Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe
-
Size
408KB
-
MD5
fb7a014ccb227a9f8fc425ea6808aa92
-
SHA1
47c326bf0113753975bd64acd139574f51048943
-
SHA256
3713d713584f6daff65e9cd220f01dd50d3e19b4013a7cb364bd9d4c03d6b4e4
-
SHA512
49851bcd41c5ba81d790821a2bc02e0f45ed5d974b6f4f92146cc1c46d623d8095adddb8f450bbda3ea9154adea7fd3765ff32ce118ec935e5ff7922d7637608
-
SSDEEP
3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D53811D4-A2AA-47fd-9AF9-3D597B9389D7}\stubpath = "C:\\Windows\\{D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe" {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79FEB94F-8A05-4f13-A649-7F7D48089059}\stubpath = "C:\\Windows\\{79FEB94F-8A05-4f13-A649-7F7D48089059}.exe" {98549B94-1B08-4a67-A25A-A29873984BE7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3EBEE91-6CFF-45f9-B873-40DF4C2078A1} {1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63D86F77-F1FB-46f2-8935-E4114CD83EE1} {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C07C68F-2BAD-46bd-A912-0D7ED2A456B5} {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A6C581C-6F52-4217-A6ED-DE8438A959BE} {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A6C581C-6F52-4217-A6ED-DE8438A959BE}\stubpath = "C:\\Windows\\{9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe" {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8E0CDA8-74FA-48d5-8E9D-7372D04C6706} {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}\stubpath = "C:\\Windows\\{C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe" {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}\stubpath = "C:\\Windows\\{4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}.exe" {C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{971F777B-EFED-444f-8A7D-A7C0A361F767} 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63D86F77-F1FB-46f2-8935-E4114CD83EE1}\stubpath = "C:\\Windows\\{63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe" {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D53811D4-A2AA-47fd-9AF9-3D597B9389D7} {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CA54B43-A442-45c1-90C6-99EFD08641AD}\stubpath = "C:\\Windows\\{1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe" {C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}\stubpath = "C:\\Windows\\{C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe" {1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{971F777B-EFED-444f-8A7D-A7C0A361F767}\stubpath = "C:\\Windows\\{971F777B-EFED-444f-8A7D-A7C0A361F767}.exe" 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}\stubpath = "C:\\Windows\\{9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe" {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79FEB94F-8A05-4f13-A649-7F7D48089059} {98549B94-1B08-4a67-A25A-A29873984BE7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CA54B43-A442-45c1-90C6-99EFD08641AD} {C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E1BFF15-6965-40ef-BB4D-B7CD5A87270F} {C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98549B94-1B08-4a67-A25A-A29873984BE7} {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98549B94-1B08-4a67-A25A-A29873984BE7}\stubpath = "C:\\Windows\\{98549B94-1B08-4a67-A25A-A29873984BE7}.exe" {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe -
Deletes itself 1 IoCs
pid Process 2144 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 1760 {C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe 2912 {1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe 448 {C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe 2380 {4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{98549B94-1B08-4a67-A25A-A29873984BE7}.exe {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe File created C:\Windows\{79FEB94F-8A05-4f13-A649-7F7D48089059}.exe {98549B94-1B08-4a67-A25A-A29873984BE7}.exe File created C:\Windows\{D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe File created C:\Windows\{63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe File created C:\Windows\{9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe File created C:\Windows\{9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe File created C:\Windows\{C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe File created C:\Windows\{1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe {C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe File created C:\Windows\{C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe {1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe File created C:\Windows\{4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}.exe {C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe File created C:\Windows\{971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {98549B94-1B08-4a67-A25A-A29873984BE7}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe Token: SeIncBasePriorityPrivilege 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe Token: SeIncBasePriorityPrivilege 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe Token: SeIncBasePriorityPrivilege 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe Token: SeIncBasePriorityPrivilege 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe Token: SeIncBasePriorityPrivilege 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe Token: SeIncBasePriorityPrivilege 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe Token: SeIncBasePriorityPrivilege 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe Token: SeIncBasePriorityPrivilege 1760 {C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe Token: SeIncBasePriorityPrivilege 2912 {1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe Token: SeIncBasePriorityPrivilege 448 {C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2088 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 31 PID 2452 wrote to memory of 2088 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 31 PID 2452 wrote to memory of 2088 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 31 PID 2452 wrote to memory of 2088 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 31 PID 2452 wrote to memory of 2144 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 32 PID 2452 wrote to memory of 2144 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 32 PID 2452 wrote to memory of 2144 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 32 PID 2452 wrote to memory of 2144 2452 2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe 32 PID 2088 wrote to memory of 2372 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 33 PID 2088 wrote to memory of 2372 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 33 PID 2088 wrote to memory of 2372 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 33 PID 2088 wrote to memory of 2372 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 33 PID 2088 wrote to memory of 2796 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 34 PID 2088 wrote to memory of 2796 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 34 PID 2088 wrote to memory of 2796 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 34 PID 2088 wrote to memory of 2796 2088 {971F777B-EFED-444f-8A7D-A7C0A361F767}.exe 34 PID 2372 wrote to memory of 2788 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 35 PID 2372 wrote to memory of 2788 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 35 PID 2372 wrote to memory of 2788 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 35 PID 2372 wrote to memory of 2788 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 35 PID 2372 wrote to memory of 2152 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 36 PID 2372 wrote to memory of 2152 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 36 PID 2372 wrote to memory of 2152 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 36 PID 2372 wrote to memory of 2152 2372 {63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe 36 PID 2788 wrote to memory of 2728 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 37 PID 2788 wrote to memory of 2728 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 37 PID 2788 wrote to memory of 2728 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 37 PID 2788 wrote to memory of 2728 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 37 PID 2788 wrote to memory of 2668 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 38 PID 2788 wrote to memory of 2668 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 38 PID 2788 wrote to memory of 2668 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 38 PID 2788 wrote to memory of 2668 2788 {9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe 38 PID 2728 wrote to memory of 3012 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 39 PID 2728 wrote to memory of 3012 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 39 PID 2728 wrote to memory of 3012 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 39 PID 2728 wrote to memory of 3012 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 39 PID 2728 wrote to memory of 2228 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 40 PID 2728 wrote to memory of 2228 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 40 PID 2728 wrote to memory of 2228 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 40 PID 2728 wrote to memory of 2228 2728 {D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe 40 PID 3012 wrote to memory of 352 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 41 PID 3012 wrote to memory of 352 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 41 PID 3012 wrote to memory of 352 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 41 PID 3012 wrote to memory of 352 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 41 PID 3012 wrote to memory of 2528 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 42 PID 3012 wrote to memory of 2528 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 42 PID 3012 wrote to memory of 2528 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 42 PID 3012 wrote to memory of 2528 3012 {9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe 42 PID 352 wrote to memory of 1036 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 44 PID 352 wrote to memory of 1036 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 44 PID 352 wrote to memory of 1036 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 44 PID 352 wrote to memory of 1036 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 44 PID 352 wrote to memory of 1396 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 45 PID 352 wrote to memory of 1396 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 45 PID 352 wrote to memory of 1396 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 45 PID 352 wrote to memory of 1396 352 {98549B94-1B08-4a67-A25A-A29873984BE7}.exe 45 PID 1036 wrote to memory of 1760 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 46 PID 1036 wrote to memory of 1760 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 46 PID 1036 wrote to memory of 1760 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 46 PID 1036 wrote to memory of 1760 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 46 PID 1036 wrote to memory of 2624 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 47 PID 1036 wrote to memory of 2624 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 47 PID 1036 wrote to memory of 2624 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 47 PID 1036 wrote to memory of 2624 1036 {79FEB94F-8A05-4f13-A649-7F7D48089059}.