Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 10:25
General
-
Target
2024-08-25_9bc3abcf1455bbbcf929d8628e3a6c42_goldeneye.exe
-
Size
408KB
-
MD5
9bc3abcf1455bbbcf929d8628e3a6c42
-
SHA1
333a16790326400f47cbaaa53fb42ccca0281261
-
SHA256
1ca5f8f4279e4d0b40aae96d0bab9caa5aadadacd91ac6ff21cd38755c2f3bb3
-
SHA512
0a0108446edc514dfce392ee9177efbc47268107c7c16502a567bd205f20ce7b830e844ba7d86e87fa34e8b5c4e037d2434c350536e6fff30ed349b4b746b7fa
-
SSDEEP
3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_9bc3abcf1455bbbcf929d8628e3a6c42_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_9bc3abcf1455bbbcf929d8628e3a6c42_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A33D78B4-3028-489a-8C7E-1E2701720524}.exeC:\Windows\{A33D78B4-3028-489a-8C7E-1E2701720524}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72C5C666-F07A-444a-986E-32076151AC31}.exeC:\Windows\{72C5C666-F07A-444a-986E-32076151AC31}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF7BB994-3EC4-4af8-803A-C340223DACD8}.exeC:\Windows\{CF7BB994-3EC4-4af8-803A-C340223DACD8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20ABBD30-6307-4bf8-846B-13DDD51E3990}.exeC:\Windows\{20ABBD30-6307-4bf8-846B-13DDD51E3990}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A335FB6-228F-42a6-9D96-AC79F3DD81D9}.exeC:\Windows\{6A335FB6-228F-42a6-9D96-AC79F3DD81D9}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CE3C596-6663-45c8-ADE4-5E4EEAD73A0A}.exeC:\Windows\{5CE3C596-6663-45c8-ADE4-5E4EEAD73A0A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15B511C7-B6AC-47c9-878F-B3D7FA5FD8BD}.exeC:\Windows\{15B511C7-B6AC-47c9-878F-B3D7FA5FD8BD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C10AD3A4-B0EE-49c4-B356-D472C36497FE}.exeC:\Windows\{C10AD3A4-B0EE-49c4-B356-D472C36497FE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E69874DF-7974-40c1-BFB6-93A10E5804DE}.exeC:\Windows\{E69874DF-7974-40c1-BFB6-93A10E5804DE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20FCF4F3-1B89-419b-A888-D75623A83513}.exeC:\Windows\{20FCF4F3-1B89-419b-A888-D75623A83513}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDF835A8-EB8A-4d17-9FFC-B30C9D8BD69A}.exeC:\Windows\{FDF835A8-EB8A-4d17-9FFC-B30C9D8BD69A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{80023E24-7964-483f-98A6-B76EC59D1F2C}.exeC:\Windows\{80023E24-7964-483f-98A6-B76EC59D1F2C}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDF83~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20FCF~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6987~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C10AD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15B51~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CE3C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A335~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20ABB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF7BB~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72C5C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A33D7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4124,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5ec85cdd2db9b4fd19083f9f273c002fc
SHA1399fcb87a03468570eec3ec40280ed751400de1b
SHA256df98fbb18f117b03749a6d6686a6a68f72c7b50403e580e6bc186b9f9da27421
SHA512dfbab376af99eef2d643aaee9ba73e2588e60e49be213dfb477f7021ca9735595d46856ce21979d1dfc1ed6b965afab0932b9595f537baba042ed4007a7c5290
-
Filesize
408KB
MD5da4c8e2e8e58ea57c4e1adfb6ca34d62
SHA17b9c5d5da8889743c301067a5f9ca4a8c04d023d
SHA256230b06791f781983dba454bff03de917bc91a95d3c72322106b9131f3e957fb7
SHA512080d0e5ed6fac6c2aed7325141618162cae631841b7e59c8b25539a1f94ff7e0d94a7d0a70752bc14d94a88ee4c7948859a2bc0ec926522f7d8f02809fe7e726
-
Filesize
408KB
MD5af6b5906316a5b081618400bd7f6ebc6
SHA1e1361d39847bb7a5217d45d1bba48e4ed6cef1bc
SHA256cbddbf2f439caf04d6f040f98621e7494a8eb3e06bd314d8a4f99dac62beeaf8
SHA512f841c769379195f9048fc24b9367e4fc054b7474aafbd440003d9a4a6648964db0af2dc2c2eb2b8efc37ebaff3b9e818172a09d20bdaf67cc74bdbf416232b8c
-
Filesize
408KB
MD54927278f7c9f20a3dd49d6542034d1b9
SHA19c16cbb48349ee678a66f5b709b88d50018026cf
SHA256265f6126f99955c9d330cc2118c9cf95c8b9d8e75a047bbdc350918fdd50d7fe
SHA5127c8a401688fa58e6367730b4edd28c9a023f71c6796e48ed33f7376393896683e2bbe8f5fd648f4bc74295b87fe72897fc11951c02270c67273ffe9c77b6ccc3
-
Filesize
408KB
MD5df6c0144b4f7346a8c69a97e1b8616df
SHA17928c646291c2368b7900ca5ebc63a04dcf278fc
SHA25690cd56603f52dee763d3e5595030a55778a5381e0cfbe9539e23c656311e47f6
SHA5123e9c8d47d7e5cb289e80637bc81a6adcc25a6fccdf4c1cd59fbcc13337e191215c06c0e4f26f759e13b85c0244b70d8e14add401df189b1247d296c342251642
-
Filesize
408KB
MD518e162c4439557e13d1a0a35dccfbb3c
SHA1599d3679154d7d79cd36b8e86e9ec69863e0dbb0
SHA256d8bcea1f7424fc21cebb36dabe06a1a61a0f52a0f4f9f644620b07c9d7ccb727
SHA51246e25c85c04d383ed4e5b3adaeeba6d133acd8e7054324021efeb0fd959754aa1f122b40ecb08835c268d5092a511a918fe2667cd50486984d2ce9a3a5d1d15d
-
Filesize
408KB
MD591784320c4e17f53386168ee02a94758
SHA119791e77c9ce7edb7b0d138365e3d4c40aaebb36
SHA256d8cb17e3590b2b466adb69f797428330642b4220e04ea95e95bfa95f16eda4fc
SHA5129213f23f19af137d40b7f31e429b46aae756b6430f2b6d94064cb878404286d8e03213f0d6c05fcabdc38a42cbed1d7ba95543abcbde4f1130aa2d8fd6636647
-
Filesize
408KB
MD55d6a0a907a2bf1e899f4e6f2bcaad190
SHA12c0cab825a5b81409729742d5ff268ed58eaaf27
SHA256ba40c419929e2efc25808e378791d860deff1293e2097102e23a96e4066e473c
SHA512977f0e2cf4ca3048c58657430e0efee9a9bdd7a7f44b9ce19fd45102035a27375a337e16c22c8b373eae7d8560c154201e94bb2302eccdb812167a35bbe2f562
-
Filesize
408KB
MD50caad28ddbaa500a405de10e73f34bf6
SHA12dfce63847562dfee00f882dbe5b87dabf93df25
SHA256867cb72cb62f51e918d1cbe500058b960fc55e57067c206a529f269f60141438
SHA5129ce777491ab8c9068d1fd9c844fcb95fe3472ed6ba2e9a68858cdc9d83b4d8eeadb7c5d6135e44dd7152834d9144557686f3ff1fee5dfea8b355c9baeb02dbb1
-
Filesize
408KB
MD5a97e54cbd4187f74b8b3df4a4cdb203b
SHA1ff766a24e45224517a1c17b99e817fe84f2b750c
SHA256a13b5d70851c8fb1a59f79dc8838a4787c88b838a961d6a0584bc72f83778750
SHA5120ae414bcf4a8f4f03cb35aa8479532b6cde04be2a1bf11beb8e34a224eee77ef75e0bbc5b6c5c22a95f1130cd2c4b16c1f26d95277c40e3acd089468d55d6f32
-
Filesize
408KB
MD54aa027630353edae569f454eea19876b
SHA176d9c6b69792c31e62a813ae453165af2ce75b12
SHA2564006a936b3dc5553458aa4460c5d68041998b9675cab616a8dc6be93f3b17fab
SHA51250eac504a4bd0304dc965f9cf43670ad6d67c762b97be6a1d4b877a97daebd310b464c019d3b7260092e5cc053035dcdca24a324e3ed42842144ca4711ad3ea2
-
Filesize
408KB
MD5417f376a1bb09c6e35b5f447b9d7a0bc
SHA13fe2d09d297d66eb3512a71f369faff9d36f5d7b
SHA2560e66adc96b6f26fe2b0482ef5c405d4ab55121840ded73bb78c76dcf73022ae7
SHA512c1dd1e088fcd477d8b1935a0ee37d102e7d15be11ff0e7b783800349ff03a43ec222711d99555d65ec2789d85233f0522d4791cd6f99e1c73592c57153e08a6f