Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 07:44
General
-
Target
2024-09-14_8b971919b01c8649045830ae916cd701_goldeneye.exe
-
Size
197KB
-
MD5
8b971919b01c8649045830ae916cd701
-
SHA1
970ed62f490f850aa61d911b8ff54fd59b0c1c09
-
SHA256
b46273efaa9f02a0ed52e6f2b799c044eef877acac1eba48c6a3f81a9df28ad4
-
SHA512
bbb26974159f3b9936c90231e71b6cb9f39a501e442d7ca98e1964834392f6ee1684e19163b10e16061997b68cec5d5552a3521627cc3c1f1b435e37fadea2a4
-
SSDEEP
3072:jEGh0oVl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGrlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_8b971919b01c8649045830ae916cd701_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_8b971919b01c8649045830ae916cd701_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2982237-A62D-4f40-9935-A7B1E687909F}.exeC:\Windows\{A2982237-A62D-4f40-9935-A7B1E687909F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33765A41-4D9D-4640-A275-340E20482237}.exeC:\Windows\{33765A41-4D9D-4640-A275-340E20482237}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{396A7FD5-56FE-416d-9FC8-EEDED5450A26}.exeC:\Windows\{396A7FD5-56FE-416d-9FC8-EEDED5450A26}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{001D5BA2-F216-4690-9010-0C28B9446F9A}.exeC:\Windows\{001D5BA2-F216-4690-9010-0C28B9446F9A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8E539767-0FA9-4125-A25C-BFDD3F2AFD9E}.exeC:\Windows\{8E539767-0FA9-4125-A25C-BFDD3F2AFD9E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC39859A-1F47-49e7-8601-154D12EB68D2}.exeC:\Windows\{FC39859A-1F47-49e7-8601-154D12EB68D2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54D87F12-6C55-4146-B1C4-69522D298446}.exeC:\Windows\{54D87F12-6C55-4146-B1C4-69522D298446}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA45F9FC-14D1-443f-AA1D-E0D8A179C6AE}.exeC:\Windows\{AA45F9FC-14D1-443f-AA1D-E0D8A179C6AE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94678900-1991-485a-8BD9-2E69CF3E0BFC}.exeC:\Windows\{94678900-1991-485a-8BD9-2E69CF3E0BFC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE58C0F2-6CE4-42a8-95F7-07E5E922B81A}.exeC:\Windows\{EE58C0F2-6CE4-42a8-95F7-07E5E922B81A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{779166F1-963A-4a19-B262-5984A906625F}.exeC:\Windows\{779166F1-963A-4a19-B262-5984A906625F}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9429E361-AA9E-4e2c-88EB-32E01568033E}.exeC:\Windows\{9429E361-AA9E-4e2c-88EB-32E01568033E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77916~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE58C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94678~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA45F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54D87~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC398~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E539~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{001D5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{396A7~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33765~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2982~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5613975986d0a46e0891329642f6588f2
SHA168401b55d48542fc124350cadae9c5bee73b0cd9
SHA256544a8632a5fee6c1b414d04da3198c1ab2a8bc0541f37832c57991beec0f93f1
SHA512e18d63ebc84d0f6c9298611fdce0f421f54e3a89b7b90eddb6cac300eb7b923bf5fccbcad83bb8670990f210a26a59506fd98452de6a6c313a6c2dd866790245
