Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 08:29
General
-
Target
2024-10-02_2da0afdbca6400b88f842fab2d1babc1_goldeneye.exe
-
Size
372KB
-
MD5
2da0afdbca6400b88f842fab2d1babc1
-
SHA1
120ae016323963c21bb81137587f89a3fec174a6
-
SHA256
ea7827590023928c5d6272e4a27c096cc9ed011be90e37fca00a31ff6cfdd1e1
-
SHA512
3e41e1042dde5ce1bee813ddf30ea107de157fe392c01998764e070ea71338e4f099e64b71023a622d8457de569fcbae8dc96425f8fd9d78366fc13e6f80dae7
-
SSDEEP
3072:CEGh0oAlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGulkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_2da0afdbca6400b88f842fab2d1babc1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_2da0afdbca6400b88f842fab2d1babc1_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD366409-1575-4e57-9EB7-837DB4B3B600}.exeC:\Windows\{BD366409-1575-4e57-9EB7-837DB4B3B600}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08685A58-1DD8-4a9b-8A00-DB118AA739A8}.exeC:\Windows\{08685A58-1DD8-4a9b-8A00-DB118AA739A8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7B186B8-02F0-4f9f-8926-B324C1DAF00A}.exeC:\Windows\{C7B186B8-02F0-4f9f-8926-B324C1DAF00A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F41B46A-7AA0-40df-AD4B-951FD39B513F}.exeC:\Windows\{9F41B46A-7AA0-40df-AD4B-951FD39B513F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D96DCC4-9C7D-4dfe-965B-B0838932524B}.exeC:\Windows\{9D96DCC4-9C7D-4dfe-965B-B0838932524B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8DB39AB-75A9-456c-B11F-6A371A5EC380}.exeC:\Windows\{C8DB39AB-75A9-456c-B11F-6A371A5EC380}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66E38471-F0DD-41d1-B38B-99F5C6E400D5}.exeC:\Windows\{66E38471-F0DD-41d1-B38B-99F5C6E400D5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FA9CE2E-4329-4564-84BF-595262BC7D5B}.exeC:\Windows\{4FA9CE2E-4329-4564-84BF-595262BC7D5B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68480E4A-11F3-465e-A933-40DC91689629}.exeC:\Windows\{68480E4A-11F3-465e-A933-40DC91689629}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46C102FA-D3B0-4159-8C93-C66D9647C501}.exeC:\Windows\{46C102FA-D3B0-4159-8C93-C66D9647C501}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA0C3A12-D724-4ed7-8B52-7F0018AAEFFD}.exeC:\Windows\{DA0C3A12-D724-4ed7-8B52-7F0018AAEFFD}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1FF9CA9E-41F9-4c65-BDAD-67E376136653}.exeC:\Windows\{1FF9CA9E-41F9-4c65-BDAD-67E376136653}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA0C3~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46C10~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68480~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FA9C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66E38~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8DB3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D96D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F41B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7B18~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08685~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD366~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD51f7823ecd20bb5b6985246af109d0154
SHA18b7ebd3b09d72940d711f6e0ab0eec848be04fca
SHA25614a47b003b9f1e1a279c4d46b9cf6302ec46eacc3cbd519792a1001cb99795c0
SHA5121312146cf3f756145e7f686be6d7e7230637ee4a1a450485eae4a0d3d9c2539f8464da880c4fc1716ded4a232018f56706aa1b2e531d958c5bb481c9fd563c9f
