Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 10:12
General
-
Target
2024-10-18_7f4e20fa714569ff92b386b7a22e8e48_goldeneye.exe
-
Size
372KB
-
MD5
7f4e20fa714569ff92b386b7a22e8e48
-
SHA1
8caa4e34379378b282488e212b02af3ed9409bd5
-
SHA256
c128477b6927ea4da604ce23880aa23c8ced0279340b181e1dbdc2fd69435e55
-
SHA512
bf9b9ee97c9c6376beb59184e710c95aeaf78c790822f4c2a081197b2cba09b74515574f816424c67ec82473bc56c2656d05e0cf572a53e7d84fc52f069b45b1
-
SSDEEP
3072:CEGh0o9mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGyl/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_7f4e20fa714569ff92b386b7a22e8e48_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_7f4e20fa714569ff92b386b7a22e8e48_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{727226CB-48D7-44cc-95B5-2EC956EA0188}.exeC:\Windows\{727226CB-48D7-44cc-95B5-2EC956EA0188}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4571ABA0-B2A1-4b3b-8258-1B628784D4A7}.exeC:\Windows\{4571ABA0-B2A1-4b3b-8258-1B628784D4A7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A657BA4-0D7F-45ae-8D01-A1B7C5C4AAD8}.exeC:\Windows\{6A657BA4-0D7F-45ae-8D01-A1B7C5C4AAD8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCA83D32-E0CB-4034-AA83-8C77BA26C4EE}.exeC:\Windows\{CCA83D32-E0CB-4034-AA83-8C77BA26C4EE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C8771E5-D0B7-47b8-8EBB-AD5CE92B4D2C}.exeC:\Windows\{4C8771E5-D0B7-47b8-8EBB-AD5CE92B4D2C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEA69E60-5537-4c35-AE71-7339DB63D2E2}.exeC:\Windows\{DEA69E60-5537-4c35-AE71-7339DB63D2E2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEBC6F00-09B1-4415-B669-714734911DD9}.exeC:\Windows\{EEBC6F00-09B1-4415-B669-714734911DD9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C9FE0B2-02AE-4e0d-B262-F6C76799CB4D}.exeC:\Windows\{6C9FE0B2-02AE-4e0d-B262-F6C76799CB4D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06D39040-BC7F-4446-B467-0745CE6EE29B}.exeC:\Windows\{06D39040-BC7F-4446-B467-0745CE6EE29B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FE51DFA-FE16-4ffd-B593-BF7DAD636398}.exeC:\Windows\{4FE51DFA-FE16-4ffd-B593-BF7DAD636398}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB22CFFD-0D5D-450c-87A8-283D70F247CE}.exeC:\Windows\{CB22CFFD-0D5D-450c-87A8-283D70F247CE}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{E841F682-9886-4a74-93A0-E9BC8C179097}.exeC:\Windows\{E841F682-9886-4a74-93A0-E9BC8C179097}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB22C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FE51~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06D39~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C9FE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEBC6~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEA69~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C877~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCA83~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A657~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4571A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72722~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD516ad3dc38113ef72a822b5d5962ce860
SHA1f30e19698dea5648a21cc9292a27d85c4a9f92d3
SHA256e4c0c2b68d21573b648694b495b8f955f72b2c449c9329ff8d6de60eac1efae0
SHA512067191a85fbaa0acd89690c58d4ed18a60967ced5bf00c4e5c918fe0ed6390e3216f033d4857c861008d29cae400edbf5e2c9701e664943f9da5cd74626a90f6
