Analysis
-
max time kernel
149s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 05:55
General
-
Target
2024-09-13_70293947357ea290aadace87092958ed_goldeneye.exe
-
Size
344KB
-
MD5
70293947357ea290aadace87092958ed
-
SHA1
75e815ce877662f251d679504f468e1c9bbbe1db
-
SHA256
63bd316e8f0d2d7712bcce63df0839d06fe213b6bfbc0223111589616a2bbca0
-
SHA512
443e041531d138ae9934a719b4aef30404b9cf4e463ebd28dc4b91e483d7887fbbefc9fc1b7df29b7313b12df3351e0b66327a88aab6e105b53a57c953e436d7
-
SSDEEP
3072:mEGh0oOlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGwlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_70293947357ea290aadace87092958ed_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_70293947357ea290aadace87092958ed_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7285AD50-8399-48e1-9EFB-BB95ED6CB6DE}.exeC:\Windows\{7285AD50-8399-48e1-9EFB-BB95ED6CB6DE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E1F5D42-3BAE-4108-9CDD-E7B7785BA097}.exeC:\Windows\{0E1F5D42-3BAE-4108-9CDD-E7B7785BA097}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A9194FE-E2CE-49e8-BAD3-4B9FBAE4732F}.exeC:\Windows\{9A9194FE-E2CE-49e8-BAD3-4B9FBAE4732F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{733F70E3-5804-4a33-B2F5-9A684727D93D}.exeC:\Windows\{733F70E3-5804-4a33-B2F5-9A684727D93D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F4EFFBD-56E0-4b7f-872B-0B142A271C74}.exeC:\Windows\{9F4EFFBD-56E0-4b7f-872B-0B142A271C74}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3323B02F-7F05-4870-92D1-82430D8D1D90}.exeC:\Windows\{3323B02F-7F05-4870-92D1-82430D8D1D90}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{926C952F-7F14-4688-833B-E37CDD9D1A00}.exeC:\Windows\{926C952F-7F14-4688-833B-E37CDD9D1A00}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECC888A6-A297-4fa1-A610-8112DA2ACA34}.exeC:\Windows\{ECC888A6-A297-4fa1-A610-8112DA2ACA34}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E1DFCEE-A490-4e9a-98A4-B5A04C2C9307}.exeC:\Windows\{7E1DFCEE-A490-4e9a-98A4-B5A04C2C9307}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5BE4744-2C9C-461c-8F79-814B8847C10D}.exeC:\Windows\{A5BE4744-2C9C-461c-8F79-814B8847C10D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B0A4601-B448-4a21-8576-DF4B89E5FFF8}.exeC:\Windows\{2B0A4601-B448-4a21-8576-DF4B89E5FFF8}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{15651121-A2B9-4aad-B1E2-98B41FE36897}.exeC:\Windows\{15651121-A2B9-4aad-B1E2-98B41FE36897}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B0A4~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5BE4~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E1DF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECC88~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{926C9~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3323B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F4EF~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{733F7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A919~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E1F5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7285A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5358df4cc48af9bc051544ef5e449d846
SHA16a6e2e757bda63434f75fc04be0d35442254bff5
SHA256ac5fa989a61337e764db5a7a32645a4974ae4d32b5bc3463dc262509be370b1c
SHA5121834028deac15ec83bbbca99f3d31c03a035aab4ceabac519080781a916ec04f2282f37db179ef6ee8560269f305c3b514283fe60e44622d97579b896b0a65cc
