Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 08:42
General
-
Target
2024-08-17_7e14f1094e801b01ed01ca1aafbaaaa7_goldeneye.exe
-
Size
372KB
-
MD5
7e14f1094e801b01ed01ca1aafbaaaa7
-
SHA1
31d033b04519e5eec22e18c6b9efc97e7e3a0c9f
-
SHA256
4fc8c9ad0b12de21d35e20382335f01f45045e132fc7f1cb7003a95c9e65e60e
-
SHA512
a2d712e488c5d59ad9fc2ba411d36421ba25e76bb2adc854a83ac281b50cae6c2a09a43c6c70e9ac9fb2abe39cb92d694c30650dc4d5af771289d346a369a34a
-
SSDEEP
3072:CEGh0oamlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGNl/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_7e14f1094e801b01ed01ca1aafbaaaa7_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_7e14f1094e801b01ed01ca1aafbaaaa7_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BFF9EB0-430E-4ff0-BC38-0FADCFF07263}.exeC:\Windows\{7BFF9EB0-430E-4ff0-BC38-0FADCFF07263}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93BB7B74-4177-4ee9-AA07-6F7C3DE9DB64}.exeC:\Windows\{93BB7B74-4177-4ee9-AA07-6F7C3DE9DB64}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E9EC06A-E26F-45cb-8527-6DEBE7C9B232}.exeC:\Windows\{5E9EC06A-E26F-45cb-8527-6DEBE7C9B232}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D924DF34-117D-4d79-A25C-67E9C7313EDD}.exeC:\Windows\{D924DF34-117D-4d79-A25C-67E9C7313EDD}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F1EE03F-2431-438a-956B-F8254F3328E6}.exeC:\Windows\{5F1EE03F-2431-438a-956B-F8254F3328E6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{976DD607-EE35-436b-AC9D-AE4F0E1E4A40}.exeC:\Windows\{976DD607-EE35-436b-AC9D-AE4F0E1E4A40}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECA9669F-8A1B-4212-8411-4A384E4A2E2F}.exeC:\Windows\{ECA9669F-8A1B-4212-8411-4A384E4A2E2F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{401A14C1-F153-459b-87B7-F848DCA23A6A}.exeC:\Windows\{401A14C1-F153-459b-87B7-F848DCA23A6A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51245DBC-4EEF-4ca8-811F-D74D98860006}.exeC:\Windows\{51245DBC-4EEF-4ca8-811F-D74D98860006}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC14F464-99F1-4a99-A2AA-01F4791E8277}.exeC:\Windows\{EC14F464-99F1-4a99-A2AA-01F4791E8277}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1C5F12C-E877-4617-98AB-6C433344DDAE}.exeC:\Windows\{A1C5F12C-E877-4617-98AB-6C433344DDAE}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{932D2EA5-4DA2-4e2e-87AC-B69F63854E58}.exeC:\Windows\{932D2EA5-4DA2-4e2e-87AC-B69F63854E58}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1C5F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC14F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51245~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{401A1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECA96~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{976DD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F1EE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D924D~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E9EC~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93BB7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BFF9~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5fbc2d188332d99e4d768b07370fc3445
SHA1c380b3edf7020ba99fe1f2829aaa97c9b983241c
SHA25627b8b35bb0deb6b99b86c499a841bda9f628862049035f3cce490da11cb25c6d
SHA51270f9c035c1cd3ae06c7a169fe20e0b00fb59b0c253f473217a40fcd190afabf6d665024bcfd047091664c98543fe8429fbb8c123f65e8c35258928874a3f727c
