Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 21:27
General
-
Target
2024-10-02_4d4c4beb28cdb26fc9e135713c74482d_goldeneye.exe
-
Size
192KB
-
MD5
4d4c4beb28cdb26fc9e135713c74482d
-
SHA1
c8c120fd7352b22c69ae8c8498ea627d67182b5b
-
SHA256
755308bee753dbd1021527b66d26ecfe178cbc31006aee4cf17a07dad014cacd
-
SHA512
f39a7f65b1f4f02d379667478c4e4da03d833c420dc8c29a3eaa6798671d4ce2fb74ec357caf7f529213eedc7373a662ee5628059ac0b4a018ee79a1ae59c7c7
-
SSDEEP
1536:1EGh0oSl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oSl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_4d4c4beb28cdb26fc9e135713c74482d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_4d4c4beb28cdb26fc9e135713c74482d_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95616AA7-930D-4c3c-81D6-9A716BB2056D}.exeC:\Windows\{95616AA7-930D-4c3c-81D6-9A716BB2056D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01663BD5-596B-40d6-AE8A-F6CA884F7C96}.exeC:\Windows\{01663BD5-596B-40d6-AE8A-F6CA884F7C96}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C6175F1-B675-4f29-85F1-CEA9EE239C92}.exeC:\Windows\{5C6175F1-B675-4f29-85F1-CEA9EE239C92}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A00A04FE-ADB0-42cf-864D-86B4DD93320B}.exeC:\Windows\{A00A04FE-ADB0-42cf-864D-86B4DD93320B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42662744-71BE-48f4-828E-BC7A452C0305}.exeC:\Windows\{42662744-71BE-48f4-828E-BC7A452C0305}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C153EF32-83C5-4bcf-B935-68B8947163E4}.exeC:\Windows\{C153EF32-83C5-4bcf-B935-68B8947163E4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E70666A-E632-4e93-B4B4-7AE8224DBAB7}.exeC:\Windows\{9E70666A-E632-4e93-B4B4-7AE8224DBAB7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02593748-F677-4e29-BEC2-A57B5ED5D1A3}.exeC:\Windows\{02593748-F677-4e29-BEC2-A57B5ED5D1A3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B3DFF8D-3184-49e1-B99D-F0CCCEBDEB48}.exeC:\Windows\{5B3DFF8D-3184-49e1-B99D-F0CCCEBDEB48}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54D49A7E-59C4-4e6f-8CF8-BC6B4D976FC6}.exeC:\Windows\{54D49A7E-59C4-4e6f-8CF8-BC6B4D976FC6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E13BF82-2F92-4059-A7B1-ED8CE6740C84}.exeC:\Windows\{1E13BF82-2F92-4059-A7B1-ED8CE6740C84}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DECD2815-BD2C-4f2d-8457-407970276E30}.exeC:\Windows\{DECD2815-BD2C-4f2d-8457-407970276E30}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E13B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54D49~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B3DF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02593~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E706~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C153E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42662~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A00A0~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C617~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01663~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95616~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD57ddc68763861bfcec38ad1ad61655f70
SHA1b15b859941f0002f5d6b2f48880af5729e14472c
SHA2566f452a91b299c5b5a70fd0c142811cff7ca6e8865131cffd8deafac6c289e97b
SHA512fb641cd5d70ad52ba887834527ddab87e2adb47575d761fb6262e8425c7b25048a2e15891b2f35fd6f48cb1e94ba7e250527a208b48db3f2aaaec222e2c4dd2d
