Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04-09-2024 08:02
General
-
Target
2024-09-04_a09993a37abf9c5698be4966c7651399_goldeneye.exe
-
Size
408KB
-
MD5
a09993a37abf9c5698be4966c7651399
-
SHA1
725201d73f9bc9f59c3ad2999c1842c4dd695201
-
SHA256
4de37176cfdd8bf25ed5acd0e2815b282dd7f4c11f13d6e496785318d6978812
-
SHA512
91a9e6df4eacf8a08f066a3fa2ce82ee2a024768e443607690bd0d3c881665a8f0ddcc48f37d33bf2d175f5e0f27b732e5dfdb3b6d642fe1b44306321a95a1eb
-
SSDEEP
3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGvldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_a09993a37abf9c5698be4966c7651399_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_a09993a37abf9c5698be4966c7651399_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{191E2392-D0ED-4d57-A5BC-E935ED13A8CF}.exeC:\Windows\{191E2392-D0ED-4d57-A5BC-E935ED13A8CF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BECD97E-3A4F-41f5-8DDD-522700B03FC6}.exeC:\Windows\{1BECD97E-3A4F-41f5-8DDD-522700B03FC6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CFDDF2B-242B-40e4-A3F4-F650E9D331EF}.exeC:\Windows\{0CFDDF2B-242B-40e4-A3F4-F650E9D331EF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E1C5254-7B21-4b41-BFF1-0019106CCD1A}.exeC:\Windows\{4E1C5254-7B21-4b41-BFF1-0019106CCD1A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{842A4F02-C30A-4fa1-A36E-D0282FDB5E1D}.exeC:\Windows\{842A4F02-C30A-4fa1-A36E-D0282FDB5E1D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FAC473CD-F807-4001-AE8F-4D78B9D01B15}.exeC:\Windows\{FAC473CD-F807-4001-AE8F-4D78B9D01B15}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B05FEA4-441B-498a-88B3-E59E9E1F0189}.exeC:\Windows\{3B05FEA4-441B-498a-88B3-E59E9E1F0189}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF6506A7-4C76-4ac2-8B39-1ACDEDB1EB39}.exeC:\Windows\{FF6506A7-4C76-4ac2-8B39-1ACDEDB1EB39}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{976116D1-5C10-4ba2-A046-1EF563698C7D}.exeC:\Windows\{976116D1-5C10-4ba2-A046-1EF563698C7D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C48EABB5-C879-4f9b-991A-10A380B582C7}.exeC:\Windows\{C48EABB5-C879-4f9b-991A-10A380B582C7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D6F0624-4FD9-45fd-A1AF-11D27BB0E433}.exeC:\Windows\{8D6F0624-4FD9-45fd-A1AF-11D27BB0E433}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4A7C4A2B-75C0-4c11-834E-E5AD2B60B757}.exeC:\Windows\{4A7C4A2B-75C0-4c11-834E-E5AD2B60B757}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D6F0~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C48EA~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97611~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF650~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B05F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAC47~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{842A4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E1C5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CFDD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BECD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{191E2~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD575e7166f580641c0eba9c53de7b54a7b
SHA1e4a237328ad26a45676b0013ee40ba6e161a40c1
SHA256ad07f750e7883948308087ff8c2cd283f6cf8fc12a74c2b26474d8c3e68f9724
SHA51234ff8c29111ba8c669d58196b0610a9908567df6a265490aa6014e1f98b675b7d2d596d249be93a7c6402b2ed4bf2f1a1cdaadeacff202522d42e8130d4cdd8e
