Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 23:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
-
Size
180KB
-
MD5
325ad5cab02211ba043f6a1ec096bc26
-
SHA1
50d54c83f2a838652bef7e12981a8576527d2113
-
SHA256
c7f7a7ddc0c84f60366206b41c11ec34c73094fc8718a3c358dadec33ba5a837
-
SHA512
e08b85acb7fcf1845d5b2194db1591c3ebf1c98fad8c174fa7e86807407a382dc8a876fe990eff7e35d762e6e69ab71d1c5604d0402934339a2678fddc816ab1
-
SSDEEP
3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGVl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B1686C4-C587-412e-9240-6F743ECB5BCD} 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EF578DB-761A-43b7-93B3-2031ACDB773F}\stubpath = "C:\\Windows\\{7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe" {135B9A8E-44C0-4286-8752-F8F94A754317}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E559A52F-18EF-4010-881C-9FAFDF8EE893}\stubpath = "C:\\Windows\\{E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe" {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}\stubpath = "C:\\Windows\\{8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe" {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D27CA7B-51ED-49fd-B86A-58CD59215FCD} {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{811E02DC-E4C0-4aaa-9090-09674687BE3A} {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB6712EA-3021-49ff-AF52-3F4E8AF06CED} {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DECF01AC-D9ED-467c-916B-346DB298230A}\stubpath = "C:\\Windows\\{DECF01AC-D9ED-467c-916B-346DB298230A}.exe" {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{135B9A8E-44C0-4286-8752-F8F94A754317}\stubpath = "C:\\Windows\\{135B9A8E-44C0-4286-8752-F8F94A754317}.exe" {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E559A52F-18EF-4010-881C-9FAFDF8EE893} {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6A90EA-5428-4782-A6AD-C4080FE4D5B7} {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}\stubpath = "C:\\Windows\\{0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe" {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88E110FE-EA60-491b-A4AF-07411FE8A2DA} {DECF01AC-D9ED-467c-916B-346DB298230A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B} {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB6712EA-3021-49ff-AF52-3F4E8AF06CED}\stubpath = "C:\\Windows\\{FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe" {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B1686C4-C587-412e-9240-6F743ECB5BCD}\stubpath = "C:\\Windows\\{7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe" 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA2A881D-A96D-4d86-8B7E-2C9C64ACF556} {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}\stubpath = "C:\\Windows\\{BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe" {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{811E02DC-E4C0-4aaa-9090-09674687BE3A}\stubpath = "C:\\Windows\\{811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe" {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{135B9A8E-44C0-4286-8752-F8F94A754317} {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EF578DB-761A-43b7-93B3-2031ACDB773F} {135B9A8E-44C0-4286-8752-F8F94A754317}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D27CA7B-51ED-49fd-B86A-58CD59215FCD}\stubpath = "C:\\Windows\\{4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe" {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DECF01AC-D9ED-467c-916B-346DB298230A} {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88E110FE-EA60-491b-A4AF-07411FE8A2DA}\stubpath = "C:\\Windows\\{88E110FE-EA60-491b-A4AF-07411FE8A2DA}.exe" {DECF01AC-D9ED-467c-916B-346DB298230A}.exe -
Executes dropped EXE 12 IoCs
pid Process 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 3836 {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe 4828 {DECF01AC-D9ED-467c-916B-346DB298230A}.exe 4988 {88E110FE-EA60-491b-A4AF-07411FE8A2DA}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe File created C:\Windows\{7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe {135B9A8E-44C0-4286-8752-F8F94A754317}.exe File created C:\Windows\{FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe File created C:\Windows\{DECF01AC-D9ED-467c-916B-346DB298230A}.exe {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe File created C:\Windows\{7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe File created C:\Windows\{811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe File created C:\Windows\{135B9A8E-44C0-4286-8752-F8F94A754317}.exe {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe File created C:\Windows\{E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe File created C:\Windows\{8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe File created C:\Windows\{0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe File created C:\Windows\{4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe File created C:\Windows\{88E110FE-EA60-491b-A4AF-07411FE8A2DA}.exe {DECF01AC-D9ED-467c-916B-346DB298230A}.exe -
