Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12-02-2024 20:20
General
-
Target
2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe
-
Size
372KB
-
MD5
ce09de74a24ae5891ffdaf2b69c0b5d1
-
SHA1
dba92e1d8f7c659907c6bfa5626dc7c07be54a36
-
SHA256
8f461d836a5540a2c43018397ccea692206512053f77ca03ea6daf48484210e7
-
SHA512
829308d90942e0c266f0894f92eaf609d99c73c4c498bd6d675bf530e6e1e015dc4f70c66c3542059802a5af2fa2d401ab0d4925766cd541afe1578745125d5f
-
SSDEEP
3072:CEGh0oXlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG9lkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ce09de74a24ae5891ffdaf2b69c0b5d1_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD16725A-522C-433e-A73D-56FE36552AF0}.exeC:\Windows\{AD16725A-522C-433e-A73D-56FE36552AF0}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exeC:\Windows\{34134B4B-E4D8-4fd5-97E7-CEB7D7B91F54}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34134~1.EXE > nul4⤵
-
C:\Windows\{A315B770-2622-4b9f-B98F-129CD28BC94C}.exeC:\Windows\{A315B770-2622-4b9f-B98F-129CD28BC94C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exeC:\Windows\{C5FB7D97-C3EC-446f-A603-8E9685DBBCC6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exeC:\Windows\{3CFF3EAB-CB6A-45da-977C-296E4CE32940}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exeC:\Windows\{BE4DD1B1-907B-40ec-8AC7-7A0DDDE39B6E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exeC:\Windows\{3B2FA5FF-8622-4985-94C9-B7FDB05FE90D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B2FA~1.EXE > nul9⤵
-
C:\Windows\{0508D169-BE44-4097-AE3D-6D6469330088}.exeC:\Windows\{0508D169-BE44-4097-AE3D-6D6469330088}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0508D~1.EXE > nul10⤵
-
C:\Windows\{4ED47729-FCE2-44cf-8971-7B883357F29B}.exeC:\Windows\{4ED47729-FCE2-44cf-8971-7B883357F29B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4ED47~1.EXE > nul11⤵
-
C:\Windows\{0430D383-2D39-45f4-803D-C7DC25DACD97}.exeC:\Windows\{0430D383-2D39-45f4-803D-C7DC25DACD97}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0430D~1.EXE > nul12⤵
-
C:\Windows\{BEA03692-AF7B-4752-B1A3-68114BD968E3}.exeC:\Windows\{BEA03692-AF7B-4752-B1A3-68114BD968E3}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE4DD~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CFF3~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5FB7~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A315B~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD167~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5f146d81edf9a34b7365b78e5b24ca7f9
SHA1f250e354a21943ecd01a3de9539bb6f1b12896e1
SHA256d6b86f1c3243b4f126ef0bc4b9a579055a5cd59543f7dd9186d951480f126f8f
SHA512ed1c234d66c1002c3f84ab2ee9d4eab1155f19aa2d59d19dcc90b5afe4f74e7148b8af174d03d1f776b2e766bcc43f75e8ec229fdbb5b4c4482636e401f0405a
-
Filesize
372KB
MD5aa03e59c16baf16411f18a6656852ef5
SHA1f02ad5e41967e994949260a28c08fc23dbdd22c2
