Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26-07-2024 09:24
General
-
Target
2024-07-26_9be373f9a39bc56e186458b2eed19784_goldeneye.exe
-
Size
372KB
-
MD5
9be373f9a39bc56e186458b2eed19784
-
SHA1
c6d4aa37a92ce985202ac874e667ff614a481de4
-
SHA256
49db031a395709625fa94c8be9a150deff3bc4d554074f21f410bb71cc4ac731
-
SHA512
79132d480c55f8f3342edc59636b1443846c7fe2cd4ac470eb22dd5e55e64f654a60ab489fd23882949a0d150829a9a89d7ad112c5b2013818ad94345a4ada93
-
SSDEEP
3072:CEGh0oflMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGVlkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_9be373f9a39bc56e186458b2eed19784_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_9be373f9a39bc56e186458b2eed19784_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4813B47-83AF-499f-A990-C7737C1D18CE}.exeC:\Windows\{D4813B47-83AF-499f-A990-C7737C1D18CE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A2B46A5-ABAF-451b-9B52-064E02018CFD}.exeC:\Windows\{7A2B46A5-ABAF-451b-9B52-064E02018CFD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3572A91-F6CF-492b-8F7B-C48B01C6A301}.exeC:\Windows\{A3572A91-F6CF-492b-8F7B-C48B01C6A301}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5ACD8DEC-266B-41a7-8E25-E8B329D1784C}.exeC:\Windows\{5ACD8DEC-266B-41a7-8E25-E8B329D1784C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADBCC22C-042D-45c3-B530-E48BA3CE44C6}.exeC:\Windows\{ADBCC22C-042D-45c3-B530-E48BA3CE44C6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95D05984-380E-4fab-98C9-81D17406EE77}.exeC:\Windows\{95D05984-380E-4fab-98C9-81D17406EE77}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{982E4860-CBDC-48c5-B8B1-0CF50266C91C}.exeC:\Windows\{982E4860-CBDC-48c5-B8B1-0CF50266C91C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83A07019-C1D3-40ea-84AA-5349D02F50BB}.exeC:\Windows\{83A07019-C1D3-40ea-84AA-5349D02F50BB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7337DF0C-D3D3-4a36-9155-35CA115B76BD}.exeC:\Windows\{7337DF0C-D3D3-4a36-9155-35CA115B76BD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12EE773E-DEC3-42a7-AA64-C3EA043A44BB}.exeC:\Windows\{12EE773E-DEC3-42a7-AA64-C3EA043A44BB}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51F4BBC1-ED38-44dc-BFC8-D76C536F891F}.exeC:\Windows\{51F4BBC1-ED38-44dc-BFC8-D76C536F891F}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B66E3DF8-8476-4ff7-9240-9C8C17B78DD8}.exeC:\Windows\{B66E3DF8-8476-4ff7-9240-9C8C17B78DD8}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51F4B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12EE7~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7337D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83A07~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{982E4~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95D05~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADBCC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5ACD8~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3572~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A2B4~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4813~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD57dab10b8c59da9cd62a6ef2741529a94
SHA184fb99fcfc3fe4e7d6b5dd027b224353edd14273
SHA25639d921f21e79397328d53a0b4b8e58b27c49acd13be1a43d45239562d0692f80
SHA51275e4f97ecac70fb8e8c668c177ece9ffa729bedc69b296783247e9e65f0fa74fb7e48b78340cb0c5b3e2e9ce8df1bd49cff5a033d432224807f577dbfa9b2745
