Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe
-
Size
168KB
-
MD5
806559ecd6678cdc7e9b5281ab8cffbd
-
SHA1
e4ac86e840b871542544b3e85def0b2fc1a29520
-
SHA256
5a214470205aeea815fb0a21bb8de544f299150c44fb425b4afa6d8066103bca
-
SHA512
015d2af2071ec84995c429ad781f664e40277efb621d2f766b5730834453d056749d45548c6643746cbbaf70c84d8bbdbb19192c77d6b753c92fdf388989b27a
-
SSDEEP
1536:1EGh0oklq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oklqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71721942-19E4-4fdd-A95B-894A66A5C043} {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}\stubpath = "C:\\Windows\\{9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe" 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{734CF85B-B961-484f-B832-A810E3639022} {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EB811A1-0395-439f-B523-D4526E67137C} {734CF85B-B961-484f-B832-A810E3639022}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADE831CA-1793-4821-AA9E-7EA289C89793}\stubpath = "C:\\Windows\\{ADE831CA-1793-4821-AA9E-7EA289C89793}.exe" {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EAEB40B-A267-4a63-BF54-951F2F8774C2} {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A054440-934B-42e1-8743-D02B014D264A} {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E8416CF-1280-4018-89AF-054DD5D87D3E}\stubpath = "C:\\Windows\\{1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe" {9A054440-934B-42e1-8743-D02B014D264A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD} {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF5DAAA4-6B33-4808-9ABB-66532D6B6600} {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}\stubpath = "C:\\Windows\\{44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe" {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71721942-19E4-4fdd-A95B-894A66A5C043}\stubpath = "C:\\Windows\\{71721942-19E4-4fdd-A95B-894A66A5C043}.exe" {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9} 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{734CF85B-B961-484f-B832-A810E3639022}\stubpath = "C:\\Windows\\{734CF85B-B961-484f-B832-A810E3639022}.exe" {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EB811A1-0395-439f-B523-D4526E67137C}\stubpath = "C:\\Windows\\{0EB811A1-0395-439f-B523-D4526E67137C}.exe" {734CF85B-B961-484f-B832-A810E3639022}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E28AF19C-E659-434e-8CCF-F04735BD874B} {0EB811A1-0395-439f-B523-D4526E67137C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E8416CF-1280-4018-89AF-054DD5D87D3E} {9A054440-934B-42e1-8743-D02B014D264A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03BE6052-67ED-470e-A7B7-4215332C44F5} {71721942-19E4-4fdd-A95B-894A66A5C043}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03BE6052-67ED-470e-A7B7-4215332C44F5}\stubpath = "C:\\Windows\\{03BE6052-67ED-470e-A7B7-4215332C44F5}.exe" {71721942-19E4-4fdd-A95B-894A66A5C043}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E28AF19C-E659-434e-8CCF-F04735BD874B}\stubpath = "C:\\Windows\\{E28AF19C-E659-434e-8CCF-F04735BD874B}.exe" {0EB811A1-0395-439f-B523-D4526E67137C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A054440-934B-42e1-8743-D02B014D264A}\stubpath = "C:\\Windows\\{9A054440-934B-42e1-8743-D02B014D264A}.exe" {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF5DAAA4-6B33-4808-9ABB-66532D6B6600}\stubpath = "C:\\Windows\\{CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe" {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADE831CA-1793-4821-AA9E-7EA289C89793} {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EAEB40B-A267-4a63-BF54-951F2F8774C2}\stubpath = "C:\\Windows\\{1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe" {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe -
Executes dropped EXE 12 IoCs
pid Process 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 528 {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe 4748 {71721942-19E4-4fdd-A95B-894A66A5C043}.exe 4928 {03BE6052-67ED-470e-A7B7-4215332C44F5}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{9A054440-934B-42e1-8743-D02B014D264A}.exe {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe File created C:\Windows\{44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe File created C:\Windows\{ADE831CA-1793-4821-AA9E-7EA289C89793}.exe {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe File created C:\Windows\{0EB811A1-0395-439f-B523-D4526E67137C}.exe {734CF85B-B961-484f-B832-A810E3639022}.exe File created C:\Windows\{E28AF19C-E659-434e-8CCF-F04735BD874B}.exe {0EB811A1-0395-439f-B523-D4526E67137C}.exe File created C:\Windows\{1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe {9A054440-934B-42e1-8743-D02B014D264A}.exe File created C:\Windows\{CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe File created C:\Windows\{1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe File created C:\Windows\{71721942-19E4-4fdd-A95B-894A66A5C043}.exe {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe File created C:\Windows\{03BE6052-67ED-470e-A7B7-4215332C44F5}.exe {71721942-19E4-4fdd-A95B-894A66A5C043}.exe File created C:\Windows\{9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe File created C:\Windows\{734CF85B-B961-484f-B832-A810E3639022}.exe {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe -
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {0EB811A1-0395-439f-B523-D4526E67137C}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {03BE6052-67ED-470e-A7B7-4215332C44F5}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9A054440-934B-42e1-8743-D02B014D264A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {734CF85B-B961-484f-B832-A810E3639022}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {71721942-19E4-4fdd-A95B-894A66A5C043}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe Token: SeIncBasePriorityPrivilege 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe Token: SeIncBasePriorityPrivilege 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe Token: SeIncBasePriorityPrivilege 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe Token: SeIncBasePriorityPrivilege 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe Token: SeIncBasePriorityPrivilege 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe Token: SeIncBasePriorityPrivilege 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe Token: SeIncBasePriorityPrivilege 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe Token: SeIncBasePriorityPrivilege 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe Token: SeIncBasePriorityPrivilege 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe Token: SeIncBasePriorityPrivilege 528 {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe Token: SeIncBasePriorityPrivilege 4748 {71721942-19E4-4fdd-A95B-894A66A5C043}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3852 wrote to memory of 1116 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe 95 PID 3852 wrote to memory of 1116 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe 95 PID 3852 wrote to memory of 1116 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe 95 PID 3852 wrote to memory of 2000 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe 96 PID 3852 wrote to memory of 2000 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe 96 PID 3852 wrote to memory of 2000 3852 2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe 96 PID 1116 wrote to memory of 1364 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 97 PID 1116 wrote to memory of 1364 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 97 PID 1116 wrote to memory of 1364 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 97 PID 1116 wrote to memory of 1856 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 98 PID 1116 wrote to memory of 1856 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 98 PID 1116 wrote to memory of 1856 1116 {9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe 98 PID 1364 wrote to memory of 4108 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 102 PID 1364 wrote to memory of 4108 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 102 PID 1364 wrote to memory of 4108 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 102 PID 1364 wrote to memory of 2148 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 103 PID 1364 wrote to memory of 2148 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 103 PID 1364 wrote to memory of 2148 1364 {734CF85B-B961-484f-B832-A810E3639022}.exe 103 PID 4108 wrote to memory of 4572 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 104 PID 4108 wrote to memory of 4572 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 104 PID 4108 wrote to memory of 4572 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 104 PID 4108 wrote to memory of 1508 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 105 PID 4108 wrote to memory of 1508 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 105 PID 4108 wrote to memory of 1508 4108 {0EB811A1-0395-439f-B523-D4526E67137C}.exe 105 PID 4572 wrote to memory of 3512 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 106 PID 4572 wrote to memory of 3512 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 106 PID 4572 wrote to memory of 3512 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 106 PID 4572 wrote to memory of 4220 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 107 PID 4572 wrote to memory of 4220 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 107 PID 4572 wrote to memory of 4220 4572 {E28AF19C-E659-434e-8CCF-F04735BD874B}.exe 107 PID 3512 wrote to memory of 1332 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 