Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/08/2024, 06:22
General
-
Target
2024-08-09_4ccdcefc233217c4d34cdbd0f7567ccb_goldeneye.exe
-
Size
372KB
-
MD5
4ccdcefc233217c4d34cdbd0f7567ccb
-
SHA1
18693c3290fc74093044a849864a98a496897c50
-
SHA256
e3afb9ec599eb162c996476a09a867f729d07f82ee9da8ce668fc9943c711cbf
-
SHA512
e7608a91d589656883ab498451651fef56139ae13079acb5e44eb6f3daba931ddc045bcf6e99f6901ff540471730da37399317a74e1beed05919dc1194d94fa1
-
SSDEEP
3072:CEGh0oPmlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGZmlkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_4ccdcefc233217c4d34cdbd0f7567ccb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_4ccdcefc233217c4d34cdbd0f7567ccb_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{456D0D5D-A258-42dc-95D3-6805BA69300E}.exeC:\Windows\{456D0D5D-A258-42dc-95D3-6805BA69300E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{631DC3C6-6583-4c47-9413-06B3D02668BC}.exeC:\Windows\{631DC3C6-6583-4c47-9413-06B3D02668BC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{533A83E0-3251-4105-B03C-4BBBFA836D69}.exeC:\Windows\{533A83E0-3251-4105-B03C-4BBBFA836D69}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18B1E071-81B9-4c6d-9A07-99BB9639E120}.exeC:\Windows\{18B1E071-81B9-4c6d-9A07-99BB9639E120}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD3B67C4-CE33-49b6-9DC5-777A5A0AC1EE}.exeC:\Windows\{FD3B67C4-CE33-49b6-9DC5-777A5A0AC1EE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91B26E7F-0516-4c63-855E-FD1FB77511ED}.exeC:\Windows\{91B26E7F-0516-4c63-855E-FD1FB77511ED}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0316D6EA-43B6-446e-82FB-07228472E1E0}.exeC:\Windows\{0316D6EA-43B6-446e-82FB-07228472E1E0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F54DBB07-C3B7-482a-BDBE-F45BBC796DDD}.exeC:\Windows\{F54DBB07-C3B7-482a-BDBE-F45BBC796DDD}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C823928-DE16-42f1-ACC7-47CF59499830}.exeC:\Windows\{2C823928-DE16-42f1-ACC7-47CF59499830}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CACB0E4D-9775-4bea-B5A6-5DE968A0504B}.exeC:\Windows\{CACB0E4D-9775-4bea-B5A6-5DE968A0504B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15F4F5AC-E208-4fdb-A574-59AE81C25A94}.exeC:\Windows\{15F4F5AC-E208-4fdb-A574-59AE81C25A94}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F701377D-2E22-4f32-A482-6A87DA2D9661}.exeC:\Windows\{F701377D-2E22-4f32-A482-6A87DA2D9661}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15F4F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CACB0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C823~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F54DB~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0316D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91B26~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD3B6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18B1E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{533A8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{631DC~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{456D0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD59f7e7943a6f3a7cefeff9831dccd9113
SHA185cf9c06b7fe8b1192a7e29d26c72d1d66cd04f0
SHA2563b6886f36d91fb99f3a80a897ddfce03d7c1e9f5b9a944a28aede07999df9461
SHA512b8fe8d8ae01def3bdff14a21dd9409d9ee605230a13ce77cff9ea9fe12a8a2344bbb33238a1b85d4516680bdf975d581aa4c1ea3da045d644f49a075e6bb71e3
