Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 13:27
General
-
Target
2024-11-19_631763eea4d0d63b650afeaaece807cb_goldeneye.exe
-
Size
380KB
-
MD5
631763eea4d0d63b650afeaaece807cb
-
SHA1
b839ec21fff702e40fa07a94d022a5d333da622c
-
SHA256
ba5fdf64224f1602d76f9d533fdf8b8dd65dbdddb6d6636004bcbe3b28c0567c
-
SHA512
4b362ac90694881738417f3727801659908b5593aa71be89e943f709785ea0200f83bbcca629916a0156fd24f6fbcbf8a6b19d06eff530590b0eec20a1981293
-
SSDEEP
3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_631763eea4d0d63b650afeaaece807cb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_631763eea4d0d63b650afeaaece807cb_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{104B5B2F-CDD0-4b12-8F1E-CC8D4619C4CA}.exeC:\Windows\{104B5B2F-CDD0-4b12-8F1E-CC8D4619C4CA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8BC05351-141C-44c8-B7F7-039C45CA5211}.exeC:\Windows\{8BC05351-141C-44c8-B7F7-039C45CA5211}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{207E0764-4717-4d20-B4BC-AD27FD2EE18E}.exeC:\Windows\{207E0764-4717-4d20-B4BC-AD27FD2EE18E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{953F310C-328A-4cb2-9E9B-31047C97BB7E}.exeC:\Windows\{953F310C-328A-4cb2-9E9B-31047C97BB7E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F1748D0-4EBF-40ca-B355-193C6A319952}.exeC:\Windows\{2F1748D0-4EBF-40ca-B355-193C6A319952}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A79858A3-D466-44c1-A207-26EC89E8F4A2}.exeC:\Windows\{A79858A3-D466-44c1-A207-26EC89E8F4A2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E770FD3-BF99-4027-A84B-73785DAD484F}.exeC:\Windows\{7E770FD3-BF99-4027-A84B-73785DAD484F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6F37ED4-E214-4494-9A73-4C708D7FCB2C}.exeC:\Windows\{C6F37ED4-E214-4494-9A73-4C708D7FCB2C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C821A906-3739-4d83-8C59-9C1A0A0E8725}.exeC:\Windows\{C821A906-3739-4d83-8C59-9C1A0A0E8725}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2A45510-9D27-46ac-A33B-A8BE44101BBF}.exeC:\Windows\{C2A45510-9D27-46ac-A33B-A8BE44101BBF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{639E576A-896C-4322-A210-F25F37AF013A}.exeC:\Windows\{639E576A-896C-4322-A210-F25F37AF013A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{11A58BFA-7C9E-4a9a-B12B-D60D2ED5BD4B}.exeC:\Windows\{11A58BFA-7C9E-4a9a-B12B-D60D2ED5BD4B}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{639E5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2A45~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C821A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6F37~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E770~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7985~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F174~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{953F3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{207E0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8BC05~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{104B5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5c2e2d1b5f5444e69ba921c622efdf942
SHA10bbfdf42f2502eed8d81ed57668742ebca4dbce1
SHA2563775fde7cb896429f2470c6a8fa653d3213680d40c9ec0d1a779da9bd97a7483
SHA51229873134210d039aa7588494d8020de80ba0e86548689ecf1dfb919090324a63596408b624d52e0422aecdc37daaddade06fb6fe155f6c6b7429d0875505d474
-
Filesize
