Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 20:17
General
-
Target
2024-02-12_bc0408b213fdeb332d4b7b317f137703_goldeneye.exe
-
Size
344KB
-
MD5
bc0408b213fdeb332d4b7b317f137703
-
SHA1
58a586ea6d7446f01f034d1d24bf836df71e37e6
-
SHA256
affd6ffb8eb7c03feadbdd7c555ce18175e4583cdc3a6422a9a41d019ec17ca3
-
SHA512
07d93ff1ecade03971ace9cf56d31449a80f375d1efda2eabd2479a947b7cc4a07c8d5f17f96e5682d0aaaf21824b380d0f894674b0235f5b63f84b8b4470edb
-
SSDEEP
3072:mEGh0owlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_bc0408b213fdeb332d4b7b317f137703_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_bc0408b213fdeb332d4b7b317f137703_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6BFDD1FB-A033-4b93-B099-DDC9DB1AD596}.exeC:\Windows\{6BFDD1FB-A033-4b93-B099-DDC9DB1AD596}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91104075-B892-43e4-997D-D1555250DFBA}.exeC:\Windows\{91104075-B892-43e4-997D-D1555250DFBA}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDA6BA8F-3AB2-44fb-B608-1C74EAD4E99A}.exeC:\Windows\{EDA6BA8F-3AB2-44fb-B608-1C74EAD4E99A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7CBDCA28-2D8A-4ac4-9EF2-B671B76F5F1A}.exeC:\Windows\{7CBDCA28-2D8A-4ac4-9EF2-B671B76F5F1A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{153144BE-C5BE-4595-8287-BFE765B9D11F}.exeC:\Windows\{153144BE-C5BE-4595-8287-BFE765B9D11F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15314~1.EXE > nul7⤵
-
C:\Windows\{0B9032D7-8CC4-4197-AFF3-B678492DC34F}.exeC:\Windows\{0B9032D7-8CC4-4197-AFF3-B678492DC34F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B903~1.EXE > nul8⤵
-
C:\Windows\{552A803A-6EE8-4daf-8E80-CEE9750058E4}.exeC:\Windows\{552A803A-6EE8-4daf-8E80-CEE9750058E4}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7EC7179-FF40-41ad-9524-A0A9331648FD}.exeC:\Windows\{C7EC7179-FF40-41ad-9524-A0A9331648FD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7EC7~1.EXE > nul10⤵
-
C:\Windows\{6188EFE8-6E47-4126-AC00-E4534B36E76A}.exeC:\Windows\{6188EFE8-6E47-4126-AC00-E4534B36E76A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6188E~1.EXE > nul11⤵
-
C:\Windows\{6EBAA7B2-B632-4e43-AEFC-AF320014C822}.exeC:\Windows\{6EBAA7B2-B632-4e43-AEFC-AF320014C822}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EBAA~1.EXE > nul12⤵
-
C:\Windows\{C7B3F7B6-C230-41ab-BB3E-CA7C6E9C8AD0}.exeC:\Windows\{C7B3F7B6-C230-41ab-BB3E-CA7C6E9C8AD0}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{552A8~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7CBDC~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDA6B~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91104~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6BFDD~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5fd71a2de4a879c283b1e1b257dacd4bc
SHA1cfaac46d21228af774f13f830f6d5f07f5a710ae
SHA25627ef35f9406366fb4269dde40b055c010e0d501c067e31f8548b548d3cd672be
SHA51242292480019a96f078192be3b0f4b7600f0f2a64281a6ec92dfc2309ec43b43ff3ed1874ee3f7723f86549630e4562ec7713259fa55d42d920eaacbdf406b299
-
Filesize
