Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:04
General
-
Target
2024-09-19_aac2545ee265b1e9e058f5b81c7d32ff_goldeneye.exe
-
Size
192KB
-
MD5
aac2545ee265b1e9e058f5b81c7d32ff
-
SHA1
9cc155d5ab689a688a651966a1c3d47038bdc3c4
-
SHA256
6a8c7c7e91bdc473e1e738551c5c773f64fdbc13b6e682ac655d7a091270ab6e
-
SHA512
dcc4fad8f6ca1e9ede8787cf265e9767f39680f350c187b910363db6baa86873d7e612f47d54c894412cf40e74ce5d8df5ef04a5b67273165cb7ae6eb663479e
-
SSDEEP
1536:1EGh0o9l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o9l1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_aac2545ee265b1e9e058f5b81c7d32ff_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_aac2545ee265b1e9e058f5b81c7d32ff_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C1CF731-34DF-4d9c-B062-6BE6D5B812DD}.exeC:\Windows\{8C1CF731-34DF-4d9c-B062-6BE6D5B812DD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2B3C3D7-E8ED-420f-83DE-0DC79281E022}.exeC:\Windows\{A2B3C3D7-E8ED-420f-83DE-0DC79281E022}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC576A87-F7AC-4f83-AC52-E2C49A6F9CDE}.exeC:\Windows\{BC576A87-F7AC-4f83-AC52-E2C49A6F9CDE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9178619F-CF9A-4e18-AE6D-428A3C34E338}.exeC:\Windows\{9178619F-CF9A-4e18-AE6D-428A3C34E338}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39931BD1-0A30-4ab2-8034-FB9B250AC265}.exeC:\Windows\{39931BD1-0A30-4ab2-8034-FB9B250AC265}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB177D2F-FF07-4440-8F98-77719F93223C}.exeC:\Windows\{AB177D2F-FF07-4440-8F98-77719F93223C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C243B3C-8D91-4a46-AACC-D91D3EF13316}.exeC:\Windows\{2C243B3C-8D91-4a46-AACC-D91D3EF13316}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7502B2A6-CE52-4d30-BC32-458EC9239F47}.exeC:\Windows\{7502B2A6-CE52-4d30-BC32-458EC9239F47}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0532A2ED-7F2B-448d-9FCE-4A760119AB25}.exeC:\Windows\{0532A2ED-7F2B-448d-9FCE-4A760119AB25}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07F961D1-771F-4bae-8D8D-5478B601F5F4}.exeC:\Windows\{07F961D1-771F-4bae-8D8D-5478B601F5F4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC85E3B4-7905-438d-B249-B79D6AFCEA3B}.exeC:\Windows\{AC85E3B4-7905-438d-B249-B79D6AFCEA3B}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A35A5082-7AFD-41c0-A2E7-F8BB11E9493A}.exeC:\Windows\{A35A5082-7AFD-41c0-A2E7-F8BB11E9493A}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC85E~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07F96~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0532A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7502B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C243~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB177~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39931~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91786~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC576~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2B3C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C1CF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5ca09c1eb72280d2616c86c84f28ea552
SHA136ab3de820c32bb60b591c14cfdd6ea8896c5c4c
SHA256fc81807f73907cda6a7c099e7f945e8cd3be7b3dd2007fb8cc06997642b21e06
SHA512bd94aba0efff0ca81618d213cc0262d6aaaeff790d677adcf5948443eb950e6987d5c985a84e1a4cde39d2b2366ed1b7f039c56a53261dd0fe21c3e0f3f7c001
