Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-06-2024 13:22
General
-
Target
2024-06-20_d1f07e4eaa15b5fce11b22fbf8834116_goldeneye.exe
-
Size
408KB
-
MD5
d1f07e4eaa15b5fce11b22fbf8834116
-
SHA1
1a30df9c4c885d5502a888b29bafd0e1dd5b4d09
-
SHA256
fbde691cdfa4479bd45e82929e7499e9dc819edd14f213798192d7ed684c0d5d
-
SHA512
474a641a291a63dd117f5e6b2face57ec07a20a9324cb8d1025f294a7383c4f2f9c2df7ec59b1736d753dff31c00241e1c286e7891b7f614c58e758cf4f8dd19
-
SSDEEP
3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGKldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_d1f07e4eaa15b5fce11b22fbf8834116_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_d1f07e4eaa15b5fce11b22fbf8834116_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC2EE5FA-AF32-4424-9368-7C9C5B07FA38}.exeC:\Windows\{EC2EE5FA-AF32-4424-9368-7C9C5B07FA38}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3A02F16-D7CB-4f20-BB17-07FFC1F753F7}.exeC:\Windows\{E3A02F16-D7CB-4f20-BB17-07FFC1F753F7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{499F2E29-D639-4c66-890A-30148974E9B7}.exeC:\Windows\{499F2E29-D639-4c66-890A-30148974E9B7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BC26012-74AB-4a68-BC05-54D0269D053C}.exeC:\Windows\{4BC26012-74AB-4a68-BC05-54D0269D053C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6EE7027F-B965-44de-99A0-EBEC5C258B85}.exeC:\Windows\{6EE7027F-B965-44de-99A0-EBEC5C258B85}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6F83BE4-BEBD-4342-B422-17F08F707E7D}.exeC:\Windows\{A6F83BE4-BEBD-4342-B422-17F08F707E7D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8E7DBB8-0611-4802-9627-CC6D51CB0522}.exeC:\Windows\{B8E7DBB8-0611-4802-9627-CC6D51CB0522}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55034683-B822-4a12-977B-8AB9B461932E}.exeC:\Windows\{55034683-B822-4a12-977B-8AB9B461932E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD562E26-A228-4787-9CA4-4781BEDDBBEC}.exeC:\Windows\{DD562E26-A228-4787-9CA4-4781BEDDBBEC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2286D033-E4AE-4511-A2FB-96C3E1D79E0F}.exeC:\Windows\{2286D033-E4AE-4511-A2FB-96C3E1D79E0F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B719DC8-E0A0-49be-820E-B371840A8CD4}.exeC:\Windows\{0B719DC8-E0A0-49be-820E-B371840A8CD4}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{42FA2782-FE50-4bf6-A0BA-7021095D618B}.exeC:\Windows\{42FA2782-FE50-4bf6-A0BA-7021095D618B}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B719~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2286D~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD562~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55034~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8E7D~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6F83~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EE70~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BC26~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{499F2~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3A02~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC2EE~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD597c1a6647faff2e25a7e5e904e1dba04
SHA1b414dde80c03d004c5e21bcb2befaf2f58c52693
SHA2565fe9432378e8802c4cf0485ff224faed8ce46791bca0bcbaff109f17b8f9b8c2
SHA512ffa9cb27cdd61dbf0eff45139c264cbc9ee2a543eb35d3382843c1a846a9fd206beb4d0942b685c62ff3a2042c406fcad8dfc28a0068e2a0791ce0f7536e2af0
