Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 19:26
General
-
Target
2024-02-12_bcfc3df16adba25b9b2f9c723704dc7e_goldeneye.exe
-
Size
380KB
-
MD5
bcfc3df16adba25b9b2f9c723704dc7e
-
SHA1
89a494db31a590fd40782a09cb889101204a6259
-
SHA256
0c4457ce496935159ba5a3beff84db4ffb48e8c3d1f0750a4772243d88d22643
-
SHA512
1b5749c8a7211104a57a4e86d64d7469bd380ad84d4f9ae72b525c27c10e66e2089b787bef7c2d9dfca5fa2286bbed62a769213d173840dfea6d6433a3421f53
-
SSDEEP
3072:mEGh0oNlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGXl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_bcfc3df16adba25b9b2f9c723704dc7e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_bcfc3df16adba25b9b2f9c723704dc7e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10A48CC5-24E1-45bf-9AB9-29304DBFB76B}.exeC:\Windows\{10A48CC5-24E1-45bf-9AB9-29304DBFB76B}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52D2CDC2-66A7-464f-9741-E67446CD1806}.exeC:\Windows\{52D2CDC2-66A7-464f-9741-E67446CD1806}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52D2C~1.EXE > nul4⤵
-
C:\Windows\{82F84ADE-8166-44c0-A54A-BBF94118340B}.exeC:\Windows\{82F84ADE-8166-44c0-A54A-BBF94118340B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D7EF983-0583-477c-A5C3-B7D7151BB860}.exeC:\Windows\{3D7EF983-0583-477c-A5C3-B7D7151BB860}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9F792FC-A944-41e5-8D02-A15738FB0E2E}.exeC:\Windows\{C9F792FC-A944-41e5-8D02-A15738FB0E2E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9F79~1.EXE > nul7⤵
-
C:\Windows\{5820C185-2A83-45b5-8C3F-D0C79B874234}.exeC:\Windows\{5820C185-2A83-45b5-8C3F-D0C79B874234}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78900E03-DCB9-41f8-B174-38C91D6AD768}.exeC:\Windows\{78900E03-DCB9-41f8-B174-38C91D6AD768}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33D2CA4C-D99D-4375-BC2C-5DB4131A4B1A}.exeC:\Windows\{33D2CA4C-D99D-4375-BC2C-5DB4131A4B1A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F5DC82C-0C2F-4d3d-BC32-777B343699B1}.exeC:\Windows\{0F5DC82C-0C2F-4d3d-BC32-777B343699B1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95EF513C-46CE-4b60-B97D-334EF76B1ADF}.exeC:\Windows\{95EF513C-46CE-4b60-B97D-334EF76B1ADF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D5F6597-08D9-47ce-BDB9-E08F09005D86}.exeC:\Windows\{0D5F6597-08D9-47ce-BDB9-E08F09005D86}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D5F6~1.EXE > nul13⤵
-
C:\Windows\{F479E213-4326-4c19-903E-E2A85244ED2D}.exeC:\Windows\{F479E213-4326-4c19-903E-E2A85244ED2D}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95EF5~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F5DC~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33D2C~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78900~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5820C~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D7EF~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82F84~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10A48~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5a8d346da9eb2ecb551fd72749749ca20
SHA1dd10f2d4996741d1d778321fbc8971b8fc8be76d
SHA256bdf260b20580af12edfb2f346c0baf756f7a6ef0a538c50067933353ef1ff8b7
SHA51260a7ffedfbeeab906935935772a48b2b6b048d7e82c3e305235aa00a3e13d742b8628cf39b34d0f4349d45e48a66e6ef2e91b8c0b7611ee5e865ae75d529a109
-
Filesize
380KB
