Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 08:27
General
-
Target
2024-10-02_1f03612414259e25895c05f0c5e3910f_goldeneye.exe
-
Size
192KB
-
MD5
1f03612414259e25895c05f0c5e3910f
-
SHA1
57993210d8791d5be41c8cd04a639c7a6c9761c6
-
SHA256
198ccccefc77221033868e3b4347fbc2caed4ed3c203692b721c1e5c8415f04f
-
SHA512
17d54a2051a2e0544368e97ead0d92e3cd6d80ee5f1852a47303e4bfa8096ca80107fd74af9781105cef61c5306eab4ca7bb48f67bd9262875edf5ed0da43e4b
-
SSDEEP
1536:1EGh0odl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0odl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_1f03612414259e25895c05f0c5e3910f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_1f03612414259e25895c05f0c5e3910f_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9D6CA95-6455-44e4-8E06-0A8E97D90CB4}.exeC:\Windows\{E9D6CA95-6455-44e4-8E06-0A8E97D90CB4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F2DAB9B-B089-45d2-A839-B4B2AF6465EE}.exeC:\Windows\{4F2DAB9B-B089-45d2-A839-B4B2AF6465EE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B05CCCA4-0777-400e-A2F0-9369BBAB2FBC}.exeC:\Windows\{B05CCCA4-0777-400e-A2F0-9369BBAB2FBC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73BC34FD-BFFD-4db6-8DD7-15AE9355ABA9}.exeC:\Windows\{73BC34FD-BFFD-4db6-8DD7-15AE9355ABA9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81D903BF-4E90-46f9-BE58-F6BCF565AA96}.exeC:\Windows\{81D903BF-4E90-46f9-BE58-F6BCF565AA96}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8181E912-F30F-4ad8-BA4F-08483C2C49B9}.exeC:\Windows\{8181E912-F30F-4ad8-BA4F-08483C2C49B9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B10E4FDF-66E4-48b7-8BFE-98A182FD4CCA}.exeC:\Windows\{B10E4FDF-66E4-48b7-8BFE-98A182FD4CCA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D14BF46-D702-4ef7-BD0F-3F43D89546B5}.exeC:\Windows\{8D14BF46-D702-4ef7-BD0F-3F43D89546B5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD59689B-51F1-489f-9457-0137C2A07668}.exeC:\Windows\{DD59689B-51F1-489f-9457-0137C2A07668}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D012A0B-4D7F-41fe-800C-6623EF068ED3}.exeC:\Windows\{6D012A0B-4D7F-41fe-800C-6623EF068ED3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDAFAE9F-78BD-4486-9BA6-107F0ED48C26}.exeC:\Windows\{EDAFAE9F-78BD-4486-9BA6-107F0ED48C26}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{996975A1-8EBA-4930-A3BB-0F3E8DC09CBE}.exeC:\Windows\{996975A1-8EBA-4930-A3BB-0F3E8DC09CBE}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDAFA~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D012~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD596~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D14B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B10E4~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8181E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81D90~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73BC3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B05CC~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F2DA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9D6C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD502dba11450218b7a08e768433ef4156e
SHA13c75e2a59ae2b805007228a350c5804ae4ecac71
SHA256c5bc95544b9aa659bdc21c24301c01506f1c2b8b4420d08d300d47296eec93ae
SHA512f0af1e619c846b50a0f2c3dfb420a61be05563e8733e5236d84f193374c05ea812dac0a706ace65bf0deec126f92c268624eac8775436c2f067189d45116c2e2
-
Filesize
192KB
MD5854069528ebd3e846b831c16df108e93
SHA152c2f9d293feb867a7fb69dcd33c53be24443e1f
SHA256ffdb90fc1be6e0f1df9ffe9aade5e42afc7c1513878415425e959b7743a986c0
SHA512a5ec92a0e15e9e7965ff5998938dae1023821558f01c17567c47c359205e7413770cb2794521bae034c0ffaf4f07b17b8f481b9cb6197e2188476f59df36c31d
-
Filesize
192KB
MD5edf18ab8c9ff8df14cad9f0c4b9c9655
SHA1f53f07827b4688c85d289132f5c923ff8942b291
SHA256c7fe1a1e3cbdc712ce075c14cc9258a0a32167b8008986564a4e19fe38547157
SHA51233ac20c7ef713a79486e91d5a20825b21bbf9021efae125571c26ad6ae900ced346a4eb8833f2391bf17bf2e70b68a147fd47c27b6c6ffa47625101c5b8dd1e5
-
Filesize
192KB
MD51daf56d328ff86818aa0c114bc3c7924
SHA15b6a13a29440cc91d0b1c9d416b30c66c3019774
SHA2569ec10693e8cba05fd304a04ded32919e5698df85c895ba8db7db0634005f2f0c
SHA51272400403b4f65ef20a75cdaf9e972979a785d2d22638bd08d9e0704707a3843479d5e37c36cfd4b974acfe5847ea9d958216044ce582a1760962f27c2141846d
-
Filesize
192KB
MD5b68455d774841717629f292b826d15e1
SHA123d62e40eee39d4e06b6a82d184aac4b8f93659e
SHA256ab43c94cdbb6cebc0fd3a7fafb1064fe52770124579d83bdf1dc821553f9e8f0
SHA512d4e0fece7d5b40fd00e17fff78da9cf78b03ae9fb0abc745602dc7e9abac0877b8788000d96fc39cc7813d70981089055d1aa802bda9056317666b716d8402ea
-
Filesize
192KB
MD5e2b5afeb6e5fde70a49b105dddbb618d
SHA1627da75410c6393b558a62d2836dda9c19781fc6
SHA2562edd89328612abf5f71a6f7816cea4382e6d202bbebdd591aaae851ae909fca5
SHA512abd0a47eb8417df0a998e45214fef2e858ea505e61b4b603efa2235e9a13263a53ad04f5fd547cfc2ea885255ab9ec85fcd5640a0756043264604f613a8f311a
-
Filesize
192KB
MD5083ced3f332c8e7743f7a8fd3986a19a
SHA17cbee1e3f4560de2c5e4ca3110457a7aaf0e1ca9
SHA256dcd66c561d527dfcab7bb9281575c66d990b7620c6d4fdec7b6e9e1dcd8c3f5c
SHA512bd4b40fdebe8a8246ad703a85db8de4fd8f42ac4b20446104d298eb98a4c85d8845bad32025a83c1bed284e80caead564702653b87ee6626a8b4a2a0b35a14c0
-
Filesize
192KB
MD569027672fe045703b8e76313a30f0e67
SHA10bc0a5344bf1945347432da48bf1550b37da662a
SHA25610fbc326e0014bf9a21d2d0a85719514c7ed597fdab8ef92f20ef8768661fe07
SHA5126fe7f66b2c357e9831c8ae7a7bd2cccc9f06709244eb237ce107a45e349ef2cc94de1aac7c010ebffa8dec30517f01f82a586aba6de0ecfef182f3b260a5a10a
-
Filesize
192KB
MD5fef0d9aaff9ee1aea1d8561362c8d96f
SHA11fba9ed2f7d526366655cefde8ba48ac69cc953b
SHA256a9977601e2a5b9d7db37040820aed000b1efa4174d07bc5a18e3ed7e448f6ebf
SHA5122b10c0ee19cb95a1a70dc09e6a01a14ec49f24da78e5d19a7470c97be08a12c1528e46899311f9c31864a93c029f26a344554ffa939560b93f72ae81d499d3da
-
Filesize
192KB
MD56adfe4a0d9799e4a727f42f762e755b5
SHA173363a8cf93ea12efd767c9f80dd7b18a02677b6
SHA256349424665637a41d0432c318980125df1321830e2841a490df8f46f4e9c5e37b
SHA512124099689af4d528ba99eeac4c45f74469dbba932e9c1fe30f555d5ab2677a5ab157d2d519d5e94892e2041ab89d028e64d09edd62e6742252794baba863ad00
-
Filesize
192KB
MD5b573d431c4432dbdee9da7274ac82e72
SHA1151b6142b954902b909a727780dbb229f6ceaee1
SHA256b8fa6cf7f87fa7c556a576ce4dc819a8ae0a6b2ae400c7ec432f9660b0c692f4
SHA5126ab595901ced7dcf783e958b89d8f431a4614ba493306a83d03bf92023c7b1fc15c3eb7d97948690bbcc0e7f81285c441644d724227f7aed52459bc073583578
-
Filesize
192KB
MD59308b196240c6a1fd0ff1dd3b41bd5be
SHA1d33f33df326b1ceb566a1be8c5faa7626fe1b552
SHA256044ea0f92ce9d49fe5fdbd7b8099f455361a5988bb603129743c534dce52f468
SHA512cc7f16a1641162afa84c7ab15b1e8adb456e552e171e8742022746d5dad55abf3481adc2fe9e814617c1400f006d34fcd668f4111c9a7aa5a5c2e0a7ebc5d4e9