Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe
-
Size
168KB
-
MD5
3f7db079a3996bc0c8526cae4d6497fa
-
SHA1
b7bfb85c04a907f1283a3180c9d9cb82eaf93062
-
SHA256
f711cdf4fc3db9a50331351e83f1d438c3b079b9c760b8dc6519e864ec46b336
-
SHA512
5833cf38df21cfa91182a933421b307d9d10e4886a0a9c6f30e591427cc9b1c3d86e60c03dbba319ec908860f4384dc797c00d0865039a20c3e1341a18ab5bf2
-
SSDEEP
1536:1EGh0oGlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oGlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D487729C-BA0A-41c7-8DBD-0B781DDACBD4} {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B435D10-597F-41de-808F-737E03450630} {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC319AB4-3585-4d24-A17A-29A4043B283D}\stubpath = "C:\\Windows\\{AC319AB4-3585-4d24-A17A-29A4043B283D}.exe" {3B435D10-597F-41de-808F-737E03450630}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AC72429-0A28-44d9-9C93-AA345C7DA6EE} {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AC72429-0A28-44d9-9C93-AA345C7DA6EE}\stubpath = "C:\\Windows\\{1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe" {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2538BAE-C7FE-4b6c-B183-A0A0A515E977} {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6111A5C8-C18E-4b18-93EB-CCB8509E2420}\stubpath = "C:\\Windows\\{6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe" {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D15EA515-D7B7-4306-9E84-167A57BEFCEC} {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D15EA515-D7B7-4306-9E84-167A57BEFCEC}\stubpath = "C:\\Windows\\{D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe" {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6111A5C8-C18E-4b18-93EB-CCB8509E2420} {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{402B78B7-13E2-4e1f-8484-2AB388AC4618} 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{402B78B7-13E2-4e1f-8484-2AB388AC4618}\stubpath = "C:\\Windows\\{402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe" 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC539198-109A-47dd-B4B2-05062F4E33BB} {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC539198-109A-47dd-B4B2-05062F4E33BB}\stubpath = "C:\\Windows\\{CC539198-109A-47dd-B4B2-05062F4E33BB}.exe" {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D487729C-BA0A-41c7-8DBD-0B781DDACBD4}\stubpath = "C:\\Windows\\{D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe" {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B435D10-597F-41de-808F-737E03450630}\stubpath = "C:\\Windows\\{3B435D10-597F-41de-808F-737E03450630}.exe" {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC319AB4-3585-4d24-A17A-29A4043B283D} {3B435D10-597F-41de-808F-737E03450630}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}\stubpath = "C:\\Windows\\{85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe" {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{344804A8-35F5-4360-9A01-9FD696AA0CBC} {85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2538BAE-C7FE-4b6c-B183-A0A0A515E977}\stubpath = "C:\\Windows\\{B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe" {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8} {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}\stubpath = "C:\\Windows\\{4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe" {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8} {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{344804A8-35F5-4360-9A01-9FD696AA0CBC}\stubpath = "C:\\Windows\\{344804A8-35F5-4360-9A01-9FD696AA0CBC}.exe" {85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe -
Executes dropped EXE 12 IoCs
pid Process 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 3836 {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe 2452 {85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe 1272 {344804A8-35F5-4360-9A01-9FD696AA0CBC}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe File created C:\Windows\{B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe File created C:\Windows\{3B435D10-597F-41de-808F-737E03450630}.exe {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe File created C:\Windows\{AC319AB4-3585-4d24-A17A-29A4043B283D}.exe {3B435D10-597F-41de-808F-737E03450630}.exe File created C:\Windows\{4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe File created C:\Windows\{85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe File created C:\Windows\{344804A8-35F5-4360-9A01-9FD696AA0CBC}.exe {85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe File created C:\Windows\{CC539198-109A-47dd-B4B2-05062F4E33BB}.exe {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe File created C:\Windows\{D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe File created C:\Windows\{D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe File created C:\Windows\{6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe File created C:\Windows\{1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe -
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {3B435D10-597F-41de-808F-737E03450630}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {344804A8-35F5-4360-9A01-9FD696AA0CBC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe Token: SeIncBasePriorityPrivilege 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe Token: SeIncBasePriorityPrivilege 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe Token: SeIncBasePriorityPrivilege 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe Token: SeIncBasePriorityPrivilege 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe Token: SeIncBasePriorityPrivilege 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe Token: SeIncBasePriorityPrivilege 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe Token: SeIncBasePriorityPrivilege 4568 {3B435D10-597F-41de-808F-737E03450630}.exe Token: SeIncBasePriorityPrivilege 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe Token: SeIncBasePriorityPrivilege 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe Token: SeIncBasePriorityPrivilege 3836 {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe Token: SeIncBasePriorityPrivilege 2452 {85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3580 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe 99 PID 2980 wrote to memory of 3580 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe 99 PID 2980 wrote to memory of 3580 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe 99 PID 2980 wrote to memory of 4464 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe 100 PID 2980 wrote to memory of 4464 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe 100 PID 2980 wrote to memory of 4464 2980 2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe 100 PID 3580 wrote to memory of 3132 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 101 PID 3580 wrote to memory of 3132 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 101 PID 3580 wrote to memory of 3132 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 101 PID 3580 wrote to memory of 2760 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 102 PID 3580 wrote to memory of 2760 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 102 PID 3580 wrote to memory of 2760 3580 {402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe 102 PID 3132 wrote to memory of 1400 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 106 PID 3132 wrote to memory of 1400 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 106 PID 3132 wrote to memory of 1400 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 106 PID 3132 wrote to memory of 4576 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 107 PID 3132 wrote to memory of 4576 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 107 PID 3132 wrote to memory of 4576 3132 {CC539198-109A-47dd-B4B2-05062F4E33BB}.exe 107 PID 1400 wrote to memory of 1264 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 108 PID 1400 wrote to memory of 1264 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 108 PID 1400 wrote to memory of 1264 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 108 PID 1400 wrote to memory of 5088 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 109 PID 1400 wrote to memory of 5088 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 109 PID 1400 wrote to memory of 5088 1400 {B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe 109 PID 1264 wrote to memory of 3264 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 111 PID 1264 wrote to memory of 3264 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 111 PID 1264 wrote to memory of 3264 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 111 PID 1264 wrote to memory of 4672 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 112 PID 1264 wrote to memory of 4672 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 112 PID 1264 wrote to memory of 4672 1264 {D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe 112 PID 3264 wrote to memory of 1716 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 113 PID 3264 wrote to memory of 1716 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 113 PID 3264 wrote to memory of 1716 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 113 PID 3264 wrote to memory of 4984 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 114 PID 3264 wrote to memory of 4984 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 114 PID 3264 wrote to memory