Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 19:22
General
-
Target
2024-02-12_15f977738b53211c934abbb34676df42_goldeneye.exe
-
Size
180KB
-
MD5
15f977738b53211c934abbb34676df42
-
SHA1
1baf8df446b4ac9bc884c18dffd7cc84414602ba
-
SHA256
9f934c1199d2d4575c805b189e5b875c9c735daa6da909d4ae596fa78307ba46
-
SHA512
16ea8b7dd5f0910609ad7a4b19f60744e658b543d9a1b5e499d8990ef559d42fa3044b9707e36f9704d2463e3d6b12091e798b4658de191f4d23f4cbb01ba88e
-
SSDEEP
3072:jEGh0oUlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_15f977738b53211c934abbb34676df42_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_15f977738b53211c934abbb34676df42_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32FBD9E9-A634-4c2b-883E-BD66C52AE9C3}.exeC:\Windows\{32FBD9E9-A634-4c2b-883E-BD66C52AE9C3}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40D68BFD-CB37-447b-83CE-DD70A78528BB}.exeC:\Windows\{40D68BFD-CB37-447b-83CE-DD70A78528BB}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40D68~1.EXE > nul4⤵
-
C:\Windows\{08B04805-065C-4ee9-B7B4-067BBBD3F97C}.exeC:\Windows\{08B04805-065C-4ee9-B7B4-067BBBD3F97C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E54EFBDB-23AB-426d-9D4D-372315C42785}.exeC:\Windows\{E54EFBDB-23AB-426d-9D4D-372315C42785}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE2D77C4-C536-44fb-B371-071765B3E72B}.exeC:\Windows\{FE2D77C4-C536-44fb-B371-071765B3E72B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2416B499-10B6-4452-BF87-1857E38AEA22}.exeC:\Windows\{2416B499-10B6-4452-BF87-1857E38AEA22}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B24C0900-607D-44e2-9E86-75D20E2F2306}.exeC:\Windows\{B24C0900-607D-44e2-9E86-75D20E2F2306}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5785640C-F8EC-4102-A0F7-8367134D8FB4}.exeC:\Windows\{5785640C-F8EC-4102-A0F7-8367134D8FB4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B9F7D5C-3251-47eb-9564-B3EA393E1D93}.exeC:\Windows\{8B9F7D5C-3251-47eb-9564-B3EA393E1D93}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E82D1422-AD31-4bb7-8873-04ABD111ECA4}.exeC:\Windows\{E82D1422-AD31-4bb7-8873-04ABD111ECA4}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D6E8BC6-4A1A-4bbe-AC11-8ABAE3F39845}.exeC:\Windows\{9D6E8BC6-4A1A-4bbe-AC11-8ABAE3F39845}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3CD4AA8B-4677-4916-A7FD-463105C90C00}.exeC:\Windows\{3CD4AA8B-4677-4916-A7FD-463105C90C00}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D6E8~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E82D1~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B9F7~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57856~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B24C0~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2416B~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE2D7~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E54EF~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08B04~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32FBD~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD572f40f50e697abe38f00a6b4a39b2656
SHA1ac5540a06727269df86b3b36f08aced6a1c42f3f
SHA2565603e80f2c57ec2db76fa93c3b2fde09307c937f48b5c0439038f1bae8ea80b9
SHA51297208edc7438b60c5bf0ac4c058b640cf0a631b29bb94f21f54fb0e0abbeea9cea50e1721c2d1f05c09e34022782fcdc59618b6a1a79660593e1b701f43080ab
-
Filesize
180KB
