Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 05:48
General
-
Target
2024-10-12_ff3096404099df6df0b3ab73f94850ee_goldeneye.exe
-
Size
168KB
-
MD5
ff3096404099df6df0b3ab73f94850ee
-
SHA1
46fe57291ed5c6a386e9ca617f6bfb9b0e98f82e
-
SHA256
1e376628cccd44fdf577f025c57391f359e9611c0153a5db49b718cf9b5e9d1a
-
SHA512
096675d920e62cf972b0cfa6255b827ce716eda5e09f845854c799e2e07d7978ccea923a461843c9f69d36d9d3e639d891bc53d9b701c10b8d1d9e59a61fba05
-
SSDEEP
1536:1EGh0oolq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oolqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_ff3096404099df6df0b3ab73f94850ee_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_ff3096404099df6df0b3ab73f94850ee_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4690342-D544-4cef-9AEA-E6E40DD615F0}.exeC:\Windows\{F4690342-D544-4cef-9AEA-E6E40DD615F0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02963F5C-9A78-40bb-9B3C-D5E7D0DAA784}.exeC:\Windows\{02963F5C-9A78-40bb-9B3C-D5E7D0DAA784}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAADC031-F720-4d20-A062-768EFE97C491}.exeC:\Windows\{CAADC031-F720-4d20-A062-768EFE97C491}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EB17E25-8BCA-4daa-82FC-3B94EFDB7026}.exeC:\Windows\{5EB17E25-8BCA-4daa-82FC-3B94EFDB7026}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83CEC23F-2529-4bf6-A1D4-94E4C794DDE3}.exeC:\Windows\{83CEC23F-2529-4bf6-A1D4-94E4C794DDE3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{613C07CF-206E-4354-89DD-6D983205B135}.exeC:\Windows\{613C07CF-206E-4354-89DD-6D983205B135}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74E1C42D-DEE1-404c-955D-B204B322CA9E}.exeC:\Windows\{74E1C42D-DEE1-404c-955D-B204B322CA9E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC25CB46-6239-4c5a-8F02-BA176F2579DA}.exeC:\Windows\{BC25CB46-6239-4c5a-8F02-BA176F2579DA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C2D0E18-018C-4f66-83FA-499CEEC4120A}.exeC:\Windows\{2C2D0E18-018C-4f66-83FA-499CEEC4120A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D589529E-28A5-49b2-8B77-F05193635C26}.exeC:\Windows\{D589529E-28A5-49b2-8B77-F05193635C26}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B919CE9-88DA-4617-B3B5-32076D37F51C}.exeC:\Windows\{5B919CE9-88DA-4617-B3B5-32076D37F51C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2BA9A317-BD5C-4f2f-8E3C-AA13B5077366}.exeC:\Windows\{2BA9A317-BD5C-4f2f-8E3C-AA13B5077366}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B919~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5895~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C2D0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC25C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74E1C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{613C0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83CEC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EB17~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAADC~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02963~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4690~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5d2e11dbf7ade33d6055db7e3bf154b05
SHA1e39c527c14d590e2109a7fe0e35027e915c50333
SHA256b319e16d35e694f0fcb389697e44431f1a0cacf283ea990bea1c5a2d68445b93
SHA512daa330c6b8f80ecd943b1c3e2509a5a81d0812ded107ff4f8aa3eeb5a8c5571d48ac41b941ad22ffc6633617ccd74663cd2abf330fc7ada98a10ae981773ebd0
