0414ae293423816b7aa3f9d7679f6cee1fd1ff1a51c9aa06f872a80b9580d2ac

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe
Size

197KB
MD5

62285842c230fc52e29c1977f83c1c51
SHA1

9345fe86911bfacae41f2c33dd1973dd3c1f7476
SHA256

0414ae293423816b7aa3f9d7679f6cee1fd1ff1a51c9aa06f872a80b9580d2ac
SHA512

87afca3fdba443ddc7e64270f3dbd6be3880f0fe157e14da4f8ab222c779545f1f6ba398ca77fbeaad013d70b460045ff31f378895783c7643d341f74d500c61
SSDEEP

3072:jEGh0o4l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGulEeKcAEca

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42CCF85F-E8A6-495e-A261-EF7C04563C74}	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42CCF85F-E8A6-495e-A261-EF7C04563C74}\stubpath = "C:\\Windows\\{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe"	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50FAA83B-126D-4302-B5C2-5B9188A39902}\stubpath = "C:\\Windows\\{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe"	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}	{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}\stubpath = "C:\\Windows\\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe"	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F059C07E-56E4-41ee-862F-C36885F9764E}	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACD65451-2BA2-4140-8B89-EEF39C83D912}\stubpath = "C:\\Windows\\{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe"	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}\stubpath = "C:\\Windows\\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe"	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}\stubpath = "C:\\Windows\\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe"	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA54E714-1949-423f-BE8C-EB1248D49B7A}\stubpath = "C:\\Windows\\{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe"	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50FAA83B-126D-4302-B5C2-5B9188A39902}	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06012A2D-1795-443a-9D9B-AFDD07684E9A}	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06012A2D-1795-443a-9D9B-AFDD07684E9A}\stubpath = "C:\\Windows\\{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe"	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}\stubpath = "C:\\Windows\\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe"	{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACD65451-2BA2-4140-8B89-EEF39C83D912}	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F059C07E-56E4-41ee-862F-C36885F9764E}\stubpath = "C:\\Windows\\{F059C07E-56E4-41ee-862F-C36885F9764E}.exe"	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21BC8943-351F-4f21-ABD0-7D45805D5564}	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21BC8943-351F-4f21-ABD0-7D45805D5564}\stubpath = "C:\\Windows\\{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe"	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA54E714-1949-423f-BE8C-EB1248D49B7A}	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6426F5B5-13B4-4ead-9EC9-701A44475826}	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6426F5B5-13B4-4ead-9EC9-701A44475826}\stubpath = "C:\\Windows\\{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe"	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe

Executes dropped EXE 12 IoCs

pid	Process
2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
4840	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
4664	{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
4492	{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
File created	C:\Windows\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
File created	C:\Windows\{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
File created	C:\Windows\{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
File created	C:\Windows\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
File created	C:\Windows\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
File created	C:\Windows\{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
File created	C:\Windows\{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe
File created	C:\Windows\{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
File created	C:\Windows\{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
File created	C:\Windows\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe	{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
File created	C:\Windows\{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
Token: SeIncBasePriorityPrivilege	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
Token: SeIncBasePriorityPrivilege	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
Token: SeIncBasePriorityPrivilege	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
Token: SeIncBasePriorityPrivilege	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
Token: SeIncBasePriorityPrivilege	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
Token: SeIncBasePriorityPrivilege	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
Token: SeIncBasePriorityPrivilege	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
Token: SeIncBasePriorityPrivilege	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
Token: SeIncBasePriorityPrivilege	4840	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
Token: SeIncBasePriorityPrivilege	4664	{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2328	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe	94
PID 4088 wrote to memory of 2328	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe	94
PID 4088 wrote to memory of 2328	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe	94
PID 4088 wrote to memory of 3308	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe	95
PID 4088 wrote to memory of 3308	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe	95
PID 4088 wrote to memory of 3308	4088	2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe	95
PID 2328 wrote to memory of 3592	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	96
PID 2328 wrote to memory of 3592	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	96
PID 2328 wrote to memory of 3592	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	96
PID 2328 wrote to memory of 5056	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	97
PID 2328 wrote to memory of 5056	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	97
PID 2328 wrote to memory of 5056	2328	{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe	97
PID 3592 wrote to memory of 856	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	100
PID 3592 wrote to memory of 856	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	100
PID 3592 wrote to memory of 856	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	100
PID 3592 wrote to memory of 2144	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	101
PID 3592 wrote to memory of 2144	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	101
PID 3592 wrote to memory of 2144	3592	{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe	101
PID 856 wrote to memory of 3100	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	103
PID 856 wrote to memory of 3100	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	103
PID 856 wrote to memory of 3100	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	103
PID 856 wrote to memory of 2208	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	104
PID 856 wrote to memory of 2208	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	104
PID 856 wrote to memory of 2208	856	{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe	104
PID 3100 wrote to memory of 4460	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	105
PID 3100 wrote to memory of 4460	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	105
PID 3100 wrote to memory of 4460	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	105
PID 3100 wrote to memory of 1680	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	106
PID 3100 wrote to memory of 1680	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	106
PID 3100 wrote to memory of 1680	3100	{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe	106
PID 4460 wrote to memory of 2068	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	108
PID 4460 wrote to memory of 2068	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	108
PID 4460 wrote to memory of 2068	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	108
PID 4460 wrote to memory of 820	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	109
PID 4460 wrote to memory of 820	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	109
PID 4460 wrote to memory of 820	4460	{F059C07E-56E4-41ee-862F-C36885F9764E}.exe	109
PID 2068 wrote to memory of 3720	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	110
PID 2068 wrote to memory of 3720	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	110
PID 2068 wrote to memory of 3720	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	110
PID 2068 wrote to memory of 3268	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	111
PID 2068 wrote to memory of 3268	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	111
PID 2068 wrote to memory of 3268	2068	{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe	111
PID 3720 wrote to memory of 4480	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	114
PID 3720 wrote to memory of 4480	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	114
PID 3720 wrote to memory of 4480	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	114
PID 3720 wrote to memory of 2128	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	115
PID 3720 wrote to memory of 2128	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	115
PID 3720 wrote to memory of 2128	3720	{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe	115
PID 4480 wrote to memory of 4896	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	121
PID 4480 wrote to memory of 4896	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	121
PID 4480 wrote to memory of 4896	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	121
PID 4480 wrote to memory of 4668	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	122
PID 4480 wrote to memory of 4668	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	122
PID 4480 wrote to memory of 4668	4480	{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe	122
PID 4896 wrote to memory of 4840	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	123
PID 4896 wrote to memory of 4840	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	123
PID 4896 wrote to memory of 4840	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	123
PID 4896 wrote to memory of 4476	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	124
PID 4896 wrote to memory of 4476	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	124
PID 4896 wrote to memory of 4476	4896	{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe	124
PID 4840 wrote to memory of 4664	4840	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe	125
PID 4840 wrote to memory of 4664	4840	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe	125
PID 4840 wrote to memory of 4664	4840	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe	125
PID 4840 wrote to memory of 3456	4840	{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe	126

C:\Users\Admin\AppData\Local\Temp\2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-23_62285842c230fc52e29c1977f83c1c51_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
  C:\Windows\{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
    C:\Windows\{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
      C:\Windows\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Windows\{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
        
        C:\Windows\{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3100
      - C:\Windows\{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
        
        C:\Windows\{F059C07E-56E4-41ee-862F-C36885F9764E}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
        
        C:\Windows\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
        
        C:\Windows\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
        
        C:\Windows\{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
        
        C:\Windows\{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
        
        C:\Windows\{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
        
        C:\Windows\{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
        
        C:\Windows\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe
        
        C:\Windows\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50FAA~1.EXE > nul
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA54E~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42CCF~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21BC8~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2941F~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{06FC5~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F059C~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:820
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ACD65~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B2BF3~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{06012~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6426F~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{06012A2D-1795-443a-9D9B-AFDD07684E9A}.exe

Filesize
197KB

MD5
839ac98dfadd7d6fc370a5450d746c07

SHA1
7345722ad66e1a8ee09a53f2291c4aa5ec7ed735

SHA256
30ec8b29256b7fcffff685b774a9478c88dd3ba738de2067985af9f814af1919

SHA512
84e7658ac20636071e86b5e41ecebca80e9b97d3ff94eadf20aac064964cb5a9d7929ee3405f401ff77c3750f701227fbd3e9dd54a07bff1b2ce5cd21d4bdf14

Download Submit
C:\Windows\{06FC54EC-E47C-4d8a-8F7E-C306D17FB56B}.exe

Filesize
197KB

MD5
0384c9a9d0850af5c23dfc2db59c7e1f

SHA1
c2648ff75db097edf67377382d28e6acc5d3cca4

SHA256
b3019352ad2471ab0b132e573a5552e4d32b0959317c1819b58ec27feaa8e72f

SHA512
ccd92c02c25d14ced95b397f2fdec32b4b830cbbbdbca50bb1cd2d2ad546aad2a82fffc71fc79aaa935617db16ff1a8694744f69212320f98aa08931cc462e51

Download Submit
C:\Windows\{21BC8943-351F-4f21-ABD0-7D45805D5564}.exe

Filesize
197KB

MD5
3d50c8f5e467ee578c5c1de8b980e1f3

SHA1
bf1058b0096ebeeaf892b5290b200de32f005f57

SHA256
44f1d065b866686e74879f5087d96f59038151550878bacb65942f3b7c11df9e

SHA512
2897c1dd4420d2f04bef9a58b5ae4e12e3cda6f5c2f3d0d0b91350fde68f6d659aa9f8595fdca45da70e08084f20e4b1d512853417e81a986e9a4a7b03f0ebb5

Download Submit
C:\Windows\{2941F5F9-33AE-4dfe-84B6-D85EC1C7CFD4}.exe

Filesize
197KB

MD5
e4b463e9e2ea4a05a3fb1b4e014cc66e

SHA1
8a0d537056dfe48070077e58ef0ec934ae916f6c

SHA256
ad109fde2bc762ad8a6be37a1465d8ee190e97a034af9bc97263f4f26cc7cb48

SHA512
1668d0462cd0d58e9c1e201fe0a910eab4758eff461e4baf5547790fd83f165a0917d166805f2da2d7afb2df88880db77846087694feeb1471a4e05b37b20028

Download Submit
C:\Windows\{42CCF85F-E8A6-495e-A261-EF7C04563C74}.exe

Filesize
197KB

MD5
a7ac21e331f1d3b3c6de5e8f9c2d36da

SHA1
ed85dfeda2b73509660b258f1b7cb44a25060686

SHA256
dd815eabf5b15b43a50d91869e3c5b6111e85bd575039a6f27c8456ce5ede62c

SHA512
ebb54ed92fd6a2ed7bebd5050b85a0b2b3525e63f4541f41200d604aad35f7b21f165640c2d5baaa89853aca6a145a0e22dfce680ac7fa85328884559fa0b35b

Download Submit
C:\Windows\{50FAA83B-126D-4302-B5C2-5B9188A39902}.exe

Filesize
197KB

MD5
32f12a712c859b87f1e65dab853d061b

SHA1
43ca07b5e9ea3bce51ee002347907efef092d5ce

SHA256
711ac3e89b2d6099c26b168e5bfd6681fb00b8bf3035656b88642578333bd4e2

SHA512
ba9853f4f1dd1a2ba048a011b3715ff10b6b2bed05b7d8a247b03b164ab4985ff0137b732156f7b7fc7243a981e9c744166371ca64e2b94892f399dc49212378

