Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:00
General
-
Target
2024-09-19_885ef39fd534e498918d4b29ea5f2d1e_goldeneye.exe
-
Size
344KB
-
MD5
885ef39fd534e498918d4b29ea5f2d1e
-
SHA1
4d8d8de64e2292f9f0a126554ec97243591442d1
-
SHA256
26135ce5c7dfa97d820d476854ec6e22be856e0b3586e79e3c6167d8825c7091
-
SHA512
68518b3b630b969a3a18e88d4afc48ddf0579ec7ee8e55f024ec79c902df6a4271be4cff462d29fbcd83051b4626834e47cc7fe58ad198bb8c4c5b8b584c5a64
-
SSDEEP
3072:mEGh0oFlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGDlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_885ef39fd534e498918d4b29ea5f2d1e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_885ef39fd534e498918d4b29ea5f2d1e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68E57EF2-C1FA-4e8d-9E5C-CDA4745054CD}.exeC:\Windows\{68E57EF2-C1FA-4e8d-9E5C-CDA4745054CD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B50AF352-BFC2-4097-A18D-57CB18EA24DA}.exeC:\Windows\{B50AF352-BFC2-4097-A18D-57CB18EA24DA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6587A351-4D35-4754-B613-523D242B7DD5}.exeC:\Windows\{6587A351-4D35-4754-B613-523D242B7DD5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F65EC91C-1D9A-4960-BE4C-B79273F5B8C2}.exeC:\Windows\{F65EC91C-1D9A-4960-BE4C-B79273F5B8C2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10D6FDA0-4EFA-47e6-B792-18D7EAA0EEC6}.exeC:\Windows\{10D6FDA0-4EFA-47e6-B792-18D7EAA0EEC6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4974271-F63D-462a-96C3-694CF0C2641E}.exeC:\Windows\{B4974271-F63D-462a-96C3-694CF0C2641E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3869969-A3BF-44a6-B30E-C3BC24A7EA22}.exeC:\Windows\{D3869969-A3BF-44a6-B30E-C3BC24A7EA22}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A2CE93C-9091-4b11-A6B7-6010C3456911}.exeC:\Windows\{1A2CE93C-9091-4b11-A6B7-6010C3456911}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{22C0417C-B520-45ec-9548-BFC0C4AB2B0A}.exeC:\Windows\{22C0417C-B520-45ec-9548-BFC0C4AB2B0A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E74CAFD-7E66-4482-9173-493B9AA7B544}.exeC:\Windows\{9E74CAFD-7E66-4482-9173-493B9AA7B544}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D33A5BCE-2887-4343-A6C4-DA8882E0C61C}.exeC:\Windows\{D33A5BCE-2887-4343-A6C4-DA8882E0C61C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{48783903-34A6-4424-BC4C-511FB3C783F4}.exeC:\Windows\{48783903-34A6-4424-BC4C-511FB3C783F4}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D33A5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E74C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22C04~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A2CE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3869~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4974~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10D6F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F65EC~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6587A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B50AF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68E57~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD53bbc2230d67e3100b5becfc68a7ea7b8
SHA1cdea5907419796a1c3958e589db19269c50354e9
SHA256db973bc2f50cfdd3b6aa83940ec3c7bdd9da8b0e9d770002e53bea4130c132a3
SHA512a9c63affb75601bcf6ca157ef330fbfa1fe97ffaf148e18128638ff98592e43616fce35dc5163603211d6c07f72c0be55e8d7457d290c55890f157a12dea6169
-
Filesize
344KB
MD522b8f372a2578320b8805d5c973a552f
SHA1838af5e925ee3e09434f4647caaa1ba381794a11
SHA256c15bf2c617d4a7c2e2f6335b19e5fdc5c5ba120768c7f841cb124316e4b370d6
SHA512c5a008eabcebcb5a9c9b7f20ecca9effcd08e53b90102db9aff47c683f447e4913aa8de85a3fa4036ca9f99130855b5b94ecab80589159ce51ed91051f13b8fc
-
Filesize
344KB
MD58178d0f2f6cdfe7478a9435ecabd0b36
SHA1da4057fd17a472b7bff29dd2a33048f330a72648
SHA256378ee0ef5b21ac8a7445813a0919136043cfeec6c46dfe4d81468d650522697a
SHA512fffd360b0f6692d788cb621b7c6353b27c72e6d5f1dde6203dbfd5f552c378d0b28e1be7d09789f6f6762c5104337e47b42aa7b0e8107b1ab9d4d30803c03a03
-
Filesize
344KB
MD55447a498519ea8719800ffb120857288
SHA1ceea49a9bb6001d4d2a5490ab7bd13ecbbbb17a8
SHA2567ffc008388a212f03e8041892621e073ab0114a61aa84be364554caabd395251
SHA51219a4622d59e033dd54df3544eff2977e9a9fd71288274d435c794f48de787fb9143e50107466ab03878e82f05860329b2939b701d238c5fc7c949d7f81bdf4cf
-
Filesize
344KB
MD5972d2465a72c1c80936e60fff6d74c97
SHA1121b5eaadf53841fd2c6b7d152a3d510bc83d3c5
SHA2567eac7d2f00fa47ccddeec044a6b6e29393ce45d3024498a3af70f52fa41cf1ab
SHA512223d9bbc6ac7a45c7cd9a101564e240c551fbb1bac13c7f59cb734660f959fa5b7cdbdf0845fbd01b2894c5b920dd0b9b81d6b3564af677cbb523a14f508a4b3
-
Filesize
344KB
MD55c7cd058b423e983e9bc17cc4762bc49
SHA11e68d44f8669b0839f17521a11cb07cac16cb27e
SHA2561fd477925e78af104d4b8d3d731f31a3f110a4d09d73ff7f1cc09f8116378c16
SHA512f4d4fbd85b864d4bc708fe6c19c3a5aab6ae65641401a5c07a456a81497cea767e1d6dbff5d26ef09293f54598499a60df4a484c9f8204e42d0bb980c765863c
-
Filesize
344KB
MD5bb514d7f962e51fb333059280048770e
SHA1838414aec06972c2d856d8a924033a811d57d085
SHA256b0d00d0b0b753bf20047cae0ca1d0ffcb66b146a841fc88e7bbe6b3a2b061a1f
SHA512412401c1078e2d95965c45c56816cc699a7fcb5d8c4cf7664f460a184de1e5f062db4f1db94809ea0505a25ce1008412463c680794b18bb0c60505505f24681f
-
Filesize
344KB
MD57f7b3bb59bf56853a46296829fcb1531
SHA14573651a4cc4d9c0d7841eb82b9a3a2fce2fe053
SHA256acff9027c23d7368ae9cdfaea6050c212df913ce6fc2a943761bf9f94977d9a0
SHA512072e29fe9652663cd8e41675fa0ac3e048a2be93e506302d966cdfc8d24fce2246fa4de5e764649effcb5a1555bf5f05361d7b7d2850d8b34e44b634aeb88c62
-
Filesize
344KB
MD522d04c647da113271db106335a9db7d1
SHA1bb299d0803ee2379efca791935c71c25d8c59cfb
SHA25641e1505bd51bd1dd63f127ea695b03ee114ccbb011cefd59aae75e254871b636
SHA51252b9bafaecbfdd2ff3f8c4c0ac67425ec237cc28f33f80eccb50d1692462856f5963ebd834fa778396a2b40e7358cad1961e29e41f7738e187339198dfdd9d01
-
Filesize
344KB
MD5ed8f5ab684e01bcb8dea1ae3a5a226ec
SHA1a73e2a2567f45261ba2073ecdd6dfc3a0c3ae09e
SHA25683ccf052e320406ecd2d00cdcb8f6b66a11249943178f60cc6a3220966bf07f3
SHA512f35c6597eb1e25d756a5a7413e655975f4febfb00a6c784ed74d8bdde97f1ae27fa551a155025ebc138bac2be5652481ecfe5f1040bb6f46f7e69428f6addcfa
-
Filesize
344KB
MD53b15d10a98d2d821a87befff0f9727a4
SHA1d3499a659c179de3af5613175d2e5fa4fcb8c5d9
SHA2564de4b5db55e9ce31b6ceed20f3bbbfa04ee37a2863d1e782adf1202cdfb7a43d
SHA51224f73112e72711b8838d50a1b83249430aae1633151790850e74ccf1b07b7e3075b4759845b6ba57736106ed5318eb74b59e665164639221e7caeee0f7ddf4e7
-
Filesize
344KB
MD559b8724ad45b7b8b28539bcbc8583b0b
SHA133b5f7fc33e0fcdaaec0a1eab727d2b3de8e5700
SHA256112ec208606a06123c5618b5f032a19949c4c436a438571310b0ee65844795ae
SHA5129e0792e12e510e1de4b413843c6df56a65b3dbb29091408af2d9a67f8a3bbfb9519e53a9255ee507e07fe5faecbbbb3182b59e6cecdde5292aff67b2a71e27e7