Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 10:01
General
-
Target
2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe
-
Size
408KB
-
MD5
fb7a014ccb227a9f8fc425ea6808aa92
-
SHA1
47c326bf0113753975bd64acd139574f51048943
-
SHA256
3713d713584f6daff65e9cd220f01dd50d3e19b4013a7cb364bd9d4c03d6b4e4
-
SHA512
49851bcd41c5ba81d790821a2bc02e0f45ed5d974b6f4f92146cc1c46d623d8095adddb8f450bbda3ea9154adea7fd3765ff32ce118ec935e5ff7922d7637608
-
SSDEEP
3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_fb7a014ccb227a9f8fc425ea6808aa92_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB20F9E1-9880-41fd-A4B8-2CD61AB68BF2}.exeC:\Windows\{DB20F9E1-9880-41fd-A4B8-2CD61AB68BF2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D045E048-6A1D-449a-A4FD-C932B9E2EEFA}.exeC:\Windows\{D045E048-6A1D-449a-A4FD-C932B9E2EEFA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{708D1A3E-1667-4cc7-8835-933C4ECDC5AF}.exeC:\Windows\{708D1A3E-1667-4cc7-8835-933C4ECDC5AF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB10C8CC-235E-4670-87C4-2AC46E9BBDED}.exeC:\Windows\{CB10C8CC-235E-4670-87C4-2AC46E9BBDED}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BE39154-1E24-479d-A4BD-51C13D60CA5C}.exeC:\Windows\{9BE39154-1E24-479d-A4BD-51C13D60CA5C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FEDE442-A5F9-4dfd-A86A-6EDAEE1F2AD4}.exeC:\Windows\{2FEDE442-A5F9-4dfd-A86A-6EDAEE1F2AD4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D28CE91B-466E-44e6-A868-B20E4F244246}.exeC:\Windows\{D28CE91B-466E-44e6-A868-B20E4F244246}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A774860-574A-4bac-A560-056153816336}.exeC:\Windows\{0A774860-574A-4bac-A560-056153816336}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C21EA190-B528-472b-BE8B-31734F304D9C}.exeC:\Windows\{C21EA190-B528-472b-BE8B-31734F304D9C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFFBDAB9-7213-44ac-8B52-C8F0ACCA9596}.exeC:\Windows\{AFFBDAB9-7213-44ac-8B52-C8F0ACCA9596}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1C9E1D9-E2ED-4195-A2CA-CF9142E1DA45}.exeC:\Windows\{F1C9E1D9-E2ED-4195-A2CA-CF9142E1DA45}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{09D6918A-8558-433b-B17B-E0FACDF47798}.exeC:\Windows\{09D6918A-8558-433b-B17B-E0FACDF47798}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1C9E~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFFBD~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C21EA~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A774~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D28CE~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FEDE~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BE39~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB10C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{708D1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D045E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB20F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5682927fde2792f8d1f3a5ff592f9c91e
SHA1f67f615e987558bca240c88f45bf722348ed9dc8
SHA256b9730ad3344ccda22566d4f376e53286a2b4cb1b344a62810ed069f1f73614cf
SHA51205ea27cf0afcb32a13dd49d15f53ef904018287a89feb3b19dfbbbe1f743ad57afdad06a7448b1ba9b6c0234f29da076165a51fb5ca3516905789502bbedd987
-
Filesize
408KB
MD5216602150218c5eafb92e25d7f0bb952
