Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 06:42
General
-
Target
2024-10-01_9c58e6dba6d5d84fbee4de76a148fd75_goldeneye.exe
-
Size
344KB
-
MD5
9c58e6dba6d5d84fbee4de76a148fd75
-
SHA1
95d7c9fa7b83bc2c3de4487d38b00e7e19b627ff
-
SHA256
00fe4248c5bdbb51040ddd08e6c523857c9df2d992a29a4367b53c40d75787fb
-
SHA512
4cc1a89032d9da8ae2d02cd64d6d2963709b6522e08b9591d2099e23e5d3cee962459959d558672891568afe0034a59670e100a0b16193abcb3bbe83f8b27c38
-
SSDEEP
3072:mEGh0oalEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGQlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_9c58e6dba6d5d84fbee4de76a148fd75_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_9c58e6dba6d5d84fbee4de76a148fd75_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9770E664-CF02-4112-A214-3696F00E30CB}.exeC:\Windows\{9770E664-CF02-4112-A214-3696F00E30CB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{589C5344-FB9A-4c1d-B411-C21BC895B83E}.exeC:\Windows\{589C5344-FB9A-4c1d-B411-C21BC895B83E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18FF0ECA-8691-4822-B76E-BED363D60D61}.exeC:\Windows\{18FF0ECA-8691-4822-B76E-BED363D60D61}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0563E4B6-6B5E-4f8d-A1EC-D2D53905CDE3}.exeC:\Windows\{0563E4B6-6B5E-4f8d-A1EC-D2D53905CDE3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C257E3A9-45B7-4ea6-B8ED-DD7704A580DB}.exeC:\Windows\{C257E3A9-45B7-4ea6-B8ED-DD7704A580DB}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C615CA90-7624-4c38-B64A-20CC2358DD23}.exeC:\Windows\{C615CA90-7624-4c38-B64A-20CC2358DD23}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28711B28-5BB7-43d9-B8F1-4A9B02AEC6A6}.exeC:\Windows\{28711B28-5BB7-43d9-B8F1-4A9B02AEC6A6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D316E67-72C9-467e-AE52-EF2D49CBB228}.exeC:\Windows\{2D316E67-72C9-467e-AE52-EF2D49CBB228}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0371390A-92AE-45d1-869E-BB89657E3C81}.exeC:\Windows\{0371390A-92AE-45d1-869E-BB89657E3C81}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44FE2BEC-7DB8-476f-9418-CECB3279F353}.exeC:\Windows\{44FE2BEC-7DB8-476f-9418-CECB3279F353}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65EFF8D5-D089-4e56-9AE4-332BFE9F0BBF}.exeC:\Windows\{65EFF8D5-D089-4e56-9AE4-332BFE9F0BBF}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{7E786C4A-F165-4ae6-94D7-C8D9F1CC0237}.exeC:\Windows\{7E786C4A-F165-4ae6-94D7-C8D9F1CC0237}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65EFF~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44FE2~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03713~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D316~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28711~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C615C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C257E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0563E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18FF0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{589C5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9770E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD52a2779c18a06f866269722f39cf5baea
SHA160546498fa53d01993880112a2a442ebc6a97489
SHA256779158b8f2f3e62f38c91f12b6f409b9255f64a35e5fb3bdbccecf562f479ef0
SHA5126f1f51d1c6c32d3fcf318f3220c09cb9ebb311706b773af26a93d618d5ef2a08279700baa7c83bc311df67136a970bd2ea831469cad7c0ceecf98b3d0a965448
