Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12/09/2024, 11:43
General
-
Target
2024-09-12_60956583459dc0982ee2f8364c846998_goldeneye.exe
-
Size
168KB
-
MD5
60956583459dc0982ee2f8364c846998
-
SHA1
fed8dfe36c09baa3b82fc35c1df3d7df531d7179
-
SHA256
88f7929f8ab9d49bc4548e6558268256cc061e740cb1e43eb1385c99b4f7b2c2
-
SHA512
af169a9cdc3b4e1936c7cb3a3ce4739024bcfcfe2cb5856e6c40ad7fafc81e0192d32b6e8804403d8f41c411eeb4539f25bc29e9e2bc3e19562a348e739b7a5a
-
SSDEEP
1536:1EGh0oOlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_60956583459dc0982ee2f8364c846998_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_60956583459dc0982ee2f8364c846998_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE2842D6-D3E8-4f84-BA31-B601C41AE400}.exeC:\Windows\{EE2842D6-D3E8-4f84-BA31-B601C41AE400}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC0F4E71-8D82-4d70-A938-4F070D3EE186}.exeC:\Windows\{BC0F4E71-8D82-4d70-A938-4F070D3EE186}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E3706DA-2D6C-4655-A82B-8871118E5E51}.exeC:\Windows\{3E3706DA-2D6C-4655-A82B-8871118E5E51}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7885E6EA-7EF0-42bd-8826-5F5A775F84B3}.exeC:\Windows\{7885E6EA-7EF0-42bd-8826-5F5A775F84B3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D673DC4-B23B-4961-9242-02A5F155DDD4}.exeC:\Windows\{1D673DC4-B23B-4961-9242-02A5F155DDD4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15802D93-62C3-4e30-B1FC-EC2082B70480}.exeC:\Windows\{15802D93-62C3-4e30-B1FC-EC2082B70480}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A850C4C7-1079-4788-9CB5-810D901DBC2A}.exeC:\Windows\{A850C4C7-1079-4788-9CB5-810D901DBC2A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71248123-5C36-4b57-B2AB-CEDC6763EA82}.exeC:\Windows\{71248123-5C36-4b57-B2AB-CEDC6763EA82}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E271A53-4D80-4740-9A18-15F6147DB2A1}.exeC:\Windows\{2E271A53-4D80-4740-9A18-15F6147DB2A1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04109FF7-53B9-4f21-9E30-69ABC94904BA}.exeC:\Windows\{04109FF7-53B9-4f21-9E30-69ABC94904BA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC0FF948-A0E6-4519-829E-7AAC2E2D2AE5}.exeC:\Windows\{FC0FF948-A0E6-4519-829E-7AAC2E2D2AE5}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D60AFD8D-3713-4d36-9A97-4ECCBADA39FC}.exeC:\Windows\{D60AFD8D-3713-4d36-9A97-4ECCBADA39FC}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC0FF~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04109~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E271~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71248~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A850C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15802~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D673~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7885E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E370~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC0F4~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE284~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5b91dcb38a4d87886e1c93a527ada8c3f
SHA16ddab40f0f98823f6d5ed67e8aa0cc43b3a24630
SHA25648f2ea43d914e0460eabdb6162a06f765c69343169d01d3658c40ae2e7c0ae3d
SHA51295f7da0ef0f2cd5b17f4dbbe2c9c1d97545e9a0baf2043067244c773339dbc563508c18e8a24bf13106dedbef6dc71edf04ef8d13dfdf57e1580941e7b640953
-
