Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 04:06
General
-
Target
2024-09-06_e49e1033b65840b1618b04514d6c913a_goldeneye.exe
-
Size
344KB
-
MD5
e49e1033b65840b1618b04514d6c913a
-
SHA1
bb3fd0e30377ca368ac55352391e057cefeb630a
-
SHA256
cc7f30e2d09ab061d70e2b762e120c34c1df4ccf626f4fa32475907cf2e3b97d
-
SHA512
6f1555754d31aedbc37fd5874bcc239139a44463045069502d64a93de4d2c7357b39dda36b549e3e476352687e14994f4976a2a72b833a84f94b7fb5dfde44da
-
SSDEEP
3072:mEGh0oXlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGRlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_e49e1033b65840b1618b04514d6c913a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_e49e1033b65840b1618b04514d6c913a_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2567FE16-D28F-478c-9689-27CBC73955A8}.exeC:\Windows\{2567FE16-D28F-478c-9689-27CBC73955A8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A21CBD2-B5CA-451e-9659-126AE0D15926}.exeC:\Windows\{8A21CBD2-B5CA-451e-9659-126AE0D15926}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F641CBA0-90C1-4b51-8C62-35705C732509}.exeC:\Windows\{F641CBA0-90C1-4b51-8C62-35705C732509}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C6332D7-579D-4153-9245-6243EA5866A8}.exeC:\Windows\{6C6332D7-579D-4153-9245-6243EA5866A8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{263DA861-DA52-472f-8B6A-0ACDBEBCEAB0}.exeC:\Windows\{263DA861-DA52-472f-8B6A-0ACDBEBCEAB0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D458490-1AC6-4118-9DE2-165ABD89F4EA}.exeC:\Windows\{1D458490-1AC6-4118-9DE2-165ABD89F4EA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44221C32-4A74-4018-9448-186678C0B470}.exeC:\Windows\{44221C32-4A74-4018-9448-186678C0B470}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C057C81-A026-425a-B47F-6E4AB807EC03}.exeC:\Windows\{1C057C81-A026-425a-B47F-6E4AB807EC03}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08392E5A-971B-42ef-9598-F52AFF7FD821}.exeC:\Windows\{08392E5A-971B-42ef-9598-F52AFF7FD821}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94A12B1F-7545-4471-B417-004780AD00E2}.exeC:\Windows\{94A12B1F-7545-4471-B417-004780AD00E2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3195CF19-5A68-473c-90A4-B844E4EF8DF0}.exeC:\Windows\{3195CF19-5A68-473c-90A4-B844E4EF8DF0}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0EC3B526-12A1-4252-B03C-B9B3A0989FB9}.exeC:\Windows\{0EC3B526-12A1-4252-B03C-B9B3A0989FB9}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3195C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94A12~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08392~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C057~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44221~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D458~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{263DA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C633~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F641C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A21C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2567F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5d26e5d4bfff01cd1a869527c7a87681b
SHA1ddf11029ce79ab638656ad2d0bdf1dd1fa1ea3e0
SHA25698731b43b997621ca3dfc61ec67ddd32d15da50d7a3ba8441337ceb03429ea74
SHA512cb66f895770c8643478ce42511a1f91a63bb3721e99c2a6e16137c1f4af1b99bd892cec049911106cff3bd511d3e2b9ef721e6ca51680561f3d081288618aacd
