Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/07/2024, 11:50
General
-
Target
2024-07-03_304d65b0cdfcb2fd5705928ce114b85d_goldeneye.exe
-
Size
168KB
-
MD5
304d65b0cdfcb2fd5705928ce114b85d
-
SHA1
5e42641fee5fa91404570006dec546181c4dfacd
-
SHA256
3ff33248f6957f1579e61078e2067b2d71ad70afe5bc43f7d4684b4f134c6aea
-
SHA512
489351ecab22818219a3372c7b17b30ac49dec53bdb4371ccb763d57c6d6552d1af660d3dc554028c3d73232a87c9684bb737c6c309e1f10e98d5ba0a203a459
-
SSDEEP
1536:1EGh0oelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oelqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_304d65b0cdfcb2fd5705928ce114b85d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_304d65b0cdfcb2fd5705928ce114b85d_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B758658-2248-4b6c-A8B8-18861863F0A2}.exeC:\Windows\{6B758658-2248-4b6c-A8B8-18861863F0A2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8316EAF8-1AA0-4e86-A7FC-6A0FF248D594}.exeC:\Windows\{8316EAF8-1AA0-4e86-A7FC-6A0FF248D594}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E60493D1-48F9-4a29-BFB7-78CEE4395714}.exeC:\Windows\{E60493D1-48F9-4a29-BFB7-78CEE4395714}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C701EA0F-DA5C-425d-BCC2-9EC506A264C1}.exeC:\Windows\{C701EA0F-DA5C-425d-BCC2-9EC506A264C1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{858E0272-7356-4fea-8DD4-107C2400EC8D}.exeC:\Windows\{858E0272-7356-4fea-8DD4-107C2400EC8D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D4A760D-31A9-4211-8514-6330561F140D}.exeC:\Windows\{3D4A760D-31A9-4211-8514-6330561F140D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0AA5C96-3833-476a-81B4-3018BC56924D}.exeC:\Windows\{D0AA5C96-3833-476a-81B4-3018BC56924D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C28D0FA6-DA22-4e40-9588-6D500C23C424}.exeC:\Windows\{C28D0FA6-DA22-4e40-9588-6D500C23C424}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3985A284-1870-4fed-A523-BEAC2D782667}.exeC:\Windows\{3985A284-1870-4fed-A523-BEAC2D782667}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6EC0EC63-EB97-4d0d-A7F1-9B20194E0703}.exeC:\Windows\{6EC0EC63-EB97-4d0d-A7F1-9B20194E0703}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{630DE8ED-E23F-4677-8F54-DAA7FAEE8762}.exeC:\Windows\{630DE8ED-E23F-4677-8F54-DAA7FAEE8762}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{44D13AA2-ECB7-4987-B591-BD0E37F2EFA5}.exeC:\Windows\{44D13AA2-ECB7-4987-B591-BD0E37F2EFA5}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{630DE~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EC0E~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3985A~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C28D0~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0AA5~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D4A7~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{858E0~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C701E~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6049~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8316E~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B758~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD55e62078508509dd101df80774471c991
SHA18c1ea52ab2add44b3808ca778b273923a41ec163
SHA256e4fa42e794fbc321b3ec14b0dc027abfe7c7ed04cbbe1ed937910a68a56d47ca
SHA5127d6f1b6bbf01250ec5e732d65a71f032c2e48125a928cf82df13803adea1e80fda6e5776eab3ce40e8a398044412c149a694a0cafa70c7d1449b2247481303b3
-
Filesize
168KB
MD56d115955b7fdeda0e799f48ac6affcba
SHA15b161322cbbbfd9832d812ee7621bd8ce602d859
SHA256428ea102f5fc259d7401c214c195dac2d5f428ca75f78028810ba0b936072ce9
SHA5124c8ad4907e18639bd33fed7cc1fb432dda07fb472a3c93af7a16d43a64e87e91e078a82fa8baa451e3dfc22a5d25b8a04cba532ca448569b13d3ae9f0206e9b0
-
Filesize
168KB
MD54434016256704a316ab72a0011036e96
SHA1f06c2d3d3b558bc85a519b721f0cf593fa10f4ea
SHA256571909540acf568e2e3b0b5e5c80addcabb27bc47f4d1486c6d4a44f958aa41e
SHA512d0952a618c0178e0a4a802a9f12e2527d58b81792e0f76c354c2962e345dc4b8112990a6a47d2dd9b05ee7c9ab0f61a04f972d8b40299dfb73884a2615585527
-
Filesize
168KB
MD5c73cbe58c30d1ef2126d49cfc5564177
SHA1317ebe03bdfc7c5ce58c1df2ab2f32145422ead9
SHA2565b47683a4a1511807f003dba46a8227bc9a4ef6b34f67796e5028ad475e2b3e7
SHA512cae57aaee947d223fa35a333d5afd0c5df1c8c8ed9f94f9a7acef4373e0e6a10efd2ebc1384ddc585149207a78586c9f52164b69be259d8e192052ad2763f368
-
Filesize
168KB
MD55b300dcae5bd32ca0a8de992e50899f6
SHA1f82586749aeb4a01992391c02f203de63c2e976e
SHA2566a1f11d80079c33dafe270b8f856494221d259d105a699747baafc7a4e225bed
SHA512db3fab699204bc39f2321eabc005b4b432ab34a3aa71f8992e7c0f2ecf5dade2565d6169e78cee8c8f6f9bc39793489ca9f09f41168ad7d1b7625e1e4cf7bc2b
-
Filesize
168KB
MD5380f517c7d5d8775a2000bcd41960dea
SHA15c113975e9e479d4a89a69e511703fd915e900d7
SHA256cedc5a3698ee316a7474afc7613f5c1927f849ed09468949435d4d0e13bb22f0
SHA51216a68cec5f15014b263b5edf0d90bd72f57ba4c31aa685dcfc58f5e0551891ad66ac68eb2a2ebb71a2c1b82e57cb91d281759a2963846c5e9fd8f9395e914927
-
Filesize
168KB
MD5ac7809b99512771820874928daa35bd2
SHA1fcc8beceaf55262df745cf48b372acf7076a32a7
SHA256d67a34cde07c1ecad6d107796d477ecb647bb242fb32c241879eb0958c01fff4
SHA512c5596e6c6f7daea7d88df6c4e1670b2abde6f4041fcce02ec69bccaab4105a07431cc96250b91ca583973625e0aff784d6b9dcb412ab262ceecb2e5dc3439c60
-
Filesize
168KB
MD563609fcf054a616da84763243936d4a9
SHA171f078c8453dd28d1711236569b5afc611b1e8d4
SHA256c21873bf47410f39b5d5437081ee82ea5c3d9d5ab622e7b937e3d8177e4db79e
SHA51274c634bca5bf19341551c39df359ea275b30d82ad0890eaf7c872c7090dabb9a5351d4c04173cc900d92d5cdde30b1f4f20812324b1b59447852fe7fe49a4311
-
Filesize
168KB
MD57cdd5c78760fca73948e96a2690413ea
SHA13f95344e28bc2a559a9c0f50a4fca86f3ba6d1e4
SHA2565f4ddab0cbbeca2aab4685263f6fd4714eb595d56da925e375fd51b496f751bd
SHA5126cb5aa5015ad140401985819e53f81ca9d6c14d6527ee64abb937e21c48098f7ce75f7970fe6f4575aab436651800f33235d22b04cbe8187d641191335d12aa1
-
Filesize
168KB
MD50b78af912403afe042aa546600b65470
SHA1160ded3496782c1fc0574c5cad0517cb28036b79
SHA256a2d03d2c8418532fd1299b990c3d22c85dce2b2987cf8759df92d275c4f6bcff
SHA51270fe3d2d03b6ddcb2e29fcf19b3f74afe4beb117a60374abd47f0ec3032ba56001c523f1f9c03d38bb1374e78de8132ff9fc501d276a8e767b4c067034258dd7
-
Filesize
168KB
MD5fe01cfc588da6fc19b3f038e8fae1954
SHA12d1967e1e56d35aaaf361f62f17183fb625b0237
SHA256ebf77f79879cdf0b14f20f9d3bbe99b81064f948030bf5b53916bd1c01dcc8de
SHA5128c417208398dbf77d3de42e8e3b1a835f02cdace42f7156f962c56e18cbc2d79b934e164ba789e6df8193ef3f27bc8fd9cf98a9742394bb5df46d0571522fdc5
-
Filesize
168KB
MD5416215ea9f259c3be9a5052b80f5be1b
SHA1a928484d21cb3f5dddff1eba0487f8991412d13f
SHA2567f663d91590b174e79320324858fa1f2a33f6176cffc03ccdb1f9f768341a557
SHA512590aa82bd46087dba05e1ace661c16a4f03bb2534159c76ba27784894938e2f51ac51dffc707ab6e2bc2757104df2aa1053f847f8e6ffbf8bc17ed08682f13bb