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {DECF01AC-D9ED-467c-916B-346DB298230A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {135B9A8E-44C0-4286-8752-F8F94A754317}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {88E110FE-EA60-491b-A4AF-07411FE8A2DA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe Token: SeIncBasePriorityPrivilege 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe Token: SeIncBasePriorityPrivilege 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe Token: SeIncBasePriorityPrivilege 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe Token: SeIncBasePriorityPrivilege 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe Token: SeIncBasePriorityPrivilege 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe Token: SeIncBasePriorityPrivilege 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe Token: SeIncBasePriorityPrivilege 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe Token: SeIncBasePriorityPrivilege 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe Token: SeIncBasePriorityPrivilege 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe Token: SeIncBasePriorityPrivilege 3836 {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe Token: SeIncBasePriorityPrivilege 4828 {DECF01AC-D9ED-467c-916B-346DB298230A}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3064 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 94 PID 1672 wrote to memory of 3064 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 94 PID 1672 wrote to memory of 3064 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 94 PID 1672 wrote to memory of 4496 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 95 PID 1672 wrote to memory of 4496 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 95 PID 1672 wrote to memory of 4496 1672 2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe 95 PID 3064 wrote to memory of 896 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 96 PID 3064 wrote to memory of 896 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 96 PID 3064 wrote to memory of 896 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 96 PID 3064 wrote to memory of 1424 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 97 PID 3064 wrote to memory of 1424 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 97 PID 3064 wrote to memory of 1424 3064 {7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe 97 PID 896 wrote to memory of 4148 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 102 PID 896 wrote to memory of 4148 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 102 PID 896 wrote to memory of 4148 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 102 PID 896 wrote to memory of 4640 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 103 PID 896 wrote to memory of 4640 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 103 PID 896 wrote to memory of 4640 896 {BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe 103 PID 4148 wrote to memory of 464 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 104 PID 4148 wrote to memory of 464 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 104 PID 4148 wrote to memory of 464 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 104 PID 4148 wrote to memory of 4596 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 105 PID 4148 wrote to memory of 4596 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 105 PID 4148 wrote to memory of 4596 4148 {811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe 105 PID 464 wrote to memory of 536 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 107 PID 464 wrote to memory of 536 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 107 PID 464 wrote to memory of 536 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 107 PID 464 wrote to memory of 1588 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 108 PID 464 wrote to memory of 1588 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 108 PID 464 wrote to memory of 1588 464 {135B9A8E-44C0-4286-8752-F8F94A754317}.exe 108 PID 536 wrote to memory of 2828 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 109 PID 536 wrote to memory of 2828 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 109 PID 536 wrote to memory of 2828 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 109 