Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 16:47
General
-
Target
2024-10-13_0ece39ba2e3f44647774f23bb76803b0_goldeneye.exe
-
Size
380KB
-
MD5
0ece39ba2e3f44647774f23bb76803b0
-
SHA1
5b90ed455ca376c486f1ab1d480828f0c9b23efa
-
SHA256
ff3ea2abc932cd69002f47eb7e92157f8a43fea2e3d1c5d6b529760dd6d6d004
-
SHA512
351cd26de5649883d3e6b42066c59812933a16e2ab5da0e67848d94fff7c2a4fcc3a5278bbed6d52c37b49d1e4e7ba509b6c7cc53dc8ac530dc1e9a3e091ae17
-
SSDEEP
3072:mEGh0oqlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGIl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_0ece39ba2e3f44647774f23bb76803b0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_0ece39ba2e3f44647774f23bb76803b0_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{22F38F7D-061D-4127-9053-EC31B49AED1F}.exeC:\Windows\{22F38F7D-061D-4127-9053-EC31B49AED1F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFF9EF6E-8A2D-44f2-9157-6644269D545B}.exeC:\Windows\{FFF9EF6E-8A2D-44f2-9157-6644269D545B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BA6C088-FAB9-4fff-82BB-D100868AD4AF}.exeC:\Windows\{9BA6C088-FAB9-4fff-82BB-D100868AD4AF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FDC42BB-80A8-4a36-B858-F40C8C8BAAF2}.exeC:\Windows\{6FDC42BB-80A8-4a36-B858-F40C8C8BAAF2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F541F125-DB35-485b-A2FE-BD6DE8D9A64C}.exeC:\Windows\{F541F125-DB35-485b-A2FE-BD6DE8D9A64C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1ACF861-93E4-4abc-B5D4-BE0F9EB4531C}.exeC:\Windows\{A1ACF861-93E4-4abc-B5D4-BE0F9EB4531C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60DA6944-15E5-4096-9C8D-D370F90CB5D0}.exeC:\Windows\{60DA6944-15E5-4096-9C8D-D370F90CB5D0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8582FD1A-F777-4117-9732-1801E500D515}.exeC:\Windows\{8582FD1A-F777-4117-9732-1801E500D515}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A30F6517-CA91-4c6f-9762-3F1B5E85301A}.exeC:\Windows\{A30F6517-CA91-4c6f-9762-3F1B5E85301A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78C4EF18-F949-453b-BDA5-A8C31959E691}.exeC:\Windows\{78C4EF18-F949-453b-BDA5-A8C31959E691}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91A090CC-5E4B-4152-B7E8-0F4533C0BD6C}.exeC:\Windows\{91A090CC-5E4B-4152-B7E8-0F4533C0BD6C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1C7D3E57-9CEB-41c8-A1A1-87D97B38C18A}.exeC:\Windows\{1C7D3E57-9CEB-41c8-A1A1-87D97B38C18A}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91A09~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78C4E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A30F6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8582F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60DA6~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1ACF~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F541F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FDC4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BA6C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFF9E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22F38~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5159af1b3b607b3b7a3d18092f64c72b0
SHA1f6d0fb6066ca552e9130aa3555dd72c85e7bbccc
SHA25602e39dd7c2c76026643e61bf439821dcc41aedb4096568e043587744a8506479
SHA512b169648da7ba40bf5b37a3a184db51f6e742e20d8e64a3d7d3f1e161a8ea830e0649258aba3a6ee47fcd1cb5252806b3a73dfc48cefe35f5d63775cee662063f
