Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:31
General
-
Target
2024-01-25_82a2b4cd281ab7846611643e00925108_goldeneye.exe
-
Size
168KB
-
MD5
82a2b4cd281ab7846611643e00925108
-
SHA1
ab2bef54ffba61ef123055730d5f9cac7c1b2138
-
SHA256
7cbc4d6e0c01be66e067f901ea31c8fdd072721971f9ff6d020e4cacbd8e2e54
-
SHA512
12f31160b0379c695c8eebd94b95717879a2cadecee8454a67d1b0269d671f8f758aa7ad7e329591761f8039f8ab2d407f87015d100c229d6b8b5d6e0aefd887
-
SSDEEP
1536:1EGh0o7lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7lqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_82a2b4cd281ab7846611643e00925108_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_82a2b4cd281ab7846611643e00925108_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4614E0D-69AF-4aa6-BD27-2BE4B3458695}.exeC:\Windows\{B4614E0D-69AF-4aa6-BD27-2BE4B3458695}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16FC00C2-2DF0-42d5-AC93-D8757E2CF4CF}.exeC:\Windows\{16FC00C2-2DF0-42d5-AC93-D8757E2CF4CF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16FC0~1.EXE > nul4⤵
-
C:\Windows\{3EE154F5-4B5F-4714-B070-BE394A1ECEFD}.exeC:\Windows\{3EE154F5-4B5F-4714-B070-BE394A1ECEFD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AC03C27-27CC-4916-B343-2F4AC224F458}.exeC:\Windows\{0AC03C27-27CC-4916-B343-2F4AC224F458}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FBEDC4E-65DD-4972-A3BB-0621AEEA411E}.exeC:\Windows\{0FBEDC4E-65DD-4972-A3BB-0621AEEA411E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FBED~1.EXE > nul7⤵
-
C:\Windows\{71E27B70-1D31-4c42-BF59-0E162E2AD381}.exeC:\Windows\{71E27B70-1D31-4c42-BF59-0E162E2AD381}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71E27~1.EXE > nul8⤵
-
C:\Windows\{23DB05D2-F26D-488f-A57B-3823E9D8D86A}.exeC:\Windows\{23DB05D2-F26D-488f-A57B-3823E9D8D86A}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19E08744-2D2E-4239-8953-DABFEF785620}.exeC:\Windows\{19E08744-2D2E-4239-8953-DABFEF785620}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5C873FFA-552F-4c86-9FF5-F596D7AFF3B3}.exeC:\Windows\{5C873FFA-552F-4c86-9FF5-F596D7AFF3B3}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DBE66E56-31B5-4f2d-BB1F-1033D04F3F5F}.exeC:\Windows\{DBE66E56-31B5-4f2d-BB1F-1033D04F3F5F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C43D41A5-38AF-4bca-ACEC-0C3E761E66AD}.exeC:\Windows\{C43D41A5-38AF-4bca-ACEC-0C3E761E66AD}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBE66~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C873~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19E08~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23DB0~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AC03~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EE15~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4614~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5cacadb5beead67697a4be3e4c49989dd
SHA10b3238dbf2a46fd1e7f7440ea6f5415d66f10c65
SHA2564e33a1ad56df8dee7363ad726ec61713048fc5b9b7a5b62e177dd67a2c1f69c3
SHA51235c3373336167046ec0c59f2bb9577531827fa224dc2cb83a1e60d3515c75032f1ef5a4f655f91996f92072b8477021c99cdefcc422e2163a6ee951dfb7aa3c2
-
Filesize
168KB
MD5fe8fc635b6ec2cf27fda3217c652cb53
SHA1283ef87ed4c81b6b13d205787cac0170789310b3
SHA256f0facdf16413cc095f5c0f5e01d6493ed3e3f9d152c5de8ec7213e47b28a9d47
SHA512c119e867484fda0cd7b3614c6ac755ee745d52cb234e71530fecda6030140cecc4d43d66935805f9ccae8ae8718aa15288f1835bac333e18859a061b179a8825
-
Filesize
168KB
MD518fcc94e776b63fd19a2adc7abce5d7b
SHA118354da0850abc62b1c298197ad337878dfa3078
SHA2565b1c6c3d58f65467db09ddff8289813346f56fe259d78c94cbe2e4f32b9de5ef
SHA51275c6273d56dc618fa7923f738adff7c7619f45206cf53d93b4d998d197b1abfb1786f6608ae5491398c4df7bb0bb64aadcf523e292558f666c3a79d9283596e6
-
Filesize
168KB
MD5f78165ea49828b15f056ed764984cd81
SHA1feeb3a7213344219b65a0e65498a4ca36d9a4579
SHA25655e5567f0aa17a79f703c389c28d11589344e25758dd2f2205832d749d0db5f7
SHA5126f3e61ed61571aea43c758307562df141b140202e29ef6d9ad2f0def4ae501a54e20f645a6eda3b33febed5e0e84de922bcd94a1633e9e3d3aa347680adc33de
-
Filesize
168KB
MD5129cee2900c1c6dac514e5616fe4b89c
SHA152c8ee9712a37ec65a74d8735691a41aa0380988
SHA2568f994f91206d7c2cf1d6ad1972c2a031debce15f936f51c3efe27baae6c01dfc
SHA5124757d8872068451e6ac4126fed3a1295229c8201886b59404b90b863544abeb51503d090fa8e83549cd05452c6410bf2a7932e36d890f46b36823acd7bd641b5
-
Filesize
168KB
MD59db47a191c0a465c039a444678a8bc61
SHA1cf369708cc42f8c177a7d055cccdb7614fe087e9
SHA25646977a5b92aee18f63590f3b2c6c2857b3ae990bce1d602a31ebe89d77f634ed
SHA512d6c3b4cd4809535acbe3479f0fe491eb498041d87f9e235900e3aec9b1798af5228cf986a1e1e2b4e49c7edd35cd05ebed775b26f7a2df0773f879d357902ec8
-
Filesize
168KB
MD580442e84d4a2585adb951a2e4e4bf054
SHA1efc27472de185f7a52087460139ec4b57733988e
SHA256135b9d7254e7d72b15633dce74ddaf67b26f46835ee177adf1bdfd221861febd
SHA512155f6f55ba5e62f3effce159191d8404eb67fd8393ab8ced89b1f7c156d8ccd2e11cc9d7ebb31a9e39430c44d10d01911974075f219c39077631c684d71b1ef9
-
Filesize
168KB
MD5892ecfb5909f6162a7a1c655fa96b62a
SHA19cb8be32fe84af119f5f14c19f1bf0e92ac7110d
SHA256481a380a3ccacd070b3ab749551ea18a9f9b5794e6a2c1e0cd3aba1261ce28e8
SHA5120a66c2b560542068e71e0cb832d309a869642f0bc6d97a3e6abdede5c9825bab92a5901ee2630cebb3befb6c29037893d4a6c2a1105bb96bb86440ceffcf46a3
-
Filesize
168KB
MD519f9c90d637b2d6bdc733ceda4b8f60c
SHA11b8e03776b79209b8c84138192e766510376d8a9
SHA2566ec62ebce90b497f02ec64178822e4f5d6e3549b364e47eafbe07b118040a2e5
SHA512d56ae1c95b613991aa1ed5286f77b4731c9d5ab55705cffdb6ef2424a6ff08019dd37fa8c5dfdce8cae676b271690aa50eda5644f7be2d0b9d6074678e1038dd
-
Filesize
168KB
MD591e95812beaa2ae0234641d91afc62a1
SHA19400fdbcbe06656841fe572d212022d183fe6f59
SHA256e3a08858f47f4cfb0d10425745ac70098bed9100911f3c413332125184e308ce
SHA512f19e39225210f974bcb59faa3e71ba901237038f9412c096a5e4628b92934103a0bdad922014ed4a0056e68c07a0cbdefc6b4988353d7a9e498b280da62b6ec6
-
Filesize
168KB
MD5159af159816c1f151c9b377302c5f000
SHA1ef64640a34d7ca48089b033aab96db8a78fba380
SHA2569853f47603eefad6dcce978efeb1182070a280e9e70b84413f3fa19b82f00dd5
SHA512e62bd2ce9002bd5ac4bec50e9d8bd4db70f8541d0f490420b334320cd26c30750dbf5c629f88b6eb53b5ca29f745c61387223284a8ba4ce92f89d7c784ecb883