Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 20:17
General
-
Target
2024-02-12_bc0408b213fdeb332d4b7b317f137703_goldeneye.exe
-
Size
344KB
-
MD5
bc0408b213fdeb332d4b7b317f137703
-
SHA1
58a586ea6d7446f01f034d1d24bf836df71e37e6
-
SHA256
affd6ffb8eb7c03feadbdd7c555ce18175e4583cdc3a6422a9a41d019ec17ca3
-
SHA512
07d93ff1ecade03971ace9cf56d31449a80f375d1efda2eabd2479a947b7cc4a07c8d5f17f96e5682d0aaaf21824b380d0f894674b0235f5b63f84b8b4470edb
-
SSDEEP
3072:mEGh0owlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_bc0408b213fdeb332d4b7b317f137703_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_bc0408b213fdeb332d4b7b317f137703_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3B29669-CF97-4b59-87C7-7EBEF1694AC6}.exeC:\Windows\{D3B29669-CF97-4b59-87C7-7EBEF1694AC6}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45124306-6726-49bb-9920-7676623F3C02}.exeC:\Windows\{45124306-6726-49bb-9920-7676623F3C02}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45124~1.EXE > nul4⤵
-
C:\Windows\{1EE36A15-F127-4e72-977E-B6743744A584}.exeC:\Windows\{1EE36A15-F127-4e72-977E-B6743744A584}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A77DC26-9316-42f7-96A9-B9E439930175}.exeC:\Windows\{6A77DC26-9316-42f7-96A9-B9E439930175}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07884154-92A7-42f1-A40E-032DC894189B}.exeC:\Windows\{07884154-92A7-42f1-A40E-032DC894189B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A283733E-B0DF-4005-96E4-9B2BC27CC197}.exeC:\Windows\{A283733E-B0DF-4005-96E4-9B2BC27CC197}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCD02FEC-3A73-48b4-8E15-2AD9C3F06BB9}.exeC:\Windows\{DCD02FEC-3A73-48b4-8E15-2AD9C3F06BB9}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2E78DDA-43BA-4d3f-80A9-667FE1B8F024}.exeC:\Windows\{F2E78DDA-43BA-4d3f-80A9-667FE1B8F024}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E034985A-1A46-4e43-B918-31BED1B65808}.exeC:\Windows\{E034985A-1A46-4e43-B918-31BED1B65808}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9E54598-78AC-440d-9251-9CC515FEE6A4}.exeC:\Windows\{F9E54598-78AC-440d-9251-9CC515FEE6A4}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3AF02FC-1B04-4dd3-9957-7D5A32924E51}.exeC:\Windows\{C3AF02FC-1B04-4dd3-9957-7D5A32924E51}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{919CA1F9-13A8-4f40-9D22-7B1DCD19CD2A}.exeC:\Windows\{919CA1F9-13A8-4f40-9D22-7B1DCD19CD2A}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3AF0~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9E54~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0349~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2E78~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCD02~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2837~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07884~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A77D~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EE36~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3B29~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5100e183b11fb7a0bef50169186886034
SHA11f79854039b417929b222040a9e8cc1762263faf
SHA25677df66085938715d2dfa9da03c89e1b09529199cc3926298a52434910c436a7f
SHA512fe51c9722a17d040763c90a221cea739741613c53a26e5f8aa5d2f37d86c49598ee2dd8f8193639b9f65f2f8eeda0a38b9d4520619898e9fcbdb64ec083ad616
-
Filesize
344KB
