Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 06:41
General
-
Target
2025-01-11_4a9ce7d3fb2debcf17f5b177268f9250_goldeneye.exe
-
Size
197KB
-
MD5
4a9ce7d3fb2debcf17f5b177268f9250
-
SHA1
8082b7ec27208104022ba6e32adf58ac7d5256b0
-
SHA256
798279cd9b40881770fb830dedad8b8a67ae363077969c94b07931c89f9fcd59
-
SHA512
e4925014e63a1c843325a88c957c49933784c3e7c4386c2e452c488b7a316a50f63e0e3a9dceb8f97b711ddb897a5b31a706a0a783161c6b38926a85a2ffe6a9
-
SSDEEP
3072:jEGh0o2l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGYlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-11_4a9ce7d3fb2debcf17f5b177268f9250_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-11_4a9ce7d3fb2debcf17f5b177268f9250_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A50DEF5-4672-4152-A51B-F26E6744878B}.exeC:\Windows\{5A50DEF5-4672-4152-A51B-F26E6744878B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B84C016-C42D-4e2a-8A30-251F10DE4E38}.exeC:\Windows\{0B84C016-C42D-4e2a-8A30-251F10DE4E38}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5DDB8335-A47A-4d15-B691-E6BFB503638F}.exeC:\Windows\{5DDB8335-A47A-4d15-B691-E6BFB503638F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F43E4C57-9415-4051-87EE-15B81F2D7A23}.exeC:\Windows\{F43E4C57-9415-4051-87EE-15B81F2D7A23}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F139A741-C8A2-4bd2-8297-3496D69993BA}.exeC:\Windows\{F139A741-C8A2-4bd2-8297-3496D69993BA}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E916B0C3-92EE-4ca0-A08E-AE157CD80B53}.exeC:\Windows\{E916B0C3-92EE-4ca0-A08E-AE157CD80B53}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C717C496-0758-4369-8B51-CA2D7FE5B370}.exeC:\Windows\{C717C496-0758-4369-8B51-CA2D7FE5B370}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{061498EB-F2DF-4178-A697-329E366D4957}.exeC:\Windows\{061498EB-F2DF-4178-A697-329E366D4957}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5FC1972-F6CE-4676-B042-51825E0AA0F2}.exeC:\Windows\{A5FC1972-F6CE-4676-B042-51825E0AA0F2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1A0AD79-F0C8-4d80-8FB4-51CB4555E73E}.exeC:\Windows\{E1A0AD79-F0C8-4d80-8FB4-51CB4555E73E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D1B62CB-E080-448c-8222-7B62C5F50002}.exeC:\Windows\{5D1B62CB-E080-448c-8222-7B62C5F50002}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3F67CE33-18D2-4896-8A15-9FA66F8A5162}.exeC:\Windows\{3F67CE33-18D2-4896-8A15-9FA66F8A5162}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D1B6~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1A0A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5FC1~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06149~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C717C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E916B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F139A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F43E4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5DDB8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B84C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A50D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2025-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5c407aba295dd0acf3afe91ac7d8be66d
SHA12267efe3e91a7cf6c3470050ea7d5d7ec935143c
SHA2569f23a4158e21159f901f9268ac0f692e533f1049a184fafbdd758beacd1a02c3
SHA512e667240c175ca25bc7b9d99fd874950b673919c7f363f4a3862b499bacc9451534a9bdaffa448966087f9afdbe5e7879f4aeb5341ae9a58dd3833f366c96dd3a
-
Filesize
197KB
MD5bdc8ada708035eca227c1eeeb1d0cdb3
SHA1a5540374af0ae27f76990f59844eaf8bf630c4d2
SHA25643b738c1e37d06a84ce82ec84244b80c1339565c9a2ed9bd641fa588f4c438a7
SHA5126c6c2ae510e25ee33a84d88f9f76a9d22e5cfe8da05e023b127f14716e9b2c2d30ecd46f6f0fb7f03244b5c8b7158809c67a968cf62aafb0ec7748b42358d890
-
Filesize
197KB
MD58eb53234b6f9c2199d98f7458edbaccc
SHA1bef04e36e6717a5a74ebdf7cc4c4444bdac5ca04
SHA2568a69ac0b0ab17b1b05160d7a666857db3116e88c1f4ec3ecdaf02dfebc95b11b
SHA5122d659aeb7fd25e3f029211609884417c14a84b8af923cfae74243e5547569b92b4238b3a6ef6d4f4af775ac4d903f038e75b662020846239b5c05fd8d4d22483
-
Filesize
197KB
MD53b587d505c6fcc9d11e8d8e157f373aa
SHA14b36056f8fd955c49189b00758bc7af436890a17
SHA256640bd45e51ed281f8f17207690bb1580263a9f67c341d6be0d70d7c3923c7cbe
SHA512bad2281617b9ba0c8cce7ebc787b4adfd08ff3da64d21b5376cd0769e03d0c246c4a5e9b30eb5f55803b6d3d7a33e847d9884b901467a26642766f7734dcbed8
-
Filesize
197KB
MD5c9a9ff95dfd61970e53d2b4b627957d8
SHA115562599a2e5d42bb4a493cb0cc4f769cebeb59a
SHA25677b694bf6253c338e4fceed89372d820e4f2467aa3e5bba263ec7da6181cf3f0
SHA51227d2ff2c5b4304b773f49f282156ec2d7c0c30349751ba755ef5695639eba819356d833b5978c351a20d6f9c710335c91ffff452a52a88e024582fa18f41a6aa
-
Filesize
197KB
MD598548257745743073fd792eeb8582fd3
SHA10a71d5b445d774479d9bd9619855825be6946957
SHA2561d680343f62343da01cf4ab1d264302a6e274a3427017de2592392ba34b2d84d
SHA5120f98b29c7f0bab57fee668e1a6092373aa6c794623640f3f81af929df6020865daf4f2691c85fb499160f72b24bcbf6a238d5e8a1dc5cd2e410d27681265e788
-
Filesize
197KB
MD5e1c6f3b842ec42d4d9c5b51825053dc4
SHA1242112d1c00cc1c9765048cd3dd0b05045b439c2
SHA256ed2b5168b41e5cc8a059b7c6c1e788173b8414603f54ca89793578c559ea1e53
SHA512a42399c2c34acdd120f079e08ffe968e5831b1c471f993c079177778d1bbd20763851d46265c35d4cf03a064211b89f23458cc637e68d59e44497a91ee6250b2
-
Filesize
197KB
MD5d00fc015705b288b148dca9f08aadf38
SHA14548c8baef2c6d100cb26646e55ae09f20d4d4c9
SHA256426d8cbe25da82155e722fa8bc6bee7df2553ef80384aa4f64fcc2f78206d89f
SHA512e437c0f9e99f42194d9e31868616e7c17d6b619b2052dc99d9fd26ce24cd2c2dd0e250e9f1ac65b6aa03ffabbb4b4eef9aa13506740b92c6af83c22cb83ab361
-
Filesize
197KB
MD5a8eb555e75e451a7e84cc87bfd7df213
SHA1116557d995db6d4f1c502a6afef33c8935870372
SHA256d6085cfd6b72e6c8ef5c65d0cbbbabea7f19b83292d5dd488308a1b4d56fe662
SHA512694a9f6111cbb92548a350505c4e6f83de8fb84e107fc8c19b4002a620d0ed3d65652495e3d82f26c1a4e3ac7e4d234d1b62a945927526fc85472ff7cb61f50c
-
Filesize
197KB
MD59a70e812178e485318ea8e350f89d499
SHA11b858e33ff089dc01380b0a5eb76ec68c5d6cbe1
SHA256ea88b3ce8fda1d7aac6382bd37854d1fa22c0e4a80f6e03f9c0df4b2e636e2bf
SHA512be774b2cd4d6c19b83bfd36fd00e21aa63c7bc3337a7924df760717bdd7c3fa9ad0f98b8bf4a7e66166bd3fd1e381c8deb373a73ee6519830a9664b0cfa640ce
-
Filesize
197KB
MD5bcf2e237aeebd2e0fc6efd4730a6e231
SHA1abd0fac06a4ef480a0c0d3bb3db0836d4ebe229d
SHA256b4ff3ca0329d2f689340f91f6e68f5007597ecd301a5259a0183feb749525f1b
SHA512f60eddedd9735f18dd43308ca5734c2079a53f8e9ac54f12f370090975778c87802fab01b87abc0ba72b3fbe5763e850205262fcf8d1d0be84502c0b765f4182
-
Filesize
197KB
MD5507758acc4608add3cbf68c929d5ee18
SHA1ba3d1e71f71e8e6ed0bd9d05f44dc53336a15e0f
SHA256c3fd1675e73b051e001f5447766884c60bc2dcee07afbcd20219d77288a83e86
SHA512f2fb0c65e2cc1adf72f011a1286bd40d0c9d23f8fd7158161dbf41c3257305e2cefc401a084eb6744c1905bdf2b5b3f07c28cb5c44ee1c5e748d0fd6b754cefd