Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 07:44
General
-
Target
2024-08-17_b2b8f7db566469d8c2ad233f471df308_goldeneye.exe
-
Size
216KB
-
MD5
b2b8f7db566469d8c2ad233f471df308
-
SHA1
dbee22f2c95dfd4b92b6d986070e252516339698
-
SHA256
d550d6320e73a68bab130c7589af42f113b4b290a82ace8cc56fdbbf0c49d39a
-
SHA512
869b6dd42188b7ba887287eafa3c55bf1e6ec6dbd70cf13350617703330c723a7e5122a5b09c388cfea0ae7904f03cc9aa776a0a932a7615d1bc8dc50621f9f6
-
SSDEEP
3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG9lEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_b2b8f7db566469d8c2ad233f471df308_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_b2b8f7db566469d8c2ad233f471df308_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45D29A2D-9347-4baa-B75B-BE933B0CF620}.exeC:\Windows\{45D29A2D-9347-4baa-B75B-BE933B0CF620}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4EF202A-4CCD-4ac7-A875-054ACD1D335B}.exeC:\Windows\{A4EF202A-4CCD-4ac7-A875-054ACD1D335B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D40528A6-1C53-45d8-AA20-5FC4D517FE7F}.exeC:\Windows\{D40528A6-1C53-45d8-AA20-5FC4D517FE7F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4E2203B-4C65-4560-807D-41F1F4503CE6}.exeC:\Windows\{C4E2203B-4C65-4560-807D-41F1F4503CE6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19BC6F5C-4CDF-487f-87E6-2ABC52E6A461}.exeC:\Windows\{19BC6F5C-4CDF-487f-87E6-2ABC52E6A461}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FECB5570-3110-4477-A8EB-6D4EFF4BB3CA}.exeC:\Windows\{FECB5570-3110-4477-A8EB-6D4EFF4BB3CA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0591C59-7A9D-4d29-8996-0768BE1AF30A}.exeC:\Windows\{E0591C59-7A9D-4d29-8996-0768BE1AF30A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2E8D221-FF56-4d7d-8A42-5ED22947ED7E}.exeC:\Windows\{E2E8D221-FF56-4d7d-8A42-5ED22947ED7E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AFC9628-310B-4852-8CE4-671EAFD777E3}.exeC:\Windows\{8AFC9628-310B-4852-8CE4-671EAFD777E3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C6F57FD-C8E7-458e-A9A1-FF4A8FADD88F}.exeC:\Windows\{4C6F57FD-C8E7-458e-A9A1-FF4A8FADD88F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29EBDEBC-82C2-4047-980A-9CE8A266A17F}.exeC:\Windows\{29EBDEBC-82C2-4047-980A-9CE8A266A17F}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F5E69B61-C87E-4871-BC31-60826780E870}.exeC:\Windows\{F5E69B61-C87E-4871-BC31-60826780E870}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29EBD~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C6F5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AFC9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2E8D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0591~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FECB5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19BC6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4E22~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4052~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4EF2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45D29~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5aa425e571e5c0c533f90994ff917354e
SHA1fb5f950dfe4e76336245ef34cd7e31677b48332a
SHA256687b820daab9368cee31e960f655cd679df8ddbd2829f22ea50e2640f2343f9c
SHA51298a97bb62d1f7b983a5a3ff501da6456bed485446004b5f08812ca0b369473f9bf8309b5ccbd2c89ad89d28559f87c9e92497e9b12ab378662157e87a429f37e
-
Filesize
216KB
MD534350d057e48c514848515eb858a152d
SHA138195e8d105f03a198eee6508a103aad71b2042c
SHA256d37b12ed72d58e13710471e7714f56406ee4d3f50810a8e58fae006ed3598ed2
SHA512939eebedb30cfe16be1a3822dca076fb57621b76c6dd3cb2b2b521fba84f53a787501581d33a818791f5f88429c5653ee97e059140531507523ae6da079a649b
-
Filesize
216KB
MD5492c8012156e3980cb6248376e56d872
SHA175644a11f4fbf73e87024f30a11e7af115770cfb
SHA256ba595b20caace6f3f2f3eaee926a52dd2ccd7fa5f790256f6b15725e349292d9
SHA51210a2e32ebb6d312146c9c4bb31d7bf51479722b89a152c1c808daac236124ad0af021fcc0fc211d569a319db749987ec93406203e3906a80aa5681ffc53557ed
-
Filesize
216KB
MD5b9bd0fed15d0ff731f51117a0a318bde
SHA142c5f1f1df74e1fc6641c1c9c2890a63937bb20a
SHA2568d3dd869e28dc7b6375e75b65f43a85e56abf52d5f5ab1c5d402846865358a86
SHA5127d7f7e6ff57a0e7865ea7036bf0fb47d81ecc573584fcfc364a05b413b6ae83f219978851701917143cbfcc0a0ae3cc3d3c2d8a206e1cd164e479707e5a3dcbd
-
Filesize
216KB
MD582d156c64ed7656e3c1f7df3edd160fc
SHA1ab18e8128725372d28a34b7b430fa551f4c1382b
SHA256a67fecf2bc9f9471e299feacb2e28fe849e5cd0156719ce5852420c85e115bdc
SHA512e1a0928781643a8987665dd3297fca663d7484900bd52316443b3bee3340302adc541eeb7d4e09ee4f4610f536a00168a4daccc93d42f2fba8ee0e975c2a5d78
-
Filesize
216KB
MD5a455ee60bd055acc75751c05345a2134
SHA12d810954580b027f3274fbb3de22fcabb332161b
SHA256fe8279dcdf21ef597152dfc39aee44669668304eed874bb5bfbd76f6017ebcc8
SHA512f99961b30e6d1ff9bde847713663e05ff112127c185614109a3ce558648af3a39d3fe8f06498c8eacdbf86e2e0c7772762d34cf6e3a44c892db167ff93dfe9a1
-
Filesize
216KB
MD57042c24448eff08173e5bd4c16ab4029
SHA17c27ff379de97863cb19f3089b2a2244476f65bb
SHA2565d152a8bf3ed0eb626ffe53aca59914ee00bc2a18b4c9f0723e1ea971f8d5332
SHA5129080051570b8ba9d4c219f5790cf932d821a7c72d84ef0520927de5606e715203cf35d32e3a4306e8c3f86fa764dae4cddc249e407d33ac0a71ba4ad102f29a1
-
Filesize
216KB
MD5fe39bf06f0953209a3d9a2b18c94b7e2
SHA1884f7310c3d43a450a225b48329556e8af91c189
SHA2566d1cc03ce084d9773c3809b3b5bc5d93dae167f8874bb8ff4e70044a3273b58d
SHA5128dd981e1ad8aee1898be238cd05d3daf20c6baced78e18e4bff61542f22c0c510c7592dbda6d26d46e723e3b385521cb9f3162cbcd207c05aefd053158513ed0
-
Filesize
216KB
MD5046ca4d2984721157fb946fba3ae33b7
SHA145fe280c68c6f37a504c0b16f550741fbe034185
SHA2568b91c202a6043bb6f5fd5ffbe2e3540222b2c03beda4fd1ac333938a585ed4f6
SHA512c70a68856f136b900335b1880fdcd45e8574771fb2229a3c20dfd0def5099fb324c5d0781afeb82186f2205351ea7a435e64f860dc826d10d164e3ec97f43d91
-
Filesize
216KB
MD591d539c40016c8c836f695828275aa9d
SHA1f4042700863518276e6323bc576a4e2fd3310ee8
SHA256560944386baf30d502d54b4ee5bcf81acaa85d0cb64481322582c0c1fe05b9a4
SHA512a6f554f29677404b078f06610e1310ec87b3686ca684dcbc2253df5ba1638ce5014126d1ed023ddfe4843f441a78b0662fb180c06de3dc541e20ec9b97a17077
-
Filesize
216KB
MD5499c978b45274a3a646e2cd211941073
SHA1f1c259f1045c58e6c8abbf8b0adc5029b6fe7271
SHA2566fba854eb6371c0a2ee6245c6af5239238cdbf4c68c2bc2f729efa08694447e6
SHA512d6f55257c1b1c2227f116fd629a7378eb983c4f324cc587b8e03f5e4507089c4bd1c08f8ad7071b46ea7b130d29970ad464d7c2c5c956db9fe3c26cda2a86567
-
Filesize
216KB
MD50a55012b5c2cca9bc93eb489409ca7e6
SHA163271f6d4388b1d49525a587e806c94adf7998ef
SHA2565673aef490d718d8e691bd0259ad07560909560a52e8e1bd81aa50bc0c8e4813
SHA512b29e82fbda85877cb6f53fe1deb8a58605095be77fe82a8c2589231da5a6bcc1bd5425a45526a23cbf7d488780aa429866423af2028aa87531ac7eda3c8d1fb1