Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-08-2024 02:31
General
-
Target
2024-08-10_e86336da9f846d1597e079b7e6777a28_goldeneye.exe
-
Size
168KB
-
MD5
e86336da9f846d1597e079b7e6777a28
-
SHA1
1b508ee677915a6a8a4512d1afb8ee88bacbebf9
-
SHA256
6ae0430df1a34165fb9bf25a01e183a409df962b6a9012ed10a582ec97e0420b
-
SHA512
0614bf5e6e2fc622f343149439cf6ad55ea0b4aceca4f68a2bf1b10b21683d5b32a13234e3746eff5fcefbbb871345a801165919909ce0d8238ffc8da3223b0d
-
SSDEEP
1536:1EGh0oXlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oXlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_e86336da9f846d1597e079b7e6777a28_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_e86336da9f846d1597e079b7e6777a28_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F774526-0149-45ae-A855-A86FCFB3E351}.exeC:\Windows\{8F774526-0149-45ae-A855-A86FCFB3E351}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88B48665-3743-4342-8960-58CE6C9F1FE3}.exeC:\Windows\{88B48665-3743-4342-8960-58CE6C9F1FE3}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A25CC06-6589-4978-A9B0-211111C6AE03}.exeC:\Windows\{1A25CC06-6589-4978-A9B0-211111C6AE03}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1244BDCA-1D1B-4dcb-97E3-5FFFB2BF6E25}.exeC:\Windows\{1244BDCA-1D1B-4dcb-97E3-5FFFB2BF6E25}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB1A367E-4608-48da-8484-48DE71934C8B}.exeC:\Windows\{AB1A367E-4608-48da-8484-48DE71934C8B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76A8089D-B009-4647-91CD-96988A573456}.exeC:\Windows\{76A8089D-B009-4647-91CD-96988A573456}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A24C06C-ECF0-4743-98AC-AC3CA49836F8}.exeC:\Windows\{7A24C06C-ECF0-4743-98AC-AC3CA49836F8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17D0B7E3-9DAE-4871-8DEC-4885147C6C8D}.exeC:\Windows\{17D0B7E3-9DAE-4871-8DEC-4885147C6C8D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42B605B9-0864-4d5c-B8CA-DACC78DAB40F}.exeC:\Windows\{42B605B9-0864-4d5c-B8CA-DACC78DAB40F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7F75D21-8607-447c-8739-7F8B8C0CBDBE}.exeC:\Windows\{B7F75D21-8607-447c-8739-7F8B8C0CBDBE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{976125D4-3122-4ed8-A7AC-18A12BAE4107}.exeC:\Windows\{976125D4-3122-4ed8-A7AC-18A12BAE4107}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FFEB9557-A0EC-4f4c-ADAB-0EECA1DC2F61}.exeC:\Windows\{FFEB9557-A0EC-4f4c-ADAB-0EECA1DC2F61}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97612~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7F75~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42B60~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17D0B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A24C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76A80~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB1A3~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1244B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A25C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88B48~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F774~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD56add350665de61fcc9a80a59dcdb3d43
SHA1513f42149fc1fa3afa2e98783093d698608eba71
SHA256343e8a137f4e6285372b6477bd5e2a4b31bd74b9cbc5387d38f51d01699bece3
SHA512fdcab05ea1c36b690143d3975a81c94b13b085f707e62148985e172afcedb751e9bd6544591c54a438272dfb1a38bf6b85529d509a3a9bc967066b5cfea71db7
