Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:32
General
-
Target
2024-01-25_8d15983b44ca410b26bcb1edb2e588f3_goldeneye.exe
-
Size
180KB
-
MD5
8d15983b44ca410b26bcb1edb2e588f3
-
SHA1
c918100f2164d5e25cc71b4bc742a01b64e836f7
-
SHA256
6b93f59a8cd2eddc51651cbcf7bf7d6386a910beb7bd4bdc93be6ad8c3714bd8
-
SHA512
d34a0263343aca76e4f9f995f0d25d6bd67ef1bf2762f4315c57587ae63733b9fcc4e8dff89c914a598a93356aa995cff3bb98fee2158ef99d326a45777fdf7e
-
SSDEEP
3072:jEGh0o/lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGll5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d15983b44ca410b26bcb1edb2e588f3_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d15983b44ca410b26bcb1edb2e588f3_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E54950-01EC-4912-BAD5-05437E604CE2}.exeC:\Windows\{B2E54950-01EC-4912-BAD5-05437E604CE2}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17D57832-8389-4759-8B99-C609C534F0D2}.exeC:\Windows\{17D57832-8389-4759-8B99-C609C534F0D2}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BF808C1-877E-44fe-8EE4-163492890F64}.exeC:\Windows\{3BF808C1-877E-44fe-8EE4-163492890F64}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06622EAC-1E52-406b-B4E5-208306A316A9}.exeC:\Windows\{06622EAC-1E52-406b-B4E5-208306A316A9}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B011163E-FCDF-492f-9DE2-5FA58ED78F42}.exeC:\Windows\{B011163E-FCDF-492f-9DE2-5FA58ED78F42}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0111~1.EXE > nul7⤵
-
C:\Windows\{72F854BA-FF15-4632-9317-A804AA7D7866}.exeC:\Windows\{72F854BA-FF15-4632-9317-A804AA7D7866}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72F85~1.EXE > nul8⤵
-
C:\Windows\{397F073A-B8D5-4d69-9D1F-EAFD242D5DF5}.exeC:\Windows\{397F073A-B8D5-4d69-9D1F-EAFD242D5DF5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{397F0~1.EXE > nul9⤵
-
C:\Windows\{74F4CCF2-BF8A-483f-90B0-51AFB3A4C397}.exeC:\Windows\{74F4CCF2-BF8A-483f-90B0-51AFB3A4C397}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74F4C~1.EXE > nul10⤵
-
C:\Windows\{1AD9D436-370A-4ee0-B265-3A018D5E6C37}.exeC:\Windows\{1AD9D436-370A-4ee0-B265-3A018D5E6C37}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AD9D~1.EXE > nul11⤵
-
C:\Windows\{7B9438F7-0228-47c5-80ED-CB1080927667}.exeC:\Windows\{7B9438F7-0228-47c5-80ED-CB1080927667}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A8BFC557-4072-4ca1-8D75-7ECF708A2252}.exeC:\Windows\{A8BFC557-4072-4ca1-8D75-7ECF708A2252}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B943~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06622~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BF80~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17D57~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2E54~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5d194c922e63c9823f2aec3f23e1fd91b
SHA18024adb3219593497734a398f8e4876740a4c973
SHA2564a9a8116e0f33f5190f0a31842691656856571de27d370fe1b5903a0a8b68124
SHA512d85f32ea3783b61c4fdcbd252ed6159a4e3629e6832b8c28e431ad4ba2d58cadba6b8af664f8b29471949027059d3ab3886020059e33dc432c85f4b0fff6e92a
