Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 00:49
General
-
Target
2024-10-13_2413457564c4054ca86b0f97858ad5ef_goldeneye.exe
-
Size
180KB
-
MD5
2413457564c4054ca86b0f97858ad5ef
-
SHA1
df380522c1149359096571917ad5348c4a445b5c
-
SHA256
054432a5ff2cbda08c8a2114588c1e06087998399aa8a2b8aee8ab9814bbbf76
-
SHA512
e371d392c917749b2673d37590616070fc05db41966ce0d18d71ee4e7ee50d9b108d5042498385d7b79df6539547d0bef5d871be7f181494c035d9f0ffa6a183
-
SSDEEP
3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGOl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_2413457564c4054ca86b0f97858ad5ef_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_2413457564c4054ca86b0f97858ad5ef_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73AC91FA-3ACA-47fb-8D65-4A72499237A1}.exeC:\Windows\{73AC91FA-3ACA-47fb-8D65-4A72499237A1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE79C1A1-4A04-4daf-82DC-4A4635F6248A}.exeC:\Windows\{EE79C1A1-4A04-4daf-82DC-4A4635F6248A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6618C86F-DACA-45a4-AE30-63D500D0BBC1}.exeC:\Windows\{6618C86F-DACA-45a4-AE30-63D500D0BBC1}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A9A4CDC-4875-40b1-96BA-F4E088BA9FC8}.exeC:\Windows\{9A9A4CDC-4875-40b1-96BA-F4E088BA9FC8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9024E94A-9A88-4e05-BC22-464979ADB124}.exeC:\Windows\{9024E94A-9A88-4e05-BC22-464979ADB124}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE5E58E3-DA52-4c3c-A695-15EB60D38C60}.exeC:\Windows\{BE5E58E3-DA52-4c3c-A695-15EB60D38C60}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEC3260B-7CA5-482e-8434-8C985513006C}.exeC:\Windows\{AEC3260B-7CA5-482e-8434-8C985513006C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{011B4DCD-A46B-4c5a-931C-EC7C589A5C14}.exeC:\Windows\{011B4DCD-A46B-4c5a-931C-EC7C589A5C14}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5A4B751-82AD-4746-B643-A83E1DF52832}.exeC:\Windows\{E5A4B751-82AD-4746-B643-A83E1DF52832}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBDB1E5E-ED21-408d-9B0F-4840D0D86EAA}.exeC:\Windows\{CBDB1E5E-ED21-408d-9B0F-4840D0D86EAA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14FD46D3-2E47-457c-A732-6A1920DF8B67}.exeC:\Windows\{14FD46D3-2E47-457c-A732-6A1920DF8B67}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B78743D3-66CA-406f-BCB5-7E932CA1D485}.exeC:\Windows\{B78743D3-66CA-406f-BCB5-7E932CA1D485}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14FD4~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBDB1~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5A4B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{011B4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEC32~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE5E5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9024E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A9A4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6618C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE79C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73AC9~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5881ac4bc502362840ff1d01ba910fd12
SHA18c840995187072977d0ccd183f1c45ff4b73a60b
SHA256c451190c067979ef5b33175d3258db4eaebe8dd13554d792dd26f623a7efd09b
SHA5127897adc765cfc632a0089c964ef7aaa78115aeea95dccded1aa90684196b4438600c0ec44ff7856ecbf257f5f17b8f0fc5ae8b51f0d269af1a0fb2d9b4cd8419
