Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 13:47
General
-
Target
2024-10-09_0a31ec7040547f354751f0718fc72519_goldeneye.exe
-
Size
344KB
-
MD5
0a31ec7040547f354751f0718fc72519
-
SHA1
32c71d13117340c71a3d62be92964bfc062a9f51
-
SHA256
7bbb26088bab575db17cac4ca497efeb8b4d8af4e8d4a2bc0048d7a81d127dd7
-
SHA512
ccff12d22c938a3a2936957912acd47238afd9336ea3c3aa078713f2a47b9c226e847770a749b7d513eacb1afefd80b5c9d1edf5c8056877ea46146380ce7baf
-
SSDEEP
3072:mEGh0oNlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG/lqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_0a31ec7040547f354751f0718fc72519_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_0a31ec7040547f354751f0718fc72519_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EAA21CF8-5A79-4025-B84B-BC1BDCFEF9DF}.exeC:\Windows\{EAA21CF8-5A79-4025-B84B-BC1BDCFEF9DF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5AEA856-60A4-49c3-B35E-E0F90619F4C9}.exeC:\Windows\{B5AEA856-60A4-49c3-B35E-E0F90619F4C9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6E4BF29-BD22-404b-91EC-343911E51F0C}.exeC:\Windows\{C6E4BF29-BD22-404b-91EC-343911E51F0C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{757B10B4-92F5-49a1-B1DC-A513310C6DE6}.exeC:\Windows\{757B10B4-92F5-49a1-B1DC-A513310C6DE6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8EB0643-6CEA-47ab-BC95-FA5E0E06884E}.exeC:\Windows\{F8EB0643-6CEA-47ab-BC95-FA5E0E06884E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5800D56A-922E-4938-903D-55D486C44149}.exeC:\Windows\{5800D56A-922E-4938-903D-55D486C44149}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C0CD141-B64D-470a-ABD0-7B55AF5E7A93}.exeC:\Windows\{3C0CD141-B64D-470a-ABD0-7B55AF5E7A93}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F739C6F8-E50C-4e05-95BF-B2B33F2967E3}.exeC:\Windows\{F739C6F8-E50C-4e05-95BF-B2B33F2967E3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFD70979-E3BB-4e36-A36A-A0CC27C8AA6D}.exeC:\Windows\{DFD70979-E3BB-4e36-A36A-A0CC27C8AA6D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BF2F5350-D6CB-4873-8A70-1BA4005C146E}.exeC:\Windows\{BF2F5350-D6CB-4873-8A70-1BA4005C146E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADFE5FD0-D7B2-46db-8FC7-F964E5E3A4F8}.exeC:\Windows\{ADFE5FD0-D7B2-46db-8FC7-F964E5E3A4F8}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C1BD4263-3A5D-4d35-A549-08B36F0E2A0B}.exeC:\Windows\{C1BD4263-3A5D-4d35-A549-08B36F0E2A0B}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADFE5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF2F5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFD70~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F739C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C0CD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5800D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8EB0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{757B1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6E4B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5AEA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EAA21~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD584436caf9970021ecf7bb435f3c5c34e
SHA10b8eb0414daf5f1ee250ce703a8d98f2e6ff62ae
SHA25608c7987e3ba314f43048827ec947f890f91b83044a0c0f1440081858eea2c0c5
SHA5129df44b906c62d8a368b2f137902f9409682a96bf4c7cec3bae081d3e952ea58a4567da9195246caffaaea09350e727b752c536e183a08c31d02dc7ce552e9962
-
Filesize
344KB
MD59329dbd4af7c2b1c778c480db6c661cd
SHA116465339a4ad13def31d0af1b51c922c0dba7cef
SHA2565161ad5adbbad3422429e53ad1b4a7b886ffede1be6a1a27aae828482c082fdd
SHA512419618b2859e2a5e1c30d4ffd2851e9eaf0ae502a04995e9cc2f51a4978c846452756b9b8510560d1a21d80f247bfc4686bd38b778a8fec50cf9dc18b040e211
-
Filesize
344KB
MD5227ba8f4dd4696c9caa935b33e9f540d
SHA18dda3e33f586a411c7a004d1074499552385f362
SHA25602480500a6b4cc4db87aa352d3534b4a3df3c8244a5955c3b5aa14e6ae322a9e
SHA51221ce8505a48cb1019dcc70bcff35f7a64e6e97a06b02954a4a4cc155b6fb15653e25ca7ffb920627e7ec0dc6d31af1889ced8b9e2a382f5b8cd11abbd8e432d8
-
Filesize
344KB
MD5a475de04c3e52e7e0c3ead66f092aff5
SHA1b05db49f7075758f347fb473aa45960b7eeb9098
SHA256dcf54b1c038280b23f14d5a409a1547685c088696fbd82162ecb359f156e41cb
SHA512262f0bee13a30edff6d91dee0776340a72f76169bb3323f298f8cac9d6281927bc29c11a9a27d16f5b8cf5092048532a693202cf62f9620508bc8b960ad9bdd6
-
Filesize
344KB
MD5900a76722644c21b47c5470c8242692c
SHA124f998206df1aad846471facdfde527938f98f91
SHA2563e454f65fc91145186d6be54e46ad6581c707b420761f9e0b3a475a54648cd18
SHA5121917fbdd380ece8032c88c6cea0434ab16090b14a5f9eaf687ef0aa4889c550d53a8a70962392c015ef06a42d0165196885e36a6f0bd39b15373a949f239f4b8
-
Filesize
344KB
MD5e48e3aa467c48ee689bb40cc875fd6e5
SHA12de6172d93d39e6744b1e6b25bc3be082607593e
SHA25663af45e950718cec4a1850390a6f33b3f57b735f7f8681397b68abc1e517a28c
SHA512d5fe23b218a8510d3f90f20915f54285e0cee17dddca26dd734e1b2cd7471765ffc05298cdc2f059bd5722e6b60e350dd1e2f973422805f6f8a5abfbc90aa22e
-
Filesize
344KB
MD5c64cdeccbb0b28bcea01fee9f1125c64
SHA16a680b73963c6f68a06175dbaef78644478202c4
SHA2563a27d236bb935959452de918b44380afcd3bd5c222099dd972ce0fc2aafb1525
SHA512f45bcce46891a366f8756094bd4ee3f9f09a87924e3a4ba639d3bc5ff3dcf5448153e618aae8e70cbb7057c7d58baeb78dfdf92476b1a8331fda554e4d6cb90a
-
Filesize
344KB
MD5c1f6f9853f594031448994ed726a4e93
SHA1fc3cabed0598a50a85795c1bbcae1ad843140614
SHA2569b3eb8881e1f469086a53628f3612ec74fe7da1816f8293210e5605892cd2fcd
SHA51281b8ffe1f8f7921a4eec1e5baad80d73d855a506a494642da0b5751da45a3ffa56e9de6d544bc88ef0bfe08d961c535a564898f5bc46252bcf9bc23fb4a97c0e
-
Filesize
344KB
MD579073d3d4e7d5bc6bd4e2878f3456fa2
SHA1c5be251f725c4c4ed2ea33dc45f94f3138c16248
SHA25606b1f2df9b6bc19821d8c16f62891c5061b36e31b739d43c2b515652da92b4da
SHA512a1cb3be769f9c0ba4c33ba66ee31c20d0cf9f91bd8d27d0b878260f2805ed133e4611f027e7a1f1026561f9bc0e044a58f5ac93667fd573063b27d9221deae52
-
Filesize
344KB
MD589224e29a1c53bf716323ffd4c5a50cd
SHA1eda897849f05490e81622b5833065f07dcb74bb6
SHA256d4d6f99720d57761697d7158861cfd1f6ab8b4526498b03b8e0cb9187d84d8d5
SHA512a01451f4c1f7e6616adcd288fb5bfadd28a29bd3542ffa84a6d0042b5c52c730c334550ea4e17593c4b08a3b4aa7a5f16e361ef124a56a7c764a302aad847e72
-
Filesize
344KB
MD54436d21db1e51c9baf0cd1f56fea826f
SHA15776edc69ee7eb41ec305108b9244d6d50ed1387
SHA2566ce649d6eab88a58d7ee360053fc3829a294a6f6556a3243454f99f6811f2427
SHA5125d49bfa8e7c62c1244b573bdc871848140d7e4ceed20c0ca1954471f234af30322e5f4f883254aebf2ed2dd6428b47447e7180650420e0eef303cf0a5c35e5b6
-
Filesize
344KB
MD592ee9b2b05365357b6368692768e8f11
SHA10b191c6935d13939ee14950160cfa976cc296c38
SHA256c18b5857a1f2d1e5e3cba39c6bbd7c3b39af59e2bd848173dd63f53b8420431c
SHA51231dc7e322808dc889540468f5341de0265f1ecf8cc88835820003068d8592b8011cd46997c108fc4dbb627c74f3662997a29c18554dfafa4bdfdfb06aa5db6f2