33775182b91005df376ed1c3f08057cc6fe3fceab7c30aecdc7070f638981a49

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe
Size 168KB
Sample240908-brmglswfkl
SHA256 33775182b91005df376ed1c3f08057cc6fe3fceab7c30aecdc7070f638981a49
MD5 35192e89006d10c925969e6363018cd0
SHA1 562cff44b372c013b42e2335aa5af49dd4dd4353
SHA512 08483284587a1332239cd36420ecc84422325a6059709dc2c108c2a8b313d4792dfb228f4e5122cc5064984e306ad018859a736ee82e507a2e1482241b077346
SSDEEP 1536:1EGh0onQlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oQlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}\stubpath = "C:\\Windows\\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe"	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}\stubpath = "C:\\Windows\\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe"	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D96B736-C846-43eb-BB36-FEF25D02CA76}	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5472324E-17FD-4ba7-8802-903BC13C0378}	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9009B890-3E1C-4d5e-B11A-AECD583EF602}	{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05791787-DDD8-4dca-AF24-F2557E9CA623}\stubpath = "C:\\Windows\\{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe"	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C52C0241-D634-4c20-80F4-082CED278A72}	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}	{C52C0241-D634-4c20-80F4-082CED278A72}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}\stubpath = "C:\\Windows\\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe"	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D96B736-C846-43eb-BB36-FEF25D02CA76}\stubpath = "C:\\Windows\\{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe"	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5472324E-17FD-4ba7-8802-903BC13C0378}\stubpath = "C:\\Windows\\{5472324E-17FD-4ba7-8802-903BC13C0378}.exe"	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9009B890-3E1C-4d5e-B11A-AECD583EF602}\stubpath = "C:\\Windows\\{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe"	{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B08983F4-F0AA-42be-8E74-3971FA6448BB}	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00351A51-0599-4c7f-9792-9172664BE9DD}	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00351A51-0599-4c7f-9792-9172664BE9DD}\stubpath = "C:\\Windows\\{00351A51-0599-4c7f-9792-9172664BE9DD}.exe"	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C52C0241-D634-4c20-80F4-082CED278A72}\stubpath = "C:\\Windows\\{C52C0241-D634-4c20-80F4-082CED278A72}.exe"	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}\stubpath = "C:\\Windows\\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe"	{C52C0241-D634-4c20-80F4-082CED278A72}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}\stubpath = "C:\\Windows\\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe"	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05791787-DDD8-4dca-AF24-F2557E9CA623}	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B08983F4-F0AA-42be-8E74-3971FA6448BB}\stubpath = "C:\\Windows\\{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe"	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe

Executes dropped EXE 12 IoCs

pid	Process
2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe
5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
4788	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
1300	{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
3288	{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
File created	C:\Windows\{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe
File created	C:\Windows\{C52C0241-D634-4c20-80F4-082CED278A72}.exe	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
File created	C:\Windows\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	{C52C0241-D634-4c20-80F4-082CED278A72}.exe
File created	C:\Windows\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
File created	C:\Windows\{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
File created	C:\Windows\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
File created	C:\Windows\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
File created	C:\Windows\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
File created	C:\Windows\{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
File created	C:\Windows\{5472324E-17FD-4ba7-8802-903BC13C0378}.exe	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
File created	C:\Windows\{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe	{5472324E-17FD-4ba7-8802-903BC13C0378}.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C52C0241-D634-4c20-80F4-082CED278A72}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
Token: SeIncBasePriorityPrivilege	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe
Token: SeIncBasePriorityPrivilege	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
Token: SeIncBasePriorityPrivilege	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
Token: SeIncBasePriorityPrivilege	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
Token: SeIncBasePriorityPrivilege	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
Token: SeIncBasePriorityPrivilege	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
Token: SeIncBasePriorityPrivilege	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
Token: SeIncBasePriorityPrivilege	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
Token: SeIncBasePriorityPrivilege	4788	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
Token: SeIncBasePriorityPrivilege	1300	{5472324E-17FD-4ba7-8802-903BC13C0378}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2464	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe	94
PID 756 wrote to memory of 2464	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe	94
PID 756 wrote to memory of 2464	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe	94
PID 756 wrote to memory of 3848	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe	95
PID 756 wrote to memory of 3848	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe	95
PID 756 wrote to memory of 3848	756	2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe	95
PID 2464 wrote to memory of 2512	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	96
PID 2464 wrote to memory of 2512	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	96
PID 2464 wrote to memory of 2512	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	96
PID 2464 wrote to memory of 4036	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	97
PID 2464 wrote to memory of 4036	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	97
PID 2464 wrote to memory of 4036	2464	{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe	97
PID 2512 wrote to memory of 5068	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe	99
PID 2512 wrote to memory of 5068	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe	99
PID 2512 wrote to memory of 5068	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe	99
PID 2512 wrote to memory of 2468	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe	100
PID 2512 wrote to memory of 2468	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe	100
PID 2512 wrote to memory of 2468	2512	{C52C0241-D634-4c20-80F4-082CED278A72}.exe	100
PID 5068 wrote to memory of 428	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	101
PID 5068 wrote to memory of 428	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	101
PID 5068 wrote to memory of 428	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	101
PID 5068 wrote to memory of 4956	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	102
PID 5068 wrote to memory of 4956	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	102
PID 5068 wrote to memory of 4956	5068	{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe	102
PID 428 wrote to memory of 4440	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	103
PID 428 wrote to memory of 4440	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	103
PID 428 wrote to memory of 4440	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	103
PID 428 wrote to memory of 2140	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	104
PID 428 wrote to memory of 2140	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	104
PID 428 wrote to memory of 2140	428	{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe	104
PID 4440 wrote to memory of 456	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	105
PID 4440 wrote to memory of 456	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	105
PID 4440 wrote to memory of 456	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	105
PID 4440 wrote to memory of 968	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	106
PID 4440 wrote to memory of 968	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	106
PID 4440 wrote to memory of 968	4440	{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe	106
PID 456 wrote to memory of 816	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	107
PID 456 wrote to memory of 816	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	107
PID 456 wrote to memory of 816	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	107
PID 456 wrote to memory of 2988	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	108
PID 456 wrote to memory of 2988	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	108
PID 456 wrote to memory of 2988	456	{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe	108
PID 816 wrote to memory of 404	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	110
PID 816 wrote to memory of 404	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	110
PID 816 wrote to memory of 404	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	110
PID 816 wrote to memory of 3588	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	111
PID 816 wrote to memory of 3588	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	111
PID 816 wrote to memory of 3588	816	{00351A51-0599-4c7f-9792-9172664BE9DD}.exe	111
PID 404 wrote to memory of 4420	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	112
PID 404 wrote to memory of 4420	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	112
PID 404 wrote to memory of 4420	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	112
PID 404 wrote to memory of 2432	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	113
PID 404 wrote to memory of 2432	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	113
PID 404 wrote to memory of 2432	404	{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe	113
PID 4420 wrote to memory of 4788	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	114
PID 4420 wrote to memory of 4788	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	114
PID 4420 wrote to memory of 4788	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	114
PID 4420 wrote to memory of 2040	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	115
PID 4420 wrote to memory of 2040	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	115
PID 4420 wrote to memory of 2040	4420	{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe	115
PID 4788 wrote to memory of 1300	4788	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe	116
PID 4788 wrote to memory of 1300	4788	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe	116
PID 4788 wrote to memory of 1300	4788	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe	116
PID 4788 wrote to memory of 3208	4788	{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_35192e89006d10c925969e6363018cd0_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
  C:\Windows\{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\{C52C0241-D634-4c20-80F4-082CED278A72}.exe
    C:\Windows\{C52C0241-D634-4c20-80F4-082CED278A72}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
      C:\Windows\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Windows\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
        
        C:\Windows\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Windows\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
        
        C:\Windows\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
        
        C:\Windows\{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
        
        C:\Windows\{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
        
        C:\Windows\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
        
        C:\Windows\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
        
        C:\Windows\{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
        
        C:\Windows\{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
        
        C:\Windows\{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe
        
        C:\Windows\{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{54723~1.EXE > nul
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D96B~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA0CF~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD92B~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00351~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05791~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D5D97~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:968
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{233D5~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3DC88~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C52C0~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B0898~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{00351A51-0599-4c7f-9792-9172664BE9DD}.exe

