Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 04:07
General
-
Target
2024-11-21_66c1cdd05991763f387d74554615fc1f_goldeneye.exe
-
Size
344KB
-
MD5
66c1cdd05991763f387d74554615fc1f
-
SHA1
e31c6ca1d718f847b5202be42e8997afe62c3a57
-
SHA256
3bfd6941efabab7b47b8e5f8da6f1568f95f5b5bc148f075683808ecb41327bb
-
SHA512
7aa5c146bc55e6fbf8bccf5392da68cb08e8a31d8035df265855b64d256f342f042af6b5e0b24c6ee33734a9eda58b280834b16e68b53c69f83c2dbcc19aa25c
-
SSDEEP
3072:mEGh0oHlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGVlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_66c1cdd05991763f387d74554615fc1f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_66c1cdd05991763f387d74554615fc1f_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4659EFDF-2CC9-4824-BD8E-D7B74F98E89A}.exeC:\Windows\{4659EFDF-2CC9-4824-BD8E-D7B74F98E89A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74BF93E3-C5D1-486e-B165-68F148D9EDCD}.exeC:\Windows\{74BF93E3-C5D1-486e-B165-68F148D9EDCD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA809434-8684-4788-ACF4-B6A385E46CB4}.exeC:\Windows\{BA809434-8684-4788-ACF4-B6A385E46CB4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7B77E74-A4D0-4563-B0FC-F5A70A8297B4}.exeC:\Windows\{F7B77E74-A4D0-4563-B0FC-F5A70A8297B4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C9FF56C-EE24-4b0d-9F8F-7C9A698B0465}.exeC:\Windows\{9C9FF56C-EE24-4b0d-9F8F-7C9A698B0465}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{25F627A3-AC25-40c2-8DFA-88FCEA0E8C8E}.exeC:\Windows\{25F627A3-AC25-40c2-8DFA-88FCEA0E8C8E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCB07ABD-62AC-49ae-9A6A-D69D055545EE}.exeC:\Windows\{FCB07ABD-62AC-49ae-9A6A-D69D055545EE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12A40C1D-82AC-473e-B94C-5F7D53D2D4D1}.exeC:\Windows\{12A40C1D-82AC-473e-B94C-5F7D53D2D4D1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC33DE91-A0D9-4434-B4C9-CFDD590AEEC3}.exeC:\Windows\{EC33DE91-A0D9-4434-B4C9-CFDD590AEEC3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0B4038A-9FA4-4603-916D-24FF5175EAB3}.exeC:\Windows\{D0B4038A-9FA4-4603-916D-24FF5175EAB3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEC9E8B0-7EB3-43e9-9E7F-9E67ACBE0443}.exeC:\Windows\{EEC9E8B0-7EB3-43e9-9E7F-9E67ACBE0443}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{75ACE43D-F195-4ccf-A877-B00FCB10BB40}.exeC:\Windows\{75ACE43D-F195-4ccf-A877-B00FCB10BB40}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEC9E~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0B40~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC33D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12A40~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCB07~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25F62~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C9FF~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7B77~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA809~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74BF9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4659E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5918cd9f20d3c78e635b26c2d4158df64
SHA1badd03a5e56aba6e30ef6b1b1260b137dbca4768
SHA25692ec0614300ac31d8169e8640f41252e41913935709b8648da68bc3bb66d801e
SHA5128472bb38daebd295d9e31b86671e4cb3d047454be80780ad2eb1e263adea3e6de10a74646eb03d0cffe8777d2fe1038cbba9efc6ad62e9a6c9de7cab9cac4270
