Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:07
General
-
Target
2024-09-19_cb4dbd5c7dde73292365646f690f9805_goldeneye.exe
-
Size
344KB
-
MD5
cb4dbd5c7dde73292365646f690f9805
-
SHA1
66e64c458f36f6ae3a0e2990dabdcbaa42e181d3
-
SHA256
b5e9fbca5bdcab701fa432622e34ef8b5c5d8324222fdc97cf981f53f59489e8
-
SHA512
152dc39650017fee5b6530c0a897ca2d0c4d1807cea09a68b2fe87dd0e9c8aa9139920ff6ac247dc848d0f22050f330567edfc615f46b68435ecf296438a932e
-
SSDEEP
3072:mEGh0o9lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGzlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_cb4dbd5c7dde73292365646f690f9805_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_cb4dbd5c7dde73292365646f690f9805_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D385218D-A195-4f45-BE59-832EDF26928B}.exeC:\Windows\{D385218D-A195-4f45-BE59-832EDF26928B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCDD0226-C3ED-43ab-9636-D53A38A4DABD}.exeC:\Windows\{DCDD0226-C3ED-43ab-9636-D53A38A4DABD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87D57002-245E-466f-89B2-067061BD948A}.exeC:\Windows\{87D57002-245E-466f-89B2-067061BD948A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9268E76-A40E-41e1-8F5B-22FD774E9686}.exeC:\Windows\{D9268E76-A40E-41e1-8F5B-22FD774E9686}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C45A64FA-778E-4188-B026-FD4A568C9DB6}.exeC:\Windows\{C45A64FA-778E-4188-B026-FD4A568C9DB6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6DFBB35-9292-431f-96D7-CE52DB94F8B0}.exeC:\Windows\{E6DFBB35-9292-431f-96D7-CE52DB94F8B0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDB94ABA-4DBF-48e8-B7B7-C611B630381A}.exeC:\Windows\{BDB94ABA-4DBF-48e8-B7B7-C611B630381A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0223CD7F-7E34-4351-84C9-598B1BE147C6}.exeC:\Windows\{0223CD7F-7E34-4351-84C9-598B1BE147C6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB8DC77C-0169-4dd6-88E6-0F7ACA7E923C}.exeC:\Windows\{FB8DC77C-0169-4dd6-88E6-0F7ACA7E923C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{054FB391-0844-4af1-9F8A-D61F90D4A73E}.exeC:\Windows\{054FB391-0844-4af1-9F8A-D61F90D4A73E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2E74A56-7AC8-439f-8E69-CF37629F77C9}.exeC:\Windows\{A2E74A56-7AC8-439f-8E69-CF37629F77C9}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FB04F97C-29E2-41ec-8D88-15B181B85A18}.exeC:\Windows\{FB04F97C-29E2-41ec-8D88-15B181B85A18}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2E74~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{054FB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB8DC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0223C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDB94~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6DFB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C45A6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9268~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87D57~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCDD0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3852~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD582716f14948ecacb9ba241f2c10871f4
SHA1645ac454ca7e189c1a60be49b6f8d4493bd59534
SHA25666b096fb16f676f2a767cf80328f8eaac3d0b7e9c8fc572cc40de1e84046ae57
SHA512d90859e407ef2fe174cb1872233d8329003406c4ed32ab03e7a40908fd5ad0b8f3ffb7019d9550ae0d85f56980204566ec48151e7aab32b730d14142bbfef719
-
Filesize
344KB
MD580d06854a92b6730525a28c1779d328e
SHA1e1d7459ec772289f40273b9be071c884f5507a7e
SHA2563d72cc3f254c06dca41b052092ddb403eab8060dd7a0132e07bc60ca935df233
SHA512d933e44ab9b9cb9aa1639e1abefb4be41a1a9eee6a7e55d871b92050f95379ccb8e3078c393bd57c428890c88ef0ad8705ea9cff6e2b9f0148b7d292a729a51c
-
Filesize
344KB
MD57510dba8d4642f699ff5b433af9e82ed
SHA1e044f7739bf1c43f99362e5691b5d79c65accf58
SHA256e820cd70441ac427300de74c5c8149bad1fc768e6989f1a72232c635d5872065
SHA5121531ae58f0c4e62e04af2cafbc4dfaf78459dc3f51e8f24cf2b14c565924b1ca46146ab16ab808538c55b066b434cc45971e7f06aa2d6af167560e7c35f5ab4c
-
Filesize
344KB
MD5a9fbf46954d07824b597abcdfbf17169
SHA1d13fbff1e8d185e3b09db556e5fc8d7a50a38fe2
SHA256049df8f15f344faf59a190b9708a3264c37353c6847d79b694b98e68a12f0f98
SHA512ddd1f9e919c8e75521fc197ce74ed2ea473b306be6494f5c2e724a37fceb0383e65e08f3e97c8072bfc8848aaa5ff10e181e2ff9bb504a5dc6b2d74c541b3c4d
-
Filesize
344KB
MD529c4c116e74d82b4d5ded038e92ae6f7
SHA1cebc87e72160a4994334b08aa9ed89045608452a
SHA25672ba5d6209406de63961e21ca59594ea0dccc630a61e0340251a99ab6f54a84a
SHA51281499bc49b49e131b36245bcf6e8d32ab13ec01953d9b2c9ba47758ae6dd1f8e629471b56fbcbc6f107c9eaf893f62f1340247fde4c32ddecfc5616371d3c775
-
Filesize
344KB
MD58cc5f1799e09f8075856adc4f117dda8
SHA1ac77c5b551a3d43dd46f6e4e8b695f6b46a6dbe7
SHA256c1ab30d2f12d0c6e8067083fcee61385134da0540e2a01c9ad79afdb3f072fa9
SHA512868a4637dc1edf7788a8f75a0ac202814e32b77a7f57827ac6d8eaefd98ea75191ff6929c6604998ce9f04ead486d023da651b81b5a208d280a0cfc42deb0333
-
Filesize
344KB
MD557eecdec8c31f3f36ae28531735ca04c
SHA1436b1ece4bc86ddd9e1777a48c8f8e5d883c0280
SHA2562e11384ccf3f172344ed015bf2b09770a3e77a4009ad896dd9e9118be17d4563
SHA512e6d9b83d96d9c8b25bef020098d11bd0484271f1e7f197413bad80a61d46b03c1079e6f9542f1be2c6237bfc23a442e4309b438a3c73ec714ebaf1d5e979b3fd
-
Filesize
344KB
MD54337cae43765e1640217071cf3a39cb9
SHA13fdd8685405d6ab575683b2f71307d39938a501e
SHA2560595b4a69ec4afa24d5e919aacb617ce536da46f40e54ba8001bcf8ba5d969ec
SHA512175ace2363a690f051f4e2058f807f3cf0890f95ef308555709e3943bdf2073340c4c2d6cf9701b11fe87bb37da92eb0ddb45e8a89e3f93ad6887a857378f2a9
-
Filesize
344KB
MD5314789fce88c7d5956f45d70e4345f22
SHA179b73a8bc80b9f263f3d99d4cc19e20db09391e8
SHA2560fb11051164a0cd1f2538374ad4ee63060a0cce86892377d2677eed699ffd088
SHA5127ec3f42720353bd4c07ee0ee57b02b57814ec6c4758f21b0db03cba1d706ad3ebf49bd60d01f32c38a20d89ef1a2a6bc0903bc15a91a2250b55a60940e44b7fd
-
Filesize
344KB
MD5cf0e8663dc3619813ac1155e1c286dc3
SHA15881d4452197a22ad0bd2dfb2d7657a5bff611fc
SHA256f91ca8489fa25a4a7ce5dc52049f8f98033552c245233969a773ee44acb3d1f0
SHA512a86fd9384466d26707ac4cd8d264325442e160ec5dfecbca1cf1b0059d9b2caa5025860d2e9911a0ce00f4c531aefbbdfdde9e6864465401934f5720943e19d5
-
Filesize
344KB
MD5a7f0f3cfaf89f502a3f677e82eb58849
SHA17ba4bbbab4710b9f16ba6111d7651fcf02cdfc7b
SHA256eae8e61d53bd50ce1c4b6b9b52c69e08b2214d5136efd71335717c937208c419
SHA512fbd26dfbd4dd4625006db11dd62ca5e816a9e4be4d1f40b5c720394f384ea634a0c23e505ec28189826645839368016f8ccc786cc6a0bf157c8f8e7e8b882048
-
Filesize
344KB
MD53ebbd3005c89b3583616601a3c4f865d
SHA12880bf5c42bfcab52be82fe94a6009fd95311b56
SHA256dfb70222f75fc206ed5d1cc2beb8001f0795256f106be6efcdfdc7f645ba4693
SHA5124148760711f1cca71451ef5c51f5e8a9b4546aa45057e8371ef4b9e063c3f610c8830f345338d6c880544f1920c6fbfeb71dfaafd3ec6da7cc00c0c6bcce6812