Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 02:41
General
-
Target
2024-09-14_d63afda7dbfcaf0c309171dd648b8ec5_goldeneye.exe
-
Size
180KB
-
MD5
d63afda7dbfcaf0c309171dd648b8ec5
-
SHA1
1f0dcea04787560021c93affb4d8b78b78896451
-
SHA256
061c80dd028f5e0e2e48898236d0951f3f336a90e70cc8dfdc69ebc74565069d
-
SHA512
4b6d97583b68dae31223f915f5f70471c64c2ffc6901a1d443639777abdc63abb59a8f41ee9cd197e237119863f6cfd87807376a5f5676a674559d18b811cb7a
-
SSDEEP
3072:jEGh0osklfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGbl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_d63afda7dbfcaf0c309171dd648b8ec5_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_d63afda7dbfcaf0c309171dd648b8ec5_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D96C62F-0342-4e32-9E16-EEEE60BA1A6C}.exeC:\Windows\{4D96C62F-0342-4e32-9E16-EEEE60BA1A6C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E819C441-F55C-4026-8309-5B3E7143A659}.exeC:\Windows\{E819C441-F55C-4026-8309-5B3E7143A659}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2E5AEB2-7BFA-488a-99B9-65387A246A0D}.exeC:\Windows\{C2E5AEB2-7BFA-488a-99B9-65387A246A0D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87DFBC4A-0F10-4e66-A1F0-E751683BDD4E}.exeC:\Windows\{87DFBC4A-0F10-4e66-A1F0-E751683BDD4E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3FCC9CB0-2D9E-4bf0-9C6E-3035CE8BA2E6}.exeC:\Windows\{3FCC9CB0-2D9E-4bf0-9C6E-3035CE8BA2E6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{357D06E1-D293-4a10-82D1-CED9A8DFA9D4}.exeC:\Windows\{357D06E1-D293-4a10-82D1-CED9A8DFA9D4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEA1C3E6-83AB-47c2-B7CB-BB3B433F6BD4}.exeC:\Windows\{FEA1C3E6-83AB-47c2-B7CB-BB3B433F6BD4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56AD022F-D8AB-4b7d-A35A-B529AACDCF76}.exeC:\Windows\{56AD022F-D8AB-4b7d-A35A-B529AACDCF76}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26159FF0-DE0E-4911-970F-099F9F1B4935}.exeC:\Windows\{26159FF0-DE0E-4911-970F-099F9F1B4935}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{719282E8-C783-4335-867E-42ECC0490883}.exeC:\Windows\{719282E8-C783-4335-867E-42ECC0490883}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69D92E5B-90E6-4740-9867-59CED3FB364A}.exeC:\Windows\{69D92E5B-90E6-4740-9867-59CED3FB364A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{11000B19-9A26-4efe-957D-E1E163B6ACA6}.exeC:\Windows\{11000B19-9A26-4efe-957D-E1E163B6ACA6}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69D92~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71928~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26159~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56AD0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEA1C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{357D0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3FCC9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87DFB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2E5A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E819C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D96C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD553656bcb4bf0d1f4305f95e75edcad40
SHA19eaa53add0f929a3120bf37bbadc28a3a9bf603e
SHA256dda4e0295c8e73a180f317f16702410414ae31ae073770cbbdf12fa6ccc64984
SHA512a2565750f317065ce9f52f9ceaa2d132f3b9e447d2b23f1a2c0ce2a26e36dc8540a229af9c505b716198e2d47ff01c00ecb8c262f11fb824933e0a8d209e8f24
