Analysis
-
max time kernel
149s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 07:48
General
-
Target
2024-10-03_9b2873a4d8bd6f827729c90bca9dfa1e_goldeneye.exe
-
Size
408KB
-
MD5
9b2873a4d8bd6f827729c90bca9dfa1e
-
SHA1
7e31e311470aec882fa9c26fed0d0c11f5d52b90
-
SHA256
21b9615e6d5a6e78889bc9009a8a4484c889c61f281acb77d66c20146cfd23b7
-
SHA512
fc86f382ce553dda935159b0c0b98f668b6d9eec5709adaf156ecda362b7baad7a5bc4653d9c8a06de833daee010bd1eb4babf9608a12211145e1c87b2a7e2e4
-
SSDEEP
3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGxldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_9b2873a4d8bd6f827729c90bca9dfa1e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_9b2873a4d8bd6f827729c90bca9dfa1e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5476A5B-9456-4265-9D0B-518144CC216B}.exeC:\Windows\{D5476A5B-9456-4265-9D0B-518144CC216B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52F33E81-767F-431f-8D65-F891C15F5CD7}.exeC:\Windows\{52F33E81-767F-431f-8D65-F891C15F5CD7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0BE46D1B-9D59-4062-93CA-853D112C6784}.exeC:\Windows\{0BE46D1B-9D59-4062-93CA-853D112C6784}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12207460-FF02-427c-B672-38090A6B390B}.exeC:\Windows\{12207460-FF02-427c-B672-38090A6B390B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47C911BF-EA03-42aa-BD0F-1ED092827723}.exeC:\Windows\{47C911BF-EA03-42aa-BD0F-1ED092827723}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDE49BE7-011B-40ac-B616-BB575E3E5272}.exeC:\Windows\{BDE49BE7-011B-40ac-B616-BB575E3E5272}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C0DBABD-EDA3-4d07-ADA9-7A5365B81D3E}.exeC:\Windows\{0C0DBABD-EDA3-4d07-ADA9-7A5365B81D3E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{903E9646-E348-42ca-8A94-E852C124C1B6}.exeC:\Windows\{903E9646-E348-42ca-8A94-E852C124C1B6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AB1D3C7-FBAD-43cc-8A7C-F126158D29B4}.exeC:\Windows\{3AB1D3C7-FBAD-43cc-8A7C-F126158D29B4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F70E2F1F-CA28-4703-BE17-DFC90288734F}.exeC:\Windows\{F70E2F1F-CA28-4703-BE17-DFC90288734F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD6E27DD-3975-4feb-9B67-F11668B8AC53}.exeC:\Windows\{BD6E27DD-3975-4feb-9B67-F11668B8AC53}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2A846628-A500-4e32-B526-EE9A5E2C1FB5}.exeC:\Windows\{2A846628-A500-4e32-B526-EE9A5E2C1FB5}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD6E2~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F70E2~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AB1D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{903E9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C0DB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDE49~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47C91~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12207~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BE46~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52F33~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5476~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD59f25419db1b4e1b2d59c72290619d800
SHA10aa8dc3014ca9c50a23aa305206063d1c94065c2
SHA25698b740b10f2d7e7db67a73ec4dd6fbb271e5a26015a9a9a6201b369eee3c5e6e
SHA5126f382954c313cc6a6dbc9d2d9b11bfe9e62c5d4ed962810f8c6152c76982d319caa1c801540ea733f6fc9bb656836f01a54f8541a28ab6d61fcdb9b132903b19
-
Filesize
408KB
MD54b200ee4165e56e72abdb58f43993dcb
SHA121a71eced76c5e249d76dd29e2911ba23b758ea9
SHA256c82fbf2a34ca2628d2f2c5a26b616fc594e088d359944e0bea476ea3a5ace336
SHA512e60a01cbc87d2fc97a84b69562c1ddd5cf14fce7ffacb8380be1dcf9783467ac60626e4b72749d66baf2f18059a90185c6f48c813c2825585d4dffb55b4af493
-
Filesize
408KB
MD50d8bd24af2887e7ed02284f6c1fbf528
SHA150f1714d54eb878b58bc96f50d785f692120424c
SHA256d8e15ab2aef96ec52a3aaec59ae129a1659781109b2245f014375a18ba142fca
SHA5127a0090d81a3e4c4eb69a5669247467b10e9861020ddefb16b2ba629600d9f16ea597493fe05411a1410f6c2a569b20c43dcd18a4169b60372a71361c27387365
-
Filesize
408KB
MD520dc0d523f85aadee4cb89ffa21f6d17
SHA168e3b859234c62c9d25afbfa3d1cb3dc377a8572
SHA25674b83f0ac498f2add6a02d25cb9bfd80875fdd64c2bcd41711694d0778ce9140
SHA51217a4d6fbce1d75af56ca734f8577bc529ba386342c5479ec3ab7083af53eeb703df8660c63f817675e4d36d4bbd6bb4c3baec3a73298c149d7525683e609d272
-
Filesize
408KB
MD55b1ac48ea3def9e0329a9c312d4bf76e
SHA196e846667008e6a67048b88b7a47d3f59d3a3649
SHA256e8d55316b76762735a64c29b49d53898fc4e3db3a89b30f86faf1be19fb76a71
SHA512619c2092e80f5d0427c302c1bfa729bf1f958c578ec7d04104b7026e5661965473d963f1fa5221c322aefacb3d6e1f8ab190ca3a51777a038e5e6f33a02115e2
-
Filesize
408KB
MD542d33e1d528ca3f159d423d3f2ef7f84
SHA175735e33aafa388f8acd7d63b350533447564772
SHA256eaedeed233cc00467c86647f968da3cac12352698f4d3c917d96d6d1b383b5b7
SHA5121c7afe0749c11b5adea913dd34d9ee2f9ad3e937025c6fc6a42ec873b593a75e899b743ec8c1f9e9728266aeb47af143ff31ad44b979e3ea40c3e1dd6a39ade4
-
Filesize
408KB
MD5944fa46beaaa36e8174913a419584c0b
SHA1e0354735f8c3e3e98d9835225f82e428116c8f48
SHA256563c0e462e19139636b3c8fc7f09ee75e18fbad651c18f95cd394a50acd04e62
SHA5123976f1d4ec18ddb1005eab54684fd12741ee53e93f65713e8c2913b612d8294c2dbc30e1f2e928da6c0acc483689efc65e63d300c09d91854e53fa6a516833d5
-
Filesize
408KB
MD5fe574d7ffce8ba18a221915a8c56424e
SHA1f1f5060fc6db0902b57fcc4ba76f78434b8f0fae
SHA256a9134b47a5aef3263f36c2788a992def41115a9ddcfe7625493fc72a96142ea9
SHA512cba58311114ce9a1ca0618c05240a6e5e58195b8df67b18ba24937b1d4870226f8cd4a308764c5a3f263f9d485df5db85cd8a19f6c59ed8e19359ddeac30ae7e
-
Filesize
408KB
MD5aa59423c99934ffb648a78deffb91207
SHA138386a3e90fcab51b665e9a8414f0baa41da096a
SHA25699f183839be7b3aadbfb83dbd7ed8990f6abb6502d6ab5a34e8e48297cfd328a
SHA512ec4ea08bb573a989a5c11a6ba0233d63ea00379b8edf5df2a2d8b0d9786a6c9596256f86977c8ae2d41b0267738b8d15f6f0781f0923df2de645979004abd8a3
-
Filesize
408KB
MD59f51350b4879eb4a200879c1b523e3ec
SHA164fff8280af8728079c8bb90ce5343d7a25c3e62
SHA256047ae60a68fc8a4b4ec6be0c0e45ceb21c25d4d06c97526de32a035cf2418fc0
SHA512caab752da9379b31db12564e2840c8ad97e5dc5c103d97b0429e32879ac6e4cec6b1cb3c1160ae0b53f8bcc5db527103e0590a8901a5e30cc2d098dff1ead5c7
-
Filesize
408KB
MD5480b6709234ce437e807c492e7b4f498
SHA129d0724181f3fadaa058f453a443dd4f4f3bd5dc
SHA2567fd5ed02feaa212162344129a829b66afdc0503c624d2e1edee8758a64241ba1
SHA51279ac7ea29c3b024621c9c725359ff5b895908899372621881de44cb708a21445250508cbd7ae238d7ddb577b4c8b6c8a088eb8d789b71145dd274022b118a848
-
Filesize
408KB
MD5715545294f56c8e174bf1f0125ab7254
SHA112343f5ed7411a0af5652157cc30f88a30c894e3
SHA256ea22972efd185220af128b2fe4c5d956ecb4897f84e9f1f6d69794edba9d89aa
SHA51217301f6c59e2d6e8fa8051365ffe64ca4e27fc87c7663f32e965f0c30a6a5053dc1c64ffed654b48428206d80a6e200739339a537608d0d95e4f0a47d39aaccd