Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 09:16
General
-
Target
2024-10-02_f54b76f3d9f7bc9fa7e92abe1a84dc5f_goldeneye.exe
-
Size
372KB
-
MD5
f54b76f3d9f7bc9fa7e92abe1a84dc5f
-
SHA1
fc8c320029c62257b6b8db9a40c44c393d24d7a0
-
SHA256
55f585e451bf2bdbbcd0721335a1b91149b73453a0b2192aadeae10b53b41869
-
SHA512
f954ef279088f6e8153f3d74643cc5548a8be0b458f94a48f78c50d8f0bd1bfc2add7974fa1d8f938a9fa17facb508c8266baed66c003646039d5a0a02349854
-
SSDEEP
3072:CEGh0oQlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGilkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_f54b76f3d9f7bc9fa7e92abe1a84dc5f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_f54b76f3d9f7bc9fa7e92abe1a84dc5f_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0751AD4-7277-4118-A745-A044F55098EB}.exeC:\Windows\{F0751AD4-7277-4118-A745-A044F55098EB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0DE8612-13D3-416a-B094-E8459044D364}.exeC:\Windows\{F0DE8612-13D3-416a-B094-E8459044D364}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{153FBB36-7FC3-43b5-95B8-5E79FAE30FBA}.exeC:\Windows\{153FBB36-7FC3-43b5-95B8-5E79FAE30FBA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{204F8F35-8368-4e3e-9EBD-C715ECAA29CD}.exeC:\Windows\{204F8F35-8368-4e3e-9EBD-C715ECAA29CD}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9C62C3F-146B-4310-82A3-CC2CDC4A142A}.exeC:\Windows\{B9C62C3F-146B-4310-82A3-CC2CDC4A142A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A209EB2-F97D-4b6d-BD72-BA404D0122EF}.exeC:\Windows\{9A209EB2-F97D-4b6d-BD72-BA404D0122EF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94F54999-B56A-4b30-A22B-08E886DD9F33}.exeC:\Windows\{94F54999-B56A-4b30-A22B-08E886DD9F33}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82000894-404B-4a46-85C4-EC5A7B8E785E}.exeC:\Windows\{82000894-404B-4a46-85C4-EC5A7B8E785E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F88F299-0D44-4e32-864A-AB775A860E54}.exeC:\Windows\{2F88F299-0D44-4e32-864A-AB775A860E54}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2E725D2-A065-4a4c-91DB-6C87EB8616DA}.exeC:\Windows\{E2E725D2-A065-4a4c-91DB-6C87EB8616DA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{299D4570-1EF9-4d43-9D44-AC33F9D00AC9}.exeC:\Windows\{299D4570-1EF9-4d43-9D44-AC33F9D00AC9}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{370571BC-C874-4b60-BA9C-FBB071F4A6B8}.exeC:\Windows\{370571BC-C874-4b60-BA9C-FBB071F4A6B8}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{299D4~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2E72~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F88F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82000~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94F54~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A209~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9C62~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{204F8~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{153FB~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0DE8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0751~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5c3be1e8aee5fcc2ea48e41777cf3b60b
SHA1808f538c69bc7aa09d47f07676771b8bea33bd2b
SHA256a7ecb11e4e44ef0768abc0f81888e24b893796863f7ec25642a30c4701f8f83d
SHA5125e3f7a3ace19e06e128e6f07ce19d1eb3ad9b9febfa8ce36790714b08e9dde1afb82d4eb272d98ca5a6fc3d4f27fe25b0071c55fc656209e6c7c44300254fbfd
-
Filesize
372KB
MD5ea241ddf6441912779cc1d5d6bd8c3ed
SHA1cdfb67d47aa7ec0fe53546a04f038c79ec76d581
SHA25613a35d5e19ccf5bef18dcb8bf71f49fe700c1045fd8fa73335290abac66866e5
SHA5127eebed28f74915f88c23268a4755769e0fc1321b2c3c3111a9643df8bf3c14e5b81b95d83f3fb16c5bd2f63c7fce85115e248e247ae54f8d588e997cc1c91e0b
-
Filesize
372KB
MD53aeadec451abec388d484dbfb2b661bb
SHA1b741d2017f4b454d1e2287e9915ddca01c8ed567
SHA2564ea6bfce558bc6bad57bbc4fc8a45ca0f22698310cd60f25044c74fc44c5f87f
SHA512692c564a989445e58e015fe14f8d657e2e2e38b9435f1db616a6712fa213aeb9bcd646f3bf0631fcae831c4d1dbc6bbc356e4feb93003115cbbb858c41bacd1a
-
Filesize
372KB
MD57068038e19c63e6c9af9a819bc6013bb
SHA109deee13d2aaf71dfa1a4e3858d69d9f66849fa7
SHA256e52385de068c42d7a578f48a54c6aae378cdebfd3042ddf506e921a50cca2e9a
SHA512129d2b9fdc812a44969768e655fe90e2816278641bf049a72e880b65ba30ba780d121b9fac5821d0a5fbf0806af1c4a5850ab6c11db9c5adcc1ff1f3ada8cb62
-
Filesize
372KB
MD58c79b0e43bb5bd23aba98ce34a5ba0f0
SHA1dbdf4d5d7e8ad7bc3591f00f60255175404e063e
SHA256d3af405a667a3da9f6aeb14fceedd022935a67b0ef4b5c582d4de0215d495096
SHA5122995d87accb75774e7dad8b86f35bb4a89e3dc2caf1af73c1ca4b8fedccee3bc65d4e3d7f20f96a8f85ef4c2d6e5408014daeed40f5a98fc21d464bd46d6c35e
-
Filesize
372KB
MD51255e7ba57816e57e8efcb73c13fd9a7
SHA1e7ab31a76ade78c8d2e77d15cc6d32cc591d5d97
SHA256238f378f51c572d24c4f7b2c2ead2033cfdb6ee258ed3ace98c63813fb843831
SHA512e59936073e4c3a5ddf36504b585c3bd85f27ecefc3075af9f4c2b936e5c0f9500bb8c8e84792702fda539a9adcf1667c34806bddceb5e4edc4a513ec230f3b48
-
Filesize
372KB
MD55fa3e2352b8564ad5cf95abf537001d7
SHA1d474f33a9bafd264d4f578cbd2ec1087c09a6372
SHA2563c0e193f0c86272273e96cfbe1a77380a143739d3984225786f333cd04e6b7d2
SHA512770662a4989c12b41f26db8d1374ff0e78eb04e12c1100f21423933992f5d38ef874e8e7e96d76aaa08c6554a5a86490adc99133fc92cea58100a4a975f0b672
-
Filesize
372KB
MD599221b7fd09fd1deda41db0f9f973dc3
SHA12ed4ddc71a731981438a730eacbf8869969cc64b
SHA256a29bbd6a2bb43103fc83f854762e516dbdedf3d97154c72e7026ac16058a637b
SHA5122511c509f48e9cd6584ae3620824586c668a123f6d63efef3b0f2711b908ee33ed3627ebed3580dc71c6cdf3f4b2b8428798bd69e4ede633ef53cd9ec0a2c374
-
Filesize
372KB
MD5961fb8db8af366de4d0c1db15081c431
SHA103e142b0c8677520474f82ef1ab762af856ea67d
SHA25617c7899c0af18e9bc147067400fdfb8281a1f1d1ecadde042ab0dc8a15f28d77
SHA51253fde85ac135a47496a1eea43e4ee54358d4ac4e2185b960ecda84224c19bf09dbd41c2f8b2f69e412df0f505802b66f1039d9a2bb764cdfa68b5314d73bf67c
-
Filesize
372KB
MD53c0a07f33042a336234a86d09f4a930e
SHA1fd08e9b2e36f0ab08170cbb737591fd8cfd063d0
SHA25683e9641d425a8363cc1aa05910812261d575e5b2c847ade616074d04b0d4bf58
SHA5129b822713e5417bfe619aeeb503f683def4320d7c4879e9dd1c48346c5f37b0feb13d4f9ba0503348dcdf78c9a6bb10f26e6a52b21042571c77b4c1929111fcc1
-
Filesize
372KB
MD5e023cbc38aeaee312525fa9f9c3d7f00
SHA1f8a368d7ecbf59610e7691f1a0e4b6fb398c7904
SHA2565a81a0ee9d415949d79a90c3a6ecd2ec8dd4760e7e934f0a4585db3a6a8f63cd
SHA5128ee124697183ec0abe6899abd2ed22c185f35126079ffb2f3cecb34644ec3906aa6f6736d13753ff589e3456e3f8c6ee7d7bde7e50c91bee93fd47212e72e441
-
Filesize
372KB
MD54a73b343854d5458e91481207dcba66a
SHA123d4543c611271e301aea7433b01b26cd28e7188
SHA256284e921834c4d005adb5b02e544c33b9df949f40cefdcb6beeb54a709e642deb
SHA51228a87f6f7be823f218d4265974fe8eec064afe458c3729823c109c2eacfd267b4c55fa2f56603e786e3a29b1e09bf60930a437a4516c34369b150517f575380a