Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 04:08
General
-
Target
2024-11-21_68a4903ec79a40490261af867ecad2ea_goldeneye.exe
-
Size
168KB
-
MD5
68a4903ec79a40490261af867ecad2ea
-
SHA1
9cd1d74feb49b682edc6593aae708a2caba0a9fb
-
SHA256
46d8aac4bcd272008c4cd5f861d12a66d707f7c5a6ac865910d0a4ff8d7d9c44
-
SHA512
6c64a0e7dc2f643935982cc81770c882b8a51bbdfa6a5cc4569945b5bd4ea475657977d0439b19aab580973539bdfed3c3e9c3cce70b1ec0ef5bb3b7c6d3e006
-
SSDEEP
1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_68a4903ec79a40490261af867ecad2ea_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_68a4903ec79a40490261af867ecad2ea_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2199F1FF-42A8-4201-BE65-A042EFE883EE}.exeC:\Windows\{2199F1FF-42A8-4201-BE65-A042EFE883EE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7208D79D-9586-4725-99F1-29FE82682351}.exeC:\Windows\{7208D79D-9586-4725-99F1-29FE82682351}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE016FFE-78BA-4d10-8E96-C556BC53E3A7}.exeC:\Windows\{EE016FFE-78BA-4d10-8E96-C556BC53E3A7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{314F9533-8BB9-4598-90BE-64B6A94C92B5}.exeC:\Windows\{314F9533-8BB9-4598-90BE-64B6A94C92B5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D07C0863-86D7-433c-81E0-C3E6A98B7C51}.exeC:\Windows\{D07C0863-86D7-433c-81E0-C3E6A98B7C51}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F525FFB6-83D3-4b36-AADB-A6CFF19A1BD2}.exeC:\Windows\{F525FFB6-83D3-4b36-AADB-A6CFF19A1BD2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA7F0104-6162-478a-AD1F-3341B109400E}.exeC:\Windows\{AA7F0104-6162-478a-AD1F-3341B109400E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A84C919A-B34D-46f0-8F33-94ADDF400E31}.exeC:\Windows\{A84C919A-B34D-46f0-8F33-94ADDF400E31}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{317D684D-995C-4f49-9B71-46F59DB519DE}.exeC:\Windows\{317D684D-995C-4f49-9B71-46F59DB519DE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9709A3D9-52D9-4d2c-AC9D-A2491D5AFF9D}.exeC:\Windows\{9709A3D9-52D9-4d2c-AC9D-A2491D5AFF9D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87DC573C-2053-435f-9C1F-BDE070AE91DD}.exeC:\Windows\{87DC573C-2053-435f-9C1F-BDE070AE91DD}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F6B7A1D3-03C6-49e7-8C46-5E57502E7FB7}.exeC:\Windows\{F6B7A1D3-03C6-49e7-8C46-5E57502E7FB7}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87DC5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9709A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{317D6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A84C9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA7F0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F525F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D07C0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{314F9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE016~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7208D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2199F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5233b04f913800b1e98b883a7cf4d54ef
SHA1b6a5f0d4eba9a748595d006a93b16740d2534ccd
SHA256df70857db537899d944235d100e9a1143632656187fbd4736a6f25e53980b782
SHA512125498147b6f011a715fd07f76680fb7cceb985ed5bb439264c2b7bbed7317512f695f70808a97a7b884d410b17f98d9e6940dcfc0cd8a43f93e40cc12a5ea58
-
Filesize
