Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 17:13
General
-
Target
2024-10-12_97a1bd24f122d479820a3dc08eeb7940_goldeneye.exe
-
Size
380KB
-
MD5
97a1bd24f122d479820a3dc08eeb7940
-
SHA1
819d420b7d3e31ddeee73ac3f66e81b22cdd71cd
-
SHA256
11ba81b7f7e2dd99798cebc32f20312d57450aa4429c95835624d0b4594c09f7
-
SHA512
2ee6be333d564b318042c155e4cecc35131ec88fe3f7cbad144629a7c9fa8cb84a1f052ebe47212f77607d2a8e7804b19430c9b84e11cb6d3621df1390589876
-
SSDEEP
3072:mEGh0oKlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGUl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_97a1bd24f122d479820a3dc08eeb7940_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_97a1bd24f122d479820a3dc08eeb7940_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F3111C4-1E01-49fb-8DDC-816F7B5AB9C5}.exeC:\Windows\{5F3111C4-1E01-49fb-8DDC-816F7B5AB9C5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8D7C846-D96F-4663-A29D-006BC75FE10E}.exeC:\Windows\{A8D7C846-D96F-4663-A29D-006BC75FE10E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1225E52D-1932-4926-9061-3E0A061338F0}.exeC:\Windows\{1225E52D-1932-4926-9061-3E0A061338F0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F1E5DB3-D5A3-4eb5-8FF5-B6F2F31A4AE7}.exeC:\Windows\{0F1E5DB3-D5A3-4eb5-8FF5-B6F2F31A4AE7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80C0BA22-72E0-4bc1-9427-1E0F449D6B43}.exeC:\Windows\{80C0BA22-72E0-4bc1-9427-1E0F449D6B43}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB729013-3D67-4968-9BA9-049AA8732AA3}.exeC:\Windows\{CB729013-3D67-4968-9BA9-049AA8732AA3}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7821C1B-5217-4ee1-874C-82250F6302B1}.exeC:\Windows\{F7821C1B-5217-4ee1-874C-82250F6302B1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DE640D1-799B-4ddd-A513-ED0832F443D9}.exeC:\Windows\{0DE640D1-799B-4ddd-A513-ED0832F443D9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4A8477D-BBC8-45cd-9E0E-F62DBDCA2783}.exeC:\Windows\{D4A8477D-BBC8-45cd-9E0E-F62DBDCA2783}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0773A6ED-DAD6-427e-AC3E-A2EDC529258C}.exeC:\Windows\{0773A6ED-DAD6-427e-AC3E-A2EDC529258C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA50A094-5C14-4144-9BA4-392FCD8FC577}.exeC:\Windows\{FA50A094-5C14-4144-9BA4-392FCD8FC577}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{BBC042E7-A4A7-4a37-A78A-B3E88BE1936B}.exeC:\Windows\{BBC042E7-A4A7-4a37-A78A-B3E88BE1936B}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA50A~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0773A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4A84~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0DE64~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7821~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB729~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80C0B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F1E5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1225E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8D7C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F311~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD535a4982f6232fd7e4fa5019a06fd57c8
SHA1709c16eea9e6270667af5ea3050dd9e1347b38a7
SHA25682bd9b2cef634b314bf294e6587f34fcef767da57ef50a7b5dbbf8b65faff25f
SHA51255e007c9549d25f9af02125afa60aec63111808b611c0788565c9ae35497192ae7fc51c5317d2ad615f0a3ebc4fe62ec53d49dd579be25bf383ee1f299711cdf
