Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25-01-2024 17:30
General
-
Target
2024-01-25_780d9a0366a953f6b74dd4bf20da23dd_goldeneye.exe
-
Size
180KB
-
MD5
780d9a0366a953f6b74dd4bf20da23dd
-
SHA1
88f263a7d696826dbc147af8cff02fa1ae2a8ebd
-
SHA256
a4b5a5eb9a43ca8ef3f64d5f4c6722d14107628125b90ccc83bc850a4f1472eb
-
SHA512
2cfc16a835645d70b9b1b3cca7c50b9539aa6ecdc9b009c2846ccd6dac05336cbf93bfe9718977147f9f17355ea5efdd80625709f2a8ed2048b1ca56f76a45f1
-
SSDEEP
3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGtl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_780d9a0366a953f6b74dd4bf20da23dd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_780d9a0366a953f6b74dd4bf20da23dd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8555D3B8-6D80-471f-82E2-0F429336AC52}.exeC:\Windows\{8555D3B8-6D80-471f-82E2-0F429336AC52}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDE0FA0A-7773-402a-88B1-833929E3712C}.exeC:\Windows\{BDE0FA0A-7773-402a-88B1-833929E3712C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59E50EE4-F048-4555-87CC-67AFE6161444}.exeC:\Windows\{59E50EE4-F048-4555-87CC-67AFE6161444}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49ED9821-F821-48b5-88C1-9B69C6378243}.exeC:\Windows\{49ED9821-F821-48b5-88C1-9B69C6378243}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49ED9~1.EXE > nul6⤵
-
C:\Windows\{B00B9435-BC16-40e6-B1E0-36632890259A}.exeC:\Windows\{B00B9435-BC16-40e6-B1E0-36632890259A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B00B9~1.EXE > nul7⤵
-
C:\Windows\{33C9267C-483E-4e57-9CDF-6046159D7699}.exeC:\Windows\{33C9267C-483E-4e57-9CDF-6046159D7699}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDB6575C-3CAE-44b7-B671-E2A5A7B222B5}.exeC:\Windows\{FDB6575C-3CAE-44b7-B671-E2A5A7B222B5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16BDF902-3761-49c7-B6C8-CD481040F418}.exeC:\Windows\{16BDF902-3761-49c7-B6C8-CD481040F418}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D8AE4954-57C2-4a7e-8FD3-D1F9ADCF04F8}.exeC:\Windows\{D8AE4954-57C2-4a7e-8FD3-D1F9ADCF04F8}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8AE4~1.EXE > nul11⤵
-
C:\Windows\{367D10D1-AB3C-4324-A4E9-6A4D53CA531C}.exeC:\Windows\{367D10D1-AB3C-4324-A4E9-6A4D53CA531C}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{97B3E0F2-B147-43cd-8E96-AF55B08EB98D}.exeC:\Windows\{97B3E0F2-B147-43cd-8E96-AF55B08EB98D}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{367D1~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16BDF~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDB65~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33C92~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59E50~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDE0F~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8555D~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5c1efefab4048493a2387c34c87c1c6ca
SHA1e7e1793b05d20295d78422f817651539acdf5d40
SHA2565176e1ab856d3c934e8b9e5b584a4dca20c441f6fbbd767120450a707c5bc5bf
SHA5127d9ee874b65ebcc318471fa61546b4cbc81aead072ab04ff7c067dce00ac9626980d591501d02010a5a63886e1fbc372e3491805e7df0d805821999e2ad3859f
-
Filesize
180KB
MD5f147a63a026b565093c7ab305d15d277
SHA1414b300da432f2084c81f181ef451d2eb7ca2b65
SHA256cef9465d156af4458d361cc3eab472d3e1e4f15b6c9b8e5da9bf1130abbe7f24
SHA512562cd448d2a88c429e525d01588cb0e5df6c1a91f36423f34aa99359ce596e6506ec71b51bff204acf69b0d393f4cfa773cb7ee440021e251a4b1fc613c264ea
-
Filesize
180KB
MD52f86ab87b479314e3497862d7afedc89
SHA1b3f80b6b88ff46e26ad26e1786b27a6a1525e4cb
SHA25688d3066761aac54756b0c76399a502018d9b648fdd26d4b942251ae35f056b18
SHA512f93747e1ee7006437db116420e28a154df9fdefc7c4f67b8870d89f6b76ab74ff4cf25d8032a5242f6441bddb3670b05aa8ab00c37b660f28a5df860ebd31965
-
Filesize
45KB
MD519a0d4271c61062625a22f8b588b145a
SHA1ba195e1ffbefcfb504689b05160de526a537014c
SHA2561aa1ae204f9a6fea4a1a64e06f845cfb68a9226db9473838e1be571c7ece6454
SHA51252444594b7db3a336dfef4d29f761c35dcd517a4f17cc11ade626a4c588c2ccce1ea8d12946d44ec5ee7b243a09028833f8f8c8a370ed5327c9fc8714ed3e7b4
-
Filesize
180KB
MD580dbc9b60e60b610390553f66e8149bd
SHA1419c60bc9ac3eeb712f9eacb4815471d703bb269
SHA256b4811e3759f1d87447347e5cc3106536a28f2f4420c081ab353a9a03b3e9e491
SHA512fcdf3b01a8e03e14c95b44a35ee470bc824b2286cdb961f087b4360dccba2ca718450e9e2a0c3cddd247fffa1ee62585117da7ee569740c314ae0ee058d09d60
-
Filesize
180KB
MD547cc898fcb72ee9d846eb1d89283338e
SHA1f786fe0d9eb16a34ba478a17f54dcf577f1e4ce8
SHA2567159c151b93f232d5a3ca20e84729e6a0b50c93e2e70f15f31b7c5fdf8a10608
SHA5125810502b3956adbe66271c4c4a091f3f74529120544d069840783e06adfa4b34434182a3a3b38bf0262a6108db05b297d92aa833f3a634a8130d8718e438cef7
-
Filesize
100KB
MD598f8e3e78478eca174c591035c532adb
SHA11b3a7413d5864197dce2a8299de5648d193e3e40
SHA2561cc4a88062cf51ecc770e0244d3c2ac24be38f2eae6ab72a2d3df1a03c6b8130
SHA512fa5ebcb2b49853e553c1980ceef85cf2a87deb830fdf18c74fc15d5109e0ddfae059ce13faeb60e5beacdcfd1521fe40ac64a6ec19195f8ba1a766dbebb21b2f
-
Filesize
180KB
MD5cec3a3f2aa08261f7f479018971d701a
SHA167b5a05486ab453d2d0f2f63170d947c36429d30
SHA2569956989ffbdc0fed6b50785f84e9dd30dd07c8976f60878a715451d44829dd6e
SHA512f148cfec5219ff23a9a827841a4f1e0c2de9d418a3542d74c69d3289ff12f0120e8cc1f9a2538358d77547984b7cb943b59543b28adb29e73ee2ab81fb79dee7
-
Filesize
180KB
MD5e03402487ca34334e549fbce6e50fd32
SHA1ae291fac50394d1c39c2b64d19484168aa81f4b2
SHA256716edfc4ddec644515cafec30657e79197932dc3e9ae4f101dc8995e7d0a69bd
SHA512b3ae49dbe8b8001d6f08affa63fe8c960e8e096c8a993bc436e20d09e1a894a2dd29548b7dcc491cfe99dfa69db7b567db999e8eda61e56094a6a405cacae3f5
-
Filesize
180KB
MD50e391ba6e78c85aca9cfbc0f323f9b85
SHA158dbafe564cd99ca20ebf15eab8349649fa895e4
SHA256abccd80f665a4bad422e7c48b4f0a40c6761132032828b8cabd2cf44877a883a
SHA5126e79476893a5be7b3e0dc50ca4500622abe23ff6fea9517584321fb2c0047407cd352f8d70d977dd6df2d46eec5db8643b4d05ed0c906b6c9aa43995162839be
-
Filesize
180KB
MD536fcd91becc907b83e571ea79ba60855
SHA19811cc25f0763da68aa5f88ee6f9ab680b0601db
SHA25617533af99c03bb4707c41e615e5649a2b3834a5c27ff63a8158e4579034b04ce
SHA5123d512709d5eb25f22904472208beb9fba5df69e2bfd14d8328bcd8602faece7fa067619b927e36a044d0aa61a0fe5d5bcc12b8c5ba2eab4b24a62a55dfcc4037
-
Filesize
180KB
MD5dd745d5f5b36d3259ba68c0f7ac81ad2
SHA15afd7b3b7871168e0f44cf4e8fd77c392b50b6f2
SHA256d5c76c331986e1bd8fb65d246a32c39c733b342c8cee5f9462020f07fb001103
SHA512106214a720279fc44e91780f205b36dd518da4c37b0068c3b0b692b7f9e89822ee351f845438dc2bc619a34107a313f82a16b6b9ee7cec2d47b98bb38a17adb6
-
Filesize
180KB
MD5ef63be2eb04d48c6ddbfeb288a6a9131
SHA111906fb20441b7b57450bf3739e06ab4cc94d2ec
SHA256e243e4af952b6724e01d20464d6aee96280d3ffc7dbc982a9680efef4d3127d6
SHA5122408f3037780e984d53b40425881a93c4c9288825edd513e496dcd82c29d7c1b8026d0bc33eb0f4c7f59773c31b8194f296bc40ea19062c981963f1c0203b36e