734d901dbc7e5107c47bc93c4186a53c21d206de3e1b78796c3ca228705daa29

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Size

168KB
MD5

8e862ce7b8bd4121ec99521183a23b9e
SHA1

637b75ff4d192d91208a3a0ba74481222f29b4a7
SHA256

734d901dbc7e5107c47bc93c4186a53c21d206de3e1b78796c3ca228705daa29
SHA512

0ee2b8160a2b51326c9d91a66cdd8552708c455179892d2ce9530a3f54f5cd02cdeac0e2480aa27453568c418b31b4735ca1192273bd7bc01cee6f269392494c
SSDEEP

1536:1EGh0oKlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oKlqOPOe2MUVg3Ve+rX

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3528668D-CCC3-49b3-884F-7B7CD1A12746}	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EBD0383-87C3-4881-ADEB-36D7764034FA}	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DB47397-88B1-4c60-A676-955EB92BB255}	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21871CE0-954A-4d11-A99F-51AD1AC69F27}\stubpath = "C:\\Windows\\{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe"	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C94386E-BBF1-4944-B658-67D1F14E7933}\stubpath = "C:\\Windows\\{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe"	{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}\stubpath = "C:\\Windows\\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe"	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD56FA73-2794-4aaf-BCC4-421902AEE446}\stubpath = "C:\\Windows\\{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe"	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C94386E-BBF1-4944-B658-67D1F14E7933}	{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}\stubpath = "C:\\Windows\\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe"	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{754373DF-19E3-48d4-869F-40F928BC7B4C}	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{754373DF-19E3-48d4-869F-40F928BC7B4C}\stubpath = "C:\\Windows\\{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe"	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EBD0383-87C3-4881-ADEB-36D7764034FA}\stubpath = "C:\\Windows\\{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe"	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F64463C-6362-4195-BC1F-931E8C8B79EE}	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F64463C-6362-4195-BC1F-931E8C8B79EE}\stubpath = "C:\\Windows\\{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe"	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21871CE0-954A-4d11-A99F-51AD1AC69F27}	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}\stubpath = "C:\\Windows\\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe"	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3528668D-CCC3-49b3-884F-7B7CD1A12746}\stubpath = "C:\\Windows\\{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe"	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}\stubpath = "C:\\Windows\\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe"	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DB47397-88B1-4c60-A676-955EB92BB255}\stubpath = "C:\\Windows\\{9DB47397-88B1-4c60-A676-955EB92BB255}.exe"	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD56FA73-2794-4aaf-BCC4-421902AEE446}	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe

Executes dropped EXE 12 IoCs

pid	Process
380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
1948	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
3788	{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe
1416	{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
File created	C:\Windows\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
File created	C:\Windows\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
File created	C:\Windows\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
File created	C:\Windows\{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
File created	C:\Windows\{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
File created	C:\Windows\{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
File created	C:\Windows\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
File created	C:\Windows\{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
File created	C:\Windows\{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
File created	C:\Windows\{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
File created	C:\Windows\{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe	{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
Token: SeIncBasePriorityPrivilege	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
Token: SeIncBasePriorityPrivilege	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
Token: SeIncBasePriorityPrivilege	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
Token: SeIncBasePriorityPrivilege	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
Token: SeIncBasePriorityPrivilege	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
Token: SeIncBasePriorityPrivilege	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
Token: SeIncBasePriorityPrivilege	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
Token: SeIncBasePriorityPrivilege	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
Token: SeIncBasePriorityPrivilege	1948	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
Token: SeIncBasePriorityPrivilege	3788	{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 380	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	87
PID 3248 wrote to memory of 380	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	87
PID 3248 wrote to memory of 380	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	87
PID 3248 wrote to memory of 3056	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	88
PID 3248 wrote to memory of 3056	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	88
PID 3248 wrote to memory of 3056	3248	2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe	88
PID 380 wrote to memory of 1368	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	91
PID 380 wrote to memory of 1368	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	91
PID 380 wrote to memory of 1368	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	91
PID 380 wrote to memory of 2188	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	92
PID 380 wrote to memory of 2188	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	92
PID 380 wrote to memory of 2188	380	{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe	92
PID 1368 wrote to memory of 1044	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	95
PID 1368 wrote to memory of 1044	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	95
PID 1368 wrote to memory of 1044	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	95
PID 1368 wrote to memory of 1692	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	96
PID 1368 wrote to memory of 1692	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	96
PID 1368 wrote to memory of 1692	1368	{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe	96
PID 1044 wrote to memory of 4612	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	97
PID 1044 wrote to memory of 4612	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	97
PID 1044 wrote to memory of 4612	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	97
PID 1044 wrote to memory of 4572	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	98
PID 1044 wrote to memory of 4572	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	98
PID 1044 wrote to memory of 4572	1044	{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe	98
PID 4612 wrote to memory of 1656	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	99
PID 4612 wrote to memory of 1656	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	99
PID 4612 wrote to memory of 1656	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	99
PID 4612 wrote to memory of 2984	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	100
PID 4612 wrote to memory of 2984	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	100
PID 4612 wrote to memory of 2984	4612	{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe	100
PID 1656 wrote to memory of 732	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	101
PID 1656 wrote to memory of 732	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	101
PID 1656 wrote to memory of 732	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	101
PID 1656 wrote to memory of 4692	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	102
PID 1656 wrote to memory of 4692	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	102
PID 1656 wrote to memory of 4692	1656	{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe	102
PID 732 wrote to memory of 4768	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	103
PID 732 wrote to memory of 4768	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	103
PID 732 wrote to memory of 4768	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	103
PID 732 wrote to memory of 4828	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	104
PID 732 wrote to memory of 4828	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	104
PID 732 wrote to memory of 4828	732	{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe	104
PID 4768 wrote to memory of 1784	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	105
PID 4768 wrote to memory of 1784	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	105
PID 4768 wrote to memory of 1784	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	105
PID 4768 wrote to memory of 2944	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	106
PID 4768 wrote to memory of 2944	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	106
PID 4768 wrote to memory of 2944	4768	{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe	106
PID 1784 wrote to memory of 2704	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	107
PID 1784 wrote to memory of 2704	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	107
PID 1784 wrote to memory of 2704	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	107
PID 1784 wrote to memory of 4792	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	108
PID 1784 wrote to memory of 4792	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	108
PID 1784 wrote to memory of 4792	1784	{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe	108
PID 2704 wrote to memory of 1948	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	109
PID 2704 wrote to memory of 1948	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	109
PID 2704 wrote to memory of 1948	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	109
PID 2704 wrote to memory of 4516	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	110
PID 2704 wrote to memory of 4516	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	110
PID 2704 wrote to memory of 4516	2704	{9DB47397-88B1-4c60-A676-955EB92BB255}.exe	110
PID 1948 wrote to memory of 3788	1948	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe	111
PID 1948 wrote to memory of 3788	1948	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe	111
PID 1948 wrote to memory of 3788	1948	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe	111
PID 1948 wrote to memory of 1792	1948	{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-03_8e862ce7b8bd4121ec99521183a23b9e_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
  C:\Windows\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
    C:\Windows\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
      C:\Windows\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
        
