Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 09:48
General
-
Target
2024-09-01_7b499e1e8d99c217bfda507c3b88877e_goldeneye.exe
-
Size
168KB
-
MD5
7b499e1e8d99c217bfda507c3b88877e
-
SHA1
56d1650a3a37d4480febf0b33976dfac5f8e217a
-
SHA256
8f36579b33b1727c4d390bc96b9480d477ba158f9d19cb30fcf934b266ed2389
-
SHA512
a1f2c53c96b5d9b63b387ab281513afe168175c325433e236c7b84b73b4503d2f0dcc90146667d231399bd38543219849269d5c8e92b6489f6d994ff729eae13
-
SSDEEP
1536:1EGh0oglq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oglqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b499e1e8d99c217bfda507c3b88877e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b499e1e8d99c217bfda507c3b88877e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3441CE2E-E022-4111-824F-D429A20F2B9D}.exeC:\Windows\{3441CE2E-E022-4111-824F-D429A20F2B9D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94C46680-5564-4ad1-A671-86513C2AD341}.exeC:\Windows\{94C46680-5564-4ad1-A671-86513C2AD341}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{897B1FA6-F28B-4b07-93B8-1012A62DBEB2}.exeC:\Windows\{897B1FA6-F28B-4b07-93B8-1012A62DBEB2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D6E5653-4D59-4f55-B1BF-16352CDDDB43}.exeC:\Windows\{4D6E5653-4D59-4f55-B1BF-16352CDDDB43}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57599F31-9089-4702-819F-11E6E46D8FCE}.exeC:\Windows\{57599F31-9089-4702-819F-11E6E46D8FCE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9C2CD62-4DF9-408a-896C-6CAC24B545DB}.exeC:\Windows\{B9C2CD62-4DF9-408a-896C-6CAC24B545DB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60D12212-EF75-421a-8146-80A619E568E1}.exeC:\Windows\{60D12212-EF75-421a-8146-80A619E568E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DDE4B70-76B6-48e0-B8F6-AC64DBC20271}.exeC:\Windows\{1DDE4B70-76B6-48e0-B8F6-AC64DBC20271}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A86E995A-2F5D-4a05-965B-349807734241}.exeC:\Windows\{A86E995A-2F5D-4a05-965B-349807734241}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0372F843-1770-441f-9189-711C48A2D200}.exeC:\Windows\{0372F843-1770-441f-9189-711C48A2D200}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0487EB3A-F067-4db2-A079-DFD4AAAE349B}.exeC:\Windows\{0487EB3A-F067-4db2-A079-DFD4AAAE349B}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9D323770-8D8A-48b6-8FE8-D05CDFDDD4C1}.exeC:\Windows\{9D323770-8D8A-48b6-8FE8-D05CDFDDD4C1}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0487E~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0372F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A86E9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DDE4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60D12~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9C2C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57599~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D6E5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{897B1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94C46~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3441C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5bf2f54f2e8d7bc277646e18178dc695a
SHA1633a78df16767b20d4e3ecbc27ff948b67b4d4ed
SHA2566e32a774da365d88b986ef27b69ec769aaeadfa96f58bf4bafdf3ec09a469dbb
SHA51267c6003c33b849ed2252a8f95ac3d6d141a163cc8973d886a061e7fe3dc40de9e5e38fb9b856448ad7867a726ffd1a7a8f5be522cc2b50b61e8e1b5aebeda4bb