-
Filesize
372KB
MD5e2cc811763af4c53bb79dbccd0e3f367
SHA13411d2b4bf511fc2fb5a5b485bb327dd0bcbad96
SHA25667fb021e8ac618cb325a7d75bbde9d82dbbf873d55202f28b4da3f7a94acda19
SHA5129008ea165191cb38c9a118b3c04882c28146491c389298f096c4d8a7423da926d5aad0dbdf4725b3abcf1157616de8252a5508dae703b016ae0c8ff362f8ab84
-
Filesize
372KB
MD56a14583da0109094fd669da6e47fac7b
SHA13d89859866900022a00b4d9a82ba82d40dc480ef
SHA256f2de5ad06c43c6cc4ceb58217b546cc5fec44e64502ccd381dc86b92162da04a
SHA51259bdd3e2ce1a53c931397b87974ce94f9cbfa7c5114409d4935f8286cb374ea7fffedb5e48cb3b4e44b0585c29040aa22aa910bf2cfb9430c95ca1338e318769
-
Filesize
372KB
MD5caaf7594fca934bb01ba2a1cdd3bc0c4
SHA1c05b907415d1d45427c0e216a080d6b256b5fef1
SHA2568193ec2eb2321ad78eae9be2254d8888f7c8e94beef56ae2978174bca097f6ea
SHA512d560c1269127f4fa3ace223c0e3e0a1de23a97db0e3e46562048cb564c0d62b44d6ac358f58659756f2679e6c9b67bf3003f73f02b278404cd34353878d7b6f6
-
Filesize
372KB
MD5dbe616806807e5b64549f014754da7b4
SHA105dbec3e934c8eb0102ecf660b29788a73959397
SHA2563dbcf63f9968a1aa9912ebf348a7d6be4fc49f4ebffa07b199f2cb394f5026af
SHA512334986afa9811ef28f5a0274093f16113080be58799410b17fd2e8413e175d30746415d39a786ce3412c9d6358bd9d63d78746e31f381183d105aeb92e26b311
-
Filesize
372KB
MD55a03f6c337c1d231a76e9f81b5f91f03
SHA1cd1f31171ef1f34a70d0a76b93f1139e223ccc68
SHA25603f1fe7440416021212408414a36aac08bf7ae1ecdd58b100f1efd9fb09b3fbc
SHA512492a4a2a1e580f679a92e382bab9cbf7958f8cb8ce6cc7bc37c52898e441ab40b4f2cad332ae7af5f2f6a1bce5cb7308c036f861196b8c0b9790d3a66fac4e88
-
Filesize
372KB
MD5d7d3c738cbac62c236b537172bb2e82d
SHA1fc9e7e9af99366d70b8cbab8cfd7e91900de7246
SHA2567d402a1f9010f47385fe163aabaf9525287b9776f8a4e1e0099bd39bbfa7cb87
SHA51220462c1908a65ff1f6b504dd879806329664a0d50ccbc09ba02e9042d09736099d2032c5727282f907473f0d0e4993c7d2d2ad5765d4f1858d76b5e42187c85c
-
Filesize
372KB
MD51e73192d7149b77265b2d6062541f9d7
SHA121a7521e9fab4d57a1bcf1c23e386fcc6a034c51
SHA25633d3d8608164e9cd6d8e2d3f4bfcccc76ca1b17ebbb223dc5b11e3b2019e233d
SHA512aaaee46eb1b820813bc579e429e760510c44bd5c4f4590c1440d28aef3f1f6ff0d154a35a94dea2676eb7b2129fa8a4134492b1f3e29abf569e550ded537ef6c
-
Filesize
372KB
MD57d95ac48cb99faeb0e3d9b4ffe290320
SHA1fdf72191c7ff5856721d145e0ab9884856480fc9
SHA256b5b1b002a9bb0df7b0fe63f98d40cfa46648e650ae831409c3768bd23a766a3c
SHA512c135dcbdda6f4d63b0111cbc8b45c3995c8d9fd590a483550acbc4795be61b97e9ca5e9717220a88f0fede9a86cf83902ebd4b72ffb7f411034a0212bbc2fd7d
-
Filesize
372KB
MD5857aa24166c6236ec44ef77831c1c8e8
SHA15ef75d178bc3ef24745c3c333bc56ae675b9a7d6
SHA2563325c46b141d89aead7a71c74903dc739f7a59813b1a68186eea6b94b89a9835
SHA512b5e5dcf0d524c6e3bdf26a5e63ac5e3a0a22ce927dc21bad4057151a5b2f1eab99a71625f233539c8cf887550670f5d529e71e860508f66647996429143b43d7
-
Filesize
372KB
MD5b8613ddf456479399b5e48fefa59d3bb
SHA10d6d6cd8cbb51e2ccfbad1fe49568ffbfbe11563
SHA2569fb303e5a1456232cd0e3f5580e34b0f40722ab84edda797bf171ad0bbca0dd3
SHA5123c5473242072f46b18d3fd6ef4c6f7556f0a6cab580b7adc6ef468208bda882c0d6762cb18351820af5d8a668fedb7402af5185f7a42b12300a462e225689d95
-
Filesize
372KB
MD5cde0a5e3ab8ce6409e42656271bdcaeb
SHA1ee770c60f095c734e73b05960502210c055a74a7
SHA25688d822a509f39361580d49c7d708d8217bbf1d581799bd314883a8f08a98f1b4
SHA512db592a76383950d9deb4eeb3d555e2277a86c025503a7de1a468b5fce136da4de17d9d5d36905be8b3c365abe9ab6d75dd994859b8030786df26d5b6cc2458ba