Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 04:08
General
-
Target
2024-11-21_6aecb1c2e3c36a3d08bd9361ff812b81_goldeneye.exe
-
Size
380KB
-
MD5
6aecb1c2e3c36a3d08bd9361ff812b81
-
SHA1
8f223813f6aca9593babe275709e32a108899ea3
-
SHA256
1820784312f5be24091b3b7c5c554438b7516929d5f190a520b0b6ad97d50aa8
-
SHA512
2de2b39f7f2f64d19770d342fba96210582bcc72c29df8ebf04ebfb3a1c38f672b9a6989279491ac82d09ad85a97683b8eef853db35008661121afc5d05364d0
-
SSDEEP
3072:mEGh0oUlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGml7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_6aecb1c2e3c36a3d08bd9361ff812b81_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_6aecb1c2e3c36a3d08bd9361ff812b81_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1D29BA1-C4A2-4ba9-B2B7-B508EB7586FE}.exeC:\Windows\{A1D29BA1-C4A2-4ba9-B2B7-B508EB7586FE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3A02F9F-4907-4286-95E6-E972AC95E473}.exeC:\Windows\{B3A02F9F-4907-4286-95E6-E972AC95E473}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FF8765F-1A72-4a5d-B041-2C5FD5D57BB9}.exeC:\Windows\{6FF8765F-1A72-4a5d-B041-2C5FD5D57BB9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5986963-5FB3-4f6a-9CED-CB2C5FCADEB4}.exeC:\Windows\{E5986963-5FB3-4f6a-9CED-CB2C5FCADEB4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA6FAA63-9F8B-48ea-822D-1859974B84DC}.exeC:\Windows\{DA6FAA63-9F8B-48ea-822D-1859974B84DC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CC6FE4E-F146-42bc-AD67-EFA6D1A6429A}.exeC:\Windows\{5CC6FE4E-F146-42bc-AD67-EFA6D1A6429A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1E56AA8-6F80-47a4-A493-9632A0EF90F9}.exeC:\Windows\{B1E56AA8-6F80-47a4-A493-9632A0EF90F9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DA0D9EE-EBFE-47e5-A3F8-2F6FF5C42442}.exeC:\Windows\{2DA0D9EE-EBFE-47e5-A3F8-2F6FF5C42442}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{756BEBAB-9A88-4d67-AC2F-6ADE2D4408EE}.exeC:\Windows\{756BEBAB-9A88-4d67-AC2F-6ADE2D4408EE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A8EB9D2-9EFB-41e8-9D31-209701D3F932}.exeC:\Windows\{4A8EB9D2-9EFB-41e8-9D31-209701D3F932}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1CF1C6AF-0FE8-49ba-B96A-C1D07C456723}.exeC:\Windows\{1CF1C6AF-0FE8-49ba-B96A-C1D07C456723}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{09EC8622-01F4-41e9-A032-B18953E4575C}.exeC:\Windows\{09EC8622-01F4-41e9-A032-B18953E4575C}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CF1C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A8EB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{756BE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DA0D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1E56~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CC6F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA6FA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5986~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FF87~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3A02~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1D29~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD54d03537da32e003b7b844ff4d7f20ff9
SHA1d9c71c6b4e5711559ce891061d4468b9aa79dbc0
SHA256d5f43c7d6465d24db755e3de3d497f786ca31eb5ab8bb454518dc846ad83d307
SHA5125ff90b3454be9937f99be4e28a97ef88dd8b6005464560bb5665f90227971265643095ff42808f60efc0a3d397ac1cf187d5758774991571e187c67d566f5ca7
-
Filesize
380KB
MD53f7b3bc1edec77b161a57bca70ab6857
SHA1fa99ed7a394a972d7bb76d63acf00c2e84a0d73b
SHA256bf7338abc0507c2602566a1c014ff32c91ddb868aa2a0120da1b800f7ee8725a
SHA5127a644167de1f597e646a7441d0276936ef458f97b4ee0365d36f9aa34d9399db9e2d00d29724863c6b3d47ae3b27e3479792ffd900f7a8117e66f18aecb5043e
-
Filesize
380KB
MD5b28a43844dd6a5a2b789456fbd78bc1a
SHA19d788116b35f76c8ba67b31bb6112d6b42024fa1
SHA256827e020336bc62ba397274bbd2a1ed12d8e4e942b8a1ae410422dbf683365c44
SHA51247a0059045d8bc3990040365be6bbf5cfe29ef708562f8a298f6ec562dad353526c4020d83b446a41dcfef066e3c28b806c332dc10da01681cb8f4d6dd8f9b66
-
Filesize
380KB
MD536981c19b73013cedc18990e4a65d7d0
SHA1c5a44cacc79a9e4d056ed1361ec11ec51dfde12d
SHA2564e11795e0acb9e7dde005efc0c665921037e899e4574149f0d75608b13896d66
SHA512655e76265815c4b8fb673a9ad3d7f82574e7125faa43c6e13e341526051d2211260f7f3f275f0488150d986710145e6c9810d7ebd33947646ec33bd5a2f42b53
-
Filesize
380KB
MD5475a6fca404ac43307d5fd137e6eb784
SHA1e21a68a8d9c06feaea97ab608d0df0ed171e8767
SHA25631f63215ef80c5e13c551b77f807b1689a017656884ad548d6a7ff9bb6eff14a
SHA512d285bcf05c2dab1d94141069adfc139d568bf3a49e11a2a604a877fdabcaa43751edcacc11d559484adb2835ff7f24b166c22c8de3030f63c138a5ef0b7c8992
-
Filesize
380KB
MD53b654fd88d4b0ab190f3e2636e1fdfaa
SHA11cc9f59fc4b008f94b8d4f37a01aa19f6c6b5a39
SHA256513bd5e61d85a4c37bd01b7ee5acf0542defe2855a4dcde63b606a25cdabe1ff
SHA512959111dd29b94bb3380742480f1758ee1221f6c87227cdaf2b113f215ee0e405cae4e9a77fbb1c6fb7b57208f2720aa19016635acff422ce85d1338c5f1553c2
-
Filesize
380KB
MD52213cdb05316b0c97f3ceb1f5b522f03
SHA118e6dd5a36541df219699e8e0b3849ba8d33ceb7
SHA256a3006f56c76ca534bc086dd2a876d32414d0663f0b36d985b1fc6ba0449ba378
SHA5122f63171e77cf65ed2ceca304d3c28e1af3b10ec361c136cc2ea890518974c34f88d00e008f5ade2eb3883859237c7d15e0b83d43183e8ca22a1485c06714517a
-
Filesize
380KB
MD53aac741c0cee40fe6779b6a236fe5ea4
SHA15fd6a32ee41036112644198d17c32ecb7ab5ed84
SHA2563480e02228baacf366778978ebc80ac4b0fff3fd357b3d58991a9d744e82b9cd
SHA512b8081a324a754822604079da1914fdcb4ea73fa41df6861a5646e3767a3054973bf7ec5572eb675453e8528582e069fb69b8b76047d50bbeaf7f62ddf5140e15
-
Filesize
380KB
MD5afa196c9ac301452d7002e6f86d3c65f
SHA1a616c18499991af6ad7a5247611e366d02e483d8
SHA2568c8cc86ee28262f5ba3fc1bad3d9ff28b88fb4af227e89e840a50da7af77ae3c
SHA512c59486d0b19ee3eb300a9ff138aeb89087b0f7125a05d51ddd86cdeb87f430f5f8e2d0245fb9966acc20859d2e2eef11f32a7391c2608082b0372343cf8f9830
-
Filesize
380KB
MD5d4fa9adb1c1cf5ce0b56f08bc459b0ce
SHA12779e73c0cace8e7fe0cd14e60c242f309fa9c05
SHA256466789085c89271d70e1467c4d2d0801fbe9254b74c6e4cc8deca260999811f9
SHA5128d861e0cbbaf3cfb1fb13234d7428ffd53d1299a8835fe05c506ffef2fb0d44b855eeec6bab0d2626b0c3711e4d06ea09357a97459f762024db6bef5eaa1151e
-
Filesize
380KB
MD5a31fe5dcfd100db114d890d5bceb0ddb
SHA15c8a081af795a1c29d0aeb993efb03e4a6538c99
SHA25626d4a9fd0679c67a9c31da0b14bc3ef7961cb7578aae90d41287db33a4635531
SHA512bda4c930e1843fbc14fc15db9f1ef07955beb8c886245592cf274586c10d940485e6043d78959db9ce8e86ea3820d925ae14790b59e57df07d92ee3f3a3bb694
-
Filesize
380KB
MD50a708717eccdc5d665e1b0e16358e37e
SHA1cb3757b8432b7cdff9eb1e474dd6e605fba3fed3
SHA2560d71859e3ad06f36b097ef6efcc5e1a45c867bd083911b197f60ca07e0bd749b
SHA51267a19485ed9e52e8448a151d7ddfe87a1858274c9cc0827f101795805c64f57ccaa2cc80d3f3b1c1df0b0256360874f095f0956164e58a412944f1904c52a2fd