Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 19:01
General
-
Target
2024-09-29_a5fff169e180062b77ac501c2460fc3c_goldeneye.exe
-
Size
192KB
-
MD5
a5fff169e180062b77ac501c2460fc3c
-
SHA1
0f60903ab471387d076c07d5d0ade5750185af42
-
SHA256
25e885e1bbf39b87074f12eb92f72cc47c82649fea07b96d8f9b5e3cef0d9567
-
SHA512
2dde251881c2ba858ea1c6dd9502c309d508dc781cf5a377cb3ad759afedb2faaf1f0c63ecdc209fbae05672a1be80439790c11600cc59dffa7062c112a4c6eb
-
SSDEEP
1536:1EGh0o8l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o8l1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-29_a5fff169e180062b77ac501c2460fc3c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-29_a5fff169e180062b77ac501c2460fc3c_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{127E57BB-083F-4b99-9EE6-6FBCAC9A3656}.exeC:\Windows\{127E57BB-083F-4b99-9EE6-6FBCAC9A3656}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B239C35-050B-4c53-9778-5230B41FF67F}.exeC:\Windows\{2B239C35-050B-4c53-9778-5230B41FF67F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C68B2958-9562-4d94-B077-A78732301C02}.exeC:\Windows\{C68B2958-9562-4d94-B077-A78732301C02}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8767561-2434-42b5-B7BD-936616664948}.exeC:\Windows\{D8767561-2434-42b5-B7BD-936616664948}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A753357B-D1D3-47b2-AACB-284428C3B67C}.exeC:\Windows\{A753357B-D1D3-47b2-AACB-284428C3B67C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20A73F6F-D02B-426a-B15F-8D19D52F1466}.exeC:\Windows\{20A73F6F-D02B-426a-B15F-8D19D52F1466}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D025759B-5069-4c74-9063-2F3AE0432B77}.exeC:\Windows\{D025759B-5069-4c74-9063-2F3AE0432B77}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29A1EC74-8F4E-45eb-A8AF-93A4D6F6E441}.exeC:\Windows\{29A1EC74-8F4E-45eb-A8AF-93A4D6F6E441}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E870BBA9-C7EF-4228-B114-9BF71E17E43D}.exeC:\Windows\{E870BBA9-C7EF-4228-B114-9BF71E17E43D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C86A27A-62D4-417e-AD05-EA6A95DD3769}.exeC:\Windows\{7C86A27A-62D4-417e-AD05-EA6A95DD3769}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0834596-E7B1-4174-9781-8A121253AC26}.exeC:\Windows\{A0834596-E7B1-4174-9781-8A121253AC26}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{19E07BD3-3B65-4ffd-82B0-AE735053615E}.exeC:\Windows\{19E07BD3-3B65-4ffd-82B0-AE735053615E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0834~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C86A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E870B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29A1E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0257~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20A73~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7533~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8767~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C68B2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B239~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{127E5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD51981c0611cf80538d86099a3596f6b8d
SHA14c1dd4439bcfa981c52c9e3ceac073df4c2489a5
SHA25633cb81fc486ea2df4e7a700d58f41674d8001b3be10c3368780ef5f43112ec2a
SHA512e292ac3636c7eec783999e1ab36290fa0fec1668ea906547120bf75a8110d4ccda6bf9bfed2a4cad87694618e637fbb16e67d27317282b52187faa9bdfffd92b
