Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 04:11
General
-
Target
2024-09-07_e377422afe0a36ad197cf64aed09fb65_goldeneye.exe
-
Size
197KB
-
MD5
e377422afe0a36ad197cf64aed09fb65
-
SHA1
18521ae7a5710a01c2b395940062ee4f66329cbd
-
SHA256
6fd9d1ee1d88bf26a5388b9c764c78ebf6436e64d26742f6f87c64e71e6b5ff1
-
SHA512
2f0ac3092e71f571a401f18e790fae3f31f128a1d31bb7d2293455d8cbc09959387fdd1d407dfa1790750e8ee4f11d90be82d27b21ac52f9d847784945e11fe3
-
SSDEEP
3072:jEGh0ovl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGNlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_e377422afe0a36ad197cf64aed09fb65_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_e377422afe0a36ad197cf64aed09fb65_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4AF68AE3-F535-48f4-818B-8464D206749B}.exeC:\Windows\{4AF68AE3-F535-48f4-818B-8464D206749B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB74D5DC-D50D-4315-BE56-02CDFA95B27B}.exeC:\Windows\{CB74D5DC-D50D-4315-BE56-02CDFA95B27B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77385453-709B-46a9-BF03-E6E2860310FC}.exeC:\Windows\{77385453-709B-46a9-BF03-E6E2860310FC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4BB7A95-DF09-486f-9801-5ABD2C878C4F}.exeC:\Windows\{A4BB7A95-DF09-486f-9801-5ABD2C878C4F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{116CADC9-471E-4095-A6DC-42F04EC317F4}.exeC:\Windows\{116CADC9-471E-4095-A6DC-42F04EC317F4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F1CC354-E9D5-4633-B864-6B2D77BDE529}.exeC:\Windows\{8F1CC354-E9D5-4633-B864-6B2D77BDE529}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE991E68-07B5-40a8-9269-3EC459FF5E62}.exeC:\Windows\{CE991E68-07B5-40a8-9269-3EC459FF5E62}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4931F2F4-9225-46d5-82ED-D18EB2590884}.exeC:\Windows\{4931F2F4-9225-46d5-82ED-D18EB2590884}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1610A3B-5C67-4cfd-9B74-B2AFBD3B7D84}.exeC:\Windows\{E1610A3B-5C67-4cfd-9B74-B2AFBD3B7D84}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{331F185D-7B9E-4727-B469-4743550E590B}.exeC:\Windows\{331F185D-7B9E-4727-B469-4743550E590B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7696458D-0D87-44db-9DA2-4F6BD02DC2E2}.exeC:\Windows\{7696458D-0D87-44db-9DA2-4F6BD02DC2E2}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{283F26BB-7F7F-439a-898B-9F92550C40E7}.exeC:\Windows\{283F26BB-7F7F-439a-898B-9F92550C40E7}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76964~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{331F1~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1610~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4931F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE991~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F1CC~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{116CA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4BB7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77385~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB74D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AF68~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5987ae65d5f5b1c826d68e9bbb9a01b4b
SHA13da27e7c88591552929bfe1912820f6bc53fd244
SHA256c9e30395c54aee9504672e325d42425c8d011516e6a560c17d5cbf7d0019c95f
SHA512c5c3ef49c22d54be054c269eee29102566f96232db2a5dec2cdd9173ea01bc857edda497506b33e7052c84866f1f912ecb2097b238340a5b5b12afd56d97f5d3
