Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 13:01
General
-
Target
2024-11-19_2357c80a83a366fb3e62bb5cd949b267_goldeneye.exe
-
Size
168KB
-
MD5
2357c80a83a366fb3e62bb5cd949b267
-
SHA1
41988247efd766dfeaac255622752ffed80e0d00
-
SHA256
41c9cffa9b9e1ffa20eaebb2bc58ad4d42cb1da10c8867130d420b394cf10ecc
-
SHA512
7094e5d60bc35df6663a3be2691674d0124059875e03f420a10c0b3e54838bad8d4d559ffffd79f89d490529f52f4ccf93fedad297d3a71a052b2b90951daa04
-
SSDEEP
1536:1EGh0oNlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oNlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_2357c80a83a366fb3e62bb5cd949b267_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_2357c80a83a366fb3e62bb5cd949b267_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6ADAA6CC-409F-4504-9A9A-8ABA0729DE6F}.exeC:\Windows\{6ADAA6CC-409F-4504-9A9A-8ABA0729DE6F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDB3E2F5-CCA3-490f-B759-B55D2B0ACADB}.exeC:\Windows\{FDB3E2F5-CCA3-490f-B759-B55D2B0ACADB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93C50A8B-2C67-40ae-8F43-57E33427056C}.exeC:\Windows\{93C50A8B-2C67-40ae-8F43-57E33427056C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C776651A-C17F-40e9-8A4C-FE08CF49423A}.exeC:\Windows\{C776651A-C17F-40e9-8A4C-FE08CF49423A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9059511C-E9B6-42fd-986C-4775A5FB36DF}.exeC:\Windows\{9059511C-E9B6-42fd-986C-4775A5FB36DF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E87BAED-52A7-4542-BB93-469377F27125}.exeC:\Windows\{4E87BAED-52A7-4542-BB93-469377F27125}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1264A715-20E5-4402-93EC-44C87AB5E1C4}.exeC:\Windows\{1264A715-20E5-4402-93EC-44C87AB5E1C4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{858063D1-8196-427b-A94E-99F9244748D5}.exeC:\Windows\{858063D1-8196-427b-A94E-99F9244748D5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCA1C12F-542C-44bd-A68C-957D059C05FE}.exeC:\Windows\{CCA1C12F-542C-44bd-A68C-957D059C05FE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3175E2A7-398B-4365-A09C-7781487CF2A8}.exeC:\Windows\{3175E2A7-398B-4365-A09C-7781487CF2A8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0176575-2996-4bdb-86D0-1A780B235763}.exeC:\Windows\{A0176575-2996-4bdb-86D0-1A780B235763}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2AA41733-87DD-44c4-B931-441052C0177E}.exeC:\Windows\{2AA41733-87DD-44c4-B931-441052C0177E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0176~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3175E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCA1C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85806~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1264A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E87B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90595~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7766~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93C50~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDB3E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6ADAA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5e9f21db905a3d0f9ee9ce41ef0b0de05
SHA15fb74ec71943ff156067d17a352710f34661167d
SHA256edf8da6a21167361e8780df145408a16223ce81ce5f996c3f169cc4b894dd4f3
SHA5125d32023ae4a052b835d97c7d9d712d88edfc818f51d9bb11cdaf453678fcbca1250b6cc3484762377b3a99b2dfec46abeaa09f2aeb3de808bfd8bc0544efffbc