MD5cb380698646bb5daebcf0b338334bb53
SHA18401783d2715fe9bcd4eba255a23c9aa1b057cbc
SHA256d873bc7b9b6e8df014158cccb6f43521c2f5a2e34830dfcb371e2d671587a92b
SHA512fbc15ecab32dc3dc5b6f85941f7188c9d83712931bf8b85d81d51876c07ad3801af1ce9ea0c46a671c51fc9fc16d3d41927d6a7466843362bbf3f209be83b497
-
Filesize
180KB
MD5a342b19f7eb0e9907e237b478c287340
SHA17660dd112fd8501654e6edd8faf4cf1884b8a627
SHA256e6df068c248d1168b13f370263036f5d1211659c5e4c7e50f44a6fe3a08b7a58
SHA5123ee0d64f8be5cf3ced96675da19ed2c15a11a45e6c7e991f339c7791e3d4f6c2918379a464ef03f3b83a8596ec5f95e00a3dd124225e7cb3545c016457d39983
-
Filesize
180KB
MD5a7750723d966b9f4fb4fd6376a15eb99
SHA1e56f7d6e207bebec75e35c2a1c14cc80d97e5b3c
SHA25612112bc3588b4ae891380f0852cef51c677c6264629d7503a2e05448507d1373
SHA5126990aceb33f6ca0ffc2c09a9fc480d481f397d67700217e90585d117d3bf5c5725209ac4fb5bd2a6ae7097b6d7960edbd55da98cd409bdf02258adf3ab548454
-
Filesize
180KB
MD5893b939daea43f3893fe0a26089929d9
SHA19c12e6f368ee128111e880818acaf3204df9ee43
SHA2564f2aefed22bd3c98735bc4fc32fa4cf7237765fc1b6a130adc9cb1009143fba2
SHA5125a880945c3dbd764be0b4b081b7cf8033eb6fefdf3d1eb783080be857cb1c7aaeb68cb02ed4b3c880aac626fbd69e9ac5630bfe59cda7c0290f2f14bed321455
-
Filesize
180KB
MD5fd64e6f793cbaa4f42cebfaa060be0d0
SHA1670cc3047fc179a6a0e4fd593d568a7c699225a2
SHA256c105a9ab57577280f014269d715d17119ebf53879b15cd62ad3d5ade07686bbd
SHA5127432793c3f368b7200c403b1b2d2724da6775be364afbee7ee0ae591dcecee4c95370cca4604487dbcc2013c24a346832340a134b1849bcaef9a5240202dcab8
-
Filesize
180KB
MD597d492c115fc3bf1f09366200e1b6c73
SHA11c2bc62fd32493cb3e27d9bde249822c11628df5
SHA2562108d503fb02d9c4a10c778a5e6cd718cb7ff9ff6ab0ce2fb6aae4dffce56baa
SHA512b3b2c93fd4ea5e4b19fd92d9580d07ae73b020ec2daf89a4310589d12075f95b650799fc06293a90e3351d85b5bee7582c7eb9518fcc9dc2cdc89ed20ed1e5c6
-
Filesize
180KB
MD5d083e80401931e45f9ec9b3126c0d3ca
SHA11423fbdd5d0d064bc23c8c097fd992de51e542f5
SHA256cfa1cd85a2fb2dbab77503d7b1e223b1aad7b63cd88b300468ba6d083f49603e
SHA5123176d492c71249a5a9b9f6cc6465a678d1e9d484cf42132bdbddc6d382b68d471ec1ec8aba74b640407a58a94ca7dabb22cc70900edb7ae498112ab0d485acff
-
Filesize
180KB
MD5a6ea84cd0947b528e6df773a99ae0bdd
SHA1b0e0e2beef9d0a93c384fd06ed27444a9988e34b
SHA256549c205e1f9ed78e9f912aa622a140658c672fe8b937d3645e4ded5b67ecf719
SHA512fcf620b3294661d718a5136ec2028d709506edb16efb163599f175cd2453f38dd07dd460ea3dfa98234659100d1dbfff4356fb7c620135bf0bbbebe59339dcb9
-
Filesize
180KB
MD54373958371aebb9d937b6625712f6a25
SHA12402b1433200e8926c77407e196b562e3e81807e
SHA256ef845541db2ebc53a4a6cb47bc5600277520129cb123276c06c433c1d0b3bee9
SHA5121e5691845d188fecb226138a63ad5f2499f63548f120dcdeca6c8ed2aa72f3f752f7edd989abb91f571ff4568b4d4c252200bffb74d32a7b34fae72b230aa7bb
-
Filesize
180KB
MD55f18415dfa4c9b96ccfb25091e44a01d
SHA1ae734fa2506f3119b8341b236d9146b2aabb1f51
SHA2560aab9555b8b0e907db35bd2d4301a3cfb568d033b388f060a03a5d4d2ff045c5
SHA512fa642ad3934e7b33ebf7147a2422e5df5c880e3693484cc4a2b5f749a9ebb920bbbbc77e8d2250e1efc22753f530c6470443bf141bfbe1879c8fcd0dd99f7263
-
Filesize
180KB
MD5d2128dbd268314c29c0d58f5f550cf3f
SHA149ca984a1a72cd7d9bc57c34c9680066757ed5e5
SHA256bb961d929d07e2e1a51f0e33a3aa9d0e325a87a66065c6a71518348a89142bba
SHA5122309ddd4854ad3988cec4f06aed975867529d4d969189e220ef63acebd2799e601a088d9709afbb2029c63d4e697d3d1cd70f70e900c66c9aa76cffa47a8365d