Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 06:18
General
-
Target
2024-08-23_8f85011dbac1adfd8c4ad92fb657a78d_goldeneye.exe
-
Size
216KB
-
MD5
8f85011dbac1adfd8c4ad92fb657a78d
-
SHA1
de15e697eae8416a29bc0a31b94e238872dc19fa
-
SHA256
34efbb5a5a0f580470d72aafd6a5b5bb3921fd6c192ad2b492b87fe49df8b238
-
SHA512
30eeb153e8d8501c66557b5a0a065b857ff845741b8a0df9189665ef01c7d81cdbbd999dcb4f808d045534e6b9b5f49579ea9f6001bd86373ee6ff005b0181ae
-
SSDEEP
3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGglEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-23_8f85011dbac1adfd8c4ad92fb657a78d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-23_8f85011dbac1adfd8c4ad92fb657a78d_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D32EDBB-7277-4979-A0FA-493C3BA744D6}.exeC:\Windows\{0D32EDBB-7277-4979-A0FA-493C3BA744D6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B862865-F68F-4ee5-820E-196025283BC8}.exeC:\Windows\{0B862865-F68F-4ee5-820E-196025283BC8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92E640CD-D648-4ba8-A525-D9568C6E523D}.exeC:\Windows\{92E640CD-D648-4ba8-A525-D9568C6E523D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FD61844-D491-4111-B10E-24F558C5CCA3}.exeC:\Windows\{2FD61844-D491-4111-B10E-24F558C5CCA3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64C0BA19-2C62-4cfe-BFB7-2746DAD9D5BA}.exeC:\Windows\{64C0BA19-2C62-4cfe-BFB7-2746DAD9D5BA}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67C6D6D7-1310-4742-B212-DDAFA3091777}.exeC:\Windows\{67C6D6D7-1310-4742-B212-DDAFA3091777}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37DA2AAA-472A-469f-8F7D-92D2D870D657}.exeC:\Windows\{37DA2AAA-472A-469f-8F7D-92D2D870D657}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37D8B1CC-3572-4dfc-A91B-0A4A31392915}.exeC:\Windows\{37D8B1CC-3572-4dfc-A91B-0A4A31392915}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC8B3223-EA49-4409-A682-EDC49D2070FC}.exeC:\Windows\{FC8B3223-EA49-4409-A682-EDC49D2070FC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39F9D508-2269-4b5e-8030-B0E00D72217B}.exeC:\Windows\{39F9D508-2269-4b5e-8030-B0E00D72217B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F60877FB-BFF7-4959-B54E-B4E3C61E3560}.exeC:\Windows\{F60877FB-BFF7-4959-B54E-B4E3C61E3560}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{BE13FB15-878E-4f96-A9B6-507E1565CEB6}.exeC:\Windows\{BE13FB15-878E-4f96-A9B6-507E1565CEB6}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6087~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39F9D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC8B3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37D8B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37DA2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67C6D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64C0B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FD61~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92E64~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B862~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D32E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5d52c62b252ccccb51d87de8b7575d9e0
SHA1cff41062165b46cbf94c90de4ce98a3fb037c0c8
SHA256ad876570587952414652a7b0152b12f7b1fe19330ae2880cc9b6a7195a7a2d32
SHA51218847e38bf1cd2c9ea213d54fbf68caa5ddd12f7ee21684eb76389e6c2082c4f455550b55e1bf8f2eb50df900022cb26fa59a2255ddb72c2cfafe8ec09099b62
