Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 17:40
General
-
Target
2024-02-12_781dc4a1b9dcd39ea89cc10c9ac8d131_goldeneye.exe
-
Size
408KB
-
MD5
781dc4a1b9dcd39ea89cc10c9ac8d131
-
SHA1
48c97e0843e5c324eed5d23a1015c3f14475e14f
-
SHA256
aece22f431e7f98bd911223303575cb0b8a13583ff09d2f4ce5db62f5cd60258
-
SHA512
9675b45f901d4b04307bc0ba12081009dab53cd7c718df0e08ede1702c857faa4d33825c57a6b88fbe3b2b3a138e9e9a8a3faa4386a63fc176ca70a9bb08af1d
-
SSDEEP
3072:CEGh0ogl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGuldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_781dc4a1b9dcd39ea89cc10c9ac8d131_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_781dc4a1b9dcd39ea89cc10c9ac8d131_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B6A705C-F679-43dc-85CC-408A5BF78BC3}.exeC:\Windows\{4B6A705C-F679-43dc-85CC-408A5BF78BC3}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{143FBD86-2B3A-44e5-AB03-5D99E672CD56}.exeC:\Windows\{143FBD86-2B3A-44e5-AB03-5D99E672CD56}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A39C7588-F4F3-462e-914D-B01CA63CDE56}.exeC:\Windows\{A39C7588-F4F3-462e-914D-B01CA63CDE56}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5483BADD-91BB-4d2a-A2CD-D06CE491E088}.exeC:\Windows\{5483BADD-91BB-4d2a-A2CD-D06CE491E088}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5483B~1.EXE > nul6⤵
-
C:\Windows\{18E82F30-5E7E-4188-A84A-70C82EFA711E}.exeC:\Windows\{18E82F30-5E7E-4188-A84A-70C82EFA711E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18E82~1.EXE > nul7⤵
-
C:\Windows\{B677C5DD-0DC1-460b-9315-E940E12B9DFC}.exeC:\Windows\{B677C5DD-0DC1-460b-9315-E940E12B9DFC}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B677C~1.EXE > nul8⤵
-
C:\Windows\{9DE2131D-6BDE-41b1-8F53-AACD8548CD79}.exeC:\Windows\{9DE2131D-6BDE-41b1-8F53-AACD8548CD79}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DE21~1.EXE > nul9⤵
-
C:\Windows\{031DEE09-F6EC-4718-B72C-D931F7C2F4B0}.exeC:\Windows\{031DEE09-F6EC-4718-B72C-D931F7C2F4B0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{031DE~1.EXE > nul10⤵
-
C:\Windows\{58B4A950-2330-4fd8-98C5-08B513609C04}.exeC:\Windows\{58B4A950-2330-4fd8-98C5-08B513609C04}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4817DDF0-5951-42fa-A3ED-AE60A8A5C8C3}.exeC:\Windows\{4817DDF0-5951-42fa-A3ED-AE60A8A5C8C3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{ACEED5DE-C1AD-43e3-BD1C-D46A33CB1894}.exeC:\Windows\{ACEED5DE-C1AD-43e3-BD1C-D46A33CB1894}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4817D~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58B4A~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A39C7~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{143FB~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B6A7~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD55e7a7347ae5c565627bbb1386b7cc379
SHA142f68195007ae978c045aa94da83b71a5470b30b
SHA256aae53b4849c7a28f42bfbc11fed08a85f6b454e1c9454791a071f275d80fb14e
SHA5127bb86e84834d57800ee82edd296cbfd4c900f9df3d1bd12238358f93989a58969201e1a11b3d4800f238b1d07bc2c70714366d40b967b8516abb57c955e8bdd6
-
Filesize
408KB
MD58a91f0bc519922a844e7e5cd86893250
SHA146e6f00457efd38eea8e00a1dafc6a6270862138
SHA256b79618c0d239c0f855dde751e4cf64dbba5af004ee45d14897c4720a1449f595
SHA5124eb2d0cc1de250a873bcb5375aa91be9d21b65b7adca07170e69b198361387cf4fd4e0974d4e9c6e49c4c42a5277d0d087d504408b2832605f0a54f4979fd656
-
Filesize
408KB
MD5816b20b30c9b36cbf0559618f57cd2c9
SHA1e3dfe719f39baae1575b2296069ef457e2756bb2
SHA25652b9cb8f5102c54a19ebac6892edea0e0a10c0b68a61cc0c6734652e16f968a4
SHA51213f4aac133be3bb78e2d9e21d48a4d73477e45902d310cc7a6b3d6e4b7bf0467a68a47abf6b9f1c517d235c7626297434c02efa3d585efaa1dc9090f725a0824
-
Filesize
408KB
MD593a0104fa2ad3ba36e4c13fe65047629
SHA1e6ed5c81d36a7dda51ed051e9f61c25ed4a9dc73
SHA256278d605327116d5956cfc55f19c805022489839e981a40d68cbf783903fc08a2
SHA51247e598afd0fe7e62c73e5671dffa988b83106893a3a292814e58a226b85ece89123507b1e54411fa378f11418c5ba48fc5384cf52852baacbd34d7d236b0d91e
-
Filesize
408KB
MD5b72fa6105903fe44c96a0d5859187a18
SHA14057c5f6d60176d0573ee7db509aed41ed972f8b
SHA2563bab5f8629c568eaf0adec3f880addb7f1b3773f3d27df18ab5a832fbb475cc2
SHA51254847f0d268cff9c743faee64825f5cb9baa168cc190dd30e51bdaa0e1b5481796a9920f7699b766bcdc204e9c8f468a9a8beed9f374c0f1035d9abf5a80f381
-
Filesize
408KB
MD5fbafcbc46c9d433462781a5168cf8d6c
SHA19a337c4d7ed9923d49b6935787e7f20fefc6fa5c
SHA256f8cc51d1e1aa0edeb7a455614326f1522071b63b9b5d0ad1ec60de51955b85d7
SHA512ff65070e7b70b662ac928680965cef27800139c0e00e795188212a61322eec10792b1b1edfb4231fd8d720a824aaae30ebb632eab0950d830fcb386e1d752601
-
Filesize
408KB
MD5a071cb9ab06ed647fc60351777a60db2
SHA1b25c632a722b532544f296c92a2a48abbff9ceb0
SHA25657dbe429c9ac4a69ac17515239af90c60a0b6efa180b58b41f0ff3c57122adfd
SHA5124ed3d14fe1736f4632b754767fc46226b21623896b82cd5f95dea730647d79683f2e896b82b2cc500b349850f41d2115e89c29afedbff7d1f9798717fcc038df
-
Filesize
408KB
MD5dd8877403f247c6d8a46c8eb5179fdc6
SHA1b88287b785ae3f58e6c5f3970df873c5a0545983
SHA256763ce14a6c8d2afe926df7d6896e74f1695d6d5c814ee0c8e4097546ea97488c
SHA512aa55d6370b9a20017a0e948c56e2812a4499c3332b7e7d46324ae707ccd231f330c455e63d95cbf3d4bb6f2b2783880a1fa847171754f6415b68e66a13907ad3
-
Filesize
408KB
MD5dfc95b1d2142eebec71a3cbdabab15f2
SHA18fe0d31b6377001db866ed00ef1e0bc63485013c
SHA25609530cecba4d1273fb60a56510dee17ba0e867bdc3e5946ade089f296f39cdfd
SHA5120db5340ae9d2451808946b7e2fb032aea0b9d5a9fb5c495883c9704d5afd33d05973ebe58b27758609d1e1be143158433db4873ec1a2de7d04ff3c38ac6e22a3
-
Filesize
408KB
MD5917c04673b20aebe6813fa4544106762
SHA171846de86348c5740dea188f4d362e5ded40cfa1
SHA256e3bef4c4cff92a78db8b966ddff219fea4108c76fdd567073ef9edfbf2539eb6
SHA51294fbaae4ddb26470f9c400e1caa863b37f298d314a30c7929af07699cdaa06fdcfbcb481290f4b25af7ef4aba438c1e4e19a5d458119d0b96a4c732e1dc8bd86
-
Filesize
408KB
MD57ffd5e704905d201c9a11f260589c582
SHA1912a4494a558b8783bee6ea72cf5d8b7b3747db3
SHA256bda434ae19d2cca21f87d16f979e577905ceba8e7aad44d115caf16033ce59f6
SHA512834e7753fd3b14d440919615ed7bf634df07f2e9c2cb4556e1922e52a6178ebbd9fa9c02236a64941d73a7b8a9fb0a53b4bd53f89f6d35d55adc713db8f07413