Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 20:21
General
-
Target
2024-02-12_cf588db8019232445c572ed0d1c19be6_goldeneye.exe
-
Size
372KB
-
MD5
cf588db8019232445c572ed0d1c19be6
-
SHA1
ead705b1b65bd3f86971868226e7cf3eb02380d4
-
SHA256
fbd7cd5f248fb04d5c19a76726ba7fc57aec5494f142166ed01c28da9e915359
-
SHA512
0835cdbff8bb272cdeeb47e2fbd7a140283bbcb3097b5870c7659d7aeee291e440d9c87e869faa651b17b4a9eabb308eb814a290355f43e4b7e70b7267c4d241
-
SSDEEP
3072:CEGh0oumlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG9l/Oe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_cf588db8019232445c572ed0d1c19be6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_cf588db8019232445c572ed0d1c19be6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51FE2706-7CE4-40bd-9482-CCCDA783C930}.exeC:\Windows\{51FE2706-7CE4-40bd-9482-CCCDA783C930}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91625F8D-D1E0-43aa-8978-FF1C657235DF}.exeC:\Windows\{91625F8D-D1E0-43aa-8978-FF1C657235DF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91625~1.EXE > nul4⤵
-
C:\Windows\{C71329F0-880C-44ac-BD1D-88799BA67B4B}.exeC:\Windows\{C71329F0-880C-44ac-BD1D-88799BA67B4B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04AF66F5-DB48-4fd8-A568-4430971D4416}.exeC:\Windows\{04AF66F5-DB48-4fd8-A568-4430971D4416}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57792A25-E54C-47e4-9D44-04A7A21771D6}.exeC:\Windows\{57792A25-E54C-47e4-9D44-04A7A21771D6}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D47F215-78DD-4237-95F4-E8D8BC241D21}.exeC:\Windows\{6D47F215-78DD-4237-95F4-E8D8BC241D21}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{195EB22D-6FB3-4cc4-ABFB-BC3B2C8C0300}.exeC:\Windows\{195EB22D-6FB3-4cc4-ABFB-BC3B2C8C0300}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15F5F2BA-1353-4ef4-9A0F-C210B0881882}.exeC:\Windows\{15F5F2BA-1353-4ef4-9A0F-C210B0881882}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C389542E-AC79-432e-BA84-5D01E75D82D9}.exeC:\Windows\{C389542E-AC79-432e-BA84-5D01E75D82D9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86A19CF3-1176-45e6-A092-A9869873CF5B}.exeC:\Windows\{86A19CF3-1176-45e6-A092-A9869873CF5B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD876EBF-1CEA-453b-919B-110DF6D0B720}.exeC:\Windows\{AD876EBF-1CEA-453b-919B-110DF6D0B720}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C3E18B35-D3E7-40c3-B434-F16E5C45710F}.exeC:\Windows\{C3E18B35-D3E7-40c3-B434-F16E5C45710F}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD876~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86A19~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3895~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15F5F~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{195EB~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D47F~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57792~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04AF6~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7132~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51FE2~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD54d1f8714ec91cd13e061b22d7f3c2bce
SHA128f5fc9c30b3495ea97ebda7896ab9a6320a0ed9
SHA256904a712675df8d360403ecccdc25a1d90a194bcf16e3198beda518a4d9ebef0d
SHA512b5c20ed3a02c16c127627fb1f4970a3056a37fc9ea06abed1c0aa7359c82c4cf28363901e0eba334935f730860b8d59086de283b3b6b56ea10e9b7dc6b44c0ae
-
Filesize
372KB
MD555e122caf0783a489a79ee5e40216122
SHA1570e6cbbb1f68bc636e0113436fac6d6d5b22774
SHA256996f934dbc195a45ffd6e793b771c58cf813e3e3bf3332c2b76916fac24cf3b4
