Overview

overview

8

Static

static

3

2024-11-12...ye.exe

windows7-x64

8

2024-11-12...ye.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 14:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-11-12_6670859f8b7b25565e348f2c8fd04680_goldeneye.exe
  • Size 216KB
  • Sample241112-rrrpbsvbpm
  • SHA256 900e62813b042932cf7e4bc49025dbf62cd132c7458fbbc11b2806ef1cb27a7e
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-12_6670859f8b7b25565e348f2c8fd04680_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-12_6670859f8b7b25565e348f2c8fd04680_goldeneye.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\{B07B81CE-06F6-4054-9EA1-6980FBB2BE33}.exe
      C:\Windows\{B07B81CE-06F6-4054-9EA1-6980FBB2BE33}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\{1BC8DCC4-4B0A-4c4a-A189-8CC24CC18B12}.exe
        C:\Windows\{1BC8DCC4-4B0A-4c4a-A189-8CC24CC18B12}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Windows\{FE5D8904-F77B-413b-B11F-1C029C72DA3E}.exe
          C:\Windows\{FE5D8904-F77B-413b-B11F-1C029C72DA3E}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:764
          • C:\Windows\{D25A2D6C-7CAB-4012-9775-4617B60A48E5}.exe
            C:\Windows\{D25A2D6C-7CAB-4012-9775-4617B60A48E5}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Windows\{B1B8C7AC-A120-410c-98C0-0F4AA7A5B0A9}.exe
              C:\Windows\{B1B8C7AC-A120-410c-98C0-0F4AA7A5B0A9}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4652
              • C:\Windows\{76048FCA-8CE9-471c-A703-B8E062DF9E3C}.exe
                C:\Windows\{76048FCA-8CE9-471c-A703-B8E062DF9E3C}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4524
                • C:\Windows\{F08F764A-5CD4-4dd2-8D1E-9ED7DACB4749}.exe
                  C:\Windows\{F08F764A-5CD4-4dd2-8D1E-9ED7DACB4749}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4144
                  • C:\Windows\{E50DE30A-40DF-404b-B912-0B5BF6411A85}.exe
                    C:\Windows\{E50DE30A-40DF-404b-B912-0B5BF6411A85}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4268
                    • C:\Windows\{7BA8148F-043A-487b-94A8-2230A4D04441}.exe
                      C:\Windows\{7BA8148F-043A-487b-94A8-2230A4D04441}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3092
                      • C:\Windows\{0EE546CF-17AB-4aeb-99E2-49AC76030A71}.exe
                        C:\Windows\{0EE546CF-17AB-4aeb-99E2-49AC76030A71}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3112
                        • C:\Windows\{026A4861-0CD9-474b-8E58-AAA7E32B6BC8}.exe
                          C:\Windows\{026A4861-0CD9-474b-8E58-AAA7E32B6BC8}.exe
                          12⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:892
                          • C:\Windows\{EFDDCE67-846F-411e-9387-CF38117BA977}.exe
                            C:\Windows\{EFDDCE67-846F-411e-9387-CF38117BA977}.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3900
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{026A4~1.EXE > nul
                            13⤵
                            • System Location Discovery: System Language Discovery
                            PID:3944
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{0EE54~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:452
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{7BA81~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:4088
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{E50DE~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:2912
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{F08F7~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3672
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{76048~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4616
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{B1B8C~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4468
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{D25A2~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:880
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{FE5D8~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1748
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{1BC8D~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B07B8~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3944
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3420

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {026A4861-0CD9-474b-8E58-AAA7E32B6BC8}.exe
        • Path C:\Windows\{026A4861-0CD9-474b-8E58-AAA7E32B6BC8}.exe
        • Size 216KB
        • SHA256 835ef77b02738d611eb23f0f18523f5760cb93dd9189996030d6411106dd7834
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {0EE546CF-17AB-4aeb-99E2-49AC76030A71}.exe
        • Path C:\Windows\{0EE546CF-17AB-4aeb-99E2-49AC76030A71}.exe
        • Size 216KB
        • SHA256 dbca1437bd46a9ad6e7422ae1f0b5635d427f30c4d8059bd81e5b5a3ba5e03f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {1BC8DCC4-4B0A-4c4a-A189-8CC24CC18B12}.exe
        • Path C:\Windows\{1BC8DCC4-4B0A-4c4a-A189-8CC24CC18B12}.exe
        • Size 216KB
        • SHA256 33752d546b2e9718a960c41930d48c21c774aab5547e9b6524ed01921828884c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {76048FCA-8CE9-471c-A703-B8E062DF9E3C}.exe
        • Path C:\Windows\{76048FCA-8CE9-471c-A703-B8E062DF9E3C}.exe
        • Size 216KB
        • SHA256 6b187e991d791d408f6a93ee63c3ab938d52f8d764e4e0bfa1b2922542b160c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {7BA8148F-043A-487b-94A8-2230A4D04441}.exe
        • Path C:\Windows\{7BA8148F-043A-487b-94A8-2230A4D04441}.exe
        • Size 216KB
        • SHA256 eb598f23676ed6d1af2e86c64d6e082706475a843718f20dde01d86637b15b55
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {B07B81CE-06F6-4054-9EA1-6980FBB2BE33}.exe
        • Path C:\Windows\{B07B81CE-06F6-4054-9EA1-6980FBB2BE33}.exe
        • Size 216KB
        • SHA256 6176302f8c849b8ee46a5108f6abe6620576dceeffe4a3519757efc36430c682
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {B1B8C7AC-A120-410c-98C0-0F4AA7A5B0A9}.exe
        • Path C:\Windows\{B1B8C7AC-A120-410c-98C0-0F4AA7A5B0A9}.exe
        • Size 216KB
        • SHA256 8ca61e37ecddf82ba29104f768e723d8f06da44db532172eab39eba5f0f8b4b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {D25A2D6C-7CAB-4012-9775-4617B60A48E5}.exe
        • Path C:\Windows\{D25A2D6C-7CAB-4012-9775-4617B60A48E5}.exe
        • Size 216KB
        • SHA256 7237732667fdb3a4b22c5d51a5d02bed1497b48b196461911d303d2317af2666
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {E50DE30A-40DF-404b-B912-0B5BF6411A85}.exe
        • Path C:\Windows\{E50DE30A-40DF-404b-B912-0B5BF6411A85}.exe
        • Size 216KB
        • SHA256 457e40d9289ce2dc9559740ed99b0d6b019bd47ec3b6f71b882fdbd8bc2a5867
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {EFDDCE67-846F-411e-9387-CF38117BA977}.exe
        • Path C:\Windows\{EFDDCE67-846F-411e-9387-CF38117BA977}.exe
        • Size 216KB
        • SHA256 44ebaf4193fb52d19f44a1e8df0fa776d404f995a09907e6522c7c9d943afdb5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {F08F764A-5CD4-4dd2-8D1E-9ED7DACB4749}.exe
        • Path C:\Windows\{F08F764A-5CD4-4dd2-8D1E-9ED7DACB4749}.exe
        • Size 216KB
        • SHA256 ed8497c160c15802e0222b13aae29579ba5833352ace3be9ff1a282f6c0faa08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {FE5D8904-F77B-413b-B11F-1C029C72DA3E}.exe
        • Path C:\Windows\{FE5D8904-F77B-413b-B11F-1C029C72DA3E}.exe
        • Size 216KB
        • SHA256 32f68ab1b579151373b2520f5b23a99db9e0ae893c37503d2fcbe59df94d24e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download