Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-09-2024 16:07
General
-
Target
2024-09-12_ebc5656e8d678bc599eb0effbe59ad3a_goldeneye.exe
-
Size
380KB
-
MD5
ebc5656e8d678bc599eb0effbe59ad3a
-
SHA1
63d880f4fe554eece5d88e101324bf4c46222c01
-
SHA256
dc2a25def4162e32dcc9d0f5ca4786b49831c521e9253190f3ecf20caed9684b
-
SHA512
242215b1645f50656986ee43bc18f14c9c12e860fa5d92597a5b5e5c444b3bc6913c0d2e4ef649a019ff7a6726f40e653975f950faefe37de9be95b5ca91dff1
-
SSDEEP
3072:mEGh0orlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG1l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_ebc5656e8d678bc599eb0effbe59ad3a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_ebc5656e8d678bc599eb0effbe59ad3a_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9A90A5D-3C67-4a50-B47E-33CE0322CFB8}.exeC:\Windows\{D9A90A5D-3C67-4a50-B47E-33CE0322CFB8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{522A38DC-93E0-429b-AB42-D670777C8044}.exeC:\Windows\{522A38DC-93E0-429b-AB42-D670777C8044}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9124E597-B499-40df-B93E-12752DB50B2D}.exeC:\Windows\{9124E597-B499-40df-B93E-12752DB50B2D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C409D69-A2FB-4359-BFAE-523CC40A6771}.exeC:\Windows\{7C409D69-A2FB-4359-BFAE-523CC40A6771}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9785D57E-AB93-4b33-9FF6-BF3E51D7CC23}.exeC:\Windows\{9785D57E-AB93-4b33-9FF6-BF3E51D7CC23}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{277B85D7-95D9-4ef9-979F-53977B8553D4}.exeC:\Windows\{277B85D7-95D9-4ef9-979F-53977B8553D4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C96F328-0239-488c-9787-112686185DB6}.exeC:\Windows\{2C96F328-0239-488c-9787-112686185DB6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1BB9C40-A200-4f6d-8DE8-EF7381E93A21}.exeC:\Windows\{C1BB9C40-A200-4f6d-8DE8-EF7381E93A21}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F07EA33-807F-40e1-BF4B-FC8549687F8B}.exeC:\Windows\{3F07EA33-807F-40e1-BF4B-FC8549687F8B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3ACFB2C8-0588-4251-8737-9D5A6D902B57}.exeC:\Windows\{3ACFB2C8-0588-4251-8737-9D5A6D902B57}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C918AFB-8574-43a8-87E8-36CFEB7E5DD9}.exeC:\Windows\{6C918AFB-8574-43a8-87E8-36CFEB7E5DD9}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AC04A2A4-5111-4c11-8277-FD47C8D4E98D}.exeC:\Windows\{AC04A2A4-5111-4c11-8277-FD47C8D4E98D}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C918~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3ACFB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F07E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1BB9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C96F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{277B8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9785D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C409~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9124E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{522A3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9A90~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5ca9f6e6fe3e5614637e824c64bd6f9ac
SHA1c4fb949fa544cbb3826d803ee96880d15cc5680e
SHA2565fb309ab73b5c52bb22349a597122fd423a87d32e7bdadfa11cc670aa42de3e1
SHA512fe04d75fd22bc77f12ccfd82769a395dab674c6f0fd15c1d8a0350a043ea3fe4f186619da0747528092b8916dbe49045a7c3371a88f95081f6407b7498848dd2
-
Filesize
380KB
MD56514b0275658c5791c736b3661d07f51
SHA16d47fc6202028d10250803a499ecbe846c596bf5
SHA256b7241dba361c046747b5c36fc265c8de945d4d1759233699e61b6412af550323
SHA5126bf4f8d89881dbec0bb16edde2c3d3b805630852607b93e858af156378f5d3d9f07653bb9e5c28ab00233c9224f4e2f09866dab55cc7b2dce018cb2a4ff04f09
-
Filesize
380KB
MD5f612b8d6faf0b9c37ce13b92f5589b44
SHA13a0b5c56ee5dbb4754286948c66c8c6f099e7d76
SHA25652141fce682f01058f484c04557bbb882b26a3e5d4cc06b68e79071be667325b
SHA512ec377981cf99144dd8e4c334ebca3177ef9ab4fda76e65b2d1a0f274bb947695cf8eb0d3367d1f1ed77f6a8cbef2cce05b5fa136f5dd27398ac88b0d48e4bf0c
-
Filesize
380KB
MD5bff2a37d954bf13b39dd23cb210abab7
SHA19cb32da21045c404195a77bbd78abf843f139293
SHA2567075961ad447dab5e62e27c30f225d9d5e04a2e1576915f17512d230dab480c9
SHA512ed3b9332073e82a26f3e539408979b2b38f1bcb872caab307394e01e9d760463b57ea08eb60e1256479f210060afd973ead29dd3a9d61c18cef95ee79dc0d456
-
Filesize
380KB
MD5f55618438c63ac7aed483c8eceef46b6
SHA1420e1293c25d61396ef7280ebda73ddfaa1aae37
SHA2567a3388ac0155a21f1aadf46780a7bb578a86e4e57537959feb1a58c790988e4a
SHA512061aac781aa1034938406d9956f86e049a1eb5a41436aa74dd498d130a5bfec2cedc321e8d3ad470a8d7ca1c720425a1ac1ddd1fb31baae09e5e4c86606f8fb0
-
Filesize
380KB
MD51fa7a362cd0bb8ee78303df0921e4512
SHA129c914528fd7b81cae9bdc3c1cf6e54084c4c3ba
SHA25621bd27186a2e4137fe040ac154a1e05bd4b740ba1702acce9bf05c36dc1fdf48
SHA5120d2d7a53fc24b49b4c6d8645384f33509c53ef557432b7f0086f5ac9d782273bae58f14c4caeb53c19b2b3dc0b06fcabfbd9f0aa2f0627b66f92c2f917f158a5
-
Filesize
380KB
MD5094bc042ee671b5668123befd9237fd4
SHA1a499fda6434af4ce3f58b7ecf9cc9d20e4b357a1
SHA256137a5dd04882974a95697c4a457b50d59093c846be0995b1d0a9303327771dca
SHA512b2aa68dc48eb6adb7a02698a7f60dcaf725727daa1c53f70b55044a7d27707ced8782dc55012baf06c12ea1e414533d0ca40b3c19c57f73239f9b29c905c72a5
-
Filesize
380KB
MD547734d6a512c4e398eb7232ee392cea0
SHA1d1c51fb3bc0783b3c5337ddd2d5207f3509d3ff0
SHA2567dfad25acffd687a6b6b504c582e4f8276f3a51d596aba3fc7c2ff1538dd5830
SHA512ef8af94e5c6622e5caf87aef5acf1f7b7ff53fa10094c416a8a4b5a6bde5f5b031d1f8dfe8ed050e9b17f24a1ef7b9a3729cf0a49a71dc617f9af850a9322282
-
Filesize
380KB
MD5356e9440b27ec81569c973c37493ba7b
SHA1f40e5fec2f50ee283d5a7134da947e633e413635
SHA256e78c182e565c6ff210df888868d6f61b6590ade4ff71e64c256a91449045185d
SHA512a183f4ccc132c61bb6a9e072d1c34c70b4430b7c61f15d81c9e07d33b89e5d212b45983e4f1f3865185a3a752a1f5efc1118f78c2bb90029c7b9d40abdbebc23
-
Filesize
380KB
MD593bb28000d09eac89bc88afc3ecff860
SHA115397943ca6aec9e540011935f6655b7544b146e
SHA256cd0a54cbca16dc56bb2291506aa0b55965c83ae54c82dfafc5fa49718ec251ae
SHA512b7483aba4f3a65de648176db576973c65c1c3cb8055451fe94a04a56b6bdacef55789b41994eb591fbac88930d9cedeb314189fd9fd129a875f51a0ac0127583
-
Filesize
380KB
MD56e66eb39c51313e0969d8ba78f31816a
SHA1625cd4a0b42af8214aef093fb68475a578c49543
SHA256fefe2e8dc1a53620e520a599ad1477cdf7c1e30699362af14012afcc0257ac8a
SHA5125a70a81b0f90a1f95ce14ac59950c15d228eef1581a4bd00383321cc2b57ad880acff7f802c71dd3234535025a9457163c81322386d72ef6a932e93d111ed1b8
-
Filesize
380KB
MD5809b6a8c404a0104f57035e9a4655c6a
SHA1976fddedb3fd7a0f3fa9255ef9168ee823e76185
SHA256d93ee079d05ff9afc07c4ec4e8f63c378e1de0dffca7edeb8f1c51a3ff7b12ae
SHA5127e77bce46bcf668dde4ec3cc00ddd5c49040f5aab7edbb5f578610b621b69f326ead0568184eeb166e05cb9b5d08c8af45f04c4fd55651cb00a54fdc8024acf1