Analysis
-
max time kernel
149s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 09:48
General
-
Target
2024-08-25_56edeea85378804d2a26dde9ab04bf2b_goldeneye.exe
-
Size
408KB
-
MD5
56edeea85378804d2a26dde9ab04bf2b
-
SHA1
03e7c3323266c9c26dbdc85f80ed1c717b299ec2
-
SHA256
c68ddccac71785d1a5c9d6c075e97b27d81a62a3f234ca072a5eb265e653ff41
-
SHA512
56d7ce43875a91c20489279daf68dd3b3aa3dfefcfa08f9f729bfd3c282fdeed8ad74ab63e1e019a9402420079dd4256323d772fe6c5a0d056ade0d5489a8f7a
-
SSDEEP
3072:CEGh0ozl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGRldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_56edeea85378804d2a26dde9ab04bf2b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_56edeea85378804d2a26dde9ab04bf2b_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{491697A2-79EE-4c3f-AD8C-0B0F54789812}.exeC:\Windows\{491697A2-79EE-4c3f-AD8C-0B0F54789812}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9884F61-886F-401f-949D-84CDD4FDFD4E}.exeC:\Windows\{F9884F61-886F-401f-949D-84CDD4FDFD4E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78E5E65F-9866-44b1-9E5B-557764387237}.exeC:\Windows\{78E5E65F-9866-44b1-9E5B-557764387237}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4142639-73FD-4374-8C15-CAC8CDBD9E50}.exeC:\Windows\{F4142639-73FD-4374-8C15-CAC8CDBD9E50}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13AD92C1-E917-458a-85B3-B6DCCA833C27}.exeC:\Windows\{13AD92C1-E917-458a-85B3-B6DCCA833C27}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C147CDF-F57D-47a8-811C-862F270C4C8E}.exeC:\Windows\{4C147CDF-F57D-47a8-811C-862F270C4C8E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4342AE3B-16E9-4cf1-B64F-8F952DF0EC5B}.exeC:\Windows\{4342AE3B-16E9-4cf1-B64F-8F952DF0EC5B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D7F23EFA-2E89-4583-B396-98ECA4EA3A7A}.exeC:\Windows\{D7F23EFA-2E89-4583-B396-98ECA4EA3A7A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30FF597C-284A-4657-A276-A5EE261F2CBC}.exeC:\Windows\{30FF597C-284A-4657-A276-A5EE261F2CBC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A261BEC3-4BD2-4fc9-9E38-74B5B213073B}.exeC:\Windows\{A261BEC3-4BD2-4fc9-9E38-74B5B213073B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DDBBC3D-1B22-40d4-9AD0-63ED93D5C1BE}.exeC:\Windows\{6DDBBC3D-1B22-40d4-9AD0-63ED93D5C1BE}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3363B7DC-3078-4d27-831C-947F03D14D95}.exeC:\Windows\{3363B7DC-3078-4d27-831C-947F03D14D95}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DDBB~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A261B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30FF5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7F23~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4342A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C147~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13AD9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4142~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78E5E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9884~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49169~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5dd264352a6ae8087ecbe3ee82ac0e4ae
SHA16f63f081d58c4b0d38c1a330f7751fea1f86e32e
SHA256a0653a2009b40d2f1973c8a8b7e1f6e4f0559c6c08317cb1b8122a9bb5d5c06d
SHA512533090fa52c881ef79736cf1ea1eaf9ed6d910feaa3649e3c66fffb0d561e68631b5f7ee002e18119d6715400476d3808f3139af1eb873edb58b90cfb9ae015b
-
Filesize
408KB
MD5036b6258407d2731b42197a13f559764
SHA1d046573573e2e89b4b6c4e5a0d271c6872c5ad66
SHA2566ed9d7886f41297050164c3b12b44f30c6ea2cd40ad660286bd26164965e7a3b
SHA5128a0f52b3fd3f36071f1b96aa6cc2b8ac8b5cfce903ea7db9c0431c295d8298919b25f96ea4e79fdc9b3e3b75cb35ec8fea317725868ba83e91d2fa181c69a17f
-
Filesize
408KB
MD56daeae4ea1f33d01fdd0fcbc383f841d
SHA170f747d1a708094fd6f564f8f543be90bacecaed
SHA25642397507704e3cf20ac64f5538f1ac0867d7c5a772967dfb76d5d02002671d3b
SHA5126496f90453ad5010bc6a4f8c6f1a74661c963f70c0361f2d7c647e8d9a391228eab3952242affacc82215f6f52c1dee288ce277dcb2733941f1116ef5f58238f
-
Filesize
408KB
MD5789abd328ea480a44e3c2133350f093e
SHA17f07990f97e770b7de42c7b13c27fa25a33ff83c
SHA2561070942bbb59274165012eb9471600198257ad4433ae9f26c22658b82654dd9a
SHA5126f35338cbb58314919adb30cb2282695920642a9e6408a7ecb8f7258eba86b385b6f78d7e456d89be2614fab1d5eed6099864947ad7356231bef051be7fdf894
-
Filesize
408KB
MD55fcda30dfd8e79fe739a16aca1ae6df7
SHA113802f7a739d2415d39dca6c885c4ef0f7a70a8a
SHA256e65bb4cd3c8f92fb18250acc1ac8c28aa20ec10bda20d2bbc4a2f1c59c826101
SHA512577496b8d93fd496b06fb5a1fc3b746b61be0b29a724ef7d48cd60c3c1137986f9e631bae5d23afb27f7b715dc802811d26028b85bd358eb590a042188e8ad73
-
Filesize
408KB
MD53d31982bb411e6efefd7209f460e30cc
SHA198b4b0afb8e95a0aed3bd94ba863af749d94b9b8
SHA25638c3025566bcb7beef0aa199a52bc529aa4c6c40c7c5947546a330c383969f98
SHA5124166efe54e0434cf86b3bfc676f2fa32e4398e2e5cb86c6e2484e2352e2909c979e029c0d6b0ca1a4516667e9294e3d3cca5fc3dc4a71b263799e82b27ce3020
-
Filesize
408KB
MD527b6750377d1e21cda3aaa1bd4ffcc0c
SHA1fa23ce7c124d157622c8cfa698a593b151e7d1e7
SHA25625d5e716ed9686a0fa5307bbc69c4a69cbb91a57b9038f208d8b2fd00656c602
SHA512fb47f2845b2ec35eb2a611cfa34acaada2176d19842d12f8aaa8a1cdbf7a4a6101fc48cfc8695b4a88449524753ce2d529e395fb0f9377795a875aae568dfcf6
-
Filesize
408KB
MD552f4ae97543e883b6c263f68fa0211c0
SHA15b603ec63a1b31730d4e4b484125cf2fbec32a30
SHA2566e54b25f9f0d892aaa909a98b1339a782ea51f38d808453c2bd253222f24a15e
SHA5128007986e99d9d29af27fe39851a231611a4bd64707327668b83fe1ccfefe7db8527a22432fe52c6fa8535c268851498cab0bca78ca75131113d3afdc8c9c9fc2
-
Filesize
408KB
MD5dacaab52322c6b1493c5edd38a3576ec
SHA1afe44e52fcdf0f9be34380444d714356eac6de84
SHA256317125aafe12a28dbf0400ebb1cb7b2e2380127df83e7de65f2d5a1ce57c02a3
SHA5129c7ec42622dc5323dea46e7bc72ebf4f84987bbde49caf0ddef5f32e4cd07b523b3e4e0ff0bd9053a84560aa55f459c40942a012c72d75fc444cef3f574b3f28
-
Filesize
408KB
MD568d09762efcb7328dc0b590f7d034ea0
SHA177199089c5aa00aaa6dfc0208ddc45b37acb4f90
SHA2565828c9c9f483f4a5ec2bd7d4f78547111a68bfdcab8599e2f7411b2b2f18e3f3
SHA512ff80c2895b7dc81e3ee838cb6125a02711bd16cb6c083bc90fdd2e8109fb4d165b75319517bde9e44aa01e7dedf5cda5cb9160e19d1e9012f75821010519c9c3
-
Filesize
408KB
MD5d29921b1eaac1aa83b5808c7c89bbb48
SHA18564219351f3095dad4dbfd2b7dfbcbfce386bba
SHA256fa5ec46ac8025502ab1e63c909a3dde0fe5e66c9a624126a9079e7f6c30c9d00
SHA51254d728eb06e29ce8f7afb94c6b752f157ffae3305b8c54907fe887fb905875819796f4ed04a589e30af28c70fee90638478a4f2a7241942026d13b7960d8ae76
-
Filesize
408KB
MD5770e0b71030316a0ba39d2deaba4cdc6
SHA1fb5f13819dab1cba55de411ede459ffaae3fa9e2
SHA2566c0e1964e668c77b457ffd672b61b086532e29826ba1e5398b9f92841d20d0ae
SHA512aa698f02e22c0ea4492afe983a8c7c822e20cfa7be6275a9eac54e9b0e3f50bf6ef4b9fe505786fbb97bb47feab43ac0a512402337796fd6fbfaf9b6647bb3d5