Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10-07-2024 10:35
General
-
Target
2024-07-10_90e54695531eba5215c967820591dc9a_goldeneye.exe
-
Size
380KB
-
MD5
90e54695531eba5215c967820591dc9a
-
SHA1
1c94d8640f8eaa6b79b272d0ac2036c59638f7c7
-
SHA256
b6df3313da36f5b1e8a8e416d19a6bee860e0085e75d7ed08fdeb0e8adca210d
-
SHA512
8deb9af8495d8d04a06a361e9c3a7c49dcc7d17a4338340d8e0465bb25e60432faccd2cddbbd6f764e84998b9104cfc48ec3632b77900f665efc1609843b7e32
-
SSDEEP
3072:mEGh0owlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG2l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_90e54695531eba5215c967820591dc9a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_90e54695531eba5215c967820591dc9a_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1976D2C5-AE3A-4d05-832B-1D142AF6CB34}.exeC:\Windows\{1976D2C5-AE3A-4d05-832B-1D142AF6CB34}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{140E9D5B-8684-4229-9042-BB140EC61B67}.exeC:\Windows\{140E9D5B-8684-4229-9042-BB140EC61B67}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38E74C3F-295F-4be3-887C-89B102C8F8BA}.exeC:\Windows\{38E74C3F-295F-4be3-887C-89B102C8F8BA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA1AC04E-95BF-4189-BD5E-D0277B23BD7B}.exeC:\Windows\{AA1AC04E-95BF-4189-BD5E-D0277B23BD7B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7009FA6C-FADC-48b3-8F55-BAF4B871D3D2}.exeC:\Windows\{7009FA6C-FADC-48b3-8F55-BAF4B871D3D2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB69939F-E78F-460e-891F-5D8E766A5666}.exeC:\Windows\{BB69939F-E78F-460e-891F-5D8E766A5666}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED2326FB-2B4B-4ed0-8D15-68F852531A11}.exeC:\Windows\{ED2326FB-2B4B-4ed0-8D15-68F852531A11}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{155DB1AB-3675-465f-87CB-FAEE8B56E8F6}.exeC:\Windows\{155DB1AB-3675-465f-87CB-FAEE8B56E8F6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81F86CA0-CD65-4a71-8B60-7928B199D337}.exeC:\Windows\{81F86CA0-CD65-4a71-8B60-7928B199D337}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20382950-B539-4657-BCAB-1A0D1222CFFD}.exeC:\Windows\{20382950-B539-4657-BCAB-1A0D1222CFFD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DF71063-D9B4-4aec-9475-FC1F6C8768A1}.exeC:\Windows\{1DF71063-D9B4-4aec-9475-FC1F6C8768A1}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A1CE01FA-5AA2-47c0-AB65-FA3B31CE9F53}.exeC:\Windows\{A1CE01FA-5AA2-47c0-AB65-FA3B31CE9F53}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DF71~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20382~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81F86~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{155DB~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED232~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB699~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7009F~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA1AC~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38E74~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{140E9~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1976D~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5e9fbd9e232c42e77a811a85ad680f35b
SHA148c36b1f9b377de31219f8a9ab14100c2bbf104d
SHA25648a19ea987c48b386cbd2dbb8209c49323bd0c8bfe12ed7fb25058db8dc1c4c5
SHA512c54263a2b99d68a34451b991b454f7a9d43786b39a612a01b5cce065f1916f41d208b6b2a293e0a27df6cdc821a77470d1a1177a5483293ea428731639817c2c
