Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/10/2024, 01:10
General
-
Target
2024-10-06_ac700a3a5cc2562081a61dea9474b9a0_goldeneye.exe
-
Size
180KB
-
MD5
ac700a3a5cc2562081a61dea9474b9a0
-
SHA1
d18e846922169c64fda7818b63bcc5dec8f562c2
-
SHA256
870d6fd0d5e131d5de4ebe994cc4640bf45a8f0eb3a459ecdae4e23d2ff2abd1
-
SHA512
18b14da78da5b87f50e8d5097208b8f0280e8fce4d4004728397c71d2d88f41acfa5b002eec9720026a18bb1f709a99a4674405abd50cb8e966792747a813029
-
SSDEEP
3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-06_ac700a3a5cc2562081a61dea9474b9a0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-06_ac700a3a5cc2562081a61dea9474b9a0_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{22F5E378-ADF6-4464-99F1-0B460F2254E4}.exeC:\Windows\{22F5E378-ADF6-4464-99F1-0B460F2254E4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8849D9CD-E4D3-4afa-B924-4DD8AEFF627C}.exeC:\Windows\{8849D9CD-E4D3-4afa-B924-4DD8AEFF627C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18960EC7-6117-4fda-81D8-061B3217DCBA}.exeC:\Windows\{18960EC7-6117-4fda-81D8-061B3217DCBA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66C1C9BF-5D7B-4fab-BEA9-AAE8BA3C511A}.exeC:\Windows\{66C1C9BF-5D7B-4fab-BEA9-AAE8BA3C511A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE005283-58AB-43f1-80E3-43B477A66687}.exeC:\Windows\{AE005283-58AB-43f1-80E3-43B477A66687}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA62E438-9BE2-4279-A329-433F06F73738}.exeC:\Windows\{DA62E438-9BE2-4279-A329-433F06F73738}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF58FF0F-8FE7-4778-AFB8-3CD7298FE5F4}.exeC:\Windows\{EF58FF0F-8FE7-4778-AFB8-3CD7298FE5F4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C06408F-98EB-475e-A307-81B715BDBE53}.exeC:\Windows\{4C06408F-98EB-475e-A307-81B715BDBE53}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{872E3E81-3557-4611-A9A2-7B1343DE6E6F}.exeC:\Windows\{872E3E81-3557-4611-A9A2-7B1343DE6E6F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21F0E764-A459-4934-B170-239EB4D2A20D}.exeC:\Windows\{21F0E764-A459-4934-B170-239EB4D2A20D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D576FAF8-F631-4d5b-822F-D6E8CA94B358}.exeC:\Windows\{D576FAF8-F631-4d5b-822F-D6E8CA94B358}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B04D871C-908F-461c-A24C-0F5A0A3B7DAA}.exeC:\Windows\{B04D871C-908F-461c-A24C-0F5A0A3B7DAA}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D576F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21F0E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{872E3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C064~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF58F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA62E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE005~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66C1C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18960~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8849D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22F5E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD53dae5f935d1315f3b151f0c1b401b516
SHA1243eaaecb36c1cc1ec3a7c0886a0410a03184459
SHA2566c4738336ae86067094ebec6753adcf592da1759c4fba1e7a886e58585bd9e33
SHA51246edd36667b66ddbcae7bd836b660269724741e9d92dccabf6ffe3c76d6e6f9f3d6c4d1bc3318e7d06bfb43dc2aa66848051de2614eb2d32b844b68e2fb90e00
-
Filesize
180KB
MD5b88245eed5107d9e4116f176491004a4
SHA1e728a92b2391b6a1a7e170b47ff79d6120c4b158
SHA256465f72151ec6b80edc447ef55d8cdc38725a5b054df279027e22acd84cbc10fd
SHA5129815e35ac16362a816c369f05b5dcf6b4648d888ec2c8f721a48ad1e0349eb316c6e323e7702f5b16289b8d643fdd560aafd830275f75013362545cb4ee3efbd
-
Filesize
180KB
MD55876a18ed08e21627f24fc4e93be8fbd
SHA16f913b9f0ef9781dece5dd15acb91dd42beac0d7
SHA256a163b92fac6e7ad15f6809e73329183364fbb0d8c6925f0cfdb019df128fa018
SHA512dd3f5fd2080f689a53f91d7a7175d44601878a1c3cf7b4c5c3ea4d7c45dc4698e0bce5325e47303c94c67f111358545227dc45dcb4c84f41c12ad0a2a0a1f4dc
-
Filesize
180KB
MD55c9e39ab81de44f9b1eaa8f43fd44d52
SHA18cc02c681ac9607523091bd0d56158f3f9260df0
SHA256d5836743833fe0cc4c59d13b8e96822460256b16121103f6aca87cee7f326090
SHA5121c73bc1154f481a3a6ff67a6bcc47b11c4cfc0ad7a9578df4c4afe625ffd47ab7cf00e62f848d53797cb7324b873431103b18f62d13b1fbcfd57431d66b80d2c
-
Filesize
180KB
MD5db5f61ab4163443a71a9d32b918a23a4
SHA13beb68ae830278996e5e95672680bd0f5f76804c
SHA256249e6096fe007130afe27507ad3497978ebe2ed47a684bea3f0e31f4f7f77cd7
SHA5128b50cd66b23432ebab1907f4a71ec05c032a1fbf54d55f6f8ec3663a4fb4fb317773eea7aa087125442d9e3eb03c1ac84cd1e6eef57603ea1505d125a62a1271
-
Filesize
180KB
MD55dd8aecc2deff273f7b2c57acc8627da
SHA13fcd9f4d8275813f36b95814bab74fbe461ae7cd
SHA256677bd3a6d2f867b1c1b9a1c8c2a2e19cb4badd700506ed5ea6a7ce1a66f71cd4
SHA51277e986c6207eceae39bf03022746757687a78685488ae577a5b400b23b31baa57c31e3460203e93fd023120a926d1eb29b58bdb5af20132936e3470607069b95
-
Filesize
180KB
MD5a1f03428ee48b071a8ec3c91646a6933
SHA1f38dc10e518c2103bef057ca2e9758f690f1346b
SHA256619f707bd4b5972bdcc5fbeb0956be5f254c5820d02e670674cf2bef28de8d8c
SHA5125d4d4278c94b288701c82e67efbf3ec8c4ca294237577b9cfedc73b4e7b86780c0bf6c0a8940fce29bcf17a8fbde4e825c7675fb1f8283668a49788054aab20a
-
Filesize
180KB
MD59ce8c54eb82e9126adc58b18bbe82e84
SHA1d7d6f797d3f6298db0093b78f9ecd227247af7a5
SHA2563bbe941cf6ec9170bb511e3843e6a705840982e6f067bbd8337959ee8b7ca3bc
SHA51217395d703eb5fd4af452dfe6500211bb67d5bb4da86911c927f39142207a97eec1a0122b7711328cda805f941838a2c0a76ff3476fa7b0ad6ded0d605724b80d
-
Filesize
180KB
MD50ced56278bff789c3adb4b3dd0cb0bba
SHA185b02fec54840bbfdc0397465e02123edc503b32
SHA256a1508cc544b19b57bc5bea3584b9f5024a6bfbba2c3f74d4a81af63d194711cb
SHA51217ccc3b4d7396b0b31d41905b2b3f6eb32436a73f7c679054fe4e73c9e0c3bf2f461c9448d0644ee6992dbf3b083e0574ce0e3082d1ac0568c5f02d64cd53b8e
-
Filesize
180KB
MD51094304d36ec361fa2f50b2c4f56dd1d
SHA192c7d736fb70fec84ef5556031be8446e10c2340
SHA256e9819edddb530fd604655819a6890c0b30d078da681f03fd5e099851297cc367
SHA512bcaea11ca2f3ffaf17710c912dc16a4b5f9c540b65a51ca45f07a1c0a1b57300ae10485dac600c11d02d3df0cd6ddba8e8e8ecbbdd414263c7be2022c1aefb31
-
Filesize
180KB
MD5b1a6609c40e83d12ab911dde27c0a92e
SHA19a65fa2db81fc79f456ade41d1b50582cd697be4
SHA256098f012fb1b78e662866cd5f5ff4b56e12c57eff76c246c08dc3e2b4e584b48f
SHA51265e1b404bf8a432a9a98a546652cc8c64bc874adee4ebcdd0c1b30400bbc910449ddb9136b11977f96444fbc53b56069f8ebaefaa91651bd37b63dfd59368a54
-
Filesize
180KB
MD549d274bce348e882291a4d2b2aa1c489
SHA1218d87149ef97086dfe7f0e92c2b3c7a6f01b683
SHA256fe668defa92078ddf88bac7770f05bfa30206dfc088db2d426856227a512eb3f
SHA51230dcb2f6ad6a48ce3830e2fabd175f8910270dc1501799cf3580c51f41c385fa03b1a078fc44a6f865fc488cada666b5fa45e31426b0f89b8acd82b653cea105