Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 06:45
General
-
Target
20240905692eb2216fae43dcd755d3a5be625e7agoldeneye.exe
-
Size
344KB
-
MD5
692eb2216fae43dcd755d3a5be625e7a
-
SHA1
bd26f7ef9ba93fda37eb7cf2c9c9aa96d62af055
-
SHA256
b9125ce6a26cf789339e26872ff6d63ff2108d81dd3172d81190070afe1a53bc
-
SHA512
0b853e9447398fe0bb355cba9d1916d6f5703eb8316b7524a6f8a12ac4dcf0ecba3311d170e2ddad8c66a0baff420d40984684a47c58af8ffce8d37865aaa48e
-
SSDEEP
3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG3lqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240905692eb2216fae43dcd755d3a5be625e7agoldeneye.exe"C:\Users\Admin\AppData\Local\Temp\20240905692eb2216fae43dcd755d3a5be625e7agoldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89BFE785-D1AC-4f10-B9F4-3F238EDC5ACE}.exeC:\Windows\{89BFE785-D1AC-4f10-B9F4-3F238EDC5ACE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6806353-427A-4bc9-AF6C-FE7347B84E93}.exeC:\Windows\{A6806353-427A-4bc9-AF6C-FE7347B84E93}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FC4E564-0F9C-481e-BA95-3F10C911DE9A}.exeC:\Windows\{2FC4E564-0F9C-481e-BA95-3F10C911DE9A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B1A9AD5-CBFB-4d6a-9AEC-2FF3471CF066}.exeC:\Windows\{9B1A9AD5-CBFB-4d6a-9AEC-2FF3471CF066}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA08805F-4375-4436-8EA5-0571F7FF8737}.exeC:\Windows\{CA08805F-4375-4436-8EA5-0571F7FF8737}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA4F7523-84BA-46e9-91C7-6AFA2C22B0D5}.exeC:\Windows\{DA4F7523-84BA-46e9-91C7-6AFA2C22B0D5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D762DCC3-9BD9-40eb-BD4F-D5EDCAA39B8F}.exeC:\Windows\{D762DCC3-9BD9-40eb-BD4F-D5EDCAA39B8F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FEBC103-8AEA-4ae6-861A-69D38C17704F}.exeC:\Windows\{6FEBC103-8AEA-4ae6-861A-69D38C17704F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D61661F8-631C-4e87-91CF-3A1FB82C15B4}.exeC:\Windows\{D61661F8-631C-4e87-91CF-3A1FB82C15B4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DA56547-EC77-496d-8C28-9DF202DD7162}.exeC:\Windows\{7DA56547-EC77-496d-8C28-9DF202DD7162}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D75B5B8-963E-433f-BAA4-9BDCB602E7DA}.exeC:\Windows\{5D75B5B8-963E-433f-BAA4-9BDCB602E7DA}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{28F92077-2C84-4fca-95FA-B4EF12733C62}.exeC:\Windows\{28F92077-2C84-4fca-95FA-B4EF12733C62}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D75B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DA56~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6166~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FEBC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D762D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA4F7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA088~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B1A9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FC4E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6806~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89BFE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\202409~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5918c6d447897ba4d4abbdc9b0a6eb41a
SHA1023a65849c417af202b5d6eea95bc86431f55efd
SHA256e7087c2ed7577464e7d7dbaf6e654810d1af37708d95db73346f75a45a972df1
SHA512613e94bc27c7ccf06d2976503897886d61d3cd4fb031b4fe80496a223c426b88b40cef8bb11dac0d2514fb5d6a8ac1dcda2ed33d0ac12f1c829b6abea10e7cd8
