Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 15:42
General
-
Target
2024-10-01_0d33c41443c0f4d0a2edb08376980b58_goldeneye.exe
-
Size
192KB
-
MD5
0d33c41443c0f4d0a2edb08376980b58
-
SHA1
e480a565d22b64ab2565b65d61251a3d21ebbbb5
-
SHA256
f90effcc43643dcf25642e51312ae89c91dcd8c4821026ccbc986b8196824ca5
-
SHA512
e33155d42fc1432c33a836f13c6cef94b27cc3424fd80c45a0d875cf55eb9f6c1d37c2e5c2c2f9db835eb65ad6107895748a87ed3bec780dd8b16ec03ccefaf5
-
SSDEEP
1536:1EGh0owl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0owl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_0d33c41443c0f4d0a2edb08376980b58_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_0d33c41443c0f4d0a2edb08376980b58_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8B2E48B-F651-426a-8353-E5DF7EA008F1}.exeC:\Windows\{C8B2E48B-F651-426a-8353-E5DF7EA008F1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F5F5584-49BB-4375-9744-DA45D49ED62F}.exeC:\Windows\{9F5F5584-49BB-4375-9744-DA45D49ED62F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96D52FD3-CE0B-44c2-ACD0-E5D4D5158E28}.exeC:\Windows\{96D52FD3-CE0B-44c2-ACD0-E5D4D5158E28}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{179FD877-D69B-4868-BE0C-6CE44E12C334}.exeC:\Windows\{179FD877-D69B-4868-BE0C-6CE44E12C334}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5F59E7F-CA65-4bb9-BCF3-BD44E93796AF}.exeC:\Windows\{C5F59E7F-CA65-4bb9-BCF3-BD44E93796AF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E72310C-6227-45e9-AA88-B052E21A10F5}.exeC:\Windows\{3E72310C-6227-45e9-AA88-B052E21A10F5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8326F3A5-21CA-4927-969F-215567F26926}.exeC:\Windows\{8326F3A5-21CA-4927-969F-215567F26926}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44B6E74D-732A-43c2-BCD7-E2B38659C5DC}.exeC:\Windows\{44B6E74D-732A-43c2-BCD7-E2B38659C5DC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29E3ABD8-5475-4628-B2DF-4A6FB6B4ADDA}.exeC:\Windows\{29E3ABD8-5475-4628-B2DF-4A6FB6B4ADDA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70A827D1-FADD-4967-959F-4A9118E117F8}.exeC:\Windows\{70A827D1-FADD-4967-959F-4A9118E117F8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67E29F1A-342F-493d-B860-3D47064D2E33}.exeC:\Windows\{67E29F1A-342F-493d-B860-3D47064D2E33}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DFA16194-146B-4a8f-B8AA-7E63A2444FB8}.exeC:\Windows\{DFA16194-146B-4a8f-B8AA-7E63A2444FB8}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67E29~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70A82~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29E3A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44B6E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8326F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E723~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5F59~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{179FD~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96D52~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F5F5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8B2E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5a1a8eb5e4ec77a82b570eb0d2a177f83
SHA1061c872e625ef3b1181ad93a759443e9704ad307
SHA256e005222f516c49115519b653bad83795bc94cb895248737ce4d66de133390103
SHA512cc4ae61fe703f4f67ee37e3615872ab5fd230754222efe8341918f85c80b0f0823fa4d46bf92b661b0b8bdfbf79956a9b344d56f01d45d7ddc998a17a1760054