of 4984 3264 {D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe 114 PID 1716 wrote to memory of 4568 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 115 PID 1716 wrote to memory of 4568 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 115 PID 1716 wrote to memory of 4568 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 115 PID 1716 wrote to memory of 3816 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 116 PID 1716 wrote to memory of 3816 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 116 PID 1716 wrote to memory of 3816 1716 {6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe 116 PID 4568 wrote to memory of 2332 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 117 PID 4568 wrote to memory of 2332 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 117 PID 4568 wrote to memory of 2332 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 117 PID 4568 wrote to memory of 4680 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 118 PID 4568 wrote to memory of 4680 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 118 PID 4568 wrote to memory of 4680 4568 {3B435D10-597F-41de-808F-737E03450630}.exe 118 PID 2332 wrote to memory of 2092 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 119 PID 2332 wrote to memory of 2092 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 119 PID 2332 wrote to memory of 2092 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 119 PID 2332 wrote to memory of 4476 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 120 PID 2332 wrote to memory of 4476 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 120 PID 2332 wrote to memory of 4476 2332 {AC319AB4-3585-4d24-A17A-29A4043B283D}.exe 120 PID 2092 wrote to memory of 3836 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 121 PID 2092 wrote to memory of 3836 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 121 PID 2092 wrote to memory of 3836 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 121 PID 2092 wrote to memory of 744 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 122 PID 2092 wrote to memory of 744 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 122 PID 2092 wrote to memory of 744 2092 {1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe 122 PID 3836 wrote to memory of 2452 3836 {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe 123 PID 3836 wrote to memory of 2452 3836 {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe 123 PID 3836 wrote to memory of 2452 3836 {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe 123 PID 3836 wrote to memory of 3336 3836 {4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_3f7db079a3996bc0c8526cae4d6497fa_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\{402B78B7-13E2-4e1f-8484-2AB388AC4618}.exeC:\Windows\{402B78B7-13E2-4e1f-8484-2AB388AC4618}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\{CC539198-109A-47dd-B4B2-05062F4E33BB}.exeC:\Windows\{CC539198-109A-47dd-B4B2-05062F4E33BB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\{B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exeC:\Windows\{B2538BAE-C7FE-4b6c-B183-A0A0A515E977}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\{D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exeC:\Windows\{D487729C-BA0A-41c7-8DBD-0B781DDACBD4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\{D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exeC:\Windows\{D15EA515-D7B7-4306-9E84-167A57BEFCEC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\{6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exeC:\Windows\{6111A5C8-C18E-4b18-93EB-CCB8509E2420}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\{3B435D10-597F-41de-808F-737E03450630}.exeC:\Windows\{3B435D10-597F-41de-808F-737E03450630}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\{AC319AB4-3585-4d24-A17A-29A4043B283D}.exeC:\Windows\{AC319AB4-3585-4d24-A17A-29A4043B283D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\{1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exeC:\Windows\{1AC72429-0A28-44d9-9C93-AA345C7DA6EE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\{4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exeC:\Windows\{4AC34A98-C7E9-4e56-8D2A-5A5808C6F1B8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\{85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exeC:\Windows\{85285F8E-DFF3-4c8e-9D98-9A9FCE1924D8}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Windows\{344804A8-35F5-4360-9A01-9FD696AA0CBC}.exeC:\Windows\{344804A8-35F5-4360-9A01-9FD696AA0CBC}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85285~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
PID:1116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AC34~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:3336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AC72~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC319~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:4476
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B435~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:4680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6111A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:3816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D15EA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:4984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4877~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:4672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2538~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC539~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:4576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{402B7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:4464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5cf3a8b2c05668fb5cb4a9cbd37ce8a98
SHA142827ef4b0c6c931fe8133d0e4a5e9962cae732f
SHA2564abb211cf0b473ec16d7bfca1fe0d001c5bc74222bb3be02c83c0dd9eb7c8a9e
SHA5124786f255fa12d970d0eb1411c6d8b18f81bef1e39590b19ace2d33602a2b3e5c14c3c83768a464e74f28b640ed663ef4b960bf4ac8c4f1ec2c29a046d6bb68b3
-
Filesize
168KB
MD5234b8c7fdbf2a28783abed3fdb7f320c
SHA130d34222d028fb5ad540a023099bb67e621c6d63
SHA2562af4fc5d69e8bb9e08820291cd798498dbc5696a97c540f3d217c4846307d4a8
SHA512465b5b45353322a6b93b8ff2213e8c119d2d86c793e61b3a7a6f58ec14f064efdcbad3c0d27dc26b8c42757004dcdf399e8120522f9d06b3926f5f9271e875d6
-
Filesize
168KB
MD5aae55b43b6ab447d23833cdf7cbfc8da
SHA12ca5c9786926a0be4a902065fb8c07f5939ff4cb
SHA2564ed07d94129acdd77359fc7f5d385202aa1be897656a9eb882562bd0cd0690d3
SHA51236d4794295150b05c50c43c5a189037541b88aa2eaad7d1833f23ceb4bf8b742e232c5539bea4f47ae665b95a7ded4d004367fb6906039ea9978e9f495d863da
-
Filesize
168KB
MD51d863cafdeb51ea13aa969db906fc33b
SHA1d6027a57016c05ab9cd7c8693050fec90908afb1
SHA2564b17d98e850d03bce897418e4a0480bbe8c62d10fce211e2aea655e4868af716
SHA512e23edb70c7766a5af2878a0868dda245239cfb03539f290513e2d717af950fe4c1f2096395835c347845b1bb78216084bd6d5f304fbd32bb2271fd28332230b0
-
Filesize
168KB
MD5febad1e3dc4f2a3df740cc9fdc8b7677
SHA1f37760d320eef647be6795bbf40ff213a2893d94
SHA256fbf9375188994fc0e555f17c17ae08d16832fa1859faeb3c255ac922f8f88630
SHA5128ffbce959afd66fd848c8ea95a504965a101f3def5d5beac3b544f6d78d46049d83fbb0deaf313a85b4f1bd81c074717e6ddc4963ca7dc6767623bd3d7c06279
-
Filesize
168KB
MD58a8a0da1a36d15c6962af4cc34459669
SHA1558967cf3eefca94c9cd5c3adc784fab988180fa
SHA256591ab84b20549d394e898d11c6174d06fd55684c6aaedee5f3a4eab440d3ece2
SHA51285964431f521e5a3377e19cb2a4f8e2db06d019e4f87e4f514d537a8a6650408c2ebbc19564c1a26f7f49337f0365be7676d22901a19393a55d615691525e42b
-
Filesize
168KB
MD511b495905085ec582c1f740d1a02879a
SHA10f5ae7cf27ff27760f57e30b73d849cdf413a31c
SHA25690d575b8014e9272a0d06e893e86d5296c4cf29dfc135b12a0cc7ba7c477838d
SHA512cd5fa7db1cb10341d243cd23798175750b3c3be0cf4672de67c88b07ab34083e566c923c9fa067be3f0929d381c7b75efb2e74768a08faf08b8fcab4f59b2e6b
-
Filesize
168KB
MD516f1cc8949e37efedaa4315435ff72b9
SHA1cb9e8082ddf8f41552c92dc100095343fdef6f07
SHA2564b671eca279f9ae53c424cd03e2b11d353d690be01ce3815675fe694d605fe37
SHA5127cd32b9e8cf464879156fc75b3a2ddb45243d89bd66b3f98eea24a26982282e3d3fa8919b18406eb99a2a4641cc4b91e46dcd50f5a2d885c2c3cccf6122758ae
-
Filesize
168KB
MD5d4cc2fdc073accabd2ed854bf9cfd375
SHA178540a7a2d16c86c17d88ddeeba151504b37910c
SHA256d5456b048c3dcb9a84fd1de0b273ff3b2a1704199d490e5ca9ab683225b54d72
SHA512a80823436f80c18fd4f01b1b301765518e42ab434941521980fbc8f28104cb8f3a6bedf8a8397afad958ea016664652558cd88e7f9ca803ce774aebadf486128
-
Filesize
168KB
MD53ade4803cc43d9c0a25a2ccc22268393
SHA142cb1cef3acd55a58653e89885e38120e8ce4d10
SHA256b268f9e16f423bb6c203f661a3fdba7853a7eeba55ad4de4c1a84f5fcdffb645
SHA5122434d033f24c457ad481035b5e3168eed5b133c59034815559da3a5e7efb56ea1f7f9bca5278acd6c67dff133b45019457d3564f7bf85b6e3c8306bb2fecc00c
-
Filesize
168KB
MD5c5908290269d9a78b8fed53d8a622c6a
SHA1efd962729852b079e641279c60b0667f5496def6
SHA256bae224d632b5dece3ae82ab3a537ef2f319b10277251b92fc500d49cc2facc91
SHA512de95666d4ea5f3768ccf33cc03e0ea8524ae899ccb29ada3fbba7a05877077ba8fe4369d226201cbff665ef5514481d6a45cbc2808e07a561a0c966f697b2916
-
Filesize
168KB
MD596b25bfbca3850c1656c3a340a9fe239
SHA1dcc36db98bdb0e070f0aafdff3878dce2ee48e23
SHA2569c5fe6ea9be1f9346b109e9d3115c7c37b48410a29c7ebe413c2873c12beadef
SHA5122bb4d480c6c51720b30d41260c25de318a52212be6c6f821e03bd0c40e7e62b5ee42a845238ac184e02e8fcf74d5ebd074dbc3785b204e8f8194b2580fb9e8e9