-
Filesize
168KB
MD5ad393fc96a714b1cc6044addd2fe1d34
SHA1ebccb32f110cbf763fadc8b94c3c62e1caa4afc8
SHA2562625c45eb67edba4ba585680f71cd8b418d22833138abb811ec81730d251b99e
SHA512e7a0d02b6992d7c222e003c73653bbe30c40feb27f19145d94ed53f7d192b2b95113641ec9e5d56d8bd363bd4272002d43312d6e9b537125140e9c5ee985f07d
-
Filesize
168KB
MD5f5a80b62eea981e03f484627132eb771
SHA156f211c42f8baaa3e1526c1a434329b1538e0478
SHA2560baab68200c5e00e9d3ddd3af313a656f5ed3f107561412d5a4c114fcbe5d545
SHA5126b2097d3050328db6726c1f69859de8ac53989c17d561803df88dc5fa098cafc073f412049c197c5d53bb3d6fd998a05436daaec179578c9eeea3d3d6c23f763
-
Filesize
168KB
MD52e2cb162e6fa028bcb18f24658800dce
SHA1b9fc89880e8eb1d24bdfa8cd3d9d9022b2a082b0
SHA256e8c5839bba4df2ea0601960ec4a4971e299ab257f94d1be6dbdb964b36b7e1b7
SHA512f438c204f672b2e7668958d7a584605ae8771677e23cf5105a9857e45a8ce905f359ad33c10466d30c58955e0d20a78eccc76a8af4133f022a45e3bd271aa72e
-
Filesize
168KB
MD5f009a7629c0cd4e89f8dee0c00e734e8
SHA1235c9264ac4138f294314fe31b41e721966c5dab
SHA256f6701181edd350c9324eb9938736fcb95bb571d02a4a0a8cbdf073d47e9935d5
SHA512906e70165bc28e9ca5f52033101bd5157cbb36478e32c8e8f38f14b4c085a13a38fbb5fe5760594295912f82f67ed57defceeef5e98a13d9bb03b2cd87abdc8e
-
Filesize
168KB
MD559a8caf03bb309ccb35fe6ba2e7c9d7d
SHA140593fb4f83e626d395ea51abc86fe7ef0e6d10f
SHA256af88c5b64b2b96d1ef3dd2dcafbd21baec05e691a6c4391d51ca63b3739889fb
SHA5124022da2b94456176ce3755886ec0ca8c13979772e67ee0d1aa24c46ea595852598f12284418e84d8c7ca4dea7cf7435f2c0b37609f2d01f95a7de2fca795b336
-
Filesize
168KB
MD524542aae73ac5f6c0813287146fca587
SHA118792003f40e3bdd56c35f82aa6ac2c83c140e87
SHA256da747db5b5e397e33c51dd4bb374ddac594910667413a24e297747ee6e5ecbcc
SHA512bd3d860c4b0edf90e9ebca33ff69cfcfe1efc560590b1376829dd4cbce2dabecb2fc5e5e5b8bb329cf97e502820f863ba48dda1209c3c4deec7401b2ef3d5887
-
Filesize
168KB
MD52a0db6a663de512d8e421d14b5310803
SHA1c69432e05f42f9c699ad5218408ed450798bcf74
SHA25609ee369216ddb1071e9fd8474c949240dcad8b10762fb637b714b46121259f98
SHA512f73b81babf3276d9bc9010c98dbf38f85bdd5d72d297d933f1daee2905c69292874bddd76a0fc1399a96d7ae805244f80576797cd3716b3313940db35a13f5ff
-
Filesize
168KB
MD5007c54f0423a98fddd35f74c9192dd73
SHA1e7401ae6f3f9f9efbc3441c4ef5dbb6811523220
SHA2565eab9c162d350a2bb28676b4bbbf97e8009acafc55812e6a5222eaa620d8a229
SHA5120c80a3e279eecaa9f4d4f6b5562570ddc7a4fa112cbdfcd505e345b4c83017c0d8bae3d5db470622bb38a6fc98605b5ffd9ab0b2c856ce1766e65fd7acd015d7
-
Filesize
168KB
MD579492aeda07da33c479cc3ca4f696fdc
SHA1adac2ad445925dc8d6a062ab000cbca538bc44a7
SHA2568256f0af37930e181eb3ab161c009b0d9d0ecbc16bd61a83388c5381e8cb15c4
SHA5124a07021b7f5e8f73d81007c4aa4863ef7acc363652e8b61181771387155228d356f8a7f57a009fd0bfa9355bdbac2e5af248ed78678096f7323477f29b3a17c0
-
Filesize
168KB
MD5cb663fc0b6f3c0dc960363ed2ed296ac
SHA1314aa1c3cc1863af49cc8eb64529921bf9907faa
SHA2562ee76153e0c600e54169c5ed3d3562718ff1fe2319746d2ef4702d24e30bc983
SHA51252f5ba733770a265ecf5990456560b49eed693a1da856e79d5445281aa1be205176a25c1e715e0142d94e41df639f6ede46e980b6dc794415b215617d0f09491
-
Filesize
168KB
MD5131967283df4a8b54b6418c4a270a0c8
SHA19c4607e3250afffb12b88bafe9ff0f42efe11248
SHA256d99e749be54c0bdc51e2a658f32c8219501b53ccbe8ce47b1bc8986a4c289bcc
SHA51296748253929955cc617208b0b195976918c038a616b74d635d92413fd7b8ba34c597ababf8a86e7f73cd2d841c705c5a8de99c8269de1c71069f1f0d673d400a