Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/09/2024, 06:06
General
-
Target
2024-09-03_72eee0c77e748fa0100f2fd070410e48_goldeneye.exe
-
Size
192KB
-
MD5
72eee0c77e748fa0100f2fd070410e48
-
SHA1
4e6a28d0cbc9846bd91207d2198d6294bf037b1d
-
SHA256
2a2b0e97d0fd262c10207dcdffc51ec9d191a0e99c11fe4aa3a131e02533cc4d
-
SHA512
4109b119cde0ec52adf345f0b9d4272593f7107418352f22b836d8db239fc9946fc274e0a118e5bc2c32d459c9b0332228173e30e1b7a9cf5689c9d865061370
-
SSDEEP
1536:1EGh0oJLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0odl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_72eee0c77e748fa0100f2fd070410e48_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_72eee0c77e748fa0100f2fd070410e48_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2053C7BD-5190-4747-AA7E-799F4B0CDE34}.exeC:\Windows\{2053C7BD-5190-4747-AA7E-799F4B0CDE34}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{516142F7-780D-469a-B99C-0815901624A0}.exeC:\Windows\{516142F7-780D-469a-B99C-0815901624A0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5297D65-4734-414e-A7C9-DFDDF66EA6BE}.exeC:\Windows\{E5297D65-4734-414e-A7C9-DFDDF66EA6BE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80048CDB-65E7-4a73-8E3C-4493E9945D9B}.exeC:\Windows\{80048CDB-65E7-4a73-8E3C-4493E9945D9B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B2065CF-C707-46e5-BCA2-2187B53A4B5D}.exeC:\Windows\{5B2065CF-C707-46e5-BCA2-2187B53A4B5D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{784C81A3-5E34-4129-AB53-E117A43C8390}.exeC:\Windows\{784C81A3-5E34-4129-AB53-E117A43C8390}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{561C3BC5-2CB9-4940-9B93-9FB9047005FD}.exeC:\Windows\{561C3BC5-2CB9-4940-9B93-9FB9047005FD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAC0A61F-4C17-4a67-87C3-16CE7DBF72FD}.exeC:\Windows\{CAC0A61F-4C17-4a67-87C3-16CE7DBF72FD}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B1D3896-6206-41f0-8A30-9627B5FABD3E}.exeC:\Windows\{7B1D3896-6206-41f0-8A30-9627B5FABD3E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50BEC082-1B68-4467-96FB-2A28C636152C}.exeC:\Windows\{50BEC082-1B68-4467-96FB-2A28C636152C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DD90F39-AF4F-4515-8CDE-39F098A663B0}.exeC:\Windows\{0DD90F39-AF4F-4515-8CDE-39F098A663B0}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{025F7905-BF45-4ea2-BBD7-A7A9BE605FAB}.exeC:\Windows\{025F7905-BF45-4ea2-BBD7-A7A9BE605FAB}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0DD90~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50BEC~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B1D3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAC0A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{561C3~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{784C8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B206~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80048~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5297~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51614~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2053C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5f9d8699c283cb9afcf58d6b0c0918d91
SHA127814d8be4f25597528170ba1628608fb081665e
SHA25676a15fd2412c99ecc7f5dcd5e3554a8427dab307a82b5b948de95b5c39c889ef
SHA5127b13b5184b580f420147802605985060edc7f9a51944d1445f39b8d051cc0ef9b027a90c1b4a5bb8305db738090090c446d04c06efee82eaa7599be9816e10b1