Path C:\Windows\{00351A51-0599-4c7f-9792-9172664BE9DD}.exe
Size 168KB
SHA256 ca988a5f7e5531755f88368fcc0e612f662385dd318ce5804041acbe44ebd89c
MD5 cb9bc3497142cb0ced4b614d0d1ec68c
SHA1 418c3bb6de058b21922c1603d5fae7b3ec28a6b7
SHA512 ad60db58aa61ebb50d9d6c65c094461e1dd2e731f4add2ee1e40906517c529bf30dde2b15b0c30f3b8673b599c1121ae875c248dff8877240b88304426afb556
SSDEEP 1536:1EGh0oclq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oclqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe

Path C:\Windows\{05791787-DDD8-4dca-AF24-F2557E9CA623}.exe
Size 168KB
SHA256 90e04bf55b3104089f677cbb1ffc10cefc26087cf50a6fe24e7bfaceb62fe0f6
MD5 74d11e5116942d3451f8afd805b9bd35
SHA1 f6db8bda2d32fd3a2b501e38518c66013bb396c9
SHA512 8d91c0d1fd9c7dda1bc5d67879e1c0a05a4a856c5ddc5adbc3569411490f05ffd6a60bb567f74237f82b5da579f7ed4e10726c29fff7f9e5ddea3ec5c0434f7e
SSDEEP 1536:1EGh0oelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oelqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe

Path C:\Windows\{1D96B736-C846-43eb-BB36-FEF25D02CA76}.exe
Size 168KB
SHA256 a24690fc95a6c9b73339c1dd22f158aed6678cd362d15c173817cbb4ef311f79
MD5 e6e67ec6ecb2ff011f7eac8b997409bc
SHA1 ab0b5461ae25f5a6b49961b00707f662ee2cab1a
SHA512 c59f6ea03982a6fceb8a65592bfe17732e76c3f215d57cdde8dc6933f147b1dc5e008516e137c1e0654021be08fc6e53e8c14af43cad2abc194344d20dcdc230
SSDEEP 1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe

Path C:\Windows\{233D516B-22A7-4c9b-8013-DA739E3CCAEB}.exe
Size 168KB
SHA256 a962827ce7b0154ae2ba9d3908d9038f9a4f45692f8c87970bee24a5a9bf7fa9
MD5 0a97a7d7724f7d03b2de7411b7dbf09c
SHA1 0485420021d50fe18dadf1cc26516c645d59a246
SHA512 8cab6367bd554535f5afbd2fe012dc86f9f027a78baf4878a0e576d7cc1cd07030112a46624f998aa11e0b0f839e67a0d15eca84a01219eb6301b0b7574e9872
SSDEEP 1536:1EGh0o9lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o9lqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe

Path C:\Windows\{3DC88ACE-E8F3-425a-AD80-F2931F57BED9}.exe
Size 168KB
SHA256 abe62e0a23c68ae73b63f99e62b58724cca22c083b119749e23b6972bb0314ae
MD5 f3178618121d498d3d77fc188aee8fc9
SHA1 d0d58937dd9efb728b3ea84b696098c8ab5bb3e7
SHA512 64ea7f4bb00d710552298c8aec6ec7e8a61e35d5cba9196f6dc3311d322ec93b72cea67755c75ed392256fa2ce1c72367b9d3b5e6d2ca9c2e00846f97bc9bbfd
SSDEEP 1536:1EGh0oalq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oalqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{5472324E-17FD-4ba7-8802-903BC13C0378}.exe

Path C:\Windows\{5472324E-17FD-4ba7-8802-903BC13C0378}.exe
Size 168KB
SHA256 a8e8b3296e995f479a861c4093a997677dfd58e2fefe3a12d992dfabe855c0d4
MD5 f2fc155fcd171181b57d19d616a768ce
SHA1 04639bc4d94076e31ec4d8d72ee6edc130ac11d1
SHA512 d67cbe6624251ad064f24dca8b01522298a52372ffc674db3ef2df079398678779c07f25a9753b3de1f7a4d1128cb14004817f8556ca76041353e610c9d6f008
SSDEEP 1536:1EGh0ojlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe

Path C:\Windows\{9009B890-3E1C-4d5e-B11A-AECD583EF602}.exe
Size 168KB
SHA256 a3efd6ba0292868169896770ed7594a77eb41b1b638330cfff56010d74dd62f8
MD5 6b4cccb6956aa19992c50cb2c1489d42
SHA1 abb327d7f3215e94d6c96dc480b2558fd0695b3e
SHA512 244d82d29ae4f937cdb7e4d304fd732fd85c5d42836a8eb4bc0e2eb712b792f7be3c175d689af3527f9574507067acc6836df8a0099e5707f192103e55940860
SSDEEP 1536:1EGh0oDlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oDlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe

Path C:\Windows\{B08983F4-F0AA-42be-8E74-3971FA6448BB}.exe
Size 168KB
SHA256 3c9e2efdce695743b046edf22ea5b977454f94e7c2c7c850df22bed44859d853
MD5 4cdd670c7801a50bb39571ea23251016
SHA1 86b43a5f5a426bb2eed2d4b4dcbabb4c6a9cde8a
SHA512 ebc8ab0a2ce4c5e42675f0f09852d38efe83e7d0a4edd3b05ad3b263b64a8dd5dd762a0bcb39f3a54a4a39ad3b1dba0ab630edeb17b715505a5590ed616a5af7
SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C52C0241-D634-4c20-80F4-082CED278A72}.exe

Path C:\Windows\{C52C0241-D634-4c20-80F4-082CED278A72}.exe
Size 168KB
SHA256 8ee3515a29cfadaa419bb80b0f745fab83cdd8dfa9ff281697873bdcddb71e7c
MD5 741b911e5c56553e2ef011a9d1c067b7
SHA1 54dbf2e472b242426b54b17a9cdedba06b8d36b0
SHA512 1464c58e3916c4e7af1631f16d0f34bf01caa4314a6a29bb5c2d952d0d3506d26cfa143e93a96cd5e06ec04a2f4e315a28132e23185a8c9280616a8bd914ac7e
SSDEEP 1536:1EGh0omlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0omlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe

Path C:\Windows\{D5D97E2C-4FAC-49be-9550-434BAA9F8D16}.exe
Size 168KB
SHA256 3357d82f9bbfad7d0f47136251f497d05fae2f7c94c26bf770e751e90433d423
MD5 910799abf2c3778509fb1b673d631084
SHA1 9547ada487a4ab5a3e9887953ea1d8e8800be305
SHA512 a50d070fb5f889e00e5c66da6dc8be70854ad51486507b5a0d37b37b4a28182e4bb7e81e8f308d1f3229ce738f807abae119107eb024108dba28760f8d06b14a
SSDEEP 1536:1EGh0oKlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oKlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe

Path C:\Windows\{EA0CF2D5-3F76-4ddd-9EB4-BC353A5A9BF2}.exe
Size 168KB
SHA256 1950f6963ff1faa00bd5e54f74f38855e72086fd842100edecf198b7e4868c07
MD5 9a98bb9aa53e5a35f1bfcd577cf48ab7
SHA1 4481290ee517d540bca62d7a39bc3e90d7828f40
SHA512 498e73d61e91a38e8160ac3228dbea87dc093645a03d2a3f4c7f701e2d2b880cca15cc4e098d3bbe3092bb6a5a1cfe17f79ab167ce9be1de43e5a734c05cf8d1
SSDEEP 1536:1EGh0o5lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o5lqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe

Path C:\Windows\{FD92B019-BB3D-4e5e-B82E-F174A7874BA9}.exe
Size 168KB
SHA256 a605f07270045f8ca58d448e6ce0c7a2bbd13cdda7367a92734ee3bbe7eb86cb
MD5 e7c95b759ec0f540284828c3f59fc9a7
SHA1 8edfbcdb0575fb4fa3cb2ec1654af4bb0ae89283
SHA512 5e8f2583cf1e8edcf2fee1698e34a6ec658636dbfd5ce23d7c2e455200b647050cdb518b637d3da47791a2357e6dc782381b0bdd5372ff2d29bbbd6a8ac989ad
SSDEEP 1536:1EGh0o+lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o+lqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads