Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 21:44
General
-
Target
2024-09-09_45648b4e24f5d1aba1ddb0229390c34e_goldeneye.exe
-
Size
204KB
-
MD5
45648b4e24f5d1aba1ddb0229390c34e
-
SHA1
a368fd42fa0159712636e5d2eac6a38d9c9062a5
-
SHA256
6080af27a518c45c5cdc85ab8c51f38dd0a7f8c796a849a45551cfe985f63847
-
SHA512
fe40b94a90d88d25204e52c8df824034f94556a0dbbb52cdbd4d87d2d31ea504c49ce4283ad72ca8a30a47c81912ddbd5e08e07baef953c6638c097e9d140369
-
SSDEEP
1536:1EGh0ovl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0ovl1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-09_45648b4e24f5d1aba1ddb0229390c34e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-09_45648b4e24f5d1aba1ddb0229390c34e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7A98BC3-C96D-421c-9D0B-F9B92F975BB0}.exeC:\Windows\{F7A98BC3-C96D-421c-9D0B-F9B92F975BB0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44E66FFC-6D86-47de-B2B1-DC45A6EA5782}.exeC:\Windows\{44E66FFC-6D86-47de-B2B1-DC45A6EA5782}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A2040D2-BABE-4784-AA30-E668A272AC31}.exeC:\Windows\{2A2040D2-BABE-4784-AA30-E668A272AC31}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FBDD011-F66A-4d9e-A702-6D55F3FA6661}.exeC:\Windows\{6FBDD011-F66A-4d9e-A702-6D55F3FA6661}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7D44066-2810-49fc-8B19-389302CB4130}.exeC:\Windows\{F7D44066-2810-49fc-8B19-389302CB4130}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4166AFA-BD14-40cd-95E3-9F76F0AA97EF}.exeC:\Windows\{A4166AFA-BD14-40cd-95E3-9F76F0AA97EF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A213F86A-9907-4f68-AAA8-415DD4B55304}.exeC:\Windows\{A213F86A-9907-4f68-AAA8-415DD4B55304}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E81B390-9C99-40d3-B547-DFF93D5E0FC7}.exeC:\Windows\{9E81B390-9C99-40d3-B547-DFF93D5E0FC7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89433528-3356-49bc-9B6F-BCC44AAFAD81}.exeC:\Windows\{89433528-3356-49bc-9B6F-BCC44AAFAD81}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4526AA77-1DB7-4bc4-84AB-640806B34401}.exeC:\Windows\{4526AA77-1DB7-4bc4-84AB-640806B34401}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9B651B2-F358-4ebf-B64D-159E6F587CE0}.exeC:\Windows\{C9B651B2-F358-4ebf-B64D-159E6F587CE0}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4C9577DB-4CC9-4881-A642-36EAC2D1F318}.exeC:\Windows\{4C9577DB-4CC9-4881-A642-36EAC2D1F318}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9B65~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4526A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89433~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E81B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A213F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4166~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7D44~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FBDD~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A204~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44E66~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7A98~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD544bc14ddd0e501b46993ae7d3398ad4b
SHA14b11245699fb92805c73afdc9ca1ae1169435318
SHA256f82e8d465244a1f8b338139157cc7370ec039a3189d1bb170ff251567668f5d1
SHA5128c8105fef08176a0ea21104b9adcbf9a31f6f2c4f4c3da7974023fdff777f3f8be4b13cfd08b09ba646adb5dc5f7fcb216a5e38814e9ed137ed6ae1c634b24d9
