Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01-09-2024 06:04
General
-
Target
2024-09-01_2423101674179bcc28ab9af4ce845ca8_goldeneye.exe
-
Size
180KB
-
MD5
2423101674179bcc28ab9af4ce845ca8
-
SHA1
600afeda4e83510cf84e7ac6476579e59c7103f5
-
SHA256
18057fd114d006f6759f0a7cef2a9a3c6b4a42229ed9dbda540b0a1775c9d258
-
SHA512
ecbe76535cb9f35426ebad5f7446fee1d4b29f1df5874f58b62314d1bf33c6eb5e917f794db56b6593dff8b4d0be8391f331757c97c45a557609ab20d9e61e53
-
SSDEEP
3072:jEGh0oRlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGXl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_2423101674179bcc28ab9af4ce845ca8_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_2423101674179bcc28ab9af4ce845ca8_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1E1DF02-F8D4-48b4-AFC1-02E99821D398}.exeC:\Windows\{F1E1DF02-F8D4-48b4-AFC1-02E99821D398}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F05E3757-0C10-4069-AAF6-3E37D39DA6B2}.exeC:\Windows\{F05E3757-0C10-4069-AAF6-3E37D39DA6B2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D4E1E25-E0C7-4a13-9AC6-AC083C561BAB}.exeC:\Windows\{0D4E1E25-E0C7-4a13-9AC6-AC083C561BAB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13094A60-452A-4c63-BF9C-2DE35C463C8D}.exeC:\Windows\{13094A60-452A-4c63-BF9C-2DE35C463C8D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E695B7F-96CE-4459-B700-A6DA320DD85A}.exeC:\Windows\{6E695B7F-96CE-4459-B700-A6DA320DD85A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99C9DEB8-CEDD-4328-A2C7-F005618D0DB7}.exeC:\Windows\{99C9DEB8-CEDD-4328-A2C7-F005618D0DB7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{481975F0-8B80-4339-B83A-01EF520A86EF}.exeC:\Windows\{481975F0-8B80-4339-B83A-01EF520A86EF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9A32E8B-6723-4425-A9A1-54AADA63A62E}.exeC:\Windows\{D9A32E8B-6723-4425-A9A1-54AADA63A62E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40492BED-5332-47ee-BBEF-1B446E38F2F5}.exeC:\Windows\{40492BED-5332-47ee-BBEF-1B446E38F2F5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79BC73EB-6B7F-4730-A8F2-824B9884A2B7}.exeC:\Windows\{79BC73EB-6B7F-4730-A8F2-824B9884A2B7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C72A92D-6B00-4199-B70F-87A4FCA0313C}.exeC:\Windows\{5C72A92D-6B00-4199-B70F-87A4FCA0313C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{21E79393-98D0-49e6-B3E8-9064C5B5F983}.exeC:\Windows\{21E79393-98D0-49e6-B3E8-9064C5B5F983}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C72A~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79BC7~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40492~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9A32~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48197~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99C9D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E695~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13094~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D4E1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F05E3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1E1D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD56466ef680afb2076019da83fdb666d04
SHA1c9f17d97380a269f0e1a1757a66a9f5b94537fb7
SHA256689bbe7ebb8ec5589a0e154e760e65d2ce57b3eb11eb0a4710d9e4b2c8b85a37
SHA51230323679ed0e3a8bfedf6c275ffb0f8aa7dbf491ad07ea9a8657139941790c4eefc9138fdf196e0d78e74d98d7451e05b6ab280ec3324acca1d90c0274b17671
