Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06-07-2024 02:30
General
-
Target
2024-07-06_ac6d097a7ee1bc5ff400524795841f7b_goldeneye.exe
-
Size
344KB
-
MD5
ac6d097a7ee1bc5ff400524795841f7b
-
SHA1
3666d002e81ea908db03a74fe69ddf58e43eeea2
-
SHA256
75c24b96246d6d2bdadb156dd016eb074f385d4e0202ebaaf921c70386ec0d6f
-
SHA512
0b9b26840f8b28d43ae12c0e7129a092a5228722355e82d32631cfda39101668b5cb64c81ebf48c63fca1f636cdfe438df5ff3f6f2df61d703bec4c88f31a84b
-
SSDEEP
3072:mEGh0o7lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG5lqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_ac6d097a7ee1bc5ff400524795841f7b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_ac6d097a7ee1bc5ff400524795841f7b_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7470C46B-28BC-43e0-8DB3-16325B30CDD6}.exeC:\Windows\{7470C46B-28BC-43e0-8DB3-16325B30CDD6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD7AE36E-F39A-409d-889C-995F952893FF}.exeC:\Windows\{FD7AE36E-F39A-409d-889C-995F952893FF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED8FCFA4-3D8A-497b-A150-75ED1E83A628}.exeC:\Windows\{ED8FCFA4-3D8A-497b-A150-75ED1E83A628}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{060218E1-E4C3-48a8-9C5B-E3C5D8487F6E}.exeC:\Windows\{060218E1-E4C3-48a8-9C5B-E3C5D8487F6E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61A9008A-D00A-4bc8-8A4C-F0488D3C999A}.exeC:\Windows\{61A9008A-D00A-4bc8-8A4C-F0488D3C999A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96090492-831F-435d-A25F-9251DDCF44DF}.exeC:\Windows\{96090492-831F-435d-A25F-9251DDCF44DF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5965CCB-305B-4dba-A0E1-E08A80EA14EE}.exeC:\Windows\{B5965CCB-305B-4dba-A0E1-E08A80EA14EE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{562CCE46-BF2F-402b-BEAB-555D7A0D8DDF}.exeC:\Windows\{562CCE46-BF2F-402b-BEAB-555D7A0D8DDF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A451C924-A00A-4a06-98F9-2D20B788C50D}.exeC:\Windows\{A451C924-A00A-4a06-98F9-2D20B788C50D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A573ED5B-5FAD-49c1-9DBC-0F1F98A60CB7}.exeC:\Windows\{A573ED5B-5FAD-49c1-9DBC-0F1F98A60CB7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3478381-35EA-4435-88C1-865D4F43335E}.exeC:\Windows\{C3478381-35EA-4435-88C1-865D4F43335E}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FD95BE26-1B83-49f2-8E1E-71779330B210}.exeC:\Windows\{FD95BE26-1B83-49f2-8E1E-71779330B210}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3478~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A573E~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A451C~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{562CC~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5965~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96090~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61A90~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06021~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED8FC~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD7AE~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7470C~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5a9bd703702cdabed09e1731c0f71675a
SHA16c0aa4945657bf1782881a17bf91df88a5f8a2e3
SHA25696160780ce033ecb6924fd2ad86b2dbb651534f4c8b5c8c5f8d29f6307ebf7ba
SHA5122eaf518295b3ad1bd4a764ef457e05584a2aa07124a2329b47b1a199d36e8638b7dc525444b215402d6cc574abd9cc1c49aef81d20656f21eeba7f41c4d59d23
-
Filesize
344KB
MD51595c1d9da11ba3b40840b6ec646748d
SHA1958b3e49e9add98003afb9aeebe7aca949b7b254
SHA2566a413c20b8330fa5414533f71d527ec94ac4dfd0f9ba8afbf61209099e4d5c36
SHA5122acc96ebcfd134e847f284c688ddc8e044de53d137f8ea516570d1663530dd8240d2ac1c537bda79cb96d449719cb28d11d9b4e1fae4b3172ddc7713f6d9848d
-
Filesize
344KB
MD56f5462aa3722e3623a36408d9b373292
SHA156073f1110fe17e2dfbd6f300f6bf618b8595421
SHA2562524928b6d91355952423f46d9c0e21f66b445c6715609fed4ce4c322d6ec9cc
SHA5121e4a8b65e581030de86a72031fdf80b68cdfd59430b5f4972542c899b43b52dfeebd8d477a4c4895922cef2d448a7c1e67a59058973c20a3a894ad14d70dbf3f
-
Filesize
344KB
MD52ae3651ea463fbb2f3bf431fa82daaf5
SHA11c56d35399b6f2c7011f5ca8a6004cbccd14aeb1
SHA256cef77092c004d42f7b2597cf9555c1322df3f35329953c404fff9d70d1641c6a
SHA512800b3d839200d3b3008268186f18192055a98a8db0c5c02f6708d3168095402b93158a792b89c85cb1e7ae2d8a85d833ed7024a56aed1453a5ca9dd4b4c06c2a
-
Filesize
344KB
MD56436a182543bfd4debbf4b3aaf43d2dd
SHA1fb78222d72088b4badab28a7f18920903cff300c
SHA2566ada582cef47845a631d4576dad775090b07247140df41640713d8be2646a7bc
SHA512625ca50ad7d72c1c9ac976dd75b59d25f4b5a1307c261df09d8e9d91df6af8536c9d99b7b9dd55a383c86a37919486794b2f3d3fcc363fc5fc5b450468e42993
-
Filesize
344KB
MD5036147bc3d8af106b55eb6e03806a134
SHA1607203b9f73e23a24461245d6124cd7d33c95260
SHA2560f8e3d7cf0174c0fcb5f7a6adcddf3eaa466174b485cd322908d2062061a38ac
SHA512929881c43a51b568a04198aa85eb9b73267064c4d5388aa1d9f43e99afbcf87448c05e29f6cd0baba438df39a9d9006974ebec3b428e29917e639220ce6db6dc
-
Filesize
344KB
MD59254d26fb98d86ecef63cb581d0d021a
SHA15b427f251c8f3d7036d05a6a5c41893b3bc837c9
SHA2567ea81e95fc02b3effad884f89431c83d163da45063d97e538257424cd5d3917c
SHA5122b1a3d3d5338d10972983969b28957bd3c9d61da4a18158eda19841412f5306c774719c1223be95fccb81b26acccdb04c8a5169051c6a016cbd7508fb1317017
-
Filesize
344KB
MD5c7781969fe976e40b69db0a17ed5cfec
SHA13570d959ee1cfaca3676b88bda09e58f3b478eeb
SHA256b3adeae4529a8f649690ed297eeee6ba1bbf9a49119f1112681711f021cc49b6
SHA5121ef064008575f0e1e5b50697d0e132a81c4395e9127c420ef807df13e48b60e3234c4df2d1f0830a80d3015ae70e6cbbbf431ad28f4a57341532e5e2ec643039
-
Filesize
344KB
MD508b3313a57e905e80ce2c903e78ea5e1
SHA1e174651bd74492589361334033fe2ac6277a60ff
SHA2567eb1ece2612bf84b1ca427ea30919e4076a96703b06882b68fa5f0534bd8e890
SHA512356b0bc051b21b3d58fd1c4d66a965a12c537b8c799518dbbf1f01fe12eca2701d015403b4c9e8eb67e84c1fc0bdef6cd73b5b8b28d0780eb106d69d59102195
-
Filesize
344KB
MD51215458fb54f5d479e773ac70f4092bc
SHA1b00e8515558b45a15ea29d67b39f47062fd6091e
SHA2569cbbd7435eaa741f1574e8d1e999ae08b47d4b5eafb6c8d53cfa24d97ad52dd0
SHA512782b13882ba133a35b7ceeebf5b967e4090a0679d328882df3e1bea0c1db442cb11b6cc065b648aa474370efbb4c76f9ba08393672cce9d21a1654098f1430d2
-
Filesize
344KB
MD51708477f3aff7c8480a6de27aae8e69a
SHA11883a6ec4efb66a14d44868b09efd109dde3b539
SHA256762f6eb98eeb64679f9209c3a7f21fa5476a6ec843d80b4c4fe01f52532d3548
SHA51292dd929f09893fd9253631fe157b94aaa04edff2691fe4ae1e15912473f9f4c444f66f6e46f1765c33132c6fa5673707dbf8f6e1c5e6a534292279d0591414e5
-
Filesize
344KB
MD5a004d142cd3334550c69737948aa9943
SHA1528aa4dde7c24d8936ecba737f04fde6530b790f
SHA2568a22bafeb60173ccc762fd2dae758560911683117d8277e59db75906bdedb578
SHA512506c9a5baff72339ba3505c7d103f02da36231de95ab0576650a058eaa87c4264f3e157154c435b48aa551006446769ae11de88bb32085962087514a2cabfdb4