-
Filesize
344KB
MD5f7869ea9677fc3f61625ada9bdaa558a
SHA1748affc910201436910ac7155124a614e4a5e242
SHA256c83bfb0e04cef6accb990e31eb31c1e0696c4408073496f26b2d3928f1cd6187
SHA5124a48d7eaa6fab1d0e674bb5ac171e2d36f32748c3c095242f4c0f0e588629106ee5bd72911e6d1e518fef297c281a154525530480d96262059067fae0b72b666
-
Filesize
344KB
MD52710c20e34dd11b4533f44d9a69e8484
SHA11fa9320187f1f5da4f08e30a4f3c0f02c7c4ccf5
SHA2569da6d6fbf8578cb3e899ead890bc385769e3fe13af5d0526c7cd42310dd7b055
SHA512c57a54ff2e901c55d014e530c193784c8ca7633955fbf72b7b9fba9f54a0e6dc3acf68293b2bf8b6ad650992a2ffe36261fa2d7a704bec31e753f0bd894190cd
-
Filesize
344KB
MD52070291906b5ff6a066b53c6a52697af
SHA12bb65caf2bbc1759a24cef0c5fbe3e3fbd846018
SHA256256617bc0e0ecfd2c62f9692f1499b8b671ec394d4f2a63cd0c68950207c9c19
SHA512f76fe0df108fc92badd7dcf8287c10907c09adcaf23d62f79b2c51cad386e6d1ffa5c6d7e2ccc671abbc7d6673249adf537c210c828c4a76253e40d8d2ce419c
-
Filesize
344KB
MD5efa1d301aa0e1dc6725bb839e919171f
SHA1996b48995d97daa0d94779aa11e34f3f4d1f501c
SHA256caab7a56860e7dfb7450a9b669adf1cd30233ff6c7cda47a33be039306fe9ddf
SHA512a9866f2afd463c3fc3c8138e65d1964de6bf017f14436b63640007b5dd145f4a06c1d8674e58783a4c5cace4ab790116f3c39c75c76a5321875b60686e15d967
-
Filesize
344KB
MD5e5b6df7e5ea016e4abec835fd4ce4632
SHA1975db96b50170a914957084446538e64a1b6e905
SHA2567dedc647b75a0fe2acf34f7e70833b8dd29b617ef6c62c0ef5731d4e0e4f2803
SHA512302556a62ec45bc005439b59103a2a2e3b9a9a2fd792228914b7eaaee77c59c4d58993e684314b5a6cb12569ea5217f5890f91415abc3891daf3453edf76d1c4
-
Filesize
344KB
MD522bd7f4b1d70e98b3dac85c00fbae9de
SHA113142cf419ca097434cb9cb8f0c244e1d709c650
SHA25621b4f473e27ecca6ff0c514f20617fa04a286b7cc315f3e98c87838194c486b9
SHA51280a3a92fe724efd4aa6b17337c6e981fbf4a033d5790117f6b1a2938a23605c8944b6d2aafc9c0cdbcabbb9a094fdf564ee5b6696d3bd643b5c53b48804e7563
-
Filesize
344KB
MD5d54ff679d82565a8f155776bebc12bbd
SHA10bac68ddd906633d3730465cd02d6658c4fceb12
SHA2566c0c2bf205d6095fb1b2faacf4e278f7ff36e42cdac57bf8b15ca7e2e41ffceb
SHA512fc557d95fb94a5bcedb64083ccccab933d1ce3e4ab225772af6a380726549608ce5bfbad8d9d0f8bcff5e9a6de5b0f7dc49a346f4fc0be5ac2f521b245353b39
-
Filesize
344KB
MD589ef26845ac85c1826bc33a14e1ba0c9
SHA1685e50b91bdacacb17245c2ead17b0f3c101a87f
SHA2561ff9977af3c114b5ea552f8e7fa6d73d643ccd728c35b59e4fede64a7d8734a6
SHA512c3dc8a2ecc538eadd5233b4a454dfb4f5c3c3ea4e0c1ac6e64787a3f9696cb1fa33c5421cf05df3e28b9de487acd7b97dda4c01dcceedea4d3a217dfb3ef2917
-
Filesize
344KB
MD5b721207049a2299a4b231de027f0e55c
SHA10accb479c0745d2a651a74f24ae4e2df8d5cdc15
SHA25659fcf9746adf188db750ad16404abb13fc23da9d7f7a9a41692794739ce15177
SHA512d7889b4dee40c5e7e96e98b039535603c1d0034240fdda308415354cfc9cd2a9632f7b83c1071a2435e81824dbc0b2b6399df118e0b7d445a80da15d13421b74
-
Filesize
344KB
MD56cdf2123e7e57372bb2341157d97617d
SHA153cfc6b716faa3f8f604d948bd693b7629a3686d
SHA2567a29a392cd6d139b13206ddc90bce56c2c692caf2054499cac82a0ea2eca85b6
SHA5128f94da6ec8b2ebde1e9faf486c14ab548b232c126864995ca123dd940da1afdbf91a36a16a79212afe9a24ddb5bd93588ecba400ea7712111101f7a75398435c
-
Filesize
344KB
MD58458384e715a629da33e816094fadc91
SHA1827a199c56fa4bbf0e1aa6700c6e4a584ebd4ac2
SHA2560dd6e4e29f417a5a21ddd5df42def569bed188fcd7ff33fb47082d738922ac3f
SHA512b4425fb8046d71a07d2ef9832ee517cef0d402f660204e0ab28553dc1d4dfc5f702553dcfc153b1e5da84e6c6817ec2b74a298534368fc164ecfd1cdb23e44f1