-
Filesize
344KB
MD5f7429c9f0536c29c47984101ba09bfcb
SHA1155d800d9a78f85e1e7158059176e49d772c6a36
SHA2563884dd264adfbef3ec3e1f8d63cc1276aef3834628f9b1d08b54a435b7f1d431
SHA5129d26c1c33aa675f5db0981a20743ed019548eb7c845022c72ceb3869af8ac8b2b7878171277058311aae4695b73e77de11482f989c9796a38d409de1b93087dd
-
Filesize
344KB
MD51d12c085a5a14efcf04bd9bd483ae329
SHA1d85281fabee52cdb1fc3b62ba2d19918c03aa173
SHA25648a12cdc243570d0ad0ce6b3d6941fb87f38898e201f8b187a19b4713be75012
SHA51212113a469837fc0e3c9273e49bee4a217722551a4a9b0d47f889fb1c945299fd4c61dae66c329cf807d21df41fbbe8a742cacb1d6091c54985ff6b0f54d1f3b3
-
Filesize
344KB
MD583886a7ad093cbd13995287355794f29
SHA13f53b1c18f66a87d023714ae931c7c643f6e9dab
SHA256ba7adf8758c463cecc880d0d2997c60ad890db50e13cdb6f4db059d18a91be62
SHA512b596f76f9451e05c7f99792f5464573c16687bf203f18767f295d1b2f57f40989e7f0e01d08489694dbf238fa739100a6fd099557e88bb5a267b872fab39ed32
-
Filesize
344KB
MD53c5fd44df9597d3f2dc8d723c3faf153
SHA106895535a814c67d91158d8fae23c2413d4bf515
SHA256880605cc76540e78909dd41dc024f6a9fad7123735b8546c86f68bc4e8c85661
SHA512cd7786c84151ae93e177f47912d8784df8b6df6f9b60112c2ca41f414cfe300681822f8273c56385800563e47dde6aed69190c8e0365eed1f3ab5cd7c90b87dd
-
Filesize
344KB
MD56f5aab455b797084a7b12555ed834aac
SHA14c629e7857b2d77b7fbbed57bd8e60e9ed72b5bd
SHA256c056bc20373a695ac4f2b300040dedba98e5be6617deae5c9ac79c34fddf7737
SHA5124cf1c0c631a7d49354064c2550b5c0aadcc49ee8c65fb0708cdbef39f61551412e9839c70952eb29f6ecc277782af8f1b053167c05709cfd81227031159b2a0c
-
Filesize
344KB
MD5594360ec07a3cf783aaa1214dc8f75c5
SHA152f9ee5399ada2479444cb055e2d2806beb8a4b0
SHA2562ac6da4110074f24c50771e71870d112b9ec54bb17bf410b484b80ee790ebfb6
SHA5120918992e3a65ced890a6e54f696ec4af2c8ba6d8e6f9cfa8082dc32070ad4531cbc7e39acd78d8ef0a9664dfe56258bfc59026feb3927043f4efa669ad59e3ee
-
Filesize
344KB
MD5aa8e146fe40f451c3b67b4678bf08076
SHA112c93ac6b3d32d562cbcd426b02e7581cacbed92
SHA256ad3450e5457b11b2e2347a1b61de21c5623868b05648afe45611766dd48e8c9c
SHA512442d0262563fcda4a935408579865d46a36b485dad8fac6f6cde396deb84af8fbafbe1d3682b379f9f3b1f27f1b94aed2927ab78d7eabe0837668cd1d34e2e3b
-
Filesize
344KB
MD549f895d0249e80e6b388da5209b34bf3
SHA1820804908fc8cc4eba8a851e74a12127167ab7b9
SHA2562f92591e90e56ab250cd3c9f6e253fd58e1c8c5a2158703b8fcc415706ccd769
SHA51276b29690332d31c4d06ce5f4be25fdb2a5faa6a2e259de447603aa10eeca6276222ae43209ac9da0534d77e4186d18c701afd567d538019f0a3d4dc65dcdcd5c
-
Filesize
344KB
MD5d0d29e4f2890c2091ed0170819568162
SHA1889611b8e7fae7a929633e480dd44246bd1afaa7
SHA2569501ff30038f86b65deceab129e5f0b236238b92f2fb3271bc80bd0010cc0169
SHA512d2b5181797929298ce0297fd99b3433f7e5773dd35b2d98c1d9d976c10c20b150b2fc00ccffd80e98264fa08adbd82c0365760d65010cdea2dc8a1b113757dff
-
Filesize
344KB
MD5a78777b2753c244462fb87b336c24d59
SHA1a6977affbc2124355f4ee98906cdbb2f2a882f97
SHA256537e41991d607932761555eaba036155d739ad78e726dfa714209585092d61d4
SHA512244ac67c9ced0912aa453da75960b9a4d7d27dac75280776323398b2e2e221a319a4f09ac35261d5cfcb03cae5a00f504b30e8a2f5a493597c897498b3736e17
-
Filesize
344KB
MD524bf9b17772f4a600c7bc0a7bd4b57f6
SHA1f57ee1801ebff1f94231fc1e98423e212f566840
SHA256e74412cba01983f9aa82bb65b0e15d1c8c44121d982b4ba4078fe98649c1ac94
SHA5121cf750abba2702e6a2d0bbc4a25682ff36957ae1e2e52d12306c78bb472f1d45146d93b49d742e11f660cd3df34caf311f24dee0c61699158481161375c8accb