Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 17:52
General
-
Target
2024-02-12_da2c2cf1142e70c0ce17ffdcae24b2ea_goldeneye.exe
-
Size
180KB
-
MD5
da2c2cf1142e70c0ce17ffdcae24b2ea
-
SHA1
5afcfbab71f3e249b232883f144c51f31df1bd0d
-
SHA256
2ec5bfb79c417c6dba57c887e9432eee36904955dd48aaba2ae21351ebd8b0c1
-
SHA512
11c5fdedf2091b9464f5ce52caaac6ac53ac3e603e679f84272c492aa898a6666908128684cb9dc3b08cde481668989ca06cb099437106dce521105165c49826
-
SSDEEP
3072:jEGh0oplfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGTl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_da2c2cf1142e70c0ce17ffdcae24b2ea_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_da2c2cf1142e70c0ce17ffdcae24b2ea_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F223A4D-BCC6-4fd5-BDBD-6DE62A46AF18}.exeC:\Windows\{2F223A4D-BCC6-4fd5-BDBD-6DE62A46AF18}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{764293E3-AD17-48de-A64B-B79C42CFF39F}.exeC:\Windows\{764293E3-AD17-48de-A64B-B79C42CFF39F}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2D22CFA-E8D1-459b-BF37-532DCE365CC7}.exeC:\Windows\{A2D22CFA-E8D1-459b-BF37-532DCE365CC7}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2D22~1.EXE > nul5⤵
-
C:\Windows\{B879486D-2961-40b3-A73A-E4A858ABA287}.exeC:\Windows\{B879486D-2961-40b3-A73A-E4A858ABA287}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC4D0DE3-F8AD-4d1c-BFF2-1C5D321588DD}.exeC:\Windows\{DC4D0DE3-F8AD-4d1c-BFF2-1C5D321588DD}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E8B8104-A6B2-4175-B07D-30145684B59E}.exeC:\Windows\{0E8B8104-A6B2-4175-B07D-30145684B59E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09D6663B-2EA9-41c1-8155-E24E014A9990}.exeC:\Windows\{09D6663B-2EA9-41c1-8155-E24E014A9990}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6128B6B-7D2E-4113-BBBE-4D7EC7BA5796}.exeC:\Windows\{A6128B6B-7D2E-4113-BBBE-4D7EC7BA5796}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6F897508-C214-4789-A0B4-87CAFEB685BC}.exeC:\Windows\{6F897508-C214-4789-A0B4-87CAFEB685BC}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1EC7DCFE-4410-4d28-AC62-288C47E0880E}.exeC:\Windows\{1EC7DCFE-4410-4d28-AC62-288C47E0880E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A787FBA5-6B04-44ef-9A48-789B4379FEAE}.exeC:\Windows\{A787FBA5-6B04-44ef-9A48-789B4379FEAE}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EC7D~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F897~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6128~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09D66~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E8B8~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC4D0~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8794~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76429~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F223~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5be270dafced690088a13771a4bf40a48
SHA1b13b399ba7d877ad54afa26d4b5f0fbf9f311721
SHA2561e0a8eaf28cc8d2e0c3d1498b0f1df26b8745ec43ff10a2df7be47fac7806213
SHA512541a4b8965b35e00a0249b53e8692cf67514cc394ac94e77aafe99761eb9c9c5952a1da931928bd48341d2f9dd231afaeba558cb7c8922249e890bb8a6eea80a
