Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 09:35
General
-
Target
2024-10-01_49faa4c92a6fe8c2dff8f3e7399441eb_goldeneye.exe
-
Size
372KB
-
MD5
49faa4c92a6fe8c2dff8f3e7399441eb
-
SHA1
314f37f3f07a2dabcb11bd37afd231770f4ec21b
-
SHA256
714b3e26b559afb5f2697b3506dd6c3c79141e18a61980705e87d96208e4554a
-
SHA512
14c352d06f01990bdb29a5fdaa900393c223aaed682daf5a4b55f44db08ebeae22dc4439ef47b995487786eb2b24844fd4f0038f6f39a97ac8284d46a30b51e5
-
SSDEEP
3072:CEGh0onlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG5lkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_49faa4c92a6fe8c2dff8f3e7399441eb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_49faa4c92a6fe8c2dff8f3e7399441eb_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DEAB43D-6C6A-4231-8A2A-6C347D79EC7B}.exeC:\Windows\{2DEAB43D-6C6A-4231-8A2A-6C347D79EC7B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{993A9F05-2E84-4ecf-BFBC-E08B4AAFE40C}.exeC:\Windows\{993A9F05-2E84-4ecf-BFBC-E08B4AAFE40C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74EB1977-E77A-4cc2-81E0-33293050C105}.exeC:\Windows\{74EB1977-E77A-4cc2-81E0-33293050C105}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A83E6FAB-E57B-453d-9153-C6262985FE85}.exeC:\Windows\{A83E6FAB-E57B-453d-9153-C6262985FE85}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53557A95-A997-4bca-B346-CE4AF2A0C1E3}.exeC:\Windows\{53557A95-A997-4bca-B346-CE4AF2A0C1E3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3829DA15-0143-45e7-B5CB-AACF6E6B7611}.exeC:\Windows\{3829DA15-0143-45e7-B5CB-AACF6E6B7611}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F823BA6-8A5A-4d15-BE12-CB8B5F0C4E2B}.exeC:\Windows\{3F823BA6-8A5A-4d15-BE12-CB8B5F0C4E2B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72392154-8C32-4934-BF42-ABC4141C88EB}.exeC:\Windows\{72392154-8C32-4934-BF42-ABC4141C88EB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C140751C-28F9-4137-A4E9-A7B615C3908A}.exeC:\Windows\{C140751C-28F9-4137-A4E9-A7B615C3908A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21677D58-EEC0-44a4-A498-AEED3E29510A}.exeC:\Windows\{21677D58-EEC0-44a4-A498-AEED3E29510A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC16CF62-F424-45fe-8A68-E40A1A660632}.exeC:\Windows\{BC16CF62-F424-45fe-8A68-E40A1A660632}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{890E92F7-E373-4b17-A72B-CEF330CF5E88}.exeC:\Windows\{890E92F7-E373-4b17-A72B-CEF330CF5E88}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC16C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21677~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1407~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72392~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F823~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3829D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53557~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A83E6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74EB1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{993A9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DEAB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD56f8a2ca26d6183725c4b810c2a1f9d31
SHA1f78afbf4a4ec8b9dc5b33eab0b1cc73e5a39fcd0
SHA2567ba6662362ca444ced0c053676443ae908a58bae8e17db165f1e3f2b2a7ea19f
SHA51286036f40e4f6ff1945f6d99e1656a76a749bc0bad6d40157c2ce8c5b8d827d49761083e8a08adc305bf38728b782c7e1f5e272e2c617a84678351903365bb436
