Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27/09/2024, 18:56
General
-
Target
2024-09-27_72ed0660c593fcc8850e76ccd67d897e_goldeneye.exe
-
Size
216KB
-
MD5
72ed0660c593fcc8850e76ccd67d897e
-
SHA1
bc3e280e204376736334a01240256b895a08193a
-
SHA256
915e36e1ddc155fd5932b2d7594d2014ee73fa266b1542ba6761158bfcd230aa
-
SHA512
e1538c922f471e155bd32fea85293a41f8dde3c280f9a05471b0e1b465f1a91153485b25082a6ae2e1af526c488a8a51cdb84f913baa03a24810ba800bfd1fb0
-
SSDEEP
3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG5lEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_72ed0660c593fcc8850e76ccd67d897e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_72ed0660c593fcc8850e76ccd67d897e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13FE0E98-60FE-475e-9D06-C31C30F8AE85}.exeC:\Windows\{13FE0E98-60FE-475e-9D06-C31C30F8AE85}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{020D2728-6923-4b56-97C8-38A56DAC0F92}.exeC:\Windows\{020D2728-6923-4b56-97C8-38A56DAC0F92}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DF7E829-6686-4125-B7BC-558742F1DB48}.exeC:\Windows\{6DF7E829-6686-4125-B7BC-558742F1DB48}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DDE15FE7-1388-4be2-BCEA-2B113B3D1184}.exeC:\Windows\{DDE15FE7-1388-4be2-BCEA-2B113B3D1184}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D64FB195-2237-46d6-8B5B-A2FD16266B51}.exeC:\Windows\{D64FB195-2237-46d6-8B5B-A2FD16266B51}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3806C1A6-45F9-4d4f-A45B-0F967B7FA083}.exeC:\Windows\{3806C1A6-45F9-4d4f-A45B-0F967B7FA083}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3DE5975F-709F-4f97-BA9C-E7727E864ACE}.exeC:\Windows\{3DE5975F-709F-4f97-BA9C-E7727E864ACE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52BFD74B-1D1B-4443-AA63-3A7BFFDDA043}.exeC:\Windows\{52BFD74B-1D1B-4443-AA63-3A7BFFDDA043}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3DC9B3D3-2B39-4803-B83E-2159E9B663A9}.exeC:\Windows\{3DC9B3D3-2B39-4803-B83E-2159E9B663A9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D94A6C8-E086-4f28-9A87-33693D0D9DCA}.exeC:\Windows\{3D94A6C8-E086-4f28-9A87-33693D0D9DCA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{364FAB5F-C8CF-43f8-93A8-D468A722AD2A}.exeC:\Windows\{364FAB5F-C8CF-43f8-93A8-D468A722AD2A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{63CEAF41-1FC9-4fcd-AB6F-CA8D61A4685E}.exeC:\Windows\{63CEAF41-1FC9-4fcd-AB6F-CA8D61A4685E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{364FA~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D94A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DC9B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52BFD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DE59~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3806C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D64FB~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDE15~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DF7E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{020D2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13FE0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5b05eea711f107567242853031a4b5295
SHA15a372c780806d8af4ca394d3a45f0659c5affa7e
SHA2561fddc3432cf031a0ff6e6864cf95ffda246898ffd559cc0281d82181a0cfaf6c
SHA5128ae969db3e34ac7fa2276972c3e3d72022c0da8d787d6c616549b4719e0657fa1dd9f022a460c958e0af44fd98b4ccf1a8054cd0e3ea37060cefe5b26ec43435