-
Filesize
168KB
MD54be2d65b2fc0cc75463c37ac86312f48
SHA1a91df3b1fbf866867a82642c9f5781ab42fe702f
SHA2564282131bd837cd1220eab9cc836fb54b15c2f5a317891d9cb65e95f325ccb7e1
SHA5125d65f437310491e201b56e7df36e4ec1ef3aa2d617b833cb599b1b2013311d2a43a8dc8229a859d642bd55d310f6bb795fc1eb8bb1c8802f98dc35bb7f649b13
-
Filesize
168KB
MD5701c06a48fe11a4ea9b02ccbd8bdea28
SHA158b574ee6fe34f5e8bb154fab3290827a3c29f6d
SHA25667c53b0d79fb336b18d3e9fb84f14aa85766dea564cfa48ae4bbdadea60c979b
SHA51293d6effacdbfbed63b3ee4c90be3b7441841749eeca9d9c3eaff121d8f931d5b1cd05a1e5f5f91eea79baf718efd36e69ded8dd01a62097428c398f2c778e736
-
Filesize
168KB
MD51b398b31ceca612a7ac4e7b3a822749c
SHA1a28762579dbb800bf045d3f0585171494b3f1e79
SHA256aafd448808eb4ba5f5d2c70c56d29f00c0c506a0546f3caef7e1beff7ea23f51
SHA512448b620e9d597ca71fb08eaf6a2fadb6e598391c8168d31303a2910dbac320c9e221c12db2191db802e63dc63cbc3707d22cfdf9e01086c0eb7f0b3f2255dca5
-
Filesize
168KB
MD541bd7b6099e22e7b8c7f08338993b9dd
SHA14c47acabe35071e0336ba521ca552e9ce6fb05cf
SHA256433f6ce90a108f19ce213806b7e3d50e913618d1937936e4e0bdfa728f749e3c
SHA512edcc2b2a97368c23127886c743acf998c921c57383d4bc1be6739099510065eaf7dac76c5b111a862b378766613e4bfe8fed7e940bcd90d73324b214a38ef67f
-
Filesize
168KB
MD546f13609a37c4d08f90cfc6cea48f8a5
SHA1256b6324e87d861c7c34dcb42a219ced65e65c1e
SHA256274bd9d1a4200962e4487eef8a86884a35feb7c8a48b8e0d240351d3645c029e
SHA512f03b1a8630145e7f2d596a1efae0eb65f7a87f28f0df60fa0756624f1d431a09266fa3520ca4f4813593528483875ecd8c0092d688146649a2dfbddb1bddb9c8
-
Filesize
168KB
MD50e15383548ac14e4dfb05718099bfb55
SHA1f319bd45a7c825497533c9452f548e88aef265ac
SHA2567d96c2febe4beab0058c30e816a122592739e6c25637eac14898601c73eef99a
SHA51291dfbfdb8319b11489fc556a04899e3de7f3fc3e186fb9b19c7759bdaff4838bc7cb7413eae2f96d10be92035188b5e8cf2069a1772da2fc8dd37a28039ba592
-
Filesize
168KB
MD58db2093ddf7001c4dc01629e0ee040fb
SHA182ba5993da40d4226975f44132d8c1083054e966
SHA256eba46d0fae06bf5ad7d0054a3b30edca073e4ca5606bbc8fd8bc86629af91253
SHA5121310ffd637a18dcc7347a9ac875e9535de72abaa9643e9008583094bbfaec6d31806f28e226e19d6add5bea5d2b92284b25a0b70b7eb05c16cffbd521621b06c
-
Filesize
168KB
MD55a787c17a594a58eb0129deff1edf670
SHA1e53b8f61a92fa885c08d40ca3a39cef9bc58ef8f
SHA256a47d279d166313313c2cc00fec197644b256c7565477200c7b418d60d917b63e
SHA512fecfb59d367d3688140841dc8680cee18627d2012315bd0eb4e4eeb03fcc1c7d139539212e41cb7587389a4940e9f41abd6283a63734ab6ebfc8aa253881d3c2
-
Filesize
168KB
MD53345ea5f0fc242d337fbe5771ab2b4d4
SHA1b429ebc946a25e32677adebb0cc00d5b766cfb3f
SHA2561195c0010a750052df9d6cccc5164f92bb38621dceaf4eef39864eef347b7d73
SHA512c9c701a07aa70e0c6a28cfd4978c70721388dfb98ecdb2e7c398882277effeb25501682e0b1bc57eff057eff9c86c7fd062082c34a0e22c6c6ec3affbd6fa94a
-
Filesize
168KB
MD55ad2a0bd0dd53b7bdb0db8ec598f0590
SHA1168c0a9c4fda5998500a04d9cbd34d25daae2318
SHA256798f3d5dc6571a52374a49aee25a059c04d312541b2a7964d4f9ce7e08b3b3fd
SHA512d2be9c88967645a289df0a450f2380eaec6fbfe0699caa01a0599d6a71b1839d50a15675fde516cf74a3624e517c2c577aef52115f056bba74ce461d1eadb500
-
Filesize
168KB
MD5cdceec1cd21e8d13762aa403a63a100a
SHA17810bb9e5734afec175520d3f22a9af90cb311a1
SHA25696a17e12697bae643fe7cf60a7756bf19a0671a9bb41ca14fc6d201d66c4ad50
SHA5128386d0434b8e71c42cb6b37616140c5b438439f741e1c7eb959ebdfa9e1da6012dced00d9c908f5ba91ad366585c2a60b1c662847e0d15cd8ac64f141ca5ae59