Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:31
General
-
Target
2024-01-25_7c7b3edf03d7bfafbdd998980609e48a_goldeneye.exe
-
Size
216KB
-
MD5
7c7b3edf03d7bfafbdd998980609e48a
-
SHA1
1c10476bccdff2e38d9e61f764e03b8389f1219d
-
SHA256
18a59b14d32216b8eec2064a0bed2658dc049d90376223dcd10c58697ef2e383
-
SHA512
b2702fdd987d8bcc3cf62039b67334139357f9db2d25aab7402885b8746d8c05074e309fd06112b2795e642813dd0de6c6d887b5b2bb6bdbd1f30b93fcd0e93a
-
SSDEEP
3072:jEGh0oXl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGFlEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_7c7b3edf03d7bfafbdd998980609e48a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_7c7b3edf03d7bfafbdd998980609e48a_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4ADCA0F9-7E36-4875-9EFE-2F453C12FE4F}.exeC:\Windows\{4ADCA0F9-7E36-4875-9EFE-2F453C12FE4F}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87E41688-2972-4dcc-9573-2ADC1EE6E69C}.exeC:\Windows\{87E41688-2972-4dcc-9573-2ADC1EE6E69C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87E41~1.EXE > nul4⤵
-
-
C:\Windows\{97389B98-1E05-420a-BF67-A8ECAB2F7336}.exeC:\Windows\{97389B98-1E05-420a-BF67-A8ECAB2F7336}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97389~1.EXE > nul5⤵
-
-
C:\Windows\{3B67DBE8-DEFC-407f-B4DA-533859977F7A}.exeC:\Windows\{3B67DBE8-DEFC-407f-B4DA-533859977F7A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{914FB5F6-1B1A-42bb-BB69-183B660D0222}.exeC:\Windows\{914FB5F6-1B1A-42bb-BB69-183B660D0222}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{768D1E8A-DD90-49c8-85D9-D863E2D1FDB7}.exeC:\Windows\{768D1E8A-DD90-49c8-85D9-D863E2D1FDB7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94EB5825-F13E-41e2-9ADF-3F33FE778B96}.exeC:\Windows\{94EB5825-F13E-41e2-9ADF-3F33FE778B96}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFA2A2CD-B78E-49f0-B53B-250445045F5D}.exeC:\Windows\{AFA2A2CD-B78E-49f0-B53B-250445045F5D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B0ACC2C1-31AA-4c54-88CC-C42553879749}.exeC:\Windows\{B0ACC2C1-31AA-4c54-88CC-C42553879749}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0ACC~1.EXE > nul11⤵
-
-
C:\Windows\{DFE163DC-7AD2-4248-AD30-A2FD4243E266}.exeC:\Windows\{DFE163DC-7AD2-4248-AD30-A2FD4243E266}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F51AFC40-4C64-4783-8F5E-5E96E6C80767}.exeC:\Windows\{F51AFC40-4C64-4783-8F5E-5E96E6C80767}.exe12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFE16~1.EXE > nul12⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFA2A~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94EB5~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{768D1~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{914FB~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B67D~1.EXE > nul6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4ADCA~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD55b6dd4c9a4bd73c300482d3b6f8e348b
SHA1bb7975648a4b654c0a33df075ac64c0ecc101cf3
SHA2568d00a670cffce1c5b41c1293101e91f867ecae9ef8fe7a000d0cc4e487923ff1
SHA512ee976d93b5316e17fc996cd446453329c626cd43b0221db1531b48f8d99bac6514a3bf8f27e1aacdeb1073eae243797ef6ed85d582654edf59e671711c35666c
