Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 10:49
General
-
Target
2024-09-30_24315375ec2c41a61116330a3016c1b6_goldeneye.exe
-
Size
180KB
-
MD5
24315375ec2c41a61116330a3016c1b6
-
SHA1
a450e29f6db727c4dd7e3c8d2ae62b024181ff17
-
SHA256
f1db3555becf04c219b9786b130a31e1c05f3ff28e1de0b0f80c7e11ff96d32b
-
SHA512
7ad427f5b6df229fea88f4b39584e82e61c753500813e831b72fc5ba5945c177d074f4c004aa3e92f0fbeaf6836a846b557e9fa79691f10201c76af11c2b97e7
-
SSDEEP
3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGRl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_24315375ec2c41a61116330a3016c1b6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_24315375ec2c41a61116330a3016c1b6_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BD288BD-AA0A-4fc7-8BAC-73E445B7D9F4}.exeC:\Windows\{7BD288BD-AA0A-4fc7-8BAC-73E445B7D9F4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAAAC829-D6FB-4112-A546-A94BE6BA170D}.exeC:\Windows\{BAAAC829-D6FB-4112-A546-A94BE6BA170D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D7E3C5D4-3CEB-4236-AD12-B6CB033FFE91}.exeC:\Windows\{D7E3C5D4-3CEB-4236-AD12-B6CB033FFE91}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DDEF084-96A3-4a64-A079-194C72DA94A6}.exeC:\Windows\{2DDEF084-96A3-4a64-A079-194C72DA94A6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04B180A1-3CDF-41a6-9B85-F435D51D35B8}.exeC:\Windows\{04B180A1-3CDF-41a6-9B85-F435D51D35B8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B487E6C6-2B67-4487-ABD2-7D9ED0C3DC20}.exeC:\Windows\{B487E6C6-2B67-4487-ABD2-7D9ED0C3DC20}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABE218BA-95E6-4779-A6D1-8ED9A302D6C5}.exeC:\Windows\{ABE218BA-95E6-4779-A6D1-8ED9A302D6C5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{942D13F0-35D1-4519-B020-9C98EB061022}.exeC:\Windows\{942D13F0-35D1-4519-B020-9C98EB061022}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99E17493-FC4D-4af9-9B01-034735344C30}.exeC:\Windows\{99E17493-FC4D-4af9-9B01-034735344C30}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9854C2F8-57BB-4455-9EF7-4D3A4F950C8F}.exeC:\Windows\{9854C2F8-57BB-4455-9EF7-4D3A4F950C8F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B58092F-FB7F-4f50-866C-A80ACC1433B2}.exeC:\Windows\{8B58092F-FB7F-4f50-866C-A80ACC1433B2}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4AA60668-AA6B-46f1-8291-774809C68BEE}.exeC:\Windows\{4AA60668-AA6B-46f1-8291-774809C68BEE}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B580~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9854C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99E17~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{942D1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABE21~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B487E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04B18~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DDEF~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7E3C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAAAC~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BD28~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD563377823c05e4c8bcedadfacb3ae7293
SHA11e254becf796a4e3faf842d8cbc3856b6daf82a3
SHA25681448c986c0f72e63db26493a4dddac39ba5be16d441a405ad34301edcfd0f1d
SHA5128a0f9eed4225c6b8d729f6c85d6600f9ea81d2abaac57a1b187bf33da71ecb2bb41560eea3c6306340d700a9b3140b554e8aace92de4f19549bd629892f28b4c
