Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12-02-2024 20:16
General
-
Target
2024-02-12_ba92e7b2a83a4cfa4dbeb849b6efb966_goldeneye.exe
-
Size
408KB
-
MD5
ba92e7b2a83a4cfa4dbeb849b6efb966
-
SHA1
21178e52a6e0d4a32a65f0a312c6ec4853d63214
-
SHA256
de71abd34e76657fd1c7b476505216ca6963b2515b133a2bffbf3b2aac4974e0
-
SHA512
1f6afa488d467aa2620a2126910aab9fc6f79c09494f3ce16db16acf32df1b5f454f568cd2557e75fc590b2e7c64476c99cd6d2b9ce7790c8a2f5c043d25474b
-
SSDEEP
3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGTldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_ba92e7b2a83a4cfa4dbeb849b6efb966_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ba92e7b2a83a4cfa4dbeb849b6efb966_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2EA8151-E5E4-4241-BD9B-3E47C17F3614}.exeC:\Windows\{C2EA8151-E5E4-4241-BD9B-3E47C17F3614}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D1D3DC2-74F5-4286-91EC-C17DCD82ED3C}.exeC:\Windows\{1D1D3DC2-74F5-4286-91EC-C17DCD82ED3C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D949A50-F484-4707-9941-0E39D8EB378F}.exeC:\Windows\{7D949A50-F484-4707-9941-0E39D8EB378F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{097CC998-D770-458c-A6BA-638D1B405C28}.exeC:\Windows\{097CC998-D770-458c-A6BA-638D1B405C28}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6F6C81A-5484-4c0d-AC49-D4ABEF202321}.exeC:\Windows\{C6F6C81A-5484-4c0d-AC49-D4ABEF202321}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AA17355-0F57-498b-8FD2-E2C152B24034}.exeC:\Windows\{8AA17355-0F57-498b-8FD2-E2C152B24034}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BC31F50-C718-4349-ABB8-3D2FDA592627}.exeC:\Windows\{5BC31F50-C718-4349-ABB8-3D2FDA592627}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9C58B53-1423-45c1-9A62-BF36A7DC3EE8}.exeC:\Windows\{C9C58B53-1423-45c1-9A62-BF36A7DC3EE8}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A4B7FB58-0936-4de1-A5CF-ABC6E09D484F}.exeC:\Windows\{A4B7FB58-0936-4de1-A5CF-ABC6E09D484F}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AAA32E06-3AD7-4fcb-899A-2B92B4E420B6}.exeC:\Windows\{AAA32E06-3AD7-4fcb-899A-2B92B4E420B6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C206D2FF-0758-44f7-AD97-A8FB8A57D61C}.exeC:\Windows\{C206D2FF-0758-44f7-AD97-A8FB8A57D61C}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAA32~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4B7F~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9C58~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BC31~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AA17~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6F6C~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{097CC~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D949~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D1D3~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2EA8~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5c35c2a97b3115c32779cd2d32224bff1
SHA18ad8572b44dd444dc863c5f64dbba22694d3f025
SHA256c3b3100ed27d08b267fe97cf8b4f97f37ecb3c06b59ab8fc1f49ac8dcca8898d
