Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 05:15
General
-
Target
2024-10-12_d0f74590cab23dc9c9d284bafc5dce73_goldeneye.exe
-
Size
344KB
-
MD5
d0f74590cab23dc9c9d284bafc5dce73
-
SHA1
0ddd60208833280c4fbafbca6cb519d0539a3c51
-
SHA256
1e6d5b734f29c9163809ae06b6f986a1400f5313227c3cc40af400677ab84d2b
-
SHA512
684e5ccd91ddc669a72bea505c386a8b87b7e6a2d0cce60294b876029efff18fbc38ede734bd261551127a09892fd0ae73157d2c0da5d20fd7e4b5d324053ae2
-
SSDEEP
3072:mEGh0oelEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGAlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_d0f74590cab23dc9c9d284bafc5dce73_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_d0f74590cab23dc9c9d284bafc5dce73_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2FCF36B-5680-4d45-9694-DDE960DC08A0}.exeC:\Windows\{B2FCF36B-5680-4d45-9694-DDE960DC08A0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C212AD84-DF7D-4f5e-B8A2-024D604F657F}.exeC:\Windows\{C212AD84-DF7D-4f5e-B8A2-024D604F657F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3398C44F-56C2-42cd-A99B-F03AE64511D3}.exeC:\Windows\{3398C44F-56C2-42cd-A99B-F03AE64511D3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{086319D3-1113-415a-B721-935520C32D92}.exeC:\Windows\{086319D3-1113-415a-B721-935520C32D92}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8ACC1BFE-88EE-48a2-8997-9DCB85AEFC17}.exeC:\Windows\{8ACC1BFE-88EE-48a2-8997-9DCB85AEFC17}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C87FB13F-B49E-42d4-BC3B-94681B214DF8}.exeC:\Windows\{C87FB13F-B49E-42d4-BC3B-94681B214DF8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E4EF916-CAA6-40c1-ADE1-B8AC4875062B}.exeC:\Windows\{3E4EF916-CAA6-40c1-ADE1-B8AC4875062B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C31F4C4-92A3-4ade-8EF5-A8E59EC0EEE5}.exeC:\Windows\{3C31F4C4-92A3-4ade-8EF5-A8E59EC0EEE5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{815ED5AA-0C0F-4e60-8864-DE9764A882D5}.exeC:\Windows\{815ED5AA-0C0F-4e60-8864-DE9764A882D5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC8976BF-B1BB-4604-B85B-D803B7622998}.exeC:\Windows\{BC8976BF-B1BB-4604-B85B-D803B7622998}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C574985-3E93-49f0-BFE1-AF7C7E7B3279}.exeC:\Windows\{5C574985-3E93-49f0-BFE1-AF7C7E7B3279}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{BD52B7C9-7D82-4db6-B94A-14F1102E899A}.exeC:\Windows\{BD52B7C9-7D82-4db6-B94A-14F1102E899A}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C574~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC897~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{815ED~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C31F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E4EF~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C87FB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8ACC1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08631~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3398C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C212A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2FCF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD57fd25fdd2dafe1d1a53a6e871ed16df1
SHA1dce9a0b1fad731a2d8f6577bb125231181c9f8d0
SHA2566c4c1d2cd5b8b2f7996c11fc2b2531e4376b61544b9dfd5cc2071d42b5aa6875
SHA512a8e9e0e93825b430edffe14ce0a8a25016f821e7f9d8fdea0c48515ec3c50d6f39388309b0913bb970ec1798c31e4b7ca047035a97d235bfa943abacde72e0f5
