Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 07:31
General
-
Target
2024-08-17_3c93b97c5852127e8b42b547b359854e_goldeneye.exe
-
Size
216KB
-
MD5
3c93b97c5852127e8b42b547b359854e
-
SHA1
b18abe54984b6479963b38339ffce2620d2c775a
-
SHA256
6337ffad33b369c6be593ff5447a76c06cf381c1625da01ba7946e399b923303
-
SHA512
c8f732d45d65df424516b1b7a1136248eea7c37e9a85cdddc84426cc32dbf095f722dd5d757bd6deae4e2559114de9ff62bbb16298e098e03fed58fd95b745ff
-
SSDEEP
3072:jEGh0oSl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGklEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_3c93b97c5852127e8b42b547b359854e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_3c93b97c5852127e8b42b547b359854e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CBBCD84-312E-41ae-824E-7C418577A7FB}.exeC:\Windows\{8CBBCD84-312E-41ae-824E-7C418577A7FB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4C79883-4ECF-4fc6-8C8C-7D08D2F1B94B}.exeC:\Windows\{C4C79883-4ECF-4fc6-8C8C-7D08D2F1B94B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E44FB7E6-AEA7-46df-9DD6-D2DE686F34B9}.exeC:\Windows\{E44FB7E6-AEA7-46df-9DD6-D2DE686F34B9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A069AB37-87B1-47df-9CD8-398574CFCCE3}.exeC:\Windows\{A069AB37-87B1-47df-9CD8-398574CFCCE3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58B19A92-E17F-4d1b-9671-0E4236C78783}.exeC:\Windows\{58B19A92-E17F-4d1b-9671-0E4236C78783}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{251BCE32-C9F4-4b74-9894-156419DAEB7A}.exeC:\Windows\{251BCE32-C9F4-4b74-9894-156419DAEB7A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E645440-21F9-4ce0-A8BF-B6B8C03C56FB}.exeC:\Windows\{6E645440-21F9-4ce0-A8BF-B6B8C03C56FB}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30F23B0A-7F2F-4d3b-A3E6-869ED847105D}.exeC:\Windows\{30F23B0A-7F2F-4d3b-A3E6-869ED847105D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EED7BFE-5F24-4bc3-980A-80C84E6BA719}.exeC:\Windows\{9EED7BFE-5F24-4bc3-980A-80C84E6BA719}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEDD766F-7218-44ff-BBCA-7A7D813CAE91}.exeC:\Windows\{AEDD766F-7218-44ff-BBCA-7A7D813CAE91}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A839DA4-5213-4db5-AE57-BC7C197CD098}.exeC:\Windows\{2A839DA4-5213-4db5-AE57-BC7C197CD098}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{64D565C8-A928-4f88-BFED-D0A3D80BC0E8}.exeC:\Windows\{64D565C8-A928-4f88-BFED-D0A3D80BC0E8}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A839~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEDD7~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EED7~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30F23~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E645~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{251BC~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58B19~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A069A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E44FB~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4C79~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CBBC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5df9421c660ec80392692c91e568567fb
SHA14f37444733a61a11d95ba7be459836c73d00323d
SHA25641c826fe5e5400ab78a7b79c2e587fad8a2ed8a6747d2ddadc3758c1b476314f
SHA51251baac5d184e4ac65149cc4113fda2ebfe393772bac45bbfe0fa8d333bbfdf523503089272576f426f82fb80dcfe4589e1e848dcb913dcf5d4853a41322f5f07
