Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 02:46
General
-
Target
2024-09-08_2a469dab096d7b8d9b0fea501609bffd_goldeneye.exe
-
Size
192KB
-
MD5
2a469dab096d7b8d9b0fea501609bffd
-
SHA1
0e412c92a4b6fd140731fdd9d0380f5df3616cb3
-
SHA256
1699ca3eaaf3f7fdd177a81a79a2e2a3f8bf6eea762e550ab81119c912d6b07a
-
SHA512
c864f41bb66605dade5121dc49c564a0af92ccae6a5832e44c77f2a13b277fba2f2a81258fd5671cef08df75f66a4590e6e3de121e4604c0ce2d532c2178d1d7
-
SSDEEP
1536:1EGh0oCl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oCl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_2a469dab096d7b8d9b0fea501609bffd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_2a469dab096d7b8d9b0fea501609bffd_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A802BBDE-3C36-4dd8-B124-C6372B2242B6}.exeC:\Windows\{A802BBDE-3C36-4dd8-B124-C6372B2242B6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69DA7D74-6780-4c38-B6B2-B5E2D9C4A3B8}.exeC:\Windows\{69DA7D74-6780-4c38-B6B2-B5E2D9C4A3B8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6605AB1-CE9F-42a4-9738-73320FE799D1}.exeC:\Windows\{F6605AB1-CE9F-42a4-9738-73320FE799D1}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E25B4FB8-229D-498e-B685-1D4F8290DBBA}.exeC:\Windows\{E25B4FB8-229D-498e-B685-1D4F8290DBBA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83B9FEA4-D2FB-4906-8B60-72414F6DDD18}.exeC:\Windows\{83B9FEA4-D2FB-4906-8B60-72414F6DDD18}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71F8FF7E-4B8E-40c1-ADD0-8F56294E3E88}.exeC:\Windows\{71F8FF7E-4B8E-40c1-ADD0-8F56294E3E88}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CFF7671-2F7B-4017-A480-E3BF35B67643}.exeC:\Windows\{3CFF7671-2F7B-4017-A480-E3BF35B67643}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5816AA08-29DE-40ee-BC8F-54138EA9B669}.exeC:\Windows\{5816AA08-29DE-40ee-BC8F-54138EA9B669}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7855FC2-5BB0-4023-965B-55DE2FD961EF}.exeC:\Windows\{E7855FC2-5BB0-4023-965B-55DE2FD961EF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC0DE911-A9F1-4d28-AF76-211CC8E3A137}.exeC:\Windows\{FC0DE911-A9F1-4d28-AF76-211CC8E3A137}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F43B1BA-BF02-445c-A623-449BDC0D228F}.exeC:\Windows\{6F43B1BA-BF02-445c-A623-449BDC0D228F}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{E92CC2C0-7BCC-471f-9838-093B88B92C2B}.exeC:\Windows\{E92CC2C0-7BCC-471f-9838-093B88B92C2B}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F43B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC0DE~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7855~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5816A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CFF7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71F8F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83B9F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E25B4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6605~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69DA7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A802B~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5f5570b74f92a056ca76850854d912bc8
SHA10767eaa39bfe0201cdcac504500e172794c91b12
SHA25614cc9442619e874aa81f464899b55c796cc68acf0780fcc160af0a3dd4b9573e
SHA5129fd455ef27e8a80032c10f36fc101ed2d5535d6ed3dea12e8a03ad1f4603d5830392bbe41f0c5e0bebcd6515e29f7617badcef3aa643c0b361eb659b0b2b5ed1