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\{971F777B-EFED-444f-8A7D-A7C0A361F767}.exeC:\Windows\{971F777B-EFED-444f-8A7D-A7C0A361F767}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\{63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exeC:\Windows\{63D86F77-F1FB-46f2-8935-E4114CD83EE1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\{9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exeC:\Windows\{9C07C68F-2BAD-46bd-A912-0D7ED2A456B5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\{D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exeC:\Windows\{D53811D4-A2AA-47fd-9AF9-3D597B9389D7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\{9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exeC:\Windows\{9A6C581C-6F52-4217-A6ED-DE8438A959BE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\{98549B94-1B08-4a67-A25A-A29873984BE7}.exeC:\Windows\{98549B94-1B08-4a67-A25A-A29873984BE7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\{79FEB94F-8A05-4f13-A649-7F7D48089059}.exeC:\Windows\{79FEB94F-8A05-4f13-A649-7F7D48089059}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\{C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exeC:\Windows\{C8E0CDA8-74FA-48d5-8E9D-7372D04C6706}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\{1CA54B43-A442-45c1-90C6-99EFD08641AD}.exeC:\Windows\{1CA54B43-A442-45c1-90C6-99EFD08641AD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\{C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exeC:\Windows\{C3EBEE91-6CFF-45f9-B873-40DF4C2078A1}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:448 -
C:\Windows\{4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}.exeC:\Windows\{4E1BFF15-6965-40ef-BB4D-B7CD5A87270F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3EBE~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CA54~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8E0C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79FEB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98549~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:1396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A6C5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5381~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C07C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63D86~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{971F7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD59240941ece61203f425bde50ba2ed04a
SHA102316309ec7025ceaf12cfe0197d6ef644b46ce5
SHA2567356cc371e1133578d1694c6fff87637492c8ae5150e7f92010e4691384b8ecb
SHA51272f695e6e097129a923530f067961bad4ba6ffda4215f054a2365b0c1fb55c519459b5f4a3f95dc50170366e24bf78a52149d8f1e11ef35489cbfa3f88e5c944
-
Filesize
408KB
MD55d3424e71cec8401cedaa08b816e14ac
SHA1a78fb9b85df9c61321c867a42a49c8afd9d073b4
SHA2561a3f1e5c2a9c4c2871551b211f95370a7d8174cd7c1cf18c6c57fd25feb68a76
SHA5126254590b831cf6a0360d4666b91711f6eda949fbd4e49725a9185812df150e9786a9414d83e5f035d1e692279bccbb7fda35a95f660bbba5cd7698d2cec1b1af
-
Filesize
408KB
MD5c3b4ea8e39d977425357e9bf7c3eb0f1
SHA11e08b071942d65aaffdad9667556442bf1f120c8
SHA256f6662da758c17565f614a4762eaf9f31dc0cec816196c6db291ee7a77f5d6419
SHA512e3b62a9d89d0605e3e0f4185508a4987875901ebf7d2351fe763e24b93b72af337c5be205808a8d528267b72830e5f29a245ba04fb42ef960268e317081bd95d
-
Filesize
408KB
MD5fc220ad4b920c4f682938937654b5f60
SHA1b5ff35f7da4d56aed488d97db4f8faa59b56fa04
SHA2564993962b68b34558d2a04a6b9f99755cd017aa7e75a11ef9530f11a051e19336
SHA5127f29eeaea70a13565ca1743442c29069bd5eaed4c60116374940747ef12f55c0a71527947db04fab42265e35c31b1a92338c14f7bdbaab8de4f007b7dfd9d232
-
Filesize
408KB
MD516d13275fd5f26433430202aa5b92b23
SHA16648297ef42f932566d3cf5b89464fbc3a70de3e
SHA256da222bcd65d1bb60955f6bb9e810f7135b75ad0f069c4308eec8ce0f6f9a8ea3
SHA512743bfe0222c704eda01c957e64cb7f3bed14bffd49a3abfe7c1c25cc43a165bb5f9830ad0370c6aa31c867755fed697b0c8462be66cb081a460ce727badd5ff8
-
Filesize
408KB
MD57a81171c0099bb5a3909415b660f7a4a
SHA132da4e2cb65903d4561d7b80b82b65690bc8b220
SHA256ae3b455278304ca46b1996285299b8561a5c88c8794206f670b0a226545a12f1
SHA512b238af26d61d8f1b4ea2abe53907a04e269a289a1515b31e74b91a9b8ff8e19b622e2bd50d5fd3ee933b9869e375e2e4f4c6494edcc6f5adbf21affe7da14805
-
Filesize
408KB
MD50c88390bcc1140c059b12307c057cb9b
SHA127c2c49fb1d3de5f0ab0c331ed7ceefe7cdb012f
SHA256f063c7974b05be21693f73565321ff8506964925ca0d06f371963c7f10052e83
SHA512578a84c78a9f961b4e3171dfea3a29d6f6f54df55df4fa783133bdb6354b8ebf17064b112db53a1d7bcc5d9c65a97caeb2825c34c8b0c179f6e4cd2f6b77edc7
-
Filesize
408KB
MD50fcf382615c6260ff93f7a28e2bab29b
SHA1337798e0fdbd1ffad9873b5900302ce77ab31298
SHA2562671477f6b00e8ccca49d6b2b8f0595bd02ff22baf7b5ae401e3c09eefb494f3
SHA51230d39f732c2603cf44837c211d6fe977f91b46fb6f55f7302350de8b4a96a581baa80f307f91833d73a29e79edb78c538cbd7fbcccab623c435f4c373b96e2f8
-
Filesize
408KB
MD5af5e98b66c4feb30e1ddced35dad2b20
SHA1d42ec7fdfdc05e6986884c0bb65415c34bf13169
SHA256bfd70fa52d0872ae0e39a32766ed413a7112baaa9d8fad0c0374903181a501c9
SHA5121c41d273aa3f4af01f0c918c5c0788b56144f63e559bd47548de01ca6f9da483f69c8bad7a86b483451df2f6e38bf20dff1dd8d6a695245f9a165ea57f6ca037
-
Filesize
408KB
MD5355cc6a4cb809e06bd26b9a20fcafe94
SHA125dfe70ce8d1ec0582a94ec635ce3ff7fe7c2662
SHA25603b4dbb65957ce06aabdbe96aa68a517d0896bd51df2cdab00f3160b2aee9673
SHA51259ae0ecd397d1f3f6586be5fbb28dc232432c83fece1e7e892af38767c0aa4a1554a4109e6635db98248f32fe1ec64a81452d7d03a829dbd65dbb1275f956be1
-
Filesize
408KB
MD53d78658d7f1a88910923cbc5f5cbb0ed
SHA1386b6dca6fbcca671a192ddd396f75a36bb637a8
SHA256b1b0cc3e2d760e666210ac5aa4803f1fe3e82717701e25e7d7d3acedac9f3d96
SHA512b0d389640ac5eb026a225e94beff394cfe12f0f7d06d0b2676584fd28fb7b4ac8dad505335e89893d5549d1b2a551c810a475e4d1cbf3008803f011a7fc353f9