-
Filesize
180KB
MD54a15bbca8ed14850cc44691141c31675
SHA1736f6e468f3fbcd46da477b5f2ba51032f300ed0
SHA256cd092e874b7b5d694def7d04939a2acfd43526e6d021fd5cf00891986dea5655
SHA512835575486905ddf0f25bd0a6c43824d8152b12b327039f27e36793e536d0fc72023c1af17f5b74dbb9533fe14241cefaf9acda90bf0fa74084b6239c32e37501
-
Filesize
180KB
MD5dc43076cfae24d8e0d02073c2b1ab1fc
SHA1422ab9c1c77071a59b10e952d9c6084e9d7cfbb3
SHA25619912dca04f94653ec61175208237822ceb917c327e5195e001e16ce36d33bcf
SHA5122872a16b6c0c87a81a3959b197b8cf8cbaf52c470588de9cb5cd117336108040abc2d39945b937afbdfdee6c3c97840ad38655d15e59701204c44bf92a1ecd09
-
Filesize
180KB
MD57de39595933e943a3020a48b28226805
SHA157844cd7a07a737490359119b5fc3067158da768
SHA256f8fe7308cb80e8f84099b1bbb55681d649ec5a0dd0afbc832afe50243101d87e
SHA5122e096676a6698e21e55d71abd45b3aa89a9f2a173fcda0f7279fe4e3e44c01908d9a53d0995cb70a6cde8796b4d7eb565d4cab62a90aac57f35a3321b91c3f1d
-
Filesize
180KB
MD5b9eaf375e1a45ae185e6935cb1c8f811
SHA1577eebb72a2b6418fffba5f72d33101873c81c7b
SHA25637bf2db163fcc00e1f42ab5b71cdbdcff36bc7192e90b8fa422a53cb90571a27
SHA512c6feab2145f485c8bce765988d364b9e3db724a494abf96b3aa2e983ebc22d751813032b2830189c31c110fee710448b48e7e8a7c1a691b175d36d39c310225f
-
Filesize
180KB
MD511dd5cc4bc2f173ac5c5f09f33e72000
SHA127e96b613719c755998550dc715b2226fed20c1f
SHA2566eb1550f815bc249c4e19fdc6d33817f7bc92956852acebe7697c7ff13a4ea20
SHA512cbe064b067a56d5baa981c8eb70387c1e1082b4aab46907e66bcb0c007c1532db88517beef7e9707bc733388a49c12787c31c31a5e6d1ae528ce17949ab1a2dc
-
Filesize
180KB
MD55a669e99b1325e35eae76b59c24db9eb
SHA162cda2f569c6e1640cc7511fbb8d9c7ed56b68ad
SHA256d85761b0ac45d2491a50d0bb15b2c7ca287ac0a2cec1726604f0da49de7e5519
SHA512d23110bf9846774c8008a6a37ea86fec094450135e637065d0fa6e5382a41d0bc9c82fd263ed5bd0d2158e2f7200cea854cdcb4b48c7b27147f75bdaa965ffa9
-
Filesize
180KB
MD54124ae735c38f6243a8eee9e237307de
SHA1cb83e7f35a10c8dd1d399cef2b81faf759d32ea7
SHA2569881667432d2ef372a4412b76867c1d3fd4bbeacadeab15c328a55d88593c245
SHA5127820891cbb96b25c62ff9ad9dc517588a69a0764343ba3b4b8ae9286daf7edb3e1b8c17ad33c41ee5c4f43883e86889beee284d99cab84ccb94b20310dfdeb87
-
Filesize
180KB
MD5e162de9e6862b06d48e1c1682594cc1f
SHA1663981a57e6d4d1054a661eee5247fdad29eb4c3
SHA256fc0c3bc52e801929e6dba9433cc767c3049c7bf156a1c09e1d2baaa26d6d2a06
SHA5129f06f41ab6afd996e974aa1d37e339e4970230de7e6bdf6b822fe558e38dd0550826666478f13f624f769022841de7f44b6b1a47ed45c74849ee419ce033310f
-
Filesize
180KB
MD5d4d99571d719150c7fcf059cf9daa09c
SHA1830b42d8f49437ebaaaa54f93604c45b2460782d
SHA2561600c1421d4c888921be7f31b2b41dbefd0737c5631d534843ac2e29b288e10b
SHA51280d479467aeaac638399cbe787450c4ff6e3ec372fb097b2263228013cff45e11a500c58b961dae826b6a98902806377c344e9b337ce5d3f6d353b09257e5e33
-
Filesize
180KB
MD5cb23e4991206cfbdd9140849ed494fde
SHA1023c0a0e0e4c71420ed62be536fda17080bfdac6
SHA256f4e56247c0dee73ba3f982612abab4df17d5cbf06b1eee403455efb539f01df6
SHA51225ca7beb9474fdd5eab423b536ff77556f9a31bb12c6befd8c67153210822bb5275ab68aea033be052c434fe81fdfcafd5ac3f4d54aa067f1c0722116c679bbe
-
Filesize
180KB
MD5b209df2697ba91bcbf7713b326bf4740
SHA172e4e75412b861063b54bd3a8ccc92c60eafba64
SHA256a7ccf031c48f23bd5870e2b553f2ce7ada2cc1d162d734795f6385a7e78200ba
SHA512c242f98cd7864221adc89e042a904f61b14105a0e81048a4583ba05b4e3d0821aeeebce1b58d9e00337490eae2f7b48ee356d771ed3536af2e363a94359053ae