-
Filesize
168KB
MD520c52633303a7463c91c8a3a964cb383
SHA19efe2d75d926797d497eb7a0ace960add4d96a8f
SHA2568748f4d07e6c18aa57f73df4d7d5385b65b242fc27b3a60e51f03da5fa9214f1
SHA512e2b89aea504b96e56717f324aa89becebd53fc472ee7dc6f654766fd4778bf29110d42105abb0a8b75f7035cda8b05fb2359f89c05897913bec92daeb742b2f1
-
Filesize
168KB
MD5b19f71eb3495a4f838c2c83d813b7adf
SHA1c182873b7d86ddaf0dce291e146ababc6a92461f
SHA2567f33d019c5434ae000285795855fe35f4388c3310fb31cd8acdd0a52a21ec376
SHA512e8675fecca1769b7efc2cadbb20d3a1d0bb2be6452339e2667606c1172c2cea7030f09b3240226a1449d6b288a58b5774bbd3416b53b4a438edbd4a19ab259bb
-
Filesize
168KB
MD56a5f9f69f12e1175973c1b58350c153e
SHA1b274cfc765eca0da54d26bd9b475b64e20e3f449
SHA256015c4353f0cbd079701610f8d0e2e113af857bb5bbcc6fb1ab58444cdea2f2f4
SHA512dbada93c9f0362d54ba015477e27525e901da9c301f21ff4616c21d50d92fcb7c9037b5669a44866b093b2b9872e8634d767d5faed3f7406bf4a651513e5a366
-
Filesize
168KB
MD5d71271e204fbb36fdb455beed5e04475
SHA164c4c42f64aa04a153095a0c52b5339601b45d9d
SHA256b7cd8f222a4bad0cfb3c28e67052816075b856fec547eb99d5d0475b2bfe914e
SHA512aa6a583fe006e0960300dd2dcc92a4c2c420d73ff402b847f2f3a2be3fc4890d4c3d9d600e3b9ee6838366d5fafb05e3fa54367aa11dbaf30237adf560fa3da1
-
Filesize
168KB
MD5c80cef28ba55e1636499119372169e1d
SHA1a6ee61ecf9036a34df763a8a7fc0da9f7e4b3f65
SHA2566a69f28c7f9f5cfb60884a53357a624f825a07578a75591900f51721573ea9a2
SHA512419e47c928da957893f34870f0bdce92b8bda0139fb466ecaa92f087e2b688b1f6b9fd19633e0a88462ce8bc9fa522f2aa28a9519bd10fe878b5ec0268972ed5
-
Filesize
168KB
MD5cdf880c9f55b4c8aeae888490be43822
SHA1839bc65f6dc4f2d7c2a535659f9840e61a497e67
SHA2562d4d3e6add99788ff3114a801e3b1001d7d3fc3f63cb0c8e509e7b88fd0b2ed7
SHA512f72267980a0344a2d38c64befaed8156b9116dc314414e59adb76c1bb7c4a70dbc828dee4ff21e32145a9350d41a44953a11ce78fe9053e3a2eb054cb6b8df0d
-
Filesize
168KB
MD5f80b0949f9371379efa47a800e594c3f
SHA1cdc0062a33ce6c3461b2d25eb3251f4384d1cb6d
SHA2564ddc64c187add44741ebf0551f49396843269d4ee7e260063117a528951d650c
SHA512ee00c88d08ebb6ae00f19ca6dc55fdca65e6b0fd563a53b853773eed0b1ef5c90906809e9e68df6cc11eda041ac152cc246d95f54e16560d6fee16c3e61e8963
-
Filesize
168KB
MD5047c961aa6dbfba8f000a7cebdb4c61d
SHA1f7c2d30abd2bd6f0c964f8892770e7f89b63c4c5
SHA256cf603fd7ac4c7788cd088c05725d5f9f4eac15b1a75f7c7d6642e29a207449dd
SHA512782b1074c843bd27c565d26fd2e4fc86adbaabd08b41a79d447757cc2770886d310f246ad676467daed078f34e0ceeca5b7c77dd10a198c1897611979da45a5e
-
Filesize
168KB
MD586bcffd47f6a2ee7c98a9fdec9b57661
SHA12ed0f672d9ac50696b722229a9d2c627ac85d892
SHA256ecdb451dde55f6b12ecb6b78b28771de056641df5d251ffee3e133d74b959c58
SHA512984591be9cd7f76332bf2be283bc34b8d16b993202715ea9d21756906a55e3852fde833bfca862472381439c2de10197619b5b2836263faff66641ed6789277b
-
Filesize
168KB
MD5bf5f5bd9e98c3af011934d020eac328d
SHA10489d7ef8a1a005e77d74af960fe677027acf303
SHA256864f81a8c14b4a3ffb4ee52427dd9da152b53b7ab4b70cf9204c8adaacf47929
SHA51220a929052cd409b078ba4696b8af352b7fc8c56f5f2786cf3b1f1e4db6989538e1bcd30c52f4757c17ad1d2f93808b0b4e8b6440a51287798844d29e9c578c7f
-
Filesize
168KB
MD5137993125d455078dfbcfd88a285cfde
SHA1da3e53411953899d72b08980fc374864dba4415e
SHA256f1ebb8107de5fd9bbe95e9b65a1b26e91de0779df348b0353e5e046fb47b7da7
SHA5122c64834f69bd3f6ff597f86e8e7aaac3618435cbbbe94a60781fa3f11a592488ee86ba3bd50baae8d99214b71e9119b918c40af3130373becf8b7b8c888661d3