-
Filesize
380KB
MD555bf1871fff8dfa2085809202be26359
SHA1c3d59907482559ea156255038117eb99526eae7e
SHA256875f4abfd3ee1b5d763c14bd57a84c90eb5226557aa21833e533d55d89a3e10e
SHA5125df6943e17d86f32c5398e49c8a4a8c17d107310c08c53e0c371d7424ec12f0ad9706d8759fcca7ce5ab322c455b56346b85cd2d110242b223ce67223d10693e
-
Filesize
380KB
MD5c75408f2d7d06b74d95d06a4b35754d1
SHA18e988a7953582ace46b39e6d7d0c10fd61a6a471
SHA256a09323ee85b5426d201a2231c5a7e4743748fb4555b07c04a8c88646d0921c95
SHA512342cf294b934b3a08b311421502a9de4b6cc30d310da012f1efade640a2ac34aaf5db629118e669e974b7fc1b3f3f2cabd399702c855f4d2c4b8d8ff1019721d
-
Filesize
380KB
MD5d8c5eac0d6568c663f85f27831351366
SHA162c81091df025c0202e5c005454e3901da02d005
SHA2568d7abd672de7732ce4b2164645eca836692a0e75409f41c34cb3749a401ce7b6
SHA5128511e7152fa2198d9fdcaa444270d032db02b476d174d45761019dced6e80bb3629f88929bbc9e17d9d1e9a082f1109302fc22de5755594f7fe3db233dcb4308
-
Filesize
380KB
MD52b89c6597c8da0f17ef579fdeb2c7f3d
SHA16d8fbbb408ddd4828a703c577aa791f57549127c
SHA256205fd30cf6b42b2d0127e11d7e8fb7e613c0fe557e50148b310d8976becf16c3
SHA512e87dd01f215c9bd44620d960811be43e120056116e21aa6a27b2f29a10f56b3852a2ebaf324bfdf08ea92266846889f03b10702955ead7ec206787ef6b55cad2
-
Filesize
380KB
MD5852c69d77ddb625116aba070c3a71d3a
SHA1f6e5867ac15ac286db25fb87557d180901723dae
SHA2567e84b11d96fcd4e7b507298f07280a606c7861a1318dcf3c66120f7ef4a463c6
SHA5120bc2b3177ed84e6f1a5d49265be86ac79935bb542820e2772f033f6d9602e24d0bfc3990daaee148b3b728c15ee33bf18d398b3f72bd536b32924b17e946f207
-
Filesize
380KB
MD59b7a2c711aa216403546369ed22deb57
SHA162b57892eaafe63a179592c16a2d08c948b7c442
SHA25674173f5f921ed9e9abb6c059ca185b8ef7f13826ea5b7d9f01c9378675b5ce4a
SHA512e0896de7fd6d7479b1c9899960be82bed6e50d9a3be5dc2bdfb2e98d7050ee8aef9f8bf65336c0a15b27ad36cf5c249f5e7b699b3201d390d5cea105c30a232e
-
Filesize
380KB
MD5d182252c7d0897e81de5c06ebb376554
SHA1ca91a08cfdfee1b18c9bd2af74ce24044c5fb142
SHA256cdfa015c33ccbde5dee95b995c79154b36ab624e1ba082a6b836a00162a4692c
SHA51272e6a61add61df9ca84886b0999924285ce995338aa1fb6fccb997b844deaac43c51800cd03356e6443aae12f191f3b8358733ee8ea6af46f45dcec03e7af48d
-
Filesize
380KB
MD5f6ce39bef0ffe494c3adbd82b44b19d5
SHA173fd5cbe6692e6c6690bd30e9f3ca3ceb1f623dd
SHA256ca44e5d63ee5c55a70571a8aacccdb79741f77153a10c6e383c4f50289d0b369
SHA5126588d6714a44c2ec436fe62bde6899a9dc0332ef44f3b8e95325f3573a16171155e9f859639def5f48a86f22ece2bc8f70bddee6a4d8340558caac881af26376
-
Filesize
380KB
MD53cc89bd72c2359957a10abb16975baba
SHA1d8f25960598f8e7fbf743d81cce710724fc92a90
SHA25650efe6c06801786f6fd9085e70498ff94169a7e190457408a16c88057d83d9f8
SHA512cd757285ccd06f4ba0cfee17984956d465dc2d390ff52d603282f5c2c24d2f857f8e0fe1d1c133ab34009086e9fc313e95e0d57334e5e02dab0bd64af2b5dbdb
-
Filesize
380KB
MD54e3edb63f3dc7f66031292e76112a847
SHA1d5fac5726ebbfb8d2f860c7b667a53d73cdafa8b
SHA2567366c83a7dc8889bece19346b7b3494b74f6d3fa34f97c189a04b48d8115194a
SHA5122177537194e1326474f75ead004d1a9eac6fa54e804f4073ba139293e2703c3a93df5ca451df510e9321a90c017b21cbee97beb02336efa2180b7d2f06da6748
-
Filesize
380KB
MD5d80d600eafbfe3a950a5d9853442b57b
SHA182a1d67d297b7086f6a26579879a0199d6dfbe8f
SHA256489cddf6d5d21488b0202b317496258bb8dadb26c0b71eaf604556af3caa4991
SHA5121498cd5c80afa6ba846e130d85b8f9628bec3923a72475b1ef6b66e95b84b15e8c931757252a5b3c28e55a2647fb36d5b6f40668dc68a10d2d3e8d01e95f1eab