-
Filesize
372KB
MD5559741a83b4ca1776a7fca609e4a9ded
SHA1a86bddc014e988e4ac666b25eada1c4cca9b4770
SHA2566a00433b3221cb72a09167367af10dfd7fd416aa35946bccde1465f1bc315910
SHA5121bb89e2326f76aa50fc64976f79a72e52b7ef0c77775e1aad2fc4d66c711436b452455b1fccff0734037b23ac31465af8277bce3eeebb03cf228fa9c4fb5ef12
-
Filesize
372KB
MD55d30f7ece7d4c79267bb952e4bb63b94
SHA1f0c3df1402d33ed28a13dc1a96e413728b134f72
SHA2568e16ce37a9f1daf217d71183add226b2106c9910de41a70d54db1655a6680269
SHA512b33fe184b8dc42bcc84476f45e4b8f385082de26e83c2c334d6a8ee1c49f74166b55a90b6767c892e00fcfdaece2fbb4080d31b8a52e31630f1e5d7f0dea6560
-
Filesize
372KB
MD5365a721914faeb28ff466365b19caa5a
SHA1fc4e5ef7a0dab26062dacaf312bc8f7a172d6c95
SHA256caa9915889b75aff98536510996032e98ceba84be19e914a845526fe92b8cfff
SHA512021374c1ee97277c851bf53a248ab297d9f72731bed993c048b8a5858dc44d245a06995bec757ebf295446a9ef93458535467727881cd75048cb744617a75f2f
-
Filesize
372KB
MD5ab29918eb0e733d0114d022838c1fb52
SHA1e9a5b74780e76adc43f6c0e62a8acb3c02f2208a
SHA256487da9c4ef6cf4e4eca49e5643108aba9fd58b19e3e5088ff60965d7362da4bd
SHA512835f3550af6ec11ed91407ecde98cbbee0a84431bb2911f12d3b97e9a9638583c77504b1aa5c2da95482dfb1805d8281e486c83fb149132c21e0339a68bf3b81
-
Filesize
372KB
MD58dc92497ea077f772e8016c51f514a59
SHA14b51714e1d1a960fd254ac29bc8285778e855bd4
SHA25694eea32986b4ef09e3a79ae035afea87089f723a763c43ccb19e7728d3739a8b
SHA512b63dff8f56d859506788cbe327ec3637cfa8fd1adccce4a0e94e9fe3bc3febb68dfc90332091f2d44a260e8433551121f026afe34f39270e32b628045885285a
-
Filesize
372KB
MD518ac50d8e0f6b2df9f09a84deec5605f
SHA187bf44c01694124339372bd63da395c020545f84
SHA256a04481e52f7e0862352ac71efa61e2bbd0a7b524a46dba8947d254d010ab8c3a
SHA512d53295a291c2c1f10f3874b90e4868d5235859006ee1cf6ed12ffe9f2c8f91c9b960b2453b690f3c34cca6e47b9782743b5ca6c684dd0a275415c072cca2b0be
-
Filesize
372KB
MD55e351bec4549af7cf5959a4f08b20546
SHA121f7e6bad2daff2e1a8e4e243081465777acc5b7
SHA256ee79fc36f18273dfd54176d3b96779a917b6c019e0af58f5387a441f4e16062d
SHA512c6eea51d32fdbf7ce59b9f6fb90720f111f7c6816a31315ff87c6d9cabd962f062bcad2d72a14158e308783b75f65de61fce68e6a73bff030cf4f6feb616647d
-
Filesize
372KB
MD569787414e9d7449c63117288f0fd3c79
SHA1982994e5de1637760324dc69d7fd89af297f1b7a
SHA2568815d5113f28796dac397d22344993a442cbdad7aee9299edc329aaeb9bb302f
SHA5127d65480e7bd79061b4d0d755e42da996c8ac9b126b8ae12e2e1f6f88dfe43931da14b5a74b500ba9a49032bddf64bf08f99ca711e924aeb9d0f03982ce251182
-
Filesize
372KB
MD5ffeb25b043698deda941bd06d8681cb9
SHA1bc9965f09be6e327ce0525a2e82944a97d5edcfb
SHA2563eac12b60b5ac60a72f0202d473c5ec15cce685bfb0e346bfc0222f271448f76
SHA51204c8c22581843fbd2f3b1c8ec060eecfe057b715fa5268e53554bb121910f1fac9aaafe587b31884b363869cef911011af169704311a2761536abe7124795b82
-
Filesize
372KB
MD515e8cc06716c00e088fdfed843ea57e7
SHA109ae53a9af743093879093061258241b4de45954
SHA25631ba48eb08cc16e65048dbb1ce2fd8ec309630e7918c497a4c9bb24cb26556cd
SHA51231e035a99f3e2fe1a4fb46e13f16f96e7e29a201a6177278fbf17c1fedcdbb917862285d65745a3a811a37d822c3f8fdc6178acc74d97ce6e160b9ebe22b62f8
-
Filesize
372KB
MD598176326da157873787d48dc0a38b917
SHA1713552ed9ab9e1ea188ac8d4ce8deeb88c3bac97
SHA256db9f3950a6deebc9fac02c0d84749c3d84fe81d6410fd962cfc0996d57ed5b39
SHA512674a580eb752424e3e9e4102da0986587da7aec1c0c6e239d26cf5a76548a206118afe3129be3df4525b3dd1640eb6bf5e7d3616cd83ba288ee3fa883f92ae5d