-
Filesize
380KB
MD5477f3e128255be0b6aef33aaef65a2eb
SHA13a1d5ba1aa197b5b2f5732c3dcf8fa00c055df51
SHA25673c2a9c53112de60cc9ba91fd5d6652708af6f0beeedebedbc64680676b51d07
SHA5126b2cecfb454243a4f91382388056bacdde4c6c08b36f54b0abcc7eb64807876e91a3236a4756579730aff1c90dbe300f8e7dbc245f9f38a519794d5245c89cee
-
Filesize
380KB
MD548e8a8c5fc5e148997a95fb565bdcab4
SHA1d6debd74d2b150e1ffd9c4ecbf6caa382244d2fb
SHA25632ef1ba274ccfb195ccfcbcd1c8a71f35a84f27b8d373340b292eddbe0f4f3c8
SHA5128b8f053c4cc6f475ced2655689cb42acb9d7641d4d25084adf76365c68d2b26cf73033d181f1fb42ab375744da62a49e35cc288cda9edc4121f2f9355f81890e
-
Filesize
380KB
MD5225a69186c99f861155bacbc13ec3045
SHA10f1142b5d7db5e5a75a34718b034446d5929e8a0
SHA2566c80fd69910d79dfa627dba8f59c6ec9cdf6dd171c991b88e257bde6c048df3a
SHA5128e80b73124f18cc547f632009770c52f30fbeb535fcbc5f796727b79203065a6615b2a62658d7dd3f1a1188436bd1cb7d482987e7f15223d63dcdf7df1dc145e
-
Filesize
380KB
MD59fe6c6cd13ea59b23978efde65778e08
SHA1a2d7f2a213add381b991e00b1ee305e9091876ec
SHA2565c87d4c380786dd79342c9c6ab4b1be801898f8592fd5e07e82672502cfb5a7b
SHA51267ddf08b445c2ffec1f6ba7533ac0b378e1a04c48928efc657ab56fa7ea3612c672ffa6bdd9f94ac8bec6eb7bac4a2dcbfe968e08e7c293e72883be2b75e5399
-
Filesize
380KB
MD557e0e8ec3bae256b120ad8e96681e44d
SHA170de7ed970992c4a7bf6da36fc5827d813654507
SHA25612eb9340c431f9a70f352cc7ed6a02686d8f6cd8f547b10f078d8813b283136d
SHA512f5f9d104b0290342e1a8cfec3b951a7d5ded604cee3e760375b56663893593560300aa8f4c14c56db3f42959cc355a8da88fabb09136dfb441cf0f1a9a9fefa4
-
Filesize
380KB
MD5be7df93ca4b16d40fe8444eb1a0c2a3d
SHA14cee48a92e78942cba5e45b103d0fa9c49b7e233
SHA256cced4ed1be80fab05b7cf95703931f7abdc81a1cc0f2a7e4f00030f3c04d953a
SHA5127745632cdd31bb49a785f2df4c061748e68f49c578c4e8ec0ed938879435948ad8dba3f406a2b8a346599df6d649d13f0b6b4d37bb9c19daf403d85ec5928e28
-
Filesize
380KB
MD563d0d41d77e5d446dfeca23f7b426ee9
SHA1519c769e5dcc355ab136786fd0379f5129f0b3ab
SHA2566cee06f0f5326da56fdcbb63336e75f8ef4c0e824077d125b1239b7a36293524
SHA5125e86046c15d9a36c281e172984f53b36c25d5e913769a37a8434d4e5abb47c35adfa19e785371b3900cf392d8fd92e217b55401f3658cbbae0c5da7c3cdb25a2
-
Filesize
380KB
MD566f4a1680dcba78933da5f2ed26bd5e5
SHA16788bc419b059e6dbdf756c56f7746c2fb29d0ae
SHA25600d1ab56e9fa5bc2605e95c18ed06d4c4d4bb2ae4c8abcc373e3f42801f7195f
SHA512eb414a794aba409b4e83570d378d3dc1eca48e67400dfac07827b8031031e75a4fc50ad9dcd7c5dc572ab9041d749af1c49a7237d7dff9488012acbe1ec9f8ea
-
Filesize
380KB
MD5c15b8d3b00ad44df7f2063c0561addeb
SHA1fa6564890923ffc9a208bd7c74c2f41a750a3136
SHA2560411ac5e6da93eb999ba71180306f0ad8d420b3364e0da2de2505df99f5f87a3
SHA512d60be92e98b205e7bfe481202a782dc5a9e25a84726ae61f7627bcea89e43ff182e2ae1d123be74711695cee94e313b0a32cd008a48563073ed644a7f1b887d3
-
Filesize
380KB
MD5ce361fbbe5de072c6f168dd6e243d6c1
SHA1ef55d542c6d04c2a858bf590aec09bd74edbf07d
SHA256f2d877f6a1818051626b2b19d12dcd5db9a8df29211f921b3587e9bb46a2fdd2
SHA512c7411008b0aa679012d786900202915163d8226b3a152d6c99216935d3361ed5efec604b0ba2cd289c1118a2a1d70e89d5ac719d95b351050971349470138ed8
-
Filesize
380KB
MD5683ffdc743185b555b22faa4cbbb049a
SHA1cb72f0e341ca80a54468b4e00b36c486a6d8bb6f
SHA256a0201364ca79eac7c68febe5ddee4e0ef7da4f3cf5ecaae4d64914b31e310f8c
SHA5128034806fa468c18aebd9c33ae6faad47ec5ba395c856a707ede462a0c97e3cd2422d5fb95e59d3cd5017a2096be1415ef11d774a6c87a9af7cf0c0d14dcc58ef