734d901dbc7e5107c47bc93c4186a53c21d206de3e1b78796c3ca228705daa29

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Size

168KB
MD5

8e862ce7b8bd4121ec99521183a23b9e
SHA1

637b75ff4d192d91208a3a0ba74481222f29b4a7
SHA256

734d901dbc7e5107c47bc93c4186a53c21d206de3e1b78796c3ca228705daa29
SHA512

0ee2b8160a2b51326c9d91a66cdd8552708c455179892d2ce9530a3f54f5cd02cdeac0e2480aa27453568c418b31b4735ca1192273bd7bc01cee6f269392494c
SSDEEP

1536:1EGh0oKlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oKlqOPOe2MUVg3Ve+rX

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}\stubpath = "C:\\Windows\\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe"	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}\stubpath = "C:\\Windows\\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe"	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9B90821D-1F8B-4c90-9F67-48991F1E1202}	{3AAAEC41-5934-4053-8669-252E7677C347}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{92723311-DD0E-4960-A363-11EE4C28A832}\stubpath = "C:\\Windows\\{92723311-DD0E-4960-A363-11EE4C28A832}.exe"	{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{633B9D49-89C3-4f09-BE43-464489916273}\stubpath = "C:\\Windows\\{633B9D49-89C3-4f09-BE43-464489916273}.exe"	{92723311-DD0E-4960-A363-11EE4C28A832}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}\stubpath = "C:\\Windows\\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe"	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}\stubpath = "C:\\Windows\\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe"	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AAAEC41-5934-4053-8669-252E7677C347}\stubpath = "C:\\Windows\\{3AAAEC41-5934-4053-8669-252E7677C347}.exe"	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{92723311-DD0E-4960-A363-11EE4C28A832}	{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}\stubpath = "C:\\Windows\\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe"	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F447EEB-C663-4554-A69E-7B8C9A971734}	{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{91C6AF64-3158-43fd-854D-6A9D382C535F}	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{91C6AF64-3158-43fd-854D-6A9D382C535F}\stubpath = "C:\\Windows\\{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe"	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AAAEC41-5934-4053-8669-252E7677C347}	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9B90821D-1F8B-4c90-9F67-48991F1E1202}\stubpath = "C:\\Windows\\{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe"	{3AAAEC41-5934-4053-8669-252E7677C347}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F447EEB-C663-4554-A69E-7B8C9A971734}\stubpath = "C:\\Windows\\{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe"	{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{633B9D49-89C3-4f09-BE43-464489916273}	{92723311-DD0E-4960-A363-11EE4C28A832}.exe