-
Filesize
168KB
MD5de435a56c0dbfd791816a4530401a52a
SHA108a5d68d180dd9f3669b4d6a921b6fd01ad5a30d
SHA25651da0ed5abdb6871fdd239aa63b90612f0b5d537d0173aafffe0bdb95a0a3054
SHA512250ebe8c98b60f636c400dedfe3a127c6110f6779ecd5410253bb7c028265e8e666028e3b51858ab89e06b2608fef9fb2ad62672c0cdf54e9815f6dd8188118a
-
Filesize
168KB
MD5354555f41cccf058044f1cbfaf182be9
SHA1671de1070895a0e955a2622c3eab993818cfb3fb
SHA2565b7adf66ada6a86cab36f02e9ecb2b58193ebc9cac800b96eaf1bdbde7b45e50
SHA5126bb9904fda264276c63f79956401ac52e7184c26b753498347e2cd78ed16292510de6f29cf1fc074fe3b539b59600153e1fd255dfd0140cc7971a09a22f8d368
-
Filesize
168KB
MD504343cc7d76d73aa536fea6cdd694f20
SHA1cfae94193bd2d2d6012eefd38cc81ce53bdc476b
SHA25659ace8fe136cc89700756ed43a9d1d3d6fcf60f99ecbbf8d2819b23d76e10d88
SHA512c3c1d80a2efc22da2135a631d2c832c23e01b0482b9d937a8118d93fe4ea0cbd48860b9da9722ce02a18d862244f0dadd13fb6e24d28873b88efdb3b2daa40aa
-
Filesize
168KB
MD56f4e00bc2163ccc24966179abd8fc4ca
SHA1d39559392b3841df163d1d6d74ca98ca49034d1d
SHA2569448e58910e3e8c859e786f5544ca108c3b9350ad611e86b3c763316629aed6b
SHA512658151eb250d2932bb95bd4bc97fbb0e60277c066984bff61bfddc1246e11b304665a1007f919be7e572f67c21293672cf0afbef5e69c290754e410a28c58f63
-
Filesize
168KB
MD5b4763c10e114486d033339bd50ce8c66
SHA14edc7f543ddc44479e2590ecfaa6419e75397d42
SHA256af5493629826d6e9aa9d758fd969d43da3d131ce79c987706e89be101cc040b8
SHA5121672303fb9c751204b3e9be37209dea55d769379080c1db76f60262ee60ec81aaa1208c129a48363246af2b7c09c84374cfb49ccb074b41b815be2018c20d1a5
-
Filesize
168KB
MD5c70e33a975919ad235e99068f7bca4de
SHA1170b587a9f6a1e0214deac70c2ef9ac39d607d61
SHA256f1587d699647c50d2414606512283689c1d5d589dd14694aceef33a92f41da8a
SHA512b2d8352fb9b9124f3bf062fe58c8db81ec2457646487eb85bb675626456f065f15c3e2f9e27307fb39f6f994457d4c046e42077d63b9bb02b72bf4fb5c6bec68
-
Filesize
168KB
MD502c5fe1826519e53a0217268f0d401b2
SHA1ac647cbdb7c9fb68eaa834aca2ee9c5183168367
SHA2560e5a28acd3da543e85e89b6ad13bc2f466de98d33262c280bc9193782750aabc
SHA5120226fdc58582fafdccff9d0ca21ca43efa572c9888845b40495b7a40630d3d55c85cbd918a8fe8c474df517f8874dd10c5f029a2caf2e275f7a4c1e2e1be9ce5
-
Filesize
168KB
MD5ef4a6a6354a25e99c45a67936158a5ca
SHA130637e769dfa21eb88ad605db1e4b92eceebdf8e
SHA256dc4afc6e97bd1524516fb9abee9ba5bb763d86c3abc34c3e5737027b79cc54b5
SHA512c3b2d937ef815b4544f572ef0b83324e7d63767a9695b79920ce513be88bd609525a9900d01d20e2ac0ce7ff60a4bfcd56cdefb41f59d00aebdf3a404fe371f5
-
Filesize
168KB
MD5e2c6e0c813b933b325308fc63941c511
SHA1565353a2d81571b1a1f4d8ce6e4111c6813a910c
SHA256ceeabb34a6221af5ef61624e8fac0e89577a05dbc93461e9247ec85679f73b20
SHA5129d844e65ebb605228849dcd75b61ea5cd89cb10a9929155c3be6bd0b2ed1914829afcdca66a56f4d5ca002257dcd395ff309c1b39c2d57e5999fdd341514b152
-
Filesize
168KB
MD5f52e59a06a42cddb7027e7350541813c
SHA126649e34479d100274fbd85cbb7d11f404bd2a0e
SHA256c92c22159e8e9a02b16fa6e6683bee154c9c3c855800d081ad32fbf4fff64263
SHA512cb90fa5cc8ae1d3742d693891d6a8fb4741d7282d4cae876a1e9276e64f4758a259cfd441f6786165186afeeb2b999d4c1ba7e958e96799565a228ed7824b617
-
Filesize
168KB
MD59f03975de7ebfca75f67d61c0f9c13f6
SHA1b65f9b02be1015a96695db8a23a554e2fb0f7159
SHA256ea3f7ac4c968be19096f0b7000390d9c61d4f91d3da0eab2bdef5f318a9e1fbc
SHA5127831546944d23c6ebd9159c3cd7ca7ca80af7b6ee9b78919ffe7e3bc29774a8274772a5e766d6f4ef9c859e92d65c59e7398642e7a2ec1ba7f6705e78b5881fa