SHA5128f8e586ffabd5a873bbb66033b6844881eec0eb67620d93996aa508eda66da1a8d8ed9664e7cc0bbae009b0b0595e70a5adf5763f599c7df5dc7fde63584cb33
-
Filesize
372KB
MD5d4916d56f0277b0100c3f13ba322ffdf
SHA1f86b0e0d3a283c6e015ec0b6d0e84b9d217ac50a
SHA25693c49197546df7eb1427a1a233d15ec0b5b2490d85e1192ebea76252da7e5cca
SHA512a52bf2d92c118023c103f109d5eb6409eedf296d3937e582a156d86397509377af7c3e404b933a98c970b2974b4a79c24862f3aaf49571fbccfa347b8179939c
-
Filesize
372KB
MD5efb473e734c2d1c2307896707468c8b8
SHA1de75e7519157970d00b0b7c26496dfca92ab0884
SHA256ad9a79676e95aecf8064d18f7d21aaeaa6e25f7d4ac62a4f86f1d78770d2abf1
SHA5128bdba9506d403ff616ce5784735c4bfdf2732e33be0949e47373821d592c5896088e85f4b95876454ad4ea7f73540f81a498e8adee28d12f10917b4d23208cc4
-
Filesize
372KB
MD59101520470891c26c6a3c25b62289a99
SHA1d0d8dffcc1199bddef8689d9fcf09a2748cf3dba
SHA25612a3ea4bbf179004af3be2bf0ebec2cb206b8f8c5086c35977fd3c8d3791d4c3
SHA512c4eb977fdf33fdeca77f9d0bbd1da3cc7039871a053df8db1ab4401103bbac6e1449a4d782e475bb429abf7a7adaccec7232c6418755ebedf0b072e0562b8231
-
Filesize
372KB
MD55aa6199ff5bc2127e3cb9554d73cc47d
SHA1df3749d562601ab45c652e9294cdf5f48118a9d6
SHA25674e29fe43c24b6625df530fc11d88be995a7686927f41b850070151103cff156
SHA512658aa7ea7fdc09082ad26e7fadd2b7d5d829dd1de8beccd32ee869428c8884547705f0a7ea1a98c1cdae03116ec47880e820987dc203bcd3bc20131a261d312d
-
Filesize
318KB
MD5a0c633023eeb7eb04239df20b6f9b168
SHA1732d3aab69ae2957d1c10e7addb5a96a82cbf380
SHA256ae90dc7df571791d42136ecd412a0cc2ec607bedd98f987cad7cf2731ffd7d0c
SHA5126156695d4f6bf7a9b65d6fd616deb3d0eb912dcedf402316dbf6fe204035d8c003c658bae50e8b0e7a4a57ae6e576f0bb076adab1c06fc01fe22cf2fd90a15a8
-
Filesize
372KB
MD55e635e19af63c292320ca0328d113711
SHA1eae7b7ef0687e7114daae4454aa39685cdbd8f4d
SHA256f3be43fe85cdf72d5db65dc035b196cfc6bd4b9f14ffd88161adf6fea3c8f9c1
SHA51249d4d3882fb5e98c699b2956f0407501e35f802e497dc41a6f40348f992e8d6878a67e6ff4afb82514529540864b9438aff5ca4492c2169253fabd9fd769b620
-
Filesize
372KB
MD588f662f2ae32ae6c20b254577dcdd529
SHA1573db001d78c7b06c920528a717264b5ab46ca31
SHA256333cdd6fe026054187f7e4c8c175814e4d9420d9ba61fc2ba0a7d8ff8060e300
SHA512718edcb3ab9d28a38b95cb6b1294367a532c8eba797a6c6b9ac80c9c196442a8e08b2a88062203522018fe98ad9f5542269df575658ca37030b89c792cfac826
-
Filesize
372KB
MD563a659296ea171fac17125597c2a8823
SHA160b2caa39a48ed316127962aec9a4cb7008c211f
SHA256a9977c05720e3b85aaf0c72c7ef11f4b8287d3326a7126bda621bc20c80cd762
SHA5125e1bb78786366ae6513c27199cf7cdce8b5ca152cabfdb32f7d8c97bdd6cb0b245bf85701842bccaa72fa8cc60ea13e0087230dda4480feb0258ca75689d11ca
-
Filesize
372KB
MD55c318258634f053b7a40f6aa324a0d38
SHA1aeaf03b765bd86dd37890eaa8477f4bd4bd316fe
SHA2568b8e892dcd998fbf5f3923833be76cf748ba3f2e50c5f7821208be9608e1447f
SHA512addf5bee9aae00f77874eb37f3f1c1b943f0be35fedffcf2f9910d853ec3006061975ff8614d4e95f9b35c2ca5947422136b574494e7295b239cb22ad7781d03
-
Filesize
372KB
MD5d66c3ecb648e7ed3910a451ffa87f5dc
SHA101ba318d82adbb8774fd9913f7dcfc2d981d8103
SHA2568049abf359d8791ec8a41cea1aea1cb8efc5aa77b8124a42e67e14f692970e69
SHA51234e33be9846b28179ee04834777a434ea3ecab9739623453870116111d5a2b5087ea373717b0f69216a95fdc1ab94080d9697849c9371cb20665caaf9983bb41
-
Filesize
372KB
MD5a35ffec2d210fe92978cbc8882fc32a0
SHA16a2ef51848725938b2396e1fa5633ce145a062d9
SHA256ecd50c7bd4094d9d81e8927b7d7b925267c0824a192d8c75540bba31fd763fe4
SHA512278f5cefd10722b6b5cb8905edae5adbc2376ee2890419a1dfcefcf0aac2f9fe43b4e99990fb2eeb9a97c0f66ccf6cebeb53782b369822e5ca27670b91079567