Overview

overview

8

Static

static

3

2024-11-11...ye.exe

windows7-x64

8

2024-11-11...ye.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    144s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 12:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-11-11_a9814e9f37ce3de7fc5003d08703a386_goldeneye.exe
  • Size 168KB
  • Sample241111-pyvcpazcqa
  • SHA256 c41a94fcd55fecbb3c558e9dcaa69db7e8d82475dd37653d51d36e5dce859ebb
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-11_a9814e9f37ce3de7fc5003d08703a386_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-11_a9814e9f37ce3de7fc5003d08703a386_goldeneye.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Windows\{36F5B0A9-2CFB-4687-9552-C7E8E1D576FF}.exe
      C:\Windows\{36F5B0A9-2CFB-4687-9552-C7E8E1D576FF}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\{9DFC94EE-6CC6-4121-A2DD-EDE405B09F16}.exe
        C:\Windows\{9DFC94EE-6CC6-4121-A2DD-EDE405B09F16}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Windows\{4FB46A62-85CB-4726-B059-3A56EF104DA5}.exe
          C:\Windows\{4FB46A62-85CB-4726-B059-3A56EF104DA5}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\{0919E7EB-F21C-4f18-9826-DCF9F7B99FA0}.exe
            C:\Windows\{0919E7EB-F21C-4f18-9826-DCF9F7B99FA0}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Windows\{2859455D-28FF-421d-9927-C30BCA4DE292}.exe
              C:\Windows\{2859455D-28FF-421d-9927-C30BCA4DE292}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2652
              • C:\Windows\{F6034D52-3871-4e8f-BC37-86CACDDC27E1}.exe
                C:\Windows\{F6034D52-3871-4e8f-BC37-86CACDDC27E1}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2024
                • C:\Windows\{AB04C9B0-E68D-41f7-A0D3-2685E652AC7A}.exe
                  C:\Windows\{AB04C9B0-E68D-41f7-A0D3-2685E652AC7A}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1560
                  • C:\Windows\{E9051735-DE32-40f4-8D47-BB83102B6CF5}.exe
                    C:\Windows\{E9051735-DE32-40f4-8D47-BB83102B6CF5}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2368
                    • C:\Windows\{739100CD-99E8-4c1a-BD13-BB725914A8E5}.exe
                      C:\Windows\{739100CD-99E8-4c1a-BD13-BB725914A8E5}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2648
                      • C:\Windows\{240573A9-2182-40e3-AF2F-B4100EE1B230}.exe
                        C:\Windows\{240573A9-2182-40e3-AF2F-B4100EE1B230}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2436
                        • C:\Windows\{63040175-D15B-4d3f-BFFE-50CB1455D068}.exe
                          C:\Windows\{63040175-D15B-4d3f-BFFE-50CB1455D068}.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1136
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{24057~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:292
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{73910~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:1288
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{E9051~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1624
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{AB04C~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:840
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{F6034~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2124
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{28594~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1160
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{0919E~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3040
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{4FB46~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2760
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{9DFC9~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2588
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36F5B~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2728
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3064

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {0919E7EB-F21C-4f18-9826-DCF9F7B99FA0}.exe
        • Path C:\Windows\{0919E7EB-F21C-4f18-9826-DCF9F7B99FA0}.exe
        • Size 168KB
        • SHA256 7d62274a1f66eed6a4ec24a46785ad3abe194a1183facef3d6d074f4e7d4a5d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {240573A9-2182-40e3-AF2F-B4100EE1B230}.exe
        • Path C:\Windows\{240573A9-2182-40e3-AF2F-B4100EE1B230}.exe
        • Size 168KB
        • SHA256 f2b691c45a2b9b53689c5efa5de584c929bdbbafa7faaf42813d81fe5acfd920
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {2859455D-28FF-421d-9927-C30BCA4DE292}.exe
        • Path C:\Windows\{2859455D-28FF-421d-9927-C30BCA4DE292}.exe
        • Size 168KB
        • SHA256 0b09570a651f939e61a70cc2717d7c3437b9a5c1caea6fd2b02e9371a06ad828
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {36F5B0A9-2CFB-4687-9552-C7E8E1D576FF}.exe
        • Path C:\Windows\{36F5B0A9-2CFB-4687-9552-C7E8E1D576FF}.exe
        • Size 168KB
        • SHA256 cb159df8db98cb5e8d80a19ec69518b4c2d3248e2621f6aa6b3a35e87b1b07c6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {4FB46A62-85CB-4726-B059-3A56EF104DA5}.exe
        • Path C:\Windows\{4FB46A62-85CB-4726-B059-3A56EF104DA5}.exe
        • Size 168KB
        • SHA256 5f213d74cb748e0e3dc6476f2b7b79d6b49db0319575d2ee5e1d87e3eedb1b12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {63040175-D15B-4d3f-BFFE-50CB1455D068}.exe
        • Path C:\Windows\{63040175-D15B-4d3f-BFFE-50CB1455D068}.exe
        • Size 168KB
        • SHA256 95b9c60ec32404123202749199b50724d51127db38340f717bbe7bcd80a5577f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {739100CD-99E8-4c1a-BD13-BB725914A8E5}.exe
        • Path C:\Windows\{739100CD-99E8-4c1a-BD13-BB725914A8E5}.exe
        • Size 168KB
        • SHA256 96f157635f1895cd84177ea672fd91caa97e7f8c49131b96a7496df29c1c0429
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {9DFC94EE-6CC6-4121-A2DD-EDE405B09F16}.exe
        • Path C:\Windows\{9DFC94EE-6CC6-4121-A2DD-EDE405B09F16}.exe
        • Size 168KB
        • SHA256 9a2186aa39e5b11ca4cfde0570ee47bd7ff1f95b24e11c77442e710dd4be6ec1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {AB04C9B0-E68D-41f7-A0D3-2685E652AC7A}.exe
        • Path C:\Windows\{AB04C9B0-E68D-41f7-A0D3-2685E652AC7A}.exe
        • Size 168KB
        • SHA256 ca1c0838563861ad4ceb2448e3a301deeca33b011148f8f7db9f8c026eecb4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {E9051735-DE32-40f4-8D47-BB83102B6CF5}.exe
        • Path C:\Windows\{E9051735-DE32-40f4-8D47-BB83102B6CF5}.exe
        • Size 168KB
        • SHA256 a7b5f180a1dac13dc40ad3f8d5967d2dcd03333625096015ab19ebd61aef1861
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {F6034D52-3871-4e8f-BC37-86CACDDC27E1}.exe
        • Path C:\Windows\{F6034D52-3871-4e8f-BC37-86CACDDC27E1}.exe
        • Size 168KB
        • SHA256 7e976ef97568eac84bf9ebac5eb0ac186a8aeaccc79645df7e35739de59ce547
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download