-
Filesize
204KB
MD5c42963035f87226a605be327f659db99
SHA1bab8e509339f8a75f6bb6ad9c3bb8364da6cf453
SHA2566dd4d337c9074b37be3ad3b9aa9a30e084bf12554bad5dac1d45fe6b9c3b3efb
SHA51281f2ee99b68164927b7900053a337388ed1ad8372d2af645e45df92c30aa2d9c24105362dbf4e62e95453a1f2d24487a7008afcf049789cf7c15656f200ab891
-
Filesize
204KB
MD56699c5c29b8b7b82db30ec1b7cf7a843
SHA10e4b784cd7649d722b1692ad29bb164a0c9635a0
SHA256d0ee3c288e4b960ac34f76ce0607e6410b3f697dcaff9dd86e6a72a930f62ca5
SHA512c9ed8fd54ef66ee6a31719811d39c21a4825bb3899e04430b40facb341dd96c959f01c8e5a7b0a5933b213c469413fd0e207c325aa4d77582d01a53904dc0785
-
Filesize
204KB
MD5091e85686b863004f0ebea4503a08d44
SHA1935834cd8a344e2d7c21c4322b5c103b18313d76
SHA2563f9cc6658a8de172a8ba9ce245b9ba4033d4940fbeb73a89903c5b0a3597eda2
SHA51258c363111b55e60bf3f3131003f6bd75f44723a36b9d9169ab220ae91c27c24fa43ec2216e9cc6d8583fb9d6e866279c8b269bf8a83180d8d0ba43bdcc791755
-
Filesize
204KB
MD5d289368b6d43953128485df7b1e0b76b
SHA1c71c5c9a576e8560c9dc46b19a095967f7057ca4
SHA2564afc6a487ee71b9763720c54fe620ddd61b1d25c67e461193bd61cecab454ed2
SHA512e628ef58c21189ddc210537c6400022451a7f7d069e9eaa5a0aa824b932da2fd807d08085a29bf19d819b0da14913c1f38f0000b529f2103dd0d1b070326d5c4
-
Filesize
204KB
MD5aef9d411aed5dab4a1ba0bd1694445e8
SHA1f77e8c043e0f4968e6e46131977b1c46f476bdae
SHA256e9599b32b3b685f992a33d844cff7c342093ba5576555fb12499a53b2a064eec
SHA512fedc74dc3789afb7e6d8d7bef34fe2780e0d232ba826026b2aa328f76b41b0ba3aecc73592648d84cccb264d1f96396b99c297d60e3968e0f305b73f71fa4912
-
Filesize
204KB
MD5d66cf83f68f0d688da7ccf15c61e7c91
SHA1d44ef9620984bcecd2a5b7dd913b2e4348048a4f
SHA256448011d18f0fb56a5dbabad86a354e5d908fe50eac2ededf654484f886c1dfdd
SHA51213ff0bccd16cbe1cd4e8b4407a61ddfc822e25cc6b0f8a4e6accfebbf1ab4173df361da1dd0b1730abd4417ebc46685ed63f17738f855fdda15f101a3d00b828
-
Filesize
204KB
MD5809295564fad5f25b32f01a936c006c5
SHA1d0c6b0c1a5961db538d6ffd794b234e38370aa50
SHA25663a5c39e6f3d9efd795c548d42923eaaecf97f88aaf9a8f413cbdecf4a509622
SHA512c60e6ad590ed3fea1aa8682860a9ebe17522161781f63b1e9427f71aa423773bfd5283f74d49fe0d1a044d1096a6a03623a86c309c416673bac72826039d6e47
-
Filesize
204KB
MD518d74019a18764e8f67279ae457b8be4
SHA1c6bfec6924e8b1add4a9d33d91e5f2cf93f358bc
SHA2563d9d8b01cf62977b2817b9b80188dfd69b097212e7f123af160f59aa7966e13c
SHA512994e00942e646d6d388f6a71cb64047e1f984c783dfc853c407d1fedbc7ab8f9fa13d33bba48fe91af51471bf5db56fcf2cb9a6dd99ad278df19b533b80ef521
-
Filesize
204KB
MD53e0128bdc941b4cf6368563e8b8e396d
SHA1263d0546e4d284226665fbc1a9b8229420fd0609
SHA256812fedcdfbad8efaa57f19e5065b3e6295cd9f21706c44ed4b73636f234f2a4d
SHA5124dc080105e5b984a17d708f8ba6dac0179095f85820468eea913b03503739dca1ef65d4a8da4a4534c878e028bc69518c4edfad456519030010e705c974d7702
-
Filesize
204KB
MD5f6e4fac651b4dab750abe7ba79679579
SHA1df2ef9322ebac85eb26a1eaa1eac9c499dae3971
SHA256394cbf4bd98e2eb6a29d27439a2357869470311b6ee81a1305060764c08160d0
SHA5129728817ac1d3ddf8797ae7a001f48ae24fec48b52159670fd6bcbb5a8e092f6630fa5a02252bbffb86fd90e8add99b18faabed088479b7605500cab91585dddd
-
Filesize
204KB
MD57ce1751bfc69b3cf7991fa7fac375a00
SHA1f4cdf7e761ab04882cd7216753bd929d2da3bd0e
SHA25698d0b14fd5eb139e5244e75dbceff5e257d5b7947ffc49b536fbdab78d49b780
SHA5120ff73259585c3af2bd25eeb213caf702f448dcba36af89f4b77a54c9f5f85367face57f0033c2c544729f3e86e8c07868f174e64f5fe1ad9d8a04399df9660db