Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/10/2024, 12:14
General
-
Target
2024-10-17_9bd6cbaf6a2aa3bc6d82363ab612c717_goldeneye.exe
-
Size
408KB
-
MD5
9bd6cbaf6a2aa3bc6d82363ab612c717
-
SHA1
5e4693a71831148e258831fa71ce7d5fc9568301
-
SHA256
b0c4f17ae6ef89db53ff0079a2d220d839d65b6ca9bf4f77f71bc668fe45be7d
-
SHA512
1c0cceafe5376769207503b6c3f9865b5a2690b64fa14334674443488c47a7dd56c2241f8a9255a6ec6cbf56d879b0361e736dc1e59d02a760eff754b5660179
-
SSDEEP
3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGZldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-17_9bd6cbaf6a2aa3bc6d82363ab612c717_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-17_9bd6cbaf6a2aa3bc6d82363ab612c717_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD358954-447E-4582-8993-C19ED7CC6554}.exeC:\Windows\{CD358954-447E-4582-8993-C19ED7CC6554}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{768B1230-A3F7-4888-A552-F699124733DC}.exeC:\Windows\{768B1230-A3F7-4888-A552-F699124733DC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC79A317-3403-4f89-962E-099E632471D0}.exeC:\Windows\{AC79A317-3403-4f89-962E-099E632471D0}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06BCF2B5-601C-40ec-AF48-C272E870F27C}.exeC:\Windows\{06BCF2B5-601C-40ec-AF48-C272E870F27C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A6F7F40-AB2F-40bb-8695-824FFD9BE2B6}.exeC:\Windows\{2A6F7F40-AB2F-40bb-8695-824FFD9BE2B6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F690DC42-E931-4306-8432-19218A078ECA}.exeC:\Windows\{F690DC42-E931-4306-8432-19218A078ECA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E85D2C2-8DC5-4d7c-B7C5-FB0C6744E33E}.exeC:\Windows\{4E85D2C2-8DC5-4d7c-B7C5-FB0C6744E33E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A823B38-9A19-4d2d-ACAF-F5B56F27C252}.exeC:\Windows\{5A823B38-9A19-4d2d-ACAF-F5B56F27C252}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1EA67351-E58E-485f-9B95-3EB00D50DDD6}.exeC:\Windows\{1EA67351-E58E-485f-9B95-3EB00D50DDD6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6726153-3B0F-4a15-B896-30E81DA6BDA3}.exeC:\Windows\{F6726153-3B0F-4a15-B896-30E81DA6BDA3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC3FDF12-DA92-40c9-B82B-5F3158107DD0}.exeC:\Windows\{CC3FDF12-DA92-40c9-B82B-5F3158107DD0}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{E61BCCC4-4B71-4a11-B36F-D0E85F1E87C0}.exeC:\Windows\{E61BCCC4-4B71-4a11-B36F-D0E85F1E87C0}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC3FD~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6726~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EA67~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A823~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E85D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F690D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A6F7~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06BCF~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC79A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{768B1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD358~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5fb27cf77ad658a3ab899a266c02616f6
SHA1a42f8fe0a86617027ab7ac6bdeee04ec33ba84c5
SHA2562ce9b130a5bd3e5b7e2bc0571310c1efe19f68d42bb45b3732d4e20b111215a4
SHA5122a56f17873b2cfadd9dc7de4851988cf2a2c772d1d98fb3506da67848ee67c23e2f7e812613feb900863cbfc146b605120b0a9d8b3cb90d3047bc6c605cc4c4e
