Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
25-08-2024 02:06
General
-
Target
2024-08-25_6fce3a3c6d160f632ff411107d5a9e46_goldeneye.exe
-
Size
380KB
-
MD5
6fce3a3c6d160f632ff411107d5a9e46
-
SHA1
ce0ef5fd17f619884984da65837eda3201bc5f85
-
SHA256
e6abe1a071f2ef011f6ec4a3d35b1623d9201a6702af0e2a1a5db32bf71eb497
-
SHA512
8b70f5f08842f750f7be1ec606085d83379240c352436c70826252f29f2e2d57c672306cf4d7945219ecb829887be3e30104ec0d3e1a944ab62f054d15ce22c8
-
SSDEEP
3072:mEGh0oilPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGIl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_6fce3a3c6d160f632ff411107d5a9e46_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_6fce3a3c6d160f632ff411107d5a9e46_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30A62CA5-2079-40ef-8263-171F0D42E81B}.exeC:\Windows\{30A62CA5-2079-40ef-8263-171F0D42E81B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{531BBD23-8A7B-4758-8682-EBC3A0C42939}.exeC:\Windows\{531BBD23-8A7B-4758-8682-EBC3A0C42939}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{225DDCE5-EB43-4e73-89BC-DA55A0809DAE}.exeC:\Windows\{225DDCE5-EB43-4e73-89BC-DA55A0809DAE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA2D5FEE-0A65-4f4c-820D-876278752617}.exeC:\Windows\{DA2D5FEE-0A65-4f4c-820D-876278752617}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE8FDBAD-13AA-47e0-B20E-74AF85177B3C}.exeC:\Windows\{AE8FDBAD-13AA-47e0-B20E-74AF85177B3C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{390B5131-66F9-4250-864C-1BA8A9AEE2C3}.exeC:\Windows\{390B5131-66F9-4250-864C-1BA8A9AEE2C3}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{849BB5E6-D9B2-450f-928D-FD14A0344C04}.exeC:\Windows\{849BB5E6-D9B2-450f-928D-FD14A0344C04}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B309D69E-D4B2-474d-9C68-A98AD902F921}.exeC:\Windows\{B309D69E-D4B2-474d-9C68-A98AD902F921}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{CBF09C65-3495-47f1-A059-4D3B6AC82E12}.exeC:\Windows\{CBF09C65-3495-47f1-A059-4D3B6AC82E12}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B2089DD3-93FD-4785-AA23-BAD00121936C}.exeC:\Windows\{B2089DD3-93FD-4785-AA23-BAD00121936C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{179B3AAA-79F8-484a-B781-DCDDB24D9385}.exeC:\Windows\{179B3AAA-79F8-484a-B781-DCDDB24D9385}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2089~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBF09~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B309D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{849BB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{390B5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE8FD~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA2D5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{225DD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{531BB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30A62~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD58ede609989c4cd29ff2c385a2da6ecfb
SHA142163d8337707868230a6d6139f6ab30e456e8d0
SHA256f5fa4f15d8e5af5eb3d79d96c999b45cca57042ee4ae3babcfe314da027d9e2b
SHA512e21a748a49b20bc80b35ac2661035e7d36b44bbe13e0efd99b435d9c03905d0f69d28a5de2954d926a098b88bb5b613bd04b02e79d9c448052c25fcb87185cd2
-
Filesize
380KB
MD536f7051c5466fd93fcec380841cc0755
SHA1030948c58a61cfa6d8b1baabf1a7a3c4de1d7222
SHA2566b8210da3cb5680a62017e0e6c4e749edffed179c7954e10b68217aa3fbf60db
SHA512f8584d16e7b3f8259e83687fba1529ccd9778051f52dc912f224f4ffd8a81010e1874dc21effa92b8c914dc47cad8ad7d8a0568d124c6c38703eea8b21b5833d
-
Filesize
380KB
MD5af9920328d3bea76b61ded6a1ef99453
SHA18621af5d0151170354d41a16a8b221e918977507
SHA2564647e0224c1c0bdd5276f6b6d68f799ccca295f54f21cac1827e21a1b8598b3a
SHA512265738b1ce670e607bf064de6fb35f67e2412b45baeef19c67b9580ba6f1ca0e51bef068efe167fb8d17ab8eb8e520f5a5e5964f4a262692adc51ce561063ea3
-
Filesize
380KB
MD507ae88977f8a49e3d5db7144888b97c3
SHA1a712df9aeecee39cdc1fa0ecaeda4684b8c64417
SHA25699047a23926008b42f069572afb149fd9443fb1df7167e5187d744c5c32049dd
SHA512f9cc05656316ba7aa6eafcd64544ed7fbc794447030b6fd68a59f164987dfe95d61a7cb7285d8a2483777ef12d84a284d02db537501369c7fa14622da238d7f5
-
Filesize
380KB
MD54e0390c9a3da7bcb93272f810f1ea51b
SHA12554c67e1228359b32c3e3405d4c3fab02ca3eef
SHA256c82ae9b14e8f297d1c57f5d5a115de46f9557b893bc519996989ee6d08e11c04
SHA5120551db982806f947ac9b37204b4506a313d8ab7f09b0767008a071fc34293ccb287e39414dbc24764ee69f9195e2eedceafe206fc03d68ec1cad5fdb8461740a
-
Filesize
380KB
MD59a8ab0c7ad30373d689f79fe73fb91f1
SHA145a7b5b60fe5ca70968d02774ec4369b3f3e10f7
SHA25678cb65a50eeadd707e65a8e9dd5a3ff41b0892c27225c2b13e166729e675b0ec
SHA512a427cb93470c11a444def82a094d2c34ce1dd385f002c4657ef7300b79181d7592b30979d06d9603b1f3b75b927099df2a4387202b7dba8840128490c569b8cb
-
Filesize
380KB
MD5aba66c43e47248157eea43bd7449583a
SHA10053d2c1f5a491d028439411759e90fe36981547
SHA256f583941c6871be97a0640d41ff0b9148b3d5c93fca94609ef4c0c859ae2642d8
SHA51268838280dff728a5b6fa663b0d675ef995700bc15459b7ea3251ad826fed7a75dc2222866241930e459f218587a75dfb8cc93dd955e2e6c40cf9d1b86c130b42
-
Filesize
380KB
MD5234be29d50e213f6ccce8828d9e2243f
SHA1b27f52b349f607a6466e6d33974c6a81b669453b
SHA25622c132d44e0ecb6b014569b2d3029e8510c64baf3a6547b6591159f3d388046f
SHA51213f433ff4d09b8270e4466efe4e3811f1a03464b9190407f7ae6402514191c2079154523a063d4375da0c72be293fffe674735d34894128441f6045aa8b42d1e
-
Filesize
380KB
MD54f4e17982f2521f9c0e5a04e193f9500
SHA11cc1cb612bc927c73426bc801b1298a5ec6c9d88
SHA25610cc028c829d4eba8f6c77fe1c9e9ae8c352c66065207e36e5d771c2d9d75305
SHA512188f031df997e7a2cd9f09b67556bf6b0bc6c0b67ee248ee1494652ca5bb42a27b8fea43f795168840bc77a889751a52eb064812d3516b13bfda95c7eebf20ad
-
Filesize
380KB
MD51e286c196d9eff51eea55c0a643fc9e6
SHA1a8818ea3ddfc9b1591f79f4e01f8eb2158f0a581
SHA256e2229c7e1c15f892965aa0bf8bfce1819f34a42a428e98d684e0ebce525ba2e7
SHA5123a1a3419ba6a440eab77b4c8a172ea2e00ed6b96783aedba9c5fe5a7562b31006fc912a814c10b7f61455284105a236e7a3671b3f83a5f7d6a76daa52b57e1b8
-
Filesize
380KB
MD5a2f69f18c8213d6d12081569462dee4c
SHA118e63255e953042eb1c9bd8bf573e08698b8785e
SHA2565eb2bc06601ccbdde1ad9c169194d6fc25ae7e0ecf0a00b276e2f65ec292c0b1
SHA512cb82a4be906eb8e9f4a4e6956e8d2e180de344ee5531cf0fca61da04a6b1f975cbab2207b047c46afaa04e563588179e3b09a5d046e5c710e71971fbdf36a7f4