Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 20:22
General
-
Target
2024-02-12_d27ddf85b9f56d364385a1e304375ae5_goldeneye.exe
-
Size
344KB
-
MD5
d27ddf85b9f56d364385a1e304375ae5
-
SHA1
94515ff981f9353992b6c44faef80fc6faac5af8
-
SHA256
737c52f77a454826ab42a01e322da0f40205d617591c02430105d3b853c7029c
-
SHA512
53c1107f64162e32690c0308a7796606d56d8ce331fb5c86c5b6aa3840ee41dfc17662823c8eb505f8ef3a5704546da9c6a7abe20c7dfa3df087092568ece61a
-
SSDEEP
3072:mEGh0o4lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG+lqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_d27ddf85b9f56d364385a1e304375ae5_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d27ddf85b9f56d364385a1e304375ae5_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{62173984-C5D9-4755-ADAF-6EC8DC3CC0D9}.exeC:\Windows\{62173984-C5D9-4755-ADAF-6EC8DC3CC0D9}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F772756-075D-4be2-B3D5-63C8A20B8DAA}.exeC:\Windows\{6F772756-075D-4be2-B3D5-63C8A20B8DAA}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F772~1.EXE > nul4⤵
-
C:\Windows\{37634CF2-925A-467f-A699-3CDE4463C73B}.exeC:\Windows\{37634CF2-925A-467f-A699-3CDE4463C73B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37634~1.EXE > nul5⤵
-
C:\Windows\{33878EE1-CC8A-49cb-9D4A-7C6B032A7926}.exeC:\Windows\{33878EE1-CC8A-49cb-9D4A-7C6B032A7926}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{623FAC94-D511-449f-A0E0-6358642CF8C5}.exeC:\Windows\{623FAC94-D511-449f-A0E0-6358642CF8C5}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8976C64A-6780-4973-97D5-9D8E7AC007A8}.exeC:\Windows\{8976C64A-6780-4973-97D5-9D8E7AC007A8}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E44ECFF3-02B3-4122-A2EF-0EAF89EA76F5}.exeC:\Windows\{E44ECFF3-02B3-4122-A2EF-0EAF89EA76F5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8364C3E5-DBAE-4b42-86E5-F59C52D7FA5A}.exeC:\Windows\{8364C3E5-DBAE-4b42-86E5-F59C52D7FA5A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FD8400DC-573B-487f-AFBC-0309793B5506}.exeC:\Windows\{FD8400DC-573B-487f-AFBC-0309793B5506}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DD86D26A-73F2-47e3-9F85-DA86555D5573}.exeC:\Windows\{DD86D26A-73F2-47e3-9F85-DA86555D5573}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F16D797F-E4F0-429a-9E80-AB52A203F829}.exeC:\Windows\{F16D797F-E4F0-429a-9E80-AB52A203F829}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD86D~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD840~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8364C~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E44EC~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8976C~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{623FA~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33878~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62173~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5055e1c4aa1d61c4c064fa39e007de6b2
SHA10c3a1e4e32d8702831c777d93b44bf36dba07de2
SHA2560993f07dfdb14a479380c6440ef4af58fa32ac41c9af7e2aae47c0daf2d9db3c
SHA512b7785cb16f7476d7b185d477a87f80a8f78417968f48120465678e0651fb2232ea0fd6783f8d5c73a4e106e9998f86608b49b2e47ef5dc9263fff8bc55da5c2e