168KB
MD5a57a48f60b92a38139218340a69dca52
SHA13c9e0bc7ab7331301dbc09653ecbabb93876c61e
SHA256dab9045842fad56c4db55d2abec73746a7bef526f9c4981d0bf2458ce894d5ba
SHA512e2710fdf4078e351b2a74ffce0a7e1fbe1c21a84e3835eb6622cf41c7f44f63eeea78bc45bc79cb675afbdcb6bf6d1eaef89c5d7f55b770099c6d5707cb31cc7
-
Filesize
168KB
MD5a75a71d6106a8ac043e3718dbf2e8f46
SHA18471c58883acd70df78d70f8fe8bc87f016c69cf
SHA25610d9256d5c285db68e6915e30d3392dfe1dda22e2eca36e5ec9dc276d14a2c43
SHA5128d0a5eb7bd4a9b7f4cff78ce6539c62c2c292da4173c7503dde508ba6bf68a59ce88f518028288ae1d3f85b540c87b5f440220e0d321f834469acac9b3658275
-
Filesize
168KB
MD55ffe89b1024b952993c47b44d1a134c8
SHA142aba457edd2052f32324156e517b78af9b2d42d
SHA25651cbd2cc9517e686ce9154ae97cad771aa6e1f583dcd22ea59116a29330f090e
SHA5123d1e6fc183bcd0bd13eda4378ae2b87dbf92bfd09158cda27e9a235f286604dc01f12ff18c7c533f1f7d5b8b5d9ab8990ea15d4de26ad966a46a0f3f5a48ef20
-
Filesize
168KB
MD5928f7d70663aff786da5955ada80d066
SHA1fb942214c81289c99986fd9a827ef81cd7b1c86e
SHA2562cd706d18a587b8ff84967e233cac5d7c0d40cb1ec3a3bbd99fdde9eeb5e05f5
SHA5129be9476365a66821a22bf381e692189a5779a55ce4a88d763683dbf5cc5133bbd2197c555099e76ee9dbe4c5cce491b6a236f91c5e67801e971bc95a2f5f426d
-
Filesize
168KB
MD58041f28f089189a3fa01c2c0efd6f0b3
SHA15dc075c6eb1df40fdfd94363008396dd82f933c9
SHA25636b28db29bf6fb3fb5fa0375c13762c86b4a90c64f52212de0fd6095696a6b30
SHA512e55e828c5eb77b06ce61e20ebdeb6eac5f78d8611f0f7ae0b9191b4d8db6255209a99b66f1c7e7199945c3e7c6d781fb4749b12e8adbc703176f08d573b6ff1f
-
Filesize
168KB
MD5a1adbc4f2da47a06cec98a260add8590
SHA1b9e9aa26a62adbf7db0082c7627b74ccbd13a7df
SHA2560e139ad568fcdbe2459ce3d1cb39852cb98d50c379671a09d9da22d53eb0c29f
SHA512180438ada06edc360ab739055652949c787e64275960e2228b0e4e9bf77b35e2150a73fbefb91dfd87bd5b190ea42b8cbfee89858a43da54b3561e3ad30ff377
-
Filesize
168KB
MD5887053a02d65483850ad100c18487fbb
SHA10b463abb1b374fa2560d0e0788dd37121fec9e8f
SHA256f934a21cc5f9a02de2b1e1a6a626c0900a87b48ae45b1fe672d639cfa64acb90
SHA512a4373ad1bf2833a3260d8dc23bbbecc2ba6a0b04316a5d74f4ba80029f9d83dd1638fb1ccbf4b43ee3d0b077047f7ada1fc3455d0e674e2309b01bf3fbd0e0e0
-
Filesize
168KB
MD5a11eda7b787e4843d619a49b9bbfc7f9
SHA133dfe6cc1cb0a82652809ea73cb9e800909c35bf
SHA256b9ce475f9e7a76306314442caaa2c97e46d0ac9d3312c2757a5acd567977c8a9
SHA512c9216914a53ce664f25f36f45623d719c165f6dbcb92a566dd6ed28eb6ced0ab59bb82350afcb4c62ebd9c20340cf30d79fa0dfc8e61c0c7ae4c735cbb4ffce1
-
Filesize
168KB
MD508656b0f0e34faced40f9bb883ccc3f8
SHA1198ec32d40ced7cb8270cc980433410c33c9b6ac
SHA2564d35b682739f4d1979c2d4148f3b5c113e148f0a9a36d6eb99a7d3d0f5096bd5
SHA5127403f7386aa1239ab0bf67bfa4852450a3f172a96fe7da7cf281a4f5adfa4df0210812125670a5a982ab0f0b29cb52828f5224c4ec3d6b643dc0aa210815135e
-
Filesize
168KB
MD59b1006012594c969bc116805197a4b3d
SHA1980032a6c1f58ec92566722c536a08f55856361f
SHA256aa2c6740cd9335ed83ba6104fadbb3bb31c612f3b260a27bc948fac660182d1e
SHA5126b30dc0fb337fd50208a939af81949dd6f8c6f830a30d5721dab51f28a834f3d2006132d91b0ee54dff0e046c9be1888dc75f7fbb7d86d9a270a649145751537
-
Filesize
168KB
MD5b035b6cac097011903b32604a7d9797f
SHA10424c22e1d27fa4b8f4a94782f25a07670308c41
SHA256c2d9be724e237904e94d9ad93088b8ad34f5db118fa908ac0b7fe4d9bf008937
SHA5124b51ef04daca9260a08ca3450860b3d2952d38473e5daddb005748a2d8a0a466e574ce46dbf4e757c832c1cc3278f64b7fcd9d04d6caa9109a77e073cc1aecf2