Overview

overview

8

Static

static

3

2024-08-07...ye.exe

windows7-x64

8

2024-08-07...ye.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2024, 12:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-08-07_dde8214497f9cce33bb255611157fe5a_goldeneye.exe
  • Size 380KB
  • Sample240807-p1ttyascpc
  • SHA256 f9e28efa88dac35f0a7b9ff99e0c7b4827cd6496e4be9bf6a7cc2d54501957af
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-07_dde8214497f9cce33bb255611157fe5a_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-07_dde8214497f9cce33bb255611157fe5a_goldeneye.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Windows\{4307EFE9-23C5-471d-AC52-E6BC20480DAA}.exe
      C:\Windows\{4307EFE9-23C5-471d-AC52-E6BC20480DAA}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Windows\{EFC9DF1E-76EF-4707-AFBB-301A81E868F8}.exe
        C:\Windows\{EFC9DF1E-76EF-4707-AFBB-301A81E868F8}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Windows\{91514FFB-AF48-4fd5-9F76-C394552AC13D}.exe
          C:\Windows\{91514FFB-AF48-4fd5-9F76-C394552AC13D}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1168
          • C:\Windows\{E791659F-6B3A-433e-879D-BE738AACC008}.exe
            C:\Windows\{E791659F-6B3A-433e-879D-BE738AACC008}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1380
            • C:\Windows\{0DEA3C28-EF9E-4900-8225-FC378FA68E9B}.exe
              C:\Windows\{0DEA3C28-EF9E-4900-8225-FC378FA68E9B}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5044
              • C:\Windows\{1A50652B-40BB-4a31-85FF-8E78D66C67C3}.exe
                C:\Windows\{1A50652B-40BB-4a31-85FF-8E78D66C67C3}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4204
                • C:\Windows\{D9EBE2F6-C4B6-484b-867A-025530930B59}.exe
                  C:\Windows\{D9EBE2F6-C4B6-484b-867A-025530930B59}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:852
                  • C:\Windows\{49CE902F-E93C-4d61-B4E2-11AA064C5307}.exe
                    C:\Windows\{49CE902F-E93C-4d61-B4E2-11AA064C5307}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2944
                    • C:\Windows\{726DC184-19CD-4131-88F4-7759CB88DDBE}.exe
                      C:\Windows\{726DC184-19CD-4131-88F4-7759CB88DDBE}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1452
                      • C:\Windows\{9E7C0225-B173-41fe-B194-CAA16D25654A}.exe
                        C:\Windows\{9E7C0225-B173-41fe-B194-CAA16D25654A}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1768
                        • C:\Windows\{1676A555-BC30-42ba-9400-05C937C4AD62}.exe
                          C:\Windows\{1676A555-BC30-42ba-9400-05C937C4AD62}.exe
                          12⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3724
                          • C:\Windows\{A17C747F-063A-4687-A6B4-8CBDC0C5D3CF}.exe
                            C:\Windows\{A17C747F-063A-4687-A6B4-8CBDC0C5D3CF}.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:1208
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{1676A~1.EXE > nul
                            13⤵
                            • System Location Discovery: System Language Discovery
                            PID:4852
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{9E7C0~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:5064
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{726DC~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:2504
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{49CE9~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:4672
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{D9EBE~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3784
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{1A506~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2680
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{0DEA3~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3940
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{E7916~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4264
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{91514~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{EFC9D~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4448
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4307E~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1864
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3168
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
    1⤵
      PID:4272

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          {0DEA3C28-EF9E-4900-8225-FC378FA68E9B}.exe
          • Path C:\Windows\{0DEA3C28-EF9E-4900-8225-FC378FA68E9B}.exe
          • Size 380KB
          • SHA256 ee0f7246b8e85e4489cd73ec8bc87324f2199ebc18c476aba96ebc0695b99356
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {1676A555-BC30-42ba-9400-05C937C4AD62}.exe
          • Path C:\Windows\{1676A555-BC30-42ba-9400-05C937C4AD62}.exe
          • Size 380KB
          • SHA256 02f1d3e13c7f645c15aa82178e164cc934c51f38e82025bd113093ed36920035
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {1A50652B-40BB-4a31-85FF-8E78D66C67C3}.exe
          • Path C:\Windows\{1A50652B-40BB-4a31-85FF-8E78D66C67C3}.exe
          • Size 380KB
          • SHA256 f03c715d06940b3e6517b9a1cc5694ee8edf4b055a7eb4b87e3839c354741392
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {4307EFE9-23C5-471d-AC52-E6BC20480DAA}.exe
          • Path C:\Windows\{4307EFE9-23C5-471d-AC52-E6BC20480DAA}.exe
          • Size 380KB
          • SHA256 3970f29f2ff9a81aad04de176bd5488779600726c00a658706541ea3dce41337
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {49CE902F-E93C-4d61-B4E2-11AA064C5307}.exe
          • Path C:\Windows\{49CE902F-E93C-4d61-B4E2-11AA064C5307}.exe
          • Size 380KB
          • SHA256 0f858c6bd92319632df96d9c4a364302f39c142d93a36c6b39c2dbba9365c313
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {726DC184-19CD-4131-88F4-7759CB88DDBE}.exe
          • Path C:\Windows\{726DC184-19CD-4131-88F4-7759CB88DDBE}.exe
          • Size 380KB
          • SHA256 ce2641ff809a9e6e8ed0f2588df8fb85a7f28f0f128979c57a70854a5a0054e5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {91514FFB-AF48-4fd5-9F76-C394552AC13D}.exe
          • Path C:\Windows\{91514FFB-AF48-4fd5-9F76-C394552AC13D}.exe
          • Size 380KB
          • SHA256 197170174770ee423b3beaa19815fd2458877e5068d79d6f7b9d6f6b2460a411
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {9E7C0225-B173-41fe-B194-CAA16D25654A}.exe
          • Path C:\Windows\{9E7C0225-B173-41fe-B194-CAA16D25654A}.exe
          • Size 380KB
          • SHA256 c434c5f5d1fe487dd425cda53518cd27621d1835f8469d3ed3cd456f636a1f15
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {A17C747F-063A-4687-A6B4-8CBDC0C5D3CF}.exe
          • Path C:\Windows\{A17C747F-063A-4687-A6B4-8CBDC0C5D3CF}.exe
          • Size 380KB
          • SHA256 f8348e1ea57dffefdb5feae8d1e3bccc95164d62f600a5bc09801cb418d5fca1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {D9EBE2F6-C4B6-484b-867A-025530930B59}.exe
          • Path C:\Windows\{D9EBE2F6-C4B6-484b-867A-025530930B59}.exe
          • Size 380KB
          • SHA256 3a9108532087ecc5125d15664dee21f25797ca22deddedc2947bfc02214a5c6f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {E791659F-6B3A-433e-879D-BE738AACC008}.exe
          • Path C:\Windows\{E791659F-6B3A-433e-879D-BE738AACC008}.exe
          • Size 380KB
          • SHA256 a35ce6e4d5fc33b7510198e8eaeed13b04f0ecec5cf548aeaf75a448bee99fe1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {EFC9DF1E-76EF-4707-AFBB-301A81E868F8}.exe
          • Path C:\Windows\{EFC9DF1E-76EF-4707-AFBB-301A81E868F8}.exe
          • Size 380KB
          • SHA256 14308251529fb926b36c227bf66a8ac0bdaad9437831bee52f6a82919a61b305
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download