Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13/09/2024, 08:43
General
-
Target
2024-09-13_5c761811ce80777d2517a1adc9e860b3_goldeneye.exe
-
Size
168KB
-
MD5
5c761811ce80777d2517a1adc9e860b3
-
SHA1
a7eafbf7e6fb9ed33f1af9c66a2398dfd562835e
-
SHA256
2109f3a395e920ae23089e8ca60ec74928d9daa3e0719cd60e6a6c53ad766f0a
-
SHA512
c58237fc7d747bacfa5148a14fa8fc411e4d3c75ae74d109b71802ba67077107fbb956a0c27fcf5f91d7e4374c83cceddc38be0d91b38e1ce002814353173786
-
SSDEEP
1536:1EGh0ollq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ollqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_5c761811ce80777d2517a1adc9e860b3_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_5c761811ce80777d2517a1adc9e860b3_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D09B822C-7E0B-483f-9D0F-4B7DF351B035}.exeC:\Windows\{D09B822C-7E0B-483f-9D0F-4B7DF351B035}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A32C00B2-C612-4cf1-8354-313F1F256BF6}.exeC:\Windows\{A32C00B2-C612-4cf1-8354-313F1F256BF6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6406925-73C4-4c1f-AD4D-71C89EC0D7B6}.exeC:\Windows\{C6406925-73C4-4c1f-AD4D-71C89EC0D7B6}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBDB5A38-004B-48c6-B06E-9CCDFA9C318A}.exeC:\Windows\{CBDB5A38-004B-48c6-B06E-9CCDFA9C318A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1CD6505C-DBEB-400a-9ECC-D1181580FB96}.exeC:\Windows\{1CD6505C-DBEB-400a-9ECC-D1181580FB96}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50424EC1-54D7-45d0-A2C5-F351EAD20E7E}.exeC:\Windows\{50424EC1-54D7-45d0-A2C5-F351EAD20E7E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75965323-BDC3-4cd0-933B-35448D469F92}.exeC:\Windows\{75965323-BDC3-4cd0-933B-35448D469F92}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8830AC1C-9456-4085-AD38-FF40CF43DA42}.exeC:\Windows\{8830AC1C-9456-4085-AD38-FF40CF43DA42}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{E65FF984-790B-4089-B9F2-7250693B5F6E}.exeC:\Windows\{E65FF984-790B-4089-B9F2-7250693B5F6E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AD736DDD-8070-446e-826A-AC048B41F32E}.exeC:\Windows\{AD736DDD-8070-446e-826A-AC048B41F32E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6A804CAA-24B6-4174-BF32-F20861412147}.exeC:\Windows\{6A804CAA-24B6-4174-BF32-F20861412147}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD736~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E65FF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8830A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75965~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50424~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CD65~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBDB5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6406~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A32C0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D09B8~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5871defe19b8c047f192dbcef54e450bd
SHA193ad2c61e141e56fdc55f217204944fdd7daf842
SHA2568343cca7d5ee261b788e12526336d1e930d6436b02275ccd6c7fce8959a7d045
SHA5121eb8f88a360f926a881d057361c8cfed8f07012cb594481fae343484e7e67e4819cfe5a94d4142b21b4167d901d15d28da12aed45a7c81a16f327858e105e6ff
-
Filesize
168KB
MD572d08c9a257a9250e06440325c9a1516
SHA1d3fe2baf0ffc1cfc563692eec8dd559a651f5a9a
SHA2568f2a55b02f46cd91667584ca58f01090abce91ad9c01ed9be330b545770b5a3f
SHA512f75d126462ddaa2e183aa3d07c50e046d4143a5be1bbc99e00e9d8acea606183cb9274d9264f242aa49a5ff9f6a0d87963a1761b8f6e7917d079456b787a233e
-
Filesize
168KB
MD59d8881f928a32e1093a28c40143293a7
SHA18baf512ef1f5153def6205fc8268c93bcc947de7
SHA256ef157a648555ce7299027b69920f60ca99e670362f761faf93bf4c39a2bbcbb6
SHA512c5504263576c60d9f8b04b0e74e101a915d02aeb163c948b09aeeadda780adfd8f114ea8b5a1187213387a2b4f53e4979cebd444d5704a9139a2dcad0881451d
-
Filesize
168KB
MD51d306aedd3d426c2ccd35091209d13b2
SHA185074d243ad30d93650129f0330ba9203302a0db
SHA256354c46f3cbd871ab586ae3daed9f8e0ee6df7fdd0e83f632ebb7dc9b5323aa2e
SHA512588bc6ea2dc978b2c67a017e7aae36657866756983d3e9f69a54d0408c176fa37cb1a6b134bf7cbb630d9fdb6bb6e1f8106fb64ab3cbd59b33786fe85a3738ec
-
Filesize
168KB
MD556af4730351186243a645d46b38bc46b
SHA1a5150652282abbb6572633860028334540f27e7f
SHA256017c17e48768bb30648f8b0061e2f064d47ab6171e5ad56866b328df70df936c
SHA512fa09affafdc2464934d6462624bcbaca77ad4aa3eb3789daf3283d18b3ea6b2fab6b5e3ae51265317d8ed00e1b6eefb4474ceea433f633bb5cd1896dcb993cdd
-
Filesize
168KB
MD5e0f6713193ee9edebbc16c7f15a00883
SHA12a02ff92850f08295b021414db52d09200dcf007
SHA256a678d4d2d4fa0f7229f384b16d757ba0945e93a35f62e98cd87c075b317cc640
SHA51270dbd030d56919e7b9e94e81cfef567943c67c27399115f83b29c131a4653afa767bbe89cadddfebd62586a8524713c72e9b5f6a84e6b375d845440ec10ae07b
-
Filesize
168KB
MD589c689c94408928620977dfa6f9ebf7c
SHA16b5ad5b9ef6bbdc0f7da96acf80b18225c4e34bf
SHA256946e73fc238a30024cc32e469823d4e09c3614a4402bb0512bbe65f7a88a460c
SHA51277f926c963fb2559ef0acfd1acdb72eeccbdf4a5b3f7f147b58f06d3314af67b35ec7cdf9beb6f8cb350b86a4371915f5782f96b584eebebbe45019d140018e9
-
Filesize
168KB
MD5a750766b3b6d760df877571e09a41937
SHA12f4e74c00e85c8387c7c70669b3c63ecf4f5f619
SHA25611a49d7589fdee2fa9f0a047d863bd0897045847128d0662910bc90896257b73
SHA512ec27514ac5adb52ef8543e31b9967b4864492f5bf2ba621e8609fd6db3b48f3d8ca2b62b4cd6748d97bdf32285d667857b73a431facaef9d002cbfc3e142b02b
-
Filesize
168KB
MD5dfadf8732fc7530ae92722174809ddc5
SHA1c3cca4e1818f07797e48c2387689ccec887c5793
SHA256e9fba9d49a5c42183e85ba9a441c2b10779b06f770078d9acadf9a30128b4087
SHA512c504dbecb2468e9130781366bf77115e319c5286a96eb61f41261af3e00834fd76e6005e7c599864e67228fe2f521dbf316c230f5235936ae5b53e97f7565759
-
Filesize
168KB
MD562d32fd02e058f2cc26005cf5df55592
SHA1c4d7da677220d2aebe4597a4e7c3d0b6f86c8716
SHA2560b3da5930822362a0bbcbd93744df07da706fb91097d005c3cb42179dc682edd
SHA5127e6fab1c0c73f0dcc80f06c3851988cd883606ef10d9f78af8ebb9fd77f79551245f49220fd48303199091d129d78f35fd55902645c5cd27eaca177ab3c8e1be
-
Filesize
168KB
MD57a5c8c506a216ff93a5af02487ac3aee
SHA14258db50ec5fae04cebe47e033c058b633e0489a
SHA25627be061a5de9fccec756a8d778a677224707e644a1a4ae0a9c4824b8fc47b3fc
SHA512638595e1af852c8c1dfeae2894c9b5a7109a5d4b9271b22d611d46d419f3b05e5575de16461e7f04dcceebb6b72216eb6e226c69524902345f8aecb920fdcb89