-
Filesize
216KB
MD5c5b8d290c75718de815d841ec9d1bdfe
SHA149dd37759a8f7a80da684b54ed92df713f40c30f
SHA25694ce782467c88fa2f115b42db99aa1c4b8e356204ba6064c7a7e605a6a1adc17
SHA51244172cb2a693cc0ed5dbcfae155a23d89b3d12094e18206e53cc17ff00abd622f0a5b89945f40093f1d20fdf57ceb89451675ef120b0d984efc3ed4821a0340e
-
Filesize
216KB
MD569abdbbf153485dd5cca70f37b139f34
SHA1b236e29711d1c93497fb39a853a4771d71163f3d
SHA2562798ed96d99a21ac379989c9036e68f5636ba9268fdf8667c32df23b55fe4b3b
SHA512d28df1af642215b7bb16611f460f77cb171c8ea59b8418fe4cd4f4bc4ebecddce6a566da092f2c161bd2944963fdff8978f0c11c87f1d09b75daf704b90f3466
-
Filesize
216KB
MD5db694302b7d64fa8d3221721f7d72cc9
SHA18c077643c2e083a14984b9c34a7b44a4768e7a7f
SHA2562ea642b3e128d660ccfff7e44a055b70eb8ebac684c959d3fd4def9613db62d2
SHA512ed28f83d474cb23349bd87e3d8210b34f753ae5e1c768b0e2fe5a88ea3215774b911ebbfbd23076010cc8809a253954a2686abc35b723198866803dbd4f43cd8
-
Filesize
216KB
MD58a7fd2c06461dfa05eb27303acd64095
SHA1b2b3853169715753259d7ded2aa51660ca0aa875
SHA25632ef067462c5ae5261aed9348ad0ebf46b641cfe42f28b7efb2af4917c6fef28
SHA5122b7f234966822e5abd4b1002a5194f6007fe78fb062af0f332651ebd5d5997262a73ffc1b67881d79750bdce356dd2a21e9803e418034e8db8ebf86d938944f8
-
Filesize
216KB
MD5b9c052b13815ee23825b4da96cbb8635
SHA108796e8e553b1c8232ff48dc85a73371e5171fb5
SHA25684abf72c28506010d9b652623426e27656116d241c1fb1c7d7ca756363331b7c
SHA512ef51dd22a217ff3d3b7bd748036d7c12057cfbcb7e177af6a72624d193b6e73d9f6241211d6318c0b68393b49f5b2af2b44aa4b9223d7f4049615782a7cfa6f0
-
Filesize
216KB
MD57cab5c16bfc2e2355c878f527b799df3
SHA11e58c3e8ab23a5d619f3a650f880e5fdf9d2e9bc
SHA256f2ff16c8eeda4999c9a51de599898d9661d0f2d79792c18248ce2b6e77142327
SHA51268963e5295428935f7522e60a13a14324f91f97ff9f25149585b6ade8444a74aab99a44ee7079aa8ba3622d232cedacc1cec819a76f4613900a5bae5a23cd895
-
Filesize
216KB
MD58022d669c6a71d6d0168880fcdc26526
SHA10f819ce23eb5a93e6c29d02a5f2c0814e61bd203
SHA256f3a1d9132e6c131b499edfa0b6c4fcb4b0ae9154debf07c64341de4d41044764
SHA5121168560e43a905346bca6ed7e23807e390d4807784638381de4d7abcd2c514ce7e6da950b585c107f74fb6049d2e57941c51d2754a71bed93499540463c5622c
-
Filesize
216KB
MD52aa56c22360f4c3cbff90c0a04676b15
SHA112e1175b7831f0d512d9e8dccfed6bc16b44120b
SHA2563d737e3f8fb007ccb2409d2d0a10a42489f1ce92b79e0195fbe87643b3a877b3
SHA512b8b94a916c16fdffdbc71728a0ae3f3b0f46b9989fba08438741f82bfad1a2c379ae64f5251edd64c920f0b560e242aebcf00f29f069457ca02690723e40e591
-
Filesize
216KB
MD5f63953b4bc2a09201b0a39b666299beb
SHA17a0e5f68b4d249e8d2b62b2404f28c0c955464e6
SHA256b323fffdedfc7c29b77edcd13a146e094e707741bf8306e811e09d1641b941a8
SHA5126f0277b7672d966a39806561dbc4b786a6d1702468b29f345ad1664252e46d918f3f2e5080957c9db44c681b0d865dd30138afb2ba038ef493ac3e4b99acb97f
-
Filesize
216KB
MD593768438d9ed4e9713b65d8841037c72
SHA1b467e6e367bd9d5c1e9b750c806d3949292dedb5
SHA256bf1b3d3441aabdc0e921c9c44e79ddabbda1087523402cd17d3e3f277ed46c07
SHA512acf8d370e6f5760cdc1ffd3a571cf9f17f8124fb5daa5ffca8aa7a53ef87342b00c9de72c4b61f48ddba080a8e8640d1919e8a4480a25373c48accc8339c88b0
-
Filesize
216KB
MD58c70bd37bbdc184cd59c9173dcb8153a
SHA10ad0a905a4bfd72ef2b49d336b99b37f7e003798
SHA256450cf2cc67d5aced14064956bdf6bf7ddcf86a14ed6c348011cb2df1bbd16fd8
SHA5122e3c122bebc5145792c684fcb70fc56111eedd988b585a99468c28b373bfcf9fe348f8d45831739af859c361f050e68c5a9418ed21a07a5a0d4638acbbe63b52