Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 04:00
General
-
Target
2024-09-19_9206b0dcae78734c7ccca68e6104babc_goldeneye.exe
-
Size
197KB
-
MD5
9206b0dcae78734c7ccca68e6104babc
-
SHA1
8f913d7abcbbbfe748f50d9bdcb163cc9a92f68b
-
SHA256
c99dc5efdcdf7bf29b9f883e71ee392252fa7c431056c81a602ce4dd19d7f83a
-
SHA512
624b8c85733792e92915d459d2049df66798f10821032b05723e1567cfa85522b7dff81c92016c06d116a8c4ad89177a89d8a81dfce4cf4c6e539d03816b9738
-
SSDEEP
3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGJlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_9206b0dcae78734c7ccca68e6104babc_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_9206b0dcae78734c7ccca68e6104babc_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{888BA6F3-01FD-4eee-BB84-11CDA3BCA566}.exeC:\Windows\{888BA6F3-01FD-4eee-BB84-11CDA3BCA566}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3201FE5C-516D-4bfd-B715-2C124CE739E2}.exeC:\Windows\{3201FE5C-516D-4bfd-B715-2C124CE739E2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9642C53-C2DF-4f26-A2C5-10CC12E04485}.exeC:\Windows\{A9642C53-C2DF-4f26-A2C5-10CC12E04485}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AE27228-2BF4-4ca4-92CA-A904424DD2F6}.exeC:\Windows\{9AE27228-2BF4-4ca4-92CA-A904424DD2F6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{607D7B16-48FF-4b2e-8F5A-09A709B4F5F8}.exeC:\Windows\{607D7B16-48FF-4b2e-8F5A-09A709B4F5F8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1FF46896-94ED-4128-9549-C365830FD56D}.exeC:\Windows\{1FF46896-94ED-4128-9549-C365830FD56D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3E6F455-165C-420d-862B-2123F508533A}.exeC:\Windows\{F3E6F455-165C-420d-862B-2123F508533A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03BD8CC8-B1BB-4571-A8DE-819659251B99}.exeC:\Windows\{03BD8CC8-B1BB-4571-A8DE-819659251B99}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B65FD3E9-EEB4-438b-91B4-AAD34D6D91AE}.exeC:\Windows\{B65FD3E9-EEB4-438b-91B4-AAD34D6D91AE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB83E948-7C81-4ea4-9D25-862B6B393C94}.exeC:\Windows\{FB83E948-7C81-4ea4-9D25-862B6B393C94}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53DBB7CA-1CF8-49eb-89FA-8A62A10507D1}.exeC:\Windows\{53DBB7CA-1CF8-49eb-89FA-8A62A10507D1}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{67CF9B44-40D1-4051-93B5-062AB0E8A4FC}.exeC:\Windows\{67CF9B44-40D1-4051-93B5-062AB0E8A4FC}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53DBB~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB83E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B65FD~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03BD8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3E6F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FF46~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{607D7~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AE27~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9642~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3201F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{888BA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5cda14428e992ee2c11754298d11d2552
SHA1ff2f15f3ba58c98634e7497282d9f78d2a628caf
SHA2561acff5bf68a3cd943e50f5af9d739116fd67b29322942b13679bb7713b5c5d47
SHA5128eddd62df347e4aea01d92d9d339a461cc16cf1ebe688045777fd8d7e26511ebf0eb076412fae78ef0f72c520b93230c5692c6d5dea1136750eb2e41bd646eeb
