Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/08/2024, 01:45
General
-
Target
2024-08-10_74884e89b5b0e301481d6a7bb46a7418_goldeneye.exe
-
Size
197KB
-
MD5
74884e89b5b0e301481d6a7bb46a7418
-
SHA1
5e403ffecf97ed38ebc96d00c3cf698299cc91c6
-
SHA256
5e6909198165f34a018faf339247b747c34708058b5ad848afeaff731f6b47e7
-
SHA512
73126c2ea37fb96af8cb24c1fce783e086b46d355c74497311703b8fa1af9bc2c5b9365a8f986a5819b0c299d78fc2d9338d0b1b5b92f47d59d34c910a278492
-
SSDEEP
3072:jEGh0oOl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_74884e89b5b0e301481d6a7bb46a7418_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_74884e89b5b0e301481d6a7bb46a7418_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0756C7C7-45D7-4c13-8943-A4811B04A255}.exeC:\Windows\{0756C7C7-45D7-4c13-8943-A4811B04A255}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD49E6F4-CB28-4bbb-AC4B-F26A1D55DBC4}.exeC:\Windows\{FD49E6F4-CB28-4bbb-AC4B-F26A1D55DBC4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D561BFC-6606-4932-A563-36CD25949E00}.exeC:\Windows\{1D561BFC-6606-4932-A563-36CD25949E00}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76E6D79B-DE21-40b5-AF6A-4F3F61146D1D}.exeC:\Windows\{76E6D79B-DE21-40b5-AF6A-4F3F61146D1D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC2E6301-1BBC-4f1e-9541-C7373E9C854A}.exeC:\Windows\{AC2E6301-1BBC-4f1e-9541-C7373E9C854A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEA92A9A-0CDF-48c3-BE7C-DBEBD182A50B}.exeC:\Windows\{FEA92A9A-0CDF-48c3-BE7C-DBEBD182A50B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{081314C6-D1CC-4a37-845D-4D9BE27B86CE}.exeC:\Windows\{081314C6-D1CC-4a37-845D-4D9BE27B86CE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7B317AA-2B58-40b4-A5C0-8079D69F702A}.exeC:\Windows\{A7B317AA-2B58-40b4-A5C0-8079D69F702A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92DC91B6-DAC5-4d72-AA36-77780705CEC2}.exeC:\Windows\{92DC91B6-DAC5-4d72-AA36-77780705CEC2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27D22551-332A-4f60-8618-9B15D292E518}.exeC:\Windows\{27D22551-332A-4f60-8618-9B15D292E518}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{097310CC-748D-4ffa-BCA1-D361CD778C91}.exeC:\Windows\{097310CC-748D-4ffa-BCA1-D361CD778C91}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A7D44A07-B8BE-41ff-B214-29388386F2F3}.exeC:\Windows\{A7D44A07-B8BE-41ff-B214-29388386F2F3}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09731~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27D22~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92DC9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7B31~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08131~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEA92~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC2E6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76E6D~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D561~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD49E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0756C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD52c5e068bf99e9752ac20742d88d2767a
SHA116b0dbd74a880a75f51aed625dfdc6014d898063
SHA2561073acd61e3d07580e44b6bfa891a487b24eea1c0d382c9bea3ed851f8a5607b
SHA512735eec68a51706c27ba0b247ef95b80a48f4990f9f6b1f37d1f053c1753fdbbb6f09a4054b911a40e6679c9b3def8546f3a63804d2b4106699fcf35a11b17c71
-
