Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 17:52
General
-
Target
2024-02-12_da2c2cf1142e70c0ce17ffdcae24b2ea_goldeneye.exe
-
Size
180KB
-
MD5
da2c2cf1142e70c0ce17ffdcae24b2ea
-
SHA1
5afcfbab71f3e249b232883f144c51f31df1bd0d
-
SHA256
2ec5bfb79c417c6dba57c887e9432eee36904955dd48aaba2ae21351ebd8b0c1
-
SHA512
11c5fdedf2091b9464f5ce52caaac6ac53ac3e603e679f84272c492aa898a6666908128684cb9dc3b08cde481668989ca06cb099437106dce521105165c49826
-
SSDEEP
3072:jEGh0oplfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGTl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_da2c2cf1142e70c0ce17ffdcae24b2ea_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_da2c2cf1142e70c0ce17ffdcae24b2ea_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E46C2F6B-5D47-4d2e-BC2E-F1F4EA0760D6}.exeC:\Windows\{E46C2F6B-5D47-4d2e-BC2E-F1F4EA0760D6}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0851E72-EA7F-4683-A049-C2BDFEE8ED63}.exeC:\Windows\{F0851E72-EA7F-4683-A049-C2BDFEE8ED63}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0851~1.EXE > nul4⤵
-
C:\Windows\{73FC9167-2B33-4bd7-BEB3-33154EE82F0B}.exeC:\Windows\{73FC9167-2B33-4bd7-BEB3-33154EE82F0B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C303DDD8-1C12-4978-A209-D435F9B62244}.exeC:\Windows\{C303DDD8-1C12-4978-A209-D435F9B62244}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2029028-2848-407c-9F50-1B931259DD86}.exeC:\Windows\{A2029028-2848-407c-9F50-1B931259DD86}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04EF46FB-E5A4-4269-9412-7DA6A9E253DF}.exeC:\Windows\{04EF46FB-E5A4-4269-9412-7DA6A9E253DF}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EB246A7-FE11-4876-BB99-5E10D23E122B}.exeC:\Windows\{4EB246A7-FE11-4876-BB99-5E10D23E122B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B686D3A-2210-4b1e-B5FC-6C31704274E2}.exeC:\Windows\{0B686D3A-2210-4b1e-B5FC-6C31704274E2}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A80D7920-08F6-4216-99A1-F2E8FBEE05D9}.exeC:\Windows\{A80D7920-08F6-4216-99A1-F2E8FBEE05D9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26A94554-6A2B-42f5-9BC1-C4F3FFB95D3E}.exeC:\Windows\{26A94554-6A2B-42f5-9BC1-C4F3FFB95D3E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AC734B1-8FF8-4514-B6BE-E0E64FCF238E}.exeC:\Windows\{1AC734B1-8FF8-4514-B6BE-E0E64FCF238E}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B685E7B5-CD6F-4e36-A11B-67704A60CA89}.exeC:\Windows\{B685E7B5-CD6F-4e36-A11B-67704A60CA89}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AC73~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26A94~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A80D7~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B686~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EB24~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04EF4~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2029~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C303D~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73FC9~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E46C2~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD53ee4810d179fc27f6504a89dd6feeb7b
SHA1a88264e97fe38737faf4e3b537d83eae6a83f490
SHA2562d220ed909c6ee426fda9fe886beab888c8c7861bb7aad454812a51b7dc89f38
SHA512c586412aa23834bc78fac77d03ab079611c43a23420f609ab8a809828552c51db2925d66b38c6ff0945ab4ea37f6d6e36dc28a5d07c2c54c7052c6d2dd6a6e6a
-
Filesize
180KB
MD513d54cbae35092f2011648cef5341474
SHA15d31c65c2b198c835a9fc8deaaebbdb1bbb7853d
SHA256043de33b4e11059f9643e000cf03b64ecd96fbdab3422fde119b2ba1dfdf19a9
SHA5120157e15fb5e21625d65197aeeaa8d20192ebf007c06e2364845ae46a6f5596e6f4743209ddced2cb2666f118ffa0661d5709bb501bcd795d4a84b14c78f059f4
-
Filesize
180KB
MD524094246e7142ccc2214e8defe5cfd10
SHA14ba9cea4b08251f1a59e345f4c2eafa5b20b2bbb
SHA25622ef51c611d919251c5a3637ff6caa8a213bc64a53ebbf5f025a03b2d76511f3
SHA512b18b3c5b71898c986b55d7e26673ff65b5df42b3303cc74c144f0a0215624d12362d5a3bda7d2fe6b50d3fc5950572c3d055b47686d8d2a28cf8f57e24c33397
-
Filesize
180KB
MD5cf5423f6bd1f354727d4b53dfbe5c771
SHA15e5be81b78e28007f1392b756c909fa4d171bd9c
SHA2563409638c0bd3b9ae4e7d685a19ea4f00d368011f427a3c7447bd01f93e9dcdea
SHA512bc5bffd17a3053a0d79c4895ad15ac71f418ffa7e832bd82383f8ac85c23b0f7ced085581c93a5f73e86cb58521ac60d3c0e8fe14b563d41f178136cf5ccb8be
-
Filesize
180KB
MD558fa315cf77dde5e9b9ea4dfe287d4ac
SHA1f9c34aaa86e00de21d61ebe21f617e0bf463d77b
SHA256fc9bf58bd6474b4f93572a8995c28fa88e7342c921cd56f298ae61a66a68fd3b
SHA51259d9e11d6d8506bd8bdab8ba38382b5361b18550a3138099ad6894d13179b162868df8e89681a58d4fb9c85fa2dfefd13db588e87cfd55540b3c3a1c17e63ca2
-
Filesize
180KB
MD549354d37d5ada96994666a094ddeb2d9
SHA1270e1e325803bf242482f33f68c6b1fc868d9429
SHA25630277bd2f2e7ed45233c5f312a8a246f1cab854be752f43a6e4f87d66b2f5320
SHA5126b9dfb490acaa11d679c6a7ba8ee1a6155e5ed60d3cebe4fd672723edca4de43010ab06fce72c1aa9322cf9bb382270f5578d14820cf9f637b99dc81753f4c07
-
Filesize
180KB
MD5aefdb10a96bfd816f1b8eadee9afcb0d
SHA1cce49350837b7a7afca7b80a3845195891a718f5
SHA25668fbc783f322b322c6b0fc32f9bfeb8f11ba837ca885c88e8e1fbf6c7f6d0df5
SHA512ae9d061076de48be65bec1a0f04476e10ad92d82c03d195a24e7fa22a0706058ea085b3213737a979b52e89e1f0a600e646e270aaf45f185173850e8eaefdb68
-
Filesize
180KB
MD5f1453c16a135e525fa1f79c44322e9e1
SHA18fa1686a60d28d9570155d5ba00ef46cf6da022e
SHA2562a6dfcdb19b5d72961ad0d0f62b45ba14fca87e6d312aea79ab80dd857f07a37
SHA5129293142b75b4e06d86d519ee5b12dd5f919e988637734e487ff93c8b914d211dab591d7aa6d62989f99de7b6fceb68de40948a289b2ff83cb4ae3f2438858c84
-
Filesize
180KB
MD56766d62b1c10590ef9598da7a2f8b527
SHA1d9a87f843d3e2da5542d95357a5ac718154d14a0
SHA256fc8976371ca072b1c212317ec34285641d8855f6f03df25a72990c78f86dcf63
SHA5127b715d85fd4042ddf6f0f2e8e4eaf3df1eda868ff33a276f8fd4887cb620f9e681061f95ae17c11f935349e2700c03b8c66661e3f53902af63a0472e19bc5153
-
Filesize
180KB
MD55b31080673df693dd4b5db707bcca507
SHA1d2b99c59b290008b42cbb2904bf34a96f7be854e
SHA2566af8f48b17d9278bff3c512589099968e3df86a5482fbdc0ef4de7d538960c5d
SHA512e75bef508ee33eba0fe251874c73f3c35d9163106958f5e98f9d78d1ad03b5dba6e3d9a4545fcac78531be8c8b0070a260e2b3e5aa508cdd088b6050a5aabd21
-
Filesize
180KB
MD590e49210845d709fcacb97c553f19975
SHA1787a4e6927f9bc55494b8a808b4165edb511acb8
SHA2563ad016667a36a8453e3e0f354d77f29b153a983cf1f8ebc816aa88de92389f46
SHA51277eb1cf50baad44239446e7a5473b45e52202f25e75cb7d96d243e9914afac26859b04fa165f8c6dc76b20b5b99df7a2c086066408634797a4da13689d9d6727
-
Filesize
180KB
MD5bdf4e26ac6f47559bb762043a816c187
SHA19c9d0574cc1d8952417894ae64d1dd688f1b6101
SHA25676f4fb02d8f35939d0aa33e49cb7b114b82e5ecdcc7d99faa6506c1be36be7f1
SHA512e059f45aeae3c905caf47ca3c514a89eaa49cbc78dbaea8a69e610a2d2209942804f6012bb5a82287c71a6cd27b1663e1901ee4b8023c1f0bb71ff7830339284