-
Filesize
180KB
MD583a0d435a26589026b109310101b77d4
SHA1a016fde8573bb4b481b2ef962b315a04437dfe04
SHA256d2a94d3dbaad86832fb88afa0a2e9b2270f3f995f2b5a9fe48daacaab9e52ad9
SHA512a8706c45bbc86696ff5fd672c5040437b62cbe761eda5fe1750e85c19237b5cb6d7fd43865960106ca6641908079d6689896b73da0d2043b94d25f47fa2195b0
-
Filesize
180KB
MD57a237cd4644c3e1a7acdd6980140088c
SHA120f61ac9b0f7d5522a83ce1d32b8c81faff641a8
SHA256e871d01d22d839ffb9767bf01ba4c7b737a896da618f4af9085432e1dab32657
SHA512c5fbe14ccab7ab3b04749f4036b94473dfc7952cf4de7ea1b8d23ebc57546cb9cc3527f6c1c57c8160d01dd17608b2f2d348fc37120a356296b43e44b3de83b3
-
Filesize
180KB
MD521e029d1af73c12b19be03781f319117
SHA1a109e1397cbb95c60ca689a1ad92a9b25453c241
SHA25655ac244023afbe85558ec7a5355b3fc1dc4ac439fc4bbbab0129c6ef6af1a145
SHA5122fae8da1bbbc4995ae12f5ca8c1313964f70482525b19a05a887a7ff1b153fd312426ce0bf8cd16e3588e36cac4b1c33910e14365496d61dd9e7bc98902e41ad
-
Filesize
180KB
MD5f0caa74f3eb42483c30065adcc4a0fc1
SHA11179ee5c031802e13193f15683ebbcea62e75759
SHA2569adfb916b9642dcdc47010cf4ff3fd5a84a8bed44512bc5f30100de109972115
SHA512212cf467bb8b21fe0b6f8528511806f4e84a540183618eb8c23361744ee66596150e2782b145b646b91e762102ed58b1604ded094a42cff1fa444dc9f4a8d6fc
-
Filesize
180KB
MD5809d0c51c0e24acf2624887d609b5aaf
SHA1a16fba0ce185ce3f6f7d41e2758ffe5d654665c2
SHA256bfbcc21e43d2a136e3c8edb1440fc3adc656d9ba11ac211962706ed0f1fa485a
SHA5125efb22e2a40dc6f6cdaf188db095c6cc09f66789aa78d64b08c1690506589fbf0563fb64661cb07f7ff38e12854c69aff0791480a91ca6adaacc7fe738116094
-
Filesize
180KB
MD581a96f8314b1b3b53443e2f049116657
SHA1a559293d75e3934cc42184865540852525155522
SHA256f33098d80b74be14666ada7f59182050783b226693a9286a0246f92c9e65edc5
SHA512fb3558279d97705f77838e07ab6b4e3b01f82d843076173a5e4ecf8cb43606e27db3d0fc732b914b23c2d1f24384f0f8b056433438fef9384b6053c20b6df50d
-
Filesize
180KB
MD5f5a44a45af3415147dc1aad668e0cf70
SHA1c1bbf684b37b951f2fa0e95e9a6f7f5a604b73c0
SHA256fc5eb08c3c14ecdfecda580bdfaefcd1fa852ba798a07af46407e679e08fa631
SHA5120fab5b3c13bfffdb6dc118a73b4b70195544a0dce2594ceb6bf0f4981a3b1d0a318f6c967cdba1af61af94a7a4f4ebfc42b455457c24c7f37de26cd79d68990d
-
Filesize
180KB
MD5d54730a409296d1569b58738eb01b8ca
SHA17e68018aa2937fa37f900b273f2c7291f49213d4
SHA25648789fd03651f59e8eba1fd10ddfa07b6f17858a488160dac0002fea1fb40492
SHA512a6b34ad11dfc4f1a72d52b9979afbe703e099081764e540fc296ec055768e94b92f6b43e494828d2ae39becb5ec298690c7dc3c96663fff6d46e9a6d882703c3
-
Filesize
180KB
MD548a9ceb84bc191227cda6e22aabcb5f7
SHA1027fec1ebf6348a7bdc8001af25413dab33f6d9f
SHA256d6d537d0c5077bc9a518aa3666132b5a2b2cc93798a95eff53c029d9cc4b4591
SHA51230626b536ef3769ded5adac7a8ddef9c9474de1d8aa171a1317035c4d6242843f50a8b0c699e36a4256d7755e56555bfa76095ad2b61546e3db141755a4e8551
-
Filesize
180KB
MD59dfbf59eb00442afac40a80017f998a2
SHA198e82023103b01fed1e89f85c43e578fbf7d6d3b
SHA25681003e8c0a7724b79578d3726449b1603404935bd4c50b6a8f032dc479d86bd9
SHA512faef311e69ab5561aec4ba9aa19fe45cb9a298e56c8da8bad752d30ad7ec4b3d2d16e1d5e4af13c6f3ecc003f711e4358b460f2b254ad860f74d4ae2f223b5ae