Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:14
General
-
Target
2024-09-19_ecac19819c9c0ba74f0f0a7ecb43dde5_goldeneye.exe
-
Size
168KB
-
MD5
ecac19819c9c0ba74f0f0a7ecb43dde5
-
SHA1
0971906ec216eff8fcc2d0e0e57df3e9951f16d6
-
SHA256
361e219b849142c6495b61d56ddd5c1ec57c6d4e93c3e44ea06492fe350429cf
-
SHA512
46c30621e0f2eff88682cf55b46a015b0d908bf66c64470aca79705b37be09760846e6a88bb75fc0e6dcbd0fded102ef71bc559a1635bf7d2ea5b277ad73c21c
-
SSDEEP
1536:1EGh0oOlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_ecac19819c9c0ba74f0f0a7ecb43dde5_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_ecac19819c9c0ba74f0f0a7ecb43dde5_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6874E25E-A889-44fb-A373-E121F6BF8940}.exeC:\Windows\{6874E25E-A889-44fb-A373-E121F6BF8940}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32B0979F-306B-4f39-AF84-AFE67FC751F9}.exeC:\Windows\{32B0979F-306B-4f39-AF84-AFE67FC751F9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99954FE7-65D3-4062-BBBB-549BE7C18FE0}.exeC:\Windows\{99954FE7-65D3-4062-BBBB-549BE7C18FE0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7ECF1D89-AA65-4eb9-B464-C408CB63FC0F}.exeC:\Windows\{7ECF1D89-AA65-4eb9-B464-C408CB63FC0F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5355FA9-0239-4a11-9781-50003EF9BA00}.exeC:\Windows\{C5355FA9-0239-4a11-9781-50003EF9BA00}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F45D05DB-9BF2-4411-8CBB-C627ED030489}.exeC:\Windows\{F45D05DB-9BF2-4411-8CBB-C627ED030489}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3896C938-F0BC-4593-AD0E-67C4BD23B098}.exeC:\Windows\{3896C938-F0BC-4593-AD0E-67C4BD23B098}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{881EC3F5-0FD2-4a37-A630-2FAA46BF04C5}.exeC:\Windows\{881EC3F5-0FD2-4a37-A630-2FAA46BF04C5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95D8F777-5584-43b2-94BA-D5557BAF0760}.exeC:\Windows\{95D8F777-5584-43b2-94BA-D5557BAF0760}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8AB459D-08D8-4cc3-A780-4AC153B7A0E5}.exeC:\Windows\{C8AB459D-08D8-4cc3-A780-4AC153B7A0E5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{613A5403-0E22-4210-986D-C363A1C38F82}.exeC:\Windows\{613A5403-0E22-4210-986D-C363A1C38F82}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C5E5D89F-018C-47f7-9BEF-7258DF6E56D0}.exeC:\Windows\{C5E5D89F-018C-47f7-9BEF-7258DF6E56D0}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{613A5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8AB4~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95D8F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{881EC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3896C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F45D0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5355~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7ECF1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99954~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32B09~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6874E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5887db08e0da186ea186ddf1b82553c5c
SHA17e75aa27d1ef1471f9dd5e7a0c7c9b9998bdf7a0
SHA2565a4654dfa4ec2a3e75cf533dca37691d7e762ae107e72028a1a32ed82a37db37
SHA51264a4d97f2cf80f21366ceb575948c2f2f93b3b1202a78341bb9e00c876bc7d6d221c95b530396f8270988d487b3ff11b9de05ea2a06a214f852909373ec7f3a2
-
Filesize
168KB
MD555bbe2dc061badce4df667ed78a833a6
SHA1362453b6c2df105f32a01024aa9aa901b054c010
SHA256e29bd062c25cea5013329e91cb3790d15dc278f8f273ac75ece2b58b3f0f6c6d
SHA512b1521c098265017cb6821462333a5873e0d50c6da494b521a2e233f6f5aadc6682b8a4d2ebb25cbd40ca723e617d4fe0ed4802f64aaedf5c346a626a2b9505d4
-
Filesize
168KB
MD532c3f7d19c1b3bd8188fe1339610fbe3
SHA1fae79529a9b58157027da6710d32d6a391feab55
SHA2562232fa4a9a7676af96838a7a1b371255016724662b905a94d7a4f2da7bf84a23
SHA51274fcab87fd7bdb1b0d1c1bf67ab168632e2f05189e56ec2bc55dde0a2c2835e349079547b50de55d5f984e496e9fb95331a99285cb294b3470e9b552d37eb736
-
Filesize
168KB
MD5dbf85bd67536108a8b053fcb894dbd57
SHA199cc4596c99b8ac43a3fec236212f60fd38baa30
SHA2560df13af4c9ba67f51aa01523e5ad6292a2500fe828f96fe479854308ae9bb512
SHA51277eb6e7e5e5e75c87430362858783dc66c4ec7e90cffc26a20202063cd851e65f680b76d38de889a9771e8ecb9e9eb3801ed0af40de8a34fb56dd2386e71ff30
-
Filesize
168KB
MD57b843efb9ecd49dad4d2253bc51ee975
SHA12bc2a4180f2a1aa8e7eb594eaddb3e274ebfffcc
SHA256f66ea79e6a9e4f850fa7f337a90a2882dcb13bf73968279c17f8d332150eb986
SHA512132930f74741decf5d3e03c443463c569af9496b43987755ac1e48ee67a524fef12d3ddbffbd556707bf19197eb68bdd2bda06bb74db5b80bf7ea4741e1be28b
-
Filesize
168KB
MD558883a4671433a27e9e0242edca9ab8c
SHA1059d335fa5bb48b46e7ac90f7b5b7af856067863
SHA256817f5f5ba089755e7acae3cd8eb083e00055f474efe1c5969317a6165e379281
SHA512371cad91a05c53dfc2fef20b02e9ddfd18182fbfc3a4d7aacb5ad2a53f9734f57fc13f7103a44071a13f14990aeb60949b288ce0fceb18fb0c6f4591e25abb6a
-
Filesize
168KB
MD531e81a1f51d7815317e421645d5e92c4
SHA178f6292d13859e3c8e484177f10390af43297712
SHA25656680793d9b08ed78828e2d0db8156110ffb241e8378825fa791e8dee21f3e11
SHA51250e834b9d9a29ed808ee9969dc30a4e367c08fb1f9c7637667d1799fa8d049a450acf86dd77097fc5ceb7f29f17bbc1fe48ea5c87bb3a82f4bd9b05913ca2c6e
-
Filesize
168KB
MD581f987ce2a47a3582f9c429b15e61bf5
SHA1f4bc8fe9237560da944f528d64012a74539ebaa7
SHA256add4fd26673ad795277e800032c859d79066cb3afff174b19a0fab9769ea4db2
SHA512f7202d03d5ca39171a382a6f984daa0dcbdd1354ca6cc2b8d40a338e327400ef272f71667cd2406a4332e2eff598589f8869751591f79b90faf94f61d34da03c
-
Filesize
168KB
MD5172d2b8f98461b375f18807b7bd00b5f
SHA1117e1d298d2890205244bbff54d2b42bce782051
SHA256851631a87921ec60b2914ac7eb5723bc955315f6b7cf7e535970888c46bc1763
SHA5123ee1c4387574ca7e1f80fed3b860157e02906b3c8d193914a720050733befe8bf85786a5e6dc887f65e70e0729ac704a2d926da325534b105234172e47e87d55
-
Filesize
168KB
MD5e0b7dc421d2e33e1c3099718108d1b16
SHA1a23ef9202b85b158bba50f0897a08a96caea058b
SHA256afffe299ba61e1c76bbdfa2e3ee9af8e4272306356143f41ec749712a34dfb97
SHA5129e3a88fe32ce34af1b8338144ef55695f52b9241e48d70dfab18a31bfb094c19332c30e7fa0bd1eb1369128f8fb7145df7f13aabf3880a15057b5ead4f68cdf2
-
Filesize
168KB
MD54cabba0de2a3042d70a4b4f0d671b31e
SHA173b333e87136fe16fea2bd342434bf81a3fb89bc
SHA256374877974ec8f7bf1e272d1ce7c7e85f29431eea6f77ab1a77aae61d6c0586d1
SHA512488e1becfa90b35e6cb07bfeb9d335071af4a619d7ff9dde9398c008b5ec5cd2f985908213db208d31ab3352ae397198ebea7a6d88aa0cd7637d395c5d6cc452
-
Filesize
168KB
MD515ab3ad1a658ec20c84bb8f6a09288ee
SHA1c8664f48984ee49bce1c99542600bc51a6c08261
SHA2563b8fe02ab026602b2d8b33f4ab66d997487597ac631667031c0968c08d42c572
SHA512ec6a6ade40cce09242cd871e55971b268d34485bda5268af144ded37db2595dda5c23a36cbcede0a387756e649b27a6a01d3a98f07c8ecac58beba1f1e7876c7