Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 00:42
General
-
Target
2024-09-30_ddd808378c7c7b1db378b650d25edc47_goldeneye.exe
-
Size
197KB
-
MD5
ddd808378c7c7b1db378b650d25edc47
-
SHA1
f2b91f1f6ece00395709e011970feb19b64d30dd
-
SHA256
f8e494daca1ab4d01943ec71a6a7260253f1e643d2410c3c4b9b4171aa4dfc31
-
SHA512
5d67095e24f24f1a5940e2f40d27b028abb80f58e430528ff1d5f939d351a0153ae57353becfc49058803c6d12c2102412bb4a6910256b4fd4bbf9626ad22e17
-
SSDEEP
3072:jEGh0onl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGxlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_ddd808378c7c7b1db378b650d25edc47_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_ddd808378c7c7b1db378b650d25edc47_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B29E3B7C-D867-42c5-8586-D2F577024BAF}.exeC:\Windows\{B29E3B7C-D867-42c5-8586-D2F577024BAF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E065ED00-2268-484f-B77D-55C24DB6A9FA}.exeC:\Windows\{E065ED00-2268-484f-B77D-55C24DB6A9FA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA7FC3D2-5874-4bff-A10B-A2D56F7B0912}.exeC:\Windows\{CA7FC3D2-5874-4bff-A10B-A2D56F7B0912}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80321CAF-1544-4e78-890C-DEBF9EDF4002}.exeC:\Windows\{80321CAF-1544-4e78-890C-DEBF9EDF4002}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA196D60-D441-4c30-8494-65AF61848F78}.exeC:\Windows\{EA196D60-D441-4c30-8494-65AF61848F78}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE4BBDCD-7142-4bc5-80C9-5219FE26CE26}.exeC:\Windows\{DE4BBDCD-7142-4bc5-80C9-5219FE26CE26}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84C1DE6F-E9F3-43fd-9423-E8CDA2936A09}.exeC:\Windows\{84C1DE6F-E9F3-43fd-9423-E8CDA2936A09}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2D017DB-16F5-4086-8885-73ADBF80B3B5}.exeC:\Windows\{B2D017DB-16F5-4086-8885-73ADBF80B3B5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3299900-A420-445a-BC77-CB308A34E2DC}.exeC:\Windows\{A3299900-A420-445a-BC77-CB308A34E2DC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DC93280-657E-43a8-926F-30DCBFE4E02D}.exeC:\Windows\{6DC93280-657E-43a8-926F-30DCBFE4E02D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E029DA3B-1937-4554-9382-DAE7CD8CF176}.exeC:\Windows\{E029DA3B-1937-4554-9382-DAE7CD8CF176}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2BB31F42-5439-4f13-9D44-BB6CEB9D64C0}.exeC:\Windows\{2BB31F42-5439-4f13-9D44-BB6CEB9D64C0}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E029D~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DC93~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3299~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2D01~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84C1D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE4BB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA196~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80321~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA7FC~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E065E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B29E3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5bf9ae7d22b181874ea05723db481bbc7
SHA17eedad87dd0dd63bdc9d2a1aca350453023f94a3
SHA256a89aac523313d26bffc070fc27d333053506954c370a6456a27ec7700ce02a78
SHA5129174486b10d4115340cc61f55da2ee4ddda339df47307de6318ea1fe39c4b00f64b1962faa1def32621f8ffeb1b9fcfab61a31d51ea1c890869d6fec335827bb
