Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
24/06/2024, 14:31
General
-
Target
2024-06-24_916d19585ed6bfa33106ff81925c9c92_goldeneye.exe
-
Size
344KB
-
MD5
916d19585ed6bfa33106ff81925c9c92
-
SHA1
1ef461f571c041c5d828a502eecce4f443afc08a
-
SHA256
a876ee5b4e29c4bbb44ea04b02cabc8ce223cb295d5e9946c5f1ff42bb7ca985
-
SHA512
c17ffa3833044f72ac791746a1060670edae9d7bd08f29594d67b7292eeebfa28467e6d0cc02b81a0bbacc98e15635dfcd8bef2e176d6dbeb3b9c4ab04dc0995
-
SSDEEP
3072:mEGh0ollEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGTlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_916d19585ed6bfa33106ff81925c9c92_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_916d19585ed6bfa33106ff81925c9c92_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{022149A5-DD06-4ee4-B0CC-ACA7AC63F4C0}.exeC:\Windows\{022149A5-DD06-4ee4-B0CC-ACA7AC63F4C0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E329DEC-907B-4c05-B06C-2CF4F5290205}.exeC:\Windows\{7E329DEC-907B-4c05-B06C-2CF4F5290205}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B3D507A-9493-4287-9DCA-81B4E76D176F}.exeC:\Windows\{8B3D507A-9493-4287-9DCA-81B4E76D176F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BEE6128A-B9E1-480a-8741-C6250874EE4C}.exeC:\Windows\{BEE6128A-B9E1-480a-8741-C6250874EE4C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{977FAFCC-2710-4d8a-9D07-0EEB7AF21709}.exeC:\Windows\{977FAFCC-2710-4d8a-9D07-0EEB7AF21709}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E65EACD-7758-4d36-98CE-A0FB96F68E37}.exeC:\Windows\{2E65EACD-7758-4d36-98CE-A0FB96F68E37}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{037B44C5-A4C4-4017-A1B7-9AF79961D94F}.exeC:\Windows\{037B44C5-A4C4-4017-A1B7-9AF79961D94F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F8F41FF-24E7-437b-8E30-C4988B5DFB1B}.exeC:\Windows\{4F8F41FF-24E7-437b-8E30-C4988B5DFB1B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A642A619-BA59-4872-BB57-D493FE624C60}.exeC:\Windows\{A642A619-BA59-4872-BB57-D493FE624C60}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEADCE7F-E90B-46a4-8BEA-F1E7280E5699}.exeC:\Windows\{AEADCE7F-E90B-46a4-8BEA-F1E7280E5699}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2ABD8BBA-9304-4e87-8454-8FB67AA29E1C}.exeC:\Windows\{2ABD8BBA-9304-4e87-8454-8FB67AA29E1C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B62FF500-F19C-42ba-814A-0A02DE77D32C}.exeC:\Windows\{B62FF500-F19C-42ba-814A-0A02DE77D32C}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2ABD8~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEADC~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A642A~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F8F4~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{037B4~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E65E~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{977FA~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BEE61~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B3D5~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E329~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02214~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD51748ec4268ade3a225c7d297534d2481
SHA19bb7f60b5fb8682b03d944ea1410e0cd1cd57b61
SHA2560ed9fee5435035cd6c140915136b50c096d2a86f778df504b7145cea55c36322
SHA512950e155d347751cbd65f15a986f3c258aca46667a4dce1c55ee55a3a5f9438b65ec758900348dc2bd2b17f350f4a362ac290f88f1e79ed1a9e438fb2a452acf8
-
Filesize
344KB
MD51cc88bcc5ded8c769f13d6b04df9fde8
SHA187ec4d89817b7e081c863d68b5eee49cded2a8da
SHA256ad4f38f8c0da255fab553af70bd23b655f2592edf0d8f7dfd311956d972c1016
SHA512d030b944bba658990c436933d7ffd7565bd9f452058527c590cc2b3cfa70b505711b7e180877b66c51d9c4b9689521d71444c35e5874326f0c7d4ffa31048ca4
-
Filesize
344KB
MD525835fd5e68e352ee61499585467240b
SHA10782e1c86d2b98cacc6857f681fdfb2346e03a8e
SHA2560e647faf8cfef00c7f6e76ae99b6ee67825d22075e826380e4d033e1ecf24ce1
SHA512d9f4552be4a79ecf9ae24b4d89f650adecd2b411b996b5e2e35476b756bab9c9047bf9201ca27794328337c04b1b698e2f7d1a4e76cb8ed2d8f1083298ec694f
-
Filesize
344KB
MD579178fa77549a14c1f3bdaa8cb1d4db9
SHA1803bd5ecbb8dbc1902faf99b09ca1954ff7354cf
SHA25692ce64e390ee4bdf06c9efcdd037f1e65f0f421a2d7b73248939b630bb8b1fa0
SHA5120247361c2735e965baebeace3c01762aef90f9d15b3b96521cd21d35c7c6db1abb8f4c5a1668ded85ecf63dd5ec1ac4b9f150a2ba6005823a4c0534946513ff5
-
Filesize
344KB
MD5c3e8dfe3df8d1565f18e0038f93da12e
SHA143f9ddcfc5e5fe6c7c7705a870b2dbf5c4fb4341
SHA2564b78c248cb10d2f072362b50e890eee4f1a85dc12a6004d4c98adc13f8994a13
SHA51252839501a2b84d4120f5cb02a5bd4635a5f01d76fd93acdd9a28109fe69a9b4a59d643e1e543d872cadd456a7f7751985c738c03f9801bee2a18bad55c55578e
-
Filesize
344KB
MD5ceb68aefafd27596234f726506fdc520
SHA1c3df02dd8367335efab4e4e47d6fdf299fb656ac
SHA256badec3b162499b87eb8a720276f66ae40200dfc625d8f2c81bec05544f2d2600
SHA5120352da2a6a5600ebc00361928f705351980776b5388f888561d76a9ff92fcd914439e5450c1eb5b2cc875341be96bba42f378340fc26dc4d531c281befaf6afd
-
Filesize
344KB
MD51d013e503da873783aeeb671fa96cf54
SHA165cc29522382ff5f8fb6a9b949d744b2055e2685
SHA25660a981359010f5641329bd158a7dd0ee97f7f59e658c21a54446df18e8efe969
SHA51297a86479c1b74a1cd84d6924a57f8a6246facf5ef2d2229a9d6e6b0628034612992a8806fce61eaae731944c5a079a39dadaf46ad5fd24714ec78afcfe4eb47b
-
Filesize
344KB
MD58047cfd8db46b19f03d3983d59a6b881
SHA17cf9fb6c925a1910d6f52415a6cc95426395cf13
SHA25628767ba683d34ea1013bc627c015cf159d8b494c5512f83fdbc6b31a3c6a715b
SHA51289db897ab5a96626413d1a325e6f3dea4ef8769c922420f82081f14ef19dc066e315e303bae35bc9884084f1cad54dcc4527f557d3525ec5fe7604699ba2e640
-
Filesize
344KB
MD5044ada5eee833ab4f74813c199585b6b
SHA1de804d864fc109ddf493c33e60a9836fca9e253d
SHA256193646b42090c5bdf814cbcc7fa1d1b060c7ed5ae256786c5d3191412e0e56e8
SHA5123a0454ccf170f45b1b43e7e48985f25465cfea718b694286edb2163d21af3f74de1ec795741584d2c395a5fc29d31ebb7a2d4a29d8cdd0586f18727909581b94
-
Filesize
344KB
MD5ca49472e91b323418da0b7033b544ec4
SHA1101a32cfdd21bae9fc1f9b504b6053cad8bfe753
SHA25683a6e7fc7c4aa9d2b49b3218923f714fc6b01d991a8e3046ddad1b3c98c883bd
SHA5126528f1d1c092ab6d563006869f58883378b4a01dc16dcbbf69dfc0f2ae4222bdccbb789cfd842cf312e222e8ae094acf1925d4ca98c5afe03aad8b0d28c71adf
-
Filesize
344KB
MD5e9ae4b527f35d08a02965625ff34c8ed
SHA148e1c69b4bbb72a8a081a554297a35397842eb18
SHA256438dc6ffb93f844def0598b1ab01026ec37819abf516af3ff9bb9c729576b9b6
SHA512e2c20b16e112d7e2b84048820bc88bcfa744ef62a59f2d33fef83e9d72bf451e9819b52d76defcd7cc1896ad8e481110db14a985733c5e5aabf2f95c0411661d
-
Filesize
344KB
MD54a7ae95c74ddc4a2fc1208e4f0b21c4a
SHA1faa418151789bd7c80ea6fc60b136c1df0841958
SHA256ba65451bd48b821c505cb3d09f919398f396c408a42160d7f56fae6546e7d919
SHA512078eb509f6e94e5015663b462f8853d7418bcf18160fde723a67687cb085b72d27e9bc93f7d854e25f9a7a3ce70c0b2489d6eb89ba663ac2d370a7b4b1ff8942