Analysis
-
max time kernel
149s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/10/2024, 17:04
General
-
Target
2024-10-13_649aea642e115b2beb06192eab10b604_goldeneye.exe
-
Size
372KB
-
MD5
649aea642e115b2beb06192eab10b604
-
SHA1
76496aa9ae49a33c1e14ec996c951d1325a839b7
-
SHA256
79941d1fcddc7a69d4c12082a81b525cf50c042b4b5d65fd218633a41366676c
-
SHA512
8e21a4c44dbf1b18ad5480040e9a68ce40c6f3cbad87749fe6ab0ed4c0eed4a3b39701343486ae00b3866d6f1ccfd4f7bc72e16179a95fee6a0ed6c216bcad85
-
SSDEEP
3072:CEGh0oblMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGZlkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_649aea642e115b2beb06192eab10b604_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_649aea642e115b2beb06192eab10b604_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9B61C0B-BCD8-47b9-82FD-9CE3929308C8}.exeC:\Windows\{A9B61C0B-BCD8-47b9-82FD-9CE3929308C8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8613CB1-0DA9-4073-851B-111ADC548052}.exeC:\Windows\{A8613CB1-0DA9-4073-851B-111ADC548052}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8061DFF6-20DE-4699-95A1-F12D868F594F}.exeC:\Windows\{8061DFF6-20DE-4699-95A1-F12D868F594F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{969698C0-918A-4deb-8DFB-E662EAE8AD11}.exeC:\Windows\{969698C0-918A-4deb-8DFB-E662EAE8AD11}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{196B9B7E-2B6B-4c6f-990A-1B2BB41F4AC9}.exeC:\Windows\{196B9B7E-2B6B-4c6f-990A-1B2BB41F4AC9}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCC0FAA9-716B-4ff8-A8E3-611E21072400}.exeC:\Windows\{DCC0FAA9-716B-4ff8-A8E3-611E21072400}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E30BA9B5-2CFC-4e21-888B-ADC925C85B77}.exeC:\Windows\{E30BA9B5-2CFC-4e21-888B-ADC925C85B77}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8E28781-BD6C-4934-BBBD-4573F716E77C}.exeC:\Windows\{B8E28781-BD6C-4934-BBBD-4573F716E77C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFBAC412-D5AD-4bcf-8E1C-BB02ECCCEFE7}.exeC:\Windows\{FFBAC412-D5AD-4bcf-8E1C-BB02ECCCEFE7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5F5D399-56ED-47ce-A3CC-50357FB8FC6A}.exeC:\Windows\{E5F5D399-56ED-47ce-A3CC-50357FB8FC6A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAFBF91E-AA5C-448f-8E74-83B523A86CCB}.exeC:\Windows\{AAFBF91E-AA5C-448f-8E74-83B523A86CCB}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3A0DA706-1693-48d6-8977-4B8E63A5F319}.exeC:\Windows\{3A0DA706-1693-48d6-8977-4B8E63A5F319}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAFBF~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5F5D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFBAC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8E28~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E30BA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCC0F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{196B9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96969~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8061D~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8613~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9B61~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD58445ba720d97716d85a0c49190d8a607
SHA1ee682f2b70e2728e28cd8becb3ccb33e770f77e3
SHA2562a8a112b29d1416919617e235d7e7c568bf2b41f750c6aec4edca02d346ec9ba
SHA512f08c7eb1c7e9722abc2d315f4de60364d3cdcc6488155c5fc126f6bae7af53f6fdf3524f2371b6ce875957152ecaaab33c4cfda051a73201c3d85d9d7f9a05f8