-
Filesize
344KB
MD548f8471933ddfbe467d1320d0050ed74
SHA13aa2fa1fbe73b5a57edd1c7945e87de510049b80
SHA256e90b95b9a89b0419d5dec5423f5c9980df47700f71e0ccedfcbe666507fcb0d3
SHA512f003431495087da7e6307cebc42bf7a9e3010962ffb886970dc1885933daed85964eefff8f77d379450cea9cd49d0877cdd096ba7bf08250825a6a7baa234111
-
Filesize
344KB
MD55f7c5b84e75b8759c0e3645b385787db
SHA1a04f31f6af7f97ffc943e32ca2fb301d50a37050
SHA2562c8dd2cd0503aca3e7ad90f584540feceeaa70aefb54648acc1fa5ef4793e612
SHA512921b694b056cd85fc861401de4477eb8586e8dae6522c47983fc91feffc36bbeaac09d24729c625086fcfd9d4752e2767e2ab85f34038be894741a28414fe60b
-
Filesize
344KB
MD581041061208bb100efe3f9b82e264609
SHA165f0e157c27ff144497b8fb9c062cf57cecb130d
SHA2565c5f9ae9e830b164932fe1fca2621e84e02eb3e670a183b500f0362f66f339ae
SHA51293a1d75594ad37222ea4531319e9aa61fdd0ffe37abff7c95ec7f2a0931a96a2d38eeaba9f2be60fa544ff8ccbd1492503cd4b3d8f490db062dacbc6fa255eae
-
Filesize
344KB
MD59b200e7f7e6e0a5c715d08d296c7394e
SHA18396e271f85f81914d648b99f2d165bf1723f578
SHA256a2d9196b15692223358041db85dff5894da8ffdf428b8dada7fffd8dd01fdd62
SHA512f45a3b67497b7eb863f8b0d45e31d34194072b5d48773d8254909280f628075bbbb7f198a114f6197bdbfd6143785903e0b5b96e65e3a6177b90745e2fd8f247
-
Filesize
344KB
MD58e8542e50b4e153a05f5f240c8b5162d
SHA14170bb4f2f51a9be3d8940b45b72343edc39f962
SHA256551c7527725416c13ec7208cf95b8ebe64766c7358e1afd4c1e20263310cc2c0
SHA512224b07362c03bfe1329fe542c61527c97c873af10350760baff56f710903a3170b3e20b21106b1976fb44b82a3d373aa8f1389abf9777ee2af092e727b59ba08
-
Filesize
344KB
MD5fe9d0e89feebbf8b4bc7355b970c9e03
SHA114d6da0fc4e3b6aa01aa40fe541f7df20fac5c42
SHA256ea3679f27328151a0a7da549127b05fa4abc413e1e7a9b199c68e6408ad4eab6
SHA51217e5100002a2c7c3c34ca3c4337bf91452099539ecdbde6a256afba0e6301b0c8d23d9cd7c133fba7a8ab7c1bf2bed3e5d18fef160c6beb56e6b5d22aee961a9
-
Filesize
344KB
MD5585ce84c02ee7a57f829776bd7014de5
SHA136172353aed80a8453ef7b446d83f712aba417ae
SHA256ed5124ab212196177765bf24de1c44c4f07ffa7d419e8bc1afc8005249b4656c
SHA512ada80974bbaf1f6b8e9cc727eda5216c04c0aa207e9e275c58553bfed5d2b28f90faaf2295b7047040c22d047350617bb4fe2b96527e150104b6b06256711a75
-
Filesize
344KB
MD5d5acceb43e81d5d7418db2101cecb8b6
SHA1c27e3e4337334740e31a9b8221fde924bf230711
SHA256cea4a792f2deb4d793994269039c58489d54c0fff0cabd45d287804a5f470991
SHA512eb3b450fc4db326b106c55a765e5b5960d448b41cb1d54f95b68131530b83976e17f1dad6bfb0b31771694073caf432a4b9a7c5817decd0c91fa3bb36ef39298
-
Filesize
344KB
MD53e72b481e7e85a2cef8c095e4b29062f
SHA10daffb4602487e70af1929ca9d6133657b371d72
SHA2560b72527fd8815484ba3c3cf652f72cdec21d28854bc2a19b78a4bfeaf046dc06
SHA512af2f2410bafac094eb3e483df500515316fa09c5020406451a7c9e7c8fe2f84f9bf33cd9f618262e075311e759a466023d13251ea4341060e0ab2a14339dede2
-
Filesize
344KB
MD5587129a97f1c959e777c99568ba71f25
SHA1a3a415ae31ed4c49b54397d50b5ee764474cb822
SHA2567fb8163c2f7d22fe0c1fcac12dfcac8dad21cac93657bcd868cf97b2a2b9827a
SHA5120d4ea0ddc767f12ff3d8cbd6bb647553f44cd0be36fcadb38d97c19862e896f661f39c0a7812eab915ec6069e4f855c25fb40ca8270e9ec3ec7dd3c588083f7a
-
Filesize
344KB
MD5c6190d45c5453f6167275eaa32518872
SHA10df1fbfd037c0f21b36fd928acc52c2131a72842
SHA256a21736c48ba53faa4f6bb4a218388467410fd4067d2a21bd2de048f6a48b8991
SHA5120bd66bddc26be733e6bb7b08489cab609a29bfd3e2e471460e28ab8798249a73662353680f1fdbdb0967c17e88015b050cbf5abf2df9fe5329d2f1fc282cbf76