PID 536 wrote to memory of 1416 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 110 PID 536 wrote to memory of 1416 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 110 PID 536 wrote to memory of 1416 536 {7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe 110 PID 2828 wrote to memory of 1156 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 111 PID 2828 wrote to memory of 1156 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 111 PID 2828 wrote to memory of 1156 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 111 PID 2828 wrote to memory of 4484 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 112 PID 2828 wrote to memory of 4484 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 112 PID 2828 wrote to memory of 4484 2828 {E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe 112 PID 1156 wrote to memory of 3124 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 120 PID 1156 wrote to memory of 3124 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 120 PID 1156 wrote to memory of 3124 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 120 PID 1156 wrote to memory of 3000 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 121 PID 1156 wrote to memory of 3000 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 121 PID 1156 wrote to memory of 3000 1156 {8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe 121 PID 3124 wrote to memory of 2336 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 122 PID 3124 wrote to memory of 2336 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 122 PID 3124 wrote to memory of 2336 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 122 PID 3124 wrote to memory of 2360 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 123 PID 3124 wrote to memory of 2360 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 123 PID 3124 wrote to memory of 2360 3124 {FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe 123 PID 2336 wrote to memory of 3836 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 124 PID 2336 wrote to memory of 3836 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 124 PID 2336 wrote to memory of 3836 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 124 PID 2336 wrote to memory of 1600 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 125 PID 2336 wrote to memory of 1600 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 125 PID 2336 wrote to memory of 1600 2336 {0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe 125 PID 3836 wrote to memory of 4828 3836 {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe 129 PID 3836 wrote to memory of 4828 3836 {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe 129 PID 3836 wrote to memory of 4828 3836 {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe 129 PID 3836 wrote to memory of 5112 3836 {4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\{7B1686C4-C587-412e-9240-6F743ECB5BCD}.exeC:\Windows\{7B1686C4-C587-412e-9240-6F743ECB5BCD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\{BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exeC:\Windows\{BA2A881D-A96D-4d86-8B7E-2C9C64ACF556}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\{811E02DC-E4C0-4aaa-9090-09674687BE3A}.exeC:\Windows\{811E02DC-E4C0-4aaa-9090-09674687BE3A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\{135B9A8E-44C0-4286-8752-F8F94A754317}.exeC:\Windows\{135B9A8E-44C0-4286-8752-F8F94A754317}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\{7EF578DB-761A-43b7-93B3-2031ACDB773F}.exeC:\Windows\{7EF578DB-761A-43b7-93B3-2031ACDB773F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\{E559A52F-18EF-4010-881C-9FAFDF8EE893}.exeC:\Windows\{E559A52F-18EF-4010-881C-9FAFDF8EE893}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\{8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exeC:\Windows\{8E5D0B0A-6286-4d4d-8287-1CF8EFEB466B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\{FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exeC:\Windows\{FB6712EA-3021-49ff-AF52-3F4E8AF06CED}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\{0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exeC:\Windows\{0D6A90EA-5428-4782-A6AD-C4080FE4D5B7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\{4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exeC:\Windows\{4D27CA7B-51ED-49fd-B86A-58CD59215FCD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\{DECF01AC-D9ED-467c-916B-346DB298230A}.exeC:\Windows\{DECF01AC-D9ED-467c-916B-346DB298230A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4828 -
C:\Windows\{88E110FE-EA60-491b-A4AF-07411FE8A2DA}.exeC:\Windows\{88E110FE-EA60-491b-A4AF-07411FE8A2DA}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DECF0~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
