45327a9cc39d7e6c79c83c03a0e6872af72bc0c097a4f09e5e5db865a95b05b5

Analysis

max time kernel
144s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
Size

168KB
MD5

54f99ead31104fc3b98c81923ae979ac
SHA1

f4f6afe39b6fe1521ac38a76816c5284c003339f
SHA256

45327a9cc39d7e6c79c83c03a0e6872af72bc0c097a4f09e5e5db865a95b05b5
SHA512

502655854e353486edeb2c73d93e53dac81c0b81e7903329caaa3631a3e964e32e194a133c3036ce1ccc21f276a1c5043c1b190f5575fff5f1502ccc236b099d
SSDEEP

1536:1EGh0ozlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ozlqOPOe2MUVg3Ve+rX

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7568C833-1948-4aae-818B-717C175B5248}	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}\stubpath = "C:\\Windows\\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe"	{7568C833-1948-4aae-818B-717C175B5248}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}\stubpath = "C:\\Windows\\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe"	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{809A6B50-D306-402a-AA7C-69EE5DA7306C}	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}	{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA13BA1E-A037-4dbd-83A9-906F13974E71}\stubpath = "C:\\Windows\\{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe"	{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}\stubpath = "C:\\Windows\\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe"	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}	{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}\stubpath = "C:\\Windows\\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe"	{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}	{7568C833-1948-4aae-818B-717C175B5248}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7568C833-1948-4aae-818B-717C175B5248}\stubpath = "C:\\Windows\\{7568C833-1948-4aae-818B-717C175B5248}.exe"	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}\stubpath = "C:\\Windows\\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe"	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}\stubpath = "C:\\Windows\\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe"	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{809A6B50-D306-402a-AA7C-69EE5DA7306C}\stubpath = "C:\\Windows\\{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe"	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}\stubpath = "C:\\Windows\\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe"	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}\stubpath = "C:\\Windows\\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe"	{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA13BA1E-A037-4dbd-83A9-906F13974E71}	{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe

Deletes itself 1 IoCs

pid	Process
1912	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
2092	{7568C833-1948-4aae-818B-717C175B5248}.exe
2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
3044	{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
2524	{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
1676	{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
2160	{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
File created	C:\Windows\{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
File created	C:\Windows\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
File created	C:\Windows\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe	{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
File created	C:\Windows\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe	{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
File created	C:\Windows\{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe	{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
File created	C:\Windows\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
File created	C:\Windows\{7568C833-1948-4aae-818B-717C175B5248}.exe	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
File created	C:\Windows\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	{7568C833-1948-4aae-818B-717C175B5248}.exe
File created	C:\Windows\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
File created	C:\Windows\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7568C833-1948-4aae-818B-717C175B5248}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
Token: SeIncBasePriorityPrivilege	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe
Token: SeIncBasePriorityPrivilege	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
Token: SeIncBasePriorityPrivilege	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
Token: SeIncBasePriorityPrivilege	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
Token: SeIncBasePriorityPrivilege	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
Token: SeIncBasePriorityPrivilege	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
Token: SeIncBasePriorityPrivilege	3044	{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
Token: SeIncBasePriorityPrivilege	2524	{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
Token: SeIncBasePriorityPrivilege	1676	{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3000	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	30
PID 2024 wrote to memory of 3000	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	30
PID 2024 wrote to memory of 3000	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	30
PID 2024 wrote to memory of 3000	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	30
PID 2024 wrote to memory of 1912	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	31
PID 2024 wrote to memory of 1912	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	31
PID 2024 wrote to memory of 1912	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	31
PID 2024 wrote to memory of 1912	2024	2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe	31
PID 3000 wrote to memory of 2092	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	32
PID 3000 wrote to memory of 2092	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	32
PID 3000 wrote to memory of 2092	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	32
PID 3000 wrote to memory of 2092	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	32
PID 3000 wrote to memory of 2788	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	33
PID 3000 wrote to memory of 2788	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	33
PID 3000 wrote to memory of 2788	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	33
PID 3000 wrote to memory of 2788	3000	{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe	33
PID 2092 wrote to memory of 2004	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	34
PID 2092 wrote to memory of 2004	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	34
PID 2092 wrote to memory of 2004	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	34
PID 2092 wrote to memory of 2004	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	34
PID 2092 wrote to memory of 2844	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	35
PID 2092 wrote to memory of 2844	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	35
PID 2092 wrote to memory of 2844	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	35
PID 2092 wrote to memory of 2844	2092	{7568C833-1948-4aae-818B-717C175B5248}.exe	35
PID 2004 wrote to memory of 2680	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	36
PID 2004 wrote to memory of 2680	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	36
PID 2004 wrote to memory of 2680	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	36
PID 2004 wrote to memory of 2680	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	36
PID 2004 wrote to memory of 2740	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	37
PID 2004 wrote to memory of 2740	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	37
PID 2004 wrote to memory of 2740	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	37
PID 2004 wrote to memory of 2740	2004	{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe	37
PID 2680 wrote to memory of 944	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	38
PID 2680 wrote to memory of 944	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	38
PID 2680 wrote to memory of 944	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	38
PID 2680 wrote to memory of 944	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	38
PID 2680 wrote to memory of 1356	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	39
PID 2680 wrote to memory of 1356	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	39
PID 2680 wrote to memory of 1356	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	39
PID 2680 wrote to memory of 1356	2680	{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe	39
PID 944 wrote to memory of 1744	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	40
PID 944 wrote to memory of 1744	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	40
PID 944 wrote to memory of 1744	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	40
PID 944 wrote to memory of 1744	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	40
PID 944 wrote to memory of 1976	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	41
PID 944 wrote to memory of 1976	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	41
PID 944 wrote to memory of 1976	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	41
PID 944 wrote to memory of 1976	944	{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe	41
PID 1744 wrote to memory of 3052	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	42
PID 1744 wrote to memory of 3052	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	42
PID 1744 wrote to memory of 3052	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	42
PID 1744 wrote to memory of 3052	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	42
PID 1744 wrote to memory of 2920	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	43
PID 1744 wrote to memory of 2920	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	43
PID 1744 wrote to memory of 2920	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	43
PID 1744 wrote to memory of 2920	1744	{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe	43
PID 3052 wrote to memory of 3044	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	44
PID 3052 wrote to memory of 3044	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	44
PID 3052 wrote to memory of 3044	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	44
PID 3052 wrote to memory of 3044	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	44
PID 3052 wrote to memory of 3048	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	45
PID 3052 wrote to memory of 3048	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	45
PID 3052 wrote to memory of 3048	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	45
PID 3052 wrote to memory of 3048	3052	{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-06_54f99ead31104fc3b98c81923ae979ac_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
  C:\Windows\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\{7568C833-1948-4aae-818B-717C175B5248}.exe
    C:\Windows\{7568C833-1948-4aae-818B-717C175B5248}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
      C:\Windows\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
        
        C:\Windows\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
        
        C:\Windows\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
        
        C:\Windows\{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
        
        C:\Windows\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
        
        C:\Windows\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
        
        C:\Windows\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
        
        C:\Windows\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
        
        C:\Windows\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe
        
        C:\Windows\{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{51C31~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28BCF~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9B60~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8C2E~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{809A6~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C249B~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D207C~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8289F~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{7568C~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CA9A9~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{28BCF2CE-66ED-4771-9BEE-2E577968AA30}.exe

Filesize
168KB

MD5
87a99ae7ac3de86ee2e95e57476697e6

SHA1
c42fe4b2e82851e41c85a09c5a76203fb72cc5cd

SHA256
5ed88c60b8d1eb176fa74d5167fe2ba533e63808a134194a3bbb7111287cd9ec

SHA512
4dea46557dcbf260115b6ee9b2f37ad1bd67dc3c6043e4046b5f03c7af5a51e6392294095f4ec7aaaf7228a595624c06a32f617b90c58e0911ba6b41901714bb

Download Submit
C:\Windows\{51C311AE-31E4-4a8e-BFE7-A4B09BC324A0}.exe

Filesize
168KB

MD5
0d6b690e0ab6772640a98e1297c066ce

SHA1
c5ed3d47adcf869c1b88e1ea0e7f062bac86d27f

SHA256
3c80c4d2469606051e4c479d2c7b4579b596a0c510341f52eed4625eb9b1b817

SHA512
70c501ceafcac1eecb59b126aba83eb803b602c492f00572a5257bed33c0612fa77e03aed246a6acee6d796b6787fd8cb726252900f596cb5c1ffdc603048825

Download Submit
C:\Windows\{7568C833-1948-4aae-818B-717C175B5248}.exe

Filesize
168KB

MD5
ca62b66716c3514d3635def551b345a8

SHA1
da3144dc2c21c8c10910a5c949ecaada0b8f4756

SHA256
4eb6cca38fd522cdccbec08a271ec81136dc719428e8757df88f6a58c1eaa9bc

SHA512
4c26521e5f8c72f59ee2b9385df4c1aab071668e3b16a460a906445f84e00316a88c49d6101e70d83b6621fac10ecaf6e842af631adc93b5c4a830b87d5bdba7

