Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 02:56
General
-
Target
2024-09-08_82b50d461054b2ef1e2aab41c509c3d6_goldeneye.exe
-
Size
216KB
-
MD5
82b50d461054b2ef1e2aab41c509c3d6
-
SHA1
f3497466a2f949e82712d2d10a791403dfaa0b9c
-
SHA256
2e99893c3c832c1a0d26726d00684b5951562e9f3adda62410adf660653a361b
-
SHA512
5d34caf74e103f5c5b0be71e77c7b1b33e48073a9192ee55334e6f636edc4d981d1b908a6e0e31289d58168cee10722efcfd46dde0b51b792c904e32922e0b83
-
SSDEEP
3072:jEGh0oZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGvlEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_82b50d461054b2ef1e2aab41c509c3d6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_82b50d461054b2ef1e2aab41c509c3d6_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{969DDD17-2303-4d82-B0DE-76DDCC6AE468}.exeC:\Windows\{969DDD17-2303-4d82-B0DE-76DDCC6AE468}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{802FFCF0-E2F5-4f33-A226-1BAC304A300E}.exeC:\Windows\{802FFCF0-E2F5-4f33-A226-1BAC304A300E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48092562-E9E7-4f04-8AC8-1B038E1A6978}.exeC:\Windows\{48092562-E9E7-4f04-8AC8-1B038E1A6978}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{723CAF87-E241-4cbc-BD0A-D5AF9D709CE0}.exeC:\Windows\{723CAF87-E241-4cbc-BD0A-D5AF9D709CE0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA29F925-8DF7-4923-8E69-5AFB61AE993B}.exeC:\Windows\{CA29F925-8DF7-4923-8E69-5AFB61AE993B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3096449-E7B3-4b4c-B2BE-BFCE2EEE6762}.exeC:\Windows\{B3096449-E7B3-4b4c-B2BE-BFCE2EEE6762}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A3283C4-089D-4e91-A405-7180FF645099}.exeC:\Windows\{0A3283C4-089D-4e91-A405-7180FF645099}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71433BA8-631C-4555-8250-96CBD02E44D1}.exeC:\Windows\{71433BA8-631C-4555-8250-96CBD02E44D1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20DAA686-3187-43eb-91FF-03D757F79686}.exeC:\Windows\{20DAA686-3187-43eb-91FF-03D757F79686}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82982919-783C-4811-9F58-5FC303F5CBAE}.exeC:\Windows\{82982919-783C-4811-9F58-5FC303F5CBAE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97A6F428-E486-438f-A72D-6DC9940ECB1E}.exeC:\Windows\{97A6F428-E486-438f-A72D-6DC9940ECB1E}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{7FFF2284-F85C-44f9-8A19-86EBB4ECCE88}.exeC:\Windows\{7FFF2284-F85C-44f9-8A19-86EBB4ECCE88}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97A6F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82982~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20DAA~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71433~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A328~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3096~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA29F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{723CA~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48092~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{802FF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{969DD~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5d785b774dce49f9c92123d73745fca0f
SHA1f34ae1126a576d1927ba90c84690622f4375f0b0
SHA2568bc0d99ce2cdaee2f96bacecfe5187a8323490eb6e0410fd06cda810d2bc502a
SHA51296f9be40e02304a1350f91b842425b39feaf28de878fa70ae0bd4af2bc38b3acfd476b58b5de48dd0fb5a1f14e7399f8266ad155b2d10c0380056776127f8289
