Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15/09/2024, 03:50
General
-
Target
2024-09-15_c3b2a327060de7bc2385784b0a4a24ab_goldeneye.exe
-
Size
372KB
-
MD5
c3b2a327060de7bc2385784b0a4a24ab
-
SHA1
8d6065a96394f3be52d82ce5f482087115f09715
-
SHA256
4727c7673a09808f86857badd41fd1aafad23160fe941660b55721c9f0197f81
-
SHA512
8c4b0dc8221cb86417958cac25b6f19710b2d7999b5c60358a9a75a370066143ce03d6f676563858f6be742d5d933a02ba582a23492038a6702bdf28bafe02c4
-
SSDEEP
3072:CEGh0oCmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGZl/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_c3b2a327060de7bc2385784b0a4a24ab_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_c3b2a327060de7bc2385784b0a4a24ab_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCE5A2E1-8E8D-434a-B4F0-1E2B853EB0FF}.exeC:\Windows\{CCE5A2E1-8E8D-434a-B4F0-1E2B853EB0FF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74F7FC6E-A4F9-47ab-89DC-3EEB4A5D793A}.exeC:\Windows\{74F7FC6E-A4F9-47ab-89DC-3EEB4A5D793A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21A0BF97-B032-4e6c-911F-521169E044DB}.exeC:\Windows\{21A0BF97-B032-4e6c-911F-521169E044DB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F25130F-B360-4847-B240-1853AED167A5}.exeC:\Windows\{9F25130F-B360-4847-B240-1853AED167A5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{651B5BAB-CE49-40c7-94AA-F94638BF826B}.exeC:\Windows\{651B5BAB-CE49-40c7-94AA-F94638BF826B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26BA1475-C579-404c-A8F7-BE4D96DE1135}.exeC:\Windows\{26BA1475-C579-404c-A8F7-BE4D96DE1135}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB7512B1-857E-411c-80B1-F8DF61B799FE}.exeC:\Windows\{EB7512B1-857E-411c-80B1-F8DF61B799FE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4845E796-ACAE-4345-BD7B-4DE2FA4058EA}.exeC:\Windows\{4845E796-ACAE-4345-BD7B-4DE2FA4058EA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59DDACAE-5D96-401c-BD7C-828F54EB2CA1}.exeC:\Windows\{59DDACAE-5D96-401c-BD7C-828F54EB2CA1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDB7F45F-5B50-4d2b-AABC-551C4073254C}.exeC:\Windows\{CDB7F45F-5B50-4d2b-AABC-551C4073254C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4894F75D-3DD9-4e77-9CF2-AA28FEF43034}.exeC:\Windows\{4894F75D-3DD9-4e77-9CF2-AA28FEF43034}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AA017463-96B1-433d-ADDD-3E3498E4C4AC}.exeC:\Windows\{AA017463-96B1-433d-ADDD-3E3498E4C4AC}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4894F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDB7F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59DDA~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4845E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB751~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26BA1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{651B5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F251~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21A0B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74F7F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCE5A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5ad28e9334fec492dd34cce7d0511d07f
SHA16aa00ac401e7f5cdc4d61f8d5c1836cf16593f80
SHA256166e9c691dff73740b6fe60929b952da503aae85deb6dff4e7c71ea8f36ec556
SHA5122f4ecc0753ac79dcab67ce8eda3346b398424087b28b67cbaaf7a3b1b61fd1a352cf310f342261a9f8f132d108a20075373e10d4265a512fcbec274e24af101c
