Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 19:34
General
-
Target
2024-09-21_c0066adcba3177d1669a40d3bb466b8e_goldeneye.exe
-
Size
372KB
-
MD5
c0066adcba3177d1669a40d3bb466b8e
-
SHA1
40cac1419753c933779664d4388c91c1eaa7911a
-
SHA256
b3e99e8bd2d66b47b2b4fdfa363cfe389b8777db99b5b65ca0fc6cfcddae25db
-
SHA512
0c6c6cbb4f76b80baf1d2764843a97ef83652d7df2772b72abbe3fa4dd1397c6c42f2fafee03ba73aff8bf2d946ff00240b83e1f81f6ad3d4e35c6b4c9fa5483
-
SSDEEP
3072:CEGh0owmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGXl/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_c0066adcba3177d1669a40d3bb466b8e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_c0066adcba3177d1669a40d3bb466b8e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74C90102-BF69-4e7f-AA5D-34793ACD6C87}.exeC:\Windows\{74C90102-BF69-4e7f-AA5D-34793ACD6C87}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A842675-FAF7-412d-8484-3A636C688B78}.exeC:\Windows\{0A842675-FAF7-412d-8484-3A636C688B78}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{504CB968-5C68-4ae9-A71B-3D200CC0906C}.exeC:\Windows\{504CB968-5C68-4ae9-A71B-3D200CC0906C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5360BAEA-A439-4640-90C8-2FCCED15C055}.exeC:\Windows\{5360BAEA-A439-4640-90C8-2FCCED15C055}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4114BE3-43B1-4508-937F-F58CCCE78CFD}.exeC:\Windows\{E4114BE3-43B1-4508-937F-F58CCCE78CFD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B2BE85E-998F-42ba-AD72-5EB1DDB83DB7}.exeC:\Windows\{0B2BE85E-998F-42ba-AD72-5EB1DDB83DB7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5438E157-915F-49ac-8347-169D79BE77FF}.exeC:\Windows\{5438E157-915F-49ac-8347-169D79BE77FF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0443E21F-5A5A-4515-A247-F34D85669A6E}.exeC:\Windows\{0443E21F-5A5A-4515-A247-F34D85669A6E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07073F25-6461-467a-8FB9-F282A40D9782}.exeC:\Windows\{07073F25-6461-467a-8FB9-F282A40D9782}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\{B8CAEE1C-E29F-4e88-9CF1-D8AFE26C1379}.exeC:\Windows\{B8CAEE1C-E29F-4e88-9CF1-D8AFE26C1379}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC64199C-0CA8-4e30-916E-4FFAD4BC3A53}.exeC:\Windows\{EC64199C-0CA8-4e30-916E-4FFAD4BC3A53}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CCF0F2F-66ED-4246-9D8E-938B111267E1}.exeC:\Windows\{2CCF0F2F-66ED-4246-9D8E-938B111267E1}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC641~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8CAE~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07073~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0443E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5438E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B2BE~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4114~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5360B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{504CB~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A842~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74C90~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD53ad60d647aa50fd103ec9b245f114ef4
SHA1b91daf8a4be28b2af85680bfb86c522cfb51a336
SHA25604b9929daf4ef94f6528cfa8a069fd811c83b8bacdae7e29083092bc5ee2878e
SHA512a4f3f99cdc89e218628a416ca7f800f4953846643cb25a6f128970f9c8844959112fef8b11acc1c8aaa8524a96a709b81eda66ba7103856ca216a57281004acd
-
Filesize
372KB
MD577e4af389e91670a0c46650c99086170
SHA1cb05351864d9942275d5bb29dea6a48033435404
SHA2569cc89392c3accca84a746ec98e29810708951d069d7f5e7b2c2eb5d6b25e7c23
SHA512f131c1616975361f212079e045f6558e2dae7d3cf084227bf0a0973b60eb0c611c954813ff50815b15d65f9ac6338fdc584966a8048df62bf6fceb5b12bc2549
-
Filesize
372KB
MD5fba5ef736580a8b298cb1d326f76ce74
SHA11abfd68a1c4b7bd91a21c17a59f7e374b967b883
SHA2560fd16cf55b679608c848ad457eb9c314b7cbdeac7601fcfbf7fc91cc99080d8f
SHA512b5cf2770a242e07b24925183f7edec942cda26da64f97875d00137e3dbc1e41d9b84046c46eab3b5651d9ab9231a9906f75b45f3d015b5c5facd7793862ab336
-
Filesize
372KB
MD596f8273190a763e991b09daa68ff2a27
SHA14bd0d71d593a69d7f1dbd25d0064bc4a3a532104
SHA256539bdf1535c4ccd739790867d6c66e71d8f3844fc2e548031c5c97d8cba9ef81
SHA51230abfea1faeea053e9188ecd2bd2ff8138704e321b6175453f364b8d5b7f75bed6a6ca287eec875903fe453eabfa7ce9c8a29b3ae587bee7bf0cae13c679ea0a
-
Filesize
372KB
MD5c1441ac5acc185bf0505bb380723a3a6
SHA12768e9c1d5429d1a2fdeff96d3a65d10127ae533
SHA256eee0c30d8da9a74ba62109a073a2c99c519144637c66a2ab2a3c41ff110384eb
SHA512d2e2c9e9f6818b143180433ff057df9910179552afef1b93e1611e0921e5fc85aa604a11c6f6ca874b13dbbda29c887d6eb162803d7a47da3e66f252f99f3c90
-
Filesize
372KB
MD561a364ccd72715ad1cc5bde94f1075de
SHA1e7514d8e8677fcbb49257b0cdd73f59ef35441b6
SHA256ba02f4887acaf6793b21966577e3163f6751b172ff2339975e3afccd630ba513
SHA5123349f3a366acd1fad6d4b9c9b0925729a970ff6d67001851bb07f348cad711dc486038c707cfb66138a82547d564efe5ccc889af8d44d82e9f2536c0d91fdd67
-
Filesize
372KB
MD5f0a53cbd5304722e0cf33bc633fb2de7
SHA1261bccd911afa23e9f3fa968ff1cc1ffc817cb17
SHA25637d3be179b983e3553e4b0a5b3e3ebd4aea245d1b4bdd8cf61da94b699310ba7
SHA512933801630817014e367435abb7193bd25f1644ac2c0cd7af81025c754c7de3ca582b84c4f7ab2ecf3fb3eeaa8e718e214f3b7da46d9115bada5b731c06ce82af
-
Filesize
372KB
MD54aaf6781396a5917d92cea4774fb90dd
SHA17719c61a1578e2b67e763718a3dc30f963162b26
SHA256e73afd9b58acd285da74688846034e7343efcd66d10e0ac5adf309c1d4e10816
SHA5124c159fedc26143107c9548bc4d4e50c06eaa1e64a91894d313089b315bc0558bfe5233196e6b3fab8796342076279936471320b02728e83b973c6014b686e8a6
-
Filesize
372KB
MD55687b4bc9d4a56596eacdb5c792d9faa
SHA1e2b81216e1d0656dea1cf84489519e031b7d475c
SHA25668cb623e74c4c09e720e8f57fdbd9c482363c50e3a6f74cc18539146f71d3587
SHA51233bfb1eaf87c187cff6caeb28dcc208acc1fd3cd3545a059a7cee0f2ca113d817f8430e5c73dd99ff90fe491b9ba9c40ac4c05bf840a2abec3116e99c9ed4828
-
Filesize
372KB
MD51a14dd3e46fe3d147a67433be0d00727
SHA1dc76a5bdcc2048ec3ed1a80e60100f05a80a60b7
SHA2562a627b6e2627631c2f1ea54e179777c74b9b4504a9bd333b07a2c631b4bd54b4
SHA5126ce2acc16c40c31d0355e0ff6e3993813bb1d6738aba6531dc194a4c2e695b69a757b8d364b4a17c9b17c45c58c409413473d44ab36cafccd24055985c72b528
-
Filesize
372KB
MD5ac37c06125493e42cd56402b02898eb7
SHA1fd3accd99305bfd44bfd85d0aa105d2c5db6a9ca
SHA2564c389c7ad643d739c1849e16e6eae5ab1f4e6e63b6266df2fed8998165ba675c
SHA51272f81c9da679a36a9ccc2a5512cb74dcd03a8bc2d92bce004f0b1ee8b83cbb090263099c3e1c915a2b0f91111767ccfdd73ca2f51ce7bd38c0f6abf5a12592ef