2510c29efa49114cdeb4307def14e8b4cb29b3d58d4d162838f80606d92b98ae

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
Size

180KB
MD5

cf3400b6f95cc981546e5e97c4697b74
SHA1

3d2cca64e9a97dbd9c2d03acd4bcf8ee821093d9
SHA256

2510c29efa49114cdeb4307def14e8b4cb29b3d58d4d162838f80606d92b98ae
SHA512

c8d7d77baf718c11f407ea488a3fc257ada8be74ff9046a742f27d44cbb4c82130696e83ee5f94e346a1360380bdfa91bfdd137b3bf94525d5e2017de82ce4fe
SSDEEP

3072:jEGh0o4lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGel5eKcAEc

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}\stubpath = "C:\\Windows\\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe"	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E116A6-E104-4f97-A819-A8CA574D0CCA}	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E116A6-E104-4f97-A819-A8CA574D0CCA}\stubpath = "C:\\Windows\\{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe"	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3151B4BF-4D80-445d-90DD-A5531556B8E2}	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}\stubpath = "C:\\Windows\\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe"	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}\stubpath = "C:\\Windows\\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe"	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}	{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}\stubpath = "C:\\Windows\\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe"	{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}\stubpath = "C:\\Windows\\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe"	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3151B4BF-4D80-445d-90DD-A5531556B8E2}\stubpath = "C:\\Windows\\{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe"	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}\stubpath = "C:\\Windows\\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe"	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BE946B6-D65C-482d-B401-424BDDDF5467}	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}\stubpath = "C:\\Windows\\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe"	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}\stubpath = "C:\\Windows\\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe"	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BE946B6-D65C-482d-B401-424BDDDF5467}\stubpath = "C:\\Windows\\{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe"	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}\stubpath = "C:\\Windows\\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe"	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe

Executes dropped EXE 12 IoCs

pid	Process
2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
740	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
5000	{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
220	{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
File created	C:\Windows\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
File created	C:\Windows\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
File created	C:\Windows\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
File created	C:\Windows\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
File created	C:\Windows\{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
File created	C:\Windows\{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
File created	C:\Windows\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
File created	C:\Windows\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
File created	C:\Windows\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe	{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
File created	C:\Windows\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
File created	C:\Windows\{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
Token: SeIncBasePriorityPrivilege	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
Token: SeIncBasePriorityPrivilege	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
Token: SeIncBasePriorityPrivilege	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
Token: SeIncBasePriorityPrivilege	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
Token: SeIncBasePriorityPrivilege	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
Token: SeIncBasePriorityPrivilege	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
Token: SeIncBasePriorityPrivilege	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
Token: SeIncBasePriorityPrivilege	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
Token: SeIncBasePriorityPrivilege	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
Token: SeIncBasePriorityPrivilege	740	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
Token: SeIncBasePriorityPrivilege	5000	{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2420	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe	94
PID 224 wrote to memory of 2420	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe	94
PID 224 wrote to memory of 2420	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe	94
PID 224 wrote to memory of 1272	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe	95
PID 224 wrote to memory of 1272	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe	95
PID 224 wrote to memory of 1272	224	20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe	95
PID 2420 wrote to memory of 364	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	96
PID 2420 wrote to memory of 364	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	96
PID 2420 wrote to memory of 364	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	96
PID 2420 wrote to memory of 1432	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	97
PID 2420 wrote to memory of 1432	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	97
PID 2420 wrote to memory of 1432	2420	{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe	97
PID 364 wrote to memory of 3388	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	100
PID 364 wrote to memory of 3388	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	100
PID 364 wrote to memory of 3388	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	100
PID 364 wrote to memory of 1200	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	101
PID 364 wrote to memory of 1200	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	101
PID 364 wrote to memory of 1200	364	{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe	101
PID 3388 wrote to memory of 3300	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	102
PID 3388 wrote to memory of 3300	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	102
PID 3388 wrote to memory of 3300	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	102
PID 3388 wrote to memory of 588	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	103
PID 3388 wrote to memory of 588	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	103
PID 3388 wrote to memory of 588	3388	{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe	103
PID 3300 wrote to memory of 4916	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	104
PID 3300 wrote to memory of 4916	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	104
PID 3300 wrote to memory of 4916	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	104
PID 3300 wrote to memory of 4800	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	105
PID 3300 wrote to memory of 4800	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	105
PID 3300 wrote to memory of 4800	3300	{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe	105
PID 4916 wrote to memory of 1356	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	106
PID 4916 wrote to memory of 1356	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	106
PID 4916 wrote to memory of 1356	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	106
PID 4916 wrote to memory of 4448	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	107
PID 4916 wrote to memory of 4448	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	107
PID 4916 wrote to memory of 4448	4916	{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe	107
PID 1356 wrote to memory of 764	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	108
PID 1356 wrote to memory of 764	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	108
PID 1356 wrote to memory of 764	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	108
PID 1356 wrote to memory of 3320	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	109
PID 1356 wrote to memory of 3320	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	109
PID 1356 wrote to memory of 3320	1356	{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe	109
PID 764 wrote to memory of 3432	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	110
PID 764 wrote to memory of 3432	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	110
PID 764 wrote to memory of 3432	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	110
PID 764 wrote to memory of 5044	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	111
PID 764 wrote to memory of 5044	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	111
PID 764 wrote to memory of 5044	764	{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe	111
PID 3432 wrote to memory of 3600	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	112
PID 3432 wrote to memory of 3600	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	112
PID 3432 wrote to memory of 3600	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	112
PID 3432 wrote to memory of 412	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	113
PID 3432 wrote to memory of 412	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	113
PID 3432 wrote to memory of 412	3432	{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe	113
PID 3600 wrote to memory of 740	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	114
PID 3600 wrote to memory of 740	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	114
PID 3600 wrote to memory of 740	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	114
PID 3600 wrote to memory of 1540	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	115
PID 3600 wrote to memory of 1540	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	115
PID 3600 wrote to memory of 1540	3600	{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe	115
PID 740 wrote to memory of 5000	740	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe	116
PID 740 wrote to memory of 5000	740	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe	116
PID 740 wrote to memory of 5000	740	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe	116
PID 740 wrote to memory of 2940	740	{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe	117