-
Filesize
197KB
MD521cbcb135058b83652cc62c1131f85c6
SHA1ecc8c54feb750d788c3fced1da0d2438a835ff92
SHA25669f90e73acc4591ff481d48498899d32de8dc481c764961f5c51d8dbc5c465a9
SHA512ba298ba976960f660f7e794f12c27daa3c7990ac809c469a8ba7439a7ff8a681a0c1318230ef0331d2df11cb5bce6eef5e6f6982bbd207621717b36294d85ab5
-
Filesize
197KB
MD5e03ca98d4de5497870c4accca069a035
SHA105bb91b9086ac3deecfc08184629f7ad5f04e3eb
SHA256c3510070504737d044d74af386d588ce0d509a6f3578fd338c182c5a709da430
SHA5120cc2d6dfda39c9d29af815c8eab2cc70e45e7c93d2bd06ddf6dbaffdb498aa0651e56a593c91460e3a272b12a58b2bdbdb64ab8d4af0612b7a1c5c874893f55b
-
Filesize
197KB
MD53fde31611d1c77ce637653799488377a
SHA1c101cdc52fdd58adde1d00acf30b7f3fec8d8b4c
SHA256ce32355c4d98e9046b93aea0126664a9d249e230c983e338cdaaa4f2505fc2ca
SHA5126df111356204f69dc37c5a8a0034a791de076baaf73f230c9445d09ec632984933f3d5c8d9ecf9409d04b8828854fd1d922b2bb46a71784fa7c8e8ce134df0e2
-
Filesize
197KB
MD5ee3af76e4e3e6579c6b1a4b89a1bffcc
SHA15856abd7fe00f73f5e9e61146367b9a493211756
SHA25641aa71e467dfa390f925b4fb6bb2230e547aec657bf216f2c86070c476dba12f
SHA51252d6391dd413088974acc5f6becc5f859525e58426ede77a59ee13c33ed140937a354d3956d895358a52e4453ae493a51931095ffbeab3aa496d26bb51681ca4
-
Filesize
197KB
MD533ca19604f365c5f4582bfded4e39df9
SHA1fb74b0d5469b7bff7e2c27665d19bf9c70bc9e61
SHA2569233e5c075c2a9225ab9f4ec9323dc82cce74a0f77adf1da6b8dfdb5c53b4952
SHA512799b057faa1c6416e273df9139a431310cb5454a4c2143e714ef8d8b137839b5848a0b1233e9b196944c1f4616b2b9114b28bd0eafddd518e24fa4283e762fb2
-
Filesize
197KB
MD5a55fd9f219997e0f9c0fb140b9a8aecc
SHA19a97afb30e8eab69647315236f37d778ec6b0ae9
SHA256a5e3a5cb3760b68e5b4281db2e5ebfadee1e3a18fe41fc72f4fab327015fc879
SHA512cb8efbf076e71edc5b00bc913bd5314579d4ae441f303ae226345924ebd6dae55595c37844ecfd683709402de0816dcc463f25fa30855f00e6a42ea38424c578
-
Filesize
197KB
MD589092952598f0cf4bd6e0b408ba015ea
SHA13444eb059f9b140ab9862c1fdbdb20790a9edf69
SHA25625e91d2c984e1e8662b7257bbdd995503fdd98972f02ea6549a231c55b899fd6
SHA512fc025404bbff6dfe58cde112d40d1024f76109826cc44baa6d76fa08e2128b8f70651dd6e9a12f663a652024edeca3c1d61191d7f2e0647dd99aa464e8da837e
-
Filesize
197KB
MD54afc94c8725c8d0fd42b0a368e677344
SHA1f110b6ce8e8970694818550f10229d4db4cad5aa
SHA256aea1a3652fb695da600a61608667db52a2973f091ab03965abfd229f2562d8b0
SHA512fae9dcde3863fc0052ccdb581cb696e7466c19e2f0c0217b9440fe3f47acf43fd0bf8567128acce82b87ac868f4b5c847eab9b12de78d67265a91651d768a264
-
Filesize
197KB
MD5c2671fc5849211c8452cfadbaed146fa
SHA128b11d71f16e4692e0e3b2f8cd6fe6b79e0d1c47
SHA2568b97860d313e33b3237f1c983e41e913b1d885f6e05d488a5c17a7ea306a8395
SHA5129b82203b29ba8feba8f60aea3d82164423a92da1ec424b1d07fc523ef0126f139a01a233fa25bc41bc3e841b795e810b5aeb6375b6c6c39502ceca8872aeb988
-
Filesize
197KB
MD548f8a74b09fc16e30af20ffe06cbe969
SHA1d6353b95878c947e48cbc4e615f0ba0e4c54d5e2
SHA256aace6b9684f01adaa621c149ce96630fb4cd27f2a1ea84bf026e7f7e2397e941
SHA5125fb3b4cd8f83a5325c51de6e430313d13bdf0d4211b608eec6483c7b5eb9a44b391e939858d0379cad1f058a0497cc34354e3a1c1ced4742077e1fb7938ca298
-
Filesize
197KB
MD566c596e39c48e5c8d4214bbf3f1b8972
SHA1fdb0afdcdb5d715ae0c491e133c71277febfdff6
SHA256defaf92e652f7cadaf8604921f14558670ff1f61422430847c3c637a70708459
SHA5125be6a29c806f3b351507de1fdd24684bcdef0a6c1b36ea8909d01e4c7c5de352d05a8ec8231d1ea0cbc07db7ab063f89a4ffc3b5a02f5d6aac95794af3a1568a