-
Filesize
192KB
MD5b7d32b4d52c57367d231416a8621a611
SHA1ee3886863d8836ce637831103e57b65296970fb0
SHA2566d21a2574b808f9d07d4a329649c5b7f234a86ad020095caf7ce924763f4cafc
SHA51263926a03245b16ea07d326344166a5789639c4a97cc1dcab7c950508495ef026dbee6a730836c493641b0391573cfed5e03b5cb95081251f58a7a08ab876073d
-
Filesize
192KB
MD53f8ef83459dfef60c99310d045174639
SHA17c162deffe423ee18481436e94c3753c9baf2bc0
SHA256fd8750c9fb17d53f82ebcb4440ca90ce1f1aa4fbcf8aa1a9516b77d4b2fbe540
SHA512b91e1982d1cebce70d0cc2040afdccdbd925b120d926524efab50f66540c81abc27afa235635826d70ade6269255f99681def938771ddecf3361c9a01bb004e1
-
Filesize
192KB
MD5a4e1bb9fc6a3ba88ff24c498904d5df9
SHA1411b5f86ee68688d0beae811b57e51c86218a954
SHA256bf0c3689bdf36ed21cb9946ca9d237fe4bb2a52136f34efcc29b1bc52193385c
SHA512c9bdb66c11c4e8a2c78f6b36941b9dc94142dbd1a2bc3aef2fbc182b2458ec57d2381c96d2317b9dc7403f9c5772df686e0a99ed519b5bccf8194c94a3fa28d8
-
Filesize
192KB
MD528e0b7f1028a45de4b76f31247bbfce9
SHA155d2827ba1e5482c694d77b18b5c4fc87f0f2eaa
SHA25646823f9daf0050157180d1cd1aca19dfddd94eb41501ee06b21de50b084e7b30
SHA5129f73f1e4007e77d0dcbc5cea0a4a481638c838934365d595206ec1a36b0680c2a23afe20d6156eb77f2c885e4195fc4187bd5ba838040c849df7f26e71ef9396
-
Filesize
192KB
MD59dd82f5e184bc5da59750cea09c96726
SHA1f060d36f2937a00fc2d4a4bd8845c79ccb30df4a
SHA2562443109a810b34e6cd90174948ec64e1e398c1875f750e3c67480bd1043c7975
SHA512e865286af01dbd12a8d7f45b9730fd54e58d5b4fef7230ad5e1972baba1b51d1995de4052b4407f0f728d93514d5bfd2c556deee7a464d6a2aff7268ae5a31ec
-
Filesize
192KB
MD53f351ed61342a661b200af6f1c5c8e35
SHA10433908f2a59aef137454652cbe30b478ff2bfe7
SHA25681785847fff3f26ca002799d05a1aa5213c3fe12462f489cec941fabd070f075
SHA512d31d6c96860907e6b56acede85ead64de52bf88f7b55d5184507e3334ad92b431029f5630c72f0126111743db1b3db46f3397fad6a92a58ac95ed18d778b09b1
-
Filesize
192KB
MD5bb1844a10f0c557fc26c80d09187f1f1
SHA1e5a01f88badbe4051a0ccbe9b346bdd5a71269d1
SHA256294da02c09ffb6beaffaf44e207f602055e5ada78bbf00d004931bca55d2421f
SHA512ef2380bac06b0860a1e6159ef92441b0867148e072147a1ac57bd0b1ddf1e3bcf5f00b45fc4ccb7c782e160bec3909848a51b9ebb4c53bbbec0c45d4945674f6
-
Filesize
192KB
MD5bf47744c8b31750a510cebdff81fd110
SHA15271acb4682d3072dc73403c3969157d6369285a
SHA2562032be84f97c008ab2a9b06a8f7d35d231ced059484a980bd638df12c518c621
SHA5124558dfb15dfd3727422274dd1a2a6bdc7d86493f56958553bed436568e40094f5960bd461a0b65cd8fae9634adc67fab4519278266b4b97a379cd903dadbe3de
-
Filesize
192KB
MD5bb1bb781e45e420abaea3cf98c3d685b
SHA1947ab0a272395018dc90ce8de91156a14286312a
SHA256f7e227082f6dff5ad77a46031c7a0a6fec58a481233f346334df069962cdf114
SHA5123a792e15db645d3a6a43b4338ace50c1d105c67fa9da46da3dcc456147f68b69aaa38c940e62223b48d473ef49d5a8051f2ecd087ca471f8b081714d94ac53ba
-
Filesize
192KB
MD593fc93e3955f6744d0c5ac39d113f938
SHA1c343ce35db78303f0837af2ee991eb6b0dd44375
SHA2563fc8b36bfb4cc984e1046f86cae4c55ab05a2c7638ea365784b7ae91193691fb
SHA5120a158da450c1579e69cda5520f7ad08eece3a661c99d9ee330c1ca51b40ea20edd00d4c4d613a49c4c7402139843d08494f00b1d7476cbd80e2a2174798c6d9f
-
Filesize
192KB
MD5764a8a243c2d945d20a6d1c6bb3feb3d
SHA1fdeeb793bea1536d5d6da76dd19646fe7f7abb3d
SHA256d098811631aecf6cdaf27ad4c052d31ea84543caaef95c8e1d35a86b83e41ab2
SHA512b1fb3434631ccb2ec322e5502cbf6f9eedec3c566e3e859310f539587c938cd0b7345ef845840811242d115bc1dcb2a5226ed502e2a8e029d84e379d97dab8a4