C:\Users\Admin\AppData\Local\Temp\20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\20240906cf3400b6f95cc981546e5e97c4697b74goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
  C:\Windows\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
    C:\Windows\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
      C:\Windows\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Windows\{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
        
        C:\Windows\{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3300
      - C:\Windows\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
        
        C:\Windows\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
        
        C:\Windows\{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
        
        C:\Windows\{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
        
        C:\Windows\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
        
        C:\Windows\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
        
        C:\Windows\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
        
        C:\Windows\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
        
        C:\Windows\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe
        
        C:\Windows\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EF61C~1.EXE > nul
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E9CAC~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BF88~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA10E~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3151B~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6BE94~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DABCD~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71E11~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DFDC7~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F840A~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B8DBC~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\202409~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3151B4BF-4D80-445d-90DD-A5531556B8E2}.exe

Filesize
180KB

MD5
bd1025d0c47095c61f8d55d396e47449

SHA1
269e4f189595ec7c37c4d90e8a6ec0c8a485bf6d

SHA256
db51df84c4439fa5cd3561af41e0f11e785af55941eceb42ccaa28bac7011f27

SHA512
010ce7ce2407b6f207de6cc2df000f6265e33a5cef5d21518f255f0e3f415799e8d75dea59dfc0225c087b79c14a2246c92fd61d02d705cf42757699fe6f4344

Download Submit
C:\Windows\{3BF88337-4B2F-447a-97BE-6BD6D6FB3C3E}.exe

Filesize
180KB

MD5
9ba506d3c9f5df20d32f912d6ac96527

SHA1
d7c7c84af0081d1c1e7a3824ecef7ce767275af9

SHA256
fef8ab8e7234163e63d40c6a7dfd91e4240901233d5619ab7144cf64633e37b4

SHA512
008d3d4c78c9cb4796f3e5d0802bf3049d01fe36f6ddc9bc475a5aad62ebf06528fa53227cf3d5b8d643c7300826149cf2b45da830622cb3a76e9eedaefd9cdf

Download Submit
C:\Windows\{5D57DBDF-203F-496b-BC41-9F27EA1AD7EA}.exe

Filesize
180KB

MD5
109cee99432c3c6ce823fddf814ba7c1

SHA1
ca143572b44b7aaaba2072c08d1b87e37b205670

SHA256
8ba97fb9d246d9702e23cc9a9ddd6895e529ec5c456a83f635e7309c4d22890c

SHA512
9e4839215694205058d2ff28c8375159b476f7868960f808f99f11fa7dae8a7f70b383d4df37d440b546a32b906de8c49f7eef07e2a113e82203dc20336a222b

Download Submit
C:\Windows\{6BE946B6-D65C-482d-B401-424BDDDF5467}.exe

Filesize
180KB

MD5
f58c3e7fd41a6faf02e7a425a8eec4fb

SHA1
f019258d82e4b035a394fb9c60b66084855a9ba3

SHA256
9f3b85102568e39e8c3df109feb49dcd61ff3194d652aa2523a2effb3a1fbf79

SHA512
d7f0dae3c2cfdf7a7582f4276663e711d875200f53130e1e98c75e5fbaebba846066598917fc66f57c44285b56c2a715a16d8734bac3215dcf28bf6cf35065c1

