Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe
-
Size
168KB
-
MD5
2e30881cec45805dd847a371a3fd962d
-
SHA1
bfe6c9313c5f331b7aa21411ce3d7f86cf54e892
-
SHA256
4a48929724328ee8677fc684521ac46170736cc5709b8ed8c93639b63b7a3221
-
SHA512
b458c68b6410d6d083ad88844baa61d0b0883a82a32ff58fc8b85b29b678a5075cf2060ae80819f0e49ee93e42bb67be524ce72cc230876ce387aaa57ba42049
-
SSDEEP
1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A7DB9A8D-BDC3-41de-B976-400D1EB40B33}\stubpath = "C:\\Windows\\{A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe" {F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BF65B684-6575-4140-9B89-F9A9BC5327A0} {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BF65B684-6575-4140-9B89-F9A9BC5327A0}\stubpath = "C:\\Windows\\{BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe" {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{606FC2D7-1A81-4339-9AD7-C86A005FACC5}\stubpath = "C:\\Windows\\{606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe" {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D3FF16B-1BED-41e1-AC05-E9325467928F} {55B256B3-1282-4591-90BF-DC5B25B43566}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55B256B3-1282-4591-90BF-DC5B25B43566}\stubpath = "C:\\Windows\\{55B256B3-1282-4591-90BF-DC5B25B43566}.exe" {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AE92257-FA3F-4587-A077-4DABB37890C6}\stubpath = "C:\\Windows\\{5AE92257-FA3F-4587-A077-4DABB37890C6}.exe" 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}\stubpath = "C:\\Windows\\{4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe" {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14377D86-DB16-4a6e-AD30-65A69AB09080}\stubpath = "C:\\Windows\\{14377D86-DB16-4a6e-AD30-65A69AB09080}.exe" {796C8D47-9B19-4119-924E-227694DAB253}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55B256B3-1282-4591-90BF-DC5B25B43566} {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F290B57B-7618-47ae-8A2F-CF68503A6C5A} {8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A7DB9A8D-BDC3-41de-B976-400D1EB40B33} {F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AE92257-FA3F-4587-A077-4DABB37890C6} 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4AB9CA72-6664-4d68-B37F-2F1736AF9F9B} {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{796C8D47-9B19-4119-924E-227694DAB253} {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{606FC2D7-1A81-4339-9AD7-C86A005FACC5} {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D94F053A-B870-41bd-87CE-2619A3ACF841} {A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D94F053A-B870-41bd-87CE-2619A3ACF841}\stubpath = "C:\\Windows\\{D94F053A-B870-41bd-87CE-2619A3ACF841}.exe" {A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{796C8D47-9B19-4119-924E-227694DAB253}\stubpath = "C:\\Windows\\{796C8D47-9B19-4119-924E-227694DAB253}.exe" {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14377D86-DB16-4a6e-AD30-65A69AB09080} {796C8D47-9B19-4119-924E-227694DAB253}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D3FF16B-1BED-41e1-AC05-E9325467928F}\stubpath = "C:\\Windows\\{8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe" {55B256B3-1282-4591-90BF-DC5B25B43566}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F290B57B-7618-47ae-8A2F-CF68503A6C5A}\stubpath = "C:\\Windows\\{F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe" {8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe -
Deletes itself 1 IoCs
pid Process 2520 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 1648 {8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe 2688 {F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe 1652 {A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe 908 {D94F053A-B870-41bd-87CE-2619A3ACF841}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe File created C:\Windows\{14377D86-DB16-4a6e-AD30-65A69AB09080}.exe {796C8D47-9B19-4119-924E-227694DAB253}.exe File created C:\Windows\{BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe File created C:\Windows\{F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe {8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe File created C:\Windows\{A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe {F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe File created C:\Windows\{D94F053A-B870-41bd-87CE-2619A3ACF841}.exe {A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe File created C:\Windows\{5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe File created C:\Windows\{796C8D47-9B19-4119-924E-227694DAB253}.exe {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe File created C:\Windows\{606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe File created C:\Windows\{55B256B3-1282-4591-90BF-DC5B25B43566}.exe {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe File created C:\Windows\{8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe {55B256B3-1282-4591-90BF-DC5B25B43566}.