-
Filesize
192KB
MD5fe5ca9eb2ee52dc3b3bea5f0ca90aaae
SHA18965887e27d2681e595d562cbee0cf7617fb395a
SHA25638874e0c85bc5fe5dfcb05d43ef591a6c5239e613fde773f72b75d2b25774411
SHA5122f9849fd9056c11f409cc00e68b3a3a7bafb96fa0cf2b7bcda4522e66947503096aebc00ec190f34945590c66e4a8977f9e99fe4dab82eb4bdaf45270db95853
-
Filesize
192KB
MD510539774ac9b119b36506729f5edd043
SHA1d025c92133be1902d3ebb3585ccd212a400d5c70
SHA2568adf4bbb7c0dc7da89e6038772ef18094da2e07ebdc13ae52cef22c66477b63e
SHA512d06903386baaebc69ecbb1d2082a66d2486913d62eeb190f8c64729504967c0c2435f6fe7e730885e9e6c8626c6f9bfc6c287a8acd969878fc44cb71fc7aa27d
-
Filesize
192KB
MD53f6737256452fe45c79b4d7a31bd3bc8
SHA115d56962fba369d1fb135b60b80ce8d53cb7bfb4
SHA256193cc4c2fd8a260a1c11469135c8565c69dd53c09fd9c9e82f3d1bc3eaad9865
SHA512a8c4059039988c86be506918f2686d167dad464cda1a00ed221b75ddf9d788e89fd2e165c0deecc15a1bf4b3998670501b9a233f63e275cedde43d401bae7cf3
-
Filesize
192KB
MD5e7055d3ef172d43428548fe1337130f3
SHA13b3851252bd49c1c42d4d40ae75f78516645f0b0
SHA256013470b1056e39e704b554657dcb2005287ea91e67664e4792f775be9144fb8d
SHA512136b7058c9e84d6132e5c01b9183bbcfe12170e760bc030dc3b7b02f997b3af0f159cca44aeda7b5f496924a708abf4051f6af3bd947843f4501aa3ef322a49d
-
Filesize
192KB
MD50d92883609778ceaa215158789306f14
SHA1a1e507daa81516f0bbba95cda315ea1c92322dd2
SHA25600aac81ee098fc980c7f18ef7cbfec332f3d057a241d61a61a84f46a98874b8b
SHA51228d505622ffcd6c5c936d312ccfc2ba97fbb9d5a85ab8ecf87193bfeaad822359e95baaca85371ee651fbbdf180d3f3fa2120b78e048d3eb7978e43888c95621
-
Filesize
192KB
MD57c66f3205a45fec2370a4cad1dedc480
SHA11ce7bc094d00eb5b647524cc30476150efae1550
SHA2567eda73207b2dd98164815281f7f5f837a83720f5d28ad8e242a0bacd24578aee
SHA512b80d31cf1a5c6431d29eae8ca7a35d727a922b2e7db2aedfc18d30be3789e54256c29c2b69b4c4a132217dae34d1ac4f2118433f010b0fd29c5f7d8f0a1faf36
-
Filesize
192KB
MD5872e32ebe94b2f043b0905be382c6f58
SHA11ec73e1c805f39a26c607aead98c3e0804b18484
SHA2565a6b41a54381325a23f818dfae40e560f2f70093fe8a3f5ffd4df9a63146b8d8
SHA512a3aadd2e6f504790ea09c549076ef942cfd2ec49892e665ac12b9fae07bfb2cccd151615a0e1a20e657c073c6422e93e4d7d66eb5776bc79813323be8bbdd8f3
-
Filesize
192KB
MD5a0bd99fdf142fe57075634ba9e73f580
SHA11ccc99c18995be2f4cf501267dca42f6a34d6593
SHA2566d5870bfdfe932c55104aa34811aa76d4d8eb6f244e96ee1cb537c37c716f2d7
SHA5121631f53161d2f0ad9c767cd7ac1b3ce34d8275c96390180adcd2e31fbec7248cc8bbe10c9b8bc2a9eb84bb2e6e890f9aeca8b0b7cda74529179997b2ef2342b2
-
Filesize
192KB
MD502690221db9613d0b913e0d9e58da4e7
SHA1bcf12abd14ab4e63175de6607df2442a5214fd03
SHA256d4e2852ed00fb645ea2270723a374319daec2dbdaf93cc52c6dfa2ceeb5d6148
SHA51210bb653dfbc47dc53cddfe100d938f361f937ff977aa62f81a4e0e89b1955c894ee9275da990264e0aff3b4607adc6af4ab40edd82d44ef0346a80f890929ef0
-
Filesize
192KB
MD58db457ff72e6812bd1ed65d7c5829b83
SHA1d9e70383a19b563f53577287da2811f7e5fc2f03
SHA25668540bc23dead749b26a0675095acb6e0b96457f248d6e8b269f7f7b1aa175ed
SHA512e448f9d9cb6004ac2cd085aa797ac3d965eb5b61a4c95f1bfefd4cf92a68b63c89631c99e8b1551f7cbcbe5cedf78ed8d81607d24e6e378819f7f45e5d431092
-
Filesize
192KB
MD5fedbe0d0c874e239f10610b8e183c24c
SHA14642c2345132d1cf6612f34a5ce687e6a63801e1
SHA256036f1736226bad8c1af1e3cc4c4ad2201eea17edffff6c74aac51db16318e175
SHA51220eb7d46ec8d0c8d30659014829630876d2e1302ba6ec3e4ce5fd77d4eb79c3448dead6d2f1e755a37ede060229fb114f7d764116f2199c7e6c24565595ce369