Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:03
General
-
Target
2024-09-19_2bf2ed0a75c7e7e229fadaad83baebae_goldeneye.exe
-
Size
192KB
-
MD5
2bf2ed0a75c7e7e229fadaad83baebae
-
SHA1
ac921d8cd2608df104d7546bd5d61af45988d290
-
SHA256
1a45944ffe115158fe3ecb700f7ddf8511e32076dfd09a2abe0a1c27a38fb8c8
-
SHA512
4d21d1b4bd8f6505fb244e00f22acb26a5ea0b166d649e879f2b35759dd80c926a5d7211a77bd4de45681c356f01ddd55ba5429b52ab66335b41577b05981a70
-
SSDEEP
1536:1EGh0o7l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o7l1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_2bf2ed0a75c7e7e229fadaad83baebae_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_2bf2ed0a75c7e7e229fadaad83baebae_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27281F67-33EB-4836-B477-8ECC3490EFA3}.exeC:\Windows\{27281F67-33EB-4836-B477-8ECC3490EFA3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF78C706-AA70-473a-986C-C7947E791E4D}.exeC:\Windows\{EF78C706-AA70-473a-986C-C7947E791E4D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53C32080-7F67-42ad-A7BD-339F2117CABF}.exeC:\Windows\{53C32080-7F67-42ad-A7BD-339F2117CABF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{070A0E62-7E75-4e7a-B25F-F9F46C2530C8}.exeC:\Windows\{070A0E62-7E75-4e7a-B25F-F9F46C2530C8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDC6BDCE-18F6-4046-8388-A6871968E43F}.exeC:\Windows\{BDC6BDCE-18F6-4046-8388-A6871968E43F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A2A06D0-D19A-4743-9C47-03B1D0C176EC}.exeC:\Windows\{1A2A06D0-D19A-4743-9C47-03B1D0C176EC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{460A20A0-8F7C-4ca1-BAAD-387D4A9BA936}.exeC:\Windows\{460A20A0-8F7C-4ca1-BAAD-387D4A9BA936}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED62EE70-0C21-4926-803B-D753341E5871}.exeC:\Windows\{ED62EE70-0C21-4926-803B-D753341E5871}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A5063CC-DF0C-42d7-8C8D-E877F7244E1C}.exeC:\Windows\{9A5063CC-DF0C-42d7-8C8D-E877F7244E1C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E59549C3-2435-4044-8E80-9DA09EAFA568}.exeC:\Windows\{E59549C3-2435-4044-8E80-9DA09EAFA568}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3507769-ED5A-437e-B065-9A0C7A43F094}.exeC:\Windows\{B3507769-ED5A-437e-B065-9A0C7A43F094}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{E06EF833-3F7C-41af-B0D8-9EBB230F0E9B}.exeC:\Windows\{E06EF833-3F7C-41af-B0D8-9EBB230F0E9B}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3507~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5954~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A506~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED62E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{460A2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A2A0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDC6B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{070A0~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53C32~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF78C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27281~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5850afa646c3b43b132b2d6774334b996
SHA13d313f1f98a7b7a960900acd9c042de2626ac0c9
SHA2560a51ef913af31b70b1ed67a15d8690872c4f9831923f31483b3eda54bcd01174
SHA512818860c233781ca060867c61d5f58815511889c8b27ee374c7c0726aad5153d6c0ca6d0510a61663e7bf2da6315588cdee6d06d7f7297a36921adfd9c6f35863
