Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-08-2024 14:01
General
-
Target
2024-08-11_33ca5e1f6b97a77bd6f9d90661951069_goldeneye.exe
-
Size
216KB
-
MD5
33ca5e1f6b97a77bd6f9d90661951069
-
SHA1
c1432a95b95dfc2bb2d9751e6b6d76057f5e327c
-
SHA256
d9c02025ebe03290920a94c7a40af419950e6184d75555e8024b19ed28eea394
-
SHA512
490e7bfac1ed61e108e8d9deafaa98f6f41b4eaed3b9dfb9020eb048b4318165b62da56efbc42f91f3c7447524da4fffa5a126c058bcc3a76486fedfc734b349
-
SSDEEP
3072:jEGh0o7l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGRlEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-11_33ca5e1f6b97a77bd6f9d90661951069_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-11_33ca5e1f6b97a77bd6f9d90661951069_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2D036DB-B0EB-468b-A53C-FDE468ABA2E7}.exeC:\Windows\{E2D036DB-B0EB-468b-A53C-FDE468ABA2E7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A14AE13-827A-4fcb-9A79-70B97C27A19D}.exeC:\Windows\{1A14AE13-827A-4fcb-9A79-70B97C27A19D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{611F9104-C173-4114-B3CF-C1600ACA56D7}.exeC:\Windows\{611F9104-C173-4114-B3CF-C1600ACA56D7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AE6A76C-4D49-4f97-BD2D-5A688A1EB38C}.exeC:\Windows\{1AE6A76C-4D49-4f97-BD2D-5A688A1EB38C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{370DE13E-58D6-4e22-8CA1-E9D610174158}.exeC:\Windows\{370DE13E-58D6-4e22-8CA1-E9D610174158}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EB43FA4-43B9-4c57-BD7B-622A504F91E5}.exeC:\Windows\{7EB43FA4-43B9-4c57-BD7B-622A504F91E5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29A9609E-A7D8-4010-92D3-4DE299083821}.exeC:\Windows\{29A9609E-A7D8-4010-92D3-4DE299083821}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E956E73B-717A-4f3f-A6D2-58F7A87D7866}.exeC:\Windows\{E956E73B-717A-4f3f-A6D2-58F7A87D7866}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D07FEA3-CB63-45b8-8914-5B70A31D2A20}.exeC:\Windows\{0D07FEA3-CB63-45b8-8914-5B70A31D2A20}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1842E778-7489-4f32-8EFD-CA6FEAC912D0}.exeC:\Windows\{1842E778-7489-4f32-8EFD-CA6FEAC912D0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F476C98F-14EE-44ce-BBC5-986C9548E322}.exeC:\Windows\{F476C98F-14EE-44ce-BBC5-986C9548E322}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{91948E2D-F93C-40c0-A044-B67AF6B3239E}.exeC:\Windows\{91948E2D-F93C-40c0-A044-B67AF6B3239E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F476C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1842E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D07F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E956E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29A96~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EB43~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{370DE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AE6A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{611F9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A14A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2D03~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD513ce485c08460bcd5a2d9d316582250c
SHA149e7feca581967beae35fe625b307d83e27da779
SHA2561d98647572f7c2a5c8ff8d7bab7491957ca93e086055930ff6de73b847bfef2b
SHA512934bd643124ec651c9ea47e130572de70f77401551d6a2536d3edef8be5fffa865e509b679664fd4c3dfe0f2637ae0758106693e4ce4ea1324d437596ceab4c0
