Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06-07-2024 12:27
General
-
Target
2024-07-06_240b9b866b234c381a19d838845e09b4_goldeneye.exe
-
Size
408KB
-
MD5
240b9b866b234c381a19d838845e09b4
-
SHA1
16a8b971fb1e2e77f5531343407a6f38093df330
-
SHA256
eb32eac617c5f6cbcccef40435be6248c8fc0f37bcd88b4a469b2bd0aa950644
-
SHA512
1a133f651c0deb212f4fe363cf988cec3f86cea579adce22a4592b78287b7d79bafd4350dceccb8b60d289853e724003e9b8c8323a12eee1b0a3419b4e19a79e
-
SSDEEP
3072:CEGh0oDl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGVldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_240b9b866b234c381a19d838845e09b4_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_240b9b866b234c381a19d838845e09b4_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB2EFC69-53A5-461f-B42D-BE0ED21299C8}.exeC:\Windows\{EB2EFC69-53A5-461f-B42D-BE0ED21299C8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46916315-4FDD-4f4b-9BC8-6C1EF1237E9C}.exeC:\Windows\{46916315-4FDD-4f4b-9BC8-6C1EF1237E9C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0595E90B-DD1B-47b3-8D39-EBB79986EE5D}.exeC:\Windows\{0595E90B-DD1B-47b3-8D39-EBB79986EE5D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C43C61DE-763D-45eb-8BCF-68F521B1DC22}.exeC:\Windows\{C43C61DE-763D-45eb-8BCF-68F521B1DC22}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F9A39BC-5961-4970-91C5-DD66D73F418F}.exeC:\Windows\{7F9A39BC-5961-4970-91C5-DD66D73F418F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE9CD352-F39E-48f7-811F-BE8D742443E2}.exeC:\Windows\{DE9CD352-F39E-48f7-811F-BE8D742443E2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E83214BA-FA0A-4bfb-BDD6-A46C19C6A1C7}.exeC:\Windows\{E83214BA-FA0A-4bfb-BDD6-A46C19C6A1C7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17C1A81C-4BEA-40d6-AB95-6E3A59001C51}.exeC:\Windows\{17C1A81C-4BEA-40d6-AB95-6E3A59001C51}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB990CBD-6756-486e-8891-332963737ACC}.exeC:\Windows\{AB990CBD-6756-486e-8891-332963737ACC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96749B0C-6B7C-4ac5-8CFC-4CC0853A3598}.exeC:\Windows\{96749B0C-6B7C-4ac5-8CFC-4CC0853A3598}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46E91BB6-B8AA-4350-B92F-0FB83668F8E8}.exeC:\Windows\{46E91BB6-B8AA-4350-B92F-0FB83668F8E8}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0F6B9414-6166-47e2-B5F8-94973E27F3AD}.exeC:\Windows\{0F6B9414-6166-47e2-B5F8-94973E27F3AD}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46E91~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96749~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB990~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17C1A~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8321~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE9CD~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F9A3~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C43C6~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0595E~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46916~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB2EF~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5063551f7b52e8f5305d8e6bcc509175b
SHA1088afe21342caecce37bbc9a3e6bd8ccf18b87a9
SHA256f800b9e140bfae545ed50607daaaf910ba97a1d2e3397167ae683f4e1726c926
SHA512ded5e7572efa4651ddc1bddc8408ccbbf371b8c07f19ce2d1822394ebb40fd5fb5828b9f80ef4ef61a03e1d626b2578c00ed6bc31cab4ffd664f647c6f30457c
-
Filesize
408KB
MD5da39c9c3d2defc21812231560d95764e
SHA11f2b018305ddadcb26ab44156dab96fbe4a68fe8
SHA256cfb0aa6e3ab1382bcc4e1846ad5b1e2ee8ba4b10aa47b15e4a775815ef6c1511
SHA51286f796f09f85771a4606e63254022f5b7439915aaca014fefb1d72a6be4cafaf279c74ecfd552fc7cb32736147226a28f120761c80e46fff00be1750d53fde67
-
Filesize
408KB
MD57aebe203e133283ee8ecbe4460cdfe96
SHA108f5927156d61c298379912a12380758d3273c09
SHA256251661af5467fa1e87dfad1dd078922e600b012c65baff2ffa44b83badb275ca
SHA512bd58a8aa7226a6f2d88424a3813549673c405b07d01876c21fcc2408da2fbab370959ca95961781387e753b623e8642de38a3dabc40952300c141fa8a6a22793
-
Filesize
408KB
MD567de7e582875a70ed8d6c1b20f71e03c
SHA11d42e2551850057fb61eebebc8ea0ef5e8702d04
SHA256abde8f6e4cb2a2ae973cdb4de75c159e76a5768df75f8e109894fd40b26923b7
SHA5125702c765b04006a352c9f7181470463b6c26cb9cf962c2054508efa53d58424675e61ced1aed9d2b7b67ceef82201203739033a619aa54213e8a298dd1fe686a
-
Filesize
408KB
MD5a169f4483fe6a6bb19d3369900bd5101
SHA1ad912c19026d77d4cafd1768b10511ea1861e2e8
SHA256692f958921d6498cd40ee46667cfa2d334c651ca8d535e2d83583b8c1e3cef9c
SHA512a63d4c85248520de69dfcc0178dd0a21cae2ed297c0fdbc9d686415eae9e2e92fdcc4298f03295669c86a0e743f1beb5ee668b28bbb3aa46ed77bb8c562d4498
-
Filesize
408KB
MD55c3d3caec7f7556c09c078da18238417
SHA10eb4a3e091dae9788c0c940e28124848455d408d
SHA256547558497ff61138f39029de994443e50bcd6d946aded55f60d708471e98544b
SHA5128fecbe903a893cae4aacb449d67442297b6ca88e7dc401cd5753f17a46ac62bb25b031bfe86a1fa4da1669ae759b54920425754343bf99d59e363e2f1134c8ce
-
Filesize
408KB
MD5653af080cfb818b4a295595f68fd8b7b
SHA154e1d1126c3807ac8bec4d32fc64edd63d1c4aa2
SHA25626ee9f09c09aa123f00d38146dfd6cb407b9279d67faddc08a47a990c62493d7
SHA512a4af789f473ca3ac655581c0acc267ba8270b52129afe37e5429d1120583223800c37a345a11984ee5bbac92ffca33ce5fbd813f5da4b7cd3c9e6ea17bb36753
-
Filesize
408KB
MD5854d6512ccf1d1468a5b96a1fe7b2799
SHA1c465ec91380ec65314b0f9c467e762e06e7a9894
SHA2567a358a3466be7fe8e84b04a79a2436c5e4a5fb25db805df50a801033f18c9908
SHA512e54fa637b185df6a89f4143c23a220339d921dd6cbab382d1f18452d5fcadb612408bb08c012c91d299d5e76f061f40a62e29c3b978a8b9fda9b7bb0139242a1
-
Filesize
408KB
MD5fa8c5f616923a4a4a0e0ec0746a8688f
SHA16cbbffc3a915c49db2ffd61a39e2fe226a476fc9
SHA256e78465c24ddee18c3062780e8fff0b5ea593c383a45560357dbaa972105a9cdf
SHA51250e1b3fefa4b46c046da94e81f626b631ecdc16ba32f474cfa37ca4caa51e9fe2836ceba256a2674f1bb9e9dbec9a67a1d76b1749518b1f7ea4f496835cdfec9
-
Filesize
408KB
MD5f6bc4d24b586605cc2f4cd414f2ebdf3
SHA1af39f6242670be1fe88c5ceef2b4c554ec473705
SHA2566510fe5a528ff99d8d6e776cd2b116b85d9b9bf5e57550ae8cb092a3d2aa31eb
SHA5123f231b8877896569b09146d0fc04d63927643158745236c86de3c076a828a6c210abcf9cfa6e0ef21df4a713f15444d0f510b25ab522c15245c24f97f75001dd
-
Filesize
408KB
MD5a76d549ecea0df1e9eb7442b889f0f71
SHA11ed0ffd04f727ac05ce2ee7e0bbc87016311d70f
SHA25606a0137f87e22ad929fbf9eed595226d8f389fb3de36c2c4c49a0dad484380f9
SHA5126ebb72bfb8a932dfebf7339e3674b400581590d9c68974966f323d340cb9285d33ca4c0729810fd7e66ced1266ff554550fa0dc09a46d4da929fc25e4ace3bce
-
Filesize
408KB
MD5ade13ee5c5c8256ceef7094212970494
SHA1610e69ed566662b19c3c358a127f1093e61ad4a8
SHA256e1aae7970d7dae78b45af74333ccac35b0b0aae988386506aa6c51c79f009634
SHA5128001c23c86acb7d337ce4cb3c28b9ca3294fbec8cbff990d6fdde07b2402571d360b4a26efe1b2c92052fb034f60175d0a4826dab66ad276e13cc61e6417a6f9