Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01-09-2024 09:50
General
-
Target
2024-09-01_1ff6f3cb42e242825ee5e576cad00e83_goldeneye.exe
-
Size
197KB
-
MD5
1ff6f3cb42e242825ee5e576cad00e83
-
SHA1
365a3d93345f7dd26896d679a7f48c1d776eb70a
-
SHA256
76cdbc2503f69e94042422c7b02ffe3de39f956689102aaa1caf019167242456
-
SHA512
f1b7b912d145dfb1cb7d043651fb49407cb45b52831bf8e448ecb564d5565961ef6b940a77d272ffe3572fb1c50c5a072889ed458e087b0cf59e97110d92bcb6
-
SSDEEP
3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGzlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_1ff6f3cb42e242825ee5e576cad00e83_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_1ff6f3cb42e242825ee5e576cad00e83_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2312D659-70DE-4c88-93B3-87C8F4EA79DC}.exeC:\Windows\{2312D659-70DE-4c88-93B3-87C8F4EA79DC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81A5B4BE-2E25-4b71-BF1A-579CCA7D9743}.exeC:\Windows\{81A5B4BE-2E25-4b71-BF1A-579CCA7D9743}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6C783AB-F911-4cb4-AD69-4F6F7FD21586}.exeC:\Windows\{A6C783AB-F911-4cb4-AD69-4F6F7FD21586}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B4E42CC-BF77-4025-B3C0-381689AB34AF}.exeC:\Windows\{2B4E42CC-BF77-4025-B3C0-381689AB34AF}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{994574AC-BCED-40ab-9318-26599BE18C0E}.exeC:\Windows\{994574AC-BCED-40ab-9318-26599BE18C0E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03E185F8-2915-46d7-9BC3-9E2F71C765E3}.exeC:\Windows\{03E185F8-2915-46d7-9BC3-9E2F71C765E3}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FC1B540-C196-41c8-BE90-4A51419ECA77}.exeC:\Windows\{8FC1B540-C196-41c8-BE90-4A51419ECA77}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EE657F9-A8B9-4d6f-89D0-532172920886}.exeC:\Windows\{7EE657F9-A8B9-4d6f-89D0-532172920886}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{601F883C-08C5-4877-803C-571B8D2EABBF}.exeC:\Windows\{601F883C-08C5-4877-803C-571B8D2EABBF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B462A280-BDBA-4df1-A96B-8CC3618A77E9}.exeC:\Windows\{B462A280-BDBA-4df1-A96B-8CC3618A77E9}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99DB3DBE-F0B4-4f4e-816B-170CA3C49484}.exeC:\Windows\{99DB3DBE-F0B4-4f4e-816B-170CA3C49484}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8AF12373-A7B7-4c89-814F-69B79C2AA823}.exeC:\Windows\{8AF12373-A7B7-4c89-814F-69B79C2AA823}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99DB3~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B462A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{601F8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EE65~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FC1B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03E18~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99457~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B4E4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6C78~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81A5B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2312D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5f7ba0143bd331cfd4e4edccf1a2aab4b
SHA1aca44385b2e7b538d80ba95d113f755704d9d7bf
SHA256721b7209cfc0c62e62eb57d382d1654cdf73ff9522e1f0f86b987e9b67eaa64b
SHA512c74873e900d22cd3ae424de7c560684c4826ebd231673c487f902bfb8d6944e6d5be8b59d518155483e3125be74927b75d9968d69ef7a3e0a17baeb3b9758256