344KB
MD594f190f6fa6d4756de56cdc962e9fe62
SHA16d003ce5ba608a27b441c370729d4a7416cfc89e
SHA2566bf951d0decef3aa5b79526dda5db1c0a3f7bd07670cee9c3c3c1765f100ad3b
SHA51256fde22cac9a951e3fd3c0e82acfa21e94c0dc5efef534706ffad3581530032cfb6c0b3bc71a30c79fbc1dc6411d4b093c86441229bf3ccc24ed0285b8710a99
-
Filesize
344KB
MD5299e77b3472f7a4adc8088974d2153ac
SHA1cd3b0f12fc9fb81ff2eacea985a9da392553001c
SHA256fe06c794cdb557e648e9f142dcbff76692bd826bebbb00fa26ed9804b5ceecdc
SHA512fd9a21255123076e1fbcbc463f9feab3eef502d4ca5316e43b84b360c9ae7fefea583f388a8a5f25ad9b03a6882a276375281fcc3d2b98dddb42d19290a35b72
-
Filesize
344KB
MD5c8601a03958fa3301c065e1ca8198146
SHA16563d744a1f5c2a2092f227b065978e434f7c383
SHA256b4dc5e61cc4c7465566b9a7957fa493386fd4c6e97f2642e0a4270e0844b3842
SHA51297795ac39a7ee5edb6bb1286afb1d3b69ece54ab6e3f104b4a55c38fdba0ea42c54ca68ccf2167719f0dfb53e3509e43f00fc06f103e1b34e24799f2a88a8698
-
Filesize
344KB
MD524b67da351b51fc62bb644052a0c1c47
SHA108ea947a43247ed0bc1cc07a71df76e0c02e8ac1
SHA256dbd9d29498c0d446287aba846d6abba61e9662b81f40e4cc9c084cbe17a7904a
SHA512bcb6a761f8c286ae37bba3639c5684340e160e560ededa85dc7625e929734ca5dc50f239a20ad84b525604ccc24b40f8f684b6d267411184b60be64dbaaf9d53
-
Filesize
344KB
MD585ee6d0a530ca3a79c022acddbefd2e1
SHA1d2888bfbe1d4fb20348784c65dc3a3abf230c7cc
SHA2562a7af408009963a6d8a37bfdee5cf9de5d51b787cd9b49c62b32deee73030c73
SHA512609f8098f444f77592041263dcc97ca08d6a965652b801ca571893fe2c7f234dac1cc35620c96b50dc7d2b0a1d59c0f2808621618ea145d3964439d0000adc46
-
Filesize
344KB
MD557dd1a6a451f882c7beb02221bd03376
SHA181027e02b02045f7ec47d478f540f06cc67ec5a2
SHA256836b0f520de079a9919abd3251dd428c2b62162c5bee59d9d9a555dc8d9023b8
SHA51211097eb892d68dd8f495d14307e39187cae18242d5837d70fbe41906a74550865416a6741b993354c4bfd041826acbcbcc19a3da0a607cf4ef6aff1e6d79f03a
-
Filesize
344KB
MD50ee8720fbb88079afc615dea134c0d5f
SHA1211fd46c283eeea4eeef9af78eec8e6e326a0bf1
SHA256c163d5f05728adc9557f4c0385dc29747070a3f0d185dd819f1033b4f316a495
SHA512b52b6d887dced9500626a7e32ec35dbdd621c3d27ab71a6287e0408e1e6ee935bbe24b57f6c42402616931eeb31b4b1c8f6073265375e03978f3f9e67a15324b
-
Filesize
344KB
MD50e2303a287206bfce57dcd392496851b
SHA17fd29310a6fa8b45142a324afb0c1582a6441009
SHA2560d8d28cdb6108f5d87406b15299418aff5eb0249227256ac0e1b3ad36e1a4432
SHA51202e1e679d6db4a3a20f3a1f22ace225fd9c1a17a8ce636c408a0c2aeba7efea01ee588a5eb628c9d84917621ecfcbf364869860ec03d75195662e2007a85cf29
-
Filesize
344KB
MD56bc193188873f9bc67d8c16a5f81a17a
SHA1060d015f8dad222cd8d1d6cc8d1049bbc926d16a
SHA2561a4a09101e4912386069aa196b6c440a7b8cfbbb80ef7dabb601edecaca47462
SHA51268ffe71854d02e69080cf50b308c3e15218d0a703be5784d8247b87a9bddb69ea9cfaa5fdeeed4caf05d0bdd280e17206dddbc14827d5e2ef760d2068a39816f
-
Filesize
344KB
MD548fa0d6ae291565bf0ab69375af60b56
SHA1921f27775e87cd7f15f50c9c988959c90d85af15
SHA256411f5f93202d0672650f00584f55fcc55840604849efb7f6a4f76fda905a8549
SHA512c2437de40196008e03afbfaf1015f1d58c20e12f03198e9d46380f0c80abdcebd53de50b9fc1580133f3c10d08ebb56cb035dca8be907f3425410418db17c226