Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 04:03
General
-
Target
2024-11-21_5da600afa422c1ca7df4b1e272555205_goldeneye.exe
-
Size
180KB
-
MD5
5da600afa422c1ca7df4b1e272555205
-
SHA1
9dcdb5c816952f2e7b215372189dfce85a363893
-
SHA256
67a25f48f705743f64c6f596eb81719afba0811e2051dcd4bf4d9512a28370e5
-
SHA512
5c8be319a68a038ba0ffcb7a976517cece56a64ec2b9eeed28c192a8d5b86c6c1f076a45a6fe01d48e66ac355aa918b6d8743d190b9e46d219c861b513381cab
-
SSDEEP
3072:jEGh0oClfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGAl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_5da600afa422c1ca7df4b1e272555205_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_5da600afa422c1ca7df4b1e272555205_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02024DE8-51F2-4762-9A3C-A199C98CB0BB}.exeC:\Windows\{02024DE8-51F2-4762-9A3C-A199C98CB0BB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{704C316D-76C9-406f-B8EE-88F80A8FEC39}.exeC:\Windows\{704C316D-76C9-406f-B8EE-88F80A8FEC39}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3B7E37D-1ACD-4cf1-BCF4-45DB7159D34B}.exeC:\Windows\{B3B7E37D-1ACD-4cf1-BCF4-45DB7159D34B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83F30AB3-85CC-481b-95DC-67E6C94D3CA6}.exeC:\Windows\{83F30AB3-85CC-481b-95DC-67E6C94D3CA6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B888237-98D5-4a0e-B99F-A4538955594A}.exeC:\Windows\{0B888237-98D5-4a0e-B99F-A4538955594A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8680565-7054-40e2-A1BD-CB7F3CA7875D}.exeC:\Windows\{B8680565-7054-40e2-A1BD-CB7F3CA7875D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31A77D52-70BB-4d37-809F-F7CBD5774783}.exeC:\Windows\{31A77D52-70BB-4d37-809F-F7CBD5774783}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{912D6748-9AEA-49a0-8223-8825C40A8AA6}.exeC:\Windows\{912D6748-9AEA-49a0-8223-8825C40A8AA6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0BDBBC58-2FF8-433c-959F-B3BDFB4F1614}.exeC:\Windows\{0BDBBC58-2FF8-433c-959F-B3BDFB4F1614}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6692B948-1BD8-42c6-A2FF-649D82D338A0}.exeC:\Windows\{6692B948-1BD8-42c6-A2FF-649D82D338A0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91CFFB4C-CCE1-4b1b-AD6D-9356E97C9B09}.exeC:\Windows\{91CFFB4C-CCE1-4b1b-AD6D-9356E97C9B09}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C8EC420D-F6CD-4056-8680-B5342F19DC4F}.exeC:\Windows\{C8EC420D-F6CD-4056-8680-B5342F19DC4F}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91CFF~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6692B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BDBB~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{912D6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31A77~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8680~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B888~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83F30~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3B7E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{704C3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02024~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD554604d1e5600a33de8041dbcaa375128
SHA1f75a81c08169f9ea22ef571b291f0131d6155f05
SHA256995173d3576a5734e1429ce21d0194810aadbed53a808bee284a7d2029a8881b
SHA51232abf2252062c05c3e8b4ca928e52c3044c7a89bedf2f85c0a398c2c6018ba5a9066f8112a7b7fe6dc9013b6d0d0361da62f96b7ed4bd4e0669e231fd48736d4