Download Submit
C:\Windows\{6426F5B5-13B4-4ead-9EC9-701A44475826}.exe

Filesize
197KB

MD5
bad6da9196053e286d34906483a7c218

SHA1
2a30c4b82a2ed8365b27efc3342dd80d6fdccada

SHA256
7a661d501534cc7645b2cb943663d2f161d26f3cdfccb741623142bdb7c78f31

SHA512
e76c2f5d0a193a4618ea1676e3e19387639a54f26131f4dcdf1692442436b71acdde329e7ce57b9f08447f4f7446830573bc1bc92d8752839ad0012039f53bcd

Download Submit
C:\Windows\{ACD65451-2BA2-4140-8B89-EEF39C83D912}.exe

Filesize
197KB

MD5
9b256589c9e17f9c1f8074504c9f240b

SHA1
1f55d19f0a98e8b49d43c91ad689fd1f3a92969c

SHA256
b2abc1404d0dbb09302184854e8c17a3f46eab7a474d9817071a53069a0b086b

SHA512
0707b0704759c02fbd22094183dbd521b5343dc924e27ad4c522bbd601c55881201d85cb53381afe4f23ae1db1041554c6d0e3f05cb2e0d391b516b3278884db

Download Submit
C:\Windows\{B2BF30E8-B14A-4483-B434-A810FE8CB4BF}.exe

Filesize
197KB

MD5
6d10df0f2399e090164cbb1ca2034975

SHA1
3f6f38cbdee93031ff7c6da457f01cf37012805e

SHA256
5a050b55b969a708a2313ac3995faf17069c5d95f1ce98c02ba3f3e4af7a0b01

SHA512
297522fc3fafea46050b6f6c3b09144f76b459cb9b812be450b26b517e01b9e35879cd0f76d56812d6fdc224b5a8dff74ea0e8e94e05d4e34053305fc7ff9b16

Download Submit
C:\Windows\{BB2CDC54-F896-4302-8253-FFA4EE2ED731}.exe

Filesize
197KB

MD5
c66d7561e7d3565b64ed05c2f89d4a7b

SHA1
e9e863c43db4386e67b33065ab18eb51c6d695b2

SHA256
111d23c49ef99603bf98a0f99895f55d79715345c7687295c2aa47897193a515

SHA512
a164fab1d7a79b8b64f530de0b841e110722473dcc4104215c59c0419b3227d2fa491fb8707916f575c21c41c9061f2ad85eaf17066672677f03d6752a9c13f6

Download Submit
C:\Windows\{EA54E714-1949-423f-BE8C-EB1248D49B7A}.exe

Filesize
197KB

MD5
88c0302d40df39ebdb55ab14b85d6670

SHA1
72a42639c23603f3dd7e0eb74cb65aa7695f9f66

SHA256
a4c8dec4bff246dbfa0399026071577cb03420fd0be86649dc369852bb70d708

SHA512
1a6ef0e72cdceff6aef97a81a3d0112e36e4de33b9d8a80ecb024dadade223250d825b4a5fb0520525a5f7919b2ea69c8cf1132a6d2c8645ac78f4598c32f79d

Download Submit
C:\Windows\{F059C07E-56E4-41ee-862F-C36885F9764E}.exe

Filesize
197KB

MD5
be22b5663a019d7680e6ab61b62533ce

SHA1
d8cfc3b702368d82128752030c45ec863e5d1d37

SHA256
4414fa241485eb0c2a3b5453bd61bb21ab1bd39c9ff26e31f96ee07eafc523ef

SHA512
30166d37ad0f941004e9941898f57d4f323b926b03baf423ddd926cf807fc2b91e661ada94919e1773c562912e03324c6a06e50fe2a10c6182e81b5f297838f1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads