Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe
-
Size
168KB
-
MD5
320379e8fb99f2ef23f743fb7b2c1ddb
-
SHA1
bff07e68b763f630991bca5c04dc616495f6d762
-
SHA256
83a1359792eeecfd91789a475aa3bb05d6087649d1e7c2ab43f7e381cd1e21ad
-
SHA512
53168b9da73ddb898f6b95582747c0b829fd4ca0baa45e10027f34eb490b3bef2f6395b0d19d1887ac7e1c5f53a257da130fb6fc8d269a8b1eb962d21b81bd7c
-
SSDEEP
1536:1EGh0omlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0omlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46844CE1-33B2-42c4-8957-BCC2247A180F}\stubpath = "C:\\Windows\\{46844CE1-33B2-42c4-8957-BCC2247A180F}.exe" {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B0A6E8C-2DE4-4258-8180-09AB28580DFC}\stubpath = "C:\\Windows\\{8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe" {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3699A8A-23A2-4a98-87AE-E7957BD7837E}\stubpath = "C:\\Windows\\{F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe" {2D58E271-8591-475c-9A73-A126B7213A53}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}\stubpath = "C:\\Windows\\{FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe" {C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E454353-6D2B-49fb-9D2A-E94F02EEB58A} {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}\stubpath = "C:\\Windows\\{3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe" {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6D18217-D9FA-4115-A45C-3C3A6918E0D2}\stubpath = "C:\\Windows\\{C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe" {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3584CDD-1885-4d52-B416-92DFEBDE64AA}\stubpath = "C:\\Windows\\{D3584CDD-1885-4d52-B416-92DFEBDE64AA}.exe" {AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B0A6E8C-2DE4-4258-8180-09AB28580DFC} {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D58E271-8591-475c-9A73-A126B7213A53}\stubpath = "C:\\Windows\\{2D58E271-8591-475c-9A73-A126B7213A53}.exe" {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D58E271-8591-475c-9A73-A126B7213A53} {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3699A8A-23A2-4a98-87AE-E7957BD7837E} {2D58E271-8591-475c-9A73-A126B7213A53}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C6D18217-D9FA-4115-A45C-3C3A6918E0D2} {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF1F3C59-ED09-419b-8CE7-8906B8039FFE} {FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF1F3C59-ED09-419b-8CE7-8906B8039FFE}\stubpath = "C:\\Windows\\{AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe" {FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3584CDD-1885-4d52-B416-92DFEBDE64AA} {AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60CB12A0-EBD0-426b-8192-D56D91F47CEB}\stubpath = "C:\\Windows\\{60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe" 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D} {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46844CE1-33B2-42c4-8957-BCC2247A180F} {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAA0C6D9-3C7C-4296-BE7D-D72E90553C08} {C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60CB12A0-EBD0-426b-8192-D56D91F47CEB} 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E454353-6D2B-49fb-9D2A-E94F02EEB58A}\stubpath = "C:\\Windows\\{7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe" {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe -
Deletes itself 1 IoCs
pid Process 2920 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 1488 {C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe 2684 {FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe 816 {AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe 2784 {D3584CDD-1885-4d52-B416-92DFEBDE64AA}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe {C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe File created C:\Windows\{AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe {FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe File created C:\Windows\{D3584CDD-1885-4d52-B416-92DFEBDE64AA}.exe {AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe File created C:\Windows\{46844CE1-33B2-42c4-8957-BCC2247A180F}.exe {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe File created C:\Windows\{2D58E271-8591-475c-9A73-A126B7213A53}.exe {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe File created C:\Windows\{3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe File created C:\Windows\{8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe File created C:\Windows\{F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe {2D58E271-8591-475c-9A73-A126B7213A53}.exe File created C:\Windows\{C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe File created C:\Windows\{60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe File created C:\Windows\{7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D3584CDD-1885-4d52-B416-92DFEBDE64AA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {2D58E271-8591-475c-9A73-A126B7213A53}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe Token: SeIncBasePriorityPrivilege 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe Token: SeIncBasePriorityPrivilege 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe Token: SeIncBasePriorityPrivilege 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe Token: SeIncBasePriorityPrivilege 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe Token: SeIncBasePriorityPrivilege 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe Token: SeIncBasePriorityPrivilege 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe Token: SeIncBasePriorityPrivilege 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe Token: SeIncBasePriorityPrivilege 1488 {C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe Token: SeIncBasePriorityPrivilege 2684 {FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe Token: SeIncBasePriorityPrivilege 816 {AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3036 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 31 PID 2104 wrote to memory of 3036 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 31 PID 2104 wrote to memory of 3036 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 31 PID 2104 wrote to memory of 3036 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 31 PID 2104 wrote to memory of 2920 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 32 PID 2104 wrote to memory of 2920 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 32 PID 2104 wrote to memory of 2920 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 32 PID 2104 wrote to memory of 2920 2104 2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe 32 PID 3036 wrote to memory of 2736 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 33 PID 3036 wrote to memory of 2736 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 33 PID 3036 wrote to memory of 2736 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 33 PID 3036 wrote to memory of 2736 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 33 PID 3036 wrote to memory of 2804 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 34 PID 3036 wrote to memory of 2804 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 34 PID 3036 wrote to memory of 2804 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 34 PID 3036 wrote to memory of 2804 3036 {60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe 34 PID 2736 wrote to memory of 2884 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 35 PID 2736 wrote to memory of 2884 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 35 PID 2736 wrote to memory of 2884 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 35 PID 2736 wrote to memory of 2884 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 35 PID 2736 wrote to memory of 2792 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 36 PID 2736 wrote to memory of 2792 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 36 PID 2736 wrote to memory of 2792 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 36 PID 2736 wrote to memory of 2792 2736 {7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe 36 PID 2884 wrote to memory of 2760 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 37 PID 2884 wrote to memory of 2760 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 37 PID 2884 wrote to memory of 2760 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 37 PID 2884 wrote to memory of 2760 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 37 PID 2884 wrote to memory of 2708 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 38 PID 2884 wrote to memory of 2708 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 38 PID 2884 wrote to memory of 2708 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 38 PID 2884 wrote to memory of 2708 2884 {3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe 38 PID 2760 wrote to memory of 2332 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 39 PID 2760 wrote to memory of 2332 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 39 PID 2760 wrote to memory of 2332 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 39 PID 2760 wrote to memory of 2332 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 39 PID 2760 wrote to memory of 2868 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 40 PID 2760 wrote to memory of 2868 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 40 PID 2760 wrote to memory of 2868 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 40 PID 2760 wrote to memory of 2868 2760 {46844CE1-33B2-42c4-8957-BCC2247A180F}.exe 40 PID 2332 wrote to memory of 1952 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 41 PID 2332 wrote to memory of 1952 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 41 PID 2332 wrote to memory of 1952 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 41 PID 2332 wrote to memory of 1952 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 41 PID 2332 wrote to memory of 1712 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 42 PID 2332 wrote to memory of 1712 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 42 PID 2332 wrote to memory of 1712 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 42 PID 2332 wrote to memory of 1712 2332 {8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe 42 PID 1952 wrote to memory of 2528 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 43 PID 1952 wrote to memory of 2528 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 43 PID 1952 wrote to memory of 2528 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 43 PID 1952 wrote to memory of 2528 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 43 PID 1952 wrote to memory of 1672 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 44 PID 1952 wrote to memory of 1672 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 44 PID 1952 wrote to memory of 1672 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 44 PID 1952 wrote to memory of 1672 1952 {2D58E271-8591-475c-9A73-A126B7213A53}.exe 44 PID 2528 wrote to memory of 1488 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 45 PID 2528 wrote to memory of 1488 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 45 PID 2528 wrote to memory of 1488 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 45 PID 2528 wrote to memory of 1488 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 45 PID 2528 wrote to memory of 1692 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 46 PID 2528 wrote to memory of 1692 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 46 PID 2528 wrote to memory of 1692 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 46 PID 2528 wrote to memory of 1692 2528 {F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_320379e8fb99f2ef23f743fb7b2c1ddb_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\{60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exeC:\Windows\{60CB12A0-EBD0-426b-8192-D56D91F47CEB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\{7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exeC:\Windows\{7E454353-6D2B-49fb-9D2A-E94F02EEB58A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\{3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exeC:\Windows\{3A904DC4-3537-49fb-A0B5-AA49ADFB6F2D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\{46844CE1-33B2-42c4-8957-BCC2247A180F}.exeC:\Windows\{46844CE1-33B2-42c4-8957-BCC2247A180F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\{8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exeC:\Windows\{8B0A6E8C-2DE4-4258-8180-09AB28580DFC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\{2D58E271-8591-475c-9A73-A126B7213A53}.exeC:\Windows\{2D58E271-8591-475c-9A73-A126B7213A53}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\{F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exeC:\Windows\{F3699A8A-23A2-4a98-87AE-E7957BD7837E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\{C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exeC:\Windows\{C6D18217-D9FA-4115-A45C-3C3A6918E0D2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Windows\{FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exeC:\Windows\{FAA0C6D9-3C7C-4296-BE7D-D72E90553C08}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Windows\{AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exeC:\Windows\{AF1F3C59-ED09-419b-8CE7-8906B8039FFE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:816 -
C:\Windows\{D3584CDD-1885-4d52-B416-92DFEBDE64AA}.exeC:\Windows\{D3584CDD-1885-4d52-B416-92DFEBDE64AA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF1F3~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAA0C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6D18~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3699~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D58E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B0A6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46844~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A904~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E454~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60CB1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5c19d145279b07ada283c6a56c41e8733
SHA10d514bddf23e84b3e0fc324600a10b59962a6f17
SHA25656ecafbd3794686d59492208f6e2af0755295ec3bf64c789542dee91d8d1a674
SHA512f6fb597b88f3d1e7744b401850a62bf74e36f20d865da43997477a0aa7338ee3212b48099e6b3a7d4498ef5615da3b06698761c00c08dc2fa842530cba20c842
-
Filesize
168KB
MD57289884f55ce5a13428b6fcb6c72bb3e
SHA16190d8688ea6eff582ad4e5ec5aef7b89ad14bb9
SHA256b075b33756c9eb07d548d32215e7d4955868cf6a2018251623f2eb30e4e1e076
SHA512a4bf383102004a4564e26703e21b3cfead749f65d9194958e951a8e88c0ca6cb4553001ed0569483481582133a808a7e40ec2d693f01b0c69a0072fda0340393
-
Filesize
168KB
MD5ab47e0a05731b7d6dbb534708b846b15
SHA15da64ce70ce502ab8f7558278ea44a8d7627c7a8
SHA256cf47097fd2fbfe468d902bc768cc1a82b895c7cfe9718fddc45e7d863631a8ac
SHA5126a53035f698272787b4282cd67eb9f81690439177290048cbd4fb55ff9263859aa7c336e00b1cc46090dd23ad5259a764a23612fdc65e538350128e232f9daa5
-
Filesize
168KB
MD54fe7ce1e89de505eca98378eeb55d2ab
SHA126833eb35ed3e6f26a7acfec53d8d75486ae9538
SHA256ffff23a2554456540473e0249b77f0334812316cca2315e3c9be83e7ffbacf5d
SHA51269a8fbc018f60d55fa10052c29a31d923654ac50eb41a8dced609268e10318437ba44d4b22a00925e6d8bbf3ad00c0c803193223ffa0b8c6f27b542de7974127
-
Filesize
168KB
MD594a537346de7795aca38f86105291122
SHA1042429f261e0424ea201b9fc4937cff1ed121ce0
SHA25682e0099b5a73c216dd89c9f2ea66ca77390ef6679f2eb65168ccb6a04b0a1f38
SHA5127ebe2263cdc5e5503feeabaf21e65c18252840c09b569ebbb04a849cc2171a2d3b73f682b07447aeeafcc1a13697d4c49f0bcab8af8a1050268b908182586b90
-
Filesize
168KB
MD5d1350151b93996c0449e75c582225b93
SHA19b837a7eeb4f6682160cd809d2186fa88801dc25
SHA256a9222e7f015cf64296f4a878f0e5d184bf8698965c3db687eb405449d88f6de2
SHA51275081bc9942aefe4d510f0a49b04696f0a666f5553a93ce6437fad4bd33ee3524db7bb1645988219fad24f2eba23b0fd2a4e342cdd38039c14584c77c088a521
-
Filesize
168KB
MD5b01de7faf715b57c696bd0cb6589d0bd
SHA1b0efa182df3074f1875d4757a809126ecdf7f4dc
SHA256c37c4ddeda3c0bdea33dd1f03115400f52c122b4f85879a0db7547451fb2a2bb
SHA5123e98ea4750eff319f9b8eb36944418907c808607ab8e718d27e57d63e50fa42df41220008b01ceba49ffec510413625c30bb3f98c9834f7804762b5b4cf55b2e
-
Filesize
168KB
MD58255d506bb1c873384bbda84c033b253
SHA1951cc75c567dfcf5fb2dfa6e19e880aedb8f4208
SHA256d216aa86779de9f024b9413134de63b83b24c45f58b9d479317804644d793a18
SHA512ad7940e39bbf92c6b30ef1b870b42a0f983b4c8a6d66b2935de09e70d7d8830046dc92ab5cf72ff09b42cee0b4b734ce55dab3ed4b148a6f18131e7cae79c1e7
-
Filesize
168KB
MD5f4ca5c0ac8d3b1879490a954aef5ab3b
SHA1096abf60ce29df7192f36855e75bf168560f12a2
SHA25648c646520883ae53970b74498b418022a14c5edfb7517916e5bbe08f09feabaa
SHA5121a721dfb4a36e6f01dc45bfa5876014223a71abf33ff24f7fc6775832a22e4e0e7bbb9c0fde4e896064ffa25112ef147e72b92f0619ff54830f55bcb58865acc
-
Filesize
168KB
MD5ec74bf06d2ffe7c6882ae78edd76b9e3
SHA17f7ecd4fc9ffc7817960081c12e92bfe15bd8949
SHA256e3703934f40086953a6285bffc0948e4398a74bb098d2d570f10737fee19b439
SHA5127b8286942ebc3a00640b1b1c09dea15134a929b10567f86cd905e5d690abac4b46c9bbdd17ad9a82a4c493a21974005537875ef0a3f8040b14c0bc41c16530f8
-
Filesize
168KB
MD5ad842327ef25d34d944a4e9bd41bd416
SHA14b54aa89347cccc85b901c9d4f7d04421ee94a95
SHA2566c4251c45bbfd007ee18889cab2e33b821be46ea062f39cb2760f5f5842a677e
SHA512c19a56bb13b1115acb4af8f2f7c3dc72dca3bd882c4813779ddeb9c1af42f506f1475bc7805812896bed74691e5fd3bfea9743f6934cac05f2a9bbf7d4737208