-
Filesize
197KB
MD5befacc2ac538bde553242a1e242b7c94
SHA1e412727c6c4d2d61a5837bca40f902d34b0f3853
SHA25637375443bc7547299262b65a33460dd30542fdd370ed34233703624108ed46b3
SHA512b940cae662deae16b221803ba50b91a3aa5b263f1cc784b336e0237e1d371d9cad0fe8b0aa09be44ba40ff0512da677e0417a991c379756665291ca5319453c4
-
Filesize
197KB
MD551b553f5a86f3dcd07dfad2831a9f3b2
SHA1fb6d976350a6a28701223f88b4c53faa413ac031
SHA256c3ea3511eda49b5a5bfa69c6fe23d7fc268110044dd693c8368d0bde0b64efb0
SHA5128f6e9d9a47700b73421675608f25dd34f7f6b3ca4b6bbde3b028a52e35294fb46de4e22e0c756868509cb3e529107e27081017b48ddd6d7dfa13d2d844bfebda
-
Filesize
197KB
MD5525f0691ced8247ff77036004e74d220
SHA1dc2fd0a32f15441409ab2ccbdb27175f3455d125
SHA2567d5a5fcda7a81504612828840d5490235615bed607460f190ee03cb42a6173be
SHA512e878d6668068f75e8c641b33b7b7c24047df808d0d21b898b316923b36853b6be30e280e01c5cd5b5e5479d9d7ec4d212413fbc3a520f866fa59b094e01454a9
-
Filesize
197KB
MD5a7ec6f5d0669645e1e5fb2b4884d8dde
SHA1d130a01c4b76e3cf0d13cb58b6b39739d5347efe
SHA256ec4648829f022af9fe1859c96dcb62793a2a161992774cf2a44c2d72daa45797
SHA512489dc013d1322eb6859876336d4abf2a80c5d4042086cec3c47b6dee3f6e0b43bb69f7d192255dd3fa44efaae488a909d3e70bdfe5df6795f09021322cb8a3cd
-
Filesize
197KB
MD567fb6a2a6d2ba6cd409954ce897356f7
SHA18efee95bcedd4786ef0aa8c250a1fc9621f35677
SHA256aa360470a5a39201799d4e5432e703d094038c98a3da99a139a45656b71e31cd
SHA512baf93df6f6df04d7c8a24be52023958a50ffd356f9d41d4f0cb998f6315fa32be62b35f4c08ed880cd9fd0363ea665b464e23e1c979bca809ae5986e088bc067
-
Filesize
197KB
MD5d66d9167985bf655b7718e0b955ecc82
SHA12901bc7106dccbf1befddcc1ab10a2d768a9dd6e
SHA2565a9c273162afcba659cfdd33187ef0f379e56508ad4efcd43e4557d83c2ec151
SHA5123a1025837ef13c641ddd5743f485a46a46d9667bb0bc79ea8be986e49a40154aff9bff7e9a1cc09583b1854c5e51c529f28fdefbe10c37538dcc7050755fcd57
-
Filesize
197KB
MD50112af4695e00110d1e7f2bbbd8678f6
SHA11af2e642de618503c56f7bcba6e962569a48563a
SHA25620c60000bdcf46ece1547aa2104e621309940431a6822e38ac879db7de50a075
SHA5125efa91ef77b7074ae024f1be80303d71abb7403251d0ac46d66070af81e3f3c8b2cb972b629f4e07768f07583715edac1dcd9344df8ddf630ccdf0b8618bd9e7
-
Filesize
197KB
MD552fd8eabdaeb2f42c69eccbda3c0d215
SHA185c8eba2f7a50ce04c6ddbf7d4ff9cd8c8cd38f7
SHA2564098930dcbd0c36e020a0e21a345bc7b467f6c2cc76fb4d1c503dbdc5cea53a0
SHA51288eaedf4ba8667e7c5eba9d6e85063e03e4b7470611289d3b52ed6b7e180c2f149f7e9e4cabbca81f161873b3900df92210a8a936f67e8f9452217d5fcfd8087
-
Filesize
197KB
MD51d880a95dfeac3db05a96deb390f4b8b
SHA1f0989c6e28c1921db0b939a594564224cbe3f121
SHA2563249dc082960934d269e4395e3aae8cb473939b7513c78e5bc12c93ab1461d54
SHA512e717f2dce98a3aeeb09b0f01cb37735c8ad0634db44abd8d8716c4b1868e0abab4abfd28ba86de2a658f7b405e164c539712e059409f8183634a118cf2df6927
-
Filesize
197KB
MD56ee203b2ce24cf1416210e6a9ee7d534
SHA19c3336c23f7a1654018f1bfae2dd575faf2b9897
SHA256d07b000e743b1fbe1fc56c506b847e80d4a63373fb3635e00c1119ecf18e8fc5
SHA512b2a4880ee59506a4597093247e9a74a7d447a4fe61b5d3dd118d17c6145a492f303bf59176190a77f6a2364bf6d0f1c6a2886d719a998ef0a992f1b8010ff09e
-
Filesize
197KB
MD5c0af87755b1899e754927131bb752f56
SHA1a01b5b15b6e7cb2cb5db52036d83142d81805c11
SHA256ef4c3a71aaa55753ecf3779388fce9fbd4f70bcd7d29d89e992aa6f9b77153fa
SHA512589265c21e6011ad7328edb307f1d05bf16a2e79325c6b4c8755dc05ecff157e91a997c654c4bbdf07a96d2fe3d91bb56d3772fb6025ca4eb2aed92f5a5b5da0