Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:32
General
-
Target
2024-01-25_8775b09a69c8c3f6524395e50dd16b35_goldeneye.exe
-
Size
344KB
-
MD5
8775b09a69c8c3f6524395e50dd16b35
-
SHA1
e688394efbe45b5e928393a761ad46fd8dc0d232
-
SHA256
cb468bfa4b86df6fe53dd138d892972e44f680edc756af3f27d3aa00164b030f
-
SHA512
9e90551f09a614f45e3338c892fd744089bbba177249fc626eaf0ac79525ebb9c82f599a42de9420737433cb9286ff1d6a189bdfbdb52c99d5483c3f2fa3ae19
-
SSDEEP
3072:mEGh0o9lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGblqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_8775b09a69c8c3f6524395e50dd16b35_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_8775b09a69c8c3f6524395e50dd16b35_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB426A03-8F75-401c-9DAC-55CE00293E03}.exeC:\Windows\{FB426A03-8F75-401c-9DAC-55CE00293E03}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F94EB374-0372-4f8a-B6C5-E42FED46C9B8}.exeC:\Windows\{F94EB374-0372-4f8a-B6C5-E42FED46C9B8}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BECDE457-6212-413c-BE1C-9B272472E97E}.exeC:\Windows\{BECDE457-6212-413c-BE1C-9B272472E97E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A04B4CC4-106B-4296-A916-FB8E6495EFB4}.exeC:\Windows\{A04B4CC4-106B-4296-A916-FB8E6495EFB4}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB20AB02-581B-4611-91CD-17B0B22A57A1}.exeC:\Windows\{BB20AB02-581B-4611-91CD-17B0B22A57A1}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D3E1F4F-36DD-4eee-A163-4A86ED04402E}.exeC:\Windows\{7D3E1F4F-36DD-4eee-A163-4A86ED04402E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F2C881E-E16E-4f87-87C5-C6548E2EE7AD}.exeC:\Windows\{6F2C881E-E16E-4f87-87C5-C6548E2EE7AD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{293E598B-3EDB-4d99-9DC9-D37F7B63B9DA}.exeC:\Windows\{293E598B-3EDB-4d99-9DC9-D37F7B63B9DA}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{293E5~1.EXE > nul10⤵
-
C:\Windows\{B19765E9-D336-4126-8A6D-3E06C52523DD}.exeC:\Windows\{B19765E9-D336-4126-8A6D-3E06C52523DD}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B820563A-83D6-45f4-98EF-7C8FFEEBB448}.exeC:\Windows\{B820563A-83D6-45f4-98EF-7C8FFEEBB448}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D71488F6-9E4A-4b41-9C54-7FDCBC89FB34}.exeC:\Windows\{D71488F6-9E4A-4b41-9C54-7FDCBC89FB34}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8205~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1976~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F2C8~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D3E1~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB20A~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A04B4~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BECDE~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F94EB~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB426~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD585ac183b7dc1c6d1911e3ed2358279ae
SHA1cee638535157f050d459942a66e793755ac7e2a0
SHA256c08d53846fcd8398e0a14c4f5d441b7d5ff8ba24f9808f91133d356832ce0219
SHA512eccfd4037d690cb7700e64c2d0d49f9c2a0f04bdbd57930a0cb2ec09ccd42fa37fc1917706f909a1188c4cc8990241ce8c47650408479c7c3ecb61249edcafc9
