Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 09:46
General
-
Target
2024-10-01_a8d82a2ebd236a7eedfefe6a561489dc_goldeneye.exe
-
Size
192KB
-
MD5
a8d82a2ebd236a7eedfefe6a561489dc
-
SHA1
3bb3397eefccae415898f39538d6982dcf9ddaca
-
SHA256
2a23a96b0916b6424da55d684b8f6ea2e6542910d6ec76c8de6cb526cdbc5101
-
SHA512
1bbc9510f5f287384e45ac18532bc83a8899dd802fa16bea1893def363db00b420ee92bc1498bbb60032d78dcc16836666d1f82a172895be5487a89a2430fe6d
-
SSDEEP
1536:1EGh0oxl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oxl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_a8d82a2ebd236a7eedfefe6a561489dc_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_a8d82a2ebd236a7eedfefe6a561489dc_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8719209D-9C6D-4b88-9A97-40FB367A42F6}.exeC:\Windows\{8719209D-9C6D-4b88-9A97-40FB367A42F6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07091A37-B509-467c-A502-1A396ADDE9A6}.exeC:\Windows\{07091A37-B509-467c-A502-1A396ADDE9A6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A0B836D-7B2E-47b6-822D-A7AEA93B1F29}.exeC:\Windows\{5A0B836D-7B2E-47b6-822D-A7AEA93B1F29}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C22CA6E-B001-40bd-A599-7529E1C74095}.exeC:\Windows\{6C22CA6E-B001-40bd-A599-7529E1C74095}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60A170D7-2CDF-4018-87E6-EE4F7F71438F}.exeC:\Windows\{60A170D7-2CDF-4018-87E6-EE4F7F71438F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08FA7923-9181-49c4-B4F2-376D87C53C07}.exeC:\Windows\{08FA7923-9181-49c4-B4F2-376D87C53C07}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53680205-87C9-4f5d-8FAF-A82D97E43B7E}.exeC:\Windows\{53680205-87C9-4f5d-8FAF-A82D97E43B7E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28430BA7-538A-42cf-94E2-38F3F2D5879D}.exeC:\Windows\{28430BA7-538A-42cf-94E2-38F3F2D5879D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{584CF54E-981B-4c8a-9975-7665964AE3E8}.exeC:\Windows\{584CF54E-981B-4c8a-9975-7665964AE3E8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6663C236-8BFE-4bb1-8BFF-DBBC3E9F072F}.exeC:\Windows\{6663C236-8BFE-4bb1-8BFF-DBBC3E9F072F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41FA63E2-B637-447c-A574-C54E015DA02D}.exeC:\Windows\{41FA63E2-B637-447c-A574-C54E015DA02D}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3A1D442C-CE82-4835-AE41-A1BDDD141C92}.exeC:\Windows\{3A1D442C-CE82-4835-AE41-A1BDDD141C92}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41FA6~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6663C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{584CF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28430~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53680~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08FA7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60A17~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C22C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A0B8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07091~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87192~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5a94a80d0550025ca2ade3c1663055daf
SHA191a3c664d1f9ba7291e661c6740f9f1dd57b0b72
SHA2560e04333a3784e8738f41a0b9581b30862c28aab2636a1976b27f91a9bb6e2c13
SHA5127851f75bde784ce890e25950ab8475ebdefb19fa4f83f0a231c99fe961d7f367ce592e9871169f355756eaf521ac3e2914ccb6d5affdb7270910d5082c940be0