-
Filesize
192KB
MD5a0f6843e0a23c2a6c1249e41a25f924d
SHA1ed541c755af2b50aa5bd77108fb7b42199e47d33
SHA2563f8e6cad1c64ad0ce562c2a68f3878c8539b64779ac172e1bb86ec5e42f876e4
SHA5123eba5becef4b09d83f35442bea0603331b0fd1c5f6c928801240d7e83f3d96975dce5c908a617c4d272b3aecce146baa888d74a35993b759337697b5e5c69365
-
Filesize
192KB
MD53c4317faa85fd9cc31f4c5a70bf9b8f7
SHA163011a44140848ce7dbce6226f3c0638b5c0b7d7
SHA2563d7ec9ac837ccba6948645d7590bae46ca66d07504fbf58656aecbdfd172aec0
SHA512c73689113c889aea4e45ddcec5d1046a1bc1be61a04f5ceecf97a888362dbd58255d8176f1a5c8491df068a84bbcaed30af19723b15f5f255955a9f085c3a8e4
-
Filesize
192KB
MD5d4bb397bf0149b16d0007dd2982cfcfe
SHA1dd2a1486b35c88c5dd182be3ffa9fc45a4186a3a
SHA25693818357a37097689ddbfdbd64f8f76c12cab1e43e526e8524a9ee827977c2ff
SHA51254c4556af436cac0c9572b06a9a71c40d5553353ba79524a0522433eb6512c195c3a791bbde1bdecde91859c4743387236c94164dc5ad7a5529ebc624433978d
-
Filesize
192KB
MD58f369b61c31ad36f17c04e4506c7809f
SHA1274ebb42093c0af9a47d43e06b35f2f56ac648b5
SHA256731928310c92cab3c2a9c8ed6189a94bed2cd91c9863f3c2c9de2fa9ce57435f
SHA5121b3ca4f87cc0ea28e7be3d1fbc730b7fa88998b9da22243c79e705c68663b4d31256331d2508610de544c51fe5e5dd86b77ab353d6d5f77b79b1b184c8a451fc
-
Filesize
192KB
MD5cac1949e9d52dc1fa06eb067bf6bfa2e
SHA1e0004c7bf439d2c912fde038efb9ef65ccfd1273
SHA2569ffa56c7a1d0d6485d7181998078966ed75b4ae0d1984cdaf6124ebad2f8908e
SHA51286ed1270d3cb84a47ba94d930abdd51e1daf13ecb53c0e4fece61ddc1684fad1c8b3401d5a998f5849536640d98312746c3235b7fe11d15c4a9977b292da74f7
-
Filesize
192KB
MD51b5562bf0cea5bdf3428fe12bd4f59da
SHA1abe6735a72e7e83d307c8c90e73770f8768930fd
SHA2563027f6f5fc353a647d667b6a3d2951b86b82efb4155ff45bcb65e56dc26d1a2d
SHA5126898e51ab52b7801a7edf80af699734de0bb38be3a61024a4846ecbdd5db909dc09cd04138c3d30c26b32445429f12c20a57e28342e05d0438b4811f9447343e
-
Filesize
192KB
MD51a02b2ff02f629f0d832206c6ff124f2
SHA18d46a397b99936d2cfdeca3af27d690586b50a25
SHA256fd62492e7a831c39f468570ad4f9e4cef1542c26aea611ab8d2a8754faab1782
SHA512888c0b50352a0721c8152a5129f3b274d4296d4cd49382c164e2c6a2552d4536fd9d21c9da099b0752fb51614d71b8607909ba59f97eb5e5cafa23b9960640e1
-
Filesize
192KB
MD5b5f023770c6843c1a85f5173c586f634
SHA132925ebbf918d6a41d7b7ff280b8834161241186
SHA2560aed0abc0ffca2baf06e5109f5c996c5ad0248101ec569baa8aca5dea7373df9
SHA512a19a6ee86209031d3b3bbf4c93b4bb1a809308a83247b592fa0abf1dde9a82248ae1d45a798eab9b51743b32ff55893d4b35aa5c72c13070e4d3a87a4f846547
-
Filesize
192KB
MD5d9f4b59179063e8ac339f7d819889508
SHA1ca5f2054ed7cb62d4c353f107550534351771096
SHA256199f4f7cf2f443794dcce791f2f739bc52814ac6060bc5d150135f1c04013b69
SHA5120cee140a613641e98becba6016eefd127d9599c3c32dc964c35fdf40006c1f7130419d8527de9c4a7edfbaebc3ccb247eeae338feaf8d637b790415daa5c9d9a
-
Filesize
192KB
MD5f602495236a47ec0f34bbd3a39820625
SHA1b06a4cda957c6dbef9c6dc4d392919e8e2118c72
SHA256736bd5e9bd3960ff1160daa1b6c654f4e1a3d71e0f197098edcbbc4e3390b431
SHA512be21f7ba21c9faa95d3534da002635d802df2e848f935bf55a68af503b12b94d77746d0ddd4ad25631251b696075cea64b57a053101ca0b1bd4a0e829c00a3e5
-
Filesize
192KB
MD542852c6d0796dd0695932cfbb1d6c5f5
SHA15222bd079488662fd35e613eb3a75cb80ccea2a4
SHA2569870ebf80f1cda0ae15b66fd7aaf9bb0ac14ffc7719f14015592583460e85ed3
SHA5127ed6e18ed797587fb2367a9b127c00c1dd4d1faa967446e363fc9d2f14ff8eb1a6694689e4759ff846c6427b039af4112f2f005791bd9d3a9712d552dabc0902