-
Filesize
180KB
MD59310e16d36c183cb0de7b279ef7a5404
SHA1a050aab7f3a153daf7342253e7d6c3053870a6e9
SHA256ba4461a8af3a0fb56ad140febcd20c1a0b61e9dbef259fd5f1c4813ece208349
SHA5123bf2cd8c1c1c08eaef19449ae3df258ed6e0df249ebdf553ebd7d47d310294ded335df2df5b475386ab24b7d08b164ed00518351b21607630326cb85d162643b
-
Filesize
180KB
MD54a6310d27007a748b89aac0eecf77058
SHA1d67efe8513f5c2dd808b2119f591c1710f8f522b
SHA2562dcd91231beeeb63e2df9d76ffb0bfd66a8c9c8b457880e84a38575ec2ce381d
SHA5128926e7df5803c4450141656605d0e72372131579c67f2862aeeced9fd6f07478a82134406c4d6530bb983a8fec09973b66cd36ddb5710d2cbf6a4fa9a6dfeb77
-
Filesize
180KB
MD51148ac1384b7ba12e8102e192840f6f1
SHA1f4b4fc42d6c45b149eae7d0c76325116b71bea92
SHA256a60beb0301c1083b7e3479f114a0c9b661352511ea53d6931a8e0d2644728796
SHA512b83bb794c66688fe1301444bd39d69262095b39f7df913fd3b0c8bb6239397427a329ba631ed7dfaf930cc2687b758934522555726eb7962fe467a16c22eb6ad
-
Filesize
180KB
MD50b0e9889b60be6bd9cb8862f62d9c18f
SHA1ba20b43c7151c6e96ff3f6a675413fa380fd5e57
SHA256126d5ba57ed497cb4b9ef0d1fe3f2701a9abbbd15bd39e4721a5cd5660c3c0da
SHA512fadb4b9d047ddf1a73abe5f3540545a10163e998fd071c9c7b1d7b1a5fe2919b7a80f05bf30ddb3a149dd307fa928c83d6644692b9f2a83e84613d37daa18589
-
Filesize
180KB
MD5f8fa645507a51cf22581a505be234d0d
SHA1fbbd570efd53aee0f4c68beebdb9851946e36ec2
SHA2567baf9c329e1d8a16b9dd8bcac330d29a71a29d16036de623f2106ffd50a65ba2
SHA5120508391a05875d8bdc62dce0cdd4ad3ff66f544454d7f285f683369966a0e0b19852e340a45d6441d4ab6a97e5873f85a293008b1d130122045365d520c17424
-
Filesize
180KB
MD50f829ec5396be6895a6a89e882dd782e
SHA1326b2732bdbd36ca89e7cfbf8790dc293e2c0034
SHA256036b8737c59aa2c04100a0f4e786c2e28f7967f0931a66421263ad41246da219
SHA512b8cb38ebbc9924d6c0020e3053f01f245d04ecaf5a6d09e98259cd8fbc53ecf269666e6c52aab3e24a64fe3cb7b6267db47d83775da5a30fddffc884a77b341d
-
Filesize
180KB
MD5b63caed7b6d57838abac4602323c88a2
SHA10d809b14da2efbfb24d07a2f1f152c5bff8a014f
SHA256596b8a339ea9f84ba38e259dd9706fda7decc5e0406c3394f349ed91011f9d0c
SHA51272050602b5e5a54ef783dab8e17a4d0a9e6495d7aedca4954a0a74169a8d4335d97c5ad9e502fe3e4643005fc5549b06446dfd1a8b0892024c8c502c3a514b1f
-
Filesize
180KB
MD5a23cc3155a1fdeec3155ad74aff3bbe4
SHA1709aef14d7c28a6059e7b47a8f7280e6e7f7b08c
SHA25618d02c999fe5d5af0d0318b29d985456d63efc9ab22f602f6a8711b6940db21a
SHA512124018033c0cb18a2a6bd088868711ba3b3a8dc2a4a4fb699e1b4a82b46fdc486b7e78f288e35872dc6ec67f6ecb885b80fb468160c08be584b9a5f05139e7a9
-
Filesize
180KB
MD5d4df6f916d74d9f090bc34ce8c50fa87
SHA1a7ac1af81ea2234d1b1a32f3e37ff146400aaf29
SHA25686321ecab1405362b28908e692b2bc0e1729ae1e40040e429345c16fbc9763d7
SHA5127f152979c30c9a1822bc6076940e0186e2db73fb5e01259def0a55bd5bf17f9a2ef3a876786703913521a1b573b05854e49a4c990720e49a193c77fbf22bd4c9
-
Filesize
180KB
MD511057b74b31fdccb787c7d3b426601aa
SHA1096ac64a21b797c1f95d899186eed16040f7aeb0
SHA2569682e3d9f866979cdca7a82dbd88e5542a51dbc6742e8f61a9f917783d2d2673
SHA512070b6cceb20a716f660611d37dc19150b4b922635a3c989ed0059395b1a66fed247015f17116270ae4bd6eb50b5156d35d894983b67820c524c5f8b5b6891cb8
-
Filesize
180KB
MD562547c17fabd584d8064efa038bd190d
SHA18f25891d3e49dfcc45974b7d1f6f56c73363f53a
SHA256f6708a174a3792726c011fb7092101c1acede15414225030b9effd185b5d138e
SHA5127f314bcb98a554df36c954df42109805389a1f9a99bd7bb048b197c47d17542b95071d6f5f7e5a62f986455772061bdbc64b6284b831451a0ac8ef0b1ad61864