-
Filesize
344KB
MD54339191e88e474fc63ce7931c86e160b
SHA16828564e7af5778bdcfed304dda9cabcb592df70
SHA2565486aef57529ca69849f5753133fffd68e93bc6e8b00c7a47723aa5772322d4f
SHA512904e5c9343734f0a16255fb2b5f2f35a2f1dd99893dd924bc80ef2349aef02e17d72a253b9e8808a2d3de4a59e98452b3a8214f65ae56c7228f7b6d561341085
-
Filesize
344KB
MD557bda057b3f323bf0936dd33f2496869
SHA16f113be6a13a1f1a66591ac4469e0d825419e476
SHA256ceeae1cc55acb8eb5088106da6a2b9a20b4965472494feaa6ff58ec93dacd35f
SHA512d8e74ae8ed3a1a07424b17acec06c0b7c04cedeafa3ef9495604119d29591911f48852900a46a96b5404488b7d2e77f7353960625a89a80e37349fa68b29d604
-
Filesize
344KB
MD5cf092615f60db90a5201983b3a43ddfa
SHA1e8320ac42a3f42e7b5bde98ba1e156c749344998
SHA2567abe315a875116110ab6e2d8e5c2f17be3302bc9c48f32daf683aaa44d7dbc74
SHA5121e3aa79d627161c9549779ac13162ae995c384f678d79433fcda29707ee6f68eaa32e2b206a6752add7da1d5f37755cf53932b1fc2db1e8b8154af861b751eb5
-
Filesize
344KB
MD562e22f662c1036e8b3a678450284c08d
SHA1ad4c89e814204df9cfde04eb359c2945788d9626
SHA25637e05527f9701dcfdbacc11b4f1f7a6a64b1d3cc4c955633bdc5b4fc76919e6b
SHA51275be319b03836ad14d299975a5c4cfc16b0646a4c1f8d1b146f8d74ea00f16c3413867e537447997baf9c253ecafa743485bd4e0964eb6100255c31b30f55ade
-
Filesize
344KB
MD53673e98b8bce16306bbe7b3d9ebf9e7a
SHA17ecd1017500f3be21de3410f51b4976767d5e615
SHA2568c26c44133bba865d4cd946af9f11d781af5bdfd541e7dded2319755ff6bcc0f
SHA512f855aeb35463adca4e44be38b6657fcc3a546323a3b98c32f284a01bd6cbe295d34588c68b076756666aa9d835a00a965bb6e8fd4b68f02a61f6b89f8eb221c7
-
Filesize
344KB
MD59225fdb62c4cc35f4fc76b9a6bda5032
SHA12eb9d0e486516f203996b78b81637f648314a7b3
SHA25663246f08bec5d1a6f036016a429e0ceae64c85f61d7e1c38482ea21bd2a98dd2
SHA512a7cffd6110c0ddee8230d8df03a36038edf9ef09c99b292f98c4abed0613455bb329208750136a68c707d0d748b839df457e559066b43143802695ca9e23b57e
-
Filesize
344KB
MD5c61f06d49a682867da73ed564f0de715
SHA12f61e3f95406546be5618c6a77a583b4cb19f4d3
SHA256f431bacfeaaaaa3e749029b404b697456a0ab18f4f97fffca4848d600698d512
SHA51204481ca04e35c2f9f0fb90d44dafe3cad89fb62652e0dd0cd063ad18ae534e502cb27f6fd73bac0073591b1c6fb23e71bb62a23191c248ee8eabf7bd5716906c
-
Filesize
344KB
MD53f054a9c5bafe56b3e007fff1f2d31f5
SHA1edba44b1a4e9ed8bcc250b42292dce877c67a458
SHA25659f0ad75eedbcb0013f378c203ef6bbdca52aac3f15a1c36e0948c366c9633c4
SHA5120f913a1956ec8dee3125344ce422a5f8b6bd1ac52519e05dbf70c6ffb99397574e77fffd107380c8a73f84a58e4a347bbfa0fd9be80aefe5ef1a71c1b9617a9c
-
Filesize
344KB
MD530ec460d8904e6bbc34d672e463ec275
SHA1c499e94324511d6d548538c79df948339fde7f9e
SHA2565b39be3940fb5e90e0d52e9bdf91f80653768884d972da01a32c1ece27729f10
SHA512fd5e382a9918e226fe371b7c4694ccbbae6e77db368e66ca9dea36a10bd7b2988e37eb5d4019b857edb420d0d2a76968b1785c1ef13f5ecdf73cf355e53b8c6a
-
Filesize
344KB
MD57fd488807fa425cf308fc04b6dfd92b3
SHA1759db5cb0ec68c7464258795baf8ac7a36b50e76
SHA256d98d414f86794d6998a0289a86b739480b6b04de2b84b310eef8e87dca5a27c8
SHA512dd6f36c9983c728808249104f41ab0496813ea9a203181c48548429c009b18160edf0943f5272d1aab52754c9288623fe41ea30d08cab774b6f048e6282100b5
-
Filesize
344KB
MD5e26895941fc014c80969237bda846d5f
SHA166a96d6a02f35dea0b7b86284e0e1faa0fa5a80a
SHA256e6ecc7fa80ae2d45f4e874ffa35f9e10302bc387282419fa18075ceefe7b48f2
SHA512bdeaf4eb1897bccb8487f7536a4c8461fea0d305d4a59b3a6ff08cdc994c6c6b4a910cc6c041e2347705a3f2cf7ebfbda6c2c9a14ff86db2100da388bda48c59