Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30/09/2024, 21:09
General
-
Target
2024-09-30_89c431d79273e416067e424e07d41278_goldeneye.exe
-
Size
192KB
-
MD5
89c431d79273e416067e424e07d41278
-
SHA1
1d2d6e85d73ca85178b97e247c0748d5ddb944da
-
SHA256
cbda0c3ad9a69e4bdca46a720daca2a72e0dc8f10283bfe11f220297fdb9c88c
-
SHA512
920e131c10edaeb9c280aa1b06420b989b325a0d98a1e8028768be5f961f3e2601a054c1bee89eace04fcb945b5490f1d650be179be9527a3dd4f83da4aee345
-
SSDEEP
1536:1EGh0oNZl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oNZl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_89c431d79273e416067e424e07d41278_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_89c431d79273e416067e424e07d41278_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07283493-B7FF-4376-9900-12EFA17D9255}.exeC:\Windows\{07283493-B7FF-4376-9900-12EFA17D9255}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{200F743E-782E-41e6-8F01-1FD87C92D865}.exeC:\Windows\{200F743E-782E-41e6-8F01-1FD87C92D865}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5429E23-AC46-49b8-942D-355C03E0EF77}.exeC:\Windows\{B5429E23-AC46-49b8-942D-355C03E0EF77}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EB624EC-1EAC-4a4a-97B2-51287B3E42C4}.exeC:\Windows\{5EB624EC-1EAC-4a4a-97B2-51287B3E42C4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64F2257A-A410-4b24-BBCC-BF74DE25E15D}.exeC:\Windows\{64F2257A-A410-4b24-BBCC-BF74DE25E15D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3606896C-8425-4cb8-B9D4-0D1C76A77EAD}.exeC:\Windows\{3606896C-8425-4cb8-B9D4-0D1C76A77EAD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65B3AC1E-5E6A-4090-95AB-412D38525552}.exeC:\Windows\{65B3AC1E-5E6A-4090-95AB-412D38525552}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5230F970-0658-4042-B8D5-F0C4F84C55C3}.exeC:\Windows\{5230F970-0658-4042-B8D5-F0C4F84C55C3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC0E6A26-07FB-48de-8EAF-2960A9D00549}.exeC:\Windows\{EC0E6A26-07FB-48de-8EAF-2960A9D00549}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12D63119-E639-4a43-8B6F-0FE5281D039F}.exeC:\Windows\{12D63119-E639-4a43-8B6F-0FE5281D039F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75299028-2668-4ff8-A05B-2F8DD6AE1CAF}.exeC:\Windows\{75299028-2668-4ff8-A05B-2F8DD6AE1CAF}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9F728DBA-523C-4496-906E-480C885B9899}.exeC:\Windows\{9F728DBA-523C-4496-906E-480C885B9899}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75299~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12D63~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC0E6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5230F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65B3A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36068~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64F22~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EB62~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5429~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{200F7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07283~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD54a93ab78ccbc49f480c7d222289a287c
SHA152f9382f1db5edbcf98b80f34b12c3385a9ea772
SHA25615b2685297d46f06721692555ff9c20d22686ff42899ae3e1eb0e46bcff3abf4
SHA512a67771ee2d10667b2b1cbcd4e9f9d319dddcdfb80a9cbb1e6015cf81abb48aec27d1984357276820699fd99a3660845e103c4f4d419483e3f8b61111c6dd0cc8
