Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 03:56
General
-
Target
2024-09-09_684f7891cf750ef3af5c130a20d488e4_goldeneye.exe
-
Size
197KB
-
MD5
684f7891cf750ef3af5c130a20d488e4
-
SHA1
819b4b59d82d25c16e1a293cc3b4db59e3b2ccb9
-
SHA256
d85905b3b435782a9389e35f80cbeea9c2a574989c40ad254b7f22552a3adef0
-
SHA512
d5549dfb7c465f615064470784575da38d36d64d9daf5aeecce71b578d4375bd26c9321df04890164cd1bac70648a1f43a7f27a94207e90432bdc1409bddce3a
-
SSDEEP
3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGTlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-09_684f7891cf750ef3af5c130a20d488e4_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-09_684f7891cf750ef3af5c130a20d488e4_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED6F7CB8-2221-4c26-89F1-6A278666C918}.exeC:\Windows\{ED6F7CB8-2221-4c26-89F1-6A278666C918}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A7DBF4A-B55C-498a-BD27-4F9802E3286B}.exeC:\Windows\{7A7DBF4A-B55C-498a-BD27-4F9802E3286B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EFC6391-2C00-4e4f-B59E-7D0E3856105B}.exeC:\Windows\{0EFC6391-2C00-4e4f-B59E-7D0E3856105B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAE88104-BBB9-4146-89CE-56FA8DE62E41}.exeC:\Windows\{DAE88104-BBB9-4146-89CE-56FA8DE62E41}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83CDEAE1-E890-46e7-8A0A-93B248001AB9}.exeC:\Windows\{83CDEAE1-E890-46e7-8A0A-93B248001AB9}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F257E814-BBAD-44c0-9183-3E8E13EB3CB7}.exeC:\Windows\{F257E814-BBAD-44c0-9183-3E8E13EB3CB7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4804BB75-6576-4b92-A642-04ABC2B1CE5D}.exeC:\Windows\{4804BB75-6576-4b92-A642-04ABC2B1CE5D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2ED22C44-3E8E-49c4-9BE5-4F658D954832}.exeC:\Windows\{2ED22C44-3E8E-49c4-9BE5-4F658D954832}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3AEEC6C-1B46-4dfd-B13B-DB2BE2A3473E}.exeC:\Windows\{C3AEEC6C-1B46-4dfd-B13B-DB2BE2A3473E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B548D71C-9653-47d9-AA85-9150C6C496E5}.exeC:\Windows\{B548D71C-9653-47d9-AA85-9150C6C496E5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD8B264B-7341-4a48-A258-5F158FEE50A2}.exeC:\Windows\{DD8B264B-7341-4a48-A258-5F158FEE50A2}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F44810BD-A126-4aa0-AD68-1E8A0BCE4B56}.exeC:\Windows\{F44810BD-A126-4aa0-AD68-1E8A0BCE4B56}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD8B2~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B548D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3AEE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2ED22~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4804B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F257E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83CDE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAE88~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EFC6~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A7DB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED6F7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD54e5407fe0d76f9bcd1c5dc1a8670d044
SHA191205e3c9446328a1023ea2816e42b3bf5afbe7f
SHA25674652a37fa8b84f18ca18cd408b0c8cb63d275c16affcd9abf5140e236acabe8
SHA5127ffb41c90f4084baaa8371dc6e0e2ddf9c0c4612d307a38bb3ff4f29be09232442e76c60cdef7ac8528faa8183a397fe0261301b9102d61fd7bbb45916a9fd0c