380KB
MD57da6b2d0c9eccfe8de670fb68b639b5f
SHA1b6cc41454633736febb84e47f6cc5e9b9f7e26ac
SHA2561874c4a1e8c601fa3b13d8d46ad0a4fbc24ac2d8156bef4e31ba08a353e1be54
SHA512ff46d83b330ebb39e054624d28d9afd740bbac790431ef8bf9837010b7bd2eb8ecbf0922db02b77ff7a313ec22bc0b3c55c6b8d4fc8f0d0b03f4c8e5260d7b09
-
Filesize
380KB
MD55fcd73f9c7313919be2b948d6b11477a
SHA1015fb528f82e39492dc1f4bebce9604321062793
SHA2560ce9b5784b5e81a47a6288165197ec3ce387db753520d623a7add2179319dde7
SHA5126a1c92111805bd1db38de682dd9c983a5cec638bd0d0d0dfe7970078f7ea07799275414c739dca2470a3ab423ba57efecade26ff626fa29b5eb5bacad70258de
-
Filesize
380KB
MD5f62a8babaf45aa8dbdb8cbf73d6a9a8a
SHA1bf1b3cb086687aeffd386f50d3e9a142039e4e61
SHA25655ed80d0ab72957843e982eafa360d9cfb2f37ae3d9b6f0ef35dcfd0f359115e
SHA51218cc7d4bd6bcca88e40889413a6f11772e5d11eae67752abfcd91ab810c1ed53041932b5e765bdaad8f02e3289e7ee9f4e0fb435d7896b0967c036c5e4dfb82e
-
Filesize
380KB
MD547372d7c20ab334a5713caa435bfdb0d
SHA122f7f34a9e64b26b7d4dbd8d45710ffe0041d89b
SHA256f7e1d2c4c0036352fd12ac1be9226d7fef54545cf55b72cdaae73cd141685b90
SHA512d799062fda1fa691199520553d45bea5e4619e983a23fb7714b28873036720fc761c8cec2b238b66afa492b7259387fd30cf64f8d66c4e920d31794a1480be14
-
Filesize
380KB
MD58d8be8e1c30441c804dab14d010d5541
SHA1357a42da7a6a530bfd6b566c34b57a5b755865d8
SHA2568926dea19b877fe9258d3be177830132d3f085d6545e6dbc195bcb5b393574bf
SHA5126328b32fb600783a0e66feab87a019427df5d4e6f79ebb2416193f9adff8db32b2081a7b5a7bd6065a72b8fce45c5cbe7d2af01b7413e573ddc79fc305d12836
-
Filesize
380KB
MD56c6ae64f864f5409c90b8ceec9f79668
SHA1b817196a34c1a3fc678476316e0e4ec27d5b00b4
SHA2567d1caf3f9585a16cee9b14136cf10970646da19fce8d1f50a49d8474b847bd62
SHA512ed11caa58536f53906f48a46a0b2b3e30c61cab0b6b632b9a737e585c782f43312c655b9dab72e22dc0e98f7fdbf957be59507710da6cacfe65835aa0bf7ae72
-
Filesize
380KB
MD5866711f7a0c83b2d2149f484a287b633
SHA1597cbacfc2a64b02fa705ee3cd394f2a5a46f349
SHA2563ba64155b4897d2a74299fd45c845697130b4f843430be96c7bfaf86475ac74a
SHA5124b3d9e0bc295032f8c7f583302b8cecb70c9f42691442d58d11cb5b6c9ce3a7368f92dd04b377a934f83473dd73c5e995755b44ec684a65bc1798f65eacd0215
-
Filesize
380KB
MD5cf578be3a51734aff1cc80803b93c741
SHA18bfe2eda228b0297db2705ab17b8131b6372e425
SHA256b1eb3394860b9b6f15e678a2cc03d6c511f5fd0b0439118f868fae3b32abcfca
SHA5120874f12f4615a1a9ed800b0c8af249e119731cab7c9378d300445d2aa520b943b047d92292315e8d75efaf72de20544cf2154bff35f94caed9d33dbd20145a5d
-
Filesize
380KB
MD59d9b0e2c7d6a53249a9107f9fca00d90
SHA199cd1a8931243118e6395ab3781badc61f3d5f0f
SHA256f7c7758618e206be5ea292a6dabe05678007c1c4e8378f910a7266ffc4c1f401
SHA5120fc99610c003d60b8badb0e46556d71e4d5c1dcb5d6d7cf9e5430baee5edee0c279256d7df59ba62819263c7260d38ba92a82eebacd9c199c06ef06d093b29ec
-
Filesize
380KB
MD556dd9926e0003e1b57a27e52d5932d01
SHA1705872d5b1518d77eceab0adfb0699d00909ad1d
SHA2565c62f052059d6627109ef3059b8caed35f4d39db2f038ccac41239757c99afed
SHA5129a53b4108306718ead1fbc02b2f818cb099b0c64dfb5a4ec43ee205773a02219076f0864efb0b99f7547a1cc7f08a96292f17d583e4ec7f81d08b4d1564d6f06
-
Filesize
380KB
MD5ea5513787ab324f8d5e82cc5c6e4e8c4
SHA1b8afb1223ba0aef2e9360b55578884a32d2d768c
SHA2562d1b76ccabe5bdf63795b9b1398ed8e13610db14fd679179614afde919c4337e
SHA512bd9fe4f93d6840848342ada619f59080c3c3c92ff02975d7adbd3368a8dcc6010418e98a39a8de02c9ea39f86784e690acc2f307752078da0148cf954299d7ae