-
Filesize
192KB
MD5261f12725ad95c36b5bdabbb53b51771
SHA1f0b1ffa88cffd54172f76038292183e8090513b5
SHA25600badf00b341a5bdb09ff4faa1fc60884fa7ca770f8ad91127c7d8bc8520ec0f
SHA51290c6750a1612b716be7d08a0554275fab23e54ed894e1debafd88bd6d9afbc7a91873e43eafbbc451606f2bbc15ef9b002a919010165fb42564c66c2f947c0b4
-
Filesize
192KB
MD51fadca39db108d046d85c5bf06fd68bf
SHA1e5043b28388f41d61f048a308367b202f87948c1
SHA256e784554b1e91836ae5612660be94ed13b2768e4e350a532a482518b010898c0b
SHA512087011d90518ba1ef0d9ae03331bfecd2c1db7223670d91509fdae9d7b95f3131f449d39a158ecab9fa5832e80731dde6fce9ceb63b0ede64fd8a501b34c38d4
-
Filesize
192KB
MD5881090088f866082aa23d5e64dbd1f3f
SHA15c2ccb1f810b028cdd0e26627fda0609e6a451a7
SHA256df27580eb22f97f0dc7f68a54ce4468e2e5d17a512237fbb8b2f89e7e665a263
SHA51248ae3e41e16adb21e611cff01ac17ac0be9b6d2a4844c1ba744acc3516d3b1eef46df7d1b9420bad34b014467ca96d18fab2f25c3df60b92b2819462dc6450c1
-
Filesize
192KB
MD588256c67b09a499089d805239f33b7f9
SHA16d8b66ac0d43c494089695001c1c179fd38a3949
SHA25672e31fde580be03edc4e18ff63b163ed9a71c00409c7cf0235e57ef424283f26
SHA51251db3445568c6b5c9a9e0799d2f0610051cc27dcde963479b09ec36e5f830b19b7c1a54d2f6210a0f7145c1397a662c4bb60d2b70d3ed5113c890a89deb7506e
-
Filesize
192KB
MD56ab1cf8832636d8878c3d40446c3cc5a
SHA11be3fda91322ed9b978ee17a05f20262534fdf6e
SHA2561482de3b39877dab834728be486535cfe57d9e1db21706f8273ce3e7e1d7025a
SHA51219e0577e6714f5092dcfb4680ce07bf0b276b5c3f859dd9687b88c5bce627eadff169c9e149372e2a2d166278aaeab69039233bf0f2ddb888934d6af3c229566
-
Filesize
192KB
MD5921aac121cd901e77f16185ddcfb3a29
SHA1856292a4fb53ef16fc4d9f8c1c9d091f3b07df4c
SHA256322c50dc3ca09c16c31823fc03774c6bff4f8d8a59647d45b3ed2be3dc626ec6
SHA512adec87d3c0187bbe4769a1a7192015edffa04bd95057025a5a09701d8a033feee76a97b4612ce754ad62216e9fb4b691e7407f9f48489cf428a47873e3a75559
-
Filesize
192KB
MD559ebb5b6658a1da64ea4d208556ad1be
SHA129dc66aa2c0901045f60474a22c75efe34cd1e6d
SHA256809fca3f4825f31cd6adca9902b9956cad1f277497aefeac302197fa14247e66
SHA512a0061fc40ab02ecd1da7d449fd664c6660ac491702891465874e226a8f38dc0da3efc4be7d50ee8e3c6db342c2babca740571495fbc1a5eb102e609740479b82
-
Filesize
192KB
MD532836f6665a9a66b5391b6b1981acabf
SHA12dc3118e28d2dea288dcaebe7590449a1593a6c0
SHA256b7cb78c4b0d7e96235603a1b9bc44c44ebd85d02342f8b59dcba8fcc14892892
SHA5124d1e81985da96b85d840074da86a0bcce78690b7f24f8c37b3ec63e80f7bfe97c5e7e48b48e4a7266014076ae7485f7d0297d2571ef9fc23c08e537ec18e3dd8
-
Filesize
192KB
MD5e0c02460b384b41bcaefe5e54519b24f
SHA12e708f6354a6fea4a3995e2e810a723679400e5d
SHA25687671802557ef0e20529ea309f1c4d18720a3052031076dd70ffdc6d6bca1d46
SHA5122933aefa4c18577bbc9d341e09513b61c7c3c97476d5e4f9a0014454a1b5856a4a96a435d82113da89b87ef1772743b8c23b120153f0992dd0bb914c1c4623f0
-
Filesize
192KB
MD5d79396a303ba3abbbaace149c7ea5fd6
SHA196e47bcebfc47c37d8c1cfb209befeaf9c5d9673
SHA2561b3715e8cdd7571daaae47e8d0d0514b25d005b4ab8dbddce523e77372b4074a
SHA512f9f86c85889ac6cc207be609b3b3602d64e444e10bf4f3173d3ea8fb9e7aeb776df675771b0fae7fa40ad1e52d95f8eb879a382d864c35313aea46f631165066
-
Filesize
192KB
MD5d1e67660476d3822c47053fce9de9fec
SHA15efa044e99aea60a5c9a57b84afbd15bf887fd47
SHA2567677ecf4d40d3004e88de7fe100430a3672136ea209c06a3a2ea4fd6d737dc8a
SHA512f592943095317698e65c512706e5b0b1fb2729a587338c9907a5968ac2f1777587637a66a381c849001ccefd020ca505dfdb96a84b4df54d353f3b3f28470cf2