-
Filesize
180KB
MD50658a15b3a8254de8f14a0dd5c3bc5fe
SHA174ecd57f101f115120e4446bfcc14240aa1f0a05
SHA2566c1793969afe3e2f8302966c251c53658e7413a9bef90f6c27800581e6fbffdc
SHA5121fddb002c20b69a484e3e7591b889658cf1c4ee5469ffa8be0718f2e1d435d0e3c9f654613488616eb9a54ae772f42addf90e56d85ea0bd54acdbc610c7756c0
-
Filesize
180KB
MD519440e23af86aa94c439dbf0253f0fb3
SHA1a3ff756a9cf5376f7880d48a522291e34f378525
SHA25696dc9c7592fed9538eae9c97c2d1cce251828702a264aaf2e489b6a93df4e286
SHA5122a6c4dac814b3e8ea3741a26d6d08211c9dc4fe94663f9289fcff9b8cf17141fc02e85ba4b250bd31a9ed5172dd4ec57a479bd1730f531abe612375ade8fe2d0
-
Filesize
180KB
MD52bf422584db74104b52edf34ed3f36f2
SHA1303bee27f9f71aa290b2840f63d80a77f2400bb2
SHA256d885fc1feadd0a01089002c571f8f13a46f3e0e6505a2478b6e05b7f249543ee
SHA5121969a91f98d555a6677bd5bff44947fd3d5e5ceaec73cba0cc18f313ac58413a6153d12f0b300a8ca1fb19e754df00e0646ec678dce7425e94d8836f55f5fa9f
-
Filesize
180KB
MD5de2efb870e5acde360a82aa7ee22f1c2
SHA1f70a3762126d19dac4410a041acdde6abc3abe30
SHA25656275380cb2427e3250cd005cc69e520dfc69895240f46f31d086e3602c2668f
SHA51245d927d43c8913a2f83ac384f2311a723e127db1b21476581f73409c6048152bc5ff43df7f7ac70307175bf962e625407df456431e5dbcdaa007c42a59ebca4f
-
Filesize
180KB
MD542c08f710def238f897be0cebf746f88
SHA1f69b291cea470e3411fe87e76f661803a7c96c4b
SHA2562fe4af7bdf43315f488774cfe1ea423bb3f7aaf2935d5a30972715d797d90178
SHA5121821c86334040630effb3c925511c0dafc286ade8d89c037b7d00516986220886576681bda50c21c7085873749cb3daf545c715b0b9b9cba5501c904b5688800
-
Filesize
180KB
MD57366817588a389e1a69a99430d35f365
SHA124838b0b19f7c64b35c542bb01440be14017e637
SHA2569e56ee3c16ac89408301d1f889ececf7628dd32f204d90a64c934ae6b86d4110
SHA5127cca636a91ba1551e4e3eafca227a16eeb147b5a707d238e1286a23023a21ce32ae62529049a478d045975105a43c17918eae988f0aad84488dde4e6215d60b2
-
Filesize
180KB
MD5dee0213458013e8c13707db97eb9c100
SHA142b43e0e29d0d54f27780dd9d82dcb05da58db7d
SHA256403bae858794ae8aab1480e623e5505f143b2046bb62b513510c90b0a1c82c73
SHA5126fb37333a6362ddfdba0ba8562c868c3a68991dbe789ae2245e47ba15e5014d75d5bcbd1ab5c553c093ffbfec14fbf45724cb39a0c48553e0f9ef93b2e241f47
-
Filesize
180KB
MD5db4a42cc1d32ce37b884a74ea43572ae
SHA1d938b41c607f9a607a4c1fc1a28a25111b7cad29
SHA2568d13f54a9bde0bbc1014ff0c12f3e2a5d1ee7cfedc6368b0ce87c3b1e775c6cd
SHA512712bed92898ec285dd2c8fa6e4eaf9ae2e9a0bf67db4c30e96671db0084fe3f5f54730de1cc582df66adfa92ec03fe8566e950e4932c68cad8389b387baecf89
-
Filesize
180KB
MD56cf24714ad8de54ee1829e09a6882ca3
SHA1e040d9ef1f112bc4808dca3b0d964f11d4d57a17
SHA25623f988d5645fe4564d9460ce1f8837b5a6a7742e4ddc5ad6fcc0ea0bbc2f8e26
SHA5124272cf2f31e74fc86826afec28698a91feddf607f20e80ebce3c7a448e7e64e53d6ca6407e4f3bd0ebfd1ff435eb4884565135563e6a238cf1c4ae1831f0f302
-
Filesize
180KB
MD564cae0dc63e3a2cfb1564c69f8445077
SHA1844f43d2971cb5f58a4bb3193c68eb3591fd7f1a
SHA25669220aeba83b60661c928cb747369db5292aab26b83d2804db7495f183bbd019
SHA512838a9110d9fbe63fead8e3814e61359d25716af5cee87a26351971e33168cae0548b538a28e5a2370ee695344cad2102952ddf4e1ff00820a9109feef262c577
-
Filesize
180KB
MD50a39373ec098e92bdc425d79b66a3644
SHA10c759ce7c56422b5f497f8521f197fd89669dfc0
SHA2562e2fe16cf66244d3c1313574562d2deb916d53ef6e7a24221534c80cd4830c7f
SHA512acd662273e82e235989df0d7d1761894c5be330a4010085c1e5d382d80e3720014aeed84bc668802161e44044e40f0eed5029c47cf93bd791c2ec22ec2f7ed2a