Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 14:38
General
-
Target
2024-10-09_cacfd063d386abc10d049f18c8a1a59b_goldeneye.exe
-
Size
180KB
-
MD5
cacfd063d386abc10d049f18c8a1a59b
-
SHA1
ab7984ae095a22cf2fcfcbce3f67a55407fbaee6
-
SHA256
6a06e947380a9fc3df7822b5a76e344e4d725deff627900cf15a9323c29f9e22
-
SHA512
a8ee3f99cbab1d4d7b5c0b019925fc1715f0c0a9413f6c325cbc0d18b56f2c01f5d50ee132998a9e286a68d72c64ad2394f677b3e56eeed0d12c210b3934f7e5
-
SSDEEP
3072:jEGh0ojlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_cacfd063d386abc10d049f18c8a1a59b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_cacfd063d386abc10d049f18c8a1a59b_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8EBB530-DB5A-4c6e-B021-AEE5496E5178}.exeC:\Windows\{A8EBB530-DB5A-4c6e-B021-AEE5496E5178}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4835918F-D96C-4c34-8932-A7A426952679}.exeC:\Windows\{4835918F-D96C-4c34-8932-A7A426952679}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E8DAF17-72B6-4ed5-911F-62B80914D2C9}.exeC:\Windows\{5E8DAF17-72B6-4ed5-911F-62B80914D2C9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDAE1FE9-807D-4c6c-A6E0-92081493184C}.exeC:\Windows\{CDAE1FE9-807D-4c6c-A6E0-92081493184C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AA9F47D-E92A-4f04-BA78-33660F36BCE1}.exeC:\Windows\{0AA9F47D-E92A-4f04-BA78-33660F36BCE1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8564321E-9EB9-4791-9891-6EF345F9C808}.exeC:\Windows\{8564321E-9EB9-4791-9891-6EF345F9C808}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20BF1E57-5671-4c99-AD21-9E1AC0477ADD}.exeC:\Windows\{20BF1E57-5671-4c99-AD21-9E1AC0477ADD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD4353C3-D605-4100-B7A3-B8513260FA78}.exeC:\Windows\{AD4353C3-D605-4100-B7A3-B8513260FA78}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{273CEC5A-BA1D-40fe-A9E4-F992F0902D5B}.exeC:\Windows\{273CEC5A-BA1D-40fe-A9E4-F992F0902D5B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E24EFFF4-16CC-406d-B3BC-36B5BF398AEF}.exeC:\Windows\{E24EFFF4-16CC-406d-B3BC-36B5BF398AEF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A40481E9-4AD6-4c95-9AFD-C7DA249C5C81}.exeC:\Windows\{A40481E9-4AD6-4c95-9AFD-C7DA249C5C81}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B89929D8-04F1-4c09-B302-9BB900C0E099}.exeC:\Windows\{B89929D8-04F1-4c09-B302-9BB900C0E099}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4048~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E24EF~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{273CE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD435~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20BF1~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85643~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AA9F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDAE1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E8DA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48359~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8EBB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD51230b72fb4d32acd3d02f3421726bea6
SHA1e40d7722d9bf35eb4342116436bda011c5d08215
SHA25641de86a24f104ab839ff837dd54837885a8c3a6b2c0c3bc4f6e16feab4fae520
SHA51208f548d134c0fb6cfd0d2ede414eb14490e4bdd85d99395913b909df80f9ee2d386209a6d2a1c142c5a4cddf3d063013199d7cef48630253b04af79ed41e48e8
-
Filesize
180KB
MD56b961a2630a59e2d6db855442042dc0f
SHA1ff40c8aa3ceb2ed247e929f0c047765cfbd64801
SHA25661f9c2493a6b304b9c6e4b7913d3a918ce32c6a0e613ee4661263e544ef5f7ed
SHA512cc727b26564e7c73b3cdb626cb5551344a484adc686cb1240d5f8929c0374a733e07d618318947feb630767ece29289080911ca7a8d03aae0d34fda40b128062
-
Filesize
180KB
MD5d2d64a143531af199c3b5011d1dfe0f3
SHA1f6768b0d8c759cc9d558f4c44ee439ad5da55de1
SHA2561a0ddd95dfdf14b99a480849045475b7824c0b56dcd05505415b91cb70e3c276
SHA5124435390105545151cbbb9008f387782767343a00f0d201dd9ca987f7d1f6170da4abb3f8404f98d0869e2d57121f387e3a512d4cb7b374c89580564ee0ff3bce
-
Filesize
180KB
MD506ca2b933ea26da0e3c656a0cab9b69c
SHA175ea9a84e96276b75ab5b63ba5f6299d0cd9d413
SHA256222f557e7dac7ec023e4a31d3bdef8dcd54e7dc2c487c3e364efa57e96d5d546
SHA512927505db8e248652c3df0175f39528638517f8f9eb7c3de96851b7a0099596bdfb40f32b8c6860429b578f5b2f277548c4144de07a2513c9be987b58fb9e64ca
-
Filesize
180KB
MD584134765a057ac3c87717e701d38654a
SHA146050de45b41209693f6381f38f93bef36ef38cf
SHA256a17524b4d44473ff5e8290bc904df078df4f2bd313f75c8e2fe6733c33335ab3
SHA512f6d041ad8f9772b62db6e782d43e18fafcb8106eb648976f5f48f1ff25b5a243556a11195f88ebdf65514ebfa16bc63fe10be040494f39c6055eb3e2485b27cb
-
Filesize
180KB
MD568eb821e9768b7cf1ea3d51ef54b30de
SHA10ad77f377d007ddb518e5b3a574a1e610f817c76
SHA256b182825ca7cee7a65f598542405c2a2d12e5ea5334c8a742c91926b4e84f4aed
SHA5120c5d531e1ed17f5c9e24ec750661baadb8f4fb01b4cd995048755aef6e909a21f0d9e5111f0069bb1b44ddfd70c6788f4295d84a87987e8f97aa2a81842c855e
-
Filesize
180KB
MD5a3bcdc9d7b2dd819a20302b268b8126c
SHA17a5322fa9483df7c67befaff43bb96b16c80d88c
SHA256abc5c9ea401b45f9080623d3fe9bfc8bc93d8fa66ebecc078aa616762fe8bc8d
SHA512308598f9e327394135ae64b16de9f54074f8595ee88456bb91cfc9fae5ed7595a0f0b8d1b4afa43d3acf5690c530b6e96f3ead986761077c3038c54d4e6a2420
-
Filesize
180KB
MD5d41068f9277f0673ad8c4adfb3f99978
SHA18129921e52ab13454e640615a46671f17a9478fc
SHA256992ee9de06e321b0eaaa9c06cbeef6713ae0c3e1c3fcbd49513efd030821e373
SHA512c747087fce4e2a0aa69c9aa5d0ccae885b56ef82bc601b838c9e3f56903b123cdd3aedbe853fa8cfc72fb2cb988f87fef8ebd918f535f72683723ad4ba208194
-
Filesize
180KB
MD5451018bfbca1a285fa7dad53ce630d86
SHA1b529a74f40a14597b9e81d2214d469d38a2f2894
SHA256b2ea7d99c76b7fae4c4b90de0f5fc0ecaef727ea40e8fca4b8441485a692f8a8
SHA512c0968c908cd488b4e441be0d708df73c6767d3138895d4eddd3e127488b640f6a626258e74d2a410dc17a02c886c6a442178dc30b4589cc8fd95942bcc3f22ed
-
Filesize
180KB
MD59ae16724fbcea444d6d539034dd40666
SHA122599f1eaae3fb8dc5fe919b56b036a5827fad37
SHA25665fb6ed46e7fb0066e7b63cf45fed707a5fae163e4911af063cd29e17be8883b
SHA5123d2e01481fb62f3dd11969e006c85a51ad6c4cad20d6c1ff63163c835859a71df35c634c77c51375c5e83c6f8e62798d44533a467576c587eac5d30c1123b116
-
Filesize
180KB
MD5dd1eb4a399f4ede2265b827cbd7529d4
SHA1679902df6e4913d9e2072a876e59d8d3be79d86a
SHA25653bab37ec6f627a712ea46c34e6e727b9f9799650be4e2044b345a80896ff65a
SHA512e39911c141ed9237075a7f0c265f25844ce7b332a6dea3e9aa32fad00d3dfcb43136905b423dff775abd6d4aa73d619d0be6ee57189944bbdd48e2e91a8eda7d
-
Filesize
180KB
MD513247582fa6ff06d977bba4ef6f51e70
SHA160de6cdb273295eeaf126c2554a1f33cd72fbc4f
SHA25603eb0a6451886d0cc1fa7ff37c6018f0234ecce3f1ccb0ab961c0623591a6e90
SHA512c04da6dbbbda251c41fae052a99bab49231636edbf3337debd897424630d42583c90d914546c95b4776d9468054befb9c9de4be3855f27eeb82061fbd55e5495