Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe
-
Size
344KB
-
MD5
11bcad7c984f0d68447b017b2ffa67e1
-
SHA1
0da1708a903a2197d4e42bd8d2f6a4cc0bc3e100
-
SHA256
08f5acbab5ea7f6ca3d94ec0dec08788c099426c60968574dad54b7e8f817c41
-
SHA512
03b4808893562b52d9865912dd0c9392f285c9ccef9deeeb2c1c7ddee4ea09d15f102c905902190f7db9d90d22b6214b5ef54be4ddd3264616a990a66e71f280
-
SSDEEP
3072:mEGh0oclEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1F17A182-A9DE-406e-A21E-6A960B27C2DD} {40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA71584B-A234-4cde-82D3-99D0DF104556} {1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA1F35E3-3F5D-44e4-8A23-B78A58A4D284} {BA71584B-A234-4cde-82D3-99D0DF104556}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C11A877E-5470-465d-8E3E-6CCD17A952B6}\stubpath = "C:\\Windows\\{C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe" 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE30ABD9-98F4-44aa-A791-41415FB1F92B} {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{594FF90F-E4DF-41bf-A78B-2444EC8D5420} {739961BA-463E-4883-9D10-800074BA8638}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{91BE1BDD-CE43-4d68-A974-1C3A44228347}\stubpath = "C:\\Windows\\{91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe" {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B} {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}\stubpath = "C:\\Windows\\{FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}.exe" {BA71584B-A234-4cde-82D3-99D0DF104556}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}\stubpath = "C:\\Windows\\{40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe" {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1F17A182-A9DE-406e-A21E-6A960B27C2DD}\stubpath = "C:\\Windows\\{1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe" {40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C11A877E-5470-465d-8E3E-6CCD17A952B6} 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}\stubpath = "C:\\Windows\\{B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe" {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{739961BA-463E-4883-9D10-800074BA8638}\stubpath = "C:\\Windows\\{739961BA-463E-4883-9D10-800074BA8638}.exe" {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB0402D9-7A94-4d9b-B7A2-0114D095F01D}\stubpath = "C:\\Windows\\{FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe" {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{91BE1BDD-CE43-4d68-A974-1C3A44228347} {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{739961BA-463E-4883-9D10-800074BA8638} {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{594FF90F-E4DF-41bf-A78B-2444EC8D5420}\stubpath = "C:\\Windows\\{594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe" {739961BA-463E-4883-9D10-800074BA8638}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA71584B-A234-4cde-82D3-99D0DF104556}\stubpath = "C:\\Windows\\{BA71584B-A234-4cde-82D3-99D0DF104556}.exe" {1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE30ABD9-98F4-44aa-A791-41415FB1F92B}\stubpath = "C:\\Windows\\{EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe" {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7A404D9-BE05-4acc-8984-B23FE0FE6BCA} {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB0402D9-7A94-4d9b-B7A2-0114D095F01D} {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe -
Deletes itself 1 IoCs
pid Process 776 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 2892 {40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe 1132 {1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe 1296 {BA71584B-A234-4cde-82D3-99D0DF104556}.exe 1096 {FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe File created C:\Windows\{594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe {739961BA-463E-4883-9D10-800074BA8638}.exe File created C:\Windows\{BA71584B-A234-4cde-82D3-99D0DF104556}.exe {1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe File created C:\Windows\{C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe File created C:\Windows\{FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe File created C:\Windows\{739961BA-463E-4883-9D10-800074BA8638}.exe {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe File created C:\Windows\{40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe File created C:\Windows\{1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe {40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe File created C:\Windows\{FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}.exe {BA71584B-A234-4cde-82D3-99D0DF104556}.exe File created C:\Windows\{EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe File created C:\Windows\{B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BA71584B-A234-4cde-82D3-99D0DF104556}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {739961BA-463E-4883-9D10-800074BA8638}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe Token: SeIncBasePriorityPrivilege 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe Token: SeIncBasePriorityPrivilege 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe Token: SeIncBasePriorityPrivilege 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe Token: SeIncBasePriorityPrivilege 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe Token: SeIncBasePriorityPrivilege 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe Token: SeIncBasePriorityPrivilege 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe Token: SeIncBasePriorityPrivilege 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe Token: SeIncBasePriorityPrivilege 2892 {40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe Token: SeIncBasePriorityPrivilege 1132 {1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe Token: SeIncBasePriorityPrivilege 1296 {BA71584B-A234-4cde-82D3-99D0DF104556}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 