-
Filesize
192KB
MD5c0ba1e746230384a4919bb3971b6ef82
SHA17a1f7cd36e6ace375a1e60390d3a4dc0b2bfe58d
SHA2569bb1870a7e3d775b4294fc75b48cb9c56ea0a7e6abff06c1dfd9797b713522fc
SHA512656b75139ed60a110da9431c876dabd14eaddbd9df481c1066e418b363b195089a634bc766c45594f1e65713bdb5f982eb4ce8c81ad6592a103caa9aad3cd1a7
-
Filesize
192KB
MD57abf1c23df3331f22a4e131a3a971272
SHA1f3a5add63ab219d6b65f5a0ae710405a8aa207d8
SHA256bbf0990a16dc73b58d6b02a03fdcce8806c516d8852122573b3406670f10c204
SHA5125891f8caa9655436df692f4b74169ffc7ccb7bf4a7a4ca3c22908b551ba30287d19dd76c2bd7f5619ad661af8b6d1c25a3a908d46ebdabae207067875f90e4ec
-
Filesize
192KB
MD549786118e37606ce68f2812e114c3443
SHA1b6a0849041b7ccd07a9724dcf59b8819324fcd2d
SHA256ca4e97b02a05e1dcd0463a37ed3c5f656e3674fc61bec27e7b5ee240124bc45d
SHA512337c316c8f89d3aa2da24f46230344391406993e144e54ce1de96d840329ae5bc4ac443674c9981edc94a8b2c9fa05db414ebd54057bc42ac0a1a09ede157d7c
-
Filesize
192KB
MD5c5f5cafce2cf03212d97c8652bb54088
SHA1b5db6e30bf048ecf58b302f6c21b40916aef61f8
SHA2564a7aaa4af250b84af8f423ee24ce76e1ef216ec3e9b1bfa5d8e6a4c8b6459792
SHA512a58195227f01b20e4a713cfa2035da3264f00afb50d6ac4b7fc83cd19da05038e4c7177ad0161e764c2f4896a4af200ab04dbac6330f0aa2dcaba26ade751c7d
-
Filesize
192KB
MD546010053076bd3f7bd0578cf09458125
SHA10238ca7c1859713c55e1c3fcbb2268bbeb5de518
SHA25622409ba72a19ab5810bbc44ba33cce16607313a8538e2d9809ea42943749a2ad
SHA5125b0dc7e6f867cc6ec3afc67bd343c372fde7faa72d52a4597f6c9859aa5ff5c2a5825543fbe923fc4c938c14a8625cde16bf0fac928e7ee51cbf49c979f57dfd
-
Filesize
192KB
MD5027be5ecdc2cafbeef5421a6d321839c
SHA19f908508b54fb56b944430c9e4e9e27185c3df9e
SHA256953d3428fb96e6f90a70594d1bc1d9c5a320976f01b48a4d2b7409295a7e287c
SHA5124b0cf2ab7d58628e64668eeca33a1443aa10613dc30f52fb8b6645289e5e7c0aed57b5c67f5dc1af483b0623374799fc3200f8fef756be2bb5bd1a4d4a37b31f
-
Filesize
192KB
MD5a18cfe9d962f0f221159225dc7864a8e
SHA1873398d3ab01da739d7a2bd0d8b242dec7cca7e5
SHA25606b752b72b73fd32ef5b5d587b58bb0172ef67193bc808e6632def537d959e16
SHA512cff882385850e72aa8242544d446a265cc989253c0e6ba17857461fb313ca7f70c9f267a7610a2bf3187e198a91eaefb12dbac378f5c27bca733f8d61f73b2e3
-
Filesize
192KB
MD5463d6b9f3067f697f178613887abf243
SHA1e7f5fb93b082263490673d74c4940f918b9c21bd
SHA256413d027ef34341b42bf888edc3ff31cf0b9aa48fe31ff27243f97fd74dd13172
SHA5123c9a4f21a58d413ba2a5b453d89595f9bcd4070a2e4f7601912f093a6dace20d3921a5ffcda549b5d2ad4718895b5b7da00a77b6dd68d68866625fd943cdc55f
-
Filesize
192KB
MD5a82fd3585aa7550bc466e50c29c4c317
SHA1a2c10ac2a2e1362714dc95989de77d9caf871318
SHA256ed150f703580de26b0d3c4caf41551d1df5e7669359603fffd61388ba3ddf642
SHA5122f394277c9f1fc302747d555d312d9a15e4d2c0a7176e2e703ad1d17ca9239bd584377df1327746e883ee7d31ae4e8fdaaf54e7258d374b5a3ba3361693be9c6
-
Filesize
192KB
MD56c877622a350cb6671a74530c7692cef
SHA1c6d7788ad2717fb6e2a9724ee24166d613a04cbf
SHA256bb87b9efe3610b24783bc97a3c8c1f76b6496fbc2c1249e42614caa5458e5142
SHA512bc555f6c15ec8ed5c2fac8b52d5e404f1ff2326eeb89541c4e2bf1e7256fb3ea2c54a06967a84def91896f11c08c88d3ee143e0de3cf777ccb1b59d9c09e68d2
-
Filesize
192KB
MD5c6cd619aac8f9142945780913fcdf442
SHA1fc0c6ffe605fa539af6ef2c7c9480325ae6b54e7
SHA256cdaad769ce67562aaef7151cd1cc7312e585d17a5e4f33b62ab6cb7e01c6d63a
SHA5122736370cb9308e90f2382a77c737950370c9be0afbb12d85cd0adca1d2943a39333166de8882c600baacf0df03618f88d5805c7e46f69b5be1cceb9de3210722