Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 03:52
General
-
Target
2024-09-19_401a30d11ab6c7b7bfafd3479ae1ecaa_goldeneye.exe
-
Size
380KB
-
MD5
401a30d11ab6c7b7bfafd3479ae1ecaa
-
SHA1
6a509eb833950b6a796238afa1e605d91811f41f
-
SHA256
54ad90f99ca7977f86d1610a98f8550c0a4ccd77c4434e45a25cd76aafb4a507
-
SHA512
1ab57f078a873a1048a8f4a58a34ed6b7d10b35191cba77b2ac71c38a9404f6d6f0b7ff342fdf158fdde6aa8d48c825edf4307f1c0417bb69de0de33f272e726
-
SSDEEP
3072:mEGh0oQlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGal7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_401a30d11ab6c7b7bfafd3479ae1ecaa_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_401a30d11ab6c7b7bfafd3479ae1ecaa_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFEA2F75-6B41-4bf6-9BB0-03488264568A}.exeC:\Windows\{DFEA2F75-6B41-4bf6-9BB0-03488264568A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4B1ACCD-01FE-4da1-9513-F25DFF9E9E18}.exeC:\Windows\{E4B1ACCD-01FE-4da1-9513-F25DFF9E9E18}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C5C71CE-350B-4017-BCDA-7F583E5A06F0}.exeC:\Windows\{4C5C71CE-350B-4017-BCDA-7F583E5A06F0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8963E4F7-84C1-4172-9451-6636E4ABE1EA}.exeC:\Windows\{8963E4F7-84C1-4172-9451-6636E4ABE1EA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF99C50E-71C2-4eb7-AA40-B6975F48A079}.exeC:\Windows\{DF99C50E-71C2-4eb7-AA40-B6975F48A079}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC4D5E91-03FD-4d31-A997-CAF84DED2C75}.exeC:\Windows\{AC4D5E91-03FD-4d31-A997-CAF84DED2C75}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74329EE8-3663-46ce-A47F-7A848E3D1730}.exeC:\Windows\{74329EE8-3663-46ce-A47F-7A848E3D1730}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{443D8FBF-373B-4c64-AA0D-0874D4364793}.exeC:\Windows\{443D8FBF-373B-4c64-AA0D-0874D4364793}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C31434A-D0D4-4d33-A4FB-7854C1CBE2BC}.exeC:\Windows\{8C31434A-D0D4-4d33-A4FB-7854C1CBE2BC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9478233A-B9F6-488b-A0F3-D54227D1EDDA}.exeC:\Windows\{9478233A-B9F6-488b-A0F3-D54227D1EDDA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{507E989D-D9F1-4719-A473-AA89BD79CCC9}.exeC:\Windows\{507E989D-D9F1-4719-A473-AA89BD79CCC9}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C5920558-E208-4998-BCC5-271EBB704C95}.exeC:\Windows\{C5920558-E208-4998-BCC5-271EBB704C95}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{507E9~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94782~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C314~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{443D8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74329~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC4D5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF99C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8963E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C5C7~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4B1A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFEA2~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD50b13c959c8b439bfa322193e1eeb27bf
SHA144817c8f1853c36558d9e83b0a9895844a7e3de3
SHA2561e66b754afb90cc122debb76b5edb7e57a957c869888a447306c9f15fb7a7cec
SHA5123bf11d29b6ca1e613775db5115718547d9d38d1164b1b91f347f22d01c303ab68237b98e60aab16c7ee465b498a4b90715b5bd0136ad89ad118106ea88d9668c
-
Filesize
380KB
MD5243a4a1c065befd9f761430c5551b7bc
SHA141c7559680b8090ce58e77e6622bd323d8abf980
SHA2562fee90aa89d30daf3c1632125cd5cf89da525d2ed2527b14ead7332ddeb34449
SHA512303c3a2ac5a21019d393bfd8fb10244ae8d0ae10c5a0bd0f9ad0496203c93bf624625cb693d3320d13c45c5790b1410458234360d8eeaece647a4acdf80a7068
-
Filesize
380KB
MD54aeb72392ca7f5da08068cd44fed9af5
SHA111e422f90ee070b9f971d4db5992b799c3fcb667
SHA2562714d557256b7b7ccc54a7fdafab185b9ae973fc4dc180d1cf76ea0bd6f6b3ef
SHA512a33c335bbb4c9db82526f8e9546ed2f47e61c99562dc7ade7a827336a2fe6da1bba70a716afddfaaf4c73f1c8965fb88e526376365f1ca58e51150e9ec245746
-
Filesize
380KB
MD5c3ea896fd49b3c4f4ffcf2a375c93a03
SHA167feb6117d4ff99ce7f6d88d8d4e9dce4c8d3f9f
SHA256504594d8c7d2a5b7f77cb7e2068b2710b5ca41a45ccb4915b084dc1c4197a304
SHA512723e851195f6aa385cc04beb36c3c8dcd3f8e430508155a0e9cc8b41233fc52dc77f643d735ca3aade619f69eaa365f57ec2f90d386291b66adde1c30ca10235
-
Filesize
380KB
MD51be2b4efc70b14d01b00e3960efa53c3
SHA18d699af176377094a0d2378cb746fa89771e5d04
SHA256a9251094bb54bf2ea3410de3f76a4c4a4031413bc598a27e813dd9e46098cc89
SHA5121173d3ba79980b3c8e83354720ecf23d76813eda41dcd2524d4dd71de4c99821675f435755d6f13e073079219739317278f4eca5d1b523070ad0391856b50465
-
Filesize
380KB
MD5208c1606e83a44445a9911d2d13e72ad
SHA168e95f490262cca6b9f0db98de5bfaaafe617995
SHA2564ba34010ab0bb33706871a5f66b4888f48455c2994a68ff1df9ff977fe374bc1
SHA51241df89a02a24abef9150d5a8e4d7ebec9009851cc66a855b18f407fd3eb366dee51d1a912c6e8d9970cc12dad3e0c2b28da294ad89d9b7811c64f11c8b695f29
-
Filesize
380KB
MD5244e300f6c08fc4c94808f7eba822761
SHA158c6b61e21e4b3a9a0a990a3254f54339eb8c1a5
SHA256109bc8465b6a66786f1509fd17b490459df4c7d1b6155c732bc8dab4f06ef0fc
SHA512a99f8bce931cf9cacb93cd97c3331bdbc360db71e64fb31ecb37f846933c8b4363ff6dabf7148f160df7856672f77df175ccf1522ede9c63cee31f0b13b6ff2b
-
Filesize
380KB
MD5c40c8b110cf2b550f3ae63598499cc34
SHA1cafb523761ffbd8edb95de3d0411b0634abbd067
SHA256cdaa758ca3aea5336ef3385b98fb85fc4ad114f649e52b168d53ba85bf28fe0c
SHA512e62ffad845a77659b683c9eb80994deb45991b2b75034b8666a807e59967a9051cb698790db3b2bcb70a838e432e82a8120ae0c86020af89cff62ee7f8719170
-
Filesize
380KB
MD52845149c80f189a611f5e193192228f9
SHA15a5cc68a1c8678d902615e1a04721b1a4bf61708
SHA25673ec2706ffb6cf5b61ef32b85e5f2e11c4d5095bd1c32fc884a775e405b88647
SHA512c8cda8aad237dccf8d07793424f4eda6860e556dc074847bbe4ef5b65c0362e576a721451d1b7e49a03e63c97d2e90a6591f27cfe4b0b83813244be71344532b
-
Filesize
380KB
MD5829ba672327f7eccc0ae1b68272ba69d
SHA1ac73fcebd8b0cecdf51a7544140f888e7d631884
SHA256e5177af4fdf9feec877b3ddb16d3d98dec0d7f4087aa02b6814c68005274855a
SHA512f32ea163141683040847881e829644427d46eee7f2900cecef0583301f80c6fca3b34147a665d072a767a7dfad495f2ec28bd9656bcd1521ce7dcaaac3010e96
-
Filesize
380KB
MD50a54369b5a6d04f3c5b1b74595f1b972
SHA1cb1463582fc9a231c6e0830ee6a6dcf1a06141fd
SHA256070b6003f8724cc18ee5d47b62bbddd7b7cddad75866e16f421f97c1eb9eae95
SHA5126886a5b3f635474713aa1e8b154e0e4aad353736a6cfbcdab4e20cf2ac7725e78b0d44c8e0269dc2049be7fcb62138e940666b65f8a528adce5a6cfcadcbb4a3
-
Filesize
380KB
MD5df8b07d106752b421640bee7d1662aac
SHA19c3d08c8b694a88c0412dd0f091a003f638cef18
SHA2564fd8d833cc59b788a4753a5a854dbb8f2155388d65b99e468c8515e844e7b6a6
SHA512593078a87c61d76a02710fb4684ff91f675966d2de40100ecc7811454a50147316bc6e82064def8bbbb703036e8c0465127aa0bf78be17bed994d6ebad778fb9