-
Filesize
380KB
MD5a3533092643e29a559b36dfd7632a2aa
SHA1f6afa1a54c1bb2795c682726ffebb3acd75626e4
SHA256835cdbf4e886fdf3ea38a1f3a22a7d12e2041b7c1c5978177fef2a24e0c09952
SHA512a1fb4d68c1b46514ef58e70ad5eb642f864dfe32252a06cd021196f01b64136d1f6f865f4459a5537c06d407844b361a1a0ce39521d3dceb8037006a64bba6b0
-
Filesize
380KB
MD51f1bc9b45c1ab7ef8e4f70813d798187
SHA152b78d69882643a91b515e963a49f6ca197a575a
SHA256c7d80a2caded52fd79fc7828e423a1f1d0711e543ed28d9a065850f6358ae6e0
SHA5122443785bd4f8b981905db27ffb597c9318fa1cfc50923d6441300bd5a89a9f499cc84e05cd67b9e9128816b4c5b2dfa7da88ac64af4c2f7696a6f58e04b6b15d
-
Filesize
380KB
MD5f972d9d18860a67440700cfed3aec14c
SHA1f577bb07bf5f0d52b13315c56f3799385c23c9b0
SHA2568158ae8455f22f433fb5cad5bc83b0417ec85c0801ccbc8a561db29acb5d2107
SHA51231ae710eaf48d651944151d9e578105c5e8f797d6e96996c1c96d2e1b8bb58704eb5d041942243565d8e1537765da63de093ebb3a017cda46474f511155389c5
-
Filesize
380KB
MD51f0f64fa20a6f7ebe3c8677466a6a43e
SHA141121ac7df4e482d919f80c6d37e9a3068b20a7c
SHA256fd56ff5a1be028722590ca34fd54caa8683ac29ccb2e7d7e3476970b3f80b6b4
SHA5121cf582930b7d7d8e470e5009060ea8342de5b41c9a57b3c9d56094ddb81678a8cab916700e5d4cbd163c08a5f25fbb6be13022e5bd2b2ac66c1e77f7d276eca5
-
Filesize
380KB
MD5508152c3b0fbc6ef5b6510fedb6ecd29
SHA15def3dc5477db558fce3a8a36aa90a74cae36a09
SHA2561ea6d739d075518b807accb9dccad01531c69198db13186182dd8a45ffb25eb1
SHA51236eb1134614aeaec778609f41bcf3008571d9b0e95631b1c1cddd5e2c14ad6bcd10b560bf8722471e777ed516ecd8f3583d079aaf29572b702823f6ebad9c64c
-
Filesize
380KB
MD5f889e99c1040fbd20c2a09090c263955
SHA11503ab68014e14af22ef8ec63bca052a753a2c2d
SHA2560dc7d7b52b412201ae476f3200eadc245508ee9e442375ea81c3c7fb42b020bf
SHA512c5ab1b70ccae6439c861c4ef7539870cd7c519026ede3aacafc0d7268d91192c0e051dbad5b33689b0f3754038a0f13cde13d5148f6e5159824e1e79d86f4ba1
-
Filesize
380KB
MD5dee904ce1379370ee44b3ed233c5e020
SHA1f9a58efa9de309c9e0479acb78b977d7821993df
SHA2564c440bbd960afddec11a8226b49ebf49c5ae364e6ebcbdfda947131d0abdf31b
SHA512cfab6fc4a4e3695e6b047f93ac3ce85769d45ff1159e300c31765c3b1287661cb4ffc5abd37efd5acbcecb65cffb7045d64eca6a674d327cef91963d2cb675c9
-
Filesize
380KB
MD5ec98d42fb4bddf11f9d6d6420dd900f0
SHA11c84020d4c6c7b3a6ee71b98cc4d191bed13fce9
SHA25635786ffe4d9d791e74051cb592c1787dc0a76cb8fa6958d4dc00664f94a83661
SHA512edaa4d6df5b23190ac603025bbf1aad71db7a28e547e7239b5d73cd2ca431188189de82f3dcdfb1fa6d0e53f80a2e232f4b3581faf67424e1c7dae8f42a2d33f
-
Filesize
380KB
MD514e3a66c9615100b8877d0eb5b0d75d4
SHA1f0a143cda77827709351ec03adc3ab53da59ed9f
SHA256cc1b9a50ada6f9e6de77d60a0fb8dfb9ef9f9f5b932fdb1cb57291f0bd5d8042
SHA512b5c1b1942e9c9e9b0dd05a1674eadabea6ea9ce94c46ea157d52faa457758d89d6fa815ff965c1eeccb5f37c71f9658658fa718a903d473bf0590921cd61bbb4
-
Filesize
380KB
MD523f767221d224fabb62723cd65a22738
SHA12913a69ef78d34f2204e38886ba407078f6b21b8
SHA25645580aea5e7c352daf6c0f41a04c2640651871b9742051c3e6b479a9eb1f15b7
SHA512d40e6894806fa2c6c7a35407b7b9a43a71f2833cb6932f1e07b6c8ec44e18690f294cd1b97f3bc2b6ae8642ef751559c3dbfb17dbafdd222fbcf6fc68818979b
-
Filesize
380KB
MD59f1422eff391b63a6962dd379ff739ba
SHA1087b5586b8d38978b7fa3a572e3c80d18c052833
SHA25600946580738d800cfc9b0c69dd849d9a7ff4c87b121da509c538060b771ff30e
SHA5125e5e9f5765153dada35df140ab05e0e500059749367c29cbf4c9fa51f7834a826a042310fb209057e8a31464d8c79b8db40060a0b5094d6cce21e249ecfc6d00