Filesize
197KB
MD5fc33f7a526995ce2e04548756183a003
SHA1c51bc9afe81a681e8c20d62931ae6ce11101479d
SHA25614c31681f27ac1c928a1ef9f197ca3984ade28b0acb770a078ded6b682e30157
SHA512b3c177586b89afd1c4932b1800f6efee335a948c632ee5ae202650b6260f512b9a54f6a7e0462c1e71c4302ba7155ad1cb255ca517c524cdecb95d1b3279a8e3
-
Filesize
197KB
MD5eea239110e9ce73bfa06ea0b78395a9f
SHA110e3648526b1cb05df98783510b5b4c1aa74fceb
SHA256027dadd0807c37dec16aefcd2b09718ccf9f67f96a9494be5a3c19dd2a4e52e4
SHA51274ffd284b7c602a032d3be0c0067130106c8e4e7a418e2681204931030c3618d3cbb3017c33aa3e4df8e6af77521ef9d182cb4946e835350f9f76cb334458deb
-
Filesize
197KB
MD5f98639e5cf771a285db2befc02aa61ff
SHA13c76bdf65f0952f258394e6f82b14c79726e90da
SHA25643bdb2cc4bc4759acc3ceb6522fb9dc4507e0281fb5e15ec61ef9f6ca08ef068
SHA5124bf301a3e870745f4ecc243ee01556beee903ad147c01108306e6eae9b08f8951d095c536baf72d10bffabbb33bff6cc43af6a43485dca7f1ad02db3714bfdc9
-
Filesize
197KB
MD503fb4b7c091ab5ab7429e38f41fa7162
SHA173b7bb9fa8f11ed371eff5f5a621b9bb8860f6ca
SHA256662cda5e69dd032889dcb808a645e41995fd2f9e30c82dcf3e952dbe6112d55d
SHA512f488d87398cbddce996033f2d3361487792b21c0f308b24caea7121263ecba4294109f7d39194d1ea34d38dcc19059f32c631938f38ad86c38c68ca9fd01fcde
-
Filesize
197KB
MD5418e7517cae84ceca99f5555feed5f18
SHA1556129305c512d801e56188c8d18ec5c411c29bc
SHA2569009c27d800a82aa6528b99706ace3d6318f32b63af9e7cc016131d3bf8624c1
SHA51228f20a84d3dcd86aeaf8ccf6e42f0460053f34e19d89cbb61172ef02fae49779adf35bd39b61573a5d0fbc6932ff95a33b13c2bf72620a4c3c3b2bc5b9fb0318
-
Filesize
197KB
MD562d236c961262de03d87e6f38fa6250b
SHA1a05918e5bca1de9c9863c3ced7eff40052120647
SHA256fea11a38d301254c0066f10f26392113525d643282c5cbf3a235fcd6c36ba5b8
SHA512c73f9804e56c1038896d05850f97cb2cef15cab65c8ea5edd5a9be2e20097c24f2d3cad6259d098e9ce9edca301d7de4c30d09200d897ca099f9314c3be25da5
-
Filesize
197KB
MD5d413d98ccb19f0b3011708759e029c37
SHA1e5241d572d0858a10f0c849e4fbc7c34e11248c1
SHA256cfe1fde535c356448a5ecbaed11708da50b9b86ba059a40771879f2eb7cffeeb
SHA51251d645059b949771ee9b022c2e2308e65d80791122bd95018effe17e456f0d7d55ef9b45320b3356c30cf14c1fa38e047e301d3acd6fc346fcffdeb24c8466d6
-
Filesize
197KB
MD5f83648acb7096a7c0799a1d03bcd1c74
SHA1ea04e30eab13f5b2c67ce2efd309666ebf5214e6
SHA256abd26a7504f2499d3486617b4726d1a9dd1cede6a19fdfd99dd72ac3231c4c1d
SHA51221944c3b73401eee09b14fad03639495b0994b50d53f8d7fd84d9167c00b0178ee9463586a1398c8362618c5d6dbb700ad829fa4d226e3ad3c52269585105929
-
Filesize
197KB
MD5e6551e8a648bb14b9e3718279a6c7419
SHA14fcd6b45ecfdb65ef62faa6c0bf5ef9be7d025af
SHA256f1b3073a132ea03c8561a4417c50c27667a83933a8d6d69b11358beff222737a
SHA5120b8f7dfad1da3a4885a4d37aac4baf58b941df9ed6def5b062967fd96c5502f80c93a6a4bc1d61d3eb16e52d507e0200285973f1e2a2e753beccb84e82f286cc
-
Filesize
197KB
MD56ab30b98a339c4916adc8f303ce097e2
SHA138d018d3583ee0d3b2597a9f2a31774d34f2d4dc
SHA256111d16d18d59129bd027f453c17214f42c47ee34860d23c5fc829381b29d7779
SHA5126e032a8e6e504e6b8fbd12feee00b3170249bf1efa0c7eee5e983c7870b94e552f9885231524d1c91ada6caad6cf58821a339ba778edd9a8e5af3538c534cde2
-
Filesize
197KB
MD58bdb883c45fdb991ac24de2834c923d1
SHA1c39f8be4c425f8e317c052fd22dc051e5ce7bc72
SHA256b29234202740d0a7d0754a518ba59cf8146013e36d4bb3cded9210d5e467e20d
SHA512d53bcf018b7f5a92858af0c712c8c9742bf58eb129f262b6b1d56a0745e21f60c2a7e7f83ff38393b58639bd739b5018ce00d451a63bd0860d9d99226301ddc9