-
Filesize
180KB
MD5b9727d69693ca622f05586f0074416c1
SHA1e22c03f06662af354cc84bc59698ee28c79c9727
SHA256fcdd80f5f2519920056bc163331310cbd505c468d4335bcb63468cc5da0f7614
SHA5128e6e20b58bf0ffd21ae16585c5e1b799e26d0ca6a96491797cadbca6e48df0cceea17f6a85bbb4302844ff4a85b9056942ccf18c6a04526387a152e542ae707f
-
Filesize
180KB
MD50dbdaad14a6986c5e3f3567a400a9bca
SHA1cf56079dfbd99a98a088b66d36da3f5d1235f58c
SHA25624e422e00d19c76c8a6d0cfa0aa4c169db9bb4a7ce51270339a8443027cd35f8
SHA512baebad815900da689de1a2f0a17be6feaafd41416d32fcb18c5c71f5dc5916ea9aaa0199df5e981de7aa492314b997fdcdabb306a21065114385f7fce47acd3e
-
Filesize
180KB
MD5d3b346896d35db10611561b4c8a1a8c4
SHA154845a7d32d917d45ce90fe1f981f37ffb5ee806
SHA256f2d312a9c747432c36c1aa95fe760a02e224c6fd2901f27c538058364be70ce8
SHA51211ba07dd047cd234ac6f2cc5cc40cb4398ab7729f56749c32d3aa47f9f2704a026232b5cac55857d760947082ed78e31b8c56745f7be558ec0b061960c80e9bc
-
Filesize
180KB
MD5ed2f3ccfe8bc85f375de2ab8fef93453
SHA129af139fb63d1a8a1993a04eecc6aa70b0aff5d4
SHA2565abcaabbc1eff505320400db41d9be981386c0b8c41bed7fe60b8311be67317a
SHA5127a1270c15c2822a81121af75f54bafe71748ff301b6672306b438019e6adf8c9c9dfd30e068b2ddee2e444c51683c6d1aba32e572060f98f5348d4ff6d93f351
-
Filesize
180KB
MD5a5ac637b553288ede2812bcf5713fa21
SHA1b33c91dc024318d0989619c060a2d257e362a50c
SHA2565e84ddb8202f5ef76090f1cc16634b1c1553bb824f407389f4444362dc2b875a
SHA512741867fbea67934f40f2ebf3f48961f39f5e40ed5442253a801aea10725ead47a0f6c96dbb3fb9557b9ded6ac87d7b0032a5f97103bcbd1d12fdc270d4a98739
-
Filesize
180KB
MD5a57b191626bfcc5df2d87e79ebb70293
SHA165920e4af60d7a2ac4ef1cad30ca93e68d319210
SHA2564adfc9dcb3349c8e35ff9dd0bb35774c78e5494753015de26caed78f80dbf323
SHA512d92ee11e1eb68c9c6db05525096b1ecbf279e04a35b0e09ccf3a4e840341255bff3bc4ea10f33516f64bdcccd4379e84ddfacc04b36796b36899646584bdcf31
-
Filesize
180KB
MD54fe4029adc39175ed0d3af0555e9b972
SHA1fd0b712855edfedada07d7f93bbf6f3ffc396d83
SHA256f2ae719fea7dc2bc52636ddcfd681157fcd48fdca5589599500105de1d6a6239
SHA512c428712adfac60dd06ab1f1922b6c80cb5d24dc2e7a47aa485908d675bbfdc1674782b7f321587380687d4fa2a32cf11bb0824c6e8168afd135dc76033fbc2b1
-
Filesize
180KB
MD58dcd59d63b0148246cf5682e14552c8f
SHA178e418e74c206aad215acf6650a6fa263d93e4db
SHA2566d271d05ac14ed966abf30a83437fa7fb8462c9c517ebe7c826da41644b63dd7
SHA512f7144c617b8245b77ffed33bd990c7b033288b40215961065acf5ffeedd3e04749f58d3e1a5429218221414cc570eb0310682e916af7d55ae5bff1c44179269b
-
Filesize
180KB
MD5cb5a845fc81a8f30d49c7d56b1c2ac72
SHA1dfc89ee991408856e590d6b115a9a974337cef79
SHA2560362f31629c8a3f8d25d491680c96867e6a4b7ec0694b7e794da6f2637cb1d42
SHA512098ea9855739c2d17cdfcc9a766634680460867db8e57f99f9e06d082f7280013161a8ace5baddccf1e6c346d051c0b65dbc11940e92ae82a1706d05725a8755
-
Filesize
180KB
MD5881791f31bb0d8d88985ec9efffb2d8d
SHA13371a304e10fa6fe8cd2a415f3384bb0fbd2fb69
SHA2560bd08935edefe1ae3a70dcc92c884c477d30151306bc0f2b741b4e31e19a0327
SHA5126a9ccbee3e728e53562a8d2daa5b2df94a9f5a4ab2a0dd0b7bf76482369aa8cec01d918e1567f5a5946160992a10da2fac463c8f26a7047b32563baab711a4c2
-
Filesize
180KB
MD532ea12949c8fc36d875b58474431aa78
SHA1ee2243cbbb545701335678855b0a6518e4495598
SHA2564a4effe0ab4a6171e43524051e2bb9b450a8f03354955891c56a09e6fa19a7a4
SHA51204343e56a958a38050f73febe442ab77cd4cb179f1a823c74bbb26f0b72c3f59a1c3352cfe3f32fff7f626d22a0d639761fc08267cab231996895e24fb1a479a