Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/10/2024, 11:54
General
-
Target
2024-10-17_f6119b60aeb47307c6dfa7b454c007dd_goldeneye.exe
-
Size
204KB
-
MD5
f6119b60aeb47307c6dfa7b454c007dd
-
SHA1
0a5d1b0a7db77e121252b22ec764a47d189c0c4f
-
SHA256
f1f0dc003f4dfd2ba00ed8a38dbc941a9f9508a246f18227d94778ca9c03e96f
-
SHA512
3d48ec842e221771e7689090dcc15ede85ed1e653ff4c68bde4238d5d0b35a3c6666f83ebb810c06888e51415fe9e79e0cdf7f9aa2820ba67a706fc81199a863
-
SSDEEP
1536:1EGh0opl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0opl1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-17_f6119b60aeb47307c6dfa7b454c007dd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-17_f6119b60aeb47307c6dfa7b454c007dd_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B047A0D1-4B3C-4838-A99E-64023BFD7F74}.exeC:\Windows\{B047A0D1-4B3C-4838-A99E-64023BFD7F74}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D56E0B5-2A78-4904-B0CB-73744F375FA2}.exeC:\Windows\{3D56E0B5-2A78-4904-B0CB-73744F375FA2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D7B9E02-1DD0-4842-AE4C-D82B8CE7A585}.exeC:\Windows\{5D7B9E02-1DD0-4842-AE4C-D82B8CE7A585}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8035571-0871-4b24-ABDD-17A467B31092}.exeC:\Windows\{D8035571-0871-4b24-ABDD-17A467B31092}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14E696A9-DF8A-42ef-ABAA-059BDA11B5FC}.exeC:\Windows\{14E696A9-DF8A-42ef-ABAA-059BDA11B5FC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CA2A1B3-6255-493d-8541-E9BD71CEB56F}.exeC:\Windows\{0CA2A1B3-6255-493d-8541-E9BD71CEB56F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3B26B0C-C96A-4c79-8F7E-2FC8940131A3}.exeC:\Windows\{F3B26B0C-C96A-4c79-8F7E-2FC8940131A3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BBCB2B7-57EC-4538-987D-09BD761A74A6}.exeC:\Windows\{7BBCB2B7-57EC-4538-987D-09BD761A74A6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0907C02-09F9-4250-BD7A-840995E6B25D}.exeC:\Windows\{F0907C02-09F9-4250-BD7A-840995E6B25D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A312CF93-2196-4744-A412-FE32BBCE54EE}.exeC:\Windows\{A312CF93-2196-4744-A412-FE32BBCE54EE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD168915-B0AC-4d5c-AA75-80F23E8B3443}.exeC:\Windows\{CD168915-B0AC-4d5c-AA75-80F23E8B3443}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F076C9DB-2D9E-402f-9F62-4298B6BCAA35}.exeC:\Windows\{F076C9DB-2D9E-402f-9F62-4298B6BCAA35}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD168~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A312C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0907~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BBCB~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3B26~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CA2A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14E69~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8035~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D7B9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D56E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B047A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD531ed331d3ca899a9476c641b642cad4a
SHA175c9c3b04aec1a5dbcbaf248d1f332ab7aa65269
SHA2568454c025e60e717737831bc2cef305c532e6bb686ede80f706de94d2fe2c6215
SHA512492d6c7ff61dfa8828f048937fcad9e466355fcd307c12dee4ac0255254181bd75608de9816fa30ca79979fa847ff48445e74f10695db5dcfb132eaef4918374