-
Filesize
408KB
MD5e83760e694ccfe700b74074332ff5396
SHA139e65bf1184f497242724c1640e3fe646942f652
SHA256178e3cb3bccfc79f9e00c03f5d01569d0dd3e33a2a94dbe9302f22ba187bf921
SHA5125356bca5830c78dc75a609c923c663b5a6bc08cc59013984f8979d5ffa9ab79a9187be91b4f913f4bf60c539e2e1a12dc282990e0c912c62571bcd60b8c2a5a6
-
Filesize
408KB
MD59c0d27bc3ae4224cc308a06a32ba0aa7
SHA1b73adc594eb04c7d155c4b58652ed743b98a0f80
SHA256a0c4938825edeb36f056ef9d4916b746be0c99c9a2fb0642e32c643476bd1843
SHA51256457409da143eb029d7f50713b658d8b103e999047b809e67d4b7676df94fd51225cd190646eb3c6b144276fdd0231277487828e5284ea8f0a0e3dacf63e1f3
-
Filesize
408KB
MD56feaced591f01bec33c1ae48e4b343b8
SHA15e2b14b223fcfc72ba35564367b873ab698a2758
SHA2561c04f8e06afbf30643c9250f552bd9510ea31a9dffbfc623269161f3d9a19507
SHA512c89ce16aabd5ba039f4a8349db5af6715f0213eb434775adb0d0963e10296d513278d1096ea966d7905f2e7c5c59694a56eac9fba8cb466c9c71976c7db946ea
-
Filesize
408KB
MD5efa9966d45bd32c84b048e4597ce40a9
SHA10217ae2f9beb58072b0f60587f362cda7d89b248
SHA256ab57e7f8248d4d07066cebcd544214172d1ddc0ff9a7fd45a6095cef60a30c59
SHA512a4755732c3ff8c32a771102df5296b8d23f7dfeadb051d16d4819e6660b223ef96c80f6915208c2086f645266bf06ed6c5ec0c0062080d3bd5821271fc4f644d
-
Filesize
408KB
MD51d4b28d805cab3981bfb9e9c70924d93
SHA127072b663ef9c855b0fe01db813abe1177857cff
SHA256229e9b36ad434e4f9fdeaf247abe8c3c188e049929eb0be5495cad8964db9b0a
SHA512bc58b462d2de02bb0f12f2c00284d93c3975c27096e0eab8f9ab04f0cad183ce1ac8d31af88194022209d92bcc33292ea16390d9acdfdba04ea83b80bdfd7ea2
-
Filesize
408KB
MD53eb457fd1915afeb633dccc1b92b4d51
SHA1ec8a715e6582c46f9bf91af78539b61b56bc11b7
SHA256ce6420591b096c19947f1df896e7f010cd9053d3af1752f261e18b7bde6913f2
SHA5123833b8166f22356a745854052d6adf892f37e4f162b3f6f719db2f7abfe679c5be9bc3ae580f13aab02672a843774cfb359f260cff067a3a310dc1028bf4f340
-
Filesize
408KB
MD51cfc12abd9dab9b791949a64cc39890f
SHA128573b0572e889ea9801af48849dbccf790b1540
SHA256365bff946f8beda431afcc3955bd31248cd7f3d4eccef9d4d7b765de068b60d2
SHA51206b7e9f84586e2ff287880fedaa2550ddd0bdf2e5c160a7040beaa343b64235210089a0ed4a7c189cfe8beb045940c7a36411fc5976bdf6266bfdb4cca34b9cf
-
Filesize
408KB
MD55d3902f439861d289fa9bc435c8f5805
SHA1ddc7a631e63190b7e58a2ffa439c29d0a977716d
SHA2568c6a7cd3d51d31115c07b015f9d9a147d31dee517371bd08dbb6a15b7a45215d
SHA5123588f28a1b14631b051710222570df931ef9034d1025c2d4609feb024b4adafeab81d398c1abf6a2e470c9aa8c9f9d28dd9843f21eb460dc9c9b197174447121
-
Filesize
408KB
MD5b7b665c5f625788ad270989af207c501
SHA1c08dbd68980a55fc88468c8c9717d0cd38a0ad7d
SHA2561ead9f848345ff3e54eeedcd675e484d23b3364a886549dda69ab4198299650a
SHA512bcad73f884b1e539e98f9ef9fdb019e25cdb809219cc8e9d689f641fbf7cb9ad0c204884ccf4f1852d4f1af3c1f2a14ce19b99df28707833436745caf2380e3d
-
Filesize
408KB
MD57b0718cb0ffae22c7459a6b1bec9e4bc
SHA1588eba41880dddac1f5360a98201d84372418279
SHA256cf61e9d5aeb13f46ce56b4e8c2a2a700b324cf44bd83672050ca4a1317244acf
SHA512c99d3270a37352893e3961806c785c663dd5e065a04297da40f813b0eee12b1bf3b0d0a249c332b10e6fd3557677efd55af3c2c63d12a469f57cd8f02720a55e
-
Filesize
408KB
MD5d6ceb0ef220e332a21a691f4c0137c4c
SHA10647a70c4478792e85c6e24d9e931577841f49a6
SHA2564f3026daa56ef2a59621484c643282fc6fce52863263f19882934e007561400c
SHA51296d9b119b08b9e4ac039aed94ea15cd6d14601fb5545ce792a6e66a311e0ec6ff51b80bf5124d340f374069ac58a615cee5f7e7ee90f9a6795cb1b5ee3a1c70f