Download Submit
C:\Windows\{809A6B50-D306-402a-AA7C-69EE5DA7306C}.exe

Filesize
168KB

MD5
79ec5f4c80b5188c96992f1025d72008

SHA1
42fe3e6b36158648939c357cb9822cf252ea5fea

SHA256
fa296bf755e64509d5ddb86d9bc2459d0696d48f3028074ddd5a701f81a4495b

SHA512
ea8cba473b3ee95b3522a745f0b472430a2cedf627f07be4adc8d72d36f0c46cc2a90dfea7fef1e682e4fd702b7542db891e3048496808b03f34cfd451b04f8e

Download Submit
C:\Windows\{8289F654-9D5E-4882-AD0A-7272A37FC7A5}.exe

Filesize
168KB

MD5
107e11476616bba595650561a8976c23

SHA1
b86b71813cf32a145fac6111b2194b156e7c31fe

SHA256
c6745a778f1be7891b9bc39ff001cd175e272a2a3e569a0a5b4798c2c7591a7f

SHA512
90b8dfc56360ba3067475d7c5b357f02768c13c52708697f62e0cdb45973d0487ee4d05abe6c76a6a6abd9a3aa3d53e74e47d10a8c3d9367e0302b5129d13831

Download Submit
C:\Windows\{B9B60BAD-EF2B-46b9-9E02-46D50EABFF91}.exe

Filesize
168KB

MD5
2bef938f2d4b3deb3e2044e853e87932

SHA1
9da976b4aa167c17cf761d5b8770f98797c27227

SHA256
ba15f634d24ce08496e86594f5d7271041cf366c365f4658694dea55250a25e3

SHA512
6df327e69be54ee3ee136f218ab34ed4a1012513c6427d852483e328d09fdd03b7465bb72e3e76c264717a005fe5d30cda4e279905e5cc8a0d6c035b3f31f539

Download Submit
C:\Windows\{C249BDB5-2C35-4d7a-A8AE-F65910DAC1C9}.exe

Filesize
168KB

MD5
54bec4675d7d3eaac775a9040b41142f

SHA1
1db227e3978d3f54c141279fa026ac3ff8d69af3

SHA256
e181abc94203e6909d74ab91c3d93eb9407b17d0f2a1874ae9266d1d38d3f173

SHA512
6c0f82cd094f236e3c7fd6732d9af67ebebcea82599eee101342ad816b4c79543443b88715847115319be6b494f48a6652780fe38caa5657020d10f78c6a2a4a

Download Submit
C:\Windows\{CA9A990D-AB0C-47bb-A964-A97B7334D24F}.exe

Filesize
168KB

MD5
58f3fbe56d2c1afe46225021829a0eaa

SHA1
99e1a485b21b6b70fb228e8280a3f6b42104fd57

SHA256
990098cf0b4874554f33ef340eca2b4926449155e65120ab048007985b5f6aa3

SHA512
db8f1382d047154f8af0cb461659b72bc363f4d9c11cc20c3393138668040b8513fe1bf1b1c538562a63f66e2eafbc24e08f86a88127d18f5db7dd64e58a03d0

Download Submit
C:\Windows\{D207C1CD-25A0-4a6e-8773-B508ED11DF04}.exe

Filesize
168KB

MD5
b49be60f50e2f732b20455a8d0b733cd

SHA1
5c5005a758b36545d4215392e35a75a8a39f5784

SHA256
69edcc24243adbc6421f2a2291c5c7b37c18cb7c6b5289740883e525e9cdeeba

SHA512
51e730b9e66536207d195c3b2e430193099fd2132e3aa2dede15f75587bf15ff66490a65733b286abc9340dcab6a88d1e31bceb492cf751644e80a5da33b25c3

Download Submit
C:\Windows\{EA13BA1E-A037-4dbd-83A9-906F13974E71}.exe

Filesize
168KB

MD5
04a0a99aec74ed871746730fc881bddd

SHA1
e67739f1d3ee1690d53caff0f6a886668b7ec901

SHA256
9b4f7b72230b50f1d9725715e3109012c0d9b1c17d047e2cd0d52298483e0993

SHA512
3668feda22ef1a3f803720a2ed119d88242531f3bd6210aeca734b2272cc8e8933574db78c59c4c38d5c19331d3310a41ab4c12be90eb88e25e9778671027fd9

Download Submit
C:\Windows\{F8C2E3E8-2BA3-4f2b-B563-A0D5A4B6D1F6}.exe

Filesize
168KB

MD5
5b95abd21f04f8419d580f72e48631f0

SHA1
f76a78f71279233a89275565e241005ba79c72a8

SHA256
a218a4a64c543bcb20cbee24db6284f797f3963df6017a991192af7fac5e3a66

SHA512
21cebbabc42b239c58c4e76e3a6feb971c112925e7894aad8abd6e0f123f9eae46d62f1693cf300a616e66b3acc153fea4bc1ce705540c55285095966391227c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads