Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 17:51
General
-
Target
2024-02-12_d0997838fd72074f7ed585691d3f044a_goldeneye.exe
-
Size
372KB
-
MD5
d0997838fd72074f7ed585691d3f044a
-
SHA1
3876e1c3a868146add295d5e6a7166237fe00195
-
SHA256
2fc1b2743122d4c5cc8542c14d7e8b17f1c632e2cd22bd35781233c155916ea3
-
SHA512
19dc8272ee0abc14459735ce9a0d03302d1f618ab820df9843b2f7f23926ddfeb3c818db2042b0ef6c85061096998e68821472de85e006c86fcc418117d32314
-
SSDEEP
3072:CEGh0oKmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGJl/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_d0997838fd72074f7ed585691d3f044a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d0997838fd72074f7ed585691d3f044a_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45BE1E89-85AB-40ca-AFF4-DB60E9D130CD}.exeC:\Windows\{45BE1E89-85AB-40ca-AFF4-DB60E9D130CD}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA14ECB0-BEA4-4da5-9E0A-5325BACB06CC}.exeC:\Windows\{FA14ECB0-BEA4-4da5-9E0A-5325BACB06CC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14CD6959-BCC6-43ad-AFE8-B3D4287B419F}.exeC:\Windows\{14CD6959-BCC6-43ad-AFE8-B3D4287B419F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D7E8669-98BA-4805-9946-D559F4A8B1E1}.exeC:\Windows\{2D7E8669-98BA-4805-9946-D559F4A8B1E1}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42FCE186-B34A-4ab9-AEA5-2E5B2469B32C}.exeC:\Windows\{42FCE186-B34A-4ab9-AEA5-2E5B2469B32C}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{235CCFA5-5084-4ca8-84FD-1F2AC1120641}.exeC:\Windows\{235CCFA5-5084-4ca8-84FD-1F2AC1120641}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCF3FBC5-0EF1-4079-A4E7-E9CCBB800C31}.exeC:\Windows\{CCF3FBC5-0EF1-4079-A4E7-E9CCBB800C31}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02FD08EA-F3B9-4897-86EC-860B4F4B6F80}.exeC:\Windows\{02FD08EA-F3B9-4897-86EC-860B4F4B6F80}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A8F7DB7-2E32-41c2-B94A-A32BA9B53201}.exeC:\Windows\{5A8F7DB7-2E32-41c2-B94A-A32BA9B53201}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0BDEA4F7-FB63-4fff-A7B2-C855A299AF85}.exeC:\Windows\{0BDEA4F7-FB63-4fff-A7B2-C855A299AF85}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A72CBBD1-C972-4e3a-A8A0-6450E37C878D}.exeC:\Windows\{A72CBBD1-C972-4e3a-A8A0-6450E37C878D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2838833A-9684-400f-AD76-AC658AE80F55}.exeC:\Windows\{2838833A-9684-400f-AD76-AC658AE80F55}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A72CB~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BDEA~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A8F7~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02FD0~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCF3F~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{235CC~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42FCE~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D7E8~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14CD6~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA14E~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45BE1~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD589c7b08cb946dc5df5658a85c7c0f9a7
SHA15c304d0ad0d18cfec89a289639ce5513232d4dfa
SHA256d24d703beb6503d429cb076b4a7c41949fe15c88a78dc25ebe5de195e5bf488a
SHA512ec794286f8159c6a9e1ce62f77211a1511ef8f994b546f1553a616c4d207c61728640bf212d6e484114a36dda030af6f05947d5ac50d63de6b1c8938919225a4
-
Filesize
372KB
MD53089383be8aace52e0cdb836b27f82f7
SHA11c904ce6db34cdc83df468ff9df2ad65089b7a03