-
Filesize
197KB
MD5060d746761f567c5c6c28b8331a2e4b4
SHA18e8aac3e5f4859209b5726d4f695a1996609da40
SHA2560e0679520667034836e46d45522e7505e7eb882646e481beba735b0b5b084180
SHA512c20383cac68267bd1166464e96673bf477d244be18c35a1fb295974d42fa983bc7f855503da5ae9e7ab2ab52850d60436b0e0421d1afdc84e01e4f3ec2d0d102
-
Filesize
197KB
MD513b013ca4cc728ca55d9d7dfda0afacc
SHA17b32df728db69d485e39456ad0df6d892dd8918f
SHA256f3eca29f5288a20b10b37c6a84045126553697a8ef9d50038efd07ca1671f242
SHA512373d43b152f0abaad6204b635cf3edeff902818f919447015ea525345462a8bddf9c9e8514478a2fd26672ef875c2336dd4955786cd1892299fe4129698e324a
-
Filesize
197KB
MD5ff134e1bfb0852812e16896dda30293c
SHA1536d289511df72ba5bc4809c327cb261c38d3994
SHA2563c69e3b80c6d81cd679c4e21578bfee7ad5cd9d68c94d0ee17352a7a8d8daf5f
SHA51287513c199979287325c48866d06f6fd3acc1c1def52e4027a9baa08838df442f1869715d02cf18442788914162ba54e1f1c355533fab522a92a2311a81e51705
-
Filesize
197KB
MD58f5e23f14eefc2657c0c5fe8aad56c2f
SHA130df33f510a2e622fd841471e5ed7a3a7b153de4
SHA2560de214d65687b49b05de8b7d25239cbbeeb01ba16325e93f3b887f7510093567
SHA512f7c91166049decd9dfafe710e7d9fdae9fc2b460ef83983393c274c854c41497a20f7e0831115109ba73b8307f3ec79ad2b3b6c26afaf01317288beda5bb580c
-
Filesize
197KB
MD59ef2245ef9561684aadd52cfd47d91b6
SHA1570fc2a7de4f084556ba661f58ca2422bb4f8e3a
SHA2566e38917546f5f91594a03df84582a91eec00f8408fad5ba18cccc74da615c91c
SHA512092393620fc596a4b1520cff5224970d4c30c194280c1a13631f06a015a8a18f92d6aa74dc013763b0652a47298c5513ced7a718594d4cd7e7ef07131bd43fdc
-
Filesize
197KB
MD518392d547d6d2c8fc1b68d55dffeaf1a
SHA1dcdff422ff4262836f993057005c72f89653fa61
SHA2568b511e6011714f1829acaf3d4229403ddfc7396cccb4f1ebcf24857ff474d125
SHA51280ea505ec5b0311cd4d19f21e86794abe4b91de52d25f5ea4938623ce1b8fa0dd3d5766cac3554466154fb55783405261d2d25128bf0ee11eca2a9bcf17eb7d3
-
Filesize
197KB
MD5afda915c4face67dc83937e47b1464a1
SHA16e8a28e78d6118d33344c6a69174842c331888a9
SHA25607af549bf1af6431db4e935f61e47e9ecae8087e59cdb5dbb515d7c94aa9dd3c
SHA512631bb8a9ffd603642d8cfa6ddcd6364a3a44da689aca1b5cdf1376b084b670720a1d85dd72f31982800ce790d7227275a8beee5bf7a32c800b75165d55e02fdc
-
Filesize
197KB
MD510559e2945452f5c6101ccd51b23bb1e
SHA1b2c2c85bedb1a1109662a794a3dc85ed36bc317b
SHA2569ded393a82f72705ae16ab2d67fadcf8030460a273744ec45a9f6d3e74638462
SHA51210fda6737ba1af1882e3b2850a365f6e591d063d6f3bf79ebe95668c6c570cad188484aa34a031c9a985aaa8c2e5613e74910b4084e590c88d09529201699ce8
-
Filesize
197KB
MD561a346856389d746a2f2ebcc49f5be42
SHA10381e6736d86c17218c85cfd324a48d9fe8c26e6
SHA256daaa88ea3e60f2a03ef2f61de4cba9b89f45c233d3709ad7189cb610498a50af
SHA512ffd961818f4580f03c74e6953017532ccefc3f993536b3037a50de1f8bc432c324d79703c042fcebebd8a3627b61b57c8f22deeb495133ddd4101e50635438fd
-
Filesize
197KB
MD51ada3548e6307cf0017dfcd2d56222c2
SHA1a280dacad6ca1c555b3b000ee12d71fff3e6e4dd
SHA2560b159a3dcf9a80b228b2d68d7663fdeef2c073420a189fe23ecab96eda819b27
SHA5129ae0953dd6a792868597213e9b73b8495b5112e3aa9f91b02dcae67a3fa062f21ed9c7b6b1cf3fe51434c4adac2f77aab56d8d4368bd3d43e184693a2c063a14
-
Filesize
197KB
MD56078b74ee4b3bdb8e51e5ee690574273
SHA134f19392c99867dc9e08336daa225042013d5e70
SHA256c35e4a19529d1a6dbd3f0e512a77a9a3e17050713a038a05967ed3e539b6342e
SHA512a79b3814c9cfea28bdd61098c182ec322b8cff03f61096c80e1f6c610893249c2a0e62807d65f3051f0150db6a7dbf6b5816ea7d6c0910af2fbf12eefac2f1bb