-
Filesize
204KB
MD55c104234a0446b91949710ddc9921dd4
SHA1963126e20f149a2ffc9e913c5d4ce125a5ff83e3
SHA256c4f4157bd6251ba339bcfc580bb2e96d44f5335f81d333bb1a947833d042a9e6
SHA512a5e09cc8d6592df9cb72f2a37e4e4239b55130d9a26d6002a8a9973b1f1b9ebe26ebcf22af62ac2efb9ab1353b7bbea0a1aa9b9738d2eb8abe55b40ebacc53a6
-
Filesize
204KB
MD546fb4c2e7eed1c690aa6f2a51a73d60b
SHA1ab596a3c2a348d0e2aa462d41e0f8d00d85a296c
SHA256f28fde0b32c1f90c3b60b439a9a34b4608277864e6e8545c426a0661df953087
SHA51255bec121d8b7e611cc30ccc0a8dd8247fd44a5cd814ae4cd4d99c05d6cd8a689dd101370f507d6fe8118bd292944ba5c3190349bcc94d4d343c9c777047922d6
-
Filesize
204KB
MD59fa55142b02edeafdc4a21bac0075aff
SHA1e5c638bd600d91e3c449adf03d8c1b56ae188dde
SHA256966dfe590c9e1763411d2e58d52e736fe9ed70b778eeae67df67ad7db2c8bb6f
SHA512a96e302ce6f90b3c1d0fca752b76bc6c34465e7f71fe39c53b7eb640bea27c8751e3846abcf822eaec788d76927d5dd7ed6fe48084a65f44c504a03a75881627
-
Filesize
204KB
MD5c047397a263a9bb68a088abd681e2516
SHA14cb0b30bcad451ab8f71761b9856c12f584493d8
SHA25620ffd8ecc4c0e848a788744f28d90d82d1c8b5d69c5c8fb21ff292405a9d5d03
SHA512447274093c43158e6aeda51f0b8e8ecf077ae9568fb8cddfedefa2101e82cd53ba56187175c349d5035d922f1229ee7d545a022dfc4ddfd20cb21b986987f0db
-
Filesize
204KB
MD5e7dd7ba040d9cd4840385c158ddd2930
SHA19366fd186bc14e9c775e4222892159527498badf
SHA256bda098301fceb4ed1bcd4309c9d0a278c8313d310fb9da76abff6ccc5b6fa524
SHA512cd024e1c83d06cbfe1e768021eae81333282eb00f3eba7dd3391b7faf615456f8addea31941997e7d8b193ce2879669a4a2e404311c51e2bd0a5b7af735f3680
-
Filesize
204KB
MD5206e0553c123a7083b7f201dc25eabe8
SHA1ce1e5afe3edf40c00982812eadfcddea419da7bb
SHA256e13b7cd280c6e7417368c76d92b433d34a0643ffad95f88a253c1e0f00baefc9
SHA51280e95322d267a89ab8313e9fdcf8f61341eb071309087e0febc397f7255f5272c54ea4ba54aa88e0d52f8ca84138062b60a848db1259f7b1d60f22fe0466e333
-
Filesize
204KB
MD5bd6d58f2bd6f67c1df306e6123f7007e
SHA13211aa4468f6071a70c1b07835827734200b6e9e
SHA256b8785298b2a5366685274546c39c58d04accf6929c4beb7adf9581b8d0886535
SHA512e7f00f384f2760856dfee7533c2d3fb65d8c94653c8d757f097ac3256b0c853f93d6ef3cf38f5972dedab4dae319957a1c2d752238b0d29150d0d3e74798f32c
-
Filesize
204KB
MD50365367f00538e315214120f477ea01b
SHA11ca935c9782988a06914b139ea8d3e95931476b2
SHA256bf78819844b77c799b0e85dd978747143c980a98ce2c2f17a83d3a1c31211f6d
SHA512b12ab60f0b2c147c485bdb62f4affdd137c3a523d96f39da63314c492a5dbb75f3a912ad3fee1a35b642e60cf37600e91b63857ef737a0b019b806d32ac03d04
-
Filesize
204KB
MD53d886f0a8ca091af44be2a49c82abb12
SHA1d34404bc060a464a9a7a803f41beab2c99fa5220
SHA256f2853d619884066ed32398092e89cd32569d833fb7e67cb32e2aed5d50e45d11
SHA512f9b3764cda9b05b8590e0d8c337a9a9d37201de2b501d996797410f99dc6b235af33b573ae6b5ccf00edd4582fd04ea986e7d6ee8046a0ae6a3c7070574be1a2
-
Filesize
204KB
MD59bd83b21f8fa333523366b68c166e80f
SHA1f6e704a10361715065de448dd7100a4a34aa81fb
SHA25646230c206797972f7685d519f7183a60d29cd8d4c12bfe25177f430d7d37dc5b
SHA5121ba6442a9839e3721b32a75ffd418a2dd0adcd69a6c5cff5ab02d4fda664e5d2d8a853be1031f42f194911a513abf6cb08b0bb02c1bb6449b14837ef0545cc02
-
Filesize
204KB
MD5ff4c04f49ea779ec75a76b9908831866
SHA1078b345b9ecb5732792e29653def002a749de4fc
SHA25610786c79334622531bd217468744b2a63cccf34046aa476735ed21997ca0e2df
SHA512d98e1095c6c1a1fbf2dfe8d4838b02e8a3b204e759765526ede86d91216c890f2e59040f7f6141ec8a41b3336afa40f2d4ee97e06b6b9809fb1f85b24a6e7df8