-
Filesize
372KB
MD5bccb18ff4d78c9049c2a1d1f5fd0d609
SHA1f7ba4f12e1aca98f05aae1e649689e07dcd79132
SHA2566b7b619ec167123a673de41eab2ddc2e693eddca8767d520cd781601234c6b40
SHA512c69593c7a9cbefc383757f25aacbf70c76351e1ad5226049daf6397318517fa69b54c18ec77e08606fcf86629191ba91fd54f9e4479bcfd91adcc8953112f0b6
-
Filesize
372KB
MD5b3d72f5ae5c499e5f68a1caff35cffdd
SHA19b7f203d8866a7d75d39607c778e9ff0009fef21
SHA256dc073e969cd8d704bfca69d53a9188241ee28f340e081a27c116e6ecc95135d9
SHA5120ffabd40cf7047eb7c013894babbeee1a04c547b370f738672d52194dc8098aa4b870270852ba6fca5b2ae288e0e68fbb698ea9698e0cecb8611f922b7efe526
-
Filesize
372KB
MD5da3bd07f3a27b39563e688c50aab4b2e
SHA107691d436de83483f851effdc888aa60dd616282
SHA25695a026775cdb6bda95df91041b8967aa24d67a7f38821465f47fc7c200b27f49
SHA512bcfde0eda6b298d3da973547efbe1eeeb8e953509f3b082c40e462b8956c1b9a40f3eb17f074c9027afbeaf0e5dd9bba0f58eede1e485f91ff0243b3ca8ed24e
-
Filesize
372KB
MD55e4872e2edc445c236d1ee8d9b82fc4d
SHA193ead829b85ae4128fec6a16c5b5ccb75a823b54
SHA2563f24eea9aeeffac7227d074d872919011b4ddc14d44fd4089ba2b0f341960e08
SHA512b04c78d48b3297921c2d504c25215eeed4b3737e0cce03097d71633946955b61df88fa4335cb42c044c4ddfadac4a041bab700f736659fe5e352e2fbaf6bbcd2
-
Filesize
372KB
MD51a09add408cc75f71a1a47542ce2a62c
SHA1b221eec46d5469004a3de56fa1d15640a14eae13
SHA256a41307e1d06109ba574afd77c00283fbf467b255f77fe9532d23d91136fc1aea
SHA5128db8723157aa78a8d1dad69c668af8221b5219476bd8b237bf80542cf29755f159806417cdb59bcc43de7cd110726a404cf84f2d202d53060b79dc7b43f9cb0c
-
Filesize
372KB
MD56574aa5e1343d0ecf1ddb4369cca497f
SHA1d17040b698fb054d6ce51e635477ea3bbfb206c0
SHA2560c5058584c4fdcbd010c6419d9cb4dda9c7f89adcd5cd0faaff56094a22f3c1f
SHA512a5d77412c6662ebc65a0af6583238a1f9003a96fe6f4468598158b410bb7e9c2a3714f18bc0f66106d7f9f398a3839fcaad5161dc8669cb54000ad6d5898866a
-
Filesize
372KB
MD57a8ea7b0085f2a49e4a65a3084fd907c
SHA1fe28e341446943f8bb165955c429ef64f4dc98fa
SHA2567767b5d6f43d0bfcc75fb3816c0679022340c1e37f8bcd77c824234f819d6bf7
SHA512e9271d907f6af0e1efbc80a77015e0068c77250d17e6ade3a09f2c6f868c6de5e6d1a0b6b42a5589c0829d57b6cd8f4d8039e327ff664af863f3a489b5b56f72
-
Filesize
372KB
MD500b065397902f24734db70a750bb2300
SHA1894b951179f58447cca1a94e54d088d118fa1ed1
SHA256ffb890bb76f31125605730442f4bf5c1e99298101a7bab4fe758ae99b80939cc
SHA5123d9fdf8a018740f5d8b2a69eb05642c3ca01f113dd81e48e6153ad1925a498e7937db224dfcbf669af85a9c431638db130e9455b62b519be519ab2485f86aae5
-
Filesize
372KB
MD59bd3507a9ba3d4905e9d40f130cc8098
SHA190a5ebfff7d54c06aebb80de10ae4f9246800923
SHA256d98fe9b5d39944144962d3940bf6c03a3ec88eae70db623526527a893245fe74
SHA51282890a623602deadc509e71d99c7a4e1038918e478d11b7369b57e8d13b0309a1286f5548bd908c352daeeda69f28dc86258c08d834863aed336f5db028644b4
-
Filesize
372KB
MD51edbdf04ac9ec934394e617b1af01e71
SHA17bdc77efc90698ead30a9dec5159010686519170
SHA25699d52082a92935e24c5b6d6497378f5f00bdcb77f039153973f57de63f2f9059
SHA5120a80c30cbcd9999007da84c96448fc6bc0514f8d182c1a9fddc6a0f0cbf6b9636042c52c3ac332fd108aa18ff855e81551da1bb5acf4d7ee1c320d9e13b51456
-
Filesize
372KB
MD5d420cada96cd3178c2e366973fa0e93b
SHA18859ded093fd46a1dc18bbd2a908e296954be676
SHA2561bd74546c02c934b3c785602d17da9687a1f4d35728d84295c222e221819bb0e
SHA512823c83b4de6887c0715d9929ba98886a791eef4e4ea41151d79da618b4c44a8e58d76333300e5e5e2ee5fc2257c0b51f1745d09281778656176280e1ee5ed554