Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-08-2024 10:27
General
-
Target
2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe
-
Size
344KB
-
MD5
11bcad7c984f0d68447b017b2ffa67e1
-
SHA1
0da1708a903a2197d4e42bd8d2f6a4cc0bc3e100
-
SHA256
08f5acbab5ea7f6ca3d94ec0dec08788c099426c60968574dad54b7e8f817c41
-
SHA512
03b4808893562b52d9865912dd0c9392f285c9ccef9deeeb2c1c7ddee4ea09d15f102c905902190f7db9d90d22b6214b5ef54be4ddd3264616a990a66e71f280
-
SSDEEP
3072:mEGh0oclEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_11bcad7c984f0d68447b017b2ffa67e1_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE4F8353-A446-4a37-81C1-7DF140CC1A26}.exeC:\Windows\{BE4F8353-A446-4a37-81C1-7DF140CC1A26}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{509879B6-B490-4b56-AF12-0313639341FA}.exeC:\Windows\{509879B6-B490-4b56-AF12-0313639341FA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3481A4C4-7C9C-4442-8DFE-0B79E82C2430}.exeC:\Windows\{3481A4C4-7C9C-4442-8DFE-0B79E82C2430}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C34772F3-16A4-4a4f-B8F6-675E75543282}.exeC:\Windows\{C34772F3-16A4-4a4f-B8F6-675E75543282}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA8E2E1B-3ADC-4b78-AC7D-444F33B45D75}.exeC:\Windows\{AA8E2E1B-3ADC-4b78-AC7D-444F33B45D75}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E0B4C41-B792-4b9a-8842-A35E3B6907E7}.exeC:\Windows\{7E0B4C41-B792-4b9a-8842-A35E3B6907E7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77B644A3-EC74-42cf-AF5C-CD5486B0EB30}.exeC:\Windows\{77B644A3-EC74-42cf-AF5C-CD5486B0EB30}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02C2578B-365B-40a3-94A0-AB44D1C7E084}.exeC:\Windows\{02C2578B-365B-40a3-94A0-AB44D1C7E084}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D8FD87C-9442-4e44-AD1C-04A9D88667F5}.exeC:\Windows\{1D8FD87C-9442-4e44-AD1C-04A9D88667F5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{607F6F99-EF92-4497-B7C5-72F26B128BF1}.exeC:\Windows\{607F6F99-EF92-4497-B7C5-72F26B128BF1}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66A83C67-2BCC-4c71-836E-57C09A57B653}.exeC:\Windows\{66A83C67-2BCC-4c71-836E-57C09A57B653}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9C5B7B13-76C9-4436-AC03-8745E5739E92}.exeC:\Windows\{9C5B7B13-76C9-4436-AC03-8745E5739E92}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66A83~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{607F6~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D8FD~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02C25~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77B64~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E0B4~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA8E2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3477~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3481A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50987~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE4F8~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5c9d430d5cfadfe91a3256766d3acee14
SHA126ed34d7189047ad23136dc16275b804cf46e04c
SHA2567901a3ff944be83f4f9186aa29616b617282aa0f46a434d567903e0b7fc27713
SHA5124452058841187960f89ca3537df08337cebf4ab3a990fa97ca717d1ab51f246b2bb1882df6c868824366aeb0d991a3b92a096e1f42270aed6472b2d093132145
-
Filesize
344KB
MD5fbf41a5807063ced60cb3374229df92f