        C:\Windows\{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4612
      - C:\Windows\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
        
        C:\Windows\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
        
        C:\Windows\{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
        
        C:\Windows\{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
        
        C:\Windows\{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
        
        C:\Windows\{9DB47397-88B1-4c60-A676-955EB92BB255}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
        
        C:\Windows\{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe
        
        C:\Windows\{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
        
        C:\Windows\{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe
        
        C:\Windows\{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21871~1.EXE > nul
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD56F~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9DB47~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1F644~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4EBD0~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75437~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98206~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{35286~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6635~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{7E2F8~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C4562~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1F64463C-6362-4195-BC1F-931E8C8B79EE}.exe

Filesize
168KB

MD5
f4003d1351463977e9e75d3db2b181c8

SHA1
d13036ff2863b1001bff06f3a71b70c3ecee0588

SHA256
9b9b940a539da54ee3d48bb2f330306687ca0a67f1a027fa48c6fece901bdd18

SHA512
eaa0330dfbd08e817b34bb1ba63db0229e17d08f277c22482a0a9ff139de8c6deed86937ebe94c85930577e263a5f41504c84ff0aabd0236c9c537f8aaefa9e5

Download Submit
C:\Windows\{21871CE0-954A-4d11-A99F-51AD1AC69F27}.exe

Filesize
168KB

MD5
92a77a84c49da384ad29794635feb896

SHA1
846c5d3170132ac22bde7f0a7078937d003959b8

SHA256
648625c027bb84e03d324c71ba264f1f282259fbd1a4062b54de3cfe1c7a00c2

SHA512
c7fbb9c712d77811a024ae2ed68160f8c3f5f224fe6d20842d26e64885ada0274683bbcc1ddaaff2480bd580c1659cefbbcc8a18b45bb84eb511d7c34f9cab1f

Download Submit
C:\Windows\{3528668D-CCC3-49b3-884F-7B7CD1A12746}.exe

Filesize
168KB

MD5
fbbccd99f287571704e114ce7e318316

SHA1
48a42633149f40312cb1713a83657b25cc7f07e7

SHA256
b6dedc9a55bc546c16bb2c3bddbd60ef57935021275c0a93e8fa002c487d93f7

SHA512
f14febf17ec8f6814b9f2c41e3d442571827ca8d97acf434afa012fa3db6508ffc641674b921efe5195c0b5076a307049f28f949cdce495ac2429226fc117294

Download Submit
C:\Windows\{3C94386E-BBF1-4944-B658-67D1F14E7933}.exe

Filesize
168KB

MD5
6cfa111994646767fab70372ffefe82f

SHA1
8df4cc3a2cdc244fe839ef4b8c41d5e706fdd3cd

SHA256
aca34806e79995476f1dc9bbb05de3f2afb03cf7de5eb009c817cdf65fd6cac2

SHA512
120c8058182fcd7ae37b2290d3d472b070697cf1319ad0784dd966ff656ff18d45beb6e975c6a92713e37b91a6824679d04a504c267bd9e4cd1a1025894da603

Download Submit
C:\Windows\{4EBD0383-87C3-4881-ADEB-36D7764034FA}.exe

Filesize
168KB

MD5
c899cea0f0ea674d236a091bc591f910

SHA1
7e493a56af458f5de222a47c8fa79e601009e42d

SHA256
e0e9e14c1e90d7aec5282fed14b40ebe1ade7c23c47eba0cb3852f23c858c9f7

SHA512
960db7b4516e4d5142655fb44d9e9f6ae468518431fad70bcc5ffb9ea0f446d6cd3b054b822a0ab2805a5cd7f7ade497f710b3b1d711e6a337e5d1e0115718b3

Download Submit
C:\Windows\{754373DF-19E3-48d4-869F-40F928BC7B4C}.exe

Filesize
168KB

MD5
e0b0cd1d3ee7cc6e9d8682d27529a057

SHA1
ac2172c26cf3b449ddf06209a4645b98684e69aa

SHA256
ba04b4e996c29b4ef327f182408fd1e0d4487879db5a30706b8a37f5807afc26

SHA512
a5ec5dcec35271f0ad0e7a09f9911bff2ea53737b05185ef528b51ae3bf7d3c3d8c3f8b19924d7dcb3c62dd0a871b7958ed9b13c6e8b78a426b574549556942f

Download Submit
C:\Windows\{7E2F8CC8-E749-4afc-A567-C0C5685B025F}.exe

Filesize
168KB

MD5
095a6ec8e141a0eba3f45db60cf4034b

SHA1
e25813a3d2ad68f7a1ac8c0028e2738232a57d09

SHA256
02ee6ea64cff0b343d1fd07dfa7a471739b6531a2803967adb68d6046e974043

SHA512
004328cb35dcd441bfcd161528a1df73e47e1b853d6b475c9bcedf5bd620b1888f63a16b25e1f57d85c56f3b15dd1ac399b414db7977978dd122507780f6996a

Download Submit
C:\Windows\{98206A34-2A9E-4ed8-BABF-1D18DCCB9E1C}.exe

Filesize
168KB

MD5
a5476954e96b88d5b1e6e61cf0b6eed7

SHA1
ac8f098fa73146ff376257a9058589e647aa7797

SHA256
e5aadbd7a08358c37a9b30adf5a7fd7c3f4ebd486a76f01792c85780a508d76e

SHA512
f2f77eb2b8cbc8d274f680b2a258b742e18988eb08e25e1545e762bc10886b566f00782ced3dd02a05da7905232cc82c42d42b62afe1f5b956f84e1e0c76e574

Download Submit
C:\Windows\{9DB47397-88B1-4c60-A676-955EB92BB255}.exe

Filesize
168KB

MD5
3507a41493b87bc705f0e01343ef3667

SHA1
cf6cc4fdd3ddc260c10fc28442ebf343954f668a

SHA256
9db4ed747224b162c06f9631eae91ed261fdb077fc23138515f254473bc8b03e

SHA512
00287fef2295cf19e487eb4f1765128fcb23b0df96e6566a2909b6d08145a2bdb2eee1448a80062f02ba8c6d57de5c60c70f2e778bd44319daba2a5be182b397

Download Submit
C:\Windows\{C45621D4-7471-4b47-BCB0-2BCABC1606FB}.exe

Filesize
168KB

MD5
23f857c94b8353c265bdc47af04fd41f

SHA1
62959ec42bd287f9435bdb4557fc38e6b646ac44

SHA256
ab9876f695321f4e51a73406b00684b870fb9a1017d7b67f2b76d0acbdea48be

SHA512
8a08e44d17aa5056e631a055f67313ce71c7c78989ff41b32cb7f68cd85c5ed640014d731004ba8a7bf6e313eac3359498ecbc0ec17bb2c18060c9975bbbb90e

Download Submit
C:\Windows\{C6635F77-EE6A-4fc3-A920-8853DA4F6228}.exe

Filesize
168KB

MD5
b11f9f571d6a23df1d925227cad41212

SHA1
200405a918b302651127ea5ff3aba71bd2b7b887

SHA256
7467173563fa02323b07e6609a3c4c3a35d96e458912bb1066906b81cb899383

SHA512
cca87e4438f1e1342a233778ae31819e424627a7ba5439ed8fc12de0a9ec02a2ad6624a5cef417d57ba3d2b0a2fcd37617ce5381adbba0831389e557ae1695ed

Download Submit
C:\Windows\{CD56FA73-2794-4aaf-BCC4-421902AEE446}.exe

Filesize
168KB

MD5
e7c526503f74f7cebc06c6a37dc555b0

SHA1
ae7884538562d43551df3220115275cc15f105fd

SHA256
67e622d2b2ab6f10ff4fb0e42071f141703774d0bb35ff0c3d4b45d4ea9e05c4

SHA512
71e6b236c1d1e5bcd296406d577d37d454998b0481d4a13d6efe101b22011a45e7ca08529b92b4fdfb47cd8b5e213514c0a59a9060961c4b5eb19a20cab318a5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads