Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 02:22
General
-
Target
2024-08-25_d6d53f1da4d795ef4989ef45adbbce24_goldeneye.exe
-
Size
372KB
-
MD5
d6d53f1da4d795ef4989ef45adbbce24
-
SHA1
5be5a89ea2436d871a27ffef5daae5778b1caaa4
-
SHA256
a9c179ff104c630a4ddd24fc5390819281a888e353b45b12d2ab6ed8ba1eb9b8
-
SHA512
80df69239f14c178a3682bf1fce26f783c318f53950ed321d0c33173eb390a6dbeed685916509abf80afa75cc086181f9321b0372c2199cb4f4224fa9f9480a7
-
SSDEEP
3072:CEGh0oKlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGElkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_d6d53f1da4d795ef4989ef45adbbce24_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_d6d53f1da4d795ef4989ef45adbbce24_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{507991C5-E180-47df-8449-D543AF2FFED5}.exeC:\Windows\{507991C5-E180-47df-8449-D543AF2FFED5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7466AE55-BA9F-4ebf-BBCC-D46BA1306505}.exeC:\Windows\{7466AE55-BA9F-4ebf-BBCC-D46BA1306505}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3033DBD-9228-482b-90A5-EC675EED8A2C}.exeC:\Windows\{D3033DBD-9228-482b-90A5-EC675EED8A2C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1E32904-1C65-406c-9493-96DAD33A6F55}.exeC:\Windows\{B1E32904-1C65-406c-9493-96DAD33A6F55}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B96179E-00F7-42fa-9008-B4C04DBC6EAD}.exeC:\Windows\{6B96179E-00F7-42fa-9008-B4C04DBC6EAD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45B4B8DD-DAC3-4e74-9BE9-70944AE7E277}.exeC:\Windows\{45B4B8DD-DAC3-4e74-9BE9-70944AE7E277}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2828802A-8A57-4754-805E-0A1888FB2B58}.exeC:\Windows\{2828802A-8A57-4754-805E-0A1888FB2B58}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AA2765A-153A-43c7-BA1B-E886D61F080E}.exeC:\Windows\{1AA2765A-153A-43c7-BA1B-E886D61F080E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24ED924B-275F-4c84-B7E4-29E1C9C13D05}.exeC:\Windows\{24ED924B-275F-4c84-B7E4-29E1C9C13D05}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB9E06F1-609A-4d99-9B35-1A24FE8B00DF}.exeC:\Windows\{FB9E06F1-609A-4d99-9B35-1A24FE8B00DF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA882CB8-1730-4098-BD10-76BBD11E200A}.exeC:\Windows\{EA882CB8-1730-4098-BD10-76BBD11E200A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AA53B87B-8E64-4e3a-966B-0ABF7EB6D241}.exeC:\Windows\{AA53B87B-8E64-4e3a-966B-0ABF7EB6D241}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA882~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB9E0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24ED9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AA27~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28288~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45B4B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B961~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1E32~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3033~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7466A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50799~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD581ded5f96b1071e0d5f89832f3355a28
SHA1dc1a904a792d156ca1337e91be8394dfd5684f79
SHA256c6adb869791abec12f904ce706c5593c8b93152ab737b29ae9a1577a9cde8905
SHA5127a8614cbff56df9f305752f3fd346db3cb955e1fc776c822a12af0e702da11a4e001e0ad396cc69799abb985985827f1a9f4dad21f8608d99947fb5bc54a5090
-
Filesize
372KB
MD5b2036423d244fc29412f7df8dea78bce
SHA1553eaac0e5c343a82b358b364c03150c8cb059c4
SHA256a9e00585e99acc11df950bacda997611dbd074cb9c07a262d56cd4f37c0fac5e
SHA512b37ef57bb7b2a9637355d6697cdafeecb96f6d66027e459ff2cb54cea75d831708550c80635e2506597dde11bc913a4e2fbdbd54956dbc8ebe468c28c5d20f03
-
Filesize
372KB
MD5895b9dc0a6e8ea0f7bace17562d82480
SHA110ba249a30828362adfe06713fd671d0c06e8d90
SHA25617843d9940cdc35852246598b155c4395a4f73bde5710c8d63d4790c20732fe4
SHA512c5e5245dac56e1cabfb4581b00cc5417534904ca599e4259ea98db03cc0b1738a7e43f7734e7568d659a638aef937049cc30fcd5843f112e159d171835a862b6
-
Filesize
372KB
MD5aef2a3f28538d98de3b024dbb0500df3
SHA14edf6933b9660597f0bb01563ab26740aa5c9e5c
SHA256b6cf179282db555d54d62ddb071f95a9a0d1565ccbef0ba99a308f313fc08348
SHA512474061cab376a1e9501456bb010bff8f396e88244cd3242f6dced5dc155881595ffbc7514c4ab9481cdbfcfb4682a6649d43762b66039d9cb086a0bc0c35741f
-
Filesize
372KB
MD5bdfbf2b1a5ddabce86d38a2ae25c13fd
SHA17c0e9b0bc0d9500ddbbdd36b7442a6339388fec3
SHA256200af888043ab6461f8ea61d3decf1102e679141e7fa8b6ff3b90ff8f0923b30
SHA512bfc79d77e455440691f6b754deb8b15f55565aa1861e4896c7c275a44e54451d57375d39ecf71f4c00b5eb6e8f6db5d14ff58b7b79de9275da0ac1725344d697
-
Filesize
372KB
MD5377346f23962a8ee5bcdeaa745a3bf1b
SHA1d781d8824f8649bcffc7263416c0b4367c346238
SHA256ae7420f5692debe6736ad25b79f4ea88628f03b2873ff7e5702f2fd4aaaf7560
SHA512dfbb9dae65423e43079978aab13cf2a10c36f59b3de53297b87521951882883d30399e4920728ee50ddca363ac493663c6e260d8135bb343b2654f9d76813c80
-
Filesize
372KB
MD56153210ddf6b61dca9d3905438873146
SHA1522a698fc588a2afef3bf56e493f8888bfb33ca6
SHA2569157e3693aa4a31e25c45f6132b5cb28acbb28b889c2b667d6c25c200611d491
SHA512364793adeb74cf166807f1b1f51c2b689e28068394938bc69254b2cae79f3ef28edf2186e9c4baf055059bc51b65b880a50b99230a6a77c59078d4ecca4923c3
-
Filesize
372KB
MD5068fdfc2e9971965ae505acbea8b475d
SHA14e0ddb02fef525c371f74780d57293eb8d8d5fcf
SHA256b9d13013eee9dba3336605da7d9e833b3394b4bcddbce648026f824ffba29804
SHA512624fd650df7b34969b347f0a7051d1579a0e5f88f898c9349efd30ca032f2bddee0ac9f3613b374e209ff242607498970720d55b406b58a0f50096fa941e347c
-
Filesize
372KB
MD514088c50aede636cb1fdbc1f86c07075
SHA11abcf538633782bdf29e826fbd94e6892f842c40
SHA2563e0d46b4339f990c2df8d4e02fa5248c2f95d7ff98f2522ca7b6b74de053f5ef
SHA512a40d05453440f82e31f4aca6ce969daed1c7c9ba2e11a1927917ddef0f636db161744db0c6901697be024bc157a8c909e2593660bf11b067ff36db20b59853ea
-
Filesize
372KB
MD518f493731d47335ad6e40badf42acc9a
SHA18be70971277ab1c6f6b24a961fedb313025e86cf
SHA25640dbf21beb6ce954dbc8460f715679d95a3417e24184787ab30f1b5e0b98d69e
SHA512890450de740b2fc01df5be2144e547a8107d5655611f899dfc3ef9a21d13d927277abd7cebf537a4a7a514566c6ba3ae8764365351380b704cbc86295bfd5cda
-
Filesize
372KB
MD56ed55fc4c738c45000c87c86fb8255c4
SHA1c40da03a2be1b7c30d08ac1fa19adf9a2ba6bede
SHA256e66379d9290ca09e74066650fd7e49c8e486c3263bc09e9934237e08bbf4452b
SHA51223754f17646cf93b1fe0939133cc381268409192cda8b14c627aa0e212db7e1eaa40269106f09667fbd4581ba46374ebaf3205f924cca07db6ba306ec8df094a
-
Filesize
372KB
MD59ccfce2be82bc3b71ea348616f74cd94
SHA15416f98e2eaf06694f4f02714416b6384a81338e
SHA2561f8878d87976a6bf6f1cf7b7fe9a3a60a38204e62346ef84604fd6fafaf86003
SHA512f402927abf0dca244544ae55899a88241e8ffb09f9c68488642647095ff77554ff49c70027d8b851824079d59ba28e05035994c42df4067862b9180a1aa906d3