Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 04:42
General
-
Target
2024-10-10_1d0889fdec2627168a01900f77a7d641_goldeneye.exe
-
Size
344KB
-
MD5
1d0889fdec2627168a01900f77a7d641
-
SHA1
5f36c59d0c09849f4e41b850d5b048cfe03be67f
-
SHA256
b3d931f1f101f9e6e587e03a8ca85ee0df1578072f0cbe4b454894f3d678fdd6
-
SHA512
6311488f934b0a7bc77b6540d9405567dd7f3c2bce8ee13b7425b61a9b47abd4ee61e93e2eff2712d9affb3989eba9f0587c8215e6a25d1872e831d53dc57756
-
SSDEEP
3072:mEGh0o7lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG1lqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_1d0889fdec2627168a01900f77a7d641_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_1d0889fdec2627168a01900f77a7d641_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4ACBC37-37F1-4a48-8C7F-4001AEDA9081}.exeC:\Windows\{A4ACBC37-37F1-4a48-8C7F-4001AEDA9081}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3002C41-D35E-4f3c-A301-3D9D2108AEB6}.exeC:\Windows\{B3002C41-D35E-4f3c-A301-3D9D2108AEB6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96C0DE8E-BEF7-48c7-A6CE-335EADBD5CD4}.exeC:\Windows\{96C0DE8E-BEF7-48c7-A6CE-335EADBD5CD4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE876DD2-F2E8-4183-BDAE-6638C3648954}.exeC:\Windows\{BE876DD2-F2E8-4183-BDAE-6638C3648954}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F97A1DD3-007C-4f44-BF9D-63E7BB3ACEEE}.exeC:\Windows\{F97A1DD3-007C-4f44-BF9D-63E7BB3ACEEE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6CDE8A2-B450-494d-870C-94FE24A89C3B}.exeC:\Windows\{B6CDE8A2-B450-494d-870C-94FE24A89C3B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4DFBE5F0-1FDD-4c29-BB6F-3DBF1D8C9C5E}.exeC:\Windows\{4DFBE5F0-1FDD-4c29-BB6F-3DBF1D8C9C5E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB48A7CA-93AA-40a4-8F98-FD3BAEFD1DC8}.exeC:\Windows\{AB48A7CA-93AA-40a4-8F98-FD3BAEFD1DC8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01D4BFE6-8CBF-41cf-9C05-667384FFD50F}.exeC:\Windows\{01D4BFE6-8CBF-41cf-9C05-667384FFD50F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{665C871B-30C0-4620-BE16-54BA94261D74}.exeC:\Windows\{665C871B-30C0-4620-BE16-54BA94261D74}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB9F98D4-FFE5-4fc5-B5E2-7D4AB8943CBB}.exeC:\Windows\{DB9F98D4-FFE5-4fc5-B5E2-7D4AB8943CBB}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{33C21100-BE19-495d-A7C6-6DDF3B10B6C5}.exeC:\Windows\{33C21100-BE19-495d-A7C6-6DDF3B10B6C5}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB9F9~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{665C8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01D4B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB48A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4DFBE~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6CDE~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F97A1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE876~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96C0D~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3002~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4ACB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5e82bdc322f9fc3a4e941dfb5868f70a8
SHA133011f8f36538d69bc3f25737750bb5d21503d23
SHA256600253ab9e3e75f884b2b00c8801f42aecbd71ee56710d9739d8cecf017205c1
SHA51221affd0f984cd985dc7681cc2dd31fa61900ac55740218078b20d660578198b91a23cfe6215d9c7f3bbbbf2914fb00ac087f827ceb745973c910db730d9834d8
-
Filesize
344KB
MD5f2db4c933b4bef873105a5b6c91c82a3
SHA17ab9a5f108dbcb6f0558542d81a4793caa6f87fd
SHA25644135327defbf6715505bc721001e83dd33dfd593929fcbf5224995da0aa50d1
SHA51213c80d9816b7d30f602f7d74f7e4419b25db0a98934e9782f8ac88ff642390b34cb8096840b4837fbdce4a22d3694163702642fd2433cc5253992905ebdb29e4
-
Filesize
344KB
MD50bac16120063595cedfd96cd18b60cd0
SHA18a31c4d0141f4e731a461c350b4092502d41ae02
SHA256d9dc472076fe02a8121b87fe3d055c3c6c0f12c7519699f9206ad7792f3cff66
SHA512f803b5daf0983c101712e661de238648069c5885de388231e5291ea1f64e626f5b0b59553e2b003c2afe447896c93c6bd984eb0aecf63bcb3076718d7bef696f
-
Filesize
344KB
MD5c8f39e7f50d990bd6801c7806898e6f5
SHA1402ca0c02bfbc4d889cb4b43b6ead45dbab9f9c3
SHA2561971f413c4a6f87ffe9650acb700b99ec72e255e259d399ec9fe872612f1f862
SHA5125f89272bf7ad64ac5fdc297c7e1843326bad8f99197d8cca168e1d50e35d361d45fa91b1a78508fd37a100085b3dde70bf2293293e93a94fc90d75cd571204dd
-
Filesize
344KB
MD53605cf9a8a94c3494f8a87749f5c0a0a
SHA18489f4944a83a7d525e56c86db61949ef9a5423d
SHA256f3c565ea4e7a0de136a42a86c34c14271d7020c419ce6429b4219bff1892f70d
SHA5125a6343a501d67966102d4a2ba51307415c4de6679587dc463dc90b210dc4be259504aadc6870bab95c4f46b7580ed231b0d3b5b28df1d2b8bd0d914c2d10d840
-
Filesize
344KB
MD56861bcfcb5e788a7303c234ddeef7f89
SHA15d27d7d5543bde6d062dfaa2af22d6b6330ad99e
SHA2566ee61d2298f55257c6336ab028de8d8d701007aa94bc1e1af16f6d2fa0a4dab9
SHA51282cc9a655d895d2da72579706cd83c0705f54be4b6b972dfc48662c4d1f19be2df61c191067ef7a8cfa075ca17caef6eea14076123bf2b57439737b0375900a0
-
Filesize
344KB
MD5688f145434837fc45689a293c59c8e5c
SHA1f561ff8263ea9398b28faf52a7dc18b7d4421be3
SHA256474a68285eec7f8d2e2d8e8710ba9dc4c3e6b32f2e74e2936b5e22f7fde04617
SHA512893497b234fe7d49dfd85c55ab3f49c52a26e04b3185760860cd506109b9f0d3c6171f1bff9f06ae56fa2a8dd1d23f2afb692ba1d3b50f94a27e7a41e4ae18cb
-
Filesize
344KB
MD549ddf4b36d5a5cc7944d9cd443dc152b
SHA1e1a972ff47b16b996b012f3e520d8849c457c344
SHA2560141ecdd11be064f6a39121f4d16a33cc4461f8e305cd796be1cf3cfa3a9de1d
SHA51250b2dae6e2e1344f1c32a41bc3eb3e91998fd90cb3004a1273bebca3629172b0eb06ee8b8477c214b8784ca6aab478a3a47202cb71b0427168843dd3bd994604
-
Filesize
344KB
MD51f2ae64305d8732e7955174edba2507b
SHA139300f40036f010c3a3ca9569bd6f145f86e46b7
SHA2569deb6b654ac2b5b48d3282db2685cfbe0983623de5edf3928302258a4d662e93
SHA5124bb788c4af447056f8d7a8453399c890ecd97c562ed183a0b8b821d283c39b9563799e0a74ae903495241331e0da33ba15372f69ec68a81bfeaeb2ca9ee38a74
-
Filesize
344KB
MD58122e74d9e21d4da7d29612d681c7704
SHA18df2b7995cbcab84f92dd256702d4f0241ed888d
SHA2564442916a781785dd0a72aa416dd76c489024ec504655d1d7d317f0abd2b5bc7b
SHA512231ad74d6c3c8f35a9e199926aad6bfcdf33f10b7a78d3e70e68565de0452da1cc34a4a3001b57d23536c19609df5ef87076d4a8de050e384f4ebd7ba96a8b0f
-
Filesize
344KB
MD5b809da79eb0bad28d60c7467373089b5
SHA182688c899c64d4d3aaedb92a35b3a44a2607268f
SHA2562eb68fa216ac7f34c2e545ae020c22c12f3241b8f835469c99a0c9b108cf4110
SHA51266e262641077606071afa29b4d5e629125a26c4b6d31fed242ad7b2c3f4dc53b8c07197377c1511c06f9b010fc884e029b7f24ceb5b6cdac6f89461bec7dd7fc
-
Filesize
344KB
MD5b963c60ffb20da20c92ab047a78ff5f0
SHA1c4b2b988ed553080317ac8c4c17ba3acdf074f8c
SHA256660ea651bd7e9e558ed0a674e1732d6681308df7ea4d025fc920d5a0274745a9
SHA51258b956885ff6c14ea2a5e2e4947a09214f3ec615de6578311e6fab90ba5c414fe71bd9505678df277657994791d953175ff19674b4885b8674c5f03704c1534b