-
Filesize
372KB
MD5910754b7566f65ad577bc6d3d5d872bb
SHA16c262b59282bedab75410ce8c1a7d651d79e8dc3
SHA25641d1232ea2c9e9afba90bc9ecd6ab69371bd0084ca4694b82ed6f144a2eb81de
SHA512e1643032e46321370cefeecf724288e979673f8f2d41f281f056f0b0bb8a7c711104eaa6b8947d79763aa7fa175279a0620b0b8c74a2c89d43d855252f13d5ba
-
Filesize
372KB
MD5347984ed7538ea5ece5ccd82046f7dc3
SHA15c4c2b0ba41fee36d27f96e94ee1760238d27c42
SHA2565ebd375df276ee4cac7427b605c082c459a398b9735682e3fe099a4afea01c21
SHA512f24050feb32b104373acb97e046e0472937725ec50f5d304e368825bb105c65b384a738d4b35f12378a75f9c08a70dbd560dd2fe466ad78f4a8e69a78533f25e
-
Filesize
372KB
MD5de71d00ab64a14fa7a79c3ebf72822d4
SHA126265b82894b40b59aa8005204d88c5a08086870
SHA256e4702f8871f8ad5b3d685c8c03bb011845bcbaf99efa65c528f9c38d68f753a2
SHA512ed24d12ac5b42ae2cd2eff2cd25a46241f237cef12997e348228f8b4f3916d3474ee4498da21bbdaac969c0a9814397a3405a664e3631acf83a44ec74e4caae0
-
Filesize
372KB
MD522b37e5a0cd51b17f1d1d8043c55e7fd
SHA1149e2ce4ca2446caf2f24e56875acfdfec6c7f73
SHA256c7316bdfd05e42c1399b8832f0909d9cb5bfbc628cf73f25996368ae61551398
SHA5124b64a1e8cc543aa0ff932456dbda977c20963a0cae56a08f531f240b3ff53225d914e16802224a7f07ee5cb1c3bce260b4e168553a28bcfb04c01d45b5eee32d
-
Filesize
372KB
MD537b02c96a7ee88f34663a8cfe48be6ae
SHA11ddf3f464ac8131d84537dbfb4c7b3465f0aa983
SHA256e311e4c72acfb45287175830c642a4a907935dc2323ba3c4b1dae9a695776d35
SHA512d91e9ab9fcaa4466529561d011482c7a6f1464b59824b9c3954e04fb97ac112759f0ade2e1762267d808b429119c0f19077d930585da33efc32116b5fd4a7930
-
Filesize
372KB
MD5a73be9d2f18e108e65664409b1ed0e39
SHA1427231aad0f0926657493457ed0db1ac9d0bbc05
SHA2563936bd9a5883490c2427638b88fc1e1712e11577b511d84e58fe36d0c5f85d1d
SHA512e002e382c3171c8be2cfc206d680d74bbe8e30bc5b05394dceda9f25a8f5478d353d7214a3767c4545e32ac0981f50e98b4e16ec35de8c8598dd338ad70660b6
-
Filesize
372KB
MD5af1cedc4c8fa7648a571e28d3c0a771d
SHA19acf941a425f061490c225c54fbe5fb97f2cdf54
SHA25687496103be35a3eedd187fedbbe3e2152df90fa76994a805520be2e734e7a376
SHA512b1a82f03beeee8ded071cd2c0d8f67259d99d5f45649908aee0cffa87d88f542d12bc8f327f16f2a1d2189bba9242792ac6b4ec26770d31460a4af2a76adebb2
-
Filesize
372KB
MD5c426ad43fbbfdebd91f6abc7918b75c8
SHA1e72fa7b4f60b72a9b35140504a9673450d597056
SHA25646227cb41508885c92b220ddf31f4a0e18c27bb7a011de58a1bb0c434acfe48c
SHA51206504521b7b8074fde0f50c74f7553d4f4ab69c66dbe41893914e3516bb91fad431b5e126f3d11316f70c34f7baf9df81989465411d6d1d68721957bd195de48
-
Filesize
372KB
MD5297c67c6f94594178f89816a09ba99d5
SHA137189f9718a224b197ccd8fcd41aab5410de15da
SHA2566a13488350f4a54e6fd6c8fefa90861d5767051d88cab7da9c85e8f81aab19d3
SHA5126a021334cf30923b113e699ec4719fd667c8f0a57ab53591e6a732569337945c4909a37a6d9f9c7c11ed1524fa9d5c0a2cb5f1744f58e412569509118f38d64a
-
Filesize
372KB
MD5951f5bbfbf47468ae12356830e8a86fe
SHA1e3ca28f815b3a2989fa4b74d1f0becfd6e7a6e88
SHA25678e0ef8383aba7b07e771bbe74e9ae1d7c758bfd7ff775d6d7d8cc6d44cbc61d
SHA51210eb548f4e2d4437346c1640cefde284a875ffd952c7245f0af82d8bc549eeed442c686acc30d253fef6e2e3af5970dc20d6bebf2a0ab18948fffe807a2460c4
-
Filesize
372KB
MD576c231ceed841c8730ca52f7f9d09a59
SHA15b9eb80d6b753b809c122b6885bbedd4bdea0a59
SHA256d7ea861b00f6d3e8f6fac5e673ccb2dcd114702aa86b940257d893572fe202c8
SHA5125d8e8a622ae883dca0138982e5633cf1836469a9f59c4b9b0bb4865bc4992e9ac6af9b54f5d11e42a6275d470832e5f7809b2777adc807c0fc380fd1cc20a278