-
Filesize
216KB
MD5855240548e12cfdae5cdddf382820f73
SHA1baf595a9b6a8cb420639d2c5ee78ce9f95f92479
SHA256c00686056008b9aa0fd12d07285bd02b876acafee82f28b6c9e3fb2dcff416ee
SHA51258546916cdcbaf2a6f32504a12bfcd81c3ac2325acae5957fb23288698792c66483c645fe860a87f21c5491a63bcd2bfe177623f8309dc5509cfb0c4495247a3
-
Filesize
216KB
MD57c4d6a154cad42070ac6ea2908300526
SHA19f96035eff18c0152362fe6e6f3f9288c68579b8
SHA256260b372a7719b9e2637307b75a90a6dace9578004aa3672985424d518380be62
SHA5129da23727a9d2e6ce022cc184d0b774833480eb5259cb0a513aaae582bd48ece5cd21962554095af8716ccd5c57348a5d2ee558605b4bff012663757c09b7c963
-
Filesize
216KB
MD561bb2edd6da2a252cb31b5d3dbc8f46b
SHA1729b1b9b03b3e25135f04eb34095a8745010f4e0
SHA2569936180690d2511f175c071f1700441b4455b2d6c6e07318eb2dc698a4525277
SHA5121583351c151a2ce946914f835d1d1d3d285fb2fd2f926bdecd059c12e6f8eeb1416a2a7fbb2b9c54ea3aefc5f0c3ed1e11af9aad05414575e6924073f9e326d5
-
Filesize
216KB
MD536cc40353fb58e4cfa3225943beb3f8f
SHA187a9af872b5c4a81f4763ec426163c9966fb32c7
SHA256e57636c832b249f7f9781e0e4e4bdad94810d7ca9acf2f134edbdd78cb40381f
SHA51233fc8c951c224e9366de960dee5ceaaf7ebe36f869d7a3b6337ed80f9c8a303b757444b1fb023bfbbbb1637e49fd88c6c6821c4a3f8141d83db19341b8fe45c7
-
Filesize
216KB
MD5534fbba8ae9eeafef6db11f32da21ed4
SHA1b688f7694ded6ef3ea0f147a35bf2daa1322ebc2
SHA2563fd1cfe2a615e9fd6a9b8182b95ceb6c9d1c810796b1537b59e61fc10d26fd4f
SHA5122c589a58acf728f5a77eabd910e307c6922ce050126293a38fb040b32caddb3f1b86d5b4f24d2982bd61efc873d999c5e87d6899b9c27430e7b0061bea5f35bf
-
Filesize
216KB
MD536d2e489fe50b004f0f4a35a33012ac9
SHA1398fe28eab6c10ad2cfdc2d63e252b2546953381
SHA2569082ed5a846ada0bec8293b87ae2d60c7ebb23f1f9b829c8370b7eb9e875c27c
SHA5129a253a283db484746a740ca3903319b6021aaf43ce58b9b21f7c236aa5b4a035bfc908b03422188a7938434906112281e241f4541c36d626bbd7c254b7aa42ca
-
Filesize
216KB
MD56312e61f1ba48dfc6abf057813ccb803
SHA1a455b2dc177aec29e84da4848cb7611c7652705c
SHA25664ad68e46a57a83c38d3ffbb8fadae1c4a8f01bb12c9747189eb972ccbda6f0c
SHA512ecf0fcabfcc1311148ae3c735ade23acac1ebb2ec5412b8c9c9031d0c39773be26730257eb6542fc73ec6ecba2336677af2460fc17f4739766a8bdf08be53f8e
-
Filesize
216KB
MD5c4a18b11b3de355538b2a76dae10acf3
SHA1c266cd9c14d6eb7b0b900b66ac75170279c52095
SHA256f62063f076af2a4db3284faae3ea87f094e1145478e05378721b4af6dc8c3495
SHA5121fe056a2e68d86b267ad7b037fbfb3cef4e667e4097c31f52e06e5622573154f6249cc5dde696da2f41471b69d3255acc207f49f6f7b701ffc25fdcc7ff34bf2
-
Filesize
216KB
MD5ec3435415c898f7fdc21ce5b54c0be33
SHA1b22ae49094b7555a61e27ab29510fe44d7fcf243
SHA256d920373716b3e01c52df7dce21ef7ab68f91a35cdae837a2fcb6f11584ba82a1
SHA5126619e63cd80a35f6381e3a36454015f54528c96965169b3f97818302ad0bbddd5321e8ae18aadd5637ea8b178ac15965c1fe7790d9bd047da3d8ad280ce4c6c2
-
Filesize
216KB
MD5b34c6fe2b6a94f637f83f78a8b2ea422
SHA14e71c7fb0989ec0f58c4733a7aa06c4e01e4e6f3
SHA256356930672257e925c8e1847ee8590b51dbe511622eb6a6af04d432638e67d065
SHA5127a8b182dbcef2547e26e4f0f5ea60b5131dd4413ba5452399d5643225406001379a12d1d12ea44801425b64fb477d7af5de6274589b9fb176bcd27c0b4eee474
-
Filesize
216KB
MD539738d6b4b5eb1e61f1094933bd870a1
SHA1b40a6ac26179444fd4f038978f9d9b2166e92e9d
SHA2567a92c5934b6abfe9d6e4e157faa2d40b912608acb8bbfd73bb1c357543864eab
SHA5122da87e96b4478eb415426b8e687119d9a08d35be414f2aeafb3c6639b88ab229201ec8d19ed30534936b3bf89372cff92cc9c0276255c7e892bd3dee535d511e