109 PID 3512 wrote to memory of 1332 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 109 PID 3512 wrote to memory of 1332 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 109 PID 3512 wrote to memory of 4020 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 110 PID 3512 wrote to memory of 4020 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 110 PID 3512 wrote to memory of 4020 3512 {9A054440-934B-42e1-8743-D02B014D264A}.exe 110 PID 1332 wrote to memory of 2072 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 111 PID 1332 wrote to memory of 2072 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 111 PID 1332 wrote to memory of 2072 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 111 PID 1332 wrote to memory of 4584 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 112 PID 1332 wrote to memory of 4584 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 112 PID 1332 wrote to memory of 4584 1332 {1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe 112 PID 2072 wrote to memory of 4880 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 117 PID 2072 wrote to memory of 4880 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 117 PID 2072 wrote to memory of 4880 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 117 PID 2072 wrote to memory of 3352 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 118 PID 2072 wrote to memory of 3352 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 118 PID 2072 wrote to memory of 3352 2072 {CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe 118 PID 4880 wrote to memory of 4080 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 122 PID 4880 wrote to memory of 4080 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 122 PID 4880 wrote to memory of 4080 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 122 PID 4880 wrote to memory of 5112 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 123 PID 4880 wrote to memory of 5112 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 123 PID 4880 wrote to memory of 5112 4880 {44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe 123 PID 4080 wrote to memory of 528 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 124 PID 4080 wrote to memory of 528 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 124 PID 4080 wrote to memory of 528 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 124 PID 4080 wrote to memory of 4108 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 125 PID 4080 wrote to memory of 4108 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 125 PID 4080 wrote to memory of 4108 4080 {ADE831CA-1793-4821-AA9E-7EA289C89793}.exe 125 PID 528 wrote to memory of 4748 528 {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe 129 PID 528 wrote to memory of 4748 528 {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe 129 PID 528 wrote to memory of 4748 528 {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe 129 PID 528 wrote to memory of 3996 528 {1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_806559ecd6678cdc7e9b5281ab8cffbd_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\{9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exeC:\Windows\{9F6CD5D8-37FD-4cb4-9B46-D67868CCFFD9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\{734CF85B-B961-484f-B832-A810E3639022}.exeC:\Windows\{734CF85B-B961-484f-B832-A810E3639022}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\{0EB811A1-0395-439f-B523-D4526E67137C}.exeC:\Windows\{0EB811A1-0395-439f-B523-D4526E67137C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\{E28AF19C-E659-434e-8CCF-F04735BD874B}.exeC:\Windows\{E28AF19C-E659-434e-8CCF-F04735BD874B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\{9A054440-934B-42e1-8743-D02B014D264A}.exeC:\Windows\{9A054440-934B-42e1-8743-D02B014D264A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\{1E8416CF-1280-4018-89AF-054DD5D87D3E}.exeC:\Windows\{1E8416CF-1280-4018-89AF-054DD5D87D3E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\{CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exeC:\Windows\{CF5DAAA4-6B33-4808-9ABB-66532D6B6600}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\{44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exeC:\Windows\{44B0EEFC-F7A6-4a2e-8F70-8CD8F96A83DD}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\{ADE831CA-1793-4821-AA9E-7EA289C89793}.exeC:\Windows\{ADE831CA-1793-4821-AA9E-7EA289C89793}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\{1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exeC:\Windows\{1EAEB40B-A267-4a63-BF54-951F2F8774C2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\{71721942-19E4-4fdd-A95B-894A66A5C043}.exeC:\Windows\{71721942-19E4-4fdd-A95B-894A66A5C043}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4748 -
