Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 19:06
General
-
Target
2024-09-21_1022046ed5dff4ed2f15b0f13804f63d_goldeneye.exe
-
Size
204KB
-
MD5
1022046ed5dff4ed2f15b0f13804f63d
-
SHA1
b3504a96d458b8f57ec12f6893fbaf3f33b73f8f
-
SHA256
2f136092964b38e946501e0bceae2afd914939119aac3df83a7d5e0dafc4cc15
-
SHA512
edd70644759952aa604981a1e6a2949f53a7016499ada6a979079454810ea8d11015f35429d3a210ce33c5eead7b3edcf5fb44163c073d5824653b94df6dbb1d
-
SSDEEP
1536:1EGh0oPvl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oPvl1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_1022046ed5dff4ed2f15b0f13804f63d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_1022046ed5dff4ed2f15b0f13804f63d_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8277F307-CFA0-4f33-ADD7-D3D707C64A68}.exeC:\Windows\{8277F307-CFA0-4f33-ADD7-D3D707C64A68}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{109B4078-FD47-4874-B55B-379111FA341F}.exeC:\Windows\{109B4078-FD47-4874-B55B-379111FA341F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE8A3253-43F0-4368-A0BA-A0B59AF70181}.exeC:\Windows\{AE8A3253-43F0-4368-A0BA-A0B59AF70181}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E039AE76-754D-45c9-B253-878788A93467}.exeC:\Windows\{E039AE76-754D-45c9-B253-878788A93467}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FB3D06B-B5BF-4a29-8518-A2DBF3E647F0}.exeC:\Windows\{0FB3D06B-B5BF-4a29-8518-A2DBF3E647F0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A43407AB-F05C-4855-B09C-B3948A10E809}.exeC:\Windows\{A43407AB-F05C-4855-B09C-B3948A10E809}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE29BE6D-0D70-429f-BC97-74611305DE4F}.exeC:\Windows\{BE29BE6D-0D70-429f-BC97-74611305DE4F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9756EFB-C0CE-4546-8F26-4F91D5C05C4A}.exeC:\Windows\{F9756EFB-C0CE-4546-8F26-4F91D5C05C4A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53686CCF-B958-4f69-AEDC-CE07D6F5E6ED}.exeC:\Windows\{53686CCF-B958-4f69-AEDC-CE07D6F5E6ED}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFD33A9D-F0AB-41b0-9F0E-533475237C92}.exeC:\Windows\{DFD33A9D-F0AB-41b0-9F0E-533475237C92}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D46D0901-79E7-4608-ADE8-DA3429B302E2}.exeC:\Windows\{D46D0901-79E7-4608-ADE8-DA3429B302E2}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{24FFBD16-329D-44f2-9143-29CBE7073394}.exeC:\Windows\{24FFBD16-329D-44f2-9143-29CBE7073394}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D46D0~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFD33~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53686~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9756~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE29B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4340~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FB3D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E039A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE8A3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{109B4~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8277F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD55fde44bbb2c6986c3b3bedaa090c7f12
SHA1f670ee75bf8ed03232d5daaad440ab7a3201cd26
SHA256d7010e12371189ec9aba7ed03092b3f478557303f930377d092eda9ef9330b25
SHA5124528580ffd763e486deb7e7307d4e7526ca5af88d1da973b34031067f40713e60b7548a792ce0fc71b5bbf84e22278add2e9d1a32bc2f3c2c3552a88d949644f
-
Filesize
204KB
MD59b18efafed140c0b89e3b8b356d27007
SHA165a55316a54410bd766ae3c6403017613c21a9f4
SHA256058629a128daffd624fb550fcd104c5c921b0da6f3280903c73ee6b669b80963
SHA51218e0ac12227e3cdbc71993a6ab1f9e22da3eb8bb18ff748ec9209d9bd6faeb5220108820c7b769ce423544aaaeef18ae552486098504971453ce9a47e3f5cffc
-
Filesize
204KB
MD5e51317c7d482d66eb9b00efae46a215b
SHA143d545a61216328440cce0aa1da56a8c2b05c958
SHA256ba74fa92dbe4da6cfda9767796044ebfe43befd442cdd8fcee0b72fb0e69d443
SHA512954bda8c69f7e821be3d834d6b2adb20476bed59bb2c6efecb1d5546484a1ff1b71ebde3eefec20d8ee651374d115a32f4f97a558fcf96d24e1423f1ea0c96d5
-
Filesize
204KB
MD5aeb10929730a4da502bba1f4c74dd47d
SHA14635f812529b17fe21032c6a3a689e4b9290e6b2
SHA256f5750c7e777f9cc2c572d66926854acea8b237d704650fda03b32bb4cb77885f
SHA5122f03a5bdb176d73c1153f30238c2a88291dd4bcd6e39e7a428d9aa3ad6d44070c1bef46f7e7fa20d3d81148b78ff6da3f417a167adf3102a7ffd653485b27087
-
Filesize
204KB
MD53a3b7590b6e64de0bf0dae5937d96317
SHA1837139fb76a2b8c28dac9c6242d110da6096c826
SHA25609810bb20c076685cec7f4e746d750b82a425d44746d774a50352502e4771b8d
SHA512c050a385f2dc879f558df2750f94da2844ecf3010033cdf15fd15b5c78b4135e5a80af76bfd89de454d31e01a86aa731c766a8af36db96bacdf4a390df8f5508
-
Filesize
204KB
MD5692d44538e5953f3b6af428a86a2c3f0
SHA16069abf7fc1b90469dcf66ca364850c400e0b3ae
SHA2566d0501478816946af5c69af1377d0ad0bb60c947bed730df91a9f3f96186025f
SHA512fc7c63e11f524d277da31461261fcc26a3e3c1326356db8f3c0583176f844cc68ff88b808ece071d972ce2a71fb7787eb36551f2686cf33d1edc2bf0e43c3d0f
-
Filesize
204KB
MD5e0c3efca6c579e626fc3628c1f9a6bc7
SHA199159175eadbfef0fc72794605782ea501972dcc
SHA2565bd9233f25edc6d64a19441b4517021cfa8569c2f2fd397affa77a6c824cb180
SHA512ade4c032543daf2e976dade8ae78fb52009ffeaf65454831b86661986930cc9513155b06dec7b4a94d30357c806dd3f64a32afd0d6e7cdffbe1ecc2c4649f60c
-
Filesize
204KB
MD5261a40ad4e1da331bec503cb98a85ccd
SHA17de1bc6ecdbb953cf15631b0ba46ff9ea97cca8a
SHA25649ea44fcc2d8e53561822cdfb321ec8fe53876b2463db01fead75f4f20387288
SHA5120366c8cb364692353b6be1f2387048b9b32a030b103f6b049c4aadb4e6a28d2965d94d928c5cfe024b953fdb5c1cc433a1f56d5abe9e3d02cc9c3e5e87b0ddde
-
Filesize
204KB
MD5be20b74ee5f16b175fc168acdf890be4
SHA1baced5faa0d5a5c61d7cba4cb2169391ceeaa32e
SHA256ab4cf04d5fae1a0d8304a31ad10eb30cb772f5a14bdcf38f9f375e06daf42d69
SHA5127a47c266fd62dc8e0d2fe82c11e963e9f73da3d4a70973e256422e14e73aa08233be2af785f626a89a68299c274e4ebe06dc19412717edd393d32fe6d2a2f3ec
-
Filesize
204KB
MD5fa6b470270abda937796f6b5ee2d301e
SHA1127f184417ba3c84b47a98d61a153131a15072c4
SHA2565c39f5999ba6cfee7d73a9c9389eae7b058dad576abd0a0f9ac2f35fc4e99b0d
SHA512d76442256d5207f3df49f11ac87c67e237f1e585aa0fa5198223062202642784006c5683164eb51a634a03f3c5cb883aaa50867dae6a0d7afd07d76e38b7a3d7
-
Filesize
204KB
MD5d0c615a049eee42b156062e164e46747
SHA12533df07ae6fab5c68ed7eb346a577fa3f563d75
SHA256fdb500781966aea646a1d51d5952150f0db78ecee76e9ba3f33bb8343e96d817
SHA51228f1969e9f6992a8c91ec778d110e44462c8b1ecc2c89ac532273cbd0ac579bdb00067af96673c47c0af2cb2fe14966a1a27c73ed8e1c70ac0269e2acc865403
-
Filesize
204KB
MD5a6fd3f0ed9e9849a936534fbd828296e
SHA1218a397606b6802a0a6cc765e3fdcf8781c5639d
SHA256aec0039212dcec2b9867ec394fda54029b456cd2049fa0361c5fcbdbdb46f3fe
SHA512efbbb52509325a183de2a9a65fb041394ea2f5bba179f91c22b820490382169740cdf5b7907ba573d6120b5e820ca4bae0c4e0baf1d98a106ee6af912887c4bc