-
Filesize
197KB
MD57afb1a52ef25982d69a2a8bd98b37079
SHA1fce53420ff0a7d698b972bd9e9a47d1e596ba59e
SHA256072a0f73afc21a9a78c3da022c87bbf9cf5e945de60f30c5970021a9c5aa3f96
SHA5124c1519b78e284a9edc18712e2c1a53e2fa9676261785ef9a644a7152c04f44f8d86ed9e0812fc8b8ca1b42e620ead059730065dd6eb0e567b94f8a6b20434a12
-
Filesize
197KB
MD56ba6553b961ccef5589c1120ac8966ae
SHA1bd2ae972d4a8b68591f019f30872daa53b27bc87
SHA256231c7ff01b69216f8363d14dd2308b2fa9857086449458e7d44d2400a1891985
SHA5123446c8392438c32a27953a26e7bf69598306d996c4305a584aac633311d317def4b98392b1bdb898b636ab1575bb44e42d166961433256d909665a78cfbd54fe
-
Filesize
197KB
MD53e7059c19c5f5e509fe68e6284b18acf
SHA1615f1622c0125be946e0b0f8581e531fdb9436ce
SHA256ac70dcb61c58fd6ec639e942a564b14863086fce2a5e87c7caf74d440424b8f6
SHA51278a86897972e74d4fd2d1f4e87115f9f5b19ba65a6e4bc9ef4c85d4665a0c1eea2db3aa6237243b3d3a28e7f1769504c366fe1b123b467b386c747b957579599
-
Filesize
197KB
MD55a77f56eed423570c0ac9999d056a089
SHA1a7243bbef2426764b6633319d607cf70923b3aba
SHA256f54dead122cf2407de21b8d57a41fe6e5260133f6fc48b475f1f68acc694e94d
SHA5123ea1048192c4d6fe2b4ad6db338ea6742db3eb144287018667ad72cf4723199d74371d825a82bbc2911c7d579909cbb84870a773cc9167e806765faee33cbd25
-
Filesize
197KB
MD53941bac94b3b5161150bcd520d549b0f
SHA1081c33223902b7a646160e89ac77a2a55d511f26
SHA2569e7def7793ca081f5f4144c24a147a6a47b63daae0933ba3f21b5cb71ca1cda6
SHA5123463987a374c161213d835dae478db36ce76e62a4fd97227e365b133e7f1ca10abe05936cbe8af17ec420a4bfe14ef1570a74518716830d8d03eb9597c52780d
-
Filesize
197KB
MD58e9310e22feff76457aa3bf527d0ea8f
SHA155e9bb1e4153b5502bb7e094feb962ad51eac421
SHA256a7d5aa0eb4e18c7bf967574d8e09c624d3bb4eee8486105ca8d895007c9ba46a
SHA512d69f3d7a9bca70ea99cc740019068e81bb8928f56a540c44e2fe613f33b8bff8be04d4b148ecc51613a95f53ee54557530133214f32b78cc1b98872623dc3526
-
Filesize
197KB
MD5b78ac2413e2fe31a2482e6d3b494b681
SHA19e8625fb662449f271d6b6aa1a98f939db6a64c5
SHA256094044dac04cdfa48545d6f0be2a7952e5de8adf356a18d51ee0a0a69b9e36fd
SHA51292a392bf0a0aed6305c406eed57db8940157fbbe18488245b16a4f749fe0306611074cae1c30f5a19bd6aa4ce4fe76a2aed6ff22f554ddde80ee2322f268892c
-
Filesize
197KB
MD559da829d37a0a54bf17c8d52cd7863e2
SHA1414bb4ff653417552f41e313574f070336851c7d
SHA25603846aa30b3dd33a4a7d28809416b3ec12be586eb839e33a41a304c30bd43aa0
SHA5124ad40a5d1e415df02648518c59e18d7590888a6cebfb51f4884d64b24bb4533666ce7872a8190570b74ad045e40024941ae6d8905b214aea6d555b3b1480a95f
-
Filesize
197KB
MD5ab8b1e3835cc70519c3c3cd2031aaf29
SHA19e63bd9d8e08f34068e9949730a3900a96227b04
SHA256f6d2be3e5239915193ac0de454e44deec90c885fd70316a7426759c176c311a7
SHA51223f01d40ac091f5705ec5b76a380e5d43a844d1357f1ca94fda8a35a434388a03d52064657aa8c76d8995b5e90a41fe94f23432446ab597fed009de0b09e0e5f
-
Filesize
197KB
MD502f516241761e3fb94b5a1f34e706c33
SHA148875f5b1d33bc40d201fa207bad4f0fc2a1e993
SHA256dd4cee10293cd6b1a2aee99a44537c84ef3347332ad798d065c2ec4c678ec702
SHA512766fa0ea20046692682724b5a0d3b5a3b8fb73d1f224258f0b551b9611bb8772d8e65188045eb0c356d033c9bd078f9619a33c40e8ff7fd50bb4a7c778e28d11
-
Filesize
197KB
MD51ee5d27ccd79f192604f6f28e4fc9070
SHA1e16adde7d7b4aae4fa4bedf8210cbd893287e0f1
SHA2567c5cad8e090f2b09c17653d7ba67fc5b1edd2029f614ca1db0920afbad037eb8
SHA51278ae7e84e2832def6a270eba78dc408eb5d869bd07a76ebf2cd31f72cbe7c03dad5a18e0932b71f99cd83189425a50ef572c59678385ef74b6916682d5dcff97