Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 20:16
General
-
Target
2024-02-12_ba92e7b2a83a4cfa4dbeb849b6efb966_goldeneye.exe
-
Size
408KB
-
MD5
ba92e7b2a83a4cfa4dbeb849b6efb966
-
SHA1
21178e52a6e0d4a32a65f0a312c6ec4853d63214
-
SHA256
de71abd34e76657fd1c7b476505216ca6963b2515b133a2bffbf3b2aac4974e0
-
SHA512
1f6afa488d467aa2620a2126910aab9fc6f79c09494f3ce16db16acf32df1b5f454f568cd2557e75fc590b2e7c64476c99cd6d2b9ce7790c8a2f5c043d25474b
-
SSDEEP
3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGTldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_ba92e7b2a83a4cfa4dbeb849b6efb966_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ba92e7b2a83a4cfa4dbeb849b6efb966_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5BEA580-E6B7-459d-8F8E-647988AA76A4}.exeC:\Windows\{C5BEA580-E6B7-459d-8F8E-647988AA76A4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B4716E7-9551-43e1-A544-CE7C2970A7DC}.exeC:\Windows\{5B4716E7-9551-43e1-A544-CE7C2970A7DC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A78BA963-3DD1-43bb-BD10-D4F1CB3B131D}.exeC:\Windows\{A78BA963-3DD1-43bb-BD10-D4F1CB3B131D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{477DC949-DB89-4288-89E0-8A03984DA88D}.exeC:\Windows\{477DC949-DB89-4288-89E0-8A03984DA88D}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C267B27-17EB-4744-8211-FEB3AFE025D6}.exeC:\Windows\{3C267B27-17EB-4744-8211-FEB3AFE025D6}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8597A966-5A5B-444c-9EA3-0A93736333D3}.exeC:\Windows\{8597A966-5A5B-444c-9EA3-0A93736333D3}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{304DFE50-441B-41b9-8E24-481667E4C93E}.exeC:\Windows\{304DFE50-441B-41b9-8E24-481667E4C93E}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F83AF1E5-3F92-4c87-805F-A6455D290487}.exeC:\Windows\{F83AF1E5-3F92-4c87-805F-A6455D290487}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEF8FAC0-58DE-461b-AD0B-EE8319FE6DAE}.exeC:\Windows\{AEF8FAC0-58DE-461b-AD0B-EE8319FE6DAE}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5319B8D-52C7-42f8-B612-347E6585DAB6}.exeC:\Windows\{F5319B8D-52C7-42f8-B612-347E6585DAB6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD860F5B-108E-4c46-AEC6-B02F36CD1C67}.exeC:\Windows\{CD860F5B-108E-4c46-AEC6-B02F36CD1C67}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D2CEB802-6ECC-43eb-9C01-41D0ABBC11E3}.exeC:\Windows\{D2CEB802-6ECC-43eb-9C01-41D0ABBC11E3}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD860~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5319~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEF8F~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F83AF~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{304DF~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8597A~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C267~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{477DC~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A78BA~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B471~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5BEA~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD51e4b03792d530c7d519ae4fecbf465f6
SHA1c71b10ca7f80b431658684ff7832d75682bb0d69
SHA256b5795a4c494c870118f2759dcb02e33f02412cc509e3eba6e83467ff52d5dabd
SHA512740b0872c4b59bea26d91cf2bb4c05c34786883a20252c303f21f3852c7c0a160318f5420943b9cfcb9cbf954499a6ad37acb576ad477fd5cbc8a80a6b36c5e6
-
Filesize
408KB
MD5037281ba1fe0be97a4f7325e20d8586c
SHA10f010d2c9b9cae5475e986f408e7e884089deea6
SHA256edf3ef250fc878abe9371ef09fdbfc00b4b4470e805dc786f94d18777586954c
SHA5129bb036ec1db0ff6d441d260c9ac25f89cdb2377d177ee4b1af683ec81d316e05320c07f5ff7063e841508e4c406533d385c277ac7a012404cba5e8315d92e0cb
-
Filesize
408KB
MD5e7a574eb57652fa0f38ae064d63c00e1
SHA1809ee3c2161521aa2b4b34510149f2cf18202a96
SHA256404534f31b7f5ec09f7a034a002b0fe4b9fb36ed69fef592630f8c08ed3aaf5d
SHA512586ef0e2d632e3e9cbd8781fad2eea8df66eb057eb0ace1c8105e858de815be27609c89866685ef2cbe53c74b7eb438a1b51f859a656b8ea548ca0ffe1383742
-
Filesize
408KB
MD54920f4ac16f4f9560470550fe8ff5de6
SHA11e6fd28aa5a844ee604f3875f91610901e6723a5
SHA2569b14034d7b657d308b65e819a8b4ab4b08308d2d07555429226d73dc4221c2d1
SHA512fe12883e83897b95e5785067bb7ecae45ec56e2e1d462bb6d605273ced7dfc35192fb56b8b91d5be1e00d5e1ee1c08f52289245f860adae406647502c94e5849
-
Filesize
408KB
MD5fea9e91f374579cd36827a6368b67307
SHA1a707e1590985fac5393b604c89fe08734fdf7728
SHA25615706a05e5950421a57d75972075d0ed10f7f6ef772a9b053d54108c3695175d
SHA5124e9dbf9401e88e7b85a949a203c6b8ed78bfe4155c8f4f0fcd494ed3ea36af81f8368e2220032e0df1bf9eae3c19b80baa443d903968b295f4a643835540ebd0
-
Filesize
408KB
MD54f898812fe1b84b92c4c98cb9df3e6a5
SHA12acec01d81d492a71709352bd95e0025f5284c41
SHA256892847c7e22c8340b1b5725ec93c0d0f86b0d53f71bbb116953822063983635b
SHA512834601e895f5676e4c6ea79038307beec6f9660871b64a87b51c03e182ea7fcb7d2500a45e37015cd666d18a39f620bf014f8aa3a79a684d525beabe517cba4b
-
Filesize
408KB
MD5e9670001b80995a06a5b0b68a31896f5
SHA1842e770d09b74f9ac91319fcce78d14960f1c11e
SHA256375f5b5ceb447800c16bec216589b1dad770b4bc8dcdab3666ddd5854ddd5950
SHA51284fce45193cbc5ac980120187600943cf7ed0ec13d8b179041a973e8325197e3f301dcf78fb9edd0ea444b63b7d8d17d214e915b82f8d120a459c7504ccec3fb
-
Filesize
408KB
MD5d923e404874aebe487254193243c7e6d
SHA1523681b3a57ee6acd2eca6fd202c95c6e1bff817
SHA2565f096ddddba25bb9f58ad47b09313b8b1e6ecf3d4be7d32495270a006f8203ab
SHA5122a2f600099c0aaec71f876bd175c169474b68eac961f25d5b5b228a4ff757e68a8725ef94084bb742b36a0f7e8fe6c88f56622209e100a130f7239999942ae91
-
Filesize
408KB
MD51b28e68220bb488864a7c4ebd13e8406
SHA1d1c4915eda808be270a85a1603e0b422c751bbb6
SHA2562c7003240eefd92573943a14dc2dde833b9765caef99980c62e241d5c27fbdda
SHA5129f406a58cf015ed63e1eac0e40afd57c450474d6028aa8df174e53cac27c6620c7ef6b30442b99ffea7828f059a4da9e5a4e0abb802142f428103eaff3f4ca41
-
Filesize
408KB
MD5d2bfd07ef1d383fbb4d3a8da0059359b
SHA1257a71210bc07ca5f39c387b800bc1473122499a
SHA256157608b0d2315ae87d268288cc4f3ba59a70b799a86039e205d2fbf19d6e9d69
SHA5127b85132482703497fa12ed00b6bd73bdb5ac7ff0c6f76d990526fef3d4a3981bfa17aaf248883db6e6263bf32ac0c74e49961ac43dc979c19bdcd098389ac708
-
Filesize
408KB
MD5b90daf7279efcfd2cf9ff26b9b9ca66e
SHA17aff369dd2a38bf9135dbd40f061f8d92e7a38c2
SHA256f91350d908a039e88bd375befa52f83b39949144c4448c4d9f22ea1493fb6813
SHA5125288353f5445a8127b04caf5a5651dca81e36efa4256e7711afd0d9064e23a593466a9a3eac68fe76dcd915fb437dca2b24e2788e539f298800854f2371e8ea6
-
Filesize
408KB
MD5b14b3db0db293cdbc1b34cde2767245d
SHA16ae1dd83d9a143cbc05051e483af5b255807b1a8
SHA2564b74ab4a5ce497276f68b6797a9ca2c26a1e63f1b08f07fe9df73c95982d5339
SHA5120158e7cb49f09de4e349a3d83fd1c3d6814cc3a7051d96209ee151268c359d82ad3323a84580c10ad8b08ba3d7a37f1d4e05b3d8733d0d68a6a1ace53733a943