Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12-02-2024 19:26
General
-
Target
2024-02-12_bcfc3df16adba25b9b2f9c723704dc7e_goldeneye.exe
-
Size
380KB
-
MD5
bcfc3df16adba25b9b2f9c723704dc7e
-
SHA1
89a494db31a590fd40782a09cb889101204a6259
-
SHA256
0c4457ce496935159ba5a3beff84db4ffb48e8c3d1f0750a4772243d88d22643
-
SHA512
1b5749c8a7211104a57a4e86d64d7469bd380ad84d4f9ae72b525c27c10e66e2089b787bef7c2d9dfca5fa2286bbed62a769213d173840dfea6d6433a3421f53
-
SSDEEP
3072:mEGh0oNlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGXl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_bcfc3df16adba25b9b2f9c723704dc7e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_bcfc3df16adba25b9b2f9c723704dc7e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56CCEA9F-2302-43dc-AD9B-74AF7EACCF98}.exeC:\Windows\{56CCEA9F-2302-43dc-AD9B-74AF7EACCF98}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8236E2DB-81F3-4227-827D-55EE35FE01A9}.exeC:\Windows\{8236E2DB-81F3-4227-827D-55EE35FE01A9}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE1C20B6-8BF0-4c55-8D64-46F028CCAE25}.exeC:\Windows\{DE1C20B6-8BF0-4c55-8D64-46F028CCAE25}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE1C2~1.EXE > nul5⤵
-
C:\Windows\{A680FE3D-8564-4848-94D5-AF7F6DCAAA13}.exeC:\Windows\{A680FE3D-8564-4848-94D5-AF7F6DCAAA13}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEE10B80-B346-4335-9232-B28A4165BFC5}.exeC:\Windows\{DEE10B80-B346-4335-9232-B28A4165BFC5}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8424E18-8976-4965-B658-B494671CD70F}.exeC:\Windows\{B8424E18-8976-4965-B658-B494671CD70F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBCEB609-19EB-446a-91C4-340A0D0016CD}.exeC:\Windows\{DBCEB609-19EB-446a-91C4-340A0D0016CD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3731BC76-D5EB-4e4d-B8CC-86CC16CD5795}.exeC:\Windows\{3731BC76-D5EB-4e4d-B8CC-86CC16CD5795}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2882AEB9-522D-40a0-8CBC-8A09A9AE1461}.exeC:\Windows\{2882AEB9-522D-40a0-8CBC-8A09A9AE1461}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{29365171-1B47-44a9-958A-D7745171BA83}.exeC:\Windows\{29365171-1B47-44a9-958A-D7745171BA83}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29365~1.EXE > nul12⤵
-
C:\Windows\{F0BB87BF-9E5B-49dc-8773-1632638ADD8B}.exeC:\Windows\{F0BB87BF-9E5B-49dc-8773-1632638ADD8B}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2882A~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3731B~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBCEB~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8424~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEE10~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A680F~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8236E~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56CCE~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD53019cff3b4176ba11879277d951b25e1
SHA18f9ba841008433021e443314e0a81087736bfedc
SHA256caad9e4f7996df9701fa62636a9178ddb6d94d698ae3b6c51a8eddb7f2560b4a
SHA5127d4769287ab680fe9d19b56d3b51d6e66531524c4f1a0be2c3856ecebc407c55757f2e65b24633f1708cd86b98752e2a9a0894548749f02b1fdddd2dcf5e0e05
-
Filesize
169KB
MD5fcccbc07893a9deef8ac76477a5f7a1a
SHA19c8b1b4e820ba08bb37c5c74275ea8f81b6f03ea
SHA2566596d133505d64abaebf8d1433632a3cc013dca72f5c848852a4b62243a8b45f
SHA51222448ca5dc316813e7f77cb8b7ff6de36dd773bc88a2959c823b7b73d08cfcc9956d20d57b967506dcb82f705de79fb3437794f56d2ab522f9deb5180e142829
-
Filesize
380KB
MD5d2932f73ccded1908aa36a928db77ebc
SHA1b3f110861657ae8e659dce794f8894979a2632dc
SHA2560f4e76d93e21bdbaa9704091378833b92dc25bd3f79a3cd03a7e9d67d528f581
SHA512b542e1c4ee9ae6aeebc32d2f875f2614e27873e9dfeaa4d408882a7fa64007261842fb74a1011db1b6361d2cafa6e44bbb127d202eed4092a24098a81f885eb3
-
Filesize
380KB
MD51ad4fdf20706f230102c3ba21c0024ff
SHA18d1c474739ecc354d01929ecb0ac99c2ed70e0f7
SHA2569c3ab15252201c1fe7116bf4f382d422caa96a354c99b677f8ab29876d712ec0
SHA51290721da42863c7c67445c6f26266868c853a770192d2f8a7d08f42b3ae0b825c0381de5e1243c6f29b826de9501b35aaf3e76cdfa7e383ae303e1c4034732444
-
Filesize
380KB
MD5db8fcb6d557654ccf1874466d5fcda55
SHA11b2662704076e541745ef40c66e6f17169f7c1bd
SHA2563d8ea0ea5c6f6bf17058258b04e2a2e63bf45cbfdffc52603ce8af138d9350a8
SHA512356e13a36e49329b4c018db9b267eb56df8da38bc9574ff284a890579cc96e3b3e1e4546e93011fae1a0d5c2f3968e20f25253838f7213da2ed76c473fc83b4c
-
Filesize
380KB
MD547449495dc2cd220d2d924262a7ba554
SHA1a221a3e699f62dd8689ccd0707d55d533340031a
SHA256ed5f775610eb25121cbe8898b95a53ce432d994b132cb1c3a6c487eacb0d9a27
SHA5128e79c2a4172c8fbc3b44121caeccc9bd322dc4aa2cc1ec88bc81c54712cc5b3cb4329e5490fd9c621df07591d53b05dee667ead9430330304b5a39033f6d5bf2
-
Filesize
380KB
MD533db4b97260795ae991bf58931205b6d
SHA1a0f115c5d30df28eda0df81881340c188978dc4c
SHA256d727a7acab1831ceefd15e69d22d1d10366f37bbb3a91ab1572a685efdc06214
SHA512b92c83dc6ba06e2a75b5d623d4f6d0ce31b8e3b0cfc1ae12cef7da5bfe390baf4a8397b25929a503e0c0d75d76545570fcd36b84a64cb2d77a4b97f93327f9cd
-
Filesize
380KB
MD5a33e52f71062020a44d2cd3f2bb5efe8
SHA1ffd411d3631613713a797d5d2e7628a091bc3db6
SHA256b3a7fbaaedcc0e8ed10e0b4a8edb431ead1b7f9d99bfa6c3d8b28359509e6e83
SHA512a8ef9fd9b6b47be66b2df0d78d912fd85bb60e949592cbc4c4170e196d769d4d8fe9d140aa886c22b60d8e4aea290e061e172bba30d32c2f41dd982c3c77f84a
-
Filesize
380KB
MD599c4dd356e3c5df9c2c0508784219a92
SHA1dc22ecdf87c5fdc39f78a203e8248c5649df6623
SHA25636b587f39eb85ab60fe4d706c8aaddbcfc9df741fb6746f6d33aacb2453c240a
SHA512ee3e8b5f3254736cd8ba7552aeed305d17e3cedead8433d2ca3db926449000aca460e86b2096a9813049e07c8d86c5eadfb885bf8e6d8eb3c53c4888d96399f5
-
Filesize
380KB
MD5ae54c2cec65a7abeecc289faa07ff8a3
SHA179d7fb44d219e149110cd75ede426b3c056185cd
SHA2569a3ea53cec0374d3184b40110d2a185b5f6245ef2e97a86b4f83dac36da5344f
SHA512a24820876e5b6102d7605a6b9fee197c76b6b68ba6d2a6591193daf43cedc0addde32e6660d46246415be0be9f6ba55305dfc085d4aacc10cb9f9737e046766f
-
Filesize
380KB
MD53a5041fa8b5f098ec8338915300d06b7
SHA1e913c065a8575928d7cbfd7e7b2d85526cde9a54
SHA2568890f9963d1db49e4a400cc88dc634734884c0bc2f12ad628688dde347703861
SHA51271c5f52441830792b2c2a6472f27e93272a6d3c0497921ba9197753a61be3c846c007ca3e1fc43db06c210355ea2b77d4f5a664a289ff2807e305f82b76702d5
-
Filesize
380KB
MD528b0d1f634ede1ef31698baa203a3dc5
SHA165cecaa1dc172d478b726dc7fd927e5194edd547
SHA256592997d5ec0413bfee3b80b0dbea626c9d1e326bc437a21d96c8400000c988d2
SHA512d323faa3ed349767c7fd49050573e64b20db7858cb8af3dcf93c09947b6e97e92a040f3e3f4b03950a2e0657dd030ab26f2ff2b40e61ee21f0a5a6bbb8b4a1ce