Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:34
General
-
Target
2024-01-25_adb394d19ea37b252289985445ae06dc_goldeneye.exe
-
Size
408KB
-
MD5
adb394d19ea37b252289985445ae06dc
-
SHA1
aed199cd664896a5bba6a98f4d84912cdec917d2
-
SHA256
2b11a28caaa1f1b6265bd919fab4c81256781b29c99db0751385fa13d1964980
-
SHA512
0b135e4213718025ec8c77eec02ff0a3dece8e62ded3ea6fd1c7846208f4a46a82de509545d69865aaa01efc7badf45272f5b7bd917e0cd4e5e718e7cac1bfec
-
SSDEEP
3072:CEGh0oDl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGdldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_adb394d19ea37b252289985445ae06dc_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_adb394d19ea37b252289985445ae06dc_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58E22BA1-C76D-49e5-89A9-763790ABD691}.exeC:\Windows\{58E22BA1-C76D-49e5-89A9-763790ABD691}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58E22~1.EXE > nul3⤵
-
-
C:\Windows\{EB295756-ACE1-4958-96A7-02BFE4A4AE6B}.exeC:\Windows\{EB295756-ACE1-4958-96A7-02BFE4A4AE6B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{262FCAD0-7CF1-416b-BE27-F1FD3CE69105}.exeC:\Windows\{262FCAD0-7CF1-416b-BE27-F1FD3CE69105}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{262FC~1.EXE > nul5⤵
-
-
C:\Windows\{71036947-2605-4992-BABD-C0FCCB9A0DE0}.exeC:\Windows\{71036947-2605-4992-BABD-C0FCCB9A0DE0}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21C938DD-06A3-4925-86BE-8B802C1D44B9}.exeC:\Windows\{21C938DD-06A3-4925-86BE-8B802C1D44B9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21C93~1.EXE > nul7⤵
-
-
C:\Windows\{E39C733E-FA61-4711-A577-A232765B971F}.exeC:\Windows\{E39C733E-FA61-4711-A577-A232765B971F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E39C7~1.EXE > nul8⤵
-
-
C:\Windows\{189A57A0-4BBE-44cf-991D-1117B16418E1}.exeC:\Windows\{189A57A0-4BBE-44cf-991D-1117B16418E1}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{189A5~1.EXE > nul9⤵
-
-
C:\Windows\{36254855-E9F5-4547-8E7B-540F6379839E}.exeC:\Windows\{36254855-E9F5-4547-8E7B-540F6379839E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36254~1.EXE > nul10⤵
-
-
C:\Windows\{1052DD48-7AF2-42d8-BE4A-979EEE3F6DED}.exeC:\Windows\{1052DD48-7AF2-42d8-BE4A-979EEE3F6DED}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1052D~1.EXE > nul11⤵
-
-
C:\Windows\{E2EB112F-296D-41b5-9A20-B7F4814170BB}.exeC:\Windows\{E2EB112F-296D-41b5-9A20-B7F4814170BB}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2EB1~1.EXE > nul12⤵
-
-
C:\Windows\{3AA6BBDE-23BD-4ccf-9F78-C0C9DC7AD5CF}.exeC:\Windows\{3AA6BBDE-23BD-4ccf-9F78-C0C9DC7AD5CF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{78C1A253-1040-4f6e-8869-9581F6F072D6}.exeC:\Windows\{78C1A253-1040-4f6e-8869-9581F6F072D6}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AA6B~1.EXE > nul13⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71036~1.EXE > nul6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB295~1.EXE > nul4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5129958dd558221146b2e318663ef7b16
SHA1994f3509374daf9ff24138466cc9edc9f6ddc8dd
SHA256225a6d8e8e07317a9787a5807a47cc9b3afeaff4d96e54411ba4811cc409cb4c
SHA512402df2e14887f05a4cbb7d71684d2198df250b7c807056b90c0c67ba39d82d033fa55e78e65bfb1222fa73eb5078cb42a5430aa4bdbb3a5fc140e071cbabb2f3
-
Filesize
408KB
MD5d6b7c588baa30ee5d3b0d89ff530cae6
