Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:05
General
-
Target
2024-09-19_bba83e3016c14a7eb655d99943f46d60_goldeneye.exe
-
Size
192KB
-
MD5
bba83e3016c14a7eb655d99943f46d60
-
SHA1
245e739e479bd2bdc2143e1cd9df44608f4980e6
-
SHA256
f070b14fe0de1fba0e4a80f0c53082348ed7a4e716a3cafe1375fcaebb147d58
-
SHA512
7c7049c2b0f0754039c1f907258c634cf5bee7c8f0ff855670ed295536302aef7b78ca8b3cd76e37394c415e51110036c2081f5bbaa8b1e47afa696d7c3c884b
-
SSDEEP
1536:1EGh0onl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0onl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_bba83e3016c14a7eb655d99943f46d60_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_bba83e3016c14a7eb655d99943f46d60_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13091E01-FF81-4def-8584-BEBDD6F492A4}.exeC:\Windows\{13091E01-FF81-4def-8584-BEBDD6F492A4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEF5BEB6-9F2B-45a7-8DCD-C980D43C6F55}.exeC:\Windows\{FEF5BEB6-9F2B-45a7-8DCD-C980D43C6F55}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E7BEC55-1EAC-4eba-A08F-9BC6D3D216CF}.exeC:\Windows\{1E7BEC55-1EAC-4eba-A08F-9BC6D3D216CF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F36407AC-566C-4cdb-AC1D-A4CE59071FBA}.exeC:\Windows\{F36407AC-566C-4cdb-AC1D-A4CE59071FBA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5ADCC13-0268-45cf-8263-1386587B5E73}.exeC:\Windows\{D5ADCC13-0268-45cf-8263-1386587B5E73}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94B0AE49-6F32-4499-9993-9DF645515C4A}.exeC:\Windows\{94B0AE49-6F32-4499-9993-9DF645515C4A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9A92CE2-2FDF-43d4-ABC7-46848B1428BC}.exeC:\Windows\{E9A92CE2-2FDF-43d4-ABC7-46848B1428BC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63E1E63D-AB3B-4026-9DC4-3164FD6FFBF9}.exeC:\Windows\{63E1E63D-AB3B-4026-9DC4-3164FD6FFBF9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3CE036B-3C6A-44d9-8D83-3DD63BFCB951}.exeC:\Windows\{B3CE036B-3C6A-44d9-8D83-3DD63BFCB951}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FD68CE9-D7BE-41ad-B0CF-ED31794358F5}.exeC:\Windows\{8FD68CE9-D7BE-41ad-B0CF-ED31794358F5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2C138FF-86B6-4529-A6F0-4038F930267E}.exeC:\Windows\{E2C138FF-86B6-4529-A6F0-4038F930267E}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0CB1B91A-EF42-4bac-8981-D13D0F8CFF78}.exeC:\Windows\{0CB1B91A-EF42-4bac-8981-D13D0F8CFF78}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2C13~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FD68~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3CE0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63E1E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9A92~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94B0A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5ADC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3640~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E7BE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEF5B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13091~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4768,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD56c1c13f86d5ff004fd06ae1d889f6a3f
SHA16242ea6d99a6dd2d88162aedae70325570e2bc23
SHA25696da6b680978064cf2c6992295e9246acfd50b81d5b94e6b76940c3561cb9a4a
SHA5120b653e072f00381dd6d00d002fbc786bd9337f6ad39ec9e83a29bd2a9bbecce68101cf444d65d88c7c2b9ee81b35cb605500d20471d874d99dcff4be4b46f840