-
Filesize
192KB
MD567631031a47cc8e02b226bb735597a27
SHA1d6be8253a87fdeb4e58e04584da578a5e3a2943a
SHA2561a23f364f002aab9ddc4667145ddb79d8cd197dd1a2255eb89705fc7f657a553
SHA5122e4ae1661a83c4ea102f99ff48582d49c04d97b37005c43a3fddd5f2192dd5cabad8cea20482f7361264ac3c7e1f6f8866e84e356f7cf562c9f9ab04ff29e593
-
Filesize
192KB
MD5acfa4ef7de3c244a8d2f0c720a9d4c1b
SHA12a7090876c362a0ffbb8245804f0a0e6a1d9b82b
SHA256acac55c575e9077882689268afb70588c04925cddb5f573e6eae03d2845dddaa
SHA51253d6e9c6685873ce094104169282ff142ffb828e2ca35ad759baba6757301937587e00688fa05fb0c9da3af9947bd00fcc0ba8dc1795e19590db21483105d748
-
Filesize
192KB
MD5f56ff6930514ee98b435aebf1fcc4527
SHA108d6696e04c9adc3b8820c84158ae72448c2e1c6
SHA2565ecbf0a073caf36ad9a81f492ef32de70c8d95cf0141e9879b32e19520c9fded
SHA512cbf775fa600d3a7c13df4f2115325b911bbf55d373786b0e0c5a154ae0e8eb1e8a4b80aaa21833e039b2aca7e347222c4452f6541bfd5b32f9ca9459c1362cbe
-
Filesize
192KB
MD5ab11d421704489d8a9e0a52aade6f93d
SHA129614420fc1986f930840c1c67d209f21a03491e
SHA2569fdf7d19fda7a9705d62a5bc115cbc351f5e788058dd6be528a45d40f2ba5ecf
SHA512902b9abd4166b2b5067d71f03086444d80e28f0c0e49aac366dc322d879f61739473b500b8046ff7386e09ddf6e04502de49354a2bf53a86e5ff18479343ffd9
-
Filesize
192KB
MD5873c1f5df93980b54690bb784ea505bf
SHA115e0db3fc1f2e619682850c539b72b945b6db362
SHA2569906a2968fb513b9745d0789b5c96c837cc5d3bd9530d9c42164f9233cca86bf
SHA51269d427c4069d3b14ee08bde2af4e6620d1c5db1d46a9ff0f48baa0ee2587481c906b17981226da47563af205dabf69279cbed1ccb1723b4a103417691271a32b
-
Filesize
192KB
MD525bcc75212415d13452c2776d50db936
SHA1a3aa35afed7b6c849a167a0776da8cfcd19d916f
SHA2567d49e704e3d8c5d2988ec20e271077ab6e1e0d42afd8c02de7852afd3cc178c9
SHA512bd8fa2e8e7b4290fefd818bd7988dda8776711c7233cafe005441af6fdfb5d7fa8aee1f664c6f491eb405f114bac52e1142a8f1b815bbc3fde8f903f6aff9485
-
Filesize
192KB
MD53827874c686172e8d8ce1eeeab07dfb9
SHA17ddd98ec3f49ea2718cf97b361c871bba4d150b7
SHA256410965802758d81bf16e1fc29c7cc6dd2e43fb083552b309b8bcdc5a33d19c17
SHA512d92394e65c3078d19e4b944c2325f2cea45e39bb47e890623d0121d24562f1f8ec58f30057b0f37225ca0d1b2ea92694b0b9205bd08a25bed3335c614f720186
-
Filesize
192KB
MD5aa452b96a02e7905d5d591f0093443e0
SHA16576ddb6835fd6368d93865055c3583fd2536b5a
SHA2561cefedc7176389356e8575289a58a2046350d085e84e9349f754480d4de09a4a
SHA5126aab7b7ef5f3b7441b61a6980d6ff03adab9e390b716b4818e0fa1d4be5e706cb0ced98657816c13a18dc07bedf6650f3de71dc3c8b764b487fa494c3eda67e4
-
Filesize
192KB
MD51df0e2a8483bd57859c52b212d35d34a
SHA1a2699939651e3205b97be489040650e1999b8635
SHA256b42e1fac597208cfb1769be4582fbe9700ff22fd650778859481b8cff096329c
SHA51253c98e4c0bad92652d13c9577fca58fe96070b444bda3e3dd863b4574bf806985b1f18195f928780dea657a221364ba867d9e7946bf97df627121ba4e5eed9c6
-
Filesize
192KB
MD503b76acdc191188b7abf869899e995f6
SHA16a2c6fcc987e7f7b91794f913ff84492de02a139
SHA256e2468bac2fc6c841f773c52b6d0c0f3077eb4193c531bb7d108cccf5c31a66d9
SHA512fecb351694d9823e14f48b42188ae0067645c7a692bd594fefd4e45986b29180f461dc2f20dd55139d00d3625f02b4f680317ae4db2b5902456df59fb419da42
-
Filesize
192KB
MD5f9c1127cd6db4323fd3bfe567bb6a2ee
SHA1f9e8f1517d4a3b567919ca0574ff03319906db34
SHA256c755ed3abcd44f415b346fd4d4f57f905b6cbf7972bddca257461c0c4b77fe4e
SHA5121e083263dd0e35b5b0fdb2e1c6b43234ac728f21bb2620742dc64a4269ee2fc277bb130c2a6d2704dc4525a49bb8abcd79ee1a081cb0eaf3cc89d7d9075d425b