Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 19:52
General
-
Target
2024-02-12_2f1c59e283dd639eaf00ebd8fd94072d_goldeneye.exe
-
Size
380KB
-
MD5
2f1c59e283dd639eaf00ebd8fd94072d
-
SHA1
535e29e5a55a10c331f6f48ace92db10df7dd043
-
SHA256
938c761a7c1963ec4e0672a09a4b6b85535340f94fdad497d688d1cfb25c6e87
-
SHA512
59a3efeb29a592cf403d8a00a2eea3f93c6b1dadd76551f300d732f0892912fc20a3499946f6c50fa5b4e4c8da2aec4b547e190a610ac692dc8bf53dd176fe5a
-
SSDEEP
3072:mEGh0oClPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGcl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_2f1c59e283dd639eaf00ebd8fd94072d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_2f1c59e283dd639eaf00ebd8fd94072d_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94D2B78B-6853-4252-ADEE-F746FF9B6F6C}.exeC:\Windows\{94D2B78B-6853-4252-ADEE-F746FF9B6F6C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61B41394-9E92-4b52-8DAA-1E9B5A34BC68}.exeC:\Windows\{61B41394-9E92-4b52-8DAA-1E9B5A34BC68}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BFA82AF-CDE1-4a07-A8A3-49124C2C9471}.exeC:\Windows\{5BFA82AF-CDE1-4a07-A8A3-49124C2C9471}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFE8B8FE-D5DC-4ec6-9262-68FE1C26E399}.exeC:\Windows\{CFE8B8FE-D5DC-4ec6-9262-68FE1C26E399}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{139A134D-838E-4479-9912-4423E0238CBE}.exeC:\Windows\{139A134D-838E-4479-9912-4423E0238CBE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3273886-F4E8-4dac-9303-B3B58DDCC60F}.exeC:\Windows\{B3273886-F4E8-4dac-9303-B3B58DDCC60F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10074FF2-69B5-4c22-A2AF-22676770DCB1}.exeC:\Windows\{10074FF2-69B5-4c22-A2AF-22676770DCB1}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0F6DF41-DEBD-4d29-90A8-C2E0C75EC3E6}.exeC:\Windows\{C0F6DF41-DEBD-4d29-90A8-C2E0C75EC3E6}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5D7D5DC-9F97-4b00-90A8-2D3688E9EC71}.exeC:\Windows\{B5D7D5DC-9F97-4b00-90A8-2D3688E9EC71}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{254192B8-C7FD-48c4-A30E-F8C9BCB72D43}.exeC:\Windows\{254192B8-C7FD-48c4-A30E-F8C9BCB72D43}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC5C22B8-0C64-467c-BB1F-333610944027}.exeC:\Windows\{EC5C22B8-0C64-467c-BB1F-333610944027}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8E7BAF21-BB9A-4503-9E83-86540A275FE9}.exeC:\Windows\{8E7BAF21-BB9A-4503-9E83-86540A275FE9}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC5C2~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25419~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5D7D~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0F6D~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10074~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3273~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{139A1~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFE8B~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BFA8~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61B41~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94D2B~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD517f01cf2637752ade2be16f4a3aa488e
SHA19f21dfb7bd3e822c13d47c7769a37b265ba693e1
SHA256a942d419d0de2eccd6a9711547ad829928bd82bcce0edb1ffbf9a8ad5f39ab29
SHA512f4aa75ae80e0d0e4114a164fac8c583042afff93e3427d2bde48c27e8b8abe39376984ea18b0f1242eb25dc34b17bd588fa57de7be2d829851a3b507d6372c07
-
Filesize
380KB
MD5bd90dcc5d5a3bb7d519f11aeec41bc42
SHA1829442d31a71fbbd6dd6111f91fdc034a5d006cf
SHA25640f78cbd239c4ccaa7d6ef2d06f34b6050bc443f5bb09c723d21a907c0e14022
SHA512a32ad50e59bc3c9db004a6544eb71bb79620d0c6b0ed7aee6b9a63f66488cf4417eed4ccbd317fca4f9c21df1fc983013978cfbd56181e095bb1ab766cc94979
-
Filesize
380KB
MD513c7ee10feb865e7e4333890b92548b6
SHA1987368fc80f5b28d59b2c808753750d538151b54
SHA2566b115792dc640ae5c604e17aeee904471d0485fd59150595fb98acc13add2aee
SHA5120df52b0138cc79ef3fd7255b7e93c3079e39585e4ece37620046ff8ead1583db47db28bedd2d6b7e691f65076a5dfb5052c93e15c7aa30bb6600c1e4bbeadb83
-
Filesize
380KB
MD57b9673e9c92044c4362843d66984774b
SHA1f51f5f140caa04d7ec5b265a3fcb105343c43379
SHA2563159f8b250bb4b0a8ba52c3fb51bdba7b3866733b89b7fc5acf332b7e5914d50
SHA51263a78251ae94854edd029448fc8dc60abff7f1c921ddcddd71c6766d47d60c2495e933618837d02294a4e5df12bab9909587cb919987c954147863dd73bad920
-
Filesize
380KB
MD5b51256c9a8b3f1be3fdfc8800a5d9110
SHA1ff9e026648235c02abf9239d2fe35d4a13a29ab8
SHA25616c60d76ec91453e5db9ad901645f93e460f52cc18dd75428e5c1f188e9ce8e5
SHA5126ff4fb82cc604c59c79d95cb4bb61485d4af2961cd63b1821478be4722a1a72a4c41001b9d0f8f6b5784550f788b85117698a1a37c0ee02559781b9fdbd7abaf
-
Filesize
380KB
MD5f325aa9a5f2f3b205834378157b907f0
SHA1fffb88dd843bb30d43b6471ab0f6ed12bb7090b5
SHA256a01574913d2cedf591a9d4eb6bb69b7db9873fce236de8dec9036a103f03127b
SHA512a6372940f354a04bf551e234ce44a6532dce57607fa278ff782f0d10675144d6f92d5bffe2981c94d780c502201aaca27e9aebbdc42eb0946e97f9413de71e0d
-
Filesize
380KB
MD57b4b24bb91266c94360e90b7aa11e7e2
SHA18b7b133a97ec4fef216d64ba79fd5f91f287696c
SHA25696ebd932b7061ff1d8e60cc476506e0bd3c7412cf74a27abd094113514c84e68
SHA5121b139709b9032809a66e3d0bbfe01b07d00036c5553057e4ef5e9df8a72f68fc369f77b11411560a55f2379f6b820e5a22eef4e5e46024318bb3a36176ba3898
-
Filesize
380KB
MD57b26fd7fc4e9a482eb38e820fe3d686e
SHA1c095b4d58ca0318c5eae5861da42a9d16c22ca51
SHA256361843c73095461dbf91f265b9fda79244b9ca07054c4bba08e1284c4fef3db2
SHA512b8c1b1090076d981346ced8f148ddb57d4d5a1b2c420679de775cba9d35556f1edc1fb372e5cc0329e432caa5d42b380c769ce839419a7ded12304eb0765c449
-
Filesize
380KB
MD535bf0e78e0fece5ac95e9999aabd3ec9
SHA1c62fe39fb26717deb762b84d037e1d9c9fdb9038
SHA256808c33f4cc56dc13f65355ee044cbea8e990e6c992560608208b43245f2d1d1f
SHA512f91c49dd18a18257bdba01f13e2a252bc9c942f7eeac9df55d6fcc04dcc9e825efb7963f7d9852765372fba51dd0890dff3b030fb7d2706b066865b1c64ed69b
-
Filesize
380KB
MD5bc328793e67880cbe8c40bdde2053cc2
SHA1b57ddf47660db4a2f3900b7137673bad66075976
SHA256f42e329c6a3a4287c060b77cb6cbc1d9cbe4c68ee69459131590084666d086a1
SHA512e0ede86db980ead19e284ffcc5d5a827485761f4ca39f8d46b7ca2af35d28003029c16b72a3b98fc97e34e74da5234d341435b35d312bbae53c305dae497a4b9
-
Filesize
380KB
MD5af65118e7542021c3c9128f4c3bd8a09
SHA1077abc613e494e8f05ae7556a0f3ebe34496ec72
SHA2564130443d31af22237a1b1048edef3aab5ee42f8b2abd2bf24563c678a62252c7
SHA5124440b1a5eb52c4cb51256ebe2d7cdd79442d0202b85b944e0893607a7cfe279291bbf30b74015dbe1b77e17305a887e51d4069897ec36cd7d6c0d897dfde4b37
-
Filesize
380KB
MD52c88b623101361556bbc309bfe3b9312
SHA1a77ae3c3173d4dce6888a31d8d14a87aa1d999b4
SHA256bedcdcc7ef640cda4821c4077b3ca2506a2074573bfd315c0e225cce86ec6f2f
SHA5129d4db6f763cb2e80ce20ca929145c45a0b8550de33925d9264a180db0233515003745bcee546628f4e799edf038fff632b843435d199f86d77710f58b0b9fe8c