SHA1ab5ffb6cd5cce07af9761bdcb3eac8c2db2b9a1d
SHA2564fa68caa4112880e630747418419051ed0c6f4e1ee567146a3efd1697537ff8e
SHA51249f2501b82881f613b14d2e7d27adf56c14155e1d58abc6a635079dbb53c47d73a874bf07214101e30aa4170d2676dc7bbdf5ff856341f02539f41fb35242e20
-
Filesize
408KB
MD56331735940beed4980d8dd7405f54f76
SHA1a3f8422a7e59f5d24601f64f6b708809349a07a3
SHA256b19c05a68d7f463d41edb85b6f8f642ff7060a09201e6ffd07f152b0c06cc162
SHA5121b22abfe069b21404d24b51aa8d9c26f3604c7d75aff7c3de7274b18896a8692f1019021d35dd2c5ea32f86413b55c169e998da2f6e6d927e76407961db62132
-
Filesize
408KB
MD5c4b4acc6da935fdf477aa020fa851676
SHA15d7bfab11cb9c92a4a72b12ad72dd1efbd56691e
SHA2569c8959f71584fd2935a7d29957df021d754bf24a7fb54effd09958084fb19a68
SHA512ed139a2d10ac56f9043402dfa7384940e363d4784e9756d5d179e054d94bcb91b663f1dde966b96f5c3be12b2e509c4bfe86468a75dffca25de437588ffb6169
-
Filesize
408KB
MD57e8a736f5adce74d049c68a61ae43aad
SHA1f1f96fdd70ede9a002e15d3a8522af1e5d6ff77c
SHA25660632e6908da981d5895a78164ed85b21e5d65e193cdded90f4c0343ab234164
SHA512424af2e13634eb38ad4a0961dfd3b203c21f312e252ed8cb0620fa136b48a2e76ffe5ecedb3b30bcf8e0e48929f52ed02fbb729e1f0b6a3b595f09b87cbaf82f
-
Filesize
408KB
MD5a6e43b0899a5f1909e01685ac50fb019
SHA18836e8325e02c8a53fe29f00afefda96db8c57bf
SHA256fb81525067a7646b375f406c6b057728e5dc2048ea6fa8b6ebfb2572eab91165
SHA5124a95f5c11a9757198770cb2c6402d15b09654bc56ea73ec89edb3989d5803b3f18b4613049d8e4f13c596e4011c2b35f4a269e38224006584d842d012775a151
-
Filesize
408KB
MD535544c34b38af55c7de1475648cc73c5
SHA12ed925b215dcb8901bc00f44d6618addeff6fa58
SHA256214c9e688935ff44484c9991674c845750af5812def343538cbd500795a6bf49
SHA51204b3a473ea4c553c63b30537c7782a8722fc8cb6357a7cfa79901c2f8fe418324405c9655a3bc8678b3399990dbe8da76f87311d0d5abe5b894ba69b86c14bcf
-
Filesize
408KB
MD58760e7e5b32abf80aad6d7dab1b36873
SHA15b38043ceb1e03a5ea9d427d658d77e1773de26d
SHA2567022185ef749e47462ddec016d95bda23bd9194e7c4e542f88fc24698765e037
SHA5123e6fc1d1a4dd9e9a2abd93d942cbf37fc5002456380eb919e09efc0e95e56de38a1ea2840b539e7620b80973d8b7ec649f61d9623b65be692d625138236a5a86
-
Filesize
408KB
MD587129918cfaffcee8dcb00cfd519ec7a
SHA12600015b0ea6a13e60f592c7627380c8100e77d7
SHA2562477428790f3dabbc6536b97836e0650081c363340ee116559df879de8638ec6
SHA512f4477746061af043007ec4ca16714985c1d92c3a9f0ec5fa21d725edb4e05fac06d030a5e310da21486ceefa79455e9d6ff4273c51c3a14909cd0777c723e3e7
-
Filesize
408KB
MD580c2c86270f8dacf118db3cb45fa3813
SHA12c0881fa802da0efd165981afa22f4fa33f0252f
SHA256b892ca81481f50d3a6600a44caa6eab78feabcab70bdb0d6f9064c2502851383
SHA51252930676fa760d8ac2f18355f89b8a1ee1cddc81c27df734d4882e68aa1c084d558ceb0bac0e1af8c115387f72c3475b918d98f174320cf0c8a5eb4b4fb1f8ea
-
Filesize
408KB
MD555c32047db60fbbceea2e68124018109
SHA13f78eace1ae15180b208bd8cd2fd60d0c0390ca2
SHA25618a790d162f9e73bfe8aacfde71fcd0d54f9608c9e6acb2c03ea52496e402e9b
SHA5128f4c0000dbcaa0ba392c8df11656b2c8069bf731ff236876e8573329cf36fb6c21596133d69c20dec926cb6e71af97a4b37195d89a82fdc2ee3687af088ac201
-
Filesize
408KB
MD544830da513680f2b5c3f13a5bb3c31eb
SHA1b5fd3ecdd88cf7ecac146d0b9caffa912e6a7939
SHA25651aba62ceb1cfcb21be6a65b0ab6f87c3be7ca5b4f4731de728803cd6e0d27a3
SHA512e9d43d1690ed788ee72dda04abd9228e0e7595a89ae3568d7d9f6cee1912436c4318cdab813e7611d33096785e296289b3a2379a2e50dc031c360b5f15fe47b9