MD55d39e3b24eb4326cbd6723f68a1c800e
SHA1c7fd937b797241a4ba8b478c15a1771d78c69585
SHA2563164e42b5d7d21888618b780f8a115e32fc91eb6041552d50e51bcd5655bf3b0
SHA5123a7cab84154dc9482fe69869f0a62b8a199da9f49c0f8d87689c8e657fd13fcd2a2e44b1585e3869ab99a72724d5d8c24d5b680abea90e3c9317e7bac5bfc6ed
-
Filesize
380KB
MD59f90eebc47f6a50488c782d2922981ec
SHA1f5bd278306a0057970d6df991ffcc12ce537b468
SHA256d906d72a807b9163c42e332dea0d8da987dc3bf1262d686cf40d39329f21cc92
SHA512805d77d466c69c6e0413c73505cf8ee2f7cbfd8b3f2ed321eea066c563867f096b0c5599776131ed511ccb2802721bbfacd4694e0546e645d6c1c1c16e289371
-
Filesize
380KB
MD5a4d830feebe5281e1793c60cec707082
SHA1b17d441db6a119b3fd7cb4de6816ab58451a80ba
SHA256330a8fea25f7f6ecac1c6fef13858f16c1a809f3cd984dd6f4acbb2562b06fbe
SHA512d847e07aadb8277baad97405bc781d552955f39830a5aefe5db9e868c6efff33a6ad8120d96484b32519c2da5af84c5981622bd9150905a25e7d2e0624f88198
-
Filesize
380KB
MD5475ee4d2a8699b455240889b68ffbe2d
SHA1157647856239014ad62188262dd669bffa165cd7
SHA256f6a32f6626641ad0ffcbf3684efd4a048518ed7073ad8a3cdc0cccbc1e5951f4
SHA51272a4f1a7c956ddf2050d68477f28e239bece7b147dccdbdcf53aea77d784017a012041b363e326dc060afd9a7cc415119ba5e75a07b25e75797dd510addb4626
-
Filesize
380KB
MD580ee7e089b6361ed16e02c60d5035875
SHA14b3393ca689952dd0e47e7a28e735ebedd5ffcdf
SHA256e43f5e133a1ea538cfea0961c18769219036fe10d0f0823c3873ac8330868caf
SHA512114c4d9ad62a3c32a4a55762c6e3ea31eb885ec2b04f536a502fc3af63882a76f967892a9a5916c599b4631c5e8754eb934d230dfbbab89793a93bbfc18f96d3
-
Filesize
380KB
MD5bd35f383ba54f96f888e8acca763b60a
SHA1cf412cf45fe06658d5f48c7722dc59dc53cc1251
SHA2563307ed73954709bde79b9c43787cfb648406649bf7e999513888377d5ac533fa
SHA51263186482b033762f4412a9cad2f0a7c3c5b453e462a49de15bff34077eba707f1bc2e3daf5a43997e1232d3cc031c220a26ef0f7f9617bba7f6fff049e9aeae6
-
Filesize
380KB
MD557c31d05da2722b213023993d6e10a65
SHA1fbfa510d1b46673d70ca9a704dea3be2fce083ab
SHA256e66beff58f9b4aa292e79ead4c29cb1237139775eb309063a406b3a2523cf757
SHA51278fd1c77cd22a204e16cbf4eb17e324a4237df378d401144dbd205d37fc310725da7930904201d758177d292bac33c1c814c5e321139d1ffff1cf6951930abde
-
Filesize
380KB
MD549e2f21f7d1b8223e4c8ab6f3e4dce06
SHA13a9256b0ee828539d929cd08c3902402d8c47e76
SHA256faf9b07e98d1ec9e98ed71d2a5c270f402255d3776d7bb5babf67f7371ad78fe
SHA5124db572cf435b5de6f97290f31b7157f5dcf8028dd0c959ceed1df5d2d9452da72fb09dbf7d336eea0850687a12ace3bd122c8528f7b849f017c0ff52b7de02f3
-
Filesize
380KB
MD571bc2581e40316bce948d0297e9b6226
SHA18dd0dcf7d2f47b41fa9764d1aac8d8e87755c180
SHA2568b63b36bf0741350d74dddd26b00f65427642e7ec84155aab9e3fb127d865633
SHA5123c4727547ecb984ca6c132af20249222e0fea56712ccc6b859b75db6288c4483d5c102e168365f966ecbea2d93632c1f9ba4469b1671fdb51354a8c448d24931
-
Filesize
380KB
MD537b529955c386493c37641d99171e6c9
SHA1a6d964a2113a13ea973ff22c55d1bb0494937127
SHA256b8e4053e6689f69ad4ef22554982c77f3778175d5442cce26742cc2ed51d6736
SHA5121dff9f5cddb818fd8da11287e26e29069f3013b6190d031ccd3fa16fe396fbdc40adaee676f8339f5cd1d66b094de92c3e997a2b304c6a86af6269704bbdb857
-
Filesize
380KB
MD5a6279a059ddd87b3308153b40d80681d
SHA1857ffce343cabf7e794a60e5679feb90763e8c43
SHA2562ca5ba10449ebbbd327dcde574057dba92600adb33be523d7c9bdf8b62b70d9d
SHA512c7400d20ade6705232c56ee0839e82103204441f2e0e119e888f19fd7975593c5ddc928ec16d5abda90aa3323fad521f63502dfa6e8f2542198835992acb6a76