-
Filesize
372KB
MD59564749db8919626130736bd27c89299
SHA1aa3b88db7830df47ed7d751df9ff177008d50f72
SHA2566e409bf00bb86c99c8821f22f15b2a458b429cb1874a6cb1ffead072b27b6633
SHA51297e91052fbe1d435b9a582129a7cb2efaf95c962647c417b25be449e28b6a285a5d524781d4c120f1693ecd24d5b36322873fae8747667898d92671e35875490
-
Filesize
372KB
MD55f2e40118ea69508e7280dc541bc654a
SHA179bde075f5fe9387f9fbf7015b2b1d3a12716657
SHA2560023b96d8699a4c80d1494e3aa033d51bb203a33b9ee2f2fb6371edfc7ba7494
SHA51296d00654d46c48f8ccce3045d25fe962febf43844630e3acc499f87f3636499e65f3587669ac61386b41b16162ac1f2960ca4c88fdde0413cf0657679c4201ca
-
Filesize
372KB
MD5d2c6d199dd09bc637e95b95298244ce7
SHA1bb42f8f507b7d1ae707f8eca6110b506bfd054f9
SHA25631177445559fadea83b4507ed00592a0e74428ef7b46afe3f2c2eb83207604bd
SHA51292ede446f52657f82890faa11d4e7a4053359ab8fefe601f38422c886caf5630d2cc9e139c4f1b8b9ed69bfa56bff36ba41a9dc3b7edd0d20435128aa01614e1
-
Filesize
372KB
MD5d8be7a3efa5732c9da1a5d9ea18fecc1
SHA198fd4cb94de786f40943a8eb100180f277c5d4be
SHA256755033f87afd2032227223bd496cb66d10f38bdb7bd10df94f1b4bf00e2fe2a2
SHA512d83cbfe09f9490873c33a5484d5fb4c4fb5ed6fd9714a4ea523d29c6e6eb224cc6cad7798768f07b3ad4d6b377373a343d8610ab5662a266367c9a37c0720d1e
-
Filesize
372KB
MD50275a1ca082e4cfaf9a4c4ef204e996e
SHA1227ef367bcd3d790fb1334ae6c2389e6d251e813
SHA25664dd7b66236c0582bd4bfeb4580fefb1973bcf2a2aa4458b55ec16cf4a386b3f
SHA5125b91735c4b56b1a8695c46cfedf5375a16bc90e150f415e74c5d741ca9318e33bcf34cf92de3eb16eafeffe31d331ebc537800616c423c8aa4a8268d023fd2ae
-
Filesize
372KB
MD5d22a7cad7086f01ee97b5f743c3f04b0
SHA1a2ca2070de5b5cb04851b69d9ea45d427f6e5cc0
SHA256b47639455ded8193c3f66c9dd3dc80d753edcdeee984b6d43f4df60ab3882bce
SHA5129b0af4a1fc7fe4c1e34d3f9af22f063dc51ee41ab0d53b794e060695da5c048be1dfd68a5ea560afc91f2691328eda3aa511ec2741d93b0ab36c68cdb4d4ae71
-
Filesize
372KB
MD58bd81137a7c48389d0467871142e0936
SHA1fef34702d1ae79cca790240092239c76f945411c
SHA256b053292c4f9c45c662e2b5ecbbde8ef5097c5ed99152ab119a2693d01fe1a6ce
SHA512c41a97cda798666b82210af275e58549d20cc93734da192151d74a675025aacc1fb317b56167902db255e93a92c7a6676b16b0f44063f6c7e4a13c253e5c18eb
-
Filesize
372KB
MD5a07630aa926ef08ab32157768b5eee05
SHA1d1c435d5f521e0dc6e3e55f6db510ad275c1d6e8
SHA256cddcc2e2f41e7dfd82201fad691c0e209db1bf89e203e2e3af18ae5d26e10ef9
SHA512222dda3219d60210d5615aea3cab9955a1f474bcd8827bd474a0b847eddedebb77598cbecf919bcfe4be9a90bf2cecfca8713ab2eaa05cc09c3010f7dc5455c5
-
Filesize
372KB
MD5b9590d16318313a09614c62270941cdf
SHA1208d480fb3b7f3960094f0809b5071701f027bdf
SHA2568effa60ec406effdcd90b2a12ad88debb4072f3e276bcd22227d70aae1889eaa
SHA512e960719c4d8494908dfbbdfbeba89bd85a6411471523f5505a91d94f963400255ecf08dbb8b2d64e4cea6846b2e6a7bcf14d89d0ea6b24eb7963857486707ee3
-
Filesize
372KB
MD5598a6eaa315c6c466f662ed71d697696
SHA1f565f62ff3bad482ca9705596947662d127c9c56
SHA256c867717f7f70d46123da899e50114016a5693592d0ad805993151cde3bfb0d74
SHA512319ed693b480bbd85f28fef8b40cd201f510a94806c68fd315faeadbe911a024a54a9e97f2fd4097f6963256ff60590f89b0866ab73958ea4b022a6f72ce6673
-
Filesize
372KB
MD5f934e19062d5f36b12e3fb34b207e181
SHA15746e1469e7439833eff79363bc14ef945f62dc9
SHA2566b4637233bc738d172f42d652929db497cac57aeb679aed2e842c180bf3973c0
SHA51296b8c59431088ed62298fdb52b742216af272ebe58b764b59177337b6e7408ad7c72826b78cefbaf6880ef9e35888e3e72c40b1437ad8518420eec238c2ab72e