-
Filesize
344KB
MD5362232ac6dfae7a465b0dca1743423dc
SHA16d53eac6006e3d678b1da58ce274cc07e89ed739
SHA256c7a620abd0610668be38028d027b9072a4f1758471b288d82364989cf81d911a
SHA512a3c9e19233186004f7893b38594e5144728061860d6856b873f233bc9efc950cb4ac4777a858ea67033534e345933792fc456136b849ea6fbebdb6288e737dac
-
Filesize
344KB
MD54dce689d1cd0b79792a5469bd729f7e8
SHA190f97799c5ff5c2c004eb5697da9c3076305d234
SHA2564daab7dfd13e0c9d33185b151504159305fb410ca6141469802149e70be80f9c
SHA5126ad0fbdb2271e1b3f1e697995ef4b3774d67086fcd216803fe5aaa39419732c5c261de299597dd1dc2c5990a326867806b73d551a795e8db386bd587d92ad037
-
Filesize
344KB
MD50390cfd62422965f62aa3ac7e243791a
SHA1a45040e5790d6cadb57711b880167ee6780e9726
SHA25647b50f4e26a8cf3c722288da62a0bbe9f2d5f765aba20728ae72ce8044492b81
SHA512b3dbae5e93057cfd34168fe23b557e5404f4bc57d33599c518eb117643f244abfc69168ddfcf5b5945255fa377694cd828f11787d9d16606b195306099b54d86
-
Filesize
344KB
MD534c23b8ac3803eb5213bad48ea0d6e5f
SHA1478fa1131e0fd3ec24803211d1e207afcc0d9283
SHA2563ab64a7070471a2fe27f9a0b0b055ddc64875470aa8bac03de3c1f3dc567cb5f
SHA5128f9dbaf83da8521c3d075422cb3927cdfd2ad8964270a475adcdc13ca4da19ba7811350b73598509c0e2b50bcb34850b08616b17df7d5bb3afcbbc435ca820bf
-
Filesize
344KB
MD5788935533d968a4f334392200c8a71fb
SHA178d324aa7e68a2808021cced0a389fa5df94f3ed
SHA256660031b0131d2fd4fcc6a077abf910873c816832b39aa02c2e2b694bcdff89c3
SHA512368486a2131586ac65483dd15cb46f428c8a4fa1ee3fc86eafa92602d054e661f66128398f51921c053595e9609da64e3170d1e553f9c3ccf442dbeec9469673
-
Filesize
344KB
MD51572c3dd5999d4c58b97ce737a4b2a5c
SHA1625656c2e91dbdfa2eaf6620d9250322437c5091
SHA256820e67eeabdf867b7959e9494a80c5dfc68f1627091eebb1c955eb8c057dc9a7
SHA512b3ae30a493ef160f2e49bbb4359bf81d0802f0b5987a824e4ec4a69159cbd80d093f59ba53e32ebe1f76390b31a8065fc6b9f503c3f7d7a836147f1d9b30bbf2
-
Filesize
344KB
MD57d459d490f5280b726396efac953f6a4
SHA1a333e1fef4683ef76b0846f5ee7a191733c5d531
SHA2561941e0f3fa5896a1a2fcb126280efa4b8bcce1930bedf2f77da6f3bfe7f0fe82
SHA512dc6babc18e9c4435349e93117ef4b46a11b5dc528fc20260bd8237d855cba19748ccb49c53cf0a8abcd9876156771cdd86d7c6c7a38c6ebeb647dd468629c9a6
-
Filesize
344KB
MD587e69f02bdcb5bb30dcbe3753f356447
SHA14dc37f8b762b87bd6b4e11e9d712b8abecd38cc4
SHA2569edf39d435c35db8df3b3b754233aa541aceff1f4ca21d8690482c8d1b2a7e05
SHA5123b978837776fe0d878750cdad451e032c2f8c68eaec3962b5dd7fda377aefd7108e61876b061d64880bcdb5e56e848d5d78b426fd00e553c45bd0f429672732a
-
Filesize
344KB
MD5791b2d8bb4699e9acaaf16b6ddae89d1
SHA13ad31f248149372102241d8016acfa422e418207
SHA256480f6b28babcf8b46f265e4932a777dadc514d03fcaeb5d4f1dddb01f9cffa58
SHA512666a04b7c93876172a1cc6748377e39de80a8d7dae5ef07b5f720917e1d87336eef39a19c0cf2d6bbc885e7d90713ce321209721c5211bb1059efb459a677a9f
-
Filesize
344KB
MD5cb909f2b326b1069854d65d001208b50
SHA122c37a29b3660b6f5c63484f99049de3f269bb03
SHA256492db32b99e85c3db89802b252e7e1fbabb8d4d8ce85ed412eb24c978129d540
SHA5125755c3fa538c0fe1f69d5310c0458dc62fdb0543b13af60b27dba7ddfcbc908a15c40dd10ae490de3678fc855c5bf0cbaf0e57c56e2b598f4067a4598bba3a96