-
Filesize
344KB
MD5324f23fff117a15407c38e3fbf01558a
SHA1933128ff247d93338313744447847a50edd7014c
SHA256d24fb975fe53fa64b41f71246fc5ccf39fc38c3806f9f0d58a2c6e9ade5ed7d1
SHA512a887111d113deab5e09d5a5531dd97d564c5afb20a0fa813ec7b1e35bf83823949050712e114acba911ffae420816deaa650818150274195be118211db12a081
-
Filesize
344KB
MD51cfc35914d6336499b172f4dacc8a39b
SHA122c8c62eafe16b8dcd390bebcb318ba5868f2c1e
SHA2568d4de928f7494a5631d015cfe47123a676da5a6665d6066c2fe9c046b0ca4d92
SHA51210a94ccc21a9608eafef8ee2e10261f2e5762a9ee1eda6cf664747cd7e2acbfabe11ef6e65851d090a4cbb288276bb7c24da002979b099122ea61bc4e3779644
-
Filesize
344KB
MD57b414101ce071cd0a631b5d43f7f5db9
SHA1cebb4c1127896955fff477b79565822783e6e970
SHA256e8e18a2a7d6b5547d2aeded99f0c3569125dc04f3af505dd80ba749357bbdc09
SHA512f6ee04611760f97afa9753f8eecda0cb787a6f22295d6f573677f8079ee6a07d269b6c6e8646133bd35a43d30ca76e56381722f20cee56f2eb65eb978ef54157
-
Filesize
344KB
MD594070f08ff4dde71f3e32b85c5cd19f6
SHA16a1150907387e8872eb7f981a96a158076842838
SHA256dc39bc022e50d972f43912efe90ae1728f73fd5356ee2bf678ecafd74d8bd9c2
SHA512ff622b36fc82c6cc8ec2c40a38dab8329e7dcfd56dc0ab7e5177b435b4ba0acfc31b5301aba1c5a776c370c3c1f1b847ea7ae3272294bf46110987ede26446ac
-
Filesize
344KB
MD5a3341da2b534ec6048bb90ffd47bfb42
SHA192e8a309119221ec97a0a6d8189f61159de71b16
SHA25699ad633eb57fe5704526d4b490abc66e273da97f6303d0e90966ce2bc65d30bc
SHA512da39706fc92bc432d69896e4307cae5a14d2b72cb0f3137f3ffad9dd5a01297699048e78f0b33f97eb496672f87a65fadce8d4927a24fb188b47f47f6e73ee5a
-
Filesize
344KB
MD5dd7162b45f76acabc12b8ace84e391f7
SHA1db4b0580afe3d0be63368a476f2af04b73e8c585
SHA256daddd289a044f4dadb63e025d827b4293df11f4e94a90dd720ccff9bf82190fe
SHA512e06530c57fa941219e6ba546bf0b8a101babdf16460642d65df63fd2bb8a6d69acf05d89292e7e81fa7439be0e707d6d83e02d03a0596d51670332ac6a627157
-
Filesize
344KB
MD5e30be041e7dfce755952aaaf1d03f01b
SHA177320a7d669bf8b8d561e4c2eab783d32789a4a4
SHA25683f32e6df4431265afe4a74d880229a1fb56bb7db7369aa254563c727daae898
SHA5120cef35943ec1698148b59df60c48e5b172b20f54677832c9ca6ab4db27ea64f47d5f326fc030e707dbe115d51ebc89975f58f82685c5feb9bc30b8e0f2aebe44
-
Filesize
344KB
MD5e0180d5c2503b5c9de153f4fdffef233
SHA174b1ff0ff96ec086ecafec888ee792cb6d97f14d
SHA256165d13f9b2b959a6d2ff98eaeb9afd8401886b9f5a52b9df530af148c0c16f8c
SHA5127e8674d52bf71bac2434edd57dd94df3922dcdd451adeb65408f65110c30ca06e11ccc088865a60fb0213f85e2d5376ff8cd5001ee27d1d4ecb8214d402acf1d
-
Filesize
344KB
MD50f8160d31c8a657a5506a0767c696edd
SHA1ed63b3a29102c54172c2920fa4cfcce7f2772a3e
SHA256f3fb15b15e115e685e29d3ce880b268c00b96887cb78a56260a3d10b8e42e9c9
SHA5120b8cfb8e203f8e20d5699359626e0f17a21319271599b2f0a67d134738c1f0ad7c1ad6aeaaf07e3a0b92bcbe39a6df5c946bdabbcc3ca9355aabb8c1b97fc120
-
Filesize
344KB
MD54b7f50346ed80f142c6ccc1ed8df3598
SHA1c189f0be651bf836b33f0d3f822697d472c3ad8a
SHA2568754f32e5e9ed27b87753e56cf00e591d9ce543d71e01871f4693e90f8245408
SHA5122036827846180018e31adbe0a1070f6300761001525957ae300b7e79615539bca436aef0f8d6d0ebc8871ae13e755471b1cd74143dfe73053bb65a0e262b187e
-
Filesize
344KB
MD5f26ff34936bf85b335d4b64087c902fd
SHA13a80a539a0d6f09e5d463742ac8076c9bd45d710
SHA256950afa561f8dfbf29819e826d3aa102621d40573e83cbdf4750a396869e85a6a
SHA5125f5d1abf7412b3af3bafc0990eef12eb08893f00943d848efe5ab15e805eaf2dade14e93dc7687e24cec503a8fe95e1c7e3de81cbbe79e9744a6ded3b7daea9f