Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 17:46
General
-
Target
2024-10-13_5372648664cdd5e18ae5248351fc0ecc_goldeneye.exe
-
Size
380KB
-
MD5
5372648664cdd5e18ae5248351fc0ecc
-
SHA1
581fecc7931bf7d9f7d389d14a386a0bf9a0a3a4
-
SHA256
84022a542402ff42acfc624e88c77173e0262f64ac20ef74869b7488e3861e67
-
SHA512
f598de50a5cc46cdef632bb978dd4aae969a174b7f4ebc24728ac3725fa84bcbfb031e24b55f0f9bc7f43dd08feb1a63435c40505d0bbc0b1a26c8d34297237f
-
SSDEEP
3072:mEGh0ojlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGFl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_5372648664cdd5e18ae5248351fc0ecc_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_5372648664cdd5e18ae5248351fc0ecc_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C05A97C4-8E71-438c-8CB9-0BE9550340AC}.exeC:\Windows\{C05A97C4-8E71-438c-8CB9-0BE9550340AC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F818CD15-D636-41b0-86FB-C7C2BCBE9B6E}.exeC:\Windows\{F818CD15-D636-41b0-86FB-C7C2BCBE9B6E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51AE0594-21E5-41d3-9358-E1A769F1D4BE}.exeC:\Windows\{51AE0594-21E5-41d3-9358-E1A769F1D4BE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06624289-0FA2-45e5-8348-25845C0A6FC4}.exeC:\Windows\{06624289-0FA2-45e5-8348-25845C0A6FC4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B1DFCB1-3A6B-49e2-A8B2-D43B1A33728B}.exeC:\Windows\{8B1DFCB1-3A6B-49e2-A8B2-D43B1A33728B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5869F4B3-794A-4b0a-9DFC-61D2868D247A}.exeC:\Windows\{5869F4B3-794A-4b0a-9DFC-61D2868D247A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{883CCF0F-94A5-43f0-9F5A-25B2AC3BF278}.exeC:\Windows\{883CCF0F-94A5-43f0-9F5A-25B2AC3BF278}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD889D5E-640A-4daf-8CEA-7F66A324D5B7}.exeC:\Windows\{BD889D5E-640A-4daf-8CEA-7F66A324D5B7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19C22AB8-C6A8-40c3-B9A2-A70D30359110}.exeC:\Windows\{19C22AB8-C6A8-40c3-B9A2-A70D30359110}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B04A5DEF-4CC2-497b-8E6D-53ABB272678F}.exeC:\Windows\{B04A5DEF-4CC2-497b-8E6D-53ABB272678F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{387BE3AF-E753-4883-ACE0-914923A34316}.exeC:\Windows\{387BE3AF-E753-4883-ACE0-914923A34316}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EEF60CD1-F219-4e86-BA05-74444078E1F6}.exeC:\Windows\{EEF60CD1-F219-4e86-BA05-74444078E1F6}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{387BE~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B04A5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19C22~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD889~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{883CC~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5869F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B1DF~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06624~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51AE0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F818C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C05A9~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD51bedcc50758cbc44a6188a084177fa23
SHA1267668259d5feb3f353512516af75cb49f1849e1
SHA2569d6d0ceca43ac2bcbe1444fab37ac07979c546f27fe505979dcff498eb7204e5
SHA512f9afb40e46053881dccc0d7360474de90440e2ab3f0a9e6897bd63cdaa023bdcfd7ff652d714fc5e6861abf4709078b8632f88c941dc616ab6bddb49d4fcef3f