-
Filesize
344KB
MD53e8320b53927f9cf5b363dccb91592f0
SHA15697da2a2aec9faf5a083d4d3fa2aa0ce5594f93
SHA256647960724aa76118a23ab30975445051177d67976defbf334a97f48830a57bd2
SHA5125ccb43dc98215fab8c26a961970b8fdb551fa72e4db5595bc4b29189f31cf108d7ef53ef129c217867a569d5d81a2eeeab923baf5ddae3c5aaf0c05e86fc8439
-
Filesize
344KB
MD56629cab3d6c99dfaae42d50ff82117fe
SHA1ac1a10c0d61b3994b072c5e1ad11651eb6504fdb
SHA2564391e8b95bf2d886c6000e50c9bbdd1fc7da2ac11ac1045acac78469d4f787ff
SHA512ed99cab6a41a08eb1cfec7651439d7efcfe523a463ebebef6b5c67075090724af61ed141e6a2111f2d16169aaf5a009f9f7e95e51c98b511e0d71b325d68b2b5
-
Filesize
344KB
MD5fcada77bdcd7ec9bbe629c069ab036bb
SHA1566d2e62b738eeb4865c49ad3682dd47f2a0b03b
SHA2561446053e488fd8278d85e080c0b9a0ec29ebb9f70b3adaeecc5acd27aec7416b
SHA5120a8a10eb0f6f4135793d903e7fb839effd74db3e4f52457bf28bf907f7a07e9f45997e0341698d9ff5eb3ea8b6610492f4c081f70e3dfcc74e300066130258c6
-
Filesize
344KB
MD59269f7808ddcb63401568d07fa58fd1e
SHA1f1c5bcefaccc040f3b2483e431099430f1332f65
SHA25682196b4b57521e22b50842ff1112aff34df2e9bd29a8095805c3727a2166e403
SHA512b5fe7c56dd53c6603565e29969bb4726b546c855b01c3eb065edf07557dad5593b370e52e29ea5f692f897e903357b99cd88b4a59ed44d0a1bb8b81f90f557ef
-
Filesize
344KB
MD5378759a2f36ebb3b3902adba78a27196
SHA15a6bf12e07815b726f84c6b8c2fe4ddbd36ceecb
SHA2564346775ae2a25551f0ecdfa0034cd24e0fccf7859a9a228a9d64dcbe3dea719d
SHA5122b4034112625aa6ce8b699bfc77b2d8105847f2482fc34f42ed25e054cf8c0f3cc6603ee63cdbeb552fae2eb1d9cc9af10a908bae9c40b29d1d744c3d725a02f
-
Filesize
344KB
MD59dc1d5e362d043ceee43356a639c6509
SHA16b25503d00d9a9838977fbaf664538690e4d75e1
SHA256d47e8c794ef875d3023b46dc2b52ed9ad520feb000be3546890301b48407679e
SHA512528191db47d69dddc6be73123c0dccff4d84bf58c8e5930dae17ecbac5193740622d4f8e14c0f9ed87a4bc9dbba49f6c9f77a8c472053980a98ec76b3a21f1de
-
Filesize
344KB
MD54c26d0ece7d772128bdcf072036a3442
SHA105c1cce9b6003592a882e397fcdd4d2c34511b78
SHA256a772166a3924be160acc0c6db3827363263ced7abfc736d8d614f7968d711da4
SHA51243fae431b3135ae83a4bd7cbc01cf9d978ecfe9a34d20bf236c7cd951d7982f976b5c78ad319cc3e9aa5b5216fb75706c4b2d6a03a01b2d9945efcb88f7d7024
-
Filesize
344KB
MD5254ec43e2b58010dcafdab4ac52d6736
SHA14fd55698b62b985fa9f1f9275dc27eab8fd5a561
SHA25644a1f5c407dda4832877d62ca713717a506ca382026252614779e65953893992
SHA51268776763fac5e3a1116f2271d519551669a149b1cf1c8855ae15d6907a52d1116e054cbf8b60d5df073e5ffcfe965fa31e8c75e1c904a20dbd74346481468cb5
-
Filesize
344KB
MD5d43cca9d03b1dd7b05bc52d1c550d568
SHA19533643d62417ab626af3506e6b5adc12e5eea56
SHA25646a9c537412b257ab4862a3bb02f8606af8af2d82b35648e867f138952535073
SHA51278da9e670c1478b7f53f7239bb8b6eab323f638fb5656d744180bf3a0821121200a351e5c64ee0a0235e542776e76306ec69493682970966979e755ef5684fb3
-
Filesize
344KB
MD5d517c1c1da836e14df18196295d03cab
SHA1aa7b552f16e0040b8075664edd4abf03747bf901
SHA25625f81dde4b555a4b5d0f931a2414d37c61154b5b73496703b50e2e0ac0082739
SHA512c9b9a04165c10b114dc2c983da2100c2456fc969d321ae8ba97fec61689ef1e1b3431bac99880627b7b5255204ee1f545e34c772870024680c6bcbb11fdb41f5
-
Filesize
344KB
MD5e909409c4f3fc4311e2b0d0d2b2d00f4
SHA1696cd15cac5384dd1a727e4294bf2a08b85acb31
SHA25609a4b89b45b72f6b892144ef1ce3a6123755f2e26cfb4355af69ce0ab7c6ed1a
SHA51215e67906df1f369e9d7b8efcfdc16ebaf273a4cc83b2efc2a8c154d5ac068f640342adb96109b70f93638f38563a5ddec44f10aa0d0b0e62bb771854ff552a0b