-
Filesize
372KB
MD5f95959440a11fcbbef5127fc00a55d2e
SHA16490629703d30397a5d5312cdf76a0a72e3095be
SHA256a31d0fdd392996758d498d090fffbb381f87c127613b020b2727a18180a66ef3
SHA5129f84881d96674f97e31a4a72e7e9ab6199e5df151e61fef9fb1780aedf3d807fe35eaf634ed56cf9492705ca1b0ef26e700037b8a87f0ceade2b222d5cb2df93
-
Filesize
372KB
MD5d71446868a5a4fc25a31776d304f50ee
SHA1d73445309736c56c0f9040cda6d5d30a5d8d4dc5
SHA256100afeda41d4d41ebbbabd1ddf3512997dce0aa974d6cb7659aa0b18dbd17ea3
SHA512144d34d3df9e26f899546bd2d8ef1114f1a3b09f741801c68f730eb01f2e3236a6b1974392686f480380ce7deeb8818d65986e979a37745154da13b902d2ce15
-
Filesize
372KB
MD5f2ec0b73ff5503977479864237d98f0b
SHA16e1a4870dedbde2a321224eaefd3c89b1efe3103
SHA2567e33f8cf78ef574ed67e682f25603a8bf38de9ed9d91b715915b4b0542d673a1
SHA5126f7045f136a8677ccfeae42c869c88102ace008ef24f5c90674b37240c84e2613e8df3ddf9833a20d852ea6894d443ce21fc99b5ab5733f65c74f45a07700d70
-
Filesize
372KB
MD5558eace9b7fef72b8b5608181880e88e
SHA1a737db6d82fb2286597c6cde14acd8f420a7cd08
SHA256d9b609f95262bb757b97901956f8cfe40febe43d0d2516d98628d9595b834c69
SHA512af25ee284bdc947cef8dcc683a20a7e654492d72b69f7631ea5a852ec11c3474bddd75bb5050ac22ffd1490a6325886aaa8abcb1f51d8c6157a703a21bdf98fb
-
Filesize
372KB
MD549e435d563d26c22961244d913bbaab1
SHA1ad26673da2043ec96661d1dce5f4f85e88966be9
SHA25625ab2e51cc094f69a2f27f92a43d32fd20c8e4e2c4cc1a416f2f7ce2189e2f98
SHA512371aa6e4c898db8c2b2ce119af1f1d16a8938d35e3ab498023b2be2a1bec1b3d8cdc3ae2c970bcbd53f4ca2142bbcdd943bd26ac62cfa237423fab0ec149ffa1
-
Filesize
372KB
MD5c4c8413403f188ed0dacb07f02d60b05
SHA130059cd54bf5e9218ea953a880f244dc08e4126c
SHA256f7357b4c8b39f853b459ca3c6a5ed28524646c51d42e8af7d5bbb85c9d57a3be
SHA5124a9ba0fb48686eeb7cf8b6353701213b49f6fe1be93850bdb6a7816e88a5197f80411ab55f78cba1eb067f4979bba291a1ab0e2e0d0086e24d7161034fb751a4
-
Filesize
372KB
MD585e23a2f80f53600fb35affd2452a849
SHA1f0e4b75e6aa872c00ca4fcd566589ba57b8bd270
SHA256900ac8796d9fde5e058ad302adbae128b9afc038d6087cf02a530c5a2d05daca
SHA5122bdcc117c03c15b5767126449c5f27a7e9625dc887ef9fa5c40a2a0446f1c023fe256b028167fca6818428524dbad535d0de647c48ea7d0cbae8beb7c2f4466e
-
Filesize
372KB
MD58e285bac6739dcaa845ed44021118efe
SHA127227a20d77dec5d946d2a07b4a16b840b895f49
SHA256a322edb54b68d8b9daff623c7af8c5c7902b6ef515a6cd99c7ef173b0362b888
SHA512ba508f24bb7d556b7366239b308eeba2cb6dca87255625db7f0ebe38c88e6aeac6cd3b15f1ecfdedd680d8a214f7351a13824fd2a77c5f6f916a2a37c4ba3357
-
Filesize
372KB
MD554cf69c769e3f597207c2725d60de7ea
SHA151e104505d6b0ca84101d99f17fb092bfe44603b
SHA256c8bac79c486f718f369ab61b2dfdbfc2c14d9235af5213d868244510867ed24e
SHA512e8965fb21c1ca6957e7a113281bcf425cb30eb6ef4a2739028dd45467ae1cb5ed31b3e45a2ceafed80814608f3fe3920c30bfb95a3a8db6b4ec2f4c481fe843e
-
Filesize
372KB
MD54d1f50ed36c330bbedde9696ff7a41c4
SHA1b76e01d00e02675320aa221b4d3f4afb61b8b69c
SHA25649a453814f7cda1f935f6cb87447a844ea7b502a744501d8bd829db5fbc36766
SHA51266cb26319d63fac7f6facca35072fddecef50a65c5f2dba73edb76e54e309b1c09adad696704b9bbc4b4aedc97e11dd5f9085e670ba1dcb4c15dcbaf2e8c4ee0
-
Filesize
372KB
MD57fba310280506db091c295eec9dbf93e
SHA176e5c9aa55231df0c84cd5497e9483eb67cd810f
SHA256318db7265b5dbe076b48a52a5f1333ecd68f13b83277428a2b7833c9d646dffa
SHA51209994bf239a79d0bcfa6b53939c64684feaa135d4fc41940367ed9362dc7a08d25d428277971025fc0297125f3e07cfa9101e60546573453193e4861d5f6d28c