-
Filesize
372KB
MD598de2fb23282705d12aa80e3fbd008fa
SHA17720d83964490739dcecf4e848d1ed22b813d1c0
SHA2560600bc212be492740bedbef26ed28f5e6d95e1f5edbce9226f4fad77137e53d8
SHA5125af1f777367828167834085f2be1c21ade6a1707da2ab38fc4b81a3da1f34b34fd6c555d6da91335ac27de09cd318d4ebb88cc274b8f4b60a516d39e9322191c
-
Filesize
372KB
MD58fe7968806a2568eb564525efa615ae9
SHA1c3a9eec467d5d75e510c232bb3b76203973f86c4
SHA2562c2bf5584c3e6a385cf4c75744bfe3fd1c7b28089eaba878849b3b86e36dfa6a
SHA5122d2840f1fe1073df57c7b33c50b8e793cdea6178d18a850bf0e7b245fc77e530c844ea06058955f192da5fed1504e0daa4dac8e8d0dfc908966dd07177121557
-
Filesize
372KB
MD51f633f4f2c4ba1d460dc991bbe04686a
SHA17c07916455ad2f571f754c168f6dd4f3d3221412
SHA2560b67086065d44669d95918e04aff7e7edd06237857179eea3f0fb1eccb187968
SHA512b2320d7f1e1e7216078210ab797ebb3d1516c40b86d5dd592091afea7a8746dd70ad1ec6684612ced768a1d51a7f3123a97854e6fb0bd7d36a1f3168bea4a465
-
Filesize
372KB
MD509347d7779b410704fea73757a5431cc
SHA1bdfdb10dffd61d3ce866277e9f457c3ec0ad34d4
SHA256578ba4bf3bb018e00bedf4e1f73ded4cfc4413e0480331daaa83449bdfb435c7
SHA512f289af33b793a9b24c2e40c9e99cae022f8649dba6c3ceaf15cacd51f889acc4f7e782a604ed97106dd84ddd9dc8ac608b2df579f3ec255d7112a044cfabcbed
-
Filesize
372KB
MD547cc4142143cc201bfa64c0a866cf2bd
SHA120223129c972bff4322d86df5157561e25deca0c
SHA256fd83102cde45b54aaa05cdaf801b074243d56eb5af4af0fba70db75aeaa75561
SHA512d7e50cc014265957111c75887df09e688f901364928f10a401e46924fb52b67529fff3a1f88f071dc9efae4736d62885514b6944a456b76e4cbda5a9a8858b7c
-
Filesize
372KB
MD5b21d1a1b8c45dbfd3dcbd0208ca322fc
SHA1c1ea1088ccf9e0de7b23aacd34f7410377eb8d92
SHA256fa3d08f42c6dca986bb6efb8dfcd25a081395a78d296f9f5b48f1d57596132a4
SHA512a6c652509864a273bb1a5faa75973538ab5036ce7fa9f4a53a0c70c2a4275e15244d6d4ef05dc6c98560ad4d4f3200171328102b2c558262efd08154968efcbc
-
Filesize
372KB
MD57a3844d246be3afca01480163226662b
SHA1a2110fbf610f410c3251468006e5588151b60103
SHA256222a78001bdc89534b8634fc63e4581e33d2f0cd8653e4c055797e6d171b86ae
SHA5127234503a64c5ee3be79d8ca18865ab11a3ccc5675c3a2614a20d4a5562156fb430a943cd385ba939b45c96116a24ec15199a2183fc4ad1a7e02341a4dd1af97b
-
Filesize
372KB
MD508c3d32a496695d44a1f5d3397ec2c50
SHA1e8d2d19e4ef9db92137ac653e5a728c6f11e1e50
SHA256b967de151171129c58405fc35b9ea5b8d17ddcab96e715d98aa8f63e790d37cb
SHA51254bf058fd1de1f0782a22d018b76ef3c09ef2c6abc3ffb0a060ec7bc2b1462d2d681f13e63f1491fb9fcefe242d94121b6d5a83c3346cddabde98ff3114dc1d1
-
Filesize
372KB
MD50513c0a2cbde6d72733e57c81a43737f
SHA142d6c3d7a47f555f736826664a2d97bb6c170d90
SHA256f95dc8c93e5e7d4043b2a00696bc1a893443a6efb9270cdc6ac4d9f3d9458bb1
SHA512303d7c3916c98c9d0a8004b0990f8fea6796036e940616859b275960376c32e07649a8cd0b4caaa51215b565b33c73d7a15aad5476e81d260f9044e9384b8cbc
-
Filesize
372KB
MD5c7c204025004b7da1539971d60ec31a0
SHA18e8f268d9e87f50280c36a993549547e578dceab
SHA25639643252f04407a98240f5ae786624589389dafb49fb3d2b650fd95e4a4d6b3b
SHA51204a9f1db9ad977d2b1a1d05c735e437386d1d41cf9ccf81b1cfec858bbcfb8bd1f90475214102b833781b39ed3783ce66ac8ad4f31905bcbffd0a5b8f0f402ad
-
Filesize
372KB
MD50aca75d246f45d314847db708eea4d4c
SHA1d123f297b5726a0ce836ce440634298d5a43af25
SHA256a48663c6b0b3129db0783700d3b515745c9a34df1fcc953332ce09118f787e72
SHA5122d728b83a489560f69bc287e347bfcd988497696c30604719c352e19c23d2f1e96aa1b0dc9af81e5404bfbfc4ea1d0c4d6ac1d2c49d1f4b5fe4cc6776781911c