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D94F053A-B870-41bd-87CE-2619A3ACF841}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {796C8D47-9B19-4119-924E-227694DAB253}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {55B256B3-1282-4591-90BF-DC5B25B43566}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe Token: SeIncBasePriorityPrivilege 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe Token: SeIncBasePriorityPrivilege 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe Token: SeIncBasePriorityPrivilege 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe Token: SeIncBasePriorityPrivilege 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe Token: SeIncBasePriorityPrivilege 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe Token: SeIncBasePriorityPrivilege 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe Token: SeIncBasePriorityPrivilege 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe Token: SeIncBasePriorityPrivilege 1648 {8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe Token: SeIncBasePriorityPrivilege 2688 {F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe Token: SeIncBasePriorityPrivilege 1652 {A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 1240 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 30 PID 620 wrote to memory of 1240 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 30 PID 620 wrote to memory of 1240 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 30 PID 620 wrote to memory of 1240 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 30 PID 620 wrote to memory of 2520 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 31 PID 620 wrote to memory of 2520 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 31 PID 620 wrote to memory of 2520 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 31 PID 620 wrote to memory of 2520 620 2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe 31 PID 1240 wrote to memory of 2820 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 33 PID 1240 wrote to memory of 2820 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 33 PID 1240 wrote to memory of 2820 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 33 PID 1240 wrote to memory of 2820 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 33 PID 1240 wrote to memory of 2804 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 34 PID 1240 wrote to memory of 2804 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 34 PID 1240 wrote to memory of 2804 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 34 PID 1240 wrote to memory of 2804 1240 {5AE92257-FA3F-4587-A077-4DABB37890C6}.exe 34 PID 2820 wrote to memory of 3012 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 35 PID 2820 wrote to memory of 3012 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 35 PID 2820 wrote to memory of 3012 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 35 PID 2820 wrote to memory of 3012 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 35 PID 2820 wrote to memory of 2784 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 36 PID 2820 wrote to memory of 2784 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 36 PID 2820 wrote to memory of 2784 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 36 PID 2820 wrote to memory of 2784 2820 {4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe 36 PID 3012 wrote to memory of 1984 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 37 PID 3012 wrote to memory of 1984 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 37 PID 3012 wrote to memory of 1984 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 37 PID 3012 wrote to memory of 1984 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 37 PID 3012 wrote to memory of 2600 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 38 PID 3012 wrote to memory of 2600 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 38 