Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 17:47
General
-
Target
2024-02-12_b747a306e5f7c0d21fe6467984d1d13e_goldeneye.exe
-
Size
180KB
-
MD5
b747a306e5f7c0d21fe6467984d1d13e
-
SHA1
4ec9e3f1b797eceb5fbc3b438fde25f9f41f6f05
-
SHA256
e5e35e0c4409bc90ba9fdb7f4523d481a539a0d02a0d309879cc0c6ebd05f212
-
SHA512
cb58c3d2309ab437179d16bc04e62e57cd55bc93b8e6a4a07f88167489aba310bf8337682e45ab83cae26eb8f0dfef68db30ce68f3b8dafd3b4234839549fbb1
-
SSDEEP
3072:jEGh0oNlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG3l5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_b747a306e5f7c0d21fe6467984d1d13e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_b747a306e5f7c0d21fe6467984d1d13e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A45735AA-343D-4a79-B31F-774F4DA99769}.exeC:\Windows\{A45735AA-343D-4a79-B31F-774F4DA99769}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A24DDB99-C12D-4705-830E-037D4D5D2ACC}.exeC:\Windows\{A24DDB99-C12D-4705-830E-037D4D5D2ACC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A24DD~1.EXE > nul4⤵
-
C:\Windows\{3C953679-3D34-4ca4-BB72-931456AF9A55}.exeC:\Windows\{3C953679-3D34-4ca4-BB72-931456AF9A55}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BF55549-068A-4a13-8C27-CD9C8A3D4087}.exeC:\Windows\{1BF55549-068A-4a13-8C27-CD9C8A3D4087}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD912B5D-63EF-4644-9EA6-ADEAF805DA51}.exeC:\Windows\{FD912B5D-63EF-4644-9EA6-ADEAF805DA51}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDCF08D0-CC4D-46ba-A1BA-28EA177B6E64}.exeC:\Windows\{BDCF08D0-CC4D-46ba-A1BA-28EA177B6E64}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AED0C8AE-8B05-48d3-AFCC-DA82172CA3A7}.exeC:\Windows\{AED0C8AE-8B05-48d3-AFCC-DA82172CA3A7}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2962C1E4-3400-4ed7-88D6-D660B60CD75A}.exeC:\Windows\{2962C1E4-3400-4ed7-88D6-D660B60CD75A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D10AE536-C183-43f1-864C-4EC2832E67B3}.exeC:\Windows\{D10AE536-C183-43f1-864C-4EC2832E67B3}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{681C06C7-8EDC-4d74-A321-168B3E07FFEE}.exeC:\Windows\{681C06C7-8EDC-4d74-A321-168B3E07FFEE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0500DE6-2ADA-4de2-8E5D-E338A39C3CDB}.exeC:\Windows\{D0500DE6-2ADA-4de2-8E5D-E338A39C3CDB}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C8E8AD8B-FB53-45c2-9AC0-2AFEBD4A0D13}.exeC:\Windows\{C8E8AD8B-FB53-45c2-9AC0-2AFEBD4A0D13}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0500~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{681C0~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D10AE~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2962C~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AED0C~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDCF0~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD912~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BF55~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C953~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4573~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5550366f2695ce6ccb4cf8815615e00d0
SHA1e9ea85aea8303f2013532b14d75b4527a0708383
SHA2560d63de363987ec899d2018ce6ddf55e9f4c6e8188b6ad8596cbeedf35277da63
SHA5127e91e01d0bb1c5367b5316195fa1b33cbc24a823713e94290a090653e09a4ea1618250d30b7235ed27dcbc3814d68cc97107a31338e4f6c0643d73ca3b18d067
-
Filesize
180KB
MD519adb86aa14e89e618f7b5b782b6cf11
SHA15ec10c2991f3ad20100709c17e784bc6ef4a948b
SHA256e193dda0c012d8519c232533b11aaa4291e3e7f9e6c7a6cc1c009d65bf4e3443
