Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:02
General
-
Target
2024-09-19_9ef6e77912b5c16b893c496cde097353_goldeneye.exe
-
Size
380KB
-
MD5
9ef6e77912b5c16b893c496cde097353
-
SHA1
b4e04264b53a6241e7516485644cdd9861e026b1
-
SHA256
4253c59a141646488a4f3f3e64dc6975d12d75da050d2e241c0dc6679e8204f9
-
SHA512
41d52c393ed9cdaabe98ac9d2fa65d31673b8064c7f1da72402a841ecf10af78e11f947cebef226afadcd77fc96c70d8f13bd545edfc13bd9ef14c1a100aaa06
-
SSDEEP
3072:mEGh0o0lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGyl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_9ef6e77912b5c16b893c496cde097353_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_9ef6e77912b5c16b893c496cde097353_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89033144-32F6-4482-A115-44CE9BC3380F}.exeC:\Windows\{89033144-32F6-4482-A115-44CE9BC3380F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE0CAFA6-0FDF-42c4-A018-F61C96F20457}.exeC:\Windows\{EE0CAFA6-0FDF-42c4-A018-F61C96F20457}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73FDEEC5-397F-4316-B929-73F4C3F793E7}.exeC:\Windows\{73FDEEC5-397F-4316-B929-73F4C3F793E7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBCDC89C-4A9C-4c92-B9B8-D974138D0EFD}.exeC:\Windows\{CBCDC89C-4A9C-4c92-B9B8-D974138D0EFD}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F3D19C5-5206-47b4-B193-E57D0EBDF849}.exeC:\Windows\{2F3D19C5-5206-47b4-B193-E57D0EBDF849}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E6BDDB8-0236-4576-AFE3-0B5595F92349}.exeC:\Windows\{5E6BDDB8-0236-4576-AFE3-0B5595F92349}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58A20539-5F93-42dc-AC7A-D67C54C52D3E}.exeC:\Windows\{58A20539-5F93-42dc-AC7A-D67C54C52D3E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C9F09A9-96B3-4489-B362-4363E4ABE515}.exeC:\Windows\{4C9F09A9-96B3-4489-B362-4363E4ABE515}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{307A0C15-5A76-4b55-BF81-BF776FDC5E29}.exeC:\Windows\{307A0C15-5A76-4b55-BF81-BF776FDC5E29}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1140122-8A5F-4347-8C13-D88D2B693FB9}.exeC:\Windows\{D1140122-8A5F-4347-8C13-D88D2B693FB9}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAA14BCE-0BE7-41a7-A804-E8720F9D88E2}.exeC:\Windows\{AAA14BCE-0BE7-41a7-A804-E8720F9D88E2}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D52EB775-E505-42c8-866C-71CD4817A6A5}.exeC:\Windows\{D52EB775-E505-42c8-866C-71CD4817A6A5}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAA14~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1140~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{307A0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C9F0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58A20~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E6BD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F3D1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBCDC~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73FDE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE0CA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89033~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5563f493f838dc6ac034744a6ed2f30e9
SHA1689052d06389dfd5750663f9f7f9fe60f2af7333
SHA256446a1767980d51ae9d19f2095e226cb784e4b1030acc06c6e17476c786815d18
SHA512baa06b6fb2ca00d61518d8db755c8d3bec9a6b7bb760fe0084a2277a42cca0232509ea5390b5b23f43d5355246d5e3224c38c169e02647fe553d74cbfa88bd7c
