Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:01
General
-
Target
2024-09-19_9717c8f38a407aec955081e8949c66f8_goldeneye.exe
-
Size
197KB
-
MD5
9717c8f38a407aec955081e8949c66f8
-
SHA1
4a748fcb6103bad1d43078d4ecde5815dea1cb34
-
SHA256
fd040d35c4137f03046a3276ff56b4ef48685b76c5e22552ac868c24b8c1356c
-
SHA512
b54960cf41ab972e96a98da1fc1ad2e19d8438a74a053ff459d5f2d29e3b2f1eeb8bc0166961887215f48fa45d96eef6ce31aab92380c4cca59cf402a0eacfdf
-
SSDEEP
3072:jEGh0owl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGKlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_9717c8f38a407aec955081e8949c66f8_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_9717c8f38a407aec955081e8949c66f8_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2CC7896-2274-4fcb-9B07-3CB2F76D22A9}.exeC:\Windows\{A2CC7896-2274-4fcb-9B07-3CB2F76D22A9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8BC6640-B955-4ee3-83A2-40A897E9D443}.exeC:\Windows\{F8BC6640-B955-4ee3-83A2-40A897E9D443}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9CE439E-251E-48e8-8805-4BEE9896DD38}.exeC:\Windows\{C9CE439E-251E-48e8-8805-4BEE9896DD38}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B3F145A-F20C-4d03-B00D-B727A0AF6D33}.exeC:\Windows\{3B3F145A-F20C-4d03-B00D-B727A0AF6D33}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06FFC29B-8BDD-4e22-9640-56741AFF0BC1}.exeC:\Windows\{06FFC29B-8BDD-4e22-9640-56741AFF0BC1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7083AB6-4F00-4450-9AAB-ED62E0DC925B}.exeC:\Windows\{E7083AB6-4F00-4450-9AAB-ED62E0DC925B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26D8A430-A8B0-4ae8-A319-D9FAA3574B30}.exeC:\Windows\{26D8A430-A8B0-4ae8-A319-D9FAA3574B30}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{487D71EC-25C1-41db-8728-8A4DFBC2798F}.exeC:\Windows\{487D71EC-25C1-41db-8728-8A4DFBC2798F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD0988D3-E5D3-4899-B8BA-499353E647F1}.exeC:\Windows\{FD0988D3-E5D3-4899-B8BA-499353E647F1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37E8DB4D-3C5A-44c3-968B-907B5B718170}.exeC:\Windows\{37E8DB4D-3C5A-44c3-968B-907B5B718170}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{319A2A13-2B67-43f1-905D-F797C8408F00}.exeC:\Windows\{319A2A13-2B67-43f1-905D-F797C8408F00}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F54BA406-258F-474a-98C7-A045E3ADF748}.exeC:\Windows\{F54BA406-258F-474a-98C7-A045E3ADF748}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{319A2~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37E8D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD098~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{487D7~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26D8A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7083~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06FFC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B3F1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9CE4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8BC6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2CC7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5d4e636df65f4949ab436149a46a647e4
SHA18de10ff1ce0b653e3fce1ca05b21506edc886341
SHA256fb49b2dbbff161d880fb6f17ec894c75e642c59f19c0328085bb01428b7eddf2
SHA512e003de3d56b8fa2e3574cbf13a58cd0ef8fdec5aa681d89f1e11ec45df07f20436293a95efe480b7ebdfbc5cc270ede68836fb6b88a84c8f986a5267436f605a
-
Filesize
197KB
MD57275612e7d99503e08ddf30822bad1f4
SHA190796339f4492311f4a22cb1ab5bd230d319ea1e
SHA2568d8e7edd864f341a0d8f1edbb7752acbcc7c6e17e44ecc816d54db379c254526
SHA51234e6b903cc26591843e0c322a64267d06072f18fa5d9fa284a7ae5cb6a70a8b45dce2043077d3a8ea92a84ccec1be6890d0408baee438a2d47e7c1b8548c9146
-
Filesize
197KB
MD53b58bf5c5b8c3141b15c3b73fd65e091
SHA1713cd8ef92ac692bda4b57b3f28f1fb30f48145f
SHA256953ea2a4664c8280d3128b51a06000ad59409f3cf2c7be9a039f95043709708a
SHA512b867639dcaa5cbde4eb044df20d79c83adb90964a5d19df05969e05094d0878c826e750ef99aca956bbd198ea7ba8bed8b3bc2ef80473c075cc1d9dea2951875
-
Filesize
197KB
MD5d38278ed12c4781c5d658205be607a08
SHA1fd2e5192ebb17754edd72722b865279a44d85e88
SHA2567e4d6cb2832e288c7358182899a3a05309d6f9d7ad7201576c42e1b31e7c2014
SHA512d10479275a653d3da97fb5ba1188e7e7b27ad1fa1fcc380652cda3f55a44c4cdb748771b7b6c45a1e4e392e32550b51a2ae22a9c3980880d6f58199ffd35edeb
-
Filesize
197KB
MD5b886316306a03ecec6feafbf9fdfd84c
SHA1a0c792c3f3232b9f4692e1a1f04fcd962eb81575
SHA2566c950f71da38aa97cc190949caf3b3d7546c9ead7bb80772699295c41c3d6271
SHA512988bad5e3e301da83afb41dad06a8a186f59797ceb51e5558ddba11cf2494b311b96b0f42da8a7b0cf81ab92c998dfe37b1b69d3c67d1fd9fee85e9ca9bb4b17
-
Filesize
197KB
MD553111d4e5a1b434e697c35533a81315c
SHA132c8ca92df76f6d0c10a2737929d6460639b362d
SHA25667518a62947466ee3d8fe35cc5befc477f933f8a9b27ca4248ff02bfb939d852
SHA51257d9e501daa51af7f5cc72fd81f20111aa7fad5aaa400141f3cea174b0568fcc2502c681270deef4639092ea0dfe18e87dab26ca090ca9e52a500706d32ff199
-
Filesize
197KB
MD50a5446b2974de021b54eda0fd980ea68
SHA128de25f3bc2a697cf23e12afba5293f8589f7268
SHA256a201a62cca30e0e2bfd2d7596ba26ab49d97e3164cb3cfd30f538a5391493770
SHA5126779d452a00f4fccf1776b28e7dce640e76772ae7dcd6bce62ddb6b14f6a0194d9fd7a5e2b00f21cd75346543658eaf61a0ddb700a569fce93961b3732150bef
-
Filesize
197KB
MD55481b471197aba2f258b55543e01d300
SHA1c153ab9b5ff95c60667df9f5e50e7be3a585f8df
SHA2563f82129fb33053ec477912ab4d4768c98f2edbe9f0749474138e6c5c965e116e
SHA512b1779f6ae2feb4d126105cd50fb0f0fadc835e8d3377a661cdca7b3c3a9f9089decf0a0654f6efa750b37462a253d3d3e51b3c423c9a9bef096863cb64a5c2a5
-
Filesize
197KB
MD5b1047f5dc46b59dc27bc936b3e8c6260
SHA12e6699ffaa5b92120a85d46f2ad9dadf11fd501f
SHA256ee6ae4cdcdd4aa3f81f2d8eefd57bf42df0468b8df0663f7a465cd8b23002ef5
SHA5124fcab5239277d21f2bdd2439e2c4d4e8c1d18bde453ee27ccb0bf23b0b7c2ac9165808d8c50c6cb4c035c95ecfddbc583309ee7f11dcfc960c4e726bcefd9c1f
-
Filesize
197KB
MD5d9410f66b7931126e7b957cb036c6c22
SHA1f2cb8516159fb552274fa8969fa909721a645cab
SHA256ff58beccd6b47fc835cb9c2bd06cd48e753e174ae4b974facbed06ee4bf181c5
SHA512340fcce518358154ce14f6405ea86ff1a7f91e56160359f098d23136d9210c1de29c0aeee0cd9769ba661d9cc3707f7f89b62aa10149d987e98146e0e98dc7f6
-
Filesize
197KB
MD5eab60ab8f37ed0032dd9528fc6c36b76
SHA1eb7c8a3ec5b3a1d13292abc440341e8a782d05e6
SHA256e94349cdb7955c4756cac5454cfe5024ed58cf53f4255e0095415ef19daf4df1
SHA512804a312fbc5bb9af00c082a8167372769be0d0ed665b54dcd3d3c15272eda373b3e8162312e092a827639fa0ac9eec1807cc353589dbf7ebdde2a2340eb8f5f8
-
Filesize
197KB
MD55b88455352c3a469c988649146c72deb
SHA136c384cfcc6e5be24e35d83dd0632aae82a5833e
SHA2560a3a5b77193c06e947b43dc3a9de24193284e73328655dcb4fb2b4902d631237
SHA51233f7c6144cb72cc69b76259fe8ee277a27910d2fb32bb050a82655dc37480172fac4a271f0d39fd200a835dd584ae9ffce40b00718ca358b84924d8bff972273