-
Filesize
197KB
MD55473531274ad34f823f6e5e870a5e829
SHA1325736c79eacfadfe786a677a465cc2bccd6d9b1
SHA256c7eb8ae7a89afb9a0586ea7e223d1b3ecc819f30a5fb6b41b346a60ea9e2f64f
SHA5127a8170ecce0366507cdbfdedf924d535f525c7a441cd544a7d1a0be984d2407ce1e8dfa5383d3b84abd7f25426288b100bd91ffdece4c97f15de420fcfc64eb0
-
Filesize
197KB
MD5aa685c9714d1a9185dbbfe34c25e5ee5
SHA1e6d163679e33ddbf156de280d6b90d8e60df2865
SHA2565dd2fff16aaa702d47c706680b4f439e5ee410b8e93433b80b4713c38817c2cc
SHA512bd2aebecf7f727046cef21167173e238ccccb9069ab41443d1d4a011a765c1cec80402456fb43a509f53ddf45ab504463addfa7af67cf1c25b72b71997319d19
-
Filesize
197KB
MD5c0f07eeadc3049e28f749a8a21d37131
SHA1b2296e6b13377b639751782e73c6f834f09aab24
SHA2564f7793ab3f2dc1f38e31062b01a79bd565db7386cbe69402b59694d22a761004
SHA5125fa120538442d9a5f9c156eb0094e71fa8a6ea7efd216417f31eba7745e328be621d9ac2b69f87ff26f1010152dfe777b754f513a4b22d2453e0518c2ae82044
-
Filesize
197KB
MD5c8d6ea8f3a55c4656c64e5c264baac0e
SHA15c518d70526475c11a60647f2cf3c479008f78f1
SHA256541436f2b4e1a15f29a1eaf1194efe7ac712399a1454716601387d2c17f15c15
SHA5127c134d45fb6670c5f7f4b0dd16c5d3247e9f3fd4d592d308f5b244c6dbdbfa514be5a670861557c34c57c3f3477f2b0b2bd9e006cb3c9bc3f13727d11f26fe4d
-
Filesize
197KB
MD5c2d542a6283356a40c59289bcf641bb3
SHA1a6cbc9cec23f8c22476941d6b492b78328496d71
SHA256a43261c0fd8b1ced6eb36ea6e93a82dc6fca402f64b06b060295f112898c1698
SHA512d42824d14d3d661d9c8569d9618b5a4d55d0f7e5af64068cc379b4296370080425042bd05879c5489df5899456cbe9e534ac1ef60e2957fa6102a4a860e075cd
-
Filesize
197KB
MD59e199b3fb0fbc3abb7ab8ac0df98dadf
SHA19929d98e0c3e83ce72761405d6952131ba9176aa
SHA256ab2dbee103605e5c391623a48182a6c1229218d9d64495ade88d4c3f3198b8dd
SHA512c1205de76caab3d8f487fd95fae906671855c22b18e4e2d2c62d0f5a83abe03d84c01db0af0c7584aebcf5c0af17a384b9fd524502ce43966c9844aebe8488ed
-
Filesize
197KB
MD51749cf96575630722548aa3c51aa10bc
SHA1c5f6bb3ad0fe955a5a696eb8fece0ef06e28bc8f
SHA2566c100e0a2cfde30da44da0b320350a944aeafac3ecc68ec6be39099d27892b83
SHA512b9fed7911c53ebae90bd04df71e86b27f1946baeab6e0bce92b73c793a16f2a98596265c620dce746afcef42fbea9bd4c377cac75f07846e49a8674c82d85e3b
-
Filesize
197KB
MD54877fcbf61547b2976efeab019dce335
SHA19331bb0830e89fb6996ac11b5e54cf407b76d0e4
SHA256753c8d3a1594705bbaa383361c22f20cd306409ec108a9aaca2b4ad03ff46f62
SHA51288dfaf12394dd2158e308f69652f8b581fd4e9b2a6fbf76d6956937d368c45ca8b42a765a75ca21323b937987d71c05c897afb68bf9ab2d8a0af8a8e4306225c
-
Filesize
197KB
MD591e60de9792f03d17e6377302940e6a1
SHA1e3cf55ace32bc9c1f423a13ea93f8745a8647b72
SHA256e3168a3a2d48cfa7df89a5ffb5dcac691c7717225f94e729433b9c30e4afa1be
SHA51274c9def01e2da8e759034894078487255cdfb95e592c54bae607bff47eb6375d27e8f73eb8b089442d82b2fc8b41c2a4b727621794ad52faa91caa5111d3529d
-
Filesize
197KB
MD572d0b8d870fa7b4211869e77265fa5d0
SHA15a2a264cb09452d915032b3380e8c4773c3e0970
SHA2565f84a5a933c9b2e5cf31609aa4423739b1ccf60e74712497b3ab84a85910601f
SHA512dec136842df52d486b6d169cec0fdd9200f4861dbb22143c125cf29f53122e4e080ae1aaefa53bae3b82e60ba8aa9986f3f172a89400e6c8510d3f9329593f4e
-
Filesize
197KB
MD5529161179adb3cbb632ec3a250727dae
SHA1f922f8800d72968025798fae6f296e3ead7aa580
SHA2566bd861bd9be7bc75031c8d51b53e698457d08c43077a14a31bdf6dfb6892b727
SHA51293491baeba4b32185742ae2407bb4462c132150633ffb3922823779f81c93796692904997504cf2b04a2eb0c0c640d827843e3c6a9e99176064e4ab3691dd51f