
PID 2620 wrote to memory of 2168	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	37
PID 2620 wrote to memory of 2728	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	38
PID 2620 wrote to memory of 2728	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	38
PID 2620 wrote to memory of 2728	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	38
PID 2620 wrote to memory of 2728	2620	{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe	38
PID 2168 wrote to memory of 2736	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	39
PID 2168 wrote to memory of 2736	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	39
PID 2168 wrote to memory of 2736	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	39
PID 2168 wrote to memory of 2736	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	39
PID 2168 wrote to memory of 2324	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	40
PID 2168 wrote to memory of 2324	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	40
PID 2168 wrote to memory of 2324	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	40
PID 2168 wrote to memory of 2324	2168	{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe	40
PID 2736 wrote to memory of 2704	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	41
PID 2736 wrote to memory of 2704	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	41
PID 2736 wrote to memory of 2704	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	41
PID 2736 wrote to memory of 2704	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	41
PID 2736 wrote to memory of 2856	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	42
PID 2736 wrote to memory of 2856	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	42
PID 2736 wrote to memory of 2856	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	42
PID 2736 wrote to memory of 2856	2736	{C8227467-FF08-4289-B0EF-A142914EA51D}.exe	42
PID 2704 wrote to memory of 2948	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	43
PID 2704 wrote to memory of 2948	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	43
PID 2704 wrote to memory of 2948	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	43
PID 2704 wrote to memory of 2948	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	43
PID 2704 wrote to memory of 1352	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	44
PID 2704 wrote to memory of 1352	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	44
PID 2704 wrote to memory of 1352	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	44
PID 2704 wrote to memory of 1352	2704	{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe	44
PID 2948 wrote to memory of 1988	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	45
PID 2948 wrote to memory of 1988	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	45
PID 2948 wrote to memory of 1988	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	45
PID 2948 wrote to memory of 1988	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	45
PID 2948 wrote to memory of 1596	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	46
PID 2948 wrote to memory of 1596	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	46
PID 2948 wrote to memory of 1596	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	46
PID 2948 wrote to memory of 1596	2948	{7578ED56-4607-4ac6-831D-7256B2330B92}.exe	46

C:\Users\Admin\AppData\Local\Temp\2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-09_8e1430dc238ca16665bc1c5fcc240dad_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
  C:\Windows\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
    C:\Windows\{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
      C:\Windows\{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
        
        C:\Windows\{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2168
      - C:\Windows\{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
        
        C:\Windows\{C8227467-FF08-4289-B0EF-A142914EA51D}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
        
        C:\Windows\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
        
        C:\Windows\{7578ED56-4607-4ac6-831D-7256B2330B92}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
        
        C:\Windows\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Windows\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
        
        C:\Windows\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Windows\{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe
        
        C:\Windows\{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe
        
        C:\Windows\{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E5C85~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F01FC~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2AC5~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7578E~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E769~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C8227~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87D98~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E3902~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{4AFDD~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9953C~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0E769CEB-07A4-4c66-9DAC-B86F048912E3}.exe

Filesize
168KB

MD5
53ae2693a43d3dff5a798b9f80327e29

SHA1
4b7155944da22f41449abdb59c8b6eac2fff0331

SHA256
72f7c80a401357430a819c92c606a8ab30de30f0dc4e9e85dc829db6cb416076

SHA512
bb7f0053ce7659bf800805930420bf53c5b3b1480b754b0101ff31813450e210ac5002067820db94c558f4672f3038ab3b3c93795570b1239dad2c0ea2d78527

Download Submit
C:\Windows\{4AFDDDFE-D848-439a-A2C9-906183874C0A}.exe

Filesize
168KB

MD5
37e30ba75727693f23e20f0405106def

SHA1
373a025b9b02da68c1cbe1fee00fe95e946eb0fc

SHA256
ec8b37976a0f1b81fc20f3624200eeb96275bdf6efb70c922bae4874003f54a4

SHA512
56aebec54a650f3a43ec806b3a9be285a61694d31b4b6a199880d93aa1b76e26a1c22170b014a42f9bcfcca4ab917ac01fb1480e4761c7f65a40f102f06c941e

Download Submit
C:\Windows\{7578ED56-4607-4ac6-831D-7256B2330B92}.exe

Filesize
168KB

MD5
efe017a99acde8c141ddf6c236a39a9a

SHA1
33e7a9a61dba96941eb1f3ce8b4161769cf8d595

SHA256
a88310cbcf14451d0b1a8d57edf5b9ec3a330965b5652f73ccd9edcc8f858f61

SHA512
9c3c1562966414815046b2d0991b1ba37bb27087fbcab1b51ec7999e0e7b6d98a8bc4c57bf9cbe6f1a1395498df0cfaea8084686e9ceb90a23a47915ccc16e92

Download Submit
C:\Windows\{87D989EA-92EF-426f-9BE6-923A3C5E3102}.exe

Filesize
168KB

MD5
aca8b12410bc347404bad192c01a2b37

SHA1
c3c614c0c35793fcf037dca9a0c8aa59a4ca4a20

SHA256
696a9abbef30ee3935ca18ccf6dcbe0af66b93f53c1d70504db0b87f001fbd10

SHA512
70eaaac528161b86ae3ea2965da257827e9b61083141ac9df3f8849ef580358c6533175f1fbaacb682cb7680d6e29fad5792aa3d60301ac7f715e3453f71d4e7

Download Submit
C:\Windows\{9641D220-FD3F-4cde-BC27-845012B6D2F1}.exe

Filesize
168KB

MD5
84dc75d8be92af7b122819490e899099

SHA1
e68a24f7710a99ad0bde9f1f7d5d82b3788d28ba

SHA256
fd10b6ecfbab29f43044eb285ba4349fb99f7b76874fd2528f6041cced0641ed

SHA512
8973c7490a27d0ff766c3cf97bf8f4346fa8079143993927d3d06aca59af18c03fcdea434fddd03ddf2c45052788a5db9e35a87b271a13982c3b40baa73893d7

Download Submit
C:\Windows\{9953CDA1-9330-4b22-A07F-9EA32EA723C4}.exe

Filesize
168KB

MD5
58f944659947e939af8a0ba5ca7b03c3

SHA1
cf4f7fb66cd4e36ee1a946bb5501356fe8cc5ecf

SHA256
86ec5267dac9fffe148ffcb8fa410fc05e9290403d7f7d6abe740563c03d455f

SHA512
be17db3344f281b934ba6cef3930f9123839304bec174ed98d1fefc8099d244a7cbe359f0dbc36590f1983a413fd1533b66e502e182ca62f2e09f46183b79bbf

Download Submit
C:\Windows\{C8227467-FF08-4289-B0EF-A142914EA51D}.exe

Filesize
168KB

MD5
86fc5b64b2dc5f30ac39ec711e8e219e

SHA1
58c6f8178809e3d6250d52d5e46ca1c692539715

SHA256
20f272bc7c0391e9f0dfec8125f96cf8d400496860bf74ea83bfe5cb808bf5f7

SHA512
c2ccf3f37e9841adbf6e3217bf7b676bae28f72e86f430aa971688133a34f469fd7d4103f6ebd48cea64900c7ba0240d170e595492efd22d5b173a3092671fa1

Download Submit
C:\Windows\{E2AC5E4A-3272-4d09-8B06-BBAC7ABCCF68}.exe

Filesize
168KB

MD5
ba89dc2c2c1d3d86095386d50d10be99

SHA1
a0dfb0eee08a8d56a132609328990943f6301789

SHA256
6bee49e3e029522f6b025c0e2b4d94d37dc04680454a2e3d0ccd9643c38bf93c

SHA512
6bdefba7525429859760ab8aca73b137ff9c662f9d49ce213b6d7ad99ad09512c9ec8040754e992da4444496cff76ee4dcd64cdc4dea996686517500aae7b236

Download Submit
C:\Windows\{E3902196-96D7-4a6b-BD67-27F909B6D36B}.exe

Filesize
168KB

MD5
b3a37fdb0275eeb2a6128f4fd3a2bd01

SHA1
cef4c5353adde62e1ca4ebfb193e1f16ae6ec55c

SHA256
021d41809da1be7766d29ccb72eea723cc999444d1bf2dc7fcf2b8d195341e6a

SHA512
7b246300d525f1a0f8f6d7fb579c486f930a2d25d9ee344330399bb27d5eade3b43fc77aa539d38565460092782bda84817b75b18b014e82a4b34b9b75f448b6

Download Submit
C:\Windows\{E5C85A42-800F-4b06-864F-4985C6201AA2}.exe

Filesize
168KB

MD5
309a8db168bcf7b63f17be88930a6ffc

SHA1
4a54d9c58caa2be4660b483be8fbbfb6220543dc

SHA256
807e623aac4876a502b7b19d5164c368a6c90e78d55ed67be198d4c4a119f759

SHA512
fa5315c924042e502c764107214ab23727bdcb6abe1249caafb4eef503fd9ab62be182f3407f78011f3e340b401c00b7117181dbb9eb3157a5d72dc98384ed1d

Download Submit
C:\Windows\{F01FCEE7-FE22-4ee8-BC8E-2ABB8B83E794}.exe

Filesize
168KB

MD5
111d212620ca8a877bae8a228867de06

SHA1
8230942328cae4d9e67d29c19decc33a389e807b

SHA256
2dceb397c167e758aeeaa5ec6e564fe59ee353f2c52437f02121039ccc9239cb

SHA512
18107eac759a1e062d5f939b390914fc1afd8152a5e489a29d9fcfdf81f9059e75a307db5cc8b0443595e24095480071c1ac9c9a7ea4af97664be7c0ca4789e7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads