Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 05:54
General
-
Target
2024-10-10_3ffab5f973f165980ae605dbbdea6808_goldeneye.exe
-
Size
372KB
-
MD5
3ffab5f973f165980ae605dbbdea6808
-
SHA1
d4f64fd733444410af331a00a7caa39a1d8fbb07
-
SHA256
2d680038b4818f4fbcee04167d9957ba75580e138b0f598d918a2311db0bc08e
-
SHA512
927c61075c17c16d94852859d4c32dc8d184e05b1ccbafd5794ee73080855e260022cbd809b59d925537e9adeeac77dad22770755788cb4370a0facb50e0198d
-
SSDEEP
3072:CEGh0oMlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGelkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_3ffab5f973f165980ae605dbbdea6808_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_3ffab5f973f165980ae605dbbdea6808_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EBC9E0E-F948-455d-B61E-F4669A399EE5}.exeC:\Windows\{0EBC9E0E-F948-455d-B61E-F4669A399EE5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB65F36A-8347-4329-8157-36EC751B6D61}.exeC:\Windows\{EB65F36A-8347-4329-8157-36EC751B6D61}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EC42797-CCEB-49a0-95C3-7FFB24E1B777}.exeC:\Windows\{4EC42797-CCEB-49a0-95C3-7FFB24E1B777}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD2B37F3-6284-4b87-BE3F-E50A14E4DB6A}.exeC:\Windows\{FD2B37F3-6284-4b87-BE3F-E50A14E4DB6A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D64392B1-F048-4415-A8C7-4FF1B32A41EF}.exeC:\Windows\{D64392B1-F048-4415-A8C7-4FF1B32A41EF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{241AD8D3-3784-4883-B171-D75473C6A87D}.exeC:\Windows\{241AD8D3-3784-4883-B171-D75473C6A87D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BCD4756E-20F8-4779-BDE3-0014767ED638}.exeC:\Windows\{BCD4756E-20F8-4779-BDE3-0014767ED638}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E0076EC-F438-43e5-B40F-86566EC0C2E3}.exeC:\Windows\{6E0076EC-F438-43e5-B40F-86566EC0C2E3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7719BEDD-917F-4d6f-96B5-E703C954B595}.exeC:\Windows\{7719BEDD-917F-4d6f-96B5-E703C954B595}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E0B1646-B1F9-483e-810C-3F7755F1E629}.exeC:\Windows\{5E0B1646-B1F9-483e-810C-3F7755F1E629}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAE8BC5B-0803-4d9c-B37C-FE43C77CC60F}.exeC:\Windows\{BAE8BC5B-0803-4d9c-B37C-FE43C77CC60F}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{189A6889-1AF4-4c62-AAFE-7C1CD59BA7B4}.exeC:\Windows\{189A6889-1AF4-4c62-AAFE-7C1CD59BA7B4}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAE8B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E0B1~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7719B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E007~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCD47~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{241AD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6439~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD2B3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EC42~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB65F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EBC9~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD51206700ef197259c82cb8abb5c520828
SHA10f811f6a1194a44371d236eec594f335cabf3b23
SHA256efffd3fa92033a511b4d56165210757ec1fd462e3bfbba400db642fb11cabbb6
SHA5120409e24a2beb638ead46a05b68389cd76b9766d529dd32d1b27f195860f511da4c52c1f07431b1a79db973dc1f62c8626b5136c6bf3858b846013bd53f48acaa
-
Filesize
372KB
MD52d88119f9949660b3900e9f4f6caff30
SHA1172ffc1a61ab4e274b540d13948e1453879d23fe
SHA2560fb4e41ff9e7ccfff85ec18176c96c96c6f8a6326cf172d8da30b29a109509e9
SHA5122213754dee4a7021137e0b9149b5d8f6b6ade11c718fbc69daad1c76d0b23c7e131dcea14bf2c605217ef8f75a79273912d46b0bf4abd531032a7e43080d6d4c
-
Filesize
372KB
MD5f750a47680da40f4b6c3603959a151fd
SHA14d47075b38d4de078c723f26bad6b8903ed70b75
SHA25627e48beac7c275848c27559a089e3188696eac41cf777c113fd05e5486081822
SHA512666801ab629eed9966ae3718bdc942768b7a2809b55f464f24d9a52703f6dccad13b0f7a830592a6cb8b8078065592d463014ca2c111b9bfb8e46fc267ddf8e2
-
Filesize
372KB
MD5f0f36abf188170173cead37dafd345cb
SHA108c6d8992c6192767470876a76b747ae89b5da17
SHA256c435593f967a21cc7b4b83b598436ce310ccdad4903f4a39ce3831777232d839
SHA5129a1a7d07dbfbff1a940c359cbdbd6e5846e50a0dfb672bbcecfa03ea138ece94620ea413c65d18f9c3010b07625d3dd8c5e6192a21069a60fd1fa9a1e7ae28cc
-
Filesize
372KB
MD50a1c63c1e3c21855ba92b4dca3e5284c
SHA18246492bbd3f4e11d5ed091998436f6d0a3db3e3
SHA25667f3eeac66d1af8b59f7218abe5f00cd96cde954c7ef4e3d7da9c11f9ecd1aeb
SHA5127ba2e8acc26a64b0cadfbfee7846e343bd717a1a2f8d7ee1629db18d0f68047191bfe7d8b77f66c9078959e4c4dde4f5ea3b3021f2d4caf7445dd667b1f81153
-
Filesize
372KB
MD568f409224429a41f50b8b2b0894f8d1a
SHA14697bcb6ec41dfc06e8ab62aaa0f9f7426c685b9
SHA2565743dfb507a37bc55516e95f735141bb827454b30828d1189946f3b2a9914097
SHA512d9f5f96e16e2a9ab06493ad5ebf665db2b311df827532a4d8f59423e7d73e1976711932f064d7044487de6129ca0e0d7b2ab2b04675bddb572b26348c26c98cc
-
Filesize
372KB
MD56858f0f63689eb2d231c9abbdb092b89
SHA1db56f7ce97f21ef213f7647dde14922125c02d96
SHA2565f98a79b777622dbd7ec8fb6e6c268afab7ab8a81b1c4bc75822a28803796b3c
SHA5122203b4eb32250ec7e55f0699807e673d1ff6363bb4a39a4f11f32bd11a18e96e23d71126fa66fc553bde994b25d826ef686fc83364cc84909940bc468b76f6d9
-
Filesize
372KB
MD5ceeaa18806b680cb291d6b9267983c88
SHA121d1ac0ec63721ea624f7456da324efb526db5e3
SHA2565dbeecacc5e7a1c2c0b9485ec2a5928325d0cf6f45f09ed538133f16a5a35c5c
SHA512cbc4760ae7813f312de2303c9aee9797b58b4e8528c10a159ccb997918370441f84489dc4f43a0709387cd6766f510f4c306d52d3e6ab68d6de8158a9d2e7908
-
Filesize
372KB
MD541dba5011b60a8f26696273e3e2416c9
SHA1eb45affdf81af26549d00825c6d91b2664f0bdb4
SHA256a2978b8dd1bacb7306bab46af369b146843694eeeeef04d317d1d6b0373e06d6
SHA512e32f1013fd73247832bae82c3bd7ec00125b25238c784b4d281df5477ce3586bbd28756d588530ea49107178eb644b35e6e01c19b3649a1dccfca6da9eaa88da
-
Filesize
372KB
MD54c18385046c69b27a1706ee32916286b
SHA1334bf1a61ad4aa49b8daca38ebd44c369542a230
SHA2561be188f4c85ece74d3ea9bbd707c14e2844963666b1bbb41a3a3ca3fc608db5f
SHA5124aa3b10772305dcfea0072ef2e7dcfe0e573fdbc26cc845e04b482479056d92d2920224623f31c3517b17fb05cba46d4c120beba1bce8c7383af893771c86e1e
-
Filesize
372KB
MD555e550baaaf0a176935b9250ca1d9727
SHA14902b2cea3888968567bd81fc3f260e3d0438274
SHA256f7415df51a0232f4565a5bb3f609465cf4ff4526ad66aaf69a532b2211d6604c
SHA512f20bb1b242ced71ae08a5187ace5474f903351aaba4ac252b6da48ba870c3a91092bd2af610d523d387467f37e018f51ed704b393d8fafe861696c5ecee18ea4
-
Filesize
372KB
MD5a707b16fd50935d1521769a5ebe2ad56
SHA10dc3b6b6fc52dbe05e6f24b62388bbceea0f9022
SHA2563ba0c6f9366932ac7c10d5f83803545efc647d916a3d5b49fb0d72df96609de3
SHA512245e06029e9d658aa3f3fdc18b53421be3d23a16cdca67009f1858dabddf6522fb15648d29b4025c73b33b4962128e9f7dc24b61e36bac83e4cb72b5f608fe96