Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25/06/2024, 09:54
General
-
Target
2024-06-25_5f7751470340039eda4d1b6a9b967b9e_goldeneye.exe
-
Size
372KB
-
MD5
5f7751470340039eda4d1b6a9b967b9e
-
SHA1
84d2f3b8b8bc1abff735fc74e4dce4468991286c
-
SHA256
2d79d3ea2510600681300ba0ecdf645aa35b1723ab6e601427c492d64b0ba0ad
-
SHA512
0b90391bab203e156f0fa7a1f088408e726481ca7f0ec0505f67b0eb28fca79eb4293966759c6584ebcf6e7b2049bcc7e73713c61f75a9e12d7b4b26fd357303
-
SSDEEP
3072:CEGh0oSlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGolkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_5f7751470340039eda4d1b6a9b967b9e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_5f7751470340039eda4d1b6a9b967b9e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0570111-B5B8-45e3-ADF0-2D0FB9631985}.exeC:\Windows\{E0570111-B5B8-45e3-ADF0-2D0FB9631985}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BF0277B-177A-4f72-A993-A57F89448C65}.exeC:\Windows\{9BF0277B-177A-4f72-A993-A57F89448C65}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05D4E9D5-2339-488d-918C-1DFD130523F1}.exeC:\Windows\{05D4E9D5-2339-488d-918C-1DFD130523F1}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{496D5534-78C7-485f-AA19-076E96C7D43D}.exeC:\Windows\{496D5534-78C7-485f-AA19-076E96C7D43D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36BA51F6-56AB-4431-8B58-70B12B825394}.exeC:\Windows\{36BA51F6-56AB-4431-8B58-70B12B825394}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9733512-C450-44e0-9B28-2223267AC6DE}.exeC:\Windows\{A9733512-C450-44e0-9B28-2223267AC6DE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C57F77F-63B5-4722-BCA1-9B9C2646E1E1}.exeC:\Windows\{9C57F77F-63B5-4722-BCA1-9B9C2646E1E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4713ABAB-43FD-49d3-9215-706F5A0F9F33}.exeC:\Windows\{4713ABAB-43FD-49d3-9215-706F5A0F9F33}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D26FF6E-430A-4ac3-B514-940D63329AD5}.exeC:\Windows\{0D26FF6E-430A-4ac3-B514-940D63329AD5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42C8DF97-7C0D-429b-A5DC-DF168499AB8C}.exeC:\Windows\{42C8DF97-7C0D-429b-A5DC-DF168499AB8C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{918920AF-2502-4d10-80B7-EC1C9295E617}.exeC:\Windows\{918920AF-2502-4d10-80B7-EC1C9295E617}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{69CB83A5-DB76-4020-A44A-F201EE933F44}.exeC:\Windows\{69CB83A5-DB76-4020-A44A-F201EE933F44}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91892~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42C8D~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D26F~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4713A~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C57F~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9733~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36BA5~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{496D5~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05D4E~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BF02~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0570~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD519e9c547112bc2c6a02d6a9a9a41f561
SHA135e1d4447bc9d29df238f5f0cb618687ab943d7f
SHA256e764752ec3ab50ebde6b8da2b9ec27f01392b6204a4891b7350e002cd965d7ac
SHA51267ee97c835004d7f2ba379699d388962308f1bdb07e8bf32b69f5df05803667636a5de859c918b7b20abe9668a7445de29414be51db2eb66e3926ef2f58ff387
-
Filesize
372KB
MD56fb268db1b4fe2e4cf261ab837d65044
SHA101728772ac0785c51ecbc02bdbb1e97e8e8cac26
SHA256c1923232f8240ea58d5249d76c3cb8f774973e260f09801013931a7365df251d
SHA51299325faf39371a92e7eb61dbab05748a0f0e910cdc1e0f5f7b0fe8b2b55fded7aa3f2d302309347320d66ff2b3d35e85a099946926bba8fe6ff0d0ca360defc5
-
Filesize
372KB
MD56dafb6aa9f765f03311c5b794e75ff72
SHA1a01319f16bfb178951327f029a3607c2bbd4b2e1
SHA25617d827c26be3fc07611d1f3a5177ce04d305693335747e2dc3fe2e91d49e0ba2
SHA5120723e21b0622a647b43e9a5c7c028a41d93f947f4ca72593f9f1be7e04144b83500def3db9ad6a0af007900ec4cb7ecbd27d559aac5cbdde04351e55d98f8501
-
Filesize
372KB
MD5296ab9775f7ef706773f48073cb15d9b
SHA18213405f5e95d3746c289aa111bea1ef87dd9d48
SHA256a47366d820a01eb6c46953e95087f4171a44b8b0ab0e3388423350d7f269420c
SHA512ec896d988c2043e95c97336cd6c20bca3db9ce78ae0f9d94e9ed8385fb21690cf8cfac7016e3763b518fe497aa32a5f42e203a3a9020e68186c1ee2dfd035d03
-
Filesize
372KB
MD5e14cfa9d8494a783202e0029d2b82fc7
SHA1151009c0615a03d3224e019fa3a80fc08f57be03
SHA256c3983a49dfaf5eca3aca3260cfe267f38302374bc1fdea51686b91cf639e2c67
SHA51204a31b87c495b467288eb9ebef4fbf5e89e3d1259f8174bd91e1dd3dd4143c72000efd7e217f85378479cb3365e92e7987bdd617cc0c8ffb7ba233b3c516d424
-
Filesize
372KB
MD5a294620ebdee0db25d78746833bf44c3
SHA1b2246b38cce44cdf733a706b71ecd399748e8861
SHA256a7caf62534d9b985a8b171fffd8360cb00f096a032bab26a37a05ab33bbaac20
SHA512267b5de7248bb21c05cc4593769f0ef4916d391f0e3d4f5d10750133c8b81b0f9fbbc967fdc0345d812d3afb453da1c75674f7a1046e024bdf6408ce82e73243
-
Filesize
372KB
MD5d47f8146a58bf32a86325e5edc2d2058
SHA121b1c3c1d2b782c80ba080aae0b1cf35884444fa
SHA2567394d9053fa17d23f6a2c553cd48f0a0850038991801741d126b141bc132d9d5
SHA51219e0fcd1dfadbfa4e25cf6005d33e39227e53bec62a83cbeebc63aa0a2dbdadefe650494a0b0ae213b268d2fea7e472c91f9ab2b94f73e46b4be0e90bb1dcfff
-
Filesize
372KB
MD50718bafa14e6a4d9d4a632fd74714158
SHA1828cd3988153a9f9632f680c8eb983effb513079
SHA25635196645f37bc0d3fac17c64020fa40bd66a9e474cacf19f0babf0ad84deb0b8
SHA512aa575f7707e6a616726f8282e11d5c888f65bb0895e27d0e8bdf3a2451f5f2562854f443722cb35692ebdbdd706b0284d2b6cc98f12435d59b674a4a0f296576
-
Filesize
372KB
MD512926a107cdf38f754dc0386d55e5f7d
SHA15b8bec543c87af0d914c93691948552848aad03e
SHA256b35a4f73723096c59967e5264410dc17097f7de473359146e26f3259dacae4af
SHA5129bdf021286e05d5d974256b0f6880f883febeb638a88537094378cdc0b4493e6c88605d73906cc0097c30782934f3e5533c11a3a4cb6cbfad2828812ad54b61a
-
Filesize
372KB
MD58019fce9c9b127fca18a51fbe341b840
SHA1024e367c0a167da032b6eb3687cef9760bc8312f
SHA256afe887025e62f40225398aaac0442a040118ffa31c8160762c36617021ea655b
SHA51234fae6635da61f56a6882f93fb854366df0306bf713c5eb061f7c747e22386117ccf8b05d4e7d4bc556d703f634e029a60df210370be548e2cbd9b5dfdd3e6cf
-
Filesize
372KB
MD54c678db9d03d9d5ee04bc3a05077e809
SHA10894695f1e6f04c6e07be2aeeeac3028e1a1dd71
SHA256d90c3f58980bb65cef29c5c93c2c39a5ef71d636a2f37743868090d5d52312d0
SHA51207418fe78a0ab0a92c1e5eac82aeaf0889de6acccf0a29b901d0ba8e77b35f284fc791e5c5cb9bc18056c57f7e212c3e764224f4b7bd8c8debf455e7d8483ab3
-
Filesize
372KB
MD51923785c8d47c58b65ebf33a1d162793
SHA1b9f47cb09c245b8a232255bfe2df85fd7c97af25
SHA256256ef723bcaced7bb19fde2215c4fdf3f3bb9948e3b7c17341e1ead1f35b8f6c
SHA512a2fe8a54bd20b95ff97643dbcddd377e52df1eea3224b7cf9248a0f2de59e0455dc5ad83283e89b320c7f806f08ce0e3650a620baeff3be89cbccbe56309eadb