MD5f78ec5458c9290a760018765eb609b3e
SHA1995fd4a8869f7cba41959a163b86647efdbc2c79
SHA25660c7f344a6f008ea2ee3acb2d7d65d68a5ad0040233af40a882f982a0cb6458f
SHA512dedd7d655b649b27e8a30e4b0abf3ddb955222ccc1169d68a1fef7cb27307339449cce265e2a1a78d17518acddb7eafd211b10e419ed6b44037a9954d751c477
-
Filesize
344KB
MD5e514c24b5df0bd402dc43f4f877b25b1
SHA1004ebf7606109238a8918c7d277a0579c5dc7608
SHA256370c6a9a2613990db70d4ddd5909d5b3ee512e771c7576c54979404d62796a7b
SHA5129008e6e3d9eb6af913d02a845e49eb6b5a6f61911b9d103486639a6b23a266516a6e3a61ece054c6493f75a2d331d488545b5d97cdc1cc8e8d08891960f2753d
-
Filesize
344KB
MD5c3b03ee515d80295cacd7ce16c46a9d4
SHA1775f42aea5b12d417c1628b02113785f517c295b
SHA2568d47fbb3d95737a75002ee48f176d3466abc3258efa8cd09fbf0c38e639c9a07
SHA5125ea416879230560893751e7e5fb9048eaa731b401641cb5ef43f87517b12f68c2be18fbea7a2d8a59f8fc6875a3b10c1661bf826dc3024bfcf8c60f04f478568
-
Filesize
344KB
MD567f37c698380f0ce5c36f28e0aab5ce1
SHA1e30939a293bc4bd329f550136371d2fc65d133b8
SHA2560be85ac0d46757ae37ddb4b51203f8fdb81ba7549888ede5b6b89c7dca3e8c3b
SHA5123c62d244edb1082ff8f4831818e7677e70eb08ec713c064e478b08bca8e737f7cc49ee15e8203347899f93ab8a36a16e4f4b1eedb3b485ca35b88a577b46f147
-
Filesize
344KB
MD5d85e8faa36532d6764cbe5b41c00dfad
SHA1baba6c864d374dd1c058382e8cd1ac53a3fb184b
SHA256cfb29222b83f8f068d97be9817d926923d516c544e319f4c865ac92edcb1fad1
SHA512e39a03e47d476a316d69126fbdd9aac2d2648063599fedc1d544f2a45403341eedc2f2f61cbcfc1b8d64073e5227d6903078ebd03e4b8d76c137269af554bcc5
-
Filesize
344KB
MD580a3470caddefb71518d20dbc86d46e7
SHA18a191bd0a0b7b20da7edffabdf1351414f7a6355
SHA25669af547a47ad02006bb6c8347daae4a2323f3b599601fc8df867a77113eedb74
SHA512994470b9ce078905f27dced2c36a058ea668a44f8b827916060b81654e49767e3bc42f5f5d9d5e8b63587e166b23a8bf729e40174c5c26604ad27a197ab63c21
-
Filesize
344KB
MD543f24fd8a1d2f50bee6206dabbd281b3
SHA1b5a08e34f7b1f0b06fdd80d63e01de74ac427caa
SHA256d087f641ff3934f23332de66f1dde2d3653fc17867f2d224a6c6b27726a31df8
SHA5129b1f610bc59614b594920a238b6303ab544f5ee5dd74644e5eabb5379a648deed776f6e49d42d311f0b2a7642b254c035df886dfc2e7eaaefb5e0b7c1fb80fb9
-
Filesize
344KB
MD57fa5a5a94ea36072506f9c7a18e6fd04
SHA1a5a3fe1c93798aa445d1eec5b9696e43b1971563
SHA256db7daf2c80a5d2c8f73b9d2bde138223e863dffe67a893a6bebf9a3a0c42712c
SHA512b5c7fa2e8aebd2061f0fc9909a96cc2fce309923b35ec6babb8e9c0d0315f01c611c1a64a6628b0c25f5f7a1d9afab1f85cd2d0d793b495b8adfbad9b32e78cc
-
Filesize
344KB
MD5d84472cd0171a98a82b09691532c5d81
SHA18916d2b17bfd3687f62a0f71a8c8f5e017b3a8d2
SHA256362d8e8e7ce163ed6fbddbaee21edf19f83d0508692dcf0646ee1f716dbb4c99
SHA51258ffb1678458f40991d83545d4aaca660f021bdb3cae25e323e64287f5d52c958254efc1ff9091025f02e70a186fbb675cbdfc9649509e9ad8322a4b4a374f3d
-
Filesize
344KB
MD58e1b0d085e3ba43d61172aff7c90328f
SHA1a35830690aa7d2ac3dba338979bb38a953a1a6fb
SHA256d7971464bf47d480053f4ba9ed04c7dbf655dcad62caa50493a6a2db4254fa07
SHA51271486f789165ff2a8da495b0eb736b5f9490146e13a4808f94e7cf6833eff7c8b5555158fea8c6defce92b70d5a6135703dfdf85395d9010ab23659405c90fb9
-
Filesize
344KB
MD5de8e6ed15e418236493adcac885cc304
SHA12439c4e85b9bad44cb6a12dd0401ada6206cd6b5
SHA2562b5b4a6e6fb54c9f8e06bc680cfa215abdf3dec96abc69ccd3527039e0a68ad7
SHA512efdbc140220cdd473b451fe2773df1758aa06f7ca31e77c46125284c13a1bd6e978c0f6fccc257b2a1f634476ca2336d009f034c98887d3551a27e70f4c0160b