Overview

overview

8

Static

static

3

2024-11-11...ye.exe

windows7-x64

8

2024-11-11...ye.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 12:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe
  • Size 168KB
  • Sample241111-pxbh7aspfk
  • SHA256 4a48929724328ee8677fc684521ac46170736cc5709b8ed8c93639b63b7a3221
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-11_2e30881cec45805dd847a371a3fd962d_goldeneye.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Windows\{15AED68C-706F-4642-985A-421C499C0CF0}.exe
      C:\Windows\{15AED68C-706F-4642-985A-421C499C0CF0}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Windows\{134BF5C3-B2EE-4721-9B31-5D2F25435377}.exe
        C:\Windows\{134BF5C3-B2EE-4721-9B31-5D2F25435377}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Windows\{04D8646B-E52D-4e65-8F01-63D7B19A28AD}.exe
          C:\Windows\{04D8646B-E52D-4e65-8F01-63D7B19A28AD}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4304
          • C:\Windows\{A1414401-1A74-4741-A46E-16BF2C9340CC}.exe
            C:\Windows\{A1414401-1A74-4741-A46E-16BF2C9340CC}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4312
            • C:\Windows\{B8E8E9FA-8F87-45df-8F09-E3647D191255}.exe
              C:\Windows\{B8E8E9FA-8F87-45df-8F09-E3647D191255}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1844
              • C:\Windows\{7200C66A-9611-4fd4-92AC-D6F953068154}.exe
                C:\Windows\{7200C66A-9611-4fd4-92AC-D6F953068154}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4420
                • C:\Windows\{4F5FFF31-0489-4464-ABC8-14BE941605B0}.exe
                  C:\Windows\{4F5FFF31-0489-4464-ABC8-14BE941605B0}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2040
                  • C:\Windows\{2386F7A9-CAE8-463e-95E4-6939A73B9B56}.exe
                    C:\Windows\{2386F7A9-CAE8-463e-95E4-6939A73B9B56}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3388
                    • C:\Windows\{6636970E-D32D-4f62-A14C-D6AF0AF45887}.exe
                      C:\Windows\{6636970E-D32D-4f62-A14C-D6AF0AF45887}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:5028
                      • C:\Windows\{D584552A-6947-4112-9F02-51B30C3BF7F4}.exe
                        C:\Windows\{D584552A-6947-4112-9F02-51B30C3BF7F4}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2940
                        • C:\Windows\{E0D8C0D5-8651-4675-A480-BA42DB925116}.exe
                          C:\Windows\{E0D8C0D5-8651-4675-A480-BA42DB925116}.exe
                          12⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3232
                          • C:\Windows\{BB9DB78D-732E-4890-97C7-21D6FD8B4CA3}.exe
                            C:\Windows\{BB9DB78D-732E-4890-97C7-21D6FD8B4CA3}.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4872
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{E0D8C~1.EXE > nul
                            13⤵
                            • System Location Discovery: System Language Discovery
                            PID:1520
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{D5845~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:1556
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{66369~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:1924
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{2386F~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:3184
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{4F5FF~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3104
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{7200C~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:664
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{B8E8E~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3160
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{A1414~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3580
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{04D86~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1196
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{134BF~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4396
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{15AED~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:516
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2904

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {04D8646B-E52D-4e65-8F01-63D7B19A28AD}.exe
        • Path C:\Windows\{04D8646B-E52D-4e65-8F01-63D7B19A28AD}.exe
        • Size 168KB
        • SHA256 9fcd1baa419fb21dd393525b6210bbf18eb729b9f0bd90a574737a7ad164218b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {134BF5C3-B2EE-4721-9B31-5D2F25435377}.exe
        • Path C:\Windows\{134BF5C3-B2EE-4721-9B31-5D2F25435377}.exe
        • Size 168KB
        • SHA256 ebb92a7e60d47bef14f18def7736bc45072e694ce815f3b065af1da4dc5f265e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {15AED68C-706F-4642-985A-421C499C0CF0}.exe
        • Path C:\Windows\{15AED68C-706F-4642-985A-421C499C0CF0}.exe
        • Size 168KB
        • SHA256 265f13d29e3012ea815f8921f252801687f95cf5d5664c2ad2460ac66e6b310b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {2386F7A9-CAE8-463e-95E4-6939A73B9B56}.exe
        • Path C:\Windows\{2386F7A9-CAE8-463e-95E4-6939A73B9B56}.exe
        • Size 168KB
        • SHA256 ee816043538cd03107e0f535db19c8f7cb460cea4da186cd224508471ee7d9bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {4F5FFF31-0489-4464-ABC8-14BE941605B0}.exe
        • Path C:\Windows\{4F5FFF31-0489-4464-ABC8-14BE941605B0}.exe
        • Size 168KB
        • SHA256 a3a31b55bf8a9dc5a55fca61aa54e2d5645246adeb38e1e3e13321b75a093687
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {6636970E-D32D-4f62-A14C-D6AF0AF45887}.exe
        • Path C:\Windows\{6636970E-D32D-4f62-A14C-D6AF0AF45887}.exe
        • Size 168KB
        • SHA256 a982ff23066622738ce662b73cfa60987823001e79de77969c26110f00f06684
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {7200C66A-9611-4fd4-92AC-D6F953068154}.exe
        • Path C:\Windows\{7200C66A-9611-4fd4-92AC-D6F953068154}.exe
        • Size 168KB
        • SHA256 c8108e29d1311a0c4d775a11c56a05761e2fad62da748eb94a1a3b2c571c986e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {A1414401-1A74-4741-A46E-16BF2C9340CC}.exe
        • Path C:\Windows\{A1414401-1A74-4741-A46E-16BF2C9340CC}.exe
        • Size 168KB
        • SHA256 8a1b5569276a4f0d4b90b6e68e80694271a53ace54a366206cdf0dd4652a8bb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {B8E8E9FA-8F87-45df-8F09-E3647D191255}.exe
        • Path C:\Windows\{B8E8E9FA-8F87-45df-8F09-E3647D191255}.exe
        • Size 168KB
        • SHA256 0a6e8233ba8ef9af3fc0c0efda3b93398bde67c44351d08415cf745d1a0c2157
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {BB9DB78D-732E-4890-97C7-21D6FD8B4CA3}.exe
        • Path C:\Windows\{BB9DB78D-732E-4890-97C7-21D6FD8B4CA3}.exe
        • Size 168KB
        • SHA256 ee7a0d4e6e03fbbd8979ebfbb50c0e85451de5b0fe7f383b7a7e49ec9bde74d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {D584552A-6947-4112-9F02-51B30C3BF7F4}.exe
        • Path C:\Windows\{D584552A-6947-4112-9F02-51B30C3BF7F4}.exe
        • Size 168KB
        • SHA256 6b78723dacff327c897aa908197265e72f445bd39d4cbf21cfc3c2abf8327e84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {E0D8C0D5-8651-4675-A480-BA42DB925116}.exe
        • Path C:\Windows\{E0D8C0D5-8651-4675-A480-BA42DB925116}.exe
        • Size 168KB
        • SHA256 ee52174130f713f18afe0a05fa317cb59bad4cdba80a8a7bd299b33b578e19e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download