Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 17:54
General
-
Target
2024-02-12_e7c152293bc1412d0d44ac4e0e252dbf_goldeneye.exe
-
Size
408KB
-
MD5
e7c152293bc1412d0d44ac4e0e252dbf
-
SHA1
efd0633ff3c453f8d530496ed539b2dc82401099
-
SHA256
6e692d6eab37f23c74ee44f194cadabf00b0f68e0b4f190127115e92bb31bac4
-
SHA512
28a9b03613f066b122b2232013fc6314f85526692b7731a54d3249f94ddf588927baa5a577033a100b69c19dc63a72faea82074365e1591f9ad94343d67c6964
-
SSDEEP
3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGcldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 14 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_e7c152293bc1412d0d44ac4e0e252dbf_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_e7c152293bc1412d0d44ac4e0e252dbf_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8531596-2F3A-405e-84FC-61041A4145DE}.exeC:\Windows\{E8531596-2F3A-405e-84FC-61041A4145DE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC56B0AE-B4D9-44d4-9D2C-3DF0071E11FF}.exeC:\Windows\{DC56B0AE-B4D9-44d4-9D2C-3DF0071E11FF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC56B~1.EXE > nul4⤵
-
C:\Windows\{69CC9655-8AA3-4ce0-B607-40913C920B62}.exeC:\Windows\{69CC9655-8AA3-4ce0-B607-40913C920B62}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A70D8C64-89AA-4944-B7CF-B8BE374BC508}.exeC:\Windows\{A70D8C64-89AA-4944-B7CF-B8BE374BC508}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7EA7EAD-F984-4555-BC67-A72ED237D745}.exeC:\Windows\{C7EA7EAD-F984-4555-BC67-A72ED237D745}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DC62176-3DAA-4481-9F83-DA990C8DEB9C}.exeC:\Windows\{7DC62176-3DAA-4481-9F83-DA990C8DEB9C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4007B88-5AF3-472c-836B-79F2F60010C6}.exeC:\Windows\{A4007B88-5AF3-472c-836B-79F2F60010C6}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF846BF1-4808-4b40-8EC7-452C43BD5303}.exeC:\Windows\{AF846BF1-4808-4b40-8EC7-452C43BD5303}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCF8F896-0EAA-4e01-8034-2CE3BC317013}.exeC:\Windows\{CCF8F896-0EAA-4e01-8034-2CE3BC317013}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7B50A7B-44E6-42f3-8E18-3B57A617ACF5}.exeC:\Windows\{A7B50A7B-44E6-42f3-8E18-3B57A617ACF5}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C75E8FB2-95DD-4aa4-ABF0-A12DEA0F0D7E}.exeC:\Windows\{C75E8FB2-95DD-4aa4-ABF0-A12DEA0F0D7E}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1B583FB7-CDE8-4f8a-BE30-9783B82BEF1A}.exeC:\Windows\{1B583FB7-CDE8-4f8a-BE30-9783B82BEF1A}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C75E8~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7B50~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCF8F~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF846~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4007~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DC62~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7EA7~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A70D8~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69CC9~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8531~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD566a28901fdc0eb5d60b6c99f74b15eae
SHA1be4a18dacc12f291786f83ca646eddd286e4603c
SHA2560d7bce4c0e5e81ffc8fea4049a86cd12e4f47dd694b6c4fa3c549e00362f8d84
SHA512343544ba23fc1157eaf8b8da38da0e79a35b5e39f01bb95263110c1f840da675db9ec5f105b39a18592f80f1fbceb9f9aa1c60386397e580573d3fffa3ff31d1
-
Filesize
408KB
MD5e0dc01c12932d0f82cc022360fcbfcb7
SHA13ed5aa4a174ca8c935d3646cbdc1ea23fecb44a6
SHA256df606d885a7f17647fa5ca5e5a9a8e70b0391e5a33e51c1e5762dee6fa27b332
SHA512f2f5e05595aa87ff922052bcd93fc3057d6ef35c237002c5df38e8a80ef7426498ead6fa50921724b5525d077eafda07fbc8c6e32870105e91f22044c11e9aae
-
Filesize
192KB
MD5627cb7c3f6d5a4c53fcbc96431b77089
SHA1ce0d6f66edb52cfad377df925b6f48304036b50b
SHA256939205dfe917a304430c9ed73f87b4a01f50b1bc81e7ec542d8f866a311448b2
SHA5124d3bbfda136727d29c7621ea1ab6ae06e9b4b990da5e92b71dfb39778ed216b7e27925a9368dc1276216ef07eff1c4ce0506a17a470f0bdb07f09116cc98b78d
-
Filesize
162KB
MD5f3511dbec7282a1c2b29ec993ce809f7
SHA1dd2f3f6bdf9c78c68891c8b41db4b3dec5725579
SHA25668f3e540b6d5cd66cedebcef180d00c28f6a411dd1c9eb36e6a1d8d178fb5509
SHA512b04060af8f44afa16d35dc94f973a6774d16cfd103b77cea69533479a932efabfcfd8220aa155be1d91b93ed9da6b240844c90e60c477e56175d7f2635be272b
-
Filesize
408KB
MD5f5c74dc02d93f3cae8d10f023078293b
SHA15217cc837c162b7fd035e9079bfc0893cef7309b
SHA256946204aca9f6c84c1a3eb83c3a1895bec7770015f038771b717094b99ba6811b
SHA512b07d24d8d5a15290eedce43b801a02af497174680ec2d987604dcf7d70e8abc52642c497b9484f2ed20106f51a85103433d6e71b838323f50d0bc9a1911913b4
-
Filesize
408KB
MD5a53eb85695f7101fd817bc5dbdbb6a35
SHA1018b170d8421282a61ae52395514d2b26b05c7d3
SHA2560b87d69b62b62042fa67a0670d2c5aefe0984856e1aef9a0c9926f9a1f8f074d
SHA5124fd336bd97a05612db97257c6008deb7a097c364e014184865fba98e69caf46e6979516117b341f664dd9314e2a68e67a15d78e91b1387ae075e90596fc020b5
-
Filesize
408KB
MD51c8af5bdc7b67b5237c82f08ae3c3383
SHA1b081c5c94a68d8fcbce10cddaf6423a854347fb9
SHA25635753b9986a15a84a9d40722d09e0fab6decd7f0514dfe9a7025c85d83a0efb0
SHA51281b33cbe4a74cda4089ec8009bab5bb14063a187b336f823966503b5db8b14c9e75b24cbdf358b38e0f0cbb9332d1efb2777e717ab90308ebc10c87362b70c81
-
Filesize
408KB
MD5a9e83ed8fec74907bac925ef6afe10ee
SHA15944387fe1649c888d5f7b220ef3dbe58c98c3da
SHA25644fc5e3922af03a502cf6225a21db7080eaa2faedba083a06cb7f8e3e3ba8402
SHA51204d338a1ef68b7735cd2a1c96bac538ec1fccbea628cf1be4e016e6485deb968235945ddea2ede2469dbbf847eaf428baf9608090afc9652963ada7342a03dbd
-
Filesize
408KB
MD5aa8e5b309586a9039839e5e9e5ad17cf
SHA103b56ca5743d354fa0cd94b0b755668d1a162062
SHA25637a864e34fa87a52afe6deab31abe83c0eea2fb972fa759a8bc5a68d7d7f67db
SHA5124aab77a6f86527fb797a505a53fd7fa4ffbec80d6ee2fc4f8e21e1e2cf70b8785637146f44fb5021ffb04cb765dbd7baf5311ea0ba775d6b4ad5fb906838a099
-
Filesize
408KB
MD522cc946ad408eae37dfe88c666126a1f
SHA11ec1e7b9c1080585df5c57080f28f4244eef14bf
SHA256ce804cb008adffb72475cbc5aa0220bbf59e4e1c81af0320bf1a041e6fd13120
SHA5129d60a57af9880d5c1bef1e33b8c648dc7bbd98630c6201a8659e54bf197a3d28b5b34e49d2c443217772dbe7b73e4f5691c856e10c06a59b61e4afc627bbc492
-
Filesize
408KB
MD57d7382e4120baf252d95953dcde7d67c
SHA1a0bb4d769f181e663fe19b97e9e68d5016a68367
SHA256d87350ecfd8f8d360c47dc7c5adbe3c6f80775a60bedb605725539653f9a1a62
SHA512810040749028e54a76a39119b7b9151493c69bcb0f7017291b3260ed220ad4b2df9412ee4aeb62d4aaea0470dcaae726b46348aa724632d741d97057dc5474f5
-
Filesize
408KB
MD52d9c79ef4fcea0d4f98ed59cd2de20bb
SHA146725c51c28cc1a6f244990265aa198464dd0006
SHA25641184865ba953596722432d985e20d092d909ff8d152ecc05c238f4d10068142
SHA512965d5c05ef9335cd0121ffa564b4f39ffcc5c8b81264433f1f12051ebf4fd1f775985895b647c13fe0ab862a44819b0e82a9b2d7f74fa181d9d8d41ab6459490
-
Filesize
408KB
MD5c5b9a5dfe949aa141d69f7e89ea48b85
SHA16c89fe7aaee1c2c59ebdf5f04adb10de06aa9550
SHA256d38de91b39b06a09e501f34da84a9ef5958de1e9304e371cf62a214ef25dc6c6
SHA5127cdc9ac24bda453ca7eac720973cb22e03fc039938db13217316c78181f73422e3b292d3300ffe4ae84417ed192db74fa6a4863905ece167a02fa2cdeb15fa4a
-
Filesize
335KB
MD58a5538d17c1cb85ce940044cff22ac0d
SHA111220459ebd30935d1d7ce609c70d07cb46e4929
SHA256ffc3195860852374ff7b796d02f2ab36192f412f546fc453fe277bfbbe3f27e9
SHA512cfaf310268a8c0d6062c65a48ad47d6c8afbfd298a196875b051d5e7aa217c91b4a84cad6f1e756892f7797db14dd8e9623acfb0b7f08172a78af176577f15ad