SHA198b4607e9ce3a241c47c5d62440694c5b0429408
SHA256f0fce192205e9992f95201d8b392eb89314fd447af01c1b347106139671fdbf3
SHA51263bda49ac9d0740c3c00b1d7a34a5966a3a610fd2c217c2764d4ca3edaf676ded31e4f45b4987dcd31ab95bd72fa35210587b002d5fca0834228abd725038f60
-
Filesize
344KB
MD5fc2808ffd29fa4c10b3f667f37808987
SHA1f90693bf5760fef78c4038022a8671a49d18670c
SHA256f99bb6fdeea2cc97a2c500e4c115726b42b26625bc36c478d654e13a9cd609eb
SHA512098d5bfd3a5f6762c21568cf78aaeb0cefc70e95d586064ce1d64c9c1420e23824e70b99aa4a63b4914c205140225da31f0058717f01fa27a2d13bd956187356
-
Filesize
344KB
MD5c11a36b36c88a21a4b453a3a1ce3595f
SHA1c5a769d8bd7f45cfd5073082d2b0083d45981a13
SHA25668951004550aaf89304a3cd4c80a42f52d9d4d7a923c0b227fdfc2aeb0161373
SHA512c9e3b10759fc3556d71b7c03fc5ef3a14a4a8debed0caaf2ed7a842fc60e69060c844fbdc7b2c63ae10553d5b090caa385d864ca52be4b779fd69344ab41c6ea
-
Filesize
344KB
MD5cb5d0b1ae6f190513121ff018a6401a1
SHA11e7e619f5568ef2da329f32844e41331c32f2d03
SHA256f02a75d0b20602bb39dfec277fc1e317384bd6f017ff9053bfc2a2bfed39f73b
SHA5127dccfa75fcc0a2fae6ae0b625ed856e6163ab724c22ea85965fc130f761503266912bbf63a4f0be146459f49284087050ac5b8689aad08f044589a76ef42c754
-
Filesize
344KB
MD577509be781957ed01085260a97340301
SHA1274c490e23270f29e41293eca7103cb48717ffdf
SHA256355d92e3111a50e8128d61af0de4f09b5b4db5c215cb6151733ca66d967a2abc
SHA512088f10bba3e12d1d02262e465e6d59163695ad632d3c97a99b74fc8bef966391dd71b3158e8676c132079f46aa872763cedc9e7826b9e87647b2045c9d50469c
-
Filesize
344KB
MD54bda10d8a8f552178ca158ae883edc51
SHA17fa8edc04d307d52d279c92efca8688e8fc6833d
SHA2563cd27b24f508a5aa0d1146c11cce4b8590cea6015b2e16babfe361f78a243d26
SHA512819b6cc0dc89b3117096fb2506f69022a1e89ab9059d6ce78ecfb9ffda25ce5f0dc3daa4d08ae0899c2df9fa257d30a338936b9b27a0166c921d22a3bf92fe0a
-
Filesize
344KB
MD5b526a1fc03a1ceead6536e82216bffe8
SHA17f7b0ebfa0462bba821026354b7f49f0d0c6595b
SHA2563bcd4f18266f94a0a5417ad082c2d0b49074aa8190c84f83c1409c5e1cfb853b
SHA512b9119c654a84dbf4d698c117a946a760a4446cb614e0b1e35040ef8eb3a19b0de9e1d2839e029b0e3ac795296fbfafc2026cbb8caa320f7c9479175fcadcec2e
-
Filesize
344KB
MD59e631d4e341c87a7f2e65b1bebef092d
SHA1d0c69ba4d2ebe7b1e7f151965df1ae8c143a6899
SHA256adb2b00d717b8a34df510116718a507042f02e69f15dad5e340c065aed0dc21e
SHA512d490bcbc67b819479ea4e73305f059819f292575610f496a9cb1e76caf144445f9abcdd08d20a595759de6013c4f1e90a7cec1bac55f87dee8ffd4c67badef48
-
Filesize
344KB
MD5ad74ab632f04f21c58678003a8429502
SHA12e2336a24a51d8394d68b38d955519e824198816
SHA2566c06a86b0ae1a89862d76619879cbf26e318e711da8b874bac0d8636f4b58f2d
SHA5126f17fa6d2abd6a07c7cdcd7a8a689b610fca2fd7a11d7b2151940b3e1f971cbcab46f5e4b043e41400e13c29c331150bbccb60663ee74415c7003ddc87a52a25
-
Filesize
344KB
MD5df32589e94a3d1a2c7f7584c7f6872fc
SHA1a837fba3d86d71be3c70e3108bdf01415c1d424e
SHA256185dc5f762847be36a4442149d731f1d981199a48bbb06903acfdf9032357727
SHA5127a21797a463fa66bc5cfb53112ba5af5bfc9f9b72466d3cf8760adc44432b3bea48a00178530705a267a1642aa5d75774738884e2f5698f91c7e9e379d0727dc
-
Filesize
344KB
MD5bcc12f7e70491b771328e92733d5f9d5
SHA1a704c066da684bbf8afd8aa88c1bca4a97186834
SHA256675d0c5d8c405be37760cc88587508e628f58170ccfb059cf35187baae1bd204
SHA512b8772bdaed03458430cad8ccf24ac880b2adee5a024b5e13d51364b9c4ceeefb87dc3b4a9079b3cb405476e9557ff8ba2a4e01ec5d4788ba29cab61ce567c6fa