Overview

overview

8

Static

static

3

2024-01-11...ye.exe

windows7-x64

8

2024-01-11...ye.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 06:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-11_a951890c78c1b918ac584f7f7d69d9d7_goldeneye.exe

  • Size

    372KB

  • MD5

    a951890c78c1b918ac584f7f7d69d9d7

  • SHA1

    b8effafaa3c870cc8ce1ff09d73b5e4ef0249538

  • SHA256

    e7bac3708927be8bfbdcc2bd095a56a0bdd06dd33bdb30f84086655d80dbd43a

  • SHA512

    fa2e7be5bcd2a5e1cdbca530011443360e74ec8149ee8d9850120dd60ce419e0dc32f3fd358f2509fa11ed97a995b1f9d9f31d3a69759db5cffcc3919b631587

  • SSDEEP

    3072:CEGh0osmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG3l/Oe2MUVg3vTeKcAEciTBqr3

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
    persistence
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-11_a951890c78c1b918ac584f7f7d69d9d7_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-11_a951890c78c1b918ac584f7f7d69d9d7_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\{9ABD9887-B620-4262-ACE5-1DD1DDA115B4}.exe
      C:\Windows\{9ABD9887-B620-4262-ACE5-1DD1DDA115B4}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9ABD9~1.EXE > nul
        3⤵
          PID:1104
        • C:\Windows\{0E21C4B1-B877-4042-907B-2B9F426BA51A}.exe
          C:\Windows\{0E21C4B1-B877-4042-907B-2B9F426BA51A}.exe
          3⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2000
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{0E21C~1.EXE > nul
            4⤵
              PID:2060
            • C:\Windows\{16DF24A3-BBE4-46ef-B10A-EA014274BF36}.exe
              C:\Windows\{16DF24A3-BBE4-46ef-B10A-EA014274BF36}.exe
              4⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5092
              • C:\Windows\{D5498296-A777-4ec7-8D70-1607196BEEDC}.exe
                C:\Windows\{D5498296-A777-4ec7-8D70-1607196BEEDC}.exe
                5⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:336
                • C:\Windows\{49AF02B8-8225-4d2d-AB64-8968AF63D91E}.exe
                  C:\Windows\{49AF02B8-8225-4d2d-AB64-8968AF63D91E}.exe
                  6⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3064
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{49AF0~1.EXE > nul
                    7⤵
                      PID:2584
                    • C:\Windows\{B0DED4EB-0531-46e9-B9A1-1F58BF60EC79}.exe
                      C:\Windows\{B0DED4EB-0531-46e9-B9A1-1F58BF60EC79}.exe
                      7⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4640
                      • C:\Windows\{E10C3036-406B-48fc-81D7-0047A40851BE}.exe
                        C:\Windows\{E10C3036-406B-48fc-81D7-0047A40851BE}.exe
                        8⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4300
                        • C:\Windows\{25DF87C7-DA62-473a-9410-C1F0E3F28E97}.exe
                          C:\Windows\{25DF87C7-DA62-473a-9410-C1F0E3F28E97}.exe
                          9⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4356
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{25DF8~1.EXE > nul
                            10⤵
                              PID:3972
                            • C:\Windows\{E4582218-BEA8-489d-8EEF-2B13BFB242B6}.exe
                              C:\Windows\{E4582218-BEA8-489d-8EEF-2B13BFB242B6}.exe
                              10⤵
                              • Modifies Installed Components in the registry
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4956
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{E4582~1.EXE > nul
                                11⤵
                                  PID:3584
                                • C:\Windows\{DF88EBB8-EC29-4078-A398-0ED5A2AD15C6}.exe
                                  C:\Windows\{DF88EBB8-EC29-4078-A398-0ED5A2AD15C6}.exe
                                  11⤵
                                  • Modifies Installed Components in the registry
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:4388
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{DF88E~1.EXE > nul
                                    12⤵
                                      PID:3808
                                    • C:\Windows\{1D0777BA-CAD7-4126-B542-8052BF10B73B}.exe
                                      C:\Windows\{1D0777BA-CAD7-4126-B542-8052BF10B73B}.exe
                                      12⤵
                                      • Executes dropped EXE
                                      PID:684
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{E10C3~1.EXE > nul
                                9⤵
                                  PID:368
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{B0DED~1.EXE > nul
                                8⤵
                                  PID:1992
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{D5498~1.EXE > nul
                              6⤵
                                PID:2408
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{16DF2~1.EXE > nul
                              5⤵
                                PID:4232
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                            PID:3016

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\{9ABD9887-B620-4262-ACE5-1DD1DDA115B4}.exe
                          Filesize

                          8KB

                          MD5

                          a8a0ed6a3d006b9c685416b2901469b8

                          SHA1

                          e38e49ee60f018d59dd150e73fb48bff8cc670b8

                          SHA256

                          97162b1da59d3332ba73ef4c0d1d1831e76b7db4782937b32ab053a209c6e90f

                          SHA512

                          314a17f1cbc41eb70a39548386d7f9bb9e264ba21a55ebd901649c28fe6d354c6df0bff6e9983ec9961d9735574663b902706429601113a04409b30be1c2443d

                          Download Submit