-
Filesize
192KB
MD5febdae8fd172b55ab5bdc61e57e750c1
SHA1fd6402cf45d9ff5147768ca3675df28102c303c8
SHA25677f2823e391ccc8cd017ba88f25925246414a6bd829cffee2af211b6ef407385
SHA5125beefd769b66181b86df04aac2529e67dabb1ec4f07b7c2f37b321b95f83f1c5307cec01f0ec113faa739c4b39c54113bae7bf5e6fa646036b2c5a119db4804f
-
Filesize
192KB
MD56aa6fc0af5e2c812cad758ce91232c83
SHA1731793049ee8d2a6946bc80e22c6461a6119416b
SHA256d033cdb755bd83a76196e7698207269d0138efa21654f0d915c1ae70f88e20a0
SHA512b0c1a9258a2c6eef6159e4f434ee8a40a9e2ac9dd0075e5a4b135ca47e66c8ea6eb570b3139d5cacaae7104c17704a07860d8a5b55eee7e5b2a23c4f1a8ba001
-
Filesize
192KB
MD5cca34bc1d05d00f26358981080c706ab
SHA198d35e80a68c09dcf62c1ba16a2a6b9de6cd3503
SHA25603174bcc4200599b95cc9631e60386c91a4a883690dc021a388216c859c0ca6c
SHA5126b2568fcc6eafeb5600cd35b5c67b3f1f286543dcf5fc713f205bfd7bd2bbdc7250dab826a845c68f786b28023f13e83f52fe8da4aeafac8685bb85bf26072d1
-
Filesize
192KB
MD580198c615d149365a521714a20e9ac9a
SHA10ce0557eb568963463444d2ab2e7857e95d97a5c
SHA256b022f01a0f17107f9882b80d20557493357f2e7553dd09003f989085a8eeb813
SHA512313377a4573c61499120565dea982486a0a721d7603f50485ea011fc3eccf00b5869593fe7128307d70a2b415509836a324603bf29d5ac07aa7436bea17ae88a
-
Filesize
192KB
MD55b53bfdc811f006bfd9cfd36a72de035
SHA1add80e82b40906c63364f04f337c3a9b437a2e6f
SHA256abb3fd7c6b6d4d68a137467d99f0b428e787c1c0a23d904b213883646609a130
SHA512a08dd19734249ac894410f7347bf9cce0623b47a8105deb100b29383a8ad007d91c20e5aef1ac23123a815a5489ac758f35e9cb790861cef7e35e72ebd3c6cc9
-
Filesize
192KB
MD55a54bd8c4d9ef47de699d32810994a79
SHA169440024804282cafe764f69271eb810d9362069
SHA256d8f49759b3eff24d172f30b2107cffcaa07543bb594f5943039a3f7f1d0a92fc
SHA512a2cce517c8c7e0e069925d1f559b5a8469189a6e480b78073eec33130169d4d16f38d24c05097df7a5297201ac6033d2da153d17b35c564cd5a612288641f0f7
-
Filesize
192KB
MD58b8df5c0f7ca088c49a14471a0a3af9a
SHA1db3980d65847fad93fe172677ca9d93803bf95fb
SHA25693bb44c6bd6ce786f07c038c571ce9a9ace510c6665b12383d1781f5341d8862
SHA512037904e77aea82b357040578fc4dc45a90f9fbd86b591f8a47003bd2ad24c86da31e147b6f8983fb116a3d1787fc2700ebeb2a140b4a13a1898035e07dc0b1a1
-
Filesize
192KB
MD5f55018aac455c5e75c51c1325b077cae
SHA15c076218031ca3dd252cfeba36cbc53035fef252
SHA256e55938ac01086c1d885c25846b6db86456894c86e323444e663ce94f16699e73
SHA5127b246cc9af6d7edb9e15712d7bbe624253db96ee0098641b4a667e559d872134bea2d80bcf3f5f3e95c2a37bd054dec635c9934ea4bd4e98076c0fdbb1d6947c
-
Filesize
192KB
MD51f1052487c4320fe184c1408193aada7
SHA1482ced37a246725ace1e496900a27bd4502a93a4
SHA256b112d27ec5c5b8847097d5fc3801f2a8fdf327b1046ee5bf1f08bf5419735dd3
SHA5120663f3a3eeba66ac650fe43513303326d26e33b0a1749ab26d568ae1d5825af01f22182d4041b629c34067f061dc458bcd03dc2ac62579f3b0802aca0368edb6
-
Filesize
192KB
MD51c9caf3a66f9272f13fb5094f3c29c59
SHA1ab648e124685710efb5dc72b34d960a61e4da50f
SHA2564a66a996f4b1cc24c94eadf1085704601917dd4f933e785d64f1bbcb194f39ac
SHA512caa723ff3173c01bcfe9e4e14a15ade366559bbeb73311c98599e3dc093d942ac91672725865a66ec126c553f63c9332b94b6fb0dd489b2532ef56576dc6ab5b
-
Filesize
192KB
MD5cc37e37348c083d5b2efcdf74f5d5176
SHA1ef941e9b0464a01c1afadde4039e946475e5cfca
SHA256130bbc931875eeb11824ac36dde73cee7924c2aba71c953c3824155c0c9960ff
SHA5124cc193ea102805069d9775af350de823a6e6a8c7e3678365862f8d43acc33d10b9f10f33d11682de8fdbed6fe7bafe00a5a1da84050df2327ca44521c467b564