Download Submit
C:\Windows\{71E116A6-E104-4f97-A819-A8CA574D0CCA}.exe

Filesize
180KB

MD5
414e2bf32002980db18ca4bc516c8398

SHA1
50ceb4ddd0d916f0dd404201da2c28df65e6d771

SHA256
044fb3d9ee10f8cec8741146ab52ec1ac49a2b41a395ab9d9fc4939bf729c8e4

SHA512
f40a20d5c1e86a41bde0e3956c506de6964722c047875e3d6aa77ac1572d90957171091a8b1ee0e7e50b24dcffc8979fd42c2f585c18a4b0fb6a42d46bb9593f

Download Submit
C:\Windows\{B8DBCED3-75DC-48f8-BA29-ACB3E9650DE1}.exe

Filesize
180KB

MD5
211002b303b20eba0dac3fc34f32710d

SHA1
276e135b015e3964df72a30a7fb4bbf02ab31bd6

SHA256
007470c3491a0fbc25a892b3f63345340ce0f6df4d31c619b60194a461d35e69

SHA512
8ced18b8677002344130264b7b8c263805a09b6f8c931562d6513d69defbc1efd8bdf57aaecadf700516bed8420d10bbfc13cfcdf7ee1db5aac732f0378703ef

Download Submit
C:\Windows\{DABCDCBB-8B02-4bf4-A555-6131684B0F0F}.exe

Filesize
180KB

MD5
f218961e669a4d01bf24182bf82e4e9f

SHA1
560debaafe45b2171a6b15b797a7dc35aa53dc47

SHA256
a722f5a04d07abbb7c036c7e4f52d9e21104ef7d6cbdeb3af2dd1a825e4292b7

SHA512
745b0aef27edc9f1c3030102970337d3a3eb854f76afc340b82b568c08cd3dbaa8434a0f805844fbe25ea4eeee444025ddc703a6a4921a17425b381879e0da54

Download Submit
C:\Windows\{DFDC78B1-F8EB-4ced-90FB-7C659A1ABBCB}.exe

Filesize
180KB

MD5
409da3f4e04e3a2c3fe2d8fc12117dd7

SHA1
06222eb15af22635a557a3bf8364b734afd2ce50

SHA256
41cc27f09f8529b43dc83f43ce45c479f93020d5eadff78772d2c41c4b963484

SHA512
325da84da3d12190cf8d50ec9cbb0d39042bf543d24f90416e6d1d859b01a669357b88e688edaf13ef6bf76e53205a0d81b51aab8752d206fe62a723868b4423

Download Submit
C:\Windows\{E9CAC8DD-FD54-4347-879E-CAE5BCF10761}.exe

Filesize
180KB

MD5
902e0420116e492a88f09a57efe0b113

SHA1
bd283ec4642d684aec978089a8c089f35ae98a9c

SHA256
3842c9ff6577d1ed822aff2057ffdf4ae9be0fa1f20975a8c6d9cd8aa36b55f5

SHA512
bb99cdc57263e75c338bd6b2b7c7f0e1702a76a866e41573497825127a2cc1498b2e8313a3e0585c9f5df29777f14726f62bd765ee757bbb8435b6da4ae1bf8f

Download Submit
C:\Windows\{EA10E7EB-4CC0-4969-9BB6-19A413B1F696}.exe

Filesize
180KB

MD5
d1095ea7110a5779f9780711dff228fb

SHA1
0bca4cb9ccede9a8bbc7a87b8eadde76d85765bf

SHA256
73d744ec6293d435bcbdaf331c7b6ff4ea9ce56c3634d437028b3667d719a18b

SHA512
800bb96a1d610e18557adde89d24362c9214272aacab1303ce84d87d429325072047e2f002772b434fe85487617630ac4ea92d0dec09ca9b04d833fd5ff223c0

Download Submit
C:\Windows\{EF61CB80-B59A-41db-8657-D3B3F711AEEC}.exe

Filesize
180KB

MD5
f4b8f20273367291e3805c626a12fe72

SHA1
c258f5c1f66c90fe8954bc1a1746447278d24707

SHA256
526fac29f435c5b8ac4834ad52e94922d95d79684465b8317308a0ec929771eb

SHA512
50accf5c08ad3cf4ed668f1fa16ac72cd0e4ac081b935dcdb8e5207bbf1115ce03a37dbe024cdff76bad3268b9fb8162d6d80b9641b55e92f554d04ce2f94218

Download Submit
C:\Windows\{F840A993-6AFC-4092-B8F9-C4A85E0D476E}.exe

Filesize
180KB

MD5
1790caed334bf60392638fea4d94e716

SHA1
560e4078a66ea839c18118c4ab4caf7d25183bd5

SHA256
07414f7d4f6fb9a0648787b82e76e94c305d9a9d07c53062df019a1df3bcee1d

SHA512
ba38fcb6fabab1579c9522cdcd280f2760b41a392bf416cb799e1140c022b30ba9aeceac5a685921694335040e7441541fdf65292f0bb049a0520e06a6ffcb10

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads