Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06/07/2024, 06:21
General
-
Target
2024-07-06_7a7b1c5b219538dcc2561feee8b58d96_goldeneye.exe
-
Size
192KB
-
MD5
7a7b1c5b219538dcc2561feee8b58d96
-
SHA1
43317d85521fe9fa1c30fe175090e101d99b3b60
-
SHA256
6973f1fe8f83b2053e3a8ed244f19f7d0e66ed2822db4ba4f92b287264167ade
-
SHA512
ef2869187af30bf64a7d3c51a07bf48bc2e2382947109b9581cb5744dd29a78723c6869f50b806d2b38b639d72c6b440c7648f24597717dfdbf26d8b7ecd064b
-
SSDEEP
1536:1EGh0oEl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oEl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_7a7b1c5b219538dcc2561feee8b58d96_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_7a7b1c5b219538dcc2561feee8b58d96_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C70E9E7-8592-4a18-8B04-7934B1304EF0}.exeC:\Windows\{7C70E9E7-8592-4a18-8B04-7934B1304EF0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56DE8216-0378-42a9-B6ED-5685B7401012}.exeC:\Windows\{56DE8216-0378-42a9-B6ED-5685B7401012}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61C47753-53E1-4d8d-8759-4890D2142B11}.exeC:\Windows\{61C47753-53E1-4d8d-8759-4890D2142B11}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCE7A59C-DC36-4929-BF43-3454A0334D69}.exeC:\Windows\{DCE7A59C-DC36-4929-BF43-3454A0334D69}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C1585C5-4D1F-44d4-BB6C-420ED6BD3D93}.exeC:\Windows\{9C1585C5-4D1F-44d4-BB6C-420ED6BD3D93}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF0F3030-72FC-4800-B77C-7A026A6D970B}.exeC:\Windows\{CF0F3030-72FC-4800-B77C-7A026A6D970B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6911651-4E6A-4df3-BCB0-2D77317A9B71}.exeC:\Windows\{E6911651-4E6A-4df3-BCB0-2D77317A9B71}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A46BF95-58CC-41b7-BE9E-04D340E5DC03}.exeC:\Windows\{4A46BF95-58CC-41b7-BE9E-04D340E5DC03}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD499852-071E-4d34-A119-4906D1B8682C}.exeC:\Windows\{BD499852-071E-4d34-A119-4906D1B8682C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{521730E6-AC64-4e32-B467-11654710B901}.exeC:\Windows\{521730E6-AC64-4e32-B467-11654710B901}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C49F524-6F1A-4547-8431-B06D0390B5DD}.exeC:\Windows\{3C49F524-6F1A-4547-8431-B06D0390B5DD}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D7F5BAE9-1E44-462d-8306-A91FDFA63FC4}.exeC:\Windows\{D7F5BAE9-1E44-462d-8306-A91FDFA63FC4}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C49F~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52173~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD499~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A46B~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6911~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF0F3~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C158~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCE7A~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61C47~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56DE8~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C70E~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD559ba0751d1f46d4eb9be3c6382f5dd9e
SHA112008204f13e376ddae5bd681a95bbfb1a0561f7
SHA2561c4de9502be87dae14986721df13aa7e26a7fcb4e3c6a12caabdbb21a3c4e5f1
SHA512675a6a31e9ca7bf8194e6a46a672091a6d160466630087cb9bb48681c7b092222376ca0cbfb7d03273fcf02ab1ed4343f9b57423761db6a67af71e5c89e669db
-
Filesize
192KB
MD500196136032ce828b5bd231f582e18b3
SHA176bb426ea1d8b57aab6f64d95aec787612326ca0
SHA256f2eac0a5ae72be7f9fbba452153dc05865b5bb5f4c18c2a0405a4c04a1e20412
SHA512b02f52a0b5354ce838edfc3bd7f40f4e950cfd9fa5dcbf42cd5810292f6f13c8d30f43db9d9e040a3128c5f20e682c2c264d742323910fd2dfa11f7351d6ef75
-
Filesize
192KB
MD55546dd4bbbb40401b4965c64e79982c0
SHA1ecf751adba49fa363e9720f5e896de3102e728c6
SHA25673b56d7c2f35f0c0dc31303ac4e09e09e78c88850f12afbdf9b87e72003ef2bb
SHA512dc1a754a15bb7a0695d92078dfafc69d6b2556ca1ae7e9509008babc53c61e5bdfb18743ca7ce31f7bb8452be644773802b23b3e531814e6176cd3ee753850ee
-
Filesize
192KB
MD579094d7568a234dce4054dde9dca2151
SHA15014d60fca3120fdc7d794714bdf7fa8a431a119
SHA256aa8bebd33d51e58cb9fc2749fe6f0707d5d57928162f5e21dafacf7802deb83d
SHA512c039ea6ce17dca14c7ceae6cdef6eb9a214c45fdbfaac5fb7340eafdc8be0b945717162c802a0355775d5be2a5db8f3e92570a34b8c2b6db578ec9bb72c9c4f0
-
Filesize
192KB
MD5e87ff2025730ecf31ce8f62cdf0f4c70
SHA1ab70ac2eca51f9bf337748f911fa39a62870ee51
SHA256329eaecaf284e9be07fdad827e6eacbad8d2ec1c1c90466cfe4e375cac1b561c
SHA5123bd1fb280f22dfa3045ee01cc9574ff5e547b6385d1ae8bb8f87f45923067ad23c4d7876abc15b5a07715f38b5acb719849af51553866f794c1dff2708b940e9
-
Filesize
192KB
MD58a467ed54b5ec7594e6f47abc02e7207
SHA123344fcd830a7c3751572c3cc7e47223802bf45e
SHA256d98fd72ab66621dc14a7fde7893501de1cfb1e3f89c5ea21623d0af538b02719
SHA512f333a7f3237bbbc6c1597c2ed5dffe5e9bcb1eb56001c67620c195e496fc8cafa0f35b829710113869f84794875d011d53755bd1024247a124147c76613a9f11
-
Filesize
192KB
MD56c108360d3c27fdc1ae7c3779d56ad60
SHA15a41df2ff377d8812863204f4e6e458c81cb5d24
SHA25687737607834e9715c30843dbdf738d6b5cdda72826f068a6e68c4cf2753f2beb
SHA512a5933247f905e0e3d4850cef85e12b6f92889e64b677f6b9d360ba209d416ddc0dc697f31330d80819750c34325810517d5724d46b224616fd0df4ee9affbec7
-
Filesize
192KB
MD562c4dda0131bf96404d67799edae7590
SHA1182156c2d2bfc0787c1e22b59b80f67b003e611a
SHA25681047a5c46d8d87e373a4050b8ad9911dad366f865cafd26b30fc4aee4b3e5ce
SHA51213ff4297f8bdbdb6bf3ae43f2f819141f3703532215a2f335853c278e5af68080c7fcdcde5b02e43d246fd87fdfc20c6312ff010cdcb0f48cd46e2a5e5800840
-
Filesize
192KB
MD5697889a216afb410f54b0cc3ac19ac0b
SHA1691c63d85e3ecd121a2325d69249607c3793f267
SHA2564f06e3352e103fe26d851ee7fbd9512047975527342c69792f27361cd8bcecb5
SHA512a0022966f35a28cf5ce2baa2242230127db5a59cabb32d9e4d694333846bf7c5dbd3db5d26471f56e766fb83af7f169b5899b4b5c369e0272cfc244d92873245
-
Filesize
192KB
MD55fa855a92e4732ead0e0690f892a6365
SHA1e624da779bce877575118d03681a9e631bbe8eb7
SHA2568798dbf19d6c0b972edef39185b074fcfdfb4aba9db990968c5237177536062f
SHA512267b4ad3f3225d7944e5b969ddbd7c6f12fda50aaf4c027572182fbd87bd1767572eb1b8c8c7bea44a8a0b18903c57d4cf685f1d29f1e962a833c250bb2867bf
-
Filesize
192KB
MD5dc6f01c87816736625057afbec3d481b
SHA17da26d333c19d0c96d6f0e3ffa1be680642261aa
SHA2569a6e46bb1435f86c9c1202a157caa745a3e20f04308cea60e60911ebdca1e0a1
SHA5123797e407e6760d9faad5f3026e314d608331c28b1c51564872e76160913ec8e662f4225ed9bcb68427fce8685d2fc7c140c264ade8b7c94acba180b797129257
-
Filesize
192KB
MD584d155579f764a0b4da0a6f8d4353317
SHA1a7f74452543c5ec7cc4f66904d2033f6e7044fca
SHA256be14c07d755a92dcba8a5927ccaa15ac42d662aa5f1a2bb972582bbb7a34a0b4
SHA512229cfee028f0f9b91ed15bf81f6157cab0c8ce72c62cf89d6337b157c66ec64c80453f93cc5a04ab8a971dde26e78502ef67ddbf2440fdef9c0efe93ca36ae38