Deletes itself 1 IoCs

pid	Process
2532	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe
2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
1428	{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
536	{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
2064	{92723311-DD0E-4960-A363-11EE4C28A832}.exe
2628	{633B9D49-89C3-4f09-BE43-464489916273}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe	{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
File created	C:\Windows\{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
File created	C:\Windows\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
File created	C:\Windows\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
File created	C:\Windows\{3AAAEC41-5934-4053-8669-252E7677C347}.exe	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
File created	C:\Windows\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
File created	C:\Windows\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
File created	C:\Windows\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
File created	C:\Windows\{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	{3AAAEC41-5934-4053-8669-252E7677C347}.exe
File created	C:\Windows\{92723311-DD0E-4960-A363-11EE4C28A832}.exe	{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
File created	C:\Windows\{633B9D49-89C3-4f09-BE43-464489916273}.exe	{92723311-DD0E-4960-A363-11EE4C28A832}.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{92723311-DD0E-4960-A363-11EE4C28A832}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{633B9D49-89C3-4f09-BE43-464489916273}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3AAAEC41-5934-4053-8669-252E7677C347}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
Token: SeIncBasePriorityPrivilege	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
Token: SeIncBasePriorityPrivilege	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
Token: SeIncBasePriorityPrivilege	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
Token: SeIncBasePriorityPrivilege	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
Token: SeIncBasePriorityPrivilege	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe
Token: SeIncBasePriorityPrivilege	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
Token: SeIncBasePriorityPrivilege	1428	{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
Token: SeIncBasePriorityPrivilege	536	{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
Token: SeIncBasePriorityPrivilege	2064	{92723311-DD0E-4960-A363-11EE4C28A832}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1700	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	31
PID 2520 wrote to memory of 1700	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	31
PID 2520 wrote to memory of 1700	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	31
PID 2520 wrote to memory of 1700	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	31
PID 2520 wrote to memory of 2532	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	32
PID 2520 wrote to memory of 2532	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	32
PID 2520 wrote to memory of 2532	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	32
PID 2520 wrote to memory of 2532	2520	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	32
PID 1700 wrote to memory of 2760	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	33
PID 1700 wrote to memory of 2760	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	33
PID 1700 wrote to memory of 2760	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	33
PID 1700 wrote to memory of 2760	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	33
PID 1700 wrote to memory of 2800	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	34
PID 1700 wrote to memory of 2800	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	34
PID 1700 wrote to memory of 2800	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	34
PID 1700 wrote to memory of 2800	1700	{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe	34
PID 2760 wrote to memory of 2776	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	35
PID 2760 wrote to memory of 2776	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	35
PID 2760 wrote to memory of 2776	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	35
PID 2760 wrote to memory of 2776	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	35
PID 2760 wrote to memory of 1692	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	36
PID 2760 wrote to memory of 1692	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	36
PID 2760 wrote to memory of 1692	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	36
PID 2760 wrote to memory of 1692	2760	{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe	36
PID 2776 wrote to memory of 2668	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	37
PID 2776 wrote to memory of 2668	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	37
PID 2776 wrote to memory of 2668	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	37
PID 2776 wrote to memory of 2668	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	37
PID 2776 wrote to memory of 2820	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	38
PID 2776 wrote to memory of 2820	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	38
PID 2776 wrote to memory of 2820	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	38
PID 2776 wrote to memory of 2820	2776	{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe	38
PID 2668 wrote to memory of 2724	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	39
PID 2668 wrote to memory of 2724	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	39
PID 2668 wrote to memory of 2724	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	39
PID 2668 wrote to memory of 2724	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	39
PID 2668 wrote to memory of 1992	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	40
PID 2668 wrote to memory of 1992	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	40
PID 2668 wrote to memory of 1992	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	40
PID 2668 wrote to memory of 1992	2668	{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe	40
PID 2724 wrote to memory of 3032	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	41
PID 2724 wrote to memory of 3032	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	41
PID 2724 wrote to memory of 3032	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	41
PID 2724 wrote to memory of 3032	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	41
PID 2724 wrote to memory of 3044	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	42
PID 2724 wrote to memory of 3044	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	42
PID 2724 wrote to memory of 3044	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	42
PID 2724 wrote to memory of 3044	2724	{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe	42
PID 3032 wrote to memory of 2996	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	43
PID 3032 wrote to memory of 2996	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	43
PID 3032 wrote to memory of 2996	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	43
PID 3032 wrote to memory of 2996	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	43
PID 3032 wrote to memory of 1272	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	44
PID 3032 wrote to memory of 1272	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	44
PID 3032 wrote to memory of 1272	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	44
PID 3032 wrote to memory of 1272	3032	{3AAAEC41-5934-4053-8669-252E7677C347}.exe	44
PID 2996 wrote to memory of 1428	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	45
PID 2996 wrote to memory of 1428	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	45
PID 2996 wrote to memory of 1428	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	45
PID 2996 wrote to memory of 1428	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	45
PID 2996 wrote to memory of 3060	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	46
PID 2996 wrote to memory of 3060	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	46
PID 2996 wrote to memory of 3060	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	46
PID 2996 wrote to memory of 3060	2996	{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe	46