552 wrote to memory of 2328 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 31 PID 552 wrote to memory of 2328 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 31 PID 552 wrote to memory of 2328 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 31 PID 552 wrote to memory of 2328 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 31 PID 552 wrote to memory of 776 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 32 PID 552 wrote to memory of 776 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 32 PID 552 wrote to memory of 776 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 32 PID 552 wrote to memory of 776 552 2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe 32 PID 2328 wrote to memory of 2748 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 33 PID 2328 wrote to memory of 2748 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 33 PID 2328 wrote to memory of 2748 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 33 PID 2328 wrote to memory of 2748 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 33 PID 2328 wrote to memory of 2788 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 34 PID 2328 wrote to memory of 2788 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 34 PID 2328 wrote to memory of 2788 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 34 PID 2328 wrote to memory of 2788 2328 {C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe 34 PID 2748 wrote to memory of 2712 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 35 PID 2748 wrote to memory of 2712 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 35 PID 2748 wrote to memory of 2712 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 35 PID 2748 wrote to memory of 2712 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 35 PID 2748 wrote to memory of 2820 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 36 PID 2748 wrote to memory of 2820 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 36 PID 2748 wrote to memory of 2820 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 36 PID 2748 wrote to memory of 2820 2748 {EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe 36 PID 2712 wrote to memory of 2720 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 37 PID 2712 wrote to memory of 2720 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 37 PID 2712 wrote to memory of 2720 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 37 PID 2712 wrote to memory of 2720 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 37 PID 2712 wrote to memory of 2544 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 38 PID 2712 wrote to memory of 2544 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 38 PID 2712 wrote to memory of 2544 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 38 PID 2712 wrote to memory of 2544 2712 {B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe 38 PID 2720 wrote to memory of 2596 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 39 PID 2720 wrote to memory of 2596 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 39 PID 2720 wrote to memory of 2596 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 39 PID 2720 wrote to memory of 2596 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 39 PID 2720 wrote to memory of 1524 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 40 PID 2720 wrote to memory of 1524 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 40 PID 2720 wrote to memory of 1524 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 40 PID 2720 wrote to memory of 1524 2720 {FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe 40 PID 2596 wrote to memory of 1828 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 41 PID 2596 wrote to memory of 1828 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 41 PID 2596 wrote to memory of 1828 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 41 PID 2596 wrote to memory of 1828 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 41 PID 2596 wrote to memory of 2728 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 42 PID 2596 wrote to memory of 2728 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 42 PID 2596 wrote to memory of 2728 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 42 PID 2596 wrote to memory of 2728 2596 {91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe 42 PID 1828 wrote to memory of 2876 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 43 PID 1828 wrote to memory of 2876 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 43 PID 1828 wrote to memory of 2876 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 43 PID 1828 wrote to memory of 2876 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 43 PID 1828 wrote to memory of 1584 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 44 PID 1828 wrote to memory of 1584 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 44 PID 1828 wrote to memory of 1584 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 44 PID 1828 wrote to memory of 1584 1828 {739961BA-463E-4883-9D10-800074BA8638}.exe 44 PID 2876 wrote to memory of 2892 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 45 PID 2876 wrote to memory of 2892 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 45 PID 2876 wrote to memory of 2892 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 45 PID 2876 wrote to memory of 2892 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 45 PID 2876 wrote to memory of 2352 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 46 PID 2876 wrote to memory of 2352 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 46 PID 2876 wrote to memory of 2352 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 46 PID 2876 wrote to memory of 2352 2876 {594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\{C11A877E-5470-465d-8E3E-6CCD17A952B6}.exeC:\Windows\{C11A877E-5470-465d-8E3E-6CCD17A952B6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\{EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exeC:\Windows\{EE30ABD9-98F4-44aa-A791-41415FB1F92B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\{B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exeC:\Windows\{B7A404D9-BE05-4acc-8984-B23FE0FE6BCA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\{FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exeC:\Windows\{FB0402D9-7A94-4d9b-B7A2-0114D095F01D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\{91BE1BDD-CE43-4d68-A974-1C3A44228347}.exeC:\Windows\{91BE1BDD-CE43-4d68-A974-1C3A44228347}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\{739961BA-463E-4883-9D10-800074BA8638}.exeC:\Windows\{739961BA-463E-4883-9D10-800074BA8638}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\{594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exeC:\Windows\{594FF90F-E4DF-41bf-A78B-2444EC8D5420}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\{40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exeC:\Windows\{40617D8B-F1F2-413f-90A0-C4D4A3DF9F9B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Windows\{1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exeC:\Windows\{1F17A182-A9DE-406e-A21E-6A960B27C2DD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Windows\{BA71584B-A234-4cde-82D3-99D0DF104556}.exeC:\Windows\{BA71584B-A234-4cde-82D3-99D0DF104556}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\{FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}.exeC:\Windows\{FA1F35E3-3F5D-44e4-8A23-B78A58A4D284}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA715~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:2992
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F17A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40617~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2188
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{594FF~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73996~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:1584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91BE1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB040~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:1524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7A40~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE30A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C11A8~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD52c1f3ab50985268508edd6ffe36452c7
SHA121f36ca9ecc939579661f5cfa9d7091b2feb67b3
SHA25619e4c3afc0ddee7dd7f526546bd07ddcb3598faf9da7072952a527466092e430
SHA512cd987e9c1f2ddee8d5255a9ba9b39520658abbb1c841662ac09ba7aa394aad923c16e214aac672e236c8673396daf3650846a290eb79223dae5f36a2b2a31272
-
Filesize
344KB
MD57c53c3cb57e31fccf2ea8bdd93de9168
SHA14dbb0a7c670bb094eb30fdd4caf784f2e72898a6
SHA2565d9542d36cff52cf3d2cea6c0de71d5c390bcbd0542ac65e0ed3f8ad6a5ada7e
SHA512bf961135799ac6acbdf8dec1b219fc4657df7e4084286d9d3b3106e08cb74df0ff157b2714703e94656ba3c3447ef1cd9a607b9b9b8850d31894606e05a1afc4
-
Filesize
344KB
MD5ad9005358ac36323934b413d3a509b1e
SHA1c322ede1faf7845ec03eaaf40941ebfe41f57ce4
SHA256a66beab01ff70326663601959adaf939157f3318296384eb45b43eac3a29f739
SHA51208d564b923effd92dfe078982a4e01f3796c880288164e3ecb7d0276490105de091520ea0d029ddc22e956e492399d591e21517ab43834297af88bdb2a2f5bc2
-
Filesize
344KB
MD582508b0df884f72d2049374cdb1d86cb
SHA1d00fe223f1ae8339ff2f30d2f731b120f39b637e
SHA2563ddaf470e16a161ddcade9f69644b6a29b83d61555f96668400dea004d0d27a5
SHA5122f4ba51dcd0646f604aa040e296fa29908f9e80ef57b87483d98c826b23b5f8e8638ad76508508f178a662ca556a7674e07cfc64758991e069e4bed74e7daa2f
-
Filesize
344KB
MD537344ffb79218b060077242e2ce7cbd8
SHA15799abe770e78551f6e563d386ef0871a3d30a5e
SHA256fdf7a241a370e0963e886217ca27ce9eebc12f00cd2977d50a8e4a58d7c51c36
SHA51283ff6cac0394b76e73264b453388eaeae88874d4c1d6ecca0bfa1f7edf9c86b74a06839a3dc5f5dabf690e0ced12887250776300329a5cd3bd048cbe4c261ca8
-
Filesize
344KB
MD5dffed40085a8bdfce33dda7c1a7ed394
SHA1de84e55a684666139ec1fa4ea875bd0e9932afb5
SHA256840a1f4abe8743a9386e807caa1f7aafb8b6627e1cde9b37fbaae8b2b174c2c5
SHA512f70faf4516ac28f249ea5e45cd8b2feb519219fe1bbfd5cd2f50c705e45ebaba35a7a2c8b95446ecc2dc96ca7be057881f8db1a53224cb99eeb72549f7f3b367
-
Filesize
344KB
MD54ed702941f20c26636e6aed8c24409f0
SHA1f3a66656b3f6c9e602d57ebb9a31c991e072c653
SHA256559eb198cfada0600b2a6428efe1e0291b6d5da19d3dee9721e82eae44e25a90
SHA512c07b25861df68f34e31b06f439e2a33a8e8ce863a1e991eff181cc11409a9497caca945012c79ef87b2ffdd251dd4dc9e0d68189a448b348451f4b84b86e0bc6
-
Filesize
344KB
MD5bd234aa258299d5d9283f4dc08a58beb
SHA1bfe2222112545327db4e5e26533e375e45fcf94f
SHA2563b3abeb726e741a2e6437d6ad22abb00b431af31b0fe0445545aee33e90dffd8
SHA5125ef4cf2046eeb1da570060d9dcad68fc577a5d4c201abf082b4815190bf68276b8d98286e1b4cc4817d20b7672e63887eb93ff851183cb3c15f5dca2a0df92b5
-
Filesize
344KB
MD5f3073042ec954e51b98e41f1fc063bcb
SHA1a8a2610f093ab2d34497df77323a641ccd4bcdbe
SHA2564c9265440b6685ae6811e7713fec05bd29325ff375027c8470ad4913de391226
SHA512c306de7a377de51176d6aa6817c71c4b4b1e75a177cc83f3ab6f55ef9dfac1bc1d27fa78d60c1376b3c345278f37a09ae8ae1ba8f97c6bb4ae83849f02356f99
-
Filesize
344KB
MD52c80c5459934eb1eaa5858079500189f
SHA19db0b981894161e9e075b106a0f336ab30e8c41c
SHA256aeca328810c05f773c7df9a88981ce567aa22b85690a3af6c3debdaac39c6842
SHA51221c57f1d34546fc65819251185986e68875dae1691b7dd613bf12fbd577eb85296bb275406ee364805b4c4673b311c679c8fa2702958f40d93150fcbc1ccbf97
-
Filesize
344KB
MD5c9445bb315f7296d8741ef28876d10fe
SHA197e684d47117969b691382a10324078d861ab53d
SHA25610dd4af94244160fb682593f1dbc7e35c3dc3166751b431ed7fb6a68d6d38b84
SHA512a6c5a1debebb86469d64afec7b12d2f9d24df9fde2aa180e44557ab4ccbac7212533f0bb1feec89544f7eefbfb7369c758a689932e1363e63219afb1870f077d