-
Filesize
380KB
MD5addbbac1acc00e2cad81cd2ea31ebaf1
SHA1ece7fa1fa157ab78e88b09eb16b2d378e7744e2f
SHA25699b4ecea36f8648da0da13106c55dde7a968add7aa5eec2f865549fd4d50c333
SHA512d4148ff0c8df77880bc34b822a50c9948e496e8130094859379e6fbbc4bfd31b47e4be3c608d976787b734c41b6d0557718e2dfafd8000d77936f1b8f54ce950
-
Filesize
380KB
MD57c99bb5316a64e176b4350f874366ba0
SHA14d1aa3727752414080a261a266cad6243ecb41c2
SHA256682d008dff1e99457b8476fe4432f6c0c9401efe4dcc4b596ba1f45d94a563d5
SHA5127ec5c763ebaebf4269c4e216aa67faf71b52fcf6add260609fb60d2f59446356d343fc73012ca3033b409c0e11b1535876d93ee2d77360461d0a0c6e06394934
-
Filesize
380KB
MD5ce8f767731ce33d2de4e989f5a19b50e
SHA1e9e1fb51f85a160c26a0aece20822d85fa1aa560
SHA256ee60ea884326783cfd3bf2c09e131e99b36c86eb905398037528633a8d917eb9
SHA51214a886d06be47f81d310779324ac7a9708211f84bac0ffe7cbba77dbf204b0171d6c4c50260bc687801e2e405120f9c5e1723d7a8765027234afd3f2df461ddb
-
Filesize
380KB
MD5edbbc5cf17f0c3dbb94ce85911b37001
SHA100b93eaf652ee15e39b2bde54cada65bac2496d2
SHA256eda47191eb71c81b7b0963f7e0a12330cdf6245877d1c7efa68d4f5f6f646159
SHA512ef33f708370c6aacceceb2bc2c45dd907803d6626cfe199542df1bbc88d025d4f6a354ddc35d82dc53170098720911cd09530cc23d9c74086896c8bcb4b8a571
-
Filesize
380KB
MD56e469b11b6ac813eb2a0c497edd6162c
SHA17798208d354ee14e60820ca773d9556a61b89da4
SHA25615ec0f0f15e5b5de65839c47a1a83ab564ec9c10f6712f73ecd9d064b30e104f
SHA512369d32c3135bb3104c969864c131095dfe381afac5212c5ec97d33022f0dfdc2d00305bbb6ccecaf06660fb49b186abc9a2609c942d9a3837b6755eccfb2ec5a
-
Filesize
380KB
MD59ee327e7e2fa5c9dac3a47a2d6a5a4a5
SHA1eeb4fa7c81e2ce829c49cfabd4cb275f023cf752
SHA256ead058229e43b2674ddb2a51299aa31d19e7669b8a234efab5098680bce01292
SHA512a39e98f7bfd45ba79b44d55343646bcaf76b1247491204a88747bdde2a524c478fab951e92552da44000c4358b0484024c6e0339c8df2b4af6459d952d8b9811
-
Filesize
380KB
MD5fa64c4deeeb1fc55a4d5dd99e1af5947
SHA1da88feb8acd73d815343905d533c231651cce111
SHA25671104da35f37144fce40e99322cdd71e99a7fd06e0a6577cc21921bed9b6cce9
SHA5126386e10ecc98cfcbdcd63ab99298cb116e1573dedcedb8035776d0246d3ab622d64f4a079279979d73deb64740588b0eaeec834b20ddb1e7cb1ce28e7044a58c
-
Filesize
380KB
MD5c9e102697e5e828f200740a4b85da5b1
SHA1009a6d2625190518f1d0ed78abec46b267778688
SHA2560df7c07daac96889246caefae032c85db5cba137bcb5ee69427f9cceb31248e2
SHA512f5a45db2c0230ba77457b4c3464e028806759084818be6e632b0a7960d93432c42220a3cdfc982a87a5caba6c9c676ba6b97c2b16b78464942876d0ad6485b1f
-
Filesize
380KB
MD5ceae63a1fd9f120f251f4dda44e279e3
SHA17c2d4e97e48adff286999b882ad61c7b19eb25ea
SHA256f0024b56e85e280a8c4c7b81bcedbd371fc24eecd9dceab64856f78c19b34c5c
SHA512bd07cdf4c1df518951a94444d59c57ce12cdd8360f63471145c151a889001b409e0ce277f8614d0ddc59b9d19b66c138806e40b6d18d3abc755004143736d1c8
-
Filesize
380KB
MD5fad660e8b475306d7dc437174c050947
SHA1f919b8212c7468f332b6e1f576d30b7259641f23
SHA256b1863219811b2e756c88c11d1089b280900d241141c15bdf816fc87b565842ad
SHA512e95e23c30f9286245791ad16c33ac9aad8b1bd852d83e1e51421f024052cee068cd851e9a831a5fe23af4346d6456d83e29ec478d1a0cab4bab5682bce45c86c
-
Filesize
380KB
MD52e452232256e84e308e244bfb0a01070
SHA179040d89a135a405728b0eeebd0e6fef6901b40c
SHA256f581b5029ea3fd77e1bc72db244f105b3b7e4c343bbea03e0f2c4f4667f92e71
SHA512830a869d4d0ad7a94fe35d99aa3446ab6500c2155480e158b8f85f4bf2c634f55e86df1291990e583d4a56804d5550d5dbc6fedf6933a2cc29052179bbcb8fab