-
Filesize
197KB
MD5e23def5735db9ed5bb176d8d8de06fc7
SHA14f989b028f5a231871574f9cc1a9f5f4ae981162
SHA2568bebf1f039355d5174730bbf6bce8bb028e673542bda204c86ad237620077751
SHA5123391517568d5d6d0d02940ed61dab6d4e64fb9ffc32ae4f4ec7d216bce4a5e42c315e6ea2151e1b4ec8e8bcc2d795e89cc237c17949faf6bc0c0c377c1ceeacf
-
Filesize
197KB
MD54b24e60259f47edf8c1fbac7f091956a
SHA105bb02bfbd9fb599399f134d418359c59ef11d64
SHA256369181c52e68632ababce61e1812ec3dc84c42d3e4a9bb2205a8982a332a620c
SHA512f1a1d9f9e354b4f2714381bb14bd311622f5c61e3812165ef52b4af9c19fe0038da37a1ad6b131cbac29e2cb2c67a35829892e263b17fd56336a6e964bcae571
-
Filesize
197KB
MD52c40253afdf8fe82b206a6af8af2b6c5
SHA1c722f108d39840c8f201732f6c950e1f8e05817c
SHA256f325923254754ff7e438aaf680de7a673a9bbb76123b659c2b89158a1dd38b74
SHA51260d133379dddd45c2ce90103f0fde7370db416d3b41aae0f30396ce4f0a7caaf32d999c343c60ba2f0bf0f0bff385b973fd89a9011cf7fdc17881f02b8d0bf6f
-
Filesize
197KB
MD523c3ae6b476635197cd0879ff1c8a5ff
SHA13561a5704f1659652345be95d751aeb60d5b3a9d
SHA256bb903bddae13e7f742836bf98a3cb87f1b30549ee89f23dfc34b7c3deaabbef0
SHA5127e44f781ba774c0761036eb1ec3226f6a0a095626fd60d5bee23c4be5bc15619966faf3a1a92461783d547aafaf038c8cec4a0cbcf6165eb0cafca1476492f2e
-
Filesize
197KB
MD5704a777dc8fc7b9da0ced0b69f746d15
SHA1f3d4adbadc7bd7eac51a96d374826129ca32baa5
SHA2568c40686745e8b0e5b1e92172f938f237f3041be0c58cafd5014c7b5a65feffc5
SHA5125fd383ea75c37d2fb61f8cfb0fe69ae35c3ab5b287a3e78474fdfab5646a7f3bbb5f2ca7e4884eaa3f81d36af92d5fdbee8387d223076f64f6c051bd2994da9c
-
Filesize
197KB
MD504f4221fd7c9800f4c9d60cada118630
SHA132c03a77d20f2e8d4064966b24268eeaaa6c1a7d
SHA2569e8979675714916295485207046c1a15cb593286463ab09923db2340d9e487e7
SHA51233d3be4d621fecfe3ed77205aa702daf0b0e22d6df1d3062906ece2bd018cab4148be3d4fc07cc92956f91c55fc5dcf969d2f8d723a7c4e961b1c2296a55cc9b
-
Filesize
197KB
MD543c3352aa887d1e23904b48562b5dcbd
SHA19bac65a499aff2689d5f0fa7157463995f2b0d3e
SHA256c887c37340c5dd18eae6dac00597925c44da05369c6c28fe6388530272d353d9
SHA5125b499549328f3c901ff3b7054b635dc5bfe8800f4dc3dabe604a9d13f0c15fae759c503fb598aa614d47e5711cb0a17e6795c8b7c7238b979552b85dcc4a2368
-
Filesize
197KB
MD54427882c1a2838a6b4ebc9e84eac7af9
SHA1a1daf49ab2ac86fbc0f3e3de0566d3da7baf02bd
SHA256f7573e92e7369d1cc402dddade260919b6a24551eba76fed1b630e7888d43729
SHA512b877f17d52339306a98fd664a26cfe19218ecf7739bd70e302f18b996ad3e979aa744f9c78bdd4ac10dc38ba0bea01475a2718333b3e22ddc12b993bb39b0bb7
-
Filesize
197KB
MD5735ac073c7d6e074f12ba6fd91bdc571
SHA1d25c6263dcc0897b08918125c8d338119593164d
SHA256a28929feb8a8d6da4115321c29787950d9c37f7581701b68de97edfa986e94c2
SHA51269b5d35b80c06e827f4a8f49a35c40ed6b2e155aa212deecb3fab1b43406bd962a967a8693cddef72c8cc207e8c19e69acb7a800b09a16ebe6ecf6995f42f9e5
-
Filesize
197KB
MD5f5a063eec734dc9a69cf73d00c37c321
SHA1e3a9aba629bd5f43949cfb282704228c1074279c
SHA25603c03d460ff95823cd0a275269371dca89e0f376ab56732c5a419f4157be13f7
SHA512409cfb82d2da43ae09bfe4c9d7eb91146315e1e465d44a6fcfa552a7310f450321609571ef0e8dcae045db289b37b19a404f510b219aaaa8b6bd8b4b0a7caf05
-
Filesize
197KB
MD5f4fd445540a6c874509ee125216b3765
SHA1da5ba02c7fcaaf4db0cfff15aa5e965156a616f8
SHA25663a15900b2efd1c9de0278b2f7bd36abc90817b4c910ec82f5ec43e68a0978ed
SHA512c239d21a2c2a104f79cef1852e4f1959abe85e908c3c6ddd0f86d52d376de5bc8ddf01c07886e607e241d1ab298048aea4e1e52eee351e5a8b922b611953da84