-
Filesize
372KB
MD593a17a35aee03ef125a9517aff76b7c7
SHA19aac7dafc936da5f6af39814593b54260b6145e0
SHA256855168524b9e83738d4edf7ade9ccda084bf5cfbe8bad4c00b36d30dfc27fbba
SHA512c298ac6995cb0464af072eaf1f9dc5e544f3af9e803dd876168ff50a959d05c85bba548707d3f328c9bad3bc562e8904fdc77fd12f9726e32934aa9414e8973c
-
Filesize
372KB
MD58410989cbcf603e4ad65037e4d7cb492
SHA1ccb47b5d80489a39ca4fe749afdcb76e81223e1a
SHA256d60720322426d0a5b9e1629a975a2f3236c7fbedd45509844448955b31bc7c9d
SHA512533f69deb1900bed6375fde151814538084a1086b0f2ab3cf0c851541facb5253cd89cc15ea601a8e467fe9b709191f45ba954958dfa3c15ea43b44c602191de
-
Filesize
372KB
MD5f09b3354fad48f651611252494970165
SHA1d5342cb63eb6929ea64ccc754922135b0c5abafe
SHA256f14ff978ad77103e30814f9b74b41e913102433db3b34c76ac99cd7a11a2aeb4
SHA512a36333145e823967d79f664877b5bf095a03e50a9d75df9398f22c48fa8228fcb815c95d4ad868aa269af102d429fbb8f815d1971dd9ac814f8064829fb0b359
-
Filesize
372KB
MD5e99194989677d263488f2ab900e91582
SHA1145be216519e8acbe12f6015e40c55313162df22
SHA2568977eaf38e2af6af941d68c7aa945bf74ca1e84d0134aea35bcf74921970bd65
SHA512d55cbcbedf2454b8f6c84510fd66bd8ed5c5747cf46b944c035cbe0bb5ef2ec04f5afb50c4ae7a8f4f6127ee6b6db8bae5e41f03f9d4a401a2f0d81467d2129d
-
Filesize
372KB
MD527721cb95a15d4972c80c3f8b36c4692
SHA1a05d9c0ca21500c25c1afa8ad7778896e3806533
SHA2564b863b888f3d35a225f3c38a0889ee05a6f514cf55f796d49d096b50da0a83a6
SHA5124e61113c1885b3ff2a767d49a26eb59ee614085c466ab592d0fa17124ee6cb143e044bad4450c62dc69924835c5dddf76b5017669e99758bcd02fc7bbad92af8
-
Filesize
372KB
MD5ec17cfe619b6fa5c7ae5d81ad9a8b70b
SHA19d76fbdbcbb8b619f0004dca5bf9cdfe9e80de22
SHA256c2bf95ce8c2196fc8907ef11b1c79fc529d68607d0d7547b715b46342a634698
SHA5127f78c66a082e1c9b49147b06f8f52442810fe8da8a1b61dd49207e3bfd134cd93456b920ba5b93668dfbc3d338613f163d81a872928b1ab39c1895bcfe3f061e
-
Filesize
372KB
MD5219a84fb3a56ba1eb7778bf264123447
SHA10808222a708274bde6957b3d41d286b8420a8d6e
SHA25633033cc139d5da621f093d81e6562bb72412b4e2d0d39e3f2b3ccca888543c3a
SHA512ddca9c2287b8c6fc881ad1f19f7ec3ff0395163233df6a8da5476ae94381e3cc08bfcc0bc4304fee7b29cfe46e7f68a808664f056ab52997531144b83f12bbdb
-
Filesize
372KB
MD550baa282021aabe5138f34e8652a75bb
SHA10aab0f13cb20a760bbb49614bc672a8c66fb8731
SHA2560767d21a1255b35d6e21a7967f04d224edb059edea27cd14b748c0f66a6632d5
SHA51211b6985dcbf7cd6e7a95b837a2f214fc43a663af871d00118a027076a4c3dfddea3cfc8d466344c17c3472d2497a69460b76c016c2002f62e2eebc5be8053a05
-
Filesize
372KB
MD599da72fe639db01a4b8de75d8688b871
SHA1b73fb6768fd9c32c10c7616ca5b18d1e3b8b5b96
SHA25686ad5c896d9eff98e9a2dcaa071904620f56f1fe8f0519d33121b2a2827eff4f
SHA5120788137d8d5d870a87c5371799ac711c3d11ffc761eef6108c91a927e48750a2c76d6b161861498877cba8c15cabf29e92359587f2c708c8a90b632165a5514b
-
Filesize
372KB
MD537cb5ba34f673049341b9e1fafd8e3ba
SHA1b29ad0150ba6f6b4057997f46da131fd99300138
SHA2560aa675eead81bc92e5550562fdb33efceea8fa4cc20fae0a293f622d9b421633
SHA5121df18b21fbd8649a05135a0a2cc6a4b47c9d0f9ccec972f777a87303fa567d8b97b4fb1fae500379166adf88125cd528ee4b3ffd2c23f1569c59287e8826a342
-
Filesize
372KB
MD5c7e8810c523eea3b91b0363893bfffe6
SHA1589c6d7bb0378345e76fbf5b6184b0f4e498a2d5
SHA2562d8bf591178130a48b5d9528b625f67df2fe4d77f2c073b38f77a589162d923a
SHA51295f04a98dac2cfd5ea8457fc31c9c8754fa4f72a9fcc7a2e18471d7e8fad5c879a9702a3e466559d2354afc31fa7bf782ee478c7290b888ad0bc431125ba994b