-
Filesize
216KB
MD50b8767c7970500cc91389e7536a167e9
SHA1d84d1a40d5da2ab86fa783e444852eaeb4ebc104
SHA2560b0f64c0a5870b76f9200dd77f61c174904949aacfc21b2bc395a6b3cd92034f
SHA512ebbb98cf196d53d7c8d7e8a4cdfc54a80aababa2b384f10b65ba4667f43b77a5a8568bb2529a2aa9d54295397455c0ec8d861dee2b1e865edafee0d807780b87
-
Filesize
216KB
MD5b875a98e9db81759622235ad95aba1b2
SHA177e19ff04f93b9dd8e9f53c4af3f297ff5e4f24b
SHA256c07832e38a8660cd28455fc1815bcbf47dea763f140412e54b03348bde96d6d6
SHA512498fec5856ec3369a507064c5e74d1657280c9e76361428f2302c70e85d2d57b8b317a1edcb6419ca199f0bda2b46e36fa4961ab5bd11bb46b584215be393592
-
Filesize
216KB
MD5aee484eb01d44206aae2ab57efddc8e8
SHA1613e23a7fb38193e80e1bb84ae6b6422a0edb77e
SHA256c40de816db79c3ccbe078d5bf5bf8c2b3f27948bbf0861f9cc50b2835fe56b85
SHA512c874316844c0449ed7e5c6f6380f3dbd6d3b8966c77335492896b64f6f0860e65d1eef2fc4fb2948e43e470f8053f1a10fa3d3f689a91134a0d2200315ca07fd
-
Filesize
216KB
MD568af533fd16c45cb657cc69b82962472
SHA1c2c2b978059f95c85dd30a44a8b6da0ad49ed1e0
SHA2560416dbd70d1f638184070b1662d595e7597916908b3c78e7e0660a609a6f1131
SHA512248a52c31fd939d76cd0526df672cf5f271fb2dcc462f584ee6187f7d5833ab7ee0d4c192bc4aff6f10987853cea7c759d49205c6db585d305871e15cf72ce43
-
Filesize
216KB
MD5d0878c2bff2effa57e33952a67026508
SHA1b0fb5fcd07879630e00e5a614adb4b37cd3d1ee8
SHA256176f9da557e222590daaa50c430bdccfa0b67b8ad92d016e5489bbbf1a12ba3b
SHA5129ac7b32804a4780bbc564ab4d8df3847ec682e1cda19c9af39bc3ab81f8df4067dd24e2ae326481f5821c238b9b1dc1eb7c49fb9f338e067eab34775e8bc88a1
-
Filesize
216KB
MD598be678c95b0b23099f07da1ee17e71a
SHA10fa25e797b4eade8fc6b82b8eacece9bb913e882
SHA256972ec27aa17d872976d8e013d00c5d21c707d0a1b546c6009ac4f606b8b9638a
SHA512375cf8c81290f0c3c403e7cc25e2d53b43da34e87cdd03f11e85ab69f25effbb6e227d94ce2d16e541447ad7c590daa8670ee5cce8f3f7df43728c17dd44a8c4
-
Filesize
216KB
MD5419b2c68562c8bec5d77a3cf077803f2
SHA1a62444b5175c12938b2a3e7c5bdf4e9455be2b83
SHA256441e79db4f08c4d307db876c7c76eb22c1ad630b096fc2955ca054ba8d6325a5
SHA5123bf9046e2608f126ae9a85a7cc76a9ca61c5240de3cad4803508bdb0469bc648717f4413ff33ed6f0542d53205df229a5a17f7c7da60200c8d117b1f35ab4930
-
Filesize
216KB
MD5c6b02c8e80672fea358030a50d7ec358
SHA1bdbd5cfcd76842acdf54e9cf79bab548782fda7c
SHA256d9ac4a9198d8d36de7d380349d921935ff173f2fb754dc08dee06c978d339e9b
SHA512e9215aa460f46f87ea873c0f775dfcaf77d29d8f0f8ef191c0196400cd70214e3cb6e15eb22952c1b4d0860b47be292ca47f48f12f24f12287b34306dfe6a045
-
Filesize
216KB
MD5955ec1ec4b02b0648ab59c7a2e9ae632
SHA10247f17a38e1424de0a6816b16b86f0808961e9e
SHA256995ad529e3a1f7a602369e5b2613e950bad1de511c43974c545abed25d4ba16f
SHA512a2bbc9268991c1af598a721d305a8cc2f4238f9e518982814f6b303790d701a34537056573636e1271f5ce9490135882ebfc4a856b35fe730f3b2654625f27ba
-
Filesize
216KB
MD5494a081179f5588c05428cb0f45e9b8b
SHA1aad6e35fc47b0607a7b141b8b24dcd8355bce823
SHA256a06e089a88fda3ac368aac711fd6ba053a5e4c95539a58be348068ed3c931932
SHA51238c852b7ef0a91a63885541e3fe233c0ef2ee73b3ed83a8cc748ebb1170f074517205aac851d5251ffa57e6e9264401f3b7e50d51922eea83cb2d6de0fc172c0
-
Filesize
216KB
MD57d05fff399b771d9134ad7a81d7941ab
SHA1359d1d6acba709063a87da0c32c777005412a694
SHA256023f8e4087b53440b8eddbcc3e06a3b35687153a1c585661b365d059b94a5c1a
SHA512bde6686bef458ec338960fed811ca18cec2e64a450082912b137313a294af0b7a985cc060261f6008d0ae7221057b176ffcdc9314bf2702709cea0935c90f208