C:\Users\Admin\AppData\Local\Temp\2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
  C:\Windows\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
    C:\Windows\{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
      C:\Windows\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
        
        C:\Windows\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Windows\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
        
        C:\Windows\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\{3AAAEC41-5934-4053-8669-252E7677C347}.exe
        
        C:\Windows\{3AAAEC41-5934-4053-8669-252E7677C347}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
        
        C:\Windows\{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
        
        C:\Windows\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
        
        C:\Windows\{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
        
        C:\Windows\{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
        
        C:\Windows\{92723311-DD0E-4960-A363-11EE4C28A832}.exe
        
        C:\Windows\{92723311-DD0E-4960-A363-11EE4C28A832}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\{633B9D49-89C3-4f09-BE43-464489916273}.exe
        
        C:\Windows\{633B9D49-89C3-4f09-BE43-464489916273}.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92723~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4F447~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA40C~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B908~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3AAAE~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AC404~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7D933~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9BED3~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{91C6A~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3D1DA~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3AAAEC41-5934-4053-8669-252E7677C347}.exe

Filesize
168KB

MD5
2b375cbb20869955baa8239bfb99e1f7

SHA1
ebef16d943b56e8ba1fbfa1fefe827c7028f4363

SHA256
69d46adc4db4fb7c45560471daaa573a371b04c2946968e485047dcd1bb15b6a

SHA512
6f78a75bc2594581a2b9750f1d037446e4c41b6d044b303ca290fbfd79f7be16c812985b0ccfe2a2af2cd204bea18e7503d91054c9f068c9173849ececa2941a

Download Submit
C:\Windows\{3D1DAF7C-10D9-4f3e-B0A7-EAB5D97DB38E}.exe

Filesize
168KB

MD5
2394cc4a50ea4e05ceb6c17d307ddd42

SHA1
46196e4822e5307b5511285f22daf3910ccfbdff

SHA256
b668e2d0713c7c8b4035616b949f6d4d86e82e8989101f7d5a45f58a3bc92f3f

SHA512
3cfb4728b5eabc78359cefd2052684750b8e01a37e13494a1fe8885027361e55d708151dd56e74b3b5fe0c29c28621150a71a42fe61aeb6575f3818a9d077f7b

Download Submit
C:\Windows\{4F447EEB-C663-4554-A69E-7B8C9A971734}.exe

Filesize
168KB

MD5
847d893c67c7747f712297ce0ee0d8a5

SHA1
18dd8c03f15704544246e46851ccfda62b6ef551

SHA256
dd0ff147785b0052a08195f247397a07cc4b2beb82772ac7116bd5cc499c4ceb

SHA512
b2e60829c63b659b5efa46bb5e138d54c1b436e8d9b69bb911a4babdda8cd31b5ff80670c9a43bdb02e7b0e575079893bb41d35ba929106e16f49e2b6ee98b7f

Download Submit
C:\Windows\{633B9D49-89C3-4f09-BE43-464489916273}.exe

Filesize
168KB

MD5
3ae849ff6f5966cb19b6180458fc311e

SHA1
722dd72aa53de5b236fe630df70e4d6524daa679

SHA256
f44a23d082a36c990628775e0b5a0f34fe6606600ee2bf71ca2e51dfbef6b4ee

SHA512
a90acc3c63150f2165b62cb7ceb16b2bc2efe7ea123280cb418003d988e81111cdc3f81f089c7ca3d86682d8e4460b29eba223c29b1d274cd5e22498f407686e

Download Submit
C:\Windows\{7D9331C3-498E-4bb1-93E5-EE1948EDC241}.exe

Filesize
168KB

MD5
a065a1b7b3faf11f9ebcb81021747e98

SHA1
d7637ef1db6faf2bdec278fbac2b5149bd46db04

SHA256
fc9cd5a858aefa0e7a967a79d1cad8a0377ddd24a88dde5ab9c657debf64d63d

SHA512
c454c18747641eb81718e41869c69be358e75d6417a123105dd45d79323a7c07bf93cbd4d1ab9a6f34d31b92cefea8a357a81a9db2dc121ebc6308ad6914ef42

Download Submit
C:\Windows\{91C6AF64-3158-43fd-854D-6A9D382C535F}.exe

Filesize
168KB

MD5
bf20988fbcb80ee7570a954d29b61cbd

SHA1
2ec2f14b5f71d3af442688ad83c12e3cc9968e0b

SHA256
bc3f97c192d17bcf44968c5ad677cd4b624b3c79ff9f21a1278be67e376a7332

SHA512
61f2d44b0b0fc48af4697084c2149f96f98791d75dc115ab5442f9f3dc07a5e53d26c4c3dd579cf8c1d95b0063e92418919a0402aa38868e439487f93c883b83

Download Submit
C:\Windows\{92723311-DD0E-4960-A363-11EE4C28A832}.exe

Filesize
168KB

MD5
1c6491cb2b25745f8b041a808c76af10

SHA1
f129555860ed65e48ecc5c45394b4783d03b5ee5

SHA256
008b16e2b5756b2a384fb840495ceb5841100467dcbb9b85a0db14b9a5970e25

SHA512
6d6ceefd5fa042ade0b21aef5b1ae30aa7cafb0ee99ae24b520dc8a31f4c8523bd8b56200f5e48be86c0aa6a9fbd9bd9718c14130c7577e94fbe09f070355ace

Download Submit
C:\Windows\{9B90821D-1F8B-4c90-9F67-48991F1E1202}.exe

Filesize
168KB

MD5
8cf756436a277a0ec471ff284878be87

SHA1
e1c5df34ecee91c2c4d04b0e33bccf1598cae15b

SHA256
927be30e039fc7c940086fec67f0bda502a106d4b2a845ba74c42446e701af3e

SHA512
22a43c9da47f4d69ae24a102c30b29cecd67744a55b12303b75f07516adfc09e665bb4cb4805be375150f701bdc7ec0195d42b250b0695359e305d9875d3b62c

Download Submit
C:\Windows\{9BED3BD5-434D-4065-83E2-AEA002B3DE57}.exe

Filesize
168KB

MD5
474d01215c42f72e4d978c92be81b50a

SHA1
5e899656d913e716fb3cb4e967fbd034fce402b6

SHA256
857b166d128fa2fa82aef8d03a952535bc8ad095e6f029fee572ebb7f2790db5

SHA512
b5cb6ca2cc8f9b926d65ceb52639ff7da96100a7dc1a0ac9723929dab2fe138baa430d541600bfbb1a7d219df30338e7c4afb5b4b8893ad904af844427809536

Download Submit
C:\Windows\{AC404137-2DC4-44bb-963D-BEF9297FE9A8}.exe

Filesize
168KB

MD5
53a1a96cab571fb12d94c0b9c6014e37

SHA1
80573fcb83cdf71a47ed78ac4c2cc4160f681332

SHA256
9299a75ce60049f690414756bfa507f1543dc8cb824dda831d60c17d987a433f

SHA512
bc56507f755ed9f58af178355251e4f0de96a9bc520d9e27e29ab14a49a5835c50caf292eaa18e7896a23894c32d67edcfae5375a34686042afa61ed574c8db9

Download Submit
C:\Windows\{DA40C8E9-8AE4-4558-B3D3-220A5DFDE104}.exe

Filesize
168KB

MD5
5e8b57d8144ed1c626c1764779470072

SHA1
a7e5f2c98677410bb4750f0e745c28edb75de5c3

SHA256
d687b48dbcc61b0b1250148121249c19030dd0d27818e671c82a2f1af048351f

SHA512
0a2b11ada1514a78fecd16ff16c74964ca2c2be18441b47d3924c1709e4a624be3a94fbadc4463c5bf151ffa4e519d2e5ccc42da0a7aacbdae166fed6a20c0de

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads