Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
25/09/2024, 09:02
General
-
Target
2024-09-25_83aaf3ea0010f785da1c22ac68b0f848_goldeneye.exe
-
Size
284KB
-
MD5
83aaf3ea0010f785da1c22ac68b0f848
-
SHA1
5dafc6fe0b1fa8805f3fbad883a8a4ada748c4ce
-
SHA256
904ce9941f4c7de3769671b1d7d7b48d2dd1ce66363d374b7da6856f69e70f6c
-
SHA512
258cbd96435125714e1bf028e713a7923845f351868c0a7bcd4ca4c420e88eff46026b8887c2f8aa7f7a57927324642f1799dee10fb663d63ee3a5cc08260610
-
SSDEEP
3072:BEGh0oFlcOHOe2MUVg3bHrH/HqOYGqe+rcC4F+jHMUy:BEGblnOe2MUVg3vceKc+y
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_83aaf3ea0010f785da1c22ac68b0f848_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_83aaf3ea0010f785da1c22ac68b0f848_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FDC4ED0-8AF9-4a49-868F-A6FDA0B990DE}.exeC:\Windows\{2FDC4ED0-8AF9-4a49-868F-A6FDA0B990DE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB2C16A9-A034-4a72-AC26-FFFB0872E162}.exeC:\Windows\{DB2C16A9-A034-4a72-AC26-FFFB0872E162}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{254098B4-0CDE-4035-9002-824FC4CA461E}.exeC:\Windows\{254098B4-0CDE-4035-9002-824FC4CA461E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28C616B2-F8AF-4768-9B41-57AD2DDB6AB7}.exeC:\Windows\{28C616B2-F8AF-4768-9B41-57AD2DDB6AB7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36860D61-6A31-4118-A6C5-7D00C05BBA68}.exeC:\Windows\{36860D61-6A31-4118-A6C5-7D00C05BBA68}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2826933-F45A-433f-89D8-F12F2FA4793E}.exeC:\Windows\{E2826933-F45A-433f-89D8-F12F2FA4793E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DBD6B09-AA7D-4999-98E3-4DC3B3C6976F}.exeC:\Windows\{7DBD6B09-AA7D-4999-98E3-4DC3B3C6976F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{237FBC3E-D732-4a94-B37F-CC2E0EB825AF}.exeC:\Windows\{237FBC3E-D732-4a94-B37F-CC2E0EB825AF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC6D66C7-08DC-4a51-9289-32E009E35307}.exeC:\Windows\{AC6D66C7-08DC-4a51-9289-32E009E35307}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8BB802EE-F595-440b-B4DC-B7D8AE16965B}.exeC:\Windows\{8BB802EE-F595-440b-B4DC-B7D8AE16965B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB4AC31D-8072-40ee-A0CA-0FE1266BDC4F}.exeC:\Windows\{DB4AC31D-8072-40ee-A0CA-0FE1266BDC4F}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F95DE17E-1E5F-4ae5-B0A8-0C17A26AB568}.exeC:\Windows\{F95DE17E-1E5F-4ae5-B0A8-0C17A26AB568}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB4AC~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8BB80~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC6D6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{237FB~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DBD6~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2826~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36860~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28C61~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25409~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB2C1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FDC4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD5e3cc1abb6014af9f78ebccf3f035ee7b
SHA14f2914700257c9b2f389c112217bd07dbc43290f
SHA256fed777267c09be7ce347ef6335e18c6830a9ffc9293a9dceb69db049298c8723
SHA51250ea7097b8bc9070856cf14ce04f603c52d38553c6936325677b4a74ed52d0f5069cea719740164b7412b2901993c2ccfc27a490e22d8807f47311d1d0e2dbfb
-
Filesize
284KB
MD5046454cf415cfcccf8111ff4922180b9
SHA1107052737c90681f83814a3554eb7f0ec284c691
SHA2566110f776dec5bd2469cdfb9bc514c5039152d4b5068c0d178c368a697d31e5dc
SHA5126c974eb20ec667ab3a611e2ff545d1c58a6256b71c3a2ea12f38430a3631d5104684bbb801570dbe9eb9cbc62ce07612ad31c8da2adab57d1fc87a89a811ff43
-
Filesize
284KB
MD5e5cc35324907999509861b26585ebecb
SHA1caceaba3b94457218dc6f8836cf138e8e3ceb265
SHA25636f82c8b4a1ab365401607a33a8582eba0089010d71a347bace07c862d4ea33d
SHA512350b06a252cefed8123d5c4ad3d355aaefd7cfa9e7af8619b0b3c6cbf3114f9bfd59c50738ea1a7470b24942d92552dbfafebaae1de7c460436f5827fa87dca3
-
Filesize
284KB
MD5ba307585d7a2b1cbd3fdea038b9e3e16
SHA1cf45ba0e32cb1959073c92d6f8120e613042aba8
SHA256e67926dac0d819f21e14224658f002bb653eb5da1a659b8f09afcb2e1b76e539
SHA512d6a12b87af9693dbc9acd9f90674140b32a8e950eabf9a26737ae26e3ef95ae4c1cab6679c38633038a1fda96fcfb8b47f5dbacb91894b99e46d399118afc87c
-
Filesize
284KB
MD5e6007c697a9a666110ad72921274436c
SHA1fb507268803974aee484f999d883f5e2ed718ee2
SHA25666f31f73ce59ce1b3b6f890f56381bff3c4e6037c33f69ff4897ea6103aa0dcb
SHA512a3b98f89a516d14edf26b03e5b830aaa1ff20cf8859efe31326852ed7d6b053d72e78da3377b7f311634f7c40b94a85be963ef956cdb001e9c84811330160b32
-
Filesize
284KB
MD5e5168809ad4540f7da539908d7ef105b
SHA1ac5afafc4523f908559a6039bf1b5f8f2563f540
SHA2564291896411bdb71a072148854760de0c7eebf7a22cc31399415fd41b40b3cda6
SHA5121bbf1e8f42f859013a083153d51fea44b9f43128b7e25fe09f2462b5e924e038ccc1c5e345205c5f262a8367c19a9dfc53fa450bffbeb932796fc215416644ea
-
Filesize
284KB
MD58819cc4b2321778456893adef8d21510
SHA12403b6ce9af4b2b2d2eb399e25f7dec071fc2e59
SHA2560c648470aa9dd895bbaba6e1cd216a487941b9e89aacedeed49d64e129cdf87d
SHA512c29b2f99d5220e766ea0a43c7daaccbdaa56591c885c102d1272a586a8a9f112a0a0d7c868b76879683444db4996526fd63b52692202d5cf4eef131c9c8e3ab5
-
Filesize
284KB
MD5facb0e1930236e086286077f9836c152
SHA125c64391cbe9ceaec9a7a84a8e887d3f859e2349
SHA256a4e012ad9c5c2229c934f1c50bdaa18e8a144f7b12831b3f807cd78804fab94c
SHA51200e671a74faa458165486f3759d23a288d33320aaecfe8c30cac4b06651608e0fef23df01c20be79280839fc6a35e7d57d7ea88e3594c73378ae5376aead196d
-
Filesize
284KB
MD582cac674eae17f720a51f5ce2ceee4bd
SHA11a21c114cf5d723270e64217846a5e9b080b3b95
SHA25666660b13bf13f470f0acd8980d1322bd8c97129c0a9e16de44f6d4ed13c16cc0
SHA5125bc12f94941e9bfe17e2048efdb4a864348135ca62448340db92503e1ca4a6baf4d9b70cc034cc4d6817f7a10a22b429508b8f4751a2a002b89f07b24c901bd9
-
Filesize
284KB
MD53d83c12bc30e551baae586955c876529
SHA10c1d4639251de2ec302fe114c95b3ba278c4ef60
SHA2561769623c077309242f3be1e9abec118c5d8b85784c81f00c538977183a71aba3
SHA512dd0c53a271d9d3d8ca9672904b6134c87bc66c551d2f2b2aac79d28066260093ca6f8470dae573831aecd85f81b9c77e8c15ed0db387d00b3ced3cec8b7cc030
-
Filesize
284KB
MD59618f9a8a273c4cd518da170ed20807a
SHA1f2051daf70672b95a49fb03ce2dcc893b2630c33
SHA256edd2001ef059098e5b1b088e2465d1a6b07014c57a94f048d781ca55bfc89c32
SHA512da50991b1488fb4dce96a88b7fa645be7c905fc3764a4f3c48bf6eb819710dfaf84624633b59b1156b3ab46fc774e92738dbde07198f5bc1b2cd0625b02976e1
-
Filesize
284KB
MD5cedce9af16c5a46ec7db5495a4f3e9a5
SHA1c8bd2e590ea42234c5ae6894dc49afab4a9aeb1f
SHA256c28a5438425add8344fc452a730dc390d60cb3eb672539eb574df83fba8b9269
SHA512c7507e3649bd6b589a57e55ba8d8dada6bc0ac0c7d21e3fc14b391e1384ed3f707aa60dd8bc8b55e5a8e73528473c443f2cc41e8133e25e4cb13d09b590e22be