PID 3012 wrote to memory of 2600 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 38 PID 3012 wrote to memory of 2600 3012 {796C8D47-9B19-4119-924E-227694DAB253}.exe 38 PID 1984 wrote to memory of 2640 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 39 PID 1984 wrote to memory of 2640 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 39 PID 1984 wrote to memory of 2640 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 39 PID 1984 wrote to memory of 2640 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 39 PID 1984 wrote to memory of 2160 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 40 PID 1984 wrote to memory of 2160 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 40 PID 1984 wrote to memory of 2160 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 40 PID 1984 wrote to memory of 2160 1984 {14377D86-DB16-4a6e-AD30-65A69AB09080}.exe 40 PID 2640 wrote to memory of 2996 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 41 PID 2640 wrote to memory of 2996 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 41 PID 2640 wrote to memory of 2996 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 41 PID 2640 wrote to memory of 2996 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 41 PID 2640 wrote to memory of 2840 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 42 PID 2640 wrote to memory of 2840 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 42 PID 2640 wrote to memory of 2840 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 42 PID 2640 wrote to memory of 2840 2640 {BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe 42 PID 2996 wrote to memory of 536 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 43 PID 2996 wrote to memory of 536 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 43 PID 2996 wrote to memory of 536 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 43 PID 2996 wrote to memory of 536 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 43 PID 2996 wrote to memory of 2988 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 44 PID 2996 wrote to memory of 2988 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 44 PID 2996 wrote to memory of 2988 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 44 PID 2996 wrote to memory of 2988 2996 {606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe 44 PID 536 wrote to memory of 1648 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 45 PID 536 wrote to memory of 1648 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 45 PID 536 wrote to memory of 1648 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 45 PID 536 wrote to memory of 1648 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 45 PID 536 wrote to memory of 348 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 46 PID 536 wrote to memory of 348 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 46 PID 536 wrote to memory of 348 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 46 PID 536 wrote to memory of 348 536 {55B256B3-1282-4591-90BF-DC5B25B43566}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\{5AE92257-FA3F-4587-A077-4DABB37890C6}.exeC:\Windows\{5AE92257-FA3F-4587-A077-4DABB37890C6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\{4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exeC:\Windows\{4AB9CA72-6664-4d68-B37F-2F1736AF9F9B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\{796C8D47-9B19-4119-924E-227694DAB253}.exeC:\Windows\{796C8D47-9B19-4119-924E-227694DAB253}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\{14377D86-DB16-4a6e-AD30-65A69AB09080}.exeC:\Windows\{14377D86-DB16-4a6e-AD30-65A69AB09080}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\{BF65B684-6575-4140-9B89-F9A9BC5327A0}.exeC:\Windows\{BF65B684-6575-4140-9B89-F9A9BC5327A0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\{606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exeC:\Windows\{606FC2D7-1A81-4339-9AD7-C86A005FACC5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\{55B256B3-1282-4591-90BF-DC5B25B43566}.exeC:\Windows\{55B256B3-1282-4591-90BF-DC5B25B43566}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\{8D3FF16B-1BED-41e1-AC05-E9325467928F}.exeC:\Windows\{8D3FF16B-1BED-41e1-AC05-E9325467928F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\{F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exeC:\Windows\{F290B57B-7618-47ae-8A2F-CF68503A6C5A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