Analysis
-
max time kernel
149s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 08:31
General
-
Target
2024-10-02_37a0fcd357b01b4ebdc94c9aeeee405b_goldeneye.exe
-
Size
192KB
-
MD5
37a0fcd357b01b4ebdc94c9aeeee405b
-
SHA1
78db0a73c660da946ad6b3b9f766bae29d6c201c
-
SHA256
42c97d82a71a401bc044959e56482759c4b0940cd385f1dead1d6bbea090c5e5
-
SHA512
79d079048674962250fff77286802f6e8861b881463456a4a860f9477344450afb40b10c8cb25ec04d95634bce0de4ebe0aa971d183d4e11233ca060b61b8181
-
SSDEEP
1536:1EGh0ojl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ojl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_37a0fcd357b01b4ebdc94c9aeeee405b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_37a0fcd357b01b4ebdc94c9aeeee405b_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{224B3AE6-24CB-43b6-A80A-9442B0252E70}.exeC:\Windows\{224B3AE6-24CB-43b6-A80A-9442B0252E70}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1134F32-87F8-4e66-8E95-5BE81D26B21C}.exeC:\Windows\{B1134F32-87F8-4e66-8E95-5BE81D26B21C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61A01994-3124-44bd-90CD-BC48FC149F8E}.exeC:\Windows\{61A01994-3124-44bd-90CD-BC48FC149F8E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03AEB212-7A15-4993-945E-C4426B1B645B}.exeC:\Windows\{03AEB212-7A15-4993-945E-C4426B1B645B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0061C2E6-FCCA-46a9-9700-105F13D50CBE}.exeC:\Windows\{0061C2E6-FCCA-46a9-9700-105F13D50CBE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5BD0460-5F1C-4e0e-B130-0721AE6FF59B}.exeC:\Windows\{D5BD0460-5F1C-4e0e-B130-0721AE6FF59B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A34527D0-C1C9-46eb-97F8-0EE24E0DC763}.exeC:\Windows\{A34527D0-C1C9-46eb-97F8-0EE24E0DC763}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50D5B699-C01D-4020-BEF5-6E9C24BE0EE1}.exeC:\Windows\{50D5B699-C01D-4020-BEF5-6E9C24BE0EE1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76E69702-77F6-4bf2-9A17-1CCECE18107F}.exeC:\Windows\{76E69702-77F6-4bf2-9A17-1CCECE18107F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19306AAA-58ED-42a3-9517-8BEF70D48A33}.exeC:\Windows\{19306AAA-58ED-42a3-9517-8BEF70D48A33}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE102220-1F17-4e68-8CA8-DB1A89FCD368}.exeC:\Windows\{DE102220-1F17-4e68-8CA8-DB1A89FCD368}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A7DCC709-A719-4c1c-854D-F5CB2250C58E}.exeC:\Windows\{A7DCC709-A719-4c1c-854D-F5CB2250C58E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE102~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19306~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76E69~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50D5B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3452~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5BD0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0061C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03AEB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61A01~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1134~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{224B3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5d7f376f5de64d19a424e25d649d4199e
SHA16aca17f790785bbf418aa8775e81463699294e8d
SHA256840b04885bf724d9a0de7fdbcbc46e8fd1159282b2257af41a554aacde07f25c
SHA512a03f253b0a4a5e7552bf1bbd286adfc4dd220b465bfaa4cfb5e048e4596dbdc2c5c591cadca532f062d444341c39ad899263919c37f01d5ead77f299d89cf057
-
Filesize
192KB
MD5ea02f9e83171377169decf320c4585a4
SHA1b77ac268d58ab256ae8f7d620ff66f4446e516ee
SHA25626fb71543103324bad81df7b004cd8534816e429fbe4db258b9424ca5321901f
SHA5124ce2242e0ded2ddf60a2a40dd23fa2bbcb62b7cdd4cde32bf8189adb62a7523237d6fe7f15d0e403791d4c686417372ba41468b77a4134ae69b6fc0278c9150a
-
Filesize
192KB
MD596b22c2f11b71556fb6ed5a32f3fc54d
SHA197f04d40fed6ceb64c3faf9ef49ddfd037a81d69
SHA256351154a36128c57bfe8779769cedaa0ce800d41d87118d4d1359eb0c4bbc8a39
SHA512b6aca75c60129403c5c44a99e6655e2878b323ebaa246fada91e724fbc6c8ad0a26f27a640032a2997413e3ce054709e4d2a5be87830175ff95ce6764f30c14e
-
Filesize
192KB
MD5abe88e86600be3ca65ea725dc868cbd8
SHA110b2490dc928978b55301f1289303b6158df506d
SHA256ce599c34900546fdeabb546994da3e5acb87f62549f08a3d338e3dcd9bfadd67
SHA51280beb04cbbdea077f613c7421577257a241427b08d9b13549cb5b9d43b73f576116b6d7ee71b6c3e84509f28b7d32c2cfc70db92799d3483979b6dc0c1c95fb1
-
Filesize
192KB
MD50a7c4cae2f13403a588525a9c5cc66cc
SHA15f5927b107b209910d83f0840256ece6a7ad4385
SHA256a92a0ca1e705bb9c7d9dc6612200e222e60cdf250a1056c2e45526deddd61266
SHA512c4c54ecefa5bba4fa57f3367002cc241a38b64ddc68ea0aa99ad46dde319f721faffd2eb9c36f3378ea7e810c7182c073f122b2e7711b651d086e61ba8745407
-
Filesize
192KB
MD5f6c63438911bcc02f5d239f8094ab4fd
SHA1e80e660df001cb0d25383251f42d12b3d5477a8b
SHA256e116662ade0dacaa9023e973c91a3fb7563e19448de817942408fa1c3da177f1
SHA51211e8cbe1c6182e0f87b2d85885a86e3cd434a20708d2d39d29eb4a3c22cdf66980174faf721847cbb3ac16af234897d53dc0719cc81fa0f065d748248175863b
-
Filesize
192KB
MD55cd40388348755ee49e29013d4997997
SHA152b4aa727fe099dd804915fef2c20bbaf1386766
SHA256bbb037e8278854aa974075077c27568e50140465fa0baf936caee5b9ca3d5081
SHA5125fed11b76075f417f68a3b1892c1942c3b01597c781e451780b0152a2edd120d27a0bffa1f370b1faf0fa1309afe45207e15992bdfbcfdce833d7131b1545a8d
-
Filesize
192KB
MD53f12075789f744c46e17ee64ce5efd57
SHA1049594268bad96ffc9c4679948ddad7d033c5c1b
SHA256ae6e120df4210f0b92f003b6791c951d4d865d186afa0d1ca6005bec1fb6c894
SHA512512aa8f65b32ef9e8c02a0c235f059f04b91468267121b4d3b66e3951590ee24f7d1ad077d773eeb6368c901266a5df78442301cd123eb37c49654055e9a40b7
-
Filesize
192KB
MD53468d4d5205682c6febee0bee14dfc47
SHA104392e5d5ce91fed792c0c3dd410e7c2ecb263ef
SHA25660470107c230f076dcd308d1f72213c5c061fce3006585e6c3325c0914914fd7
SHA512e5e6ce42b74e4e831f0828ac2a9e41ebb8b14183e04e77e85092504143a4946cea6001fea919d832ca02e732afdadc2b8679b97b020eaa90ecac026159b727ce
-
Filesize
192KB
MD541c7f305b5fa508e78342211dbbe25a2
SHA1bd839e9280984cdc3c8403b9104e99d86920b3db
SHA2566004310b8d1dfaa208e698c4e3e1236f57a4a56c26781aa72d00d0c82ba64ff6
SHA512a9eeab1d83edde70c4003dcea98bf9f9b5561384580422fb3a88043353d518a2875f7560c1482e1fe527ab33ffa004b1610260241e7fa8af49306be29b17070b
-
Filesize
192KB
MD5c48fa7b12517d3901d2e65a51b89538e
SHA1cbc833db05772a9fb81dc4c8a4ab21824e5b73f7
SHA2569cd0b2dd0f19c7d5805cd97edb22a9461e88e46a0469d221f3fe4ad9be572432
SHA512349ce8d906d664a770d25b607d62234144374cd12d23de1f72d7ff558592949f5ca919dfa40d34cbee886167cdbb60b665df40a96be8adfac3886f06c8757772
-
Filesize
192KB
MD58359be5c9abe29298b6550717b48a464
SHA158260d8922667a2bfacdde7dd8de83662faa5c98
SHA25616f10ff32c7ba023d28236dc2784601082cf77c1da116aee263911a55e15e9da
SHA51258143ee42a83e8e55284b5e5bfa445749ce816aafd3eb4a2acb374499dbbac052e03cddf51df44e0116d9e0032d941fd1ec772f86fb8c1d11c47926be6f8a7a9