-
Filesize
180KB
MD58b7052c398cf299c2d2ffae69873ac51
SHA1f2710bedbeebf5cfb15179e84dda540013db15bb
SHA2569d92c9c9df0a188781177b6bd9adca4ec8d3452bfb7837d508aed35de14c4de8
SHA512cb67d9ec3dc6b88553f78fdbb90b3c1a086b39105cb1af2cd2f63f7fd17e049f7a373a28ffbe717efb0870cedb2fc78b9448cac97e5817f89991c2a267d6277f
-
Filesize
180KB
MD5d90c9d43d1bb49b28cb36222db2cca2c
SHA152fdcd76e9022e35a685e32fc6f97a5228fa6152
SHA2561a5dba8eb70ef230051e98e3a420fc89894fcd169684c24132621ed7ed4211d2
SHA512b1bbcc89ce4b593154602d5e3f1f28e18abfdc6c8ceb8c5755ef8f1f350f137b3b0144e66701aedcfc6f8ad723179a55daa9730fe0c10834999eb114f13df45b
-
Filesize
180KB
MD5c960ae67f39b4192293a82fd6effd374
SHA1721f2cf2f2f1960c1b5a27e6c78d3756a64be019
SHA256ac4fb30bb8c936670d67b107ece89e1461fa129af9ad8000986836dea92d70d8
SHA512a836c01daf817b0a5304e2129819a74882be14f2e890a6eea0d0bc7004d09115d18b48e9dd52023353bc92c3ccbceab3386eff8917d08f45b946244435318fc3
-
Filesize
180KB
MD50f39dcfb0a28a81d062b704d2528902b
SHA134744711bd8440b487004c6be70d66a5cc81769d
SHA256ba7a0215f1ac186c31ef2df39a2d7d329f5c48ff43ad59359997457090374186
SHA51288389ff9f81b992c6423a9999a0f93ca89f13b6932c2a1200aa9820343e01808f9cf3edd17afe11e10557ece8b498064e16fa423c5ae3e1d132485875c4bf3ab
-
Filesize
180KB
MD5b83bff4fc4a2a99778ef3dc64d0d3662
SHA1c68dd3ef36f97c365a0d9a756ff4f2c28942f6dd
SHA2568ae97464e1622bd4d56d4959252ba21ee5cb82d909c956cb3bad712dd5c25ed9
SHA512b43f0ef90ae422ee2534d3e25168a41ae8bd52a65cc10cecda64453f99d74201839ce591f4b6216a2fc253da5c0778c47ae6fcc81394eb284a4d3b30f156f722
-
Filesize
180KB
MD5bcd13c6535814bec5005aafa18c33c72
SHA11c34ad01d36259d27892ac1bd68864cb9c4a1155
SHA256256ce96847f5d252a7bd1d4bf56d118cb9df98886255d8a80b4ea9ad28f95a4b
SHA512d977e4e97cc42165299b2dedc11cf03f70af53d25b27245faea8f97738e4b83ec32e113d1da73d8e3d1d63d13bb3dbbda8985ebd145e48a1a4a32332925e58e2
-
Filesize
180KB
MD519d7616fba7984c3988d2522d5a9c3f0
SHA1d4ff44439b417d01bfef897733ef40a53e2ca3c4
SHA25668b3a2db4b60b5b6eca96a20f0047fc5fc8b467d0cf94b2f2e1579f25463b2c7
SHA512baf1744b07a4d0a784cd02c2460870f12d71ed65dc5937e7e17fdf56c256661ed3030dff2fbfc806646e9130eed263b6978064b24cb447b229d97b915ddaaeee
-
Filesize
180KB
MD55fcf50d0ef0d1b1d0e6f199675a617df
SHA198b977e9be0de752bc6dc67d04ce0206e3c8bfbe
SHA2561ac33e7c57b9de91b7c7e9e71beb23f5f730259f15ed4d051eee7c626d497c0c
SHA512f44bc1668e325378b5fc7965c7c318493e10c9c8f32bf8986dfbaf06b650456eb333e93d7d705cdfa88fef7b2446b2f370c960486220fbc4c547020651fa3347
-
Filesize
180KB
MD512fded1a7a0827604f81b2f7d8205135
SHA16877cb747436b3bed3a95bf8ae6d2053ab324b1b
SHA25632a4a8422addff5a10d58a978a5e8532e8c6ad8b7533ddf4df510ad3fd7ae435
SHA512b2d4372b99a0ee552507e94a9c247b2c9cc1855694bc1d1619a06812bd360171a8dbfaeacf88c271df66e66aa0ee99bf6b0ec7b0d2693e73326608fefcfc4a5f
-
Filesize
180KB
MD52fc8f23b57884b8f10ff87372b6bf13a
SHA1e828824759d5309f518ccf5447ce6ca5a9dd947b
SHA256007717556aa0e4e7401a960a2c7268001c6a1a90291ce116058c2528052ab647
SHA5125639674eb9e9b618c1743284ab145595750f8af0e22d1bc6e1cb8ce2f2e368fcb49fcf2a282fdd7c7a8be641b4e0323a9bf6c55b49b95c1efb8445acd166bafb
-
Filesize
180KB
MD5c3c0e5b4cd623cec610301df25902396
SHA14bd35b6fb3a458905a197407b54dfff8a953d95d
SHA256995c104b51f0ee61e3339c72bdbb00dd7e9518af3bcd641ec40ea5f8dc466e6f
SHA5128e6e661150caebd11d711cc81385541c27d0483666c0d12defe81f73b29197de5777d4a9aa9af57051a1e79d2aedf81d7bf098035ab3409cd890cf74e27e71ff