-
Filesize
216KB
MD533b879acd436e5fa843fd5a2a827efd8
SHA19c1cde48368beef0941669b954827cf8a089ec2e
SHA25609384b165b5d67a67a7a265c412af83b9208c72dc54af40088c508ed636dcf0c
SHA512d976117dd9e537a0a615e01a1df4f2e66d42d2b9377bb0f71f8ad2adb30d23b7b34ace2618b5f00e7c5686a768b868489bc54838acac4292d06769da4712ec05
-
Filesize
216KB
MD5ff0920c54dd11bee0d10f621fc6678d3
SHA13878f4544958db757f10854f2acda1c658accfaa
SHA256992992ff3d7ac2b10212dfa9bb8ce0d6c9fab99e6f6576385401e0b9757f25a6
SHA512f3d02cc0fcb33ce689e4037183aae492724151ebce0e9e43e92ca5e1acd8880a03cdefdf341b9c92c2eaf6cb2218795396c183c0c1bcb4ad6d1385d5d1583216
-
Filesize
216KB
MD5f5780656b25fdd72f0d81a5a3d91ba2d
SHA179f772ceffd54ecb2141e2189590afb0a972c374
SHA25679ae65f4a3230530178afcc0d7dbb1d22e3b2a6c626ac6d9c1b46b11224f553a
SHA51210d090fc1c0a961ccc6735bc274f5b0ce4796f467fdb0124f239e28ef3048be0db8ed67a574b40e597fa9d8f9f43074abc97f4bf3b20a2afa413e848851980fe
-
Filesize
216KB
MD5b26d7977fdf17571d15386d121e956ef
SHA105042f2acf30b437d0a866371401b315fbb0996d
SHA256a97780f21dd82803e0e530d807b3109b6e973ca89498ed2877653b4feaef6e5f
SHA51281d19ead5c720725b0a2c9396d7599e4b8c326809c079c673b8e1203ac3357e9e79b95be0f14b253824885a251cb3aa95502b5e5796f7ddc506a4642794af5f3
-
Filesize
216KB
MD57e2372068d47b4171149f0f1cace9dcc
SHA1e425a3296b4491b15dd799f877671a0cd620ebc8
SHA25656aa25e1955f016bf9201f87acab33edbf4ddc21a0c0b99aa8fca9b525a28573
SHA512ac84cc4c73a793f84f37586c5b0bc3a6ad5bd1cd3fc29192111300fb0203902a98bb7ddfd69af23a5936d3f4891e1d220cd67d6dbff2ef1e176fe711192e9b42
-
Filesize
216KB
MD5e702938513f098b96d2f93382700fee8
SHA1523a223bffa0f8611f01f0d6202aaab57e3de7c6
SHA2565dafe9327c681dba4e7e36ef3c248a900c5a5eeb3e4ec883f242212118b4c7a3
SHA5122de2ec285598b36c96d1f8fa647803801e75a7ef3435d7a7f9619ab367617a368c846d7daaecc403cf741a68bbf7d616d6704c7f7830838517973ecf728a5918
-
Filesize
216KB
MD527dd5281edeab54fe477c7468e17a29b
SHA12865f6e217caec9fa34f8c70e56ec5aad32876f9
SHA25674cb78644cbca0c2544f733a2478caca9daa4d6d10d4abfc8a9a36d500a1844d
SHA51216ebb530bfde796ec757c31a295a2007de0f22549838ab57d20208d3707084503f79e905f0a5ebdd8cc75d1b5fbd6f35497762b556ca1b73a85a547383c34ac1
-
Filesize
216KB
MD5f0b54aff638b19b93c01beb9b7ab4f5c
SHA15d906f38f8bf020f44776e79537d173f1b691536
SHA256b6969996924412c771ca557c52e22c5e4980c07b7cef68ee6b53dcc7a4392e0c
SHA512128bbe90dce3eb29a5f009f7c1b9ab8bcfd2105d278b4496b6ce8c2ed08df00732bfadd314e13e646901a026fe3a792186a494d59ea5a8abb122f39587387c21
-
Filesize
216KB
MD5d20bb5fda7a254dbea55ae36637ff687
SHA18eb76d7598f61eaa108968b248014baedc21fe71
SHA2560e8122996f5d87b5224a91fdda139ef278db660e812ec81b6e647cca0eb09433
SHA512f76ab5cf679eec27e9e1719196e2c21ba6c7e4add96c2956ae5ac9e26657dcbf5a7fab457a9d18667c9e33d0aab58acc94f5291ffb5d84b464af57f01511de7f
-
Filesize
216KB
MD55d0d6aacd2c901308c902a5d1a9425f8
SHA19cba4df3d34d678f033512d820dabd926d7d6527
SHA256d72e9b373824e2e8c0b75737b483eec0cfef33c6aaa9cfd8ce8545cbea732345
SHA5126c8798acc370e6508ca550183571bae195d4dff801d7f252d8fac325e1018a3c451caaea031d537013c9497fa34b2913f5976ced29e1af2209157e65786c51ca