\{A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exeC:\Windows\{A7DB9A8D-BDC3-41de-B976-400D1EB40B33}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\{D94F053A-B870-41bd-87CE-2619A3ACF841}.exeC:\Windows\{D94F053A-B870-41bd-87CE-2619A3ACF841}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7DB9~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F290B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:2540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D3FF~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55B25~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{606FC~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:2988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF65B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14377~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2160
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{796C8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AB9C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AE92~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD51403d6aed1dcbac9f30862f1a970f830
SHA1b28e3d698712a7c07b4503247b8c183d2d9cbecd
SHA256958e51b8e4ec236976b146fbdbe346e3c10454b11b39975beda297e2487bfb7a
SHA5122bdc9fa7ab728ed8a9c0ecf5ee2a2b24f65117d3e5469566758b654f3c93f2ff82080c0ad387d5ad4e6abb17a7579a8f05fbe8f5ab2c92dd3ffae3806d209a14
-
Filesize
168KB
MD55416d13828c44f8e133da27552325c5f
SHA14c37f35b749313aaa44eda861a9bcd9faf600dc5
SHA25652b79c619630519a4dbeff9795ec1fc7fda9449f103e0d62bcebb07d4a27e035
SHA512c7dd3b7f15773e780d097a4fcfe0e4edcb83d40a5cc48caa1946923ac5a9ad09bc2dd14737715df25ac1191a7f3ce5e37697286dbf17bbe7bc3848cc06fa9ef1
-
Filesize
168KB
MD5bcac83820bc73c1545a451ae82521b97
SHA17853c4c5cbd3a4f59dbc4f825ab5925f969826d9
SHA25656e619336549d5c39ac59e36df1821d35ab35aca831c4d0f176c6c7b9c136fb2
SHA512db9ee101bef3106289f069df86f037812bd88fedc29e661f2bb60c005e1e31cad206915e0c89721f2e7c602974c5937257df4e57906169cb02107756b0520689
-
Filesize
168KB
MD5bca09a04488c9095bcf81346238c6448
SHA1271b0346908efc6d7ca23484e761d9d8b2575ff6
SHA256ae049c09ca770905c40984c3023b7a067f85d0550b0f230ee71b6b3149ae1d0e
SHA512eefb59c21930d60408ff38531298c87118564a2a91388790e2c5a5c6439b15234745b5b2c6c4dd79ec7728d36201560e8c8cc4a906cedb10c89952717c199db0
-
Filesize
168KB
MD570143e7d65f3bb665b9f7846effb7465
SHA1b308b13aed7d8bc501f9cce2ced1a631d3114ce0
SHA256a01ad3801c7609199defce3ff2f53ae065c71a2a74896ca8eefbb1f563c4d88b
SHA51239ad95bffdece4e90a0a3743eec6e03888df18ada4a1411010cc25aca550a5ddc854751cb3f5331c69c43adc929cf602cb6126f179537db021fd3dc4563533c0
-
Filesize
168KB
MD51f93b1bf643fc8e0e96a4cec4383cbba
SHA178c67c388c4fd0dae076f71ad7222bc0d675006b
SHA2565ceab7eb11e6ed19722720b68baee53684ea7f3d77fdedb013ab01b31c72bae8
SHA5120fd2ab2a197087ba5d6d25f1fabe2612f04b63f3c4388c9e13acb2d410020dc0a16c59fa0f9c291bfca42efdc00984be21aa1a1effe82ccaf98dbd32c594f9de
-
Filesize
168KB
MD521d9cd09165e0349848705c8f2987b66
SHA1b86d6047a6c05b55a68d851352f8c1812c5c54d6
SHA2566ab0b53a95837771a3baf7b469f28bf2f71d6226f002a810f9c8456f6f4b8c89
SHA5128191193cb939514deddaac8f08f0f66eb109cd9f4d7bffb91361c328e9bffbb9ef4df1bc2faa8d9d6f4b782448e8f400c054799b01809f0e5d51bf7da183449b
-
Filesize
168KB
MD5fa613e81f22ca4bc250b67c8f507b170
SHA18869802ae36dc9a2bf5dde5bd30189d43d6d781e
SHA25695ca8acf6622f92cfee8a20544063b7fd9c35f8cae0b84e1dd666c50bd352159
SHA5123012f9c5e2054de169ff096ee486401f7dc5eea2ec7aa517484bb4f9bca538002b78bb055515f1c2cd20cba18dfa1bfe585c91896188b679b01f6ee36764f19c
-
Filesize
168KB
MD549cc8444c9123809c1e883c4bc98d35f
SHA17598c67f632105c21448ec67d26de6cdf6e303d3
SHA2569bb111a0f7b57139803e1f24dfe5f261237bf59be35b9ed1f76ffe9079bcd03b
SHA5123864f3ce816d4c40bdfd09706f7047080c5e960c777b2de48caa303489d070e7f6d486f9a5c662a5aa4a6ba4b332225df0823a67a364fc432c2d713053ee8ba2
-
Filesize
168KB
MD5c392e3a717c8d4684cad4a365112f391
SHA1ebb558053aa1deccc2445e0df85fb55e1f1d2243
SHA2562bc6c6c2077668db32808b77f02bfe6bacbd18870af1890fc19aa786b7478eb1
SHA512cff7ca76ed93af6690defd2a135895470a02dc54aa2dfffa5acf44e3adc90840212d00b2225f258fde43062807bfd877d40578365d7523bc3316a64c0cedb9f0
-
Filesize
168KB
MD500d0bc8a0ebc4f0d36885812ad6ce852
SHA1b7adeb5fe6b1541539710a399f470e4b1c70e8c5
SHA256e1615d06ece6464761409bc40a1c6e719ca96324e739337d5bb56a88c45b6ea7
SHA5127dea87ab27612d1b60c5d1b7dc9ee17f1f6e8b0eb08861b68c2342535efdb2ccb69ac404c7f0293b78f3b53300748bdbe5fff0809da4ba2228da607eed0c36b5