SHA256b6f6a877318f1162747afd0a879dfcd9629825b3b8c94f1084a7f9d794f37c8d
SHA512cf298ddd4d05ad5f514e9963e6ec5eba3df15b190f751a94311fb29dee23b06af050e97a113e55420eaeef00d2e916d557a8d62c289be5f9622f18fb7217a951
-
Filesize
372KB
MD56dff744771dd2cee00b2e187a9b5f68c
SHA136727d2c316eb8f5290ba0b040c3c5ab34bd1806
SHA2563e905bede5c44b679c196ac79221aedf22c8467d035afcc0f5dfcae99ce2d098
SHA512eb96ffe94007586f31b47aae4ecac76cdfcd901cf7f34b61633b4165e8886f3e969176caea7fa0b622eb6aef475204eb587f5790d868d44422b79d89872ab3a2
-
Filesize
8KB
MD501c08fca73c93e39b0da970f14900346
SHA1e7c42b67312c392606e292cd31a81f3b69bdbdc4
SHA256ad95287f7eb68a877b26fa8f288288ddffa51ef2ba6926037b424bee35bdf7b4
SHA512dc04ba982d592e30ee1c870a34a99e537e7957e301ba37aee99e20bd61e89dbdfded0a9b31ff27f137feb47f29e6304e26e1fefac8b52f9df3829a05e97700f8
-
Filesize
372KB
MD52af1348efc479a14c2908895576e2db4
SHA1f7e1e4f9e3f8c211c0c38f009d87ac3718645410
SHA25630a349c42ccea4c751e94f2d64a742cbdbc3301c81306262f9aa7261b8262d9b
SHA512a6693814f2157f9c666a6d26cd7e06e67ab0ac2e0b9e5266de7210ae89f2145de9489afb582aa98dcb09c5a94578203ef9755c4cfee02ea6b4647eb41fa6fe70
-
Filesize
372KB
MD5553ec6c633b701f38090a0fb6ec8ca38
SHA1c86e0e7cfade3c40503b283759035b9e01a85078
SHA25607cddda86181688186b5e0f5aef51df88fe55c109aa489012a45266b3ac46b60
SHA512ca19e50f2f8f0ff2d70c996cf3dc49f4f43026fc62db723e34ed7a5cf6979d0ac2dd9423c706322e10587d034117a6bd17a55c5d4f7098d103f71d9988481264
-
Filesize
372KB
MD5a20c8e125b28b23e3e4d8542c4dff747
SHA15f3ad0bafd37c841d5dacbfc3d7aff19c1e1fdd4
SHA25619dba02325c186b8d92bcda0e4d6e40a6b9bb52b0d99ebfb955cf3321c78ca34
SHA5123c290c370b99d2462b31ecaa7cd7d229144294102d5d791302e70dc544d25e60c2d8550e09851ab38d3553d9f0bd859e5d3f827da8bfa261531b70bde993d560
-
Filesize
372KB
MD575b36b62fe7203af5c1902092dec8c6f
SHA1409f8200bf3a4152462f4a7969ede1e1fda3dd80
SHA256f05d19aac000456a0f76ac009018d6dde37fcb42e75cfc3585361a5e703f22e5
SHA512aa5369660844d6515a7b4a725d887d18bb28f47656feb9b59f9d48f351db297e90f61a9694dfbcfd56e9e2779e56e61f67fd7fefb443c7c2121c6ee828b11157
-
Filesize
372KB
MD55c9ea2b74af44f8b59bb0b4bfecd1c43
SHA19bd083f6e36250159739e470143819be77d14f16
SHA2568576a4803be1b32e776ce045ddea8b80414a31c793f9d028990d34ce3036f8e8
SHA51280564728b2317f41df869c6a830c6fc0843ef577f8d37c491c4e0ea6b3016b3166d4ed210b036ef3c84f3a71cce916dfbe1ffc8e696644492fecf3070fa9ffdc
-
Filesize
372KB
MD519f9a84d77ae0e4389319a0196c1856f
SHA1e587e44e2852e8a2912916400fed038c02e1dac5
SHA25690c6b69c835974b7c8230818e81d56975b2dc14606f6288472141184aacf34b7
SHA51277b96212d7d152e6004e2ba5394e2b380128e806181d3ec5caeac7830cbbe1f454eafde4e248fb6b7a58de1fba01721947e8d1e2f80ffe7460c797d96bcdfaab
-
Filesize
372KB
MD5ad94d2703033d6ba024cad913d23f920
SHA1f88feeb426e9f164f9e61bcf6470279b5a3c03c5
SHA256fb5ff0fb5b26f8370413d8ce540840da2bba20275b98b339f6ad53f4b2114b21
SHA512b760e5520d6f0314e32ec409cb686a04706b68fc717f1c2c696a86e81eb19db76183a073595a310bf56319f19f4ef536286311be154c15a84cd781c61ed172d4
-
Filesize
372KB
MD5fc7b901a93f999acf7bfd30895d3ecd5
SHA1d85e159f6f966be870b4c823740c2f4b2f2dc29e
SHA2562502623aaccfcd3e48a0be7115f5614b6748a0b5b97db225159c0052d110f70b
SHA512e0de48f393a4a340cb7a5d03ca97aa3c04d271fbec0994e02d3dfed2e09a2e51d3058ac568c2acf314912bb971d010265dea01d5d97f2cb1217f50f8322a4f7c
-
Filesize
372KB
MD55238b5aba9147792c099a9785b5b1abc
SHA18fbcf60f928bfaa063d16a09a71759522bd41325
SHA25676ac196978085155b07fb19c3403566e8a3ff5751d52d99120dcddd4a690b119
SHA51227ed6ecf99758d5359ae62c3f105134874ee922a6830a067579df070672089b12af4ddc485a96ba454b8d5ed1037fa9fcc4affec49a16394769a2346a306c1fe