-
Filesize
192KB
MD5711e0d22855251054758dde704b83d85
SHA1cd17457bd2ebded2fd35f3137afbc656324e7f48
SHA25671ee3f9618e33240886b612d0e1b4233222cc77dcea5d3ce7ae6ff5c88d4b10d
SHA5122585c2e1d54bb6ea159d255d978f8fed5a8fc61275e7c92d71c0d442e91370502632da84ce50732b5887f8775e82fdd0f40e8369094ade357ace111793d55782
-
Filesize
192KB
MD5d7c67dd57616dde14d247c3bc813c504
SHA160dc0c4b51c0df3bc749f8c53968fd9bb4a3304c
SHA25657327f55e2502e15511cc59c522b9902af82452a0537baadbd88b724509e582e
SHA5123b38d78d8a1a18f7549aa576e86b81aaaf67db44556c2e56acdc393014445bf0226fadfade14c978ab00f1630dbe0966c3e91138ff159af7d5db6b0107edc677
-
Filesize
192KB
MD5ea9638ed6cfb7cc7b9f783ad095ba574
SHA121384a2a0a22f22cd9338e6cd7745e06227742cd
SHA256ea4f76e1477b6dcf5b80d857c165d1451f489a0ff2ba27756a5d0abcd36c3a28
SHA512f63ef6adced3b476a982a05810da38849275f2d8d1b67821a4ca6273f58a24be1a0fda885a7737ae828722de3647f015bc0a272583fdaf7704dda05c1fb5e1d4
-
Filesize
192KB
MD56d28b7b3722ca8890d5463507c2f648d
SHA1aa422143066af31c42cd8dbc466a48c74b5009d7
SHA256cf28832d0de2459012a0f0e4e1f664893a0e669d03f7d617042dd0036332ab1c
SHA512e9d4a9f910f5eb418e8bba92dedc7f3ff30da830db02f5390aa52d0f48371ea69f41fdf738b6053feab577cd89df0b9d0bc53603340c18cfdad73b136eb7c105
-
Filesize
192KB
MD513654a6acaba3739b948b9c68c3d5d48
SHA188a1b6581688a25e2277a333547d9d393205fce2
SHA256e26356fa59dbf1dc335a11e6075ad1242c3558bb62ba000e2720425c106ba083
SHA512379c419326040d8c8d027e6a36a8c63dbe45e555e6d1e5a31233a6059382c5a75f2e00b0468d4bc70c813b527bc12f4705b7ce35691a19a88d72292555013479
-
Filesize
192KB
MD5233d7076c7f32cdfaf8f399073fefc81
SHA13fa855b110336e69522d7e716976fa3bf37eb09c
SHA25645f263c788741990f15732cf4d0d458f8928369e334d360f711898e3765d2c7b
SHA51222c059666149dff0f68c263cea9159eac30f7f52c27ad60cb1b303034ace0b27c9abc985fed2447e4016c5fb6dc264cd87604e9b09557108a7a8398c0949996b
-
Filesize
192KB
MD53e35477e34e12e16fc7c42ebce36dc91
SHA1c74d81c8d913658b39c6fb0143492b37970ef44b
SHA2563b2af8ab9f85c5b5556a2591552cfdd452dbe82e9961eadd08ecf44996188012
SHA512ef6f84a0f7b73c69eeb40c9c9e942ddf4b22a6101dc448cc38a8778e8461f785ba7cf2206c0549b9f8f939aa99c41060a01b9f7c5aa1e1e51173ee226999a35f
-
Filesize
192KB
MD5d9cad3e1c94c94cafcbe6dc59dedbe9f
SHA12c532923afe0ccbc959377537c491a43c3020ab2
SHA25682db8e841364cc9cff5b64692eb902c0dbb0bc26dbb47a05557b9eac511244a1
SHA512096c14bb40aa4d526cbbd2b1e8cc97d41a1e474fbdf0bf8603bbbdc791531b538c419b83e128213701e641590800768c9ba2a6feae5858187eea17a8b776c26b
-
Filesize
192KB
MD5b01fa2bba27191610e897843898fccd1
SHA11a676bc1f9c34c4e2c0a5f104ed88351292072d5
SHA25676c130a3efa1f27e2c86bff22530f00c7edc84ac1ee25e31124c7fcedce8fb5b
SHA5129ab65aabc34e89de3c3544b7b827f76bcb582a92e34830197367d95789418b4b3ca5f9a23e4a5bf3501d447c5b1e7b7593e7f2010908a3bc2497d706c05bd9a4
-
Filesize
192KB
MD55a6bcb02e00626399ab5d5954233cc51
SHA1ca28ac649a0035bda824792d4a318ea983a12e76
SHA256bcd0f37cef00d4ca7fd0befd2087e12660344eec5d5045dc4ca15240a3f763a4
SHA5122806f281cd2005445fff70aab4cb675aa9050d425331c19970c42403e2754c31c24e4b2d33505dc723e778fea8e5bdcfc0703d62387d65a51f42829c124e5f73
-
Filesize
192KB
MD53785fc14823dc4460052d4e9eff19717
SHA135757b5adc945fe94454f726f0927cb4591bfc04
SHA2565953710cfff880ad84b00d6cff28b700807cd641764de1445a73aa6a4e6593b8
SHA512cc0b9bea7500a99f28b14c939a5181cc3e8574dd792ccdc06a6edc8d76816e63f5bf55d62748728c497360e50a0b03ff0937851a1f297a3541d121c276de7973