-
Filesize
380KB
MD5e1a4afbc4f91e0af1637b7c800adb4a3
SHA10db8b4a91cdeb25f317dded4ede633b5399bfb78
SHA2562b42da0b566ac682e80d757955551358f1524ae96b4be63d0f9368b04a348946
SHA512fbbd80183a910238025fa2db8e4e9defc802764fe17ab95d197e05ed5158af5b0a4d356f6884acfec63a40361ca6c67eb15a5ea85cf5abe261743768cd50ee9d
-
Filesize
380KB
MD553b4648022d8a89c224c92a0082429ce
SHA1ac2527a4f8f7aebac1017e9125da6873fccb40e8
SHA256067f42f12da97ed70c74320cb95f5b8defb08c24727d55af19263f3190ce6d6d
SHA51277b6509424b3dbe716b514bd78b34846db7e7d03e96b727ed06ee8e3b542bd83c144667fdebc3aa0c60f1f229e56ac9f4305673aa3a65d93eb47824869f4ab2e
-
Filesize
380KB
MD5c3b67505f8b91e9ec17afd9606bf253c
SHA15dc21a5c6707add5d04efe5125449d2826366202
SHA25615add23ed4b6bb64deaa6cb7097d8c86fc711d1b656e8fc4b11b5f8be8fa279f
SHA51253ed41f2edcada5888b2a0d27d7235c70777a24c1ae8b283e172001fb72e787ffe5bd2e7482d31ccc087dfa34214fbd692b1171e9ba0fabb6eaa0e49ec856416
-
Filesize
380KB
MD5fa95e1abe21388f5dfaad53da7bda8a6
SHA1318618f2f7f351fe688ed2056e1a86dd71bd0a0e
SHA256983ee2df5a405a233caaafde3108751ceb0e34100e24e8ead72ab8f9ab676cb8
SHA5124606bdb6a4910c81cad07245bdda9ac8648c8c36cbbbe7374c083be59204923498b9a011da1abb5aac142a47c81a6d94276667f5aefbb3d74da2eb94d378c3d9
-
Filesize
380KB
MD5d798fb2198ff84cb4078ecdad7d7a84a
SHA1ff1890b9b30a574b595a3de70921bcb11deae6f7
SHA2561cf90c0c63f70b8026184c51fdd162f0bfd0fea6e9ec544f75f63ff3c91d015b
SHA5121e49fcd682a02ec1749908c8947f735a99627f01594e2effce25dcfa555016280271ba916114d7e9d0f562badceb5333f2090cd9b94fd5709a351a970f18fd2f
-
Filesize
380KB
MD5af46527296b1edadbaef1e84c75b5cd4
SHA16610bd4ab82ac5807d2e1f0de05d019c86e4173e
SHA25665d9235ec12bbacb99e7550f7c3132a3ad3a4ed6ab4283ca343722aa13036c8f
SHA512920244135b9af8d31a21a0f2e448a960ac6df3a0ef3a203af9da134268aceb5055b7cf656b127485d919f99f46f2d7bea94a1d3244d1be2f7a030cede8149268
-
Filesize
380KB
MD51f8a56e05ced245ceafefe89ed604ee2
SHA16b7cfa3bef9bb927479c09a5f4fc6d8394e5f8cb
SHA256b5271c8c2d60096c71bd96cfbc2f17bde98e82986b24b8a30ce921d5bd4741a2
SHA512497c26c681616e0ca7660ba132792961a42ba3b1cfc0ba3383e46eebb364f62c86a5367c04db704703b4c601815ca9904ce8f1f6a166ec2d8f4aa4cb5e7fdb58
-
Filesize
380KB
MD5f24168a27eeeea3cecd8933d757d21c5
SHA1f37c0e1dc5838a84fe452c06bfc8b11fc9e6ec66
SHA256a05855cde722eeadba6dd3bedf4dfcffdb3a417c28e61ec9d0da6aa27b6f239b
SHA5124adabb118ccae58daeb5add06c0d231542573bb5bf621a2de963c8a4a77265e3896fc4b689c6dee17bd484fd9f86baa628a3c8671ceae69b29af7e04527d537e
-
Filesize
380KB
MD509c18b2d1a211aec5e896bc6b89374ec
SHA1ed7dbd318b585c70138acd3bcd2dd5d702b34d28
SHA25690c199b96ce57f2802393b26e6e23235c32cfac391d9ea567ca0205a9b4c664e
SHA5120b67b11455cded8896355f1c8c192600a9c57758ce00fdc476ee4223e84da765f8341592a66513a15dde20221d1841af3b86d2d43577925a2e5f471c8417fa29
-
Filesize
380KB
MD5fecff988db9fb8d092af916a3ee6dc7a
SHA1287263fb3b190766d1c80f998902ea078decc9b8
SHA256db53b0e6b93637a364585a7e4a43eefd3d4164529c8c55a577774e5662c99b32
SHA512bd4ad4027725a92de0dcd31c3edb3b1e2dafeaa1acd4c1f4ea3f34b5074b4f08d0e9c96401722371c4b85edc078e71b44093480e4b172895ee2003513dc499ec
-
Filesize
380KB
MD566ec1708451c6f2f5071426fbbe0adf6
SHA1836fca403d5c02f1cf4ca1f33ce22018d9758f2a
SHA256c328069143b438cc6ad5dc00ca77fee6e364e4899d8f5c41b8abcad5c2f363f6
SHA51214324ee2a1beead09818f1b0592af6f4d8ecef5032ebf7ec15b747c1777dc858276b85a5f53e7ea7cd9e3923e0690b224b6d0bb2cc9ab6cb41c4a0e305bc3298