-
Filesize
216KB
MD59eda826e66cb0a6183dc2ec6c2e16cd6
SHA1448797fa6fbf0fe757d46d36cd70d83b01f361c7
SHA25659ddb151c0ee6cd10989b6971270799e52ef660dd1e3e593b7f43e89d341946d
SHA51233bd9b8db7001a8c667053cd6fad1961e19f697a72e177db295e4d8bac81e31c16d451bb163b135a4ae14e56931c5b3a0bd51a69f06fe8988cd5e788f179c89e
-
Filesize
216KB
MD5307cc99c287396742b01c68e51f894de
SHA19e66680829ae0b36d97a35824dcd9f827f8e6eec
SHA256d11ac23e3639b47c60f110e7bc3bfb9d6e3d37ec3258af6922378a4808a1e0c1
SHA5120daa34a88a937cc32de11b97fa71014e8c0df86a01daf094b051b8b8b921dc5878078db2b8d2794e74e672ac9bcda401e4e62392d1ee282c8186b7f7070e7dc4
-
Filesize
216KB
MD5e51591057c1d52f031ad9980ffbfb65b
SHA17fb5a364f9e42829006f5c0cddfacc5906a1ed00
SHA25689729be9effdad900a3023f9fc91784ac92d35fe193a539ec4ebb9fb46763beb
SHA512e3d33e4e940c63d46867c3774091b046bbe46d6b37ab24fec8649e38b584d77ad1f2f5a5112899406f3aa00cd95c3cf4dd0300251b1444d00e718a390ed6e6e4
-
Filesize
216KB
MD5c286d6f4b0af62e497a5d466c0044bc4
SHA162b4f21ae8e927862d2879cb592b3cd2aea680f0
SHA256809140611442e0a76d2efdf071d969c3365c1d9189d11a46aecd9a6e5e14afc7
SHA5126ed81aa568ba1e29bebc4ec552bfd494d843b397d7a5d61fdcc5be186686dfa22f6fd41795c6918cb9e9a97877d48378a61fd80ea3fbb0f3e001181cf1029464
-
Filesize
216KB
MD5c51a996fc335faa831a8d10d834d779d
SHA128f9b35fe6c02da173ec8c1b61fe52cb56dd6633
SHA256f2699b974d33a6e241ed2bed0ca396b53594dfaa753d87bc91c1dde3b26791c0
SHA5129c3377ce566298b793f873b2d49d2da889c041d5251ef32f7439fc6325400e49eb1954e3c48875d24cb1a9d5aba4683cf772acf79ed550d8826fc9f87cca4b53
-
Filesize
216KB
MD57dc0efa73e98f9a096250dac5984f28f
SHA1a849e22db40a49192254897e221902000f38cd0d
SHA25692008ab191181fe47b359392c6d51437cf6be9135c25ccbcd021b50ebc5291cc
SHA5122baa883577ac7a124c24c00850ae482b800411a03f70e55f82a1cefd1b7e75955f4a2b9e4fb577b86324057865820fdc2e88f813dd4ada48d0c6960829ed86aa
-
Filesize
216KB
MD5a74cbe861ee459ffd35616c792ca0ae3
SHA1dd5443db9d2fcaad0097607c7861ceacbafa3820
SHA25674ccb68bac5e7b26835dbeff83f3ec7483db86d38a7b1773f8fe2728389bf8ae
SHA512b32ff5e204967801c4da027d2626faf27e4951d799ba60453c5ed40d94f6404232bbbb190a6921dd6c8bf20b5b45bd1813d7da2ad18f55bdc7b34be5293eea83
-
Filesize
216KB
MD54fda82b1b62c495eba1b66cf1e76be54
SHA1c4e42e04b166a03a550e24b63aec9cc31d1ba273
SHA256ab542e94859459cf5a3bc9244d7dca46c23ab55fd18dea5b6a36d0a64454ae2e
SHA51278656367239c096da1234c32892bbb76bc0ec86273f3a9ca1cd38aab1cba0d2297f8e554e16ebf963afa1fcd680add661f4fc8b884d291a751f1aa6923df68ba
-
Filesize
216KB
MD56cd5221e20a0ba16385b5fd39193dd55
SHA101b56ad71a4b95b876047c0a446673bdb2394a9c
SHA2561d07b4c83152ca9eccdb36caaa1e71368f2b09a8d1b707cb8b1331fbd718bb45
SHA512ce33d149c0bc06aa0231a60855a1bf1402941e0a9da3426c8ad3cd2fa779865e67b4a70368bab2245471617f8d9dd6a9f205f4724c5c6fd26148fe4a0ae595fc
-
Filesize
216KB
MD57624b9d021b885fc49f3f8ef330e7555
SHA17016c602e95086cf7cdcf3de8dd0c2d65d685927
SHA256e1c1dc3d7c3c267a679ecc6789ad0ece43ab708da7716d28c6f3660e983dbf74
SHA512a3df5f74439bb07ee535c21f47267ccc2afa14bd540315f8ca9c04419f5ae2197615fb014a897bf7cbec175af069ec06d2fc0739170e717bf31f889c59a6e431
-
Filesize
216KB
MD5169cbfb04180068e2652f5561be684b6
SHA1932e73ebd53d4dcc3d31cde30361d338f1f6fb0d
SHA25693690ed7bfbefedbe34b00a9413237820e36708061c9021591f2a3a498ce741d
SHA512af6fa8f5b02ce3ebba775cfbb2930d626468dfb6b36da13ee390d6f07f4f9131bfa160865d8f3d0da106a43f51a95be640629cde947027e39c93a53cabe234ee