SHA512e5f0d6e2df10c108b738311b129d173b76fd58a34ed6a2370b7813e8f5622e701d97c195f747125cea3cb030e39059bbe20f7aeb021cec32d2d12d654d6e0816
-
Filesize
180KB
MD5ece0c0af5a4fad5ae23c64ee9f821e23
SHA1694686f000a689b5f4f2944815e638d4907ecfa6
SHA2562a047f38b1e940d80620b2c77e7de4112d89d4f4a94fbf22b1e2aab85ea2bbfa
SHA512d37b73e5b7cedbba5d4800889c10a158afb2de7b2a83bb158a95a664ab5b3ae8cd434a4d120dc44a994ea2300e8f96779fd0a3e9eececf3c9672abcbfd498e67
-
Filesize
180KB
MD5460f077bd30062eac9fc7cb9eabfb155
SHA1981e3c8ab0320c56f43e14bd1b62d553ac06b92a
SHA25619270c862776e041d4ec363a3e2e1d46746aa5564e4cb1e97e55ef3dc97d54cc
SHA512cf390b09a9dc9c66cc66bb9ec87461db64002790fb22813fc3d9a0562ce0489e96f32474c4ef3bae36b4429d2f666d2ddc979d08dfea9abcf721fc78292339d2
-
Filesize
180KB
MD5f5a6a267479947827edd6445d7893d97
SHA1587be239dad8eb216c8fca3c1fead8ac134168dc
SHA25631b95790c6a6064b6ab66dca32dcebf94f209ceca5e972319689fd2d55e10876
SHA51246c2e6a7e771470db1c130ccd9e3b3b06f07153f1fd6827c36766468896f3b0f9612901a41b9cc315431de56fcb6e9e90b931b49bee70bf63d22665bf8d00dbb
-
Filesize
180KB
MD5d0f248ed02a91490ac55809f93c1d4a6
SHA114e4e2c694a1f25b4edd663535a084df80c66864
SHA256aee8d9167b1150c7f9fe766776b1360714c70e615c970e7d612851495814e14c
SHA512c007d8c5b07c8ad48bdae6d25feb984d5fa5dc4c4081882c7ccfcdb8dc8577c05e1dfeeda9fdc4d12de42b81afcb7e54aebb1c062e3ea355720f26f53b4ca13a
-
Filesize
180KB
MD55e93c844a8e4238c5a32239222f6ad1b
SHA14829cc3dd73aa206f60669a87d297c0131fd2296
SHA2562d217401945ce1cb9e2ee6162b5b293e405c91ac9527dcf5b721d0cb15841988
SHA5120d84027e728bbdb4a70568cdc0d7290ee67d3ddb4f914b1365f73a9d3ba1d8266979ba050d6e7c9564a6967ef439b9c1a4269e64660eee23a8829753ccefacac
-
Filesize
180KB
MD53f69ae837fecfaa7cee63fae063679dd
SHA14fe6b3cd2a39123e3be9a818ecc32fd17926dc68
SHA256dca8602bfc4cff5cbd15b8513fbb89a87231257ef632691d9c87875c00f10f3c
SHA512a6642b78e25cdf7eee4db8bcc1e64417b42311e2931311947ab2d39cc61578149fff0c6ae341e41c69dd809f9446f8abe492955e844e70d1797e3570c651b7b9
-
Filesize
180KB
MD50ce70568e007ecffc616dea9aecb8e23
SHA15a373dde182a41c08cea5c70088e964c6fd50a58
SHA25677d26675990fceb89892a68fb4ff33f375d59caa8cbf1376a0017d385b5f9897
SHA51272bd9cd087540c385a1a1059a22c4d3c1a9c2b293f2849a72e3ca1bead1cc9afdd3001d7f1e57a807e5aebc2902212311c2174b54eca9077631206790cb2c2c0
-
Filesize
150KB
MD504c47c9266d1cd44f3fc0e85d992fa89
SHA11329add1c544ecb4e0036de9c2b73040da3b2c9b
SHA256178a4261fe9f1ccc4fbd4d77cdb0d86ac56f343d7578917f70e587df41b9d3a1
SHA512f776bf919cce00cb2f2447cf54450edbe13d9cf5247dc983d8b99c3d00ef5a30d25c73233411269024dbae5b03dc4634e76efbf3144d51e8a04abe1d45ac2a11
-
Filesize
180KB
MD574bf8d961113751dc87fc0ce7fe9b251
SHA16e4abf09a57e7661c02e91be3478e2456f3e201a
SHA256463f3873b640d6ceb36666e72ff6e6e156998b17084f9a56c428085f42bb390d
SHA512570e191617b03d19c9617b307275f7848e639fca8d664e0ddb01a9b03168e3753796f5532f99b9be305e14889c88acbecb2aa28a2847ec1da4f7461bf782f0c2
-
Filesize
180KB
MD5512858bb7e7f605f50653b2b49ff6968
SHA1d1119bc803a69a981ede605a527fdb86bb47dcc3
SHA256a53efb438f35d3c017939b99361f3800273f391b0718733c5fb5b9e049c5dbe7
SHA5128725ad8ec2f8378ee3d665e799876e63a47c00a3ee6537483e89978cb3fcb6da781cc26d08902ac4db9b5a857f57a2680f2dc9e5d0c053d3cbc8da10510ff04d
-
Filesize
180KB
MD5b4c6eec9fdbfb62b0e791742966b7424
SHA134bbf4ff8f5687daf283dd092b0f00bac4603c2a
SHA256a7b1876af6e7594e91d8b3c183e77903949a7c2e82d393fdf5ffc04bd746ca66
SHA5120a0a883077d17970f610d12fc4fd90891400ab3d0fd92a59c131b256f424671e8f7344d9df1fac3d59337d61f11bc9f1f7ed8ad740ea548ff0fd92cb56b14bbc