SHA2568e352c4a7f83c57232433c22cb0f7c2e454ed005ca4c60cbd20c9beb5b329215
SHA51260fea55df28b23840884bd0e1cea9c6874720ec95ce1b0d31e227ccbb7d1ef717b32505625c5ce8cca6c0c234929e9275c8419cbc28adfa3864381744c7772a8
-
Filesize
372KB
MD5a68fd167193263577aab9888b56a69bd
SHA169a8a1f904136f569a85607686d13b95bf3bfcfe
SHA256972294a5a20b8e59da04945d4edd8d01acfa49a6bc7fd779139084d0c5b8392c
SHA5127538bec2373587865ea929d48b18d0624041d47b74f71a465ba056674caad8d37e13e4f9528e421c01c4c7e5c4f63df0997530bad199ca3234351b95a28513cc
-
Filesize
372KB
MD53075849ea1b05b37e48b0d74287d12f5
SHA157b676b39e29cf7958257f431027b81556a8a78e
SHA256eeff2a50f54d922f0130f6fc9ac6790a194ff6ff42f585cd3dc511b099226894
SHA512288586943d19de732ad6c195b58f1a81ab6f6e5b3245b04e5639ca14edeafda28dc94d8362889f828e20acea5ac5f87bf5a0d356401ba0089a0e6f07e11836c2
-
Filesize
372KB
MD50d7ebb1a20af727dc2b2782bc41da136
SHA103884c7f8082481b3d78cefed4dbaefd49377d82
SHA2563401dfbab46926c8e088e691ff825a27a2105eb3128499e1b71938060b48c3e3
SHA5124c85f317cccbe5098977b17ade1b06ae0af548dff8a3b7c0dbcc807ff290576b04d68a509e96314db9f1370b9e81d45477cdcb736c1943fa8998cc9dcb431293
-
Filesize
372KB
MD516e6eb8fc2ff1addc7c85b87ffbe5ab0
SHA1dc9c45fdca9e43b23a1284dc614a061f0dcbe7a2
SHA2564656b026eccb49834fb752378c6385d82f56e588e65781d3085614d0470aea2e
SHA512e390e5c744258550dd32874768dfd185445a2c4329385b4fd8611c78353dfada4585a27216bc1223d3d1c5c81e7ccc004e1e74cd49f5db10685b3741d579b771
-
Filesize
372KB
MD5140efcb2f37740197e0f85ff3f089bba
SHA19547caace29429f36367ba5b640b56d6d7d89413
SHA256601f612c48e51332363eda2188f5e2679919d2c7fce9c689b126a370a6d65f4f
SHA512cd5a4290009b260878923157b7385c65425fd277c3c19862e355156dcf3983564a5431153c9993e5daa6421bee632d91ca54a0bc1e74d0ca23d9c9d245d6ac11
-
Filesize
372KB
MD5d3dbb409e3d4b9b62ef5168ae14e77e5
SHA1adae990bd4971bcb47f5dac4cdf540b0f526c75e
SHA256b1e51228fd01976cd09a07b661bab8bb6438a6ca2158d8b13210821081e2662b
SHA51231ab53840e06a63beb3404082683871c88aa7a999f839c21f3fe272df67ef6ec35d79f643eec15575163c0c43196cec8fcefb5fc021c6a8866ab38447b9826bf
-
Filesize
372KB
MD5564d1ebe408bd2717db2a8297eb51b3b
SHA1f64ca5233ab420d12f31ef3186852b2fa3962706
SHA2560544777c533c0c71237dab9288d2f8ef2c0716fb28192fabab30ace266594359
SHA512e38993ffc57fd9d9f4963991a476ebda88cd01338dda0a012ac5ff208d080f0b9eac5d4e3b5fa3b2bb78147a3c938f0c56d1ff6b173ea105b12dbfd88b4389a2
-
Filesize
372KB
MD51db91b5c1b8ec81a232980a1336dd99b
SHA1209c9146b50fcd4eaaeb0ae36f28ffea0f7e9861
SHA2561bb06eb5633701bf015c2b69f9668dbc74cf412fe36c92fbba66dc828db21f1f
SHA512dd5644e6d21223971dffbb1d0b3b22fc6a0312b57eb506f34ec543501eed068177cba60694fbfe9a9e5697870dc9522f559d9c523f3812c1f950be0b3718a308
-
Filesize
372KB
MD5ec834b013d523cc07b2ad15873f94b90
SHA1bb9cbd0b5bd019dc5d67bfc743ec109a1cdf8a43
SHA256c8dc125573017a1cedb1887837875eb1b6329bf3722ea256d3260a5ff9ffae3d
SHA5127e25d88037e677e1ca5c1af345abaf90c41772a01f4aacfe1f4aed47416cfbd3815e73ee04f1ee58856b3cd60eb322e64401045a41b59793bb2b9c20d3b1bef6