Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 10:09
General
-
Target
2024-09-01_f49db05c7562d0410452652367e7e117_goldeneye.exe
-
Size
372KB
-
MD5
f49db05c7562d0410452652367e7e117
-
SHA1
6a29c3513cda5532bf75d0f17f7c59117d7164c6
-
SHA256
e89bf326e3cc2f1b0bc347d2e73ed3e3b503925fa01f79002c38b71cb08e57f0
-
SHA512
f014362261c6d7efe30acd310c6e85d75694216aab12d925cd3ddcda07efd0b49c5784e5aa988bccc9e1aa6c3cc20a35ab809e0fd1b5b8de3f42e36d4db39b01
-
SSDEEP
3072:CEGh0oclMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGWlkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_f49db05c7562d0410452652367e7e117_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_f49db05c7562d0410452652367e7e117_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2EEE372-28D1-47a2-BA17-4EADD67D3BF7}.exeC:\Windows\{A2EEE372-28D1-47a2-BA17-4EADD67D3BF7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F300F90-B681-4f40-AA1A-97AD30480D27}.exeC:\Windows\{7F300F90-B681-4f40-AA1A-97AD30480D27}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD713744-A723-4f7b-B8FF-610BB4D1FC7D}.exeC:\Windows\{CD713744-A723-4f7b-B8FF-610BB4D1FC7D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3EC7742-1A4C-4ead-BBEA-5B4A151371A1}.exeC:\Windows\{A3EC7742-1A4C-4ead-BBEA-5B4A151371A1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28596F62-BBED-4204-8F70-3C7EF15F1C24}.exeC:\Windows\{28596F62-BBED-4204-8F70-3C7EF15F1C24}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10FC966F-0DD5-46fb-B12A-2EA8910CD1E8}.exeC:\Windows\{10FC966F-0DD5-46fb-B12A-2EA8910CD1E8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E388C18-D100-4777-819B-1F36F67F9D19}.exeC:\Windows\{6E388C18-D100-4777-819B-1F36F67F9D19}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82FBCCAF-9E27-444b-BCCD-367127C99264}.exeC:\Windows\{82FBCCAF-9E27-444b-BCCD-367127C99264}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACAE5B18-C78C-4941-8A16-41AEBC641D34}.exeC:\Windows\{ACAE5B18-C78C-4941-8A16-41AEBC641D34}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A063C7D-9C3B-4729-8664-5F6451B36FDE}.exeC:\Windows\{8A063C7D-9C3B-4729-8664-5F6451B36FDE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8E65D95F-08F6-4cae-9E40-4853EC5D48ED}.exeC:\Windows\{8E65D95F-08F6-4cae-9E40-4853EC5D48ED}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0AEE38E1-2878-4c9e-93A3-82B4C1FE6A83}.exeC:\Windows\{0AEE38E1-2878-4c9e-93A3-82B4C1FE6A83}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E65D~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A063~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACAE5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82FBC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E388~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10FC9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28596~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3EC7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD713~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F300~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2EEE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5e27d5edd15ddf85b45a0432af94c1ecb
SHA1b99f1d519b823e0d6b7c32f86cfeafd90721ad9c
SHA256e5c4de9260f01ef7c553207e53e77fdf4b93a33a6423d23ed866ee5f340acdc6
SHA512f0f69df356182329b99b37d82ca2d811806b79c6a7c9c9a6fef4ca7659a882ef998150f8ffc5a3824e7267b0270c2157323c3a498a5a6ec5647ca8281b18e857
-
Filesize
372KB
MD526ae12cb4fc7d1a80ee63ea0306672e5
SHA1785a965548f3b2674dff0bfb56741a4e571aa6a3
SHA25694a904fc962cc3cf90a8897a03f45d8d1bce1fc639d35f73ef98d5b152a27d7a
SHA512ccb81e7c91ec3fd616c4e4a5745e891493846573906660501e6fbe0aa7cbc541366a1799345f1d02d24ba0d8d92851fd6fc741723de8496466bae8e3a2b0e0b1
-
Filesize
372KB
MD574675b7f7be69f3fc65c5a2d87630fc2
SHA14155d004178320c72782efa17f42cd72ab716194
SHA256cc1c1de3abba63132be2c33bfea05cfdcddfbeb0232d05e6b017a9a8c00ae408
SHA512aab153293621c49cf167381ba6afe413d0c76ac29a2ea9f47ebeafb566d757628318544c432f6d3ccd0b01b7d91bd875cbb032e71c55c9ce88dc6a6d910fc44e
-
Filesize
372KB
MD5229221a509acf471650bf04b47286e9b
SHA1cab23ff11788ae63c86a4eabc454967f5aa7d8af
SHA2566e9af5ec49a8639c2080a992f16fc6ee31b1954dae56f4bd1ef35fb0ab3b6b5e
SHA512af52a69fc97129bc9242e9647b6d118bc01e0a2e5d78ecbe7a05e94c05abd7767d30aeeb27733d08227ea05df70acf546c33ef61821d248625afe08f420439c0
-
Filesize
372KB
MD5cd40e10503571be94fb67f4674d5154b
SHA11e7aaacad8df5a788273de3562034935182936d4
SHA2566c1196597bd7c99212aa06f681515da4183db3dbdc95f2b3eb1d6482b9c79a3f
SHA512920269cd4226bbcd9b7c3f6cfc19d23959c221d313713834fb087d8f5203ca9ca5d938e2ec5a61c297fe0c1ff671c4ae89444fd658f529836e72792805904981
-
Filesize
372KB
MD58140ccb8e865c37bf9897b7d733822ef
SHA1cbae9f9d0811fa4fe0d2b5ee8640feb50d33d194
SHA256fb8532a28ca0ea87bb1c075703e14f6d4ba4e208187def042eecbfe94d5a79f3
SHA51296ed38804826b5c652d4c44a66cde4d06f7adac16c48a017ab94b7e21aaba90ba24e62c3cebaf6059ae7725e887dbc86f3cc9e1d213e0da50de374bfcecce26f
-
Filesize
372KB
MD5b891e0624a34a2414acb5c5f00f4312e
SHA1f95a9ef434088d6f7fa8c4845615551c75f6e297
SHA256ab2e6a4c159a3eb12bf2f5ed661fac94ff28c4d0f777aedaf4a2aea56cb57049
SHA512982ccf78e9782024c14c45fb2fa78566fdb222c8e54415d2f6467691da015fa5bb6e582a42fb534f82649c9cc510561896da57f59f7e7c2d5dcecbdbda21b2f9
-
Filesize
372KB
MD5cbbf22f509c84fb50892b36c2d2cb609
SHA195ace96ba184914ed3f101ff28eb6c19a14a0598
SHA2562def777a8c2fa79599bb2fc1241d8b7f00f40b4697f3958279a1e58720548e49
SHA51299da750439a7c1399882e379b6f3a467c2fd533508e533e393f0724c963573963c8ec7d32cbd37e1ea19b4d41f9db06feee523547345c654855ec94d2af562b5
-
Filesize
372KB
MD53810dcae4b186586d48fe82614a8e00a
SHA17712d122c4b04db8bf0d4a59191ae20f9935153d
SHA2560288f21256e6abe2b93ceabbebf3ccd9b327cd3d612c4c11f3235490289292d7
SHA512ede2c63ec35138cd98dfe9148a65bb109817e9eb9dfff6bd99e20d5fb0d2482575b889527706d9af6bf24d1a3cf86efd52ce12a926eb44704aeef0a8be95bef1
-
Filesize
372KB
MD5384c506c36af3ed8f413a646b96976bb
SHA1bf8688b4d0dbaaa960ca65604a7eea4727a3e1dc
SHA2569fda532bd94538780982b592852b4437f867fdb59596833bf0dd5a77ec5c0dff
SHA51236df22ed12373152d9ab54586a9eb63daa2c327bc9dc592bbd506b40e97b4446df9485102cf2a7121c431b826c6b3dbfd4064855ef471bb4cdb7f98a2282e1a3
-
Filesize
372KB
MD57e1a33cc0eb0d2fad16238a5a7d1760b
SHA1ccc2f72c479bd7ff87a74967b055ee5ed5618009
SHA256852dc647aad2dbf40ad41fb029ac9e577e35b48c1ca97073b410d688d9f9443f
SHA51278b0de8c13771c00e2347d1800a69c1e1bde02d474b3d5200b3eb72207d0eb4e7205df33ce07a6d7f7eb2519eb06aad2e6f30fb785ed53ebaccb82a26a586459
-
Filesize
372KB
MD5948b50398f3687ceb24fe440b9129395
SHA1b3162d69c84c4a4edd78345bb549c6eb3eb6f6ca
SHA2564d70eadb0e51a47511f076fca29a8c66470c2428a25968f7c4773c5762f66f59
SHA512f73a09bf172ff1b426a65ba326bbf02158c3550f77292899889f3f79a2e5c9c5c188b5cad699c048de8106659792c97ea91b3fee386fb0398b4ba4e0a24d564e