-
Filesize
180KB
MD513e5638cb853afdf634c507892bcd9be
SHA1c9744ac7b973f14149586bf3668ac36c36a4d92f
SHA25658a961686c46b416a22ef01152c054580723e70bee485b095676bf262c530979
SHA51291139837225f675bede0135b63c185f817d1f39244507a3913573a87a21c944c813835cac57ba935065cba457de0a16f4288d3a3465e5dcd15ef071b7c8872b2
-
Filesize
180KB
MD5ec10885b689c92a090835cf00e5436c2
SHA186dfdda0a842403f2bd1190c86b7a6f939e34a31
SHA256e4083bcebd04998f1c37d7a51c46313c4c54fb0104d7b1904f7b497241dbb1c5
SHA51259f4a192bbe9702355200bafe5e27d1d7da72f83d1ace7692f034973aef7d3eaba6e3ab402868783c876e95ed0970da2a40255caf044e46be458c674f1318409
-
Filesize
180KB
MD53a0f27e631a0c863d4d91cdb38ad53fd
SHA1af24d9a400eef6c27ec7e4ccf7dc59d19702db75
SHA2568500fb7a3e3ead72a47e3e4096d2852cd0ab749f438c80d68a9c794bda02533a
SHA5120d063a9c879da02e8a0225b868d4978fff8a929cab44e91e04321fb1ae5d45f21677898ee02af997e78a25c80ac418348e323104eda045c222956edfd2f3958e
-
Filesize
180KB
MD55d3683ea4b9dc89da03598960b730747
SHA14deb700b70309b04d992159d3be5e4589f69a1dd
SHA256266454793ae27281d2c381985b653ddb3f7a4fdd9c7bf8e4a60f039948178653
SHA5127dcbf9cd5f7c24228b10a5bbf680bb26dd012e14863369409e8951abd84d3a54553771ac1d9de84a32ea22d155381876a6d500831865414f15f983469174fe42
-
Filesize
180KB
MD5b9f74aaf1c760a0381dee1072dfac1f7
SHA1c99f3f4ec55b44ae54fc9ecbcdd33352d14ab1d5
SHA256ab86044dc4279ec48e3ebcecf6966ffdcc22bfde932511a10086bd385fe5d1ce
SHA5128b17889ac385e5d5fb8f8d334a04f33f0f2b2e038fa943da77f9cb4cb782ee4798cdb50bb59fb31c8877d0ba92b54e1e9d5737f9791f7e66a31f87a615f21029
-
Filesize
180KB
MD559d36d4390294d11c15e8abfc516ba8d
SHA15b8bc0ace86a9d595c33ff0d501ccd8b6d2ef324
SHA25623ec2f455766d08cac0aabaf4fcd79c9d6b804b779c4f44ba42fed9ce628ce42
SHA51205527cdf3a32124e93dc8304f2963bb4ce20a0f947d9002fd002e14de6d8aa766d7cd06f3c75601148a94c88952e1eb93a4dd41c5df4d01e36d6bcd81f228dd9
-
Filesize
180KB
MD5f83e728e819e98134dcd36b1ac108dff
SHA167e6ea54e3e9dbbc6e2cf1eaf66f953750b415dd
SHA256b863792b3a93592970e09c897e428214e9878261d399673531aeb3c90be20922
SHA512c6080e9819b6da1fd5f9eb61436632a21da15d805bacb462cba1dd1d106c0107e7af738c8354a8ab7ccbc1b4c0be461fe6b0688e4a09e5dce94dc76aedffd950
-
Filesize
180KB
MD515f5416fba8a0145e9dfe5af4a4e9795
SHA14b44de9f8863c869e7db8541fb8b82ec1cee632a
SHA2564d712c38c94576fa0dcdf723bbfba4a99f9a460a3edc3209cfa96e70d4bf1b20
SHA51238a0c3c8e428d9803e52490b87b391df4eac5cf441b76942278b53dedf35601297bb664e80c2a6f933a197417438be8e55bc026169261354850f26f6b8b14d7a
-
Filesize
180KB
MD577ebeaf1c77cd232f5d58e301c9c9a0c
SHA17221fa6e5aa9ea1c8a828fcbf4cb19ff5cc0d025
SHA256f1581e4e0e67803159d8cbfae61985440f61a6b5142f3bd7dd8aabdf083cff15
SHA512cfa8ea3a5822440a9ea372f9511ac11487350e5ebeac8a86e2c9820f5442d5fd3d07eb52e6c2835efcfbef809f87d4480b8874e68d1d2e5f0b6e0ae2e47a68e3
-
Filesize
180KB
MD5f8636bd5f0ea0f40855002d55bc9d191
SHA1f18ff5b31deb7a78ccfa4cdd3e37bf372507c725
SHA2569b604c022fe5dbc51e32ad297d3c5d9c8766afb62ddc246bc0d73bf7f3d47835
SHA512ca0277e35810334dc8e603aa3af0d9b358d7df50a692174ea1fc07b0fb012dea2c3ec6706a6efa2302199435f48b9946085151779349c661a8c2df803b174225