Filesize
168KB
MD578d436a540ecb40fc832bdecf91fe2a0
SHA101fa0f81439dabe15468242caa4177e471dcb0f3
SHA25628a6999d117f466835dbfc8bb00c8db8ece0429778f35ac67051bea635002220
SHA5120b285d7be4433ecd3decbad1389cdf2097bf71ba145e401b67b0b10565b8f4e6cb66a8c3b6c228b1a6524ee870193465031d677fff457c0146be745f14757c4a
-
Filesize
168KB
MD5d0ed8f6292fc73251e2181161a86744e
SHA1b82f3ef629b958771c39a79ab65cd0f0bb48a9f5
SHA2569ea7c4ab50a1b955f5733b79113197c9d697eca3974ed525a21f120a63c64d9c
SHA512d72485ec626f3c33bc79403e70bbe10e744ddda10576cf4f9ebb31c67ded404c8a692d068b00a605524ab57798214ffef7a5c4fa5088cbd35ca57c0bad81acaf
-
Filesize
168KB
MD5edd3971fa0663ff7c7cd410d7e72894e
SHA1d0e6ebfda16361015727567ed34ceede14d795c2
SHA2567e312b7089bb7b7745854006b726171c6c2d3cc55fc5c9c410a5aca355b1c4f6
SHA512db8eccca5107ea1e382b58af3d8868f94334ba1a0263698fe4505f0af3988f8efe8e97acf3dcde74f5121cababeaecf8271f44ca1b9316a22290bd0f788617fa
-
Filesize
168KB
MD583be1dbd41b9201009a20ad56b3fc095
SHA163435412ddd435bf5da567b14f095bae369eaa73
SHA2563a1b96966b483bd37d68a96bdf4199c6db87f59356efcf05315195dee8572153
SHA512d6a0c31f077dfb21f27e7f0f6c955a7cb304b7a963a3df650fdca42becd22ff46dd614ad6d72029ed2168dfb1f52308e1dcf281b11f55128a940c14a8b0a1aaf
-
Filesize
168KB
MD545c0ad5b990da3178c21cdcf9d34efc6
SHA16dccdf4c23689c1f4ea9fad28900496449d1b168
SHA2563575e0bf3d5dd3e7e637f590f315b36c09b1aea4511d34c94a0e7a1abce602b7
SHA512554ca0c7026db45f13df04b03d203a6e8c35726813f221c5b39ea694ebdbdcada14f8c1a84719516c9b32b84c758d1bd360941f557cd419f72577f32c9ff9a56
-
Filesize
168KB
MD5d833091e7ed187a01952cd704e1c4b90
SHA1a302644542384b0b526905c4a39a95d46e1e8902
SHA25604f960aba9cdc15627d6f60f380a20dca3da4de1676b53699d6192a446df333f
SHA512da0430c4d405f78a7c8ba9c67335a51a5b27fe3a08a5f712570da9766ab369056b6abf41e54c9b6efa48cd9e75a3f909c75ce48939e9f4b6166183284f529cf0
-
Filesize
168KB
MD510f8e1ca0a752d31ec3f6b346d0beaa2
SHA14221de411d032e5120c537e977e9dede3b365105
SHA2564d24174bff1cc18d56d2647b97e96942d53c7367222b44d6e6824151444a85dd
SHA512b57854f11e481d8482acdf39e2f26978e5251d98f623e5afd9c109adc91e43227cd03ca3e96eeeb6178a3307ada1ea175160f7af0f582038a8704ed29a338b0d
-
Filesize
168KB
MD5e86fc4c50b9ce4c7b5e16fc699b92103
SHA12e9f1b5bbc068f718fb591fcf6bb5929930cedaf
SHA256f2543fdfdc7f15a24ee44d971dfe08f3021f557e86b753255e183654f5614c6e
SHA512fa0400c3e9ad7d8b5fc2ea24fbc9cfd3187963fc3b9efa594de0ec8cd2e2d3ce7e1c32eea73d3f5c97c438b3673acc50755a115f6a2e5d4355d19948eae732d3
-
Filesize
168KB
MD57acaa2ac70eaa06e3299cb50d0999c0d
SHA1905ee90cfdd3d101c3d65f9d96172857fc71f029
SHA256a49c07554c2b6825c5fd06de2addfd1904581af51825f5c46f5304b7bd2658bd
SHA512986023f10e347e9f496198b8792340d5ef8993a0afc84e468f4e6909816b29aab6d5ef59041b5c5ce87f0827d3e5694bfd99ad5563c07d63226f543865d52d89
-
Filesize
168KB
MD58f2396719248b470dbcdf30228bd4514
SHA15536682169e5fd283ff16a693821ace6c73aeb67
SHA25665bf853c6d51200f32a59f15e6b74c7122d229b9048fb7bbb952bcfc3bcfc122
SHA512de7cd6bacf7e26464e3f3bd5f87e2c2efb0a8858c7f11243bb698012c7b820d92b545f2c917182902ca005245d5f5b901d43300672dcdec805d7fbcf3f7f4d8f
-
Filesize
168KB
MD5b230d6bedb1a75966972e50b2e12af8b
SHA12af9c87b86a862965a18e87e8b0a986e05e160af
SHA25614609a00764abf82f3272b703350c012f8346635a068eff05617623c60b82612
SHA512cf9d891eb1058561189ddc9c7384b3bcd5603b6e758339d5cc0d29779074d0e71f49adbc52c6e71deee5a05742d07c10ddb55a3a7d9af503a0845985878c2675