Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30/09/2024, 21:11
General
-
Target
2024-09-30_a768c808833bae094b2f9070cd39b37a_goldeneye.exe
-
Size
372KB
-
MD5
a768c808833bae094b2f9070cd39b37a
-
SHA1
da55e05a06cd634f2e993abcb585a485cf416c6f
-
SHA256
8188f513079255958f65e17cb59c49f8b3ef878e99c4ba87b13005367eb34429
-
SHA512
ab15c62476df0f682e78afeca3516515e0f7940a9cf77ed467e0498e5132ee8154db7002323d26b9d1d83718f946edcfd901dd2777c9b335bf93908caa9225c0
-
SSDEEP
3072:CEGh0oClMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG0lkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_a768c808833bae094b2f9070cd39b37a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_a768c808833bae094b2f9070cd39b37a_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1018D4F-1A50-4b21-9A5F-A25E6103F0A2}.exeC:\Windows\{D1018D4F-1A50-4b21-9A5F-A25E6103F0A2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3490C12A-4390-462b-BC23-77BA79FCCF34}.exeC:\Windows\{3490C12A-4390-462b-BC23-77BA79FCCF34}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87875BF2-254D-4fa1-8C6C-F4F993827B57}.exeC:\Windows\{87875BF2-254D-4fa1-8C6C-F4F993827B57}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{391F1964-8F4A-448a-87A1-FEE00128A303}.exeC:\Windows\{391F1964-8F4A-448a-87A1-FEE00128A303}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E99F4ADC-0376-4916-92CD-7B26378C6969}.exeC:\Windows\{E99F4ADC-0376-4916-92CD-7B26378C6969}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A405563B-F229-43fd-8BE3-C16BA30D073B}.exeC:\Windows\{A405563B-F229-43fd-8BE3-C16BA30D073B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7F474E2-B81D-407d-AAC9-F131D6F15479}.exeC:\Windows\{A7F474E2-B81D-407d-AAC9-F131D6F15479}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93609006-8D06-4ad8-8FCF-4723AB1E62A8}.exeC:\Windows\{93609006-8D06-4ad8-8FCF-4723AB1E62A8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37EE5BAE-D4C2-45d8-9E03-EBFA6AD0EA7F}.exeC:\Windows\{37EE5BAE-D4C2-45d8-9E03-EBFA6AD0EA7F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BED6190A-FAC1-4e96-9829-05A46616E5E5}.exeC:\Windows\{BED6190A-FAC1-4e96-9829-05A46616E5E5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A367109-EB05-4820-975E-BC89F833590D}.exeC:\Windows\{7A367109-EB05-4820-975E-BC89F833590D}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9F8645BE-C509-4187-9B3D-F444E9231FB3}.exeC:\Windows\{9F8645BE-C509-4187-9B3D-F444E9231FB3}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A367~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BED61~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37EE5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93609~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7F47~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4055~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E99F4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{391F1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87875~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3490C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1018~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD57de30d543731d5b43e24b7a0f74c12dd
SHA1065c77c01dc42238706e35899154bbdf93a3e60f
SHA256902d312979bdfca19a3ee986abcfa22f3fb8565acc5fefa541fd64f5e14344d1
SHA512deb7036361de6b2bf52bc35599c9012c84797aa1c3d55917e1902b80106af50432ca86a80f3f9d1c426d1e0982b1307df547b6a7a70d47ba850adddbdd86f865
-
Filesize
372KB
MD52541d14ba176a9e4098ca0a26cec27c5
SHA109df168aa2d3d0c0770e9287ef2af10b952f6e6e
SHA2562a869902e5c51efd4f38e00982ddb8c6a9967b57d4bfce5c5b7c75abb73a3def
SHA512151c0e245305c38b97396fa6b639a200a2877020469fe2892259773c9745728ef44763266c3e7d8a2a6cc2f075e9a4ff3b4fe045c5176bbd027a9f3ce43e1f98
-
Filesize
372KB
MD56a4201e33f5ae585be3c93dfe3e5585f
SHA1cb549dfd5c0efd279bfcabe5565e7d7275a57642
SHA256a82a86c7d71612dac5c39a3207fdc36c20686aa4825a0cfd0af9cc3846bb7b8d
SHA512efec7176fd32926166015aa267788da18396ec9b5cbc21f9b0987b3d0bf48fe68920138ce56e4cca24c7fa26ba8c0940232031680391d7db526accb20bc451b9
-
Filesize
372KB
MD523e8b4c4398f7066078fb074283985f7
SHA146c26e29c5542325c8b96d3130328d4554008de1
SHA2561edbbfbeb0a9b4e9547502a3552a4efe722c415e839d9c2dbd122c1ae0527a44
SHA512e29411417a46a1f4047fe59b745dc89c3041fd12da5bb9b3701cc1ad9e54b709836d97483c8e5b80b81c095dd0a1409b697dccbb9ff125a17a9a3096f7c0a50e
-
Filesize
372KB
MD52d5271fae66521cc540d86733e7fada3
SHA1b34060f7122c42c9c990f37d0c90f3aa998341cd
SHA25642447178007b3930f7773b02c3f695cd8bd12d10708325a749decc29347fcf5d
SHA5120d9a20314ecdf135300fb51e142829cfccf8c1c477c7d05ed8801b7d4a3444d0bd84012bae927edd016532cf7c796afea5dfae8f27fe07a9918b4296c9cfff15
-
Filesize
372KB
MD585e4077481bd997321152aa5da33ee9f
SHA14a160130bf278bb7a77a831cf3a5ae46d0da5b6d
SHA25653d6361ba305626f43c4ff9a23b0d91414008d44c93e913e95cfdd80616c0f25
SHA5129b446b5c94025598bdf6e11e2e41bf335b7fe2961c378147257d9a7639b2aff478418ffc9ca78b359df9ddd193e543aef7f9946f33ab5b3a11911e7a5b82c105
-
Filesize
372KB
MD55c94da93137d19b69f32376968ea789d
SHA135045c59210432d961b3e7ae708aae6d3c63a775
SHA2561be24a5d6134459d0b202146e9ad82dcc66afa77838f4274679ba56a85ceccb9
SHA512ab1387212f4b62f127cf50b76c2360dbf25241b9e05ebd64947e31d4adc4420b320c8e01fb140534d874dbee34db237987958422f1a501d27cf03cada643e60b
-
Filesize
372KB
MD58edbd39b6561507cb71637ad1c30612a
SHA1174c104b380de3bd0484f68d931602a063824b5a
SHA2568c245cf42b2d552eac29603e1e39620a51785dd3ba2c1ab93dd71bb09e173dc3
SHA512171c0034afabbdcd36c0030bbb141d1ff753b8f8d8290ae662f170a22dcb0fd58ca91ec3311357e6bf5050fce28bfb17a110e16ee26297486c8c5879ebe257ff
-
Filesize
372KB
MD57401a7821a96d8b9867483914a881c4e
SHA1fd1ca73d2dd07e2d42c472cf1d27213de20c4404
SHA2565488721df9e1334ba636f02c579f697c5b20cc7b2231ec40e1ff7f9a0ac7ab52
SHA5123bf7ff0e57db3cc1944817e19daff721605cc0b30d8125d972e9c66b61de346bd8ba0cbf555f4471f813638b0d2cdf2f774647b1169dc54d0f36665e628df899
-
Filesize
372KB
MD52074ddc273a30e89497e0f4bfc6c643a
SHA1730dde87ff5c57c6c63e18c81dab9415fde7d5db
SHA2566642350eb82869e39610a19a83582838eb511d895dc14fd87564dd6c21124cfb
SHA5123ca53d7068276c12637e5d55a51b7b9d5741872f9b3319c588aefb221145c1a7a78c4bd6fa375f82dc1934269b73da63287b5db8df1539a0cd569b1593f4e3df
-
Filesize
372KB
MD533485f998da821e1d98b262cc586f8f3
SHA180647c9b9d6289858323d890a80880a3e714f43c
SHA256c5852968de986de2c0a1a603ba6786609e3053bfc5d91342a7f8f12e04e001fa
SHA512853762f955db03f15b8c54e8c58e4d3c2420ad555aac197b0d58eea8d499853f6b05ae123a5f8aa77dc1d4b01f0a617f2248e9aac658f3263f8cf51d29d25ffd
-
Filesize
372KB
MD505109586b8fa93cb1939ba1863aab011
SHA14ea9fc127f1429ec408272f0313835bc59d16d61
SHA2569e99287844d0cf8202cb6f6082b036d4db8b5c4243900892cdb369aedd0f80f0
SHA512839f8b4aba05b13279c0b200d2ad2be5940fe96e32846e8a9b45bc1c52c1de7d1eae396d6f83b3ad4eece70268248fdf7ab2d50fead1feb057410be346e90f3d