Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06/07/2024, 02:23
General
-
Target
2024-07-06_1b41d4db6da40c625c64771281533c80_goldeneye.exe
-
Size
408KB
-
MD5
1b41d4db6da40c625c64771281533c80
-
SHA1
138f71668b7673e842ce4d0459f5dc0da6f00746
-
SHA256
c6e9bf8c8066e845375adee83c3cace0ae265d5569888b1c2cae983ebc18d809
-
SHA512
b56aac65d1ac9d1b0e91f4b84772b2b3ddcefeeb8377f2acfe29b7e786f528beb4b1a6d3929c690d58eaf92a3a94e6a29700beefc687f4c4c83c1aadfd1877fd
-
SSDEEP
3072:CEGh0owl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGqldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_1b41d4db6da40c625c64771281533c80_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_1b41d4db6da40c625c64771281533c80_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3651ABA-B757-49ed-950B-8D05D5B7E310}.exeC:\Windows\{E3651ABA-B757-49ed-950B-8D05D5B7E310}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB3C5D8C-73C5-4b48-8399-1A5993E3409C}.exeC:\Windows\{BB3C5D8C-73C5-4b48-8399-1A5993E3409C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60FDF2F4-0FC6-4b6c-B3C2-62BBA4137F8A}.exeC:\Windows\{60FDF2F4-0FC6-4b6c-B3C2-62BBA4137F8A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52B1B4A5-059F-47b7-B175-A57DAF310E36}.exeC:\Windows\{52B1B4A5-059F-47b7-B175-A57DAF310E36}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA983730-CE21-4b27-91C5-DDA626DB2B8A}.exeC:\Windows\{DA983730-CE21-4b27-91C5-DDA626DB2B8A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B00A3761-FF32-4b72-8157-6D8DFD1E1485}.exeC:\Windows\{B00A3761-FF32-4b72-8157-6D8DFD1E1485}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4179313-F2F8-4fc5-BFA2-CAF6234BC677}.exeC:\Windows\{B4179313-F2F8-4fc5-BFA2-CAF6234BC677}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FFB62C0-1095-4db9-99A7-B74B4794DD44}.exeC:\Windows\{0FFB62C0-1095-4db9-99A7-B74B4794DD44}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{006B4001-9793-4367-87F8-210F50E702BC}.exeC:\Windows\{006B4001-9793-4367-87F8-210F50E702BC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29BAB8CD-4555-48f0-A66D-AF34EC39FC1A}.exeC:\Windows\{29BAB8CD-4555-48f0-A66D-AF34EC39FC1A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{520D6383-EAA8-4d8b-8DF8-917762834D83}.exeC:\Windows\{520D6383-EAA8-4d8b-8DF8-917762834D83}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1F6C7BAD-9F4E-4c87-851F-A2F619F09E47}.exeC:\Windows\{1F6C7BAD-9F4E-4c87-851F-A2F619F09E47}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{520D6~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29BAB~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{006B4~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FFB6~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4179~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B00A3~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA983~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52B1B~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60FDF~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB3C5~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3651~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD51507ac9c3bf5d29daa818b3eb5359e1d
SHA182e491f9f2f80775bd10c096b3f7d0f5b758301f
SHA2567f4ee7f9b3a879647fe7f6fbcc56c9637bfa080564e85e451b49fa523be25403
SHA51229ee809103a376b6d7fdb70a308e0b031c5225cc1bb7ac8916c9be6ec3567a4d1279ae1b73a8d2bb08c42c6051a0baafd0ead84fc0002f76566f40e8c6c1f912
-
Filesize
408KB
MD505dd0e737da5b9fe68af8e9730930a39
SHA12190c518112736f172912ab0e4bcb19a50aaf0a3
SHA25618ee990de2d3af76cd7f39c82642a1bbfce62acac7dc2f32ae4f3ae90c03ede8
SHA512b33ca7919d53baf510e96442799963584286b27a24dea8c3fac54d37db96da306ef846883560e97192b4ba7de3ba5b2554318eb11affecce8b794f563e55c3d1
-
Filesize
408KB
MD501807eb93f605374c3ff1e36376ec145
SHA197f8c88f1dee1da6a1bc68a1a1e27ab55981bba6
SHA2561681823daf734900821d3ff28ee88c2b37f4b373bad848f1f0cdf9e0c138cbd6
SHA5124c3a0bda397cc84f7f567cd942150d3390f79adabc160924146998322e2891f9d8d520b1f0185775d768bf47baba9df0a45d3a982c5510d6cb6a3ad8cf6b5288
-
Filesize
408KB
MD55de2a3ccdeba2dbbacaf687380175727
SHA1f202dd535a4cf65a23b25cc52fce15e8929cb238
SHA256752d7b6391874be263e8204599eb2e74f0a5707b897914e71e68342e5a02da58
SHA51295ae535ab717afa3e2bb654d8f3d24fa305c0589331fbd966cb8cca156d925b7b84471e612fe8fed0ea17b241f5d40541c1205a75d590b29ae8017192f501395
-
Filesize
408KB
MD56f02227528defbf435349f58bae191bb
SHA103f6fdce2692dfb1efc7f9e2c1448477579d4e4a
SHA2562706da6989f5a965125c9be64def8843fe2a53f07418160ea93001eef3b3bb65
SHA512778a5f087474494937f5ca2e10198c96d59fed476b684c3a4f9e77d38a080996ba60aaa7b2257cbe7bc866c7a6ad091c7fa65b5bcc9807d7a9f02b196b9a5ff6
-
Filesize
408KB
MD53552d0808618a022fa2933d197b5b3e4
SHA1ec52f08fc4e1586932d934b6f4726292e0287038
SHA2569cb438c6016cf0f67040cb9fe20ad402cbc58b6ff0b28fceda37b07e6fdd4ee0
SHA51206e8d435db0a016647377d555e3d66a0e4f3e1e23158b4c8f31d3912b0c3f2d356e272ab8d5f2bdddf68250c80cd391d342bd288d0afab4e3be2da74ec409f45
-
Filesize
408KB
MD585f9a4f35735f6d0b065bd040191186d
SHA1e17075a5ecf35ec84d557f7610788a3dcad5315e
SHA256f67aceb832ded172696a58af857ee05ea95ce0a62ff4ce233f73a49476f91227
SHA5121a3b9aa938683a3ee148db7fa9f1ecfcec10f60a3763c6fff6184c804d18a56a26952e5b57739e9286d343fb3e34b641c0be8f5af54d3cc047aaafbc09cdf0aa
-
Filesize
408KB
MD5f1a318e733430c1fff957070c1b65743
SHA1126e386f5e888a86e6d49abfb16fd3a9e8ece9d6
SHA256710e4d423f9f5f7410b2d5098de1901fd65be99ec7c1d038ed5714b9fb84038f
SHA512e12f4d8d0a4f12481bf87d526b26a1b2798cbf4502dc7b2c5f418cd664bff4533cea4abbee14f1977322db87f63e4a42dc93474416fa084c86b7e5406a068549
-
Filesize
408KB
MD526ace81c5e52b912fb05d1cbb2c8d154
SHA140f424dafc613c2e3ff4a02f8d237c78a1dc7ec6
SHA256dd141cc0cec37d721c8b6ca94c56e7f329ca0e81a69f4054d04184d80f575915
SHA512b75868b2765c4c3c1d0e34fac7df0d207dcea9b451b32dfa2f7f33411cdef7762dd04133e2790095c3cf5f01bb763396228e63a7cd8112f312f610b1d6bb4d0e
-
Filesize
408KB
MD588d6add87fd78f38632fc279baef09af
SHA1746e667255b739fd3a1796eed358b24f6dd405a2
SHA256800d778f618ad38e77e5e6ff5354df55e577be2db753354b5ac9cbeb3f154a11
SHA51210fb566590713677ca130134e60ee57e5f821305c9e7308de15103fd5844c6742b67bfb19e8945ba68a930098495474487b196a31434aeea927b8f7b9747fff6
-
Filesize
408KB
MD5051dc7ceb36c71821fb519e71c9a0876
SHA1ff2d88d85da9cd0d1671b2db8c72d1be1cefdcef
SHA2564f6c804ee96a0172bbd5941d138ad021073f63c7f6b9f98302492527089624f0
SHA512be75fcf8ac87fe351b38cb60491ad9f8f91297b2419107e3af82761a8d783def2cd9330f30632539ac794e04330e058f819c34f129baec8914e4e5f55435bb82
-
Filesize
408KB
MD54f3acb3773f9fccff22dd7832c9b04d7
SHA1f47065ab320e086e599eb3979332ac02a8f58d44
SHA2565aa666953f73b721f8a1d8229766651c9cd052e22b553d750671d5934e354e36
SHA5129b127ebc5abe0737d31e39c5973547a7556cd034e4d49f815faf9007db6643b2f6394b89dfef4810b553e471c2dfc1ed75376e3843f4c2e96166117492e95410