-
Filesize
408KB
MD50abde76fb8b49852e19395f8a5b37b5e
SHA16876d32f5b02552917a42dd4afcc2065f75195ad
SHA256d1cfbc130fe88bdc72ee51d6cb82f7fc21f8ed5bac2c1ca415254b328eb49900
SHA512ae2a1637da69b5aebc2c4ac96e837a560a8cc978bb6649e6c2e5b06c48a7637fdee0d0de225fbf0b1099a6c42fd6759e90e986e385227ee5adb6bd1f7b10f531
-
Filesize
408KB
MD54896588c64349a67af6fe4c62d6fddf7
SHA14473522087457f552af141fc1a548204d5bf3017
SHA256bfc4e0775b888ba1c5de8d8df2333c2a9dfbe57cdeb0f9621ddc4cd466d30ef6
SHA5126bcab3abc07680ec2f883d438bcc125bf95808bfc8f52849333d3e357649db9dde09f16b0ac7d7fffc8d053826d30a5abce0bad665bcf6d34dd98d3d084664a6
-
Filesize
408KB
MD5d357cfd5f6d6b27f922de1628b86150d
SHA1de4aa2a6bdf95aaa9724c6d4e7d870181f42a111
SHA256917347ed96994b29d6f09965b858b30021e9510e194c1fa0695ff8c9f4064c4d
SHA512ce26629a4a8ab9463f52b63159516f0c63ced79507aafe5e250164ef0151af00ea91189725f4c41f43847f9d9ed15aafddb3b6139b32b7dd8f2084c7dd9a07ce
-
Filesize
408KB
MD5fff2642e3d798b8001dc96536d92c62f
SHA1662057c6ede8605aebb5bb4c992d211f54acc2cd
SHA25681a38ef288eb7e6e491a87912393ae920262e909bcb9fb44ff046b4bd9d3ddea
SHA51285c5f1f1f7fb730ad610549ba73ee18a1bd363d649d4d58b5da07a43d6092e2657fc9b1fbb3cf0db683d518887732d41104ec0deb53016258ada161c7f97a0b0
-
Filesize
408KB
MD5ac7c295f0267fcf2f020b12708b3a7e7
SHA1bc5754c3b3372f1d3807c8987430a719ff7622cb
SHA25692adbd95cb47c8c3dd4b2e479467ccf8e7582dd7130a01e3615529a9b44e8561
SHA5121576e80cd89aa9304475b35a98050768698b7ab1f1abbbbebc58cca1d1ce840b0fedc2656acf5d7fda9693b03658206eb39e4de1478b4466570115fb89415e77
-
Filesize
408KB
MD5fa4ff3bd5cfef0ff09b8c52ee4a6f87f
SHA1e15565668b5b7e693398e0c63f127ff4d6674443
SHA25642653761931b2ad177879829da6d5aec3c34e94604dafec0a8cf56d0d88dae89
SHA512495c399152349e5fee426754a6dc8ad2f1cc9dab1dd074252a1131e9d8084604a113022cf7bccb17867ccc3ec1675e618ba69e68afd7c205d8b0b240bc00f736
-
Filesize
408KB
MD52c12ad353f55ef253b92af942b5efee9
SHA1f500cf2e7363eae1edc14934861b4cf892fb7c1c
SHA256e926c86dc1e9b762b6bf47086af5d106151c6b428e341bbef7453d6181f946ad
SHA5124bc0d3385124b63285017ba3fc03c2cd4b8c458e91d14f739c79b070c53c46a5063ae614204377a856f5c554751040a00a5a5292ce7b2810f7ac71e7ac0a01b6
-
Filesize
408KB
MD57794ed60dae68e75a1f3b9f19dd62500
SHA1352ddecef6c69ba909e2eca0e8a36285978f24cc
SHA256a1b42fc3a90b6f9a6ff8a156e2c86140bf0a3b89e6ce72c0e407ac108d929295
SHA5122b271dbd866a44a1db1676b89eb35f86284ac3b6d47f413aea82da4d15d32e50c285328b2d031d9f1002ed4908d371121b1642a65afe6b16dbde2be2ff216a5a
-
Filesize
408KB
MD5b504f308e0d851773b4e10aaa2e622ae
SHA1baa9b5841ee39bbbd8713000f130aa0b3b27b11e
SHA256b62208edb04a61fa1e20250f50a1a0ed51c8440464c12e5314510cb958b3ba93
SHA512524a62bd388c361d2aa91b2567ddad60dbe4fe554e6943de704963f516024d9311774dd7e6b4588101976c0d6b41873ef44dcd971deeeea5d9bad0323885cff7
-
Filesize
408KB
MD52d830d35477d79acada876fa2fc84199
SHA1bfee83635a741bb0b287b21cdc538047e159571a
SHA256485a45ed477d3b543e5f4e403a002a9d08311e67aa99cf3c23cfc2a005ca67c2
SHA51230d0dfd91eb2293e0ca86a716746e623fa7146662bf3841a5ede01fdcc48e664cfb56b48de31357bc8cf75da4934f0d524e2355fd93a751f8795ab7ec8065cf3
-
Filesize
408KB
MD5630d7147fcfa559c575794f664f767a7
SHA1a02bc8b13ccd85a3256e4acb299aff404d648c2d
SHA25676bb935019a7058035add109d8982010c341262706d94f46d1d7d090864ead6a
SHA512e80a51308db6988781bbccc575ba58420d2118b44467bb42d8186c748e3b5de55490bd31231e1fc25f9b009aa9fc9dcdd7c7242395cae0133edb343fd6918577