-
Filesize
408KB
MD5d9e5066186c116aeda31fdd3bd43ece3
SHA187715c106396bc460373b47d00594418711b38c8
SHA25674d82897c7b2410789be3a5c6a382160d2115b450e3cb9d7aead80ab1c9c4110
SHA512dbcc1e474e032bad44fae469db6f163167782ca1d330d7da516e3be74355f58b1fb7c493fa787f533f91e4330395a3f64f98a6a24171d6ce91f99bf8e91dc7f2
-
Filesize
408KB
MD5e0eead0855a26c18315855b38bdb7bcd
SHA139dbefee3a78eff5aed67b92e3c37bc9f4abc7d2
SHA25686f868102ce97d875a39a23400ed9e60f304e9443894e21debf482a22b72844c
SHA512cab9b2c6bd4f3917d5c18f92e20229f68d031c4c9e3746c744a6c831204a6cb651b32a41a610ab2681f589f63741c3727984f08743b43d7dbc935d012bf8e594
-
Filesize
408KB
MD5bc97ee99ca44409c9f920738402eafd9
SHA1bb10b0d43c3332e98bee198808fc2157b7791250
SHA25618dc0b39a6da760eba376e59f97c2898ea42b2fbbabbbeed03161fc481bf97c4
SHA5121e9723e48edc4f0846781b3d32d7e0a12db3f88a0af7073fe778604c2cc4d5f5b45635b31cd5da1ba0011eea06c277066a3113d7b31a445f37c2b06cecb0a0a0
-
Filesize
408KB
MD535600345955f5351d700a5800e580aa7
SHA1fae0df5ea48c3305b02a9c6e54e06327ba295fca
SHA2564159e828e8aed5e694d18b1f1806f2f9ab215ba057e4f0671f50ea6dfe248718
SHA512217e1e3e302c4839a053e10bc42044d2dd940f7eef311f9e11f9a9ab829aec5d85aa27033335812fea85a1aec4ee3e897b5c95fc769d719d6c799d9e5ead68e7
-
Filesize
408KB
MD5293eada54122634879e8e7bc6492bcaf
SHA11cb984d67fa9d56e8d23925b9cb0a2a654df61d6
SHA256cdae88bac6858a19343f471d8f393471a4dcb48c797a1f42e479c0420aaf9850
SHA51237d13cefd65466750a9b959da1a19d8a57bb218d72735d0678d876504ce9409e478c0b6a7155016f26365769052bb8f3f7a867298833fa92e7a80a1ac6de6c9f
-
Filesize
408KB
MD545703954f58ce416d3b14a509c9a9d36
SHA17c5b48a1a7acb90ed202b4b418631965c358c49e
SHA25672de205e1a4b771b954dcb57c7419b13c0f51259c5547f8f7ed196961c5aca11
SHA51293fbf62507ab71a0561d47e7cbf87dca2f92e1e2dc6bdf5348eb304d161fd599b26fcb4958380282de679ad4c09befdacce98065e5a03db7b162ea9c3ba3ff31
-
Filesize
408KB
MD5bbc979b85a198e08dc9186ae93a24e72
SHA1deda441b7fe93915554dc70be25f12491d74c580
SHA256ec13d7bd86658d5e9083c9d40658956c4a0d5673c9d0b20ee3aba07246521672
SHA5124ebdbd15da9aff8a04f078abe156d2fdafad479cf6655ad2c70cca4427e317a693779103fdf8502c7f117ca21325e48ed9195db8e63ee2e2d551a22716d3e777
-
Filesize
408KB
MD50ed920b369a6af5788be758534e98f32
SHA1fe425b1f2d1616e310dd49c1f68d1972623ae679
SHA2565e5bc991ea3e8923d1ac59149cf1a29a7cd9306d87cc1628704905375b3f4e90
SHA512da9f631e0a48f2c4804fa96806ba9dfd5f8785a513d0e91bc679382b540f47e1a083b7482983375177ce13358ea66a96266503f5e14d4eb9e5272f9551fd6022
-
Filesize
408KB
MD5b04c523dae1bb87018fb86def90f11e3
SHA15f7a7f8e1a035918b175e892dd28efc33cb3f224
SHA25617b676ebc36c7e1261ab8a91c09b91080c01d2fde86f02e25ae7ddf1f58c6d7c
SHA512cbd861cf4b5fc7d3c9f8f1faef1d5a100aeeb8988639e2e2d1dabe970e6efabacad3a41db426817ab95f7517a175e1d03195089f332bd89046df1bfec20e864f
-
Filesize
408KB
MD5b058b8206d786267c1daa2da6d048915
SHA1d58e5c2995aa48312a981efd4f1e64263720d3d7
SHA2560a3b7b50906f8ad63bde8282dbfc8b51a1bdf7101c1311ef57ccbd9b807f8895
SHA512264dbb5d6880d8fb141d9a9b4e566e74a5bc0cc4e9f91a26f7f56d36760c39c7c85234581c78b9f87391a4ab251ea615168ca36a6da275ed34e44930786214d2
-
Filesize
408KB
MD518d36a5ce3e53c32f535630f9d519731
SHA13d7413f89bc7fc3ed55ea22f021fec0a4e2f8761
SHA256d4184647dbfb1b6bcf7441a93f48384c1721d000ae00b555d212f7e304338c54
SHA512c67a110ff883514c236c7ab2ee3b508cd9c67ba3182fe80bc413e8a441884121cb60145c2de3e651bdbf924281af61fdc83d31ee11cad5a68aaba8286d462c6c