PID:4452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D27C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D6A9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB671~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E5D0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:3000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E559A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EF57~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{135B9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{811E0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:4596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA2A8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:4640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B168~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:1424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:4496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5e1ff781a87d44195bab227fb94744cd7
SHA16c96fd52d597754d98d1b93c9f9cf8a8f8d6974f
SHA25688666e19e9abb1c2551b08108b73bb9cee517032120b173727fb66d76d64bb2f
SHA512c1d925c91717a70c88a48c88027972c705d1bc654b0ff5e654c87f6cd22b988fabc2e44c2d49e895b4f6dfdd2c7c4b0384ae4a290b051f926df5d709bc9a1631
-
Filesize
180KB
MD599a3f2bf46d03fc5507c6f7e4e07c646
SHA1c904d027ad9411116f32ef10ac2d43274d0bb02c
SHA256682ce18f21bd8d07962063ee88be1a6f5f0db177535c12d8d0e23f2dcdacefb1
SHA5120681f4f0393845d4a00d20ae23c1473cd2f84bacbf51704a5577aafe4e7227f6264cbf3d3b840d779e053d66aa39d693bac90354ba758e335ee19106c1e4f0dc
-
Filesize
180KB
MD5e952ed2cdaa4e84197e8d2f330d14974
SHA1602daefa01bbe79924d4b67cdbfbdc82e7552e79
SHA256f70ca92c865fcd26dc58b95415cfee736ebe1fb0aae83ecf58f2f33139f3dfc3
SHA512d06a95b67a750a99843bc58787aef2a211052ce37ab46e15b032d6e7f92853e683a4ee88ef531b7a99e9d64da65826a35862fc0cd3bd824573d4c081ae0ee8e2
-
Filesize
180KB
MD564d212b74610b022ef74f2f0eac73783
SHA160975f0f77c476ff490141ce63fbfe0be5f772d4
SHA256a6bd218f977d6e09779af8820d0836b152781bd75757c9688e88c260444ff198
SHA512881a5ec079592206068f38788d7be9c937fabd54b7ddaf1c803d6678947cbf7857223a07b02d2b1f7e0edac19faaa3b8a039115b0aa2c75559cc4889196aa4b8
-
Filesize
180KB
MD53d95b1d8b6d085590c14f8c889e58ffc
SHA136529268308d545497c85076a7fea2927028f9b8
SHA2562537805f66f7d08589ee199a5f3b1f89552621c2a6060989d231aef12f92bf32
SHA5121a1fd8d01f96a0f3d7b4bb35a2277cc9e67fe54515d7cdc3083c2048c33022c5915335566e2a7b38658c06f7c4e57b2561af544db2daae5762d0cbae2ea91a6d
-
Filesize
180KB
MD54002f6ff44bcaa34770f9660bdad44a3
SHA1b86e1d703fb1c5158952894893efa5e8c9b9c649
SHA256ea74c1c6c8dadcf57cdbf02bc5bfc9e54f82e815f22d17df8191055caabc3f33
SHA512d985c8edc586a00e14fa362a22779e6bdff4b2931cfdce966a478062761de315be723f41d22234a96e38c9b381d5839f48ce3a7437b31e610720ec06e4354e86
-
Filesize
180KB
MD53af06150fa5b27b0e221eb645c3f4df1
SHA1acaabc8b7f6d42e3af2d89e2a6e2bfe542b7978b
SHA25678202076988dc7d964db5d2aa413e8549764bf7e48d7e77e9b0734d479d80624
SHA51278acffae8f7a12c3c2f71a03a838eb7cb33732bb1ea31b03f9d848187b19697ca03da2a0bdc27c84e03379cec34b93863e1b170db211323944ac010b9ea170a6
-
Filesize
180KB
MD5771d6cf4dfb2d0480430da8843f5e255
SHA16f36aa6924d89a0e4e83131b718956b9ac5851f8
SHA256642820a57dc5efd6eb6cba9dcfe6fb4c70de34dc8fc705661ace698637394ce1
SHA512d936609577b6c76454bea6266d4bb0d1bfa3c96e44314fe73649a42b84d3a3ae120355aeb5f3f37041e22bc992371661c62b6d1bad3b17da90919b9dd909def4
-
Filesize
180KB
MD5c6b739b85a8bce3393813cf5da220903
SHA11995f368087d237c64427a0bde6657741dfc0dc6
SHA2567c4431fe390eddc755e33de3e10c4d03cbd748fc4023e942be059cfc207f72e9
SHA5124174f0b67f37e84ab1e5cbc8e2341b365b870a8da80bf80df0c6b08bc85beb9aefeb546a659cd55256e6cdf9a6f9bb43c7d8eeae8b3700e038f6c3ef8c54abd5
-
Filesize
180KB
MD5aaecf624f1bd67ad4b681ca74db84412
SHA1b561d78c7db6460d470bfbe10ee5dab95abeb1a5
SHA256dfd9992c177fbfd65811a41b7dc98a8728283d113efb67b0ac0d7c8c72caa335
SHA51286f14f784837f05e5f6c82a0a60bdab31e101c20b8790891808b8f65b3c217e647ebf17c934bcc1e0099725aefaf4507af8b557f0d564fd5d1cabc3e19a6c398
-
Filesize
180KB
MD56385223a4f9fa293fbfdcfa661e12430
SHA1456c27d80d5a72086b8be3b31eed948c30b805ce
SHA2566b088251e87e30e468c6b99785526306c67af8c5074cf50b6a2ff1460b0970dc
SHA512609fbd2e95954dffe84454ca98efb8b20ab3f997e35891a8f8e327491cb5d9d6fc41327eb37c59a295f74b16a14ebfdd3ddd0b95de19aa59c5111441ce310c11
-
Filesize
180KB
MD520bd7376f8e8533dd8a87a8a8e66d68f
SHA16431820ab64a83c1819fda56f9db15b7e312bc29
SHA25616a7bee433adbd9724d7ee7adb87a2596a26b6de9163aac62afca13b4d664eb5
SHA5127dce66226b8aa4299fe866badb167a71f5ea66affcd59e1936e9b790d7d05842e8383ea7d949b031139a0968275aa86144ded82cb7697f02a884986c9c3055b3