C:\Windows\{03BE6052-67ED-470e-A7B7-4215332C44F5}.exeC:\Windows\{03BE6052-67ED-470e-A7B7-4215332C44F5}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71721~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
PID:4532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EAEB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:3996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADE83~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:4108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44B0E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF5DA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:3352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E841~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A054~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:4020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E28AF~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:4220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EB81~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{734CF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F6CD~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:1856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5e98b86ddeb79cf952b34be96953a5d26
SHA19708c43ba4d2abc7fcb421278c1f8424b2308685
SHA256996fe0a35b1b72af24d5baae041c6224b4eb13b1751eaf5c4a0483ff50ebff20
SHA5128698f96f3b13372966542da4570e8203344147903744408dea9396ce5170759ed0df9d29919826e46c3a668daaae6b91d46fc974f9cee0fa73ca8d279c8bf22c
-
Filesize
168KB
MD5da2c85e29cbdfd780dd60b53fa2b6f6b
SHA1d150d94263c90923ed2f4da28a7f260a166751ee
SHA25611f144e7308d19d7381589e8efe744e61ffa40476b814488372dc61bd67c1306
SHA51253b6ee567b83752fd8203ab8e4fbd9376976f09b11588e58ee70fc560a2d9066c1c1dc2c69eddd59ff757b9c0a3c0638ac548a5f948451b9831c2616d4a45e87
-
Filesize
168KB
MD51cfb892ad078aae33382e2f2c459b652
SHA1b84b2443812d6d13f7a848ed884d6bcb2b2b824b
SHA256e6c37096bb474f86424a6ae7665a04176fe3df7401ded643dcaada3d68d86fe9
SHA512870f82aa30669a3aba250a05e1bed02fda457358a2f8fb82cfb761adeb44baa9860ab0438070f61d9030e260188e1c8b1224968ec03fb2187fd1f4604251e7d4
-
Filesize
168KB
MD5989aee1ccdbdfe5862e5f07af51ee674
SHA15bf35fa7f57d91a16f0f24b935df1e6324859e23
SHA2564298883223fe854180b8922ed3e8ee379f2d7f83be427bc71df5f30fa204bfce
SHA512e5e579b8b037ce9f4a020a4fab439e9f521e50b24f3870135e1d77b4b387ed3a888760e5a28daa023389e5ea475820537f941466320cfff18a913732de3cda85
-
Filesize
168KB
MD57d101ff86e1f32d416b912a6dbc28487
SHA18155997dc675bac72028773518bcfa33785fa8e8
SHA2567f8e401957838b101058d684f4243d3cb92cb0068fcfb072f95f64fc1cd89b74
SHA5128575fdbb01e49c20312282e58b14aebfec472c00d1ea55ce0ab6f9be693cb2dc131b718c0f2d79608d76616d8aa2816d8033e75d2d1c3a40c8fc3d0d52e57b29
-
Filesize
168KB
MD5ccb24e04409c4e3830da579844c3700f
SHA10f22616d3becbf044b03bb2d1a7a9db384044d6b
SHA256b685d6843d1be0707e998c9208dc6b23cc02278cd72823849e4dedf0a4433eaf
SHA5120fb9acd22cf49494feb484e9d223082f8793133a4ca188a3674e2cd5fe5b890e4a5193ea3ec99e141c1725ef442dde5831e7cc26bdcc87b97b67fddea1060201
-
Filesize
168KB
MD51a5a55c183ea1eafa8d741bbc72fc866
SHA1dcec6499262d5ab47c7cccce644d0cd5d8377e01
SHA256440fd5ff7e59bcac21d94dfc267d1194dd6922b14c4c792a1e584bf933f3d57e
SHA512b99034ce315fc18328b419ff7196a1b4e1ddf52b885a72abd15ebca86ef514743606330bd53e12141520a8dbeb6c9b6c491910263e0fa6235ef0610ffddfdc0f
-
Filesize
168KB
MD5f5948174d409b376790aa024aff4ff08
SHA15412eca4cd5b984f6151a3578817155a7705ae44
SHA2562bae4db973d7ab04fe3e1a84f9f67918c899e9a61c421448f8da5694f1154556
SHA512eef0a9c8790afdb3f338b1f60293c96b8e743ac3c4292dc50f2f97571f34317316786b819e9a4eaddcfca03761b570c5ad9d85f447c4db1d44bc9688546e9b03
-
Filesize
168KB
MD5403768ed5f54077363cd4b6b926134ca
SHA19201a8afcbdad8ad7981340c56b7643593886b3f
SHA256e66ce02ffc11d9a31dea2e03f2c6605a524eb71159a4cf6ab38b6d277f80fb82
SHA512fe41a05ac6c3fbd4e8ffe4a21bf779040f41fd50e54f4f54d300f1e5bc024306e98019a009903c91baffaac9fec6eba6899310d3c30e1a93702383edb171c5b0
-
Filesize
168KB
MD5c82d8c12e74f2d30b3739fa46b3c1361
SHA1a16c125e9a036b549480cd2da11f0e433ada96aa
SHA2561b77232d44d23c1a30b4baefa96e8afb6352f2dca53a70afd52f1a3be3a38bf6
SHA512104b9af294c184613475696d993a28762385f3eaecc63dd5a721e8942843e74b5711c0c54abfce64f53515dfcd939f3a1161e1dd10bcc96afbac6ce0adaf77d1
-
Filesize
168KB
MD5042135abb2789cdf413192ac67530691
SHA174fadca3cf6f77ff68d9fab1de1f221d3123f2ab
SHA256519bbe37d069f4624634990e99f34c6e70456fdcbf28d1e6eb2ebff5b26cb7ed
SHA51278a007e4acefa00f0f88000e30e3382cc9f0751c246deef4d1011a9212ee76c6f479a8b72fdf9086ee6223ba45804e8c32f18b8442c6298d4876e47c6a393c3d
-
Filesize
168KB
MD505572a6a030b47e251ad13adafc9681e
SHA1d92b4ffa8dcd84c3e06372cecbe159c414b66367
SHA25603199379a5fa5b0849318c400267ec256c25e77b81a504acb87c848fc0e13911
SHA5124fe5dd2f1b8c6446adb4ec83a7dbc1b507bca43ef109e745d1163d298669a1743b997480454cca95a4153f2ea80cfa37eaf47ea284009067fc2904b22cee49ab