-
Filesize
192KB
MD5d0a8c4b023bb95d6fadf18efcc7a7481
SHA17b5f1ea0435bc2a87715751f3945e2831fbce938
SHA2566e300ebd08fdc42d4bb4b0b29a1041cb6a463dee9f88e9799780ba01421663b3
SHA512c717ae98a37eba6b746b4687ddaea8027e928c03f9cc5df56e5b1060944d8f06536c0f6e3cf9bae0f26feb7f547d0059c2ba436839dec858dda81fa3fa8fa66d
-
Filesize
192KB
MD5bfffc6ea06a6669fa89ed4186ff04768
SHA1cacf8ff8f4002d43a49834c8ab032fd943ae4d8c
SHA2562d2e6f21d63322b615c5f0899d07ff7791118dbf1fbca40ac8c4d53ddb392ce3
SHA512b3d0987c4ff8cfee7322d81c06e556ed1059b69483090e5131768cf0de67bfa7045d52ca1169b9c66ada87341973584f0c672fbd7a0b4705414d5cfa6a55a3c0
-
Filesize
192KB
MD56f37d0e7078bc81051d8f4239bc35b35
SHA190c82de7f83a51faa2e52768f13fd347d42e9d04
SHA25657d70ce7e9535a0e02bee2f0c73055661123df344c3108c2a99532a2ae96d432
SHA512dda1e65507ae660d0fe8686b8173932d9733ca95e7a5e7cb20187e8d0cee1c1d8b7e3ee6aed0e0dfdbfd8aa75ef94d88d789a9d3b93a42b4454f9e49bf4e16d6
-
Filesize
192KB
MD55af88f3763a77051d2c460433cbb7e97
SHA185b9b036b9c1de4d6103d6ecd5cbd8d0d4025749
SHA256b873f029e6367cbfb2627b6c834d4bb08a9b4c4db10556cfc96f82b72663dcc2
SHA51269775480e19218e5acd5edbd2a22883d34c3b2ec71829791959001da6e10938f61e60c75b7e5b667e3261a161b9886fe87a733b2d99c67fee1a16915d9bb7165
-
Filesize
192KB
MD534b7a73fbc61eb70351b242fa3d1ef95
SHA149f9bb3ad93ac541945ba15268389ba0370bafd5
SHA25642f3827a773a0cd681a62cd893661a95ca550b84e0d97239fe75b222296300ad
SHA5126b422d8596b1b148f782fa4ae2086d0b0c501f4f2c90e5c0443642456ea28bf21da0ce683243595aa6ea986553e8df75d9577e136132708ea35c69f03a14b3e8
-
Filesize
192KB
MD53d03258d28abb7ec55bc2e0e4b81ef8b
SHA180e0fd8455b1ccb27e5b5865be204c8081c3da1c
SHA256325264b1052dc49bc5a234d42c0039991aa2159d6df46ed0b1eb703784f117ab
SHA512f08f08821126ed791c08120d603d2bd6f79bef363a07db0f48b55776def189b31808cc8f8a2b90555c1243ef5b7a8d335de15ab99f0c1efc756c707d9047ef0c
-
Filesize
192KB
MD5a2d6ef48b61f26b3f680b41fb08b6963
SHA11c7a7eb547689cf9c944207c7eaf4722aa1527ab
SHA25622f7c8a8d89dd49e761e745344ece9412e5450bfc70d4a433feed270bc7e7eee
SHA512e469aa823d885a369f9d72d8f47339d6adc35bdaadfebf4586bf187fb6015f7dde860ed77e54d301ce001dc13afdd44b14014e7a5cd4917a7bf116368600fd26
-
Filesize
192KB
MD55ed876bc670c8dd3b44e65518bd32592
SHA193e7fe20d8352b198783b21a7d7bd5b3dcda24e5
SHA256ddacd8c253631dfc0eb7023bcea6652e4ba2808e82a636f15885a40aa2019562
SHA512f264df612bfe3904a5f95a467944d8f73dd03aa03360176d21b01ba686515aaae2f2b1c580f84cc931e4dbe1e15442ca3b2b690cdcff6c48c842bf088d0c2100
-
Filesize
192KB
MD5e5be61511a51f6d7c811309d93109ffb
SHA17fed3ec71fda50a280c6ec7e104274ff3635406f
SHA2560d5d8571121b4cf80aa107f99c7add3622bd6471589dba4f184284f2d6631a0a
SHA51202261535a2d110528c4b138900480b05594704f8a6e0b09c98b23370f942072b635262175403abb77febb017f3d0fb495eac29d0db51f639cdd61a762e533b2e
-
Filesize
192KB
MD54c558b17db8739f1b8b6ec7824474147
SHA1a38d0b7cd1d9d8899f3d554159b81e68b16bc8a1
SHA256b2c984206bab1682ce52475020eb8ece73629f4a3e291c52d838406f053b2393
SHA512c5990b11b4b7e6b978bb0a1a38e532865a6deba42f650a09fad725afc730b9035e2a8a5252603cea795e85bed111e44337e1e63b74b6a66dc776e7878be19b73
-
Filesize
192KB
MD553c09fe34e77da66119b551f63adb884
SHA1226736da7897dae2870bd4a4c9aed510b85b5b81
SHA256ebf36b9c035d97fe7b8276036473d9af46e56c3480fb3c76e1b765dc660659f7
SHA5128f7f63b6fe5f1ffdae5e099b701e97778b08f1d2c806e2e8897251b59f1269eff6fd9dbf5dd3726d200c7260b8839d973d42bc4fbad238ec6ce8eec565b62abb