-
Filesize
344KB
MD50ef89dc6a163b0dcb7709db5f484b3f5
SHA1c5dcc209e3c2135c492dde9f62ffe9d2331df1bd
SHA256cdbd158c7f9d85268f090dc325793f0bc1c7402935f6bd0b94687488bd3e8003
SHA512082060c9557cc0667797fb80fab87bf79dc1bc7a0dd0b42bfdabb30c21f9bee4e0719dfe5cbc59fb0f14fa0c8a45654e93cdf53327e0812101af1a403ae44f20
-
Filesize
344KB
MD50ad18bc538cd415838a8cedc80cff020
SHA156f2fce4dab3a45620dcc5532e187727d1f35043
SHA256019c65740e199d4118064d622eb798000be9b0efcd40a2f00d93bebd67c178b1
SHA512142e4414f7470d152a0a247ad8804d464182bba270fc85439500dedd59834f08cc3c51c9938c9ccc8205992d71e6c920986705760f5595e8152e34cee9fc8125
-
Filesize
344KB
MD59b1fb3192c9c62ec34c062d8637b9817
SHA1a621d4fe2328112cc95c5d3c7f0703f30ef7b8fb
SHA256b58798249177353c095c88b8402388acafcbf94c5ebf4c3d2fbc1cc28b26bb0c
SHA512c98426bd237fc8584faf5bc91d817923320f158a29a583adccedd7d0926c3227a6ad86a2b0180e256867a0c164239b59b50edee15955e91a6e2997a81ed0f5ea
-
Filesize
344KB
MD5049bc3a114da6d2f0c188b2072408f53
SHA16041caae415a161050e7667c73aa0d669bc6d9eb
SHA256c03d48f47b7055afa998c3c585798c133a2aeaf9f4323e7b5ca115c91bfc2f02
SHA5123b5f2c0f5bf9394e7daf2269343a7c29f73573a50459767ed4c8768842eba03c3f8ae87799854c94ec2433a885146a1b440bb7dd675ba22d8e18430a1cc71325
-
Filesize
344KB
MD5a531abdb78d67d3e299f9857724592a3
SHA166a3d46dd362efd2b31504d46f1831b771289b89
SHA256e5844b9cac0d3b6f18fae2c29261d58d924e00f22f9ed066bb3ac7aa62f32b0b
SHA51293ef5486bdef5bd2e8bd3ea7c7ca8e391d147f67ffd4153dd03631dc7ee12ff7fbcfeb59feccc462c2c338a7da48b9ab5388d30655dbcd5253b3515bdec527b6
-
Filesize
344KB
MD5899e744ee64abb61b128ae53b7df38ec
SHA1736bc0a36a72254edac0e3998c08763ecb560447
SHA256946842c4d515ae2f98bf6c9d00f6dcf44f4a178df84b5def05278827e07e2571
SHA512182a37b363678dc9d9aa4b3d3f4b12d02db194ad6bcd415df285d796512a8eaf66ebeb48268887e08604997d94af97c736fa17762a3d88692a7ac52fbebfcdc5
-
Filesize
344KB
MD52633245ad5b4718a0ad7163f9e94a8da
SHA193fe5fb3599a79dd083993a242f1929c6fed34c9
SHA256258ffd10572a9310d7af566435422b9ac5a3f7610023a151c2cd8e120178be5f
SHA512103ec301ef4b6a220ea00d3cb351a469bf853881968a7437424d91d38a9f432795fd5c9e69011714a5254671dc43d4dd225027dc030a25d1e61fe3fe5a25e25b
-
Filesize
344KB
MD5338bac7837b197b20d71d215e0b26079
SHA13c41f145d8284bb7c5d9cc08a2150aab740a7010
SHA256fe89bb6f749c2918413051f4dfdab016f86013b0df089e22b10273642d9d1a1c
SHA5124a16396ec6a214281e7f6f1ab9953a5d1f47e2bf3f32b757b97ba63a65dc254bad7e266c152e296c4e70b2d4d8f5dda00bbc4035669cf5db7291882bcbc9f383
-
Filesize
344KB
MD52aaabe381a667e010da0260c11473257
SHA1f4bf8278c277a1d07047d62d6be9598d42d078ff
SHA2569da6ad0b08de7f73de66631bbba9a0aaf768c4314b3d96db48964a62e93b360e
SHA51262f7e47294148a4d22b52ff833dfb9d56e8aea4fe5b70a88c4e6cbc6ad51e90e94d57f8d4618ddc973a87d4e0433a3b968efb82670d3c0c5e17353b76eea1904
-
Filesize
344KB
MD5968955f762437ac8e47acf141208e058
SHA1c6ca0023d58d25b3632080714c11cd5c31ec76a8
SHA25619f8368ad5803a32781b3fa0aa00b8f7719fb891af9a74758cd1c8907f30cfab
SHA512bd850628f766ad1742bc4d60113cf5122df3c828c9b3f3253a658a751f9ef9ea74c1fccd787de7b4c3620888c36d2a50ccfbfd2e76a9f357a62d77b90c3be5d8