SHA51225915f957b04edcb1a9622c8f920d84f6c78b65b9d4ff68ccd16ca99d2fc80039082637ac540a54e971005da134a4a6de56ff4c50a32c1d161c2173b5853f822
-
Filesize
408KB
MD539983ffcbd890d3c3dbcc8f9604b1743
SHA19a534b22a95ce65fdcb8698c3412bd104f9a01df
SHA2565e14832c2bc5eb3dfd613e74ea50dcadb99f536a8c1fd97f14d185f6192d1ad7
SHA512362b6501c0e5bf5d4fded92d0173d96fef929c6912cfd63bb1ff4e17f5238fff3bcc4cc1f29e5f2816b477691eb2b17a708f1bbbfcb46cd0b21f0101d1b8a10e
-
Filesize
408KB
MD57287213c042bcd8f4ee8076194338799
SHA1af4fb224eb30f8336fbadb43c35ca77a307d1d82
SHA256ec92f3d07c576346e8a4c83f4bab81dde8bf1f0234d93ccdc338cb54dcbb0b80
SHA5126afa3ab8bec722682901f827fe7ff2fbc8469393b13114bac616f2f806346b6b5de855e0f82d82da0d3e0288a5b155a6f143f2b254d4ac86f050bc2913e434da
-
Filesize
408KB
MD506b0d493172de56faf5799a43d9d2ac1
SHA11dd4676d8d7b83fe83944c33b703aa41e4cc0f4c
SHA2560deed1a3d5e7637ab81ea592741c0b169fce35c202948107d4cf16dbfee5c459
SHA512f4e0849ed052db7038bc447fee1a3c224cd4920f421ed424a18cdc4cf62bf277ba134b5d4ba1cf5c1652684b840427fbd91b9f7d546d92f62fd7b5a5495073cf
-
Filesize
408KB
MD55da56069b5a6467ce74adec66956424d
SHA119bebb6bd6f093607261fc2c7d51f7b33954c0f3
SHA2564c9f12dbce0eb58419d373028c697646727e982c2b612e665db634972edb61ae
SHA512a50322ca85914287d8a1f44d2e75c5471ecac09406c9274efe006120c1a564647b40076ece94fdfe5901f7743ebf7853331a905b1fb5104ccac31a6b7c4d06a1
-
Filesize
408KB
MD557b80feea79d614de27bb55d4e9a6c19
SHA13b106698a169b5464e369bd76d6c08eb193696f1
SHA256f7bf24e035faa047545ab3df33cba26dcead26ce7d9995d07f7771e76c500082
SHA512c858ed8b2c3830fe0d48f7a9237ee3dcfabbed6118ef560bc54dabde2aa3706dc3079c390deca963608b2e16d675cb1a773b36d7e426d4112864027df0e3fbd1
-
Filesize
408KB
MD59638ee58813a4913816c83951131ec3d
SHA1131fc170f608ad50e07b7992366880193658aa7e
SHA256ec17c150fb2aef4353f2a9fc1dd1df9bb4d387f1889aacf1afafdbb1464c58cf
SHA512ed134e777cd68fd11469d0d22e234f417ad66e0b0181e9bdb2e8fdbd5bc790803266bd151dfa50bb696c0b04b3615604ba29e0c0a0caf28b26f269ca49e407a9
-
Filesize
408KB
MD5063c43ada845dee387c067c0282974a9
SHA1030afbd0282c6e71884583d1b455ba0212cdcafb
SHA25645e1d0f89e15745e251a65b0d3b3d3d1e26e6fb7682b2046f69e2a6d17ce7758
SHA512edb2d858ed6980dcd2af168dec2e961301cf8de6fb430335b4dab949419bb7baf75de6daeb195b583df008ff23b6776bff35c653a08b106c7b9ca80b8857292c
-
Filesize
408KB
MD53d2e74f26d73c0ac7530970ab94d9f7d
SHA142369611128831620568f6bb0aa0c6f7189a58d3
SHA25624ba53cd70d65aabcffddf2d1a70755672efa4b08b1b648333984d72737e6f7e
SHA51233f7aa8058e0325f4feee141258c8fd70e82fe030fef6959eb7609f78f50db409c2aa4c36d1bfd913b2ab6ab5ae9696b50ac82bbaf70ac9f6b10ce81a8e96111
-
Filesize
408KB
MD5195c3e350c43a5c2ec1516b4774fa665
SHA13ff46f7dd35b3d2ec8bb932a5c5db1762497955c
SHA256ab26b052c370c1e1da2cf2d70c202ea9e255bc48e2c8f6b9f72fdd58a80f559b
SHA512f6ad7d7edefd755038be5b45242c65a67aab1a78a7b6bd3016f06de2b846a1e23b00518815b6d45435b12d56fceed8e87ec37e6d57cfb338e43736549d142e23
-
Filesize
408KB
MD56a4a3bf387570907eb7d549394ef6d6b
SHA10da0d887c1f9117af4296e7f25eff0fc92d4572f
SHA2566785d99b4e6d62b7d1d82c8ce484f733556ae081272b7f966bcbe0f8be55e439
SHA5122ef53ca8f5d89f17f71e7cd08d94b27ad088f4de1759959eef05da307d63744c8525cba11fbc955c52002bd5cd5f817152c379193ecbf4e3c8ddb05b1f125170