SHA1916769e022216046486f579b48c51038bf6695a2
SHA256ca1f93de82fea81fa9bad62999ef9f501770b2747b68ed90aee5a8c90e8cbf1f
SHA512cb79f99eefc9d3689ea33ab98af2487d466a2706aec5d958367cd08f05536306d96c4911a879eefd31e4063bbaae9183da0a2e36dd334e8dd9812c5ad076233c
-
Filesize
408KB
MD534711aa3a2f7df65b27cae618490c0da
SHA1a34b37a018813db0c5ce1b3b76f069db598cd3ba
SHA256942a2138dcc0aa60463391fa0ed96d73699827eeb77d30ba21d640531070641c
SHA51293deba7650b00b321d62ba302807807e9bbef5a6f96d09cf99c816064fa918a260ef7dd2ded3e226d5ada3ed4ca2a99ab51477c072f1697c8bb8453995dfdff6
-
Filesize
408KB
MD5f8a9e832e10aaa54e26e785d377473c6
SHA176b541ea5490bc5f56c6fb4120bc19d740667f03
SHA256211941b3c9858eea1e0c380d87f760cbe46c9a67af9c5835e285f892a175bb03
SHA512132e586842dce7f7373558f166e541fbdf64db3fc02f6ad6a13e6bd6e9eca2f79b40b6c04846faf5c636fdca5b1846b887a70d5d19674fb12531f6558233105f
-
Filesize
408KB
MD55218ad39690e148aced15e5c754ed173
SHA13c5e835bc2044e08afa93f57aba0da3edfb91946
SHA256b423823475b2a76c40dfd319629f71974d4885d01a0d4d24aa65dcfc85bdf82f
SHA512a5fd750e7371004527af06ffe0a97b355ab8eb5737c2161a0813526ab97c1ce2e97b71bec18927eff0d712a6e87400412bcff1092746bd7da506edddef32361c
-
Filesize
408KB
MD5c7f01412b3296356fcb05a5312259c86
SHA10956edcb548ce6b8dd3558762808839d39718c72
SHA2560c315579fdc34942b724bfe98e3fb87f128f38ab3a01281811408de7dbb2da90
SHA51206aaad2b5dead03fb2c7a38aed5a85556c315cd5806dfe80b4d074ab54073519b206458a3d83f0c2b41fe6098a57929dceab467d51c04084944e55a8492f391f
-
Filesize
408KB
MD5b22875926cbb2780156239d6445d7b13
SHA169d6389378a92bdc931e1692b672f0e68d195894
SHA256e76f59f6c9f07b39560a25db48f7c0fef04e8a258bafaf2f5d15d89b8cfa7baa
SHA512d874286b4748844e2b2312560ef668ecc2facd5cccf6e432af1f974badb5975d526e675a9de3813f13b3d85bcf7c1f205d516ec11e6055994e07e82467873acc
-
Filesize
408KB
MD52bf9a2010c67d81e75d4bd19789b576e
SHA1d5e017e0896e80e5584647be293b87127519dc67
SHA256de65ccf601df99fd2b64f7f63a88aaa6e79bf80489b796b9b8037e73cb6c705f
SHA512c4703aa3faa4051c62aa9406ae0dee51ca780c5d9062945422cb2f5a1a35fb9f3536c30bb22ead21acca79e0747622d6bae705f93ca88f9eee5fc4b601be299c
-
Filesize
408KB
MD5820f4abf4ac71d9b62cd6b1483fc173e
SHA182c6067f36816d5aa9518abc97cbc1f8750c2977
SHA256011283a1c040e440f60b8ba617118a2953556a6df974d31fce15b36cc2654484
SHA512a297010a618c69be8c357c7160a9c2e5aac7c1bce2122e2c5d4718a63d83334bc2be88bd4a157d75e802c1c40d3958d92720f52dec2f7c7f998c391761c5f9c7
-
Filesize
408KB
MD5137e0557b965aa90759ee47e4f8d36f9
SHA11309e194ed27e9517b8911c9353eedc67084db0d
SHA2562facab60321c30c8393ff78de23667b40fda79b05ff6fde6ae953f35304dd4ab
SHA512bca852f4b91e2459efaa0ca7e008511657a32ae8039f71a4982e431ba95f83471a00d32ed937bbd28b1b4782ad2f25c2e0f05660941cdccb55e7f07fd1221661
-
Filesize
408KB
MD5b4a88877b966554532b05da16020c1a9
SHA156abd470de56eaba5f9d7d41a027c83604f098cf
SHA25680a3b1f9e08d96105db7f4fd8f1282dd465f21d12dceef48904c8a238e2bc7b3
SHA512a33aae31827537e9c6979e2fc0f140b252ffd7b66549c202c2257f060306b1f924f5218dd339075da844397ad3f166527feef7a6a42a1d47a6b23caa5c7e2fc9
-
Filesize
408KB
MD510949632d06829b345ff627065772ad5
SHA18bdd39461304fa5ac31b579b6b4e0e3b1a53b652
SHA256224e4f62eea344905ecbee5196156d83b3e9a36e5d77719896d901a036a292e3
SHA512b4fb2f996bc4712c4a3cfdd5badb178b7005004b875f1015add7ec90a5960a41ad094d68915ec2359d0f1cb28090010e09bf06abaa851d40ef144643ace71f91