-
Filesize
216KB
MD58ba413073357fe0f173206fedc5e6bd8
SHA19ecc8f0ff96309638e319b82814abd187c6b55b1
SHA256e4af1fdcc1a787d9ab0f8d0381356bfaed92d78c8e0284dc8facf6d0cb453679
SHA512c738e205accd7b8d602d7ed2375de02cea341dd9ec7c08b444a3267bcf74d2e8d7c80c7216a47529ec8e9ec68e04e6bf0947d2d122b5d1f7b8d8dfe9f45bf525
-
Filesize
216KB
MD5a74183b0c1c4d939348a308000742817
SHA1d6e89051998f18dd8d9dccd86b9933a4efa3db9b
SHA2562a623dcee6f97e17924fa8d538d3953ca45a9e05cb3cd6fc8e0331f5652a35d4
SHA51290c815361b22fc61ecdf4afb8ce231bdee65496eb0050b6004296780ccabca74341ff24a5ddd0723ac345476f2ba2df6e6cba9abb2b4cbc0e20b62540b5f094a
-
Filesize
216KB
MD571b7fdbfa41dbe4a7f3ab89714294834
SHA1b7b66567b29f5f67bb42a6bec9d1e0a56e33ea0e
SHA256055e8677d64ec3c669719ae5fd899f51324a1dd49677e11262e72b2497e935b5
SHA512a14ef376e5bd500de6221e753569a28c5b4447f280a09f720a291394b8a89a5ea75a492fc48ed67a5d3bc24b2554fbd8f41b791a315b11f83e0bc29f3a54c3dc
-
Filesize
216KB
MD5617261f6726ac7b83d2e1b776d0568d5
SHA10870709bee25e9a29b1914a492d7da56b6b75ab7
SHA256e2e955845c3c204216880fd5d7f1fa4f719e3521198e1a059e54580e510ef4f4
SHA5127e7e1343388fff133fd5f0401c0b61db7f5bdc804cc8de6b8d354ca8ab64c80565eb4750d0130ca8d993fa2c75ce66afa001d9662af980e5c058525f49ffdbf3
-
Filesize
216KB
MD55fed182a07c8c94d8713ccfdc93cb822
SHA18ba61e27bf9457769853148863293b939cfffa07
SHA2563d9b897986ba0d707be6cdb507afdfda9dd3ecbbca8c08ac048329672030e462
SHA512326b8d3d6a1557f99423ec16e569bdb4114f747ff1d1df777075e1f36bf70f44ded7af26c6341751da4418136dc1dda2812a8f7f2d7be0d37e1bd73adc9e830d
-
Filesize
216KB
MD5a4f1958fffbb9ab9c591d42be8b8992d
SHA15270b6c53f32418c3aa5cf2a8acd03cf756ac5b7
SHA256624f142d7cf84ccf87a40d75fdcf5b5592111bd29cc92f167588f7a629e18458
SHA512e5a2627dda175ebb4dd7fae59adf52d0db1559600bc25e08795a70bd91e1b9964e81e5d215b98d878bb61557de4c3455cf19c7a13cc3d05a0c03f127c6379718
-
Filesize
216KB
MD572ab734f2ae7f269feed08aacf39fe63
SHA18743b52b2a2c3922bc6aa7c95a6b9062d9511d28
SHA2565eb2f4c9d669a0bf3d64882e59d0cdcfdb7a8dd44d3edc517f96db0f694b51c9
SHA51263123049f9cbaafafc6185f8653589e58b6238e96164286ef6047d262870e012770eabbbc7bde5a0db01a875ab18f2cdffd9514fcc3e952ec09265c931033862
-
Filesize
216KB
MD5d3ebad5d5e11e2f208879816317e857a
SHA12e75c97841d35e8d7910000cbe239612170b16e1
SHA2561eea5fee2d08489559eafef1b3011f2733d157b4b64f3297285d80c67c11160b
SHA512f0948aceb993d6caf10350b56e143adf340afa0610be848d6e32c7c57732a409b15ee929ae4e592e477451268d625ea9e6f9d316ea01da95c5f7eefdbe71ba2a
-
Filesize
216KB
MD5592cefa7933138712371f945aefb67a4
SHA16a77f2530bb5cd87837de37a60c114bd528c10bc
SHA2562d32a8c811b22352d0e31e57be41ef44ee7aad1e9abf3a6d4344dd796b0e7dd7
SHA512e3b6a073d28b0099bb11b84a624990b720e255288624e6430a54b020b87560c8ade497a81bf0fefc9e57a1755482829690490aa4d37fc5dc176fb917e9945854
-
Filesize
216KB
MD57a66cb030badd909e33576518a5d4bd8
SHA1c82a74d14fd12bed8b029da91cfd3e7b4c33eb84
SHA25660103e157701f4d8c94c5efb0939d99d9799fc5fce351ecae17146eda434f6c7
SHA512a4f0b2d4237675ebe9addf42ad0e7c686ca478333e02688430153785bd15a28336c85e28b4e8e26decfdec9f0030256ae6e1111b02dafe18dd1589e3d1babb2c
-
Filesize
216KB
MD59d78caa48f2700f27e54bbe32ba077f5
SHA1d1cce5c6e2bbab69c5c9b75b4c4749b1d5b522c4
SHA256fa06d397b6c5d8a5bac9a4cca442f3be59324e3ff03abee03f13742e76e26580
SHA5121f3d11fbd693ac0cebc27c7f9bbb6a5131015eb87cd1ef81865df476f2e4ecd35c1af0d260f8ed3ddfacc70f825ee738b4559537de6cf681fe9be97ee74ed3a2