-
Filesize
192KB
MD59391bcd272edb6eec37e5c6c8dec4404
SHA17f2fb16debbdfcf22d1a723e1760db557da72643
SHA256c93e632531fa18a0b41338fd2ac765d737b8496ba85efacb322c459ee8865a4e
SHA512e876580f026fd1d8ca74ee76b47e604ba37864387521b2f486411af2ccf45feea87a073df7cb83f47659872cbb571f052ba48a3f821b67a28442bb5f8488d3e6
-
Filesize
192KB
MD5531bcc46d72faebea7be975f704c3bc1
SHA15227300d743ff7fdb0e440a93b25af47ea1e7c78
SHA2567e59ebc1653d754fe299f59ee9fdb45267f5c3e74f758da6da8a516b8e51007c
SHA51297904b70417a650107286466cf4f6665e2c0583b12503f4df6998ae55c067568ccea14686373872c13a1c7dc69389d324a8a219749e16dfa7a090893a869f9cf
-
Filesize
192KB
MD536b1149f87a16a88f3f0aeff5d886caf
SHA1c425a2c49ec8c982f932535f0c84ae9c1e540d40
SHA256b6f37e21c1b099543375053e49376fb3fef0fc989cce19eed77fdd5fefbc39cb
SHA5127af5e8c969a44940203c3493369384d6c7e279582ade6d2cd46a8d32b3809a2e23f15c12fd8310bcb30b19c88bc19e57143142204d6f85722787af82eb793dcb
-
Filesize
192KB
MD52f6b9071ba1341b989d8f1d5040de9b1
SHA1ea834049acd16ecb903a5a827179f8bf4f86caef
SHA256a9167800b8822f40dc5b8ed2dcede6169132621f53063a37ddcb4681f7189c9d
SHA51228c18f5e85ca50728495c389c67b380acc1faa5554a14eee64d1b78dcaf2c4c501997d80fbae658ca0617eadc8cd65edad46206d517901b72533dc84c46ec1e0
-
Filesize
192KB
MD55bfdcf43436eb566d9a86503813fb66b
SHA1652e80dfb1603565019723c5bfaafb2ee995b7dc
SHA2566e14baab1e94615c0a92e072917fb6c1d4696af49b5fa2281a7c667afa5a826e
SHA5128f44cc88e2326d21ce6791c727261dc8e5be43f290c8e6eeda5cf398eb256037e810f0f1e04b5fa400f1f8610296874f2511c525a31521051365fc0ac5198f14
-
Filesize
192KB
MD511d581d4d3781fba64b067a4b2fc9eec
SHA191e79e38cf835a347fe4f5a4c8f17424cbbaf193
SHA25690da42cf66a622508d20ba47938a414b8d1bad9c85dc5a01407bd913b3b0bfce
SHA5127e7c82a2f92900b004b8a2fcde5f437568ab39ae9eada6b922cc3840d6d9246a33e9738c9ba661e0145ac833a134a399f5965d6dda8d8b4373b17cbcce058cbc
-
Filesize
192KB
MD5db07774e5617254c9227d149b2a9c403
SHA189edc103ea9d4d762d6198cb03d950f7576eb347
SHA256069b3f76f20cddc7d20b8aa1597cfdad0269f664db1935245f3221119514ea29
SHA5128d979c105828bd82517b264a4e3288c221733e3f718b9b4d593fa6d940c1670acfa9f32d54bd64a02b36d8ce7f6ed1b8e3bcf79457f9b1be53549b0b5a5ad263
-
Filesize
192KB
MD51d89cbba28013496094942762b3ba6d6
SHA117f2cf89365ee19785b5b280c9d6382308ced600
SHA25690e11ff800b0f07d0a941af369900e9811432d175674788fb4a9a245c1c5ea5f
SHA512f09765e887651cb84877a51ce6efd2e355d40a4805c176b5db202afa33fb38d4db87226f29f63a2696e4701e35a1a2467761a74bf912da6b7fefea2687698f53
-
Filesize
192KB
MD5a52b3363e630e470f7e44ed91a779829
SHA102784c3f50a1459c6c8a228e74f128a6c3c4d2b4
SHA25677b028502f1b5611a688459e4842161a0414838a5e1bab99bdcecea7cdb574d2
SHA512f5ee5cc37494965d3a7933c058067929947da4e66a586b95fc8fd52dc9985f547c600319f445fa1309e6d01efee07b0d3967aca20647e489a931ee4ad2e395fb
-
Filesize
192KB
MD51c36340885a58d0911c846b1bd07719a
SHA158ffa66a00a82393f0abe78181aa458d62eca3f8
SHA256b83745c2a73baeee08f12e0214a3c0ce2a4921798448754cc51fa89cc267b19a
SHA51275d032a9a7f4278f58dccfeda478402f685980e8daaa4e4ef370aca582cc940865296713021df55b989d15d46f7a77dc1b88cf237ad07c0cc1054905b9fc63db
-
Filesize
192KB
MD59fdb6045c62cc5aa53367a8f9bd64493
SHA1a1f75283f1d0cb69e805cafc809e41e1fec96d89
SHA256d5bc748196309a247f711277415cfb9dc9ee36d0530449368d84323c36cb8502
SHA51274a0c7f915457c4cda93fd989e09a8a508ad716784f06a539fa47be90108d6b354ccb230db3372143742738296d4e2d633d4e587c5ad012b1e06aadfcf09576e