Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 19:55
General
-
Target
2024-02-12_43cd328aa4fd5269508d217deaff4dca_goldeneye.exe
-
Size
380KB
-
MD5
43cd328aa4fd5269508d217deaff4dca
-
SHA1
93d0c9900fb63851d012cbe6609779dde7fe4267
-
SHA256
5411a9d00394116da1ce495f38e602037a92a7e42c63ca57c7a8a612b24ca968
-
SHA512
f1449a006b221a4de0db697854541ffccc9484f012a39afef930fbdc71505168614e25222d72e409e75f4d4bddde5daeef8cf5036003564cd5898ad645c76354
-
SSDEEP
3072:mEGh0oElPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG+l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_43cd328aa4fd5269508d217deaff4dca_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_43cd328aa4fd5269508d217deaff4dca_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8EC49B8-0BE9-4ae3-B933-57CD676EC8BA}.exeC:\Windows\{E8EC49B8-0BE9-4ae3-B933-57CD676EC8BA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DD9DE63-262F-41a1-ACC6-276AAC676E48}.exeC:\Windows\{7DD9DE63-262F-41a1-ACC6-276AAC676E48}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C00BB82D-760D-4c97-91A9-6F5B995510AB}.exeC:\Windows\{C00BB82D-760D-4c97-91A9-6F5B995510AB}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C00BB~1.EXE > nul5⤵
-
C:\Windows\{0E9F9480-CDAF-4c45-86A0-C7B3CA3E3064}.exeC:\Windows\{0E9F9480-CDAF-4c45-86A0-C7B3CA3E3064}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FF2B61E-701A-4581-89CC-191A0A516ED2}.exeC:\Windows\{6FF2B61E-701A-4581-89CC-191A0A516ED2}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16632D65-4835-4717-9353-1933CAB0733E}.exeC:\Windows\{16632D65-4835-4717-9353-1933CAB0733E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABE9EE54-FE17-4856-887C-738D944CEF57}.exeC:\Windows\{ABE9EE54-FE17-4856-887C-738D944CEF57}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26E6958C-176B-4e33-A80E-3480E58CD5F8}.exeC:\Windows\{26E6958C-176B-4e33-A80E-3480E58CD5F8}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E30AEA84-77BF-4183-A8DA-C97EDD8061C8}.exeC:\Windows\{E30AEA84-77BF-4183-A8DA-C97EDD8061C8}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A24B6052-16B7-48ca-ADB8-E2089327381B}.exeC:\Windows\{A24B6052-16B7-48ca-ADB8-E2089327381B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86E6C834-1457-47d7-836B-89AC78CA82B7}.exeC:\Windows\{86E6C834-1457-47d7-836B-89AC78CA82B7}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DA1CA536-1E1E-4686-9C7E-9215038695D9}.exeC:\Windows\{DA1CA536-1E1E-4686-9C7E-9215038695D9}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86E6C~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A24B6~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E30AE~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26E69~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABE9E~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16632~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6FF2B~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E9F9~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DD9D~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8EC4~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5252ab7e2e2c61489dbd3f0f573bafd95
SHA16bae62a44ff9b2b2daef416bc2022f699c586565
SHA256c69a2f05486f14452ecc046ed9a6cb2d06bd817df6b2e3082ec420f6bb0338cf
SHA5125b2b847483509ddab6bb9686965ef892c5c3bba72b191579810662594a9d6f80202cd2a7d1419d871b672430a2f3fc6e9a42e7f561f4cff68ea6f8d9ec4e74fa
-
Filesize
380KB
MD5ebfb298e491171b786b134b1725595cd
SHA159f41a9281fcad14ebd61848c33e4ee73f0c6b62
SHA2569d25fe52859465ef605c75e35dd59bf10633cbb343c2978742cbfea6f8e46c6b
SHA512e52b63495c9d8ba0b4db1df2df8e336b703b315f8768b452bd99de1f55aad524c4d5c19df03cfbdd0142149d730082205902d004c3d1292cf383c7ad9501c050
-
Filesize
380KB
MD5d868e5f25aa59939e4b5fd39ab60b92b
SHA113dbb2399d00a2240757b35be5974177d85acca4
SHA25693693dad239e6b730b2119b48a850035f5ad6d8b4e1ecfd67af8841f27795f7c
SHA5127ab5d37f2ec35396f6b8fc2e61a7d16602679b950f9bdcdc2d85497576921d9345f2d08186878365fd2752bfeedbffeb88a7abe76cb4b57d73c9cba95d1fbbba
-
Filesize
380KB
MD555c662d82bf7cebb63ad92df5fd1d0be
SHA1c0dd4e32b783bbc6516a9b6c324b3915422fa78a
SHA25606612aeb7ffbc85b772611713ffcac23773bf9b8ad14a670bba7ea6526d8295d
SHA51260cf200bd4e5dabf2a2f193c69eb79c6c9d969d83ed538065904f4fea31895232363688ad3bc221d1536ea44d547286c2a52fe26aaecd7fb477b43f8a3e06948
-
Filesize
380KB
MD544cd2232102db4fb1c8a2fcb8c4deb5c
SHA17f5b05477a609830fb02be6d3cdc3a881978937e
SHA256aba4afa51cdff4369528e306f552d954e5df15d8a3dcbe9e0f30f4911ac8dc36
SHA5123e8f12358e2da84a055b7e6a7dc39aa923d006838df49e0c1669acd8ab5b99b3c42e214b381a35f10d0e04cd0ca810629aa4650424c2e30c2346e4b42ad7126e
-
Filesize
380KB
MD5473cd7f203741bb63cedfb624f48b992
SHA1b5ae393899bebb62612505c5c2034731c58b39df
SHA256f1f4aefc4ca8943ed254337aae0ca39cff496073c851b030d1a28fca1f821e40
SHA51201611aee05bf596751acb9c805775862410a4b7f8357c7f9abba969b30d55253c1da2cc72001708cbca5e1574dc3815f69070330677780de75115082f8c89047
-
Filesize
380KB
MD5485acfbc8ed0c5da9cf5bb6d5b0c76b0
SHA1675dcd860845bbbab8f630d33f11ba7ddba4f2d3
SHA256e7796dce8e73b1d52f4c7ea798e014707715be91f7d8f4f61c72517cc20eb1b2
SHA512319824f2c45b4b92c8581ba56d78986dc7b7b714cc733ce6221f8ad01ad05a19e22cc512e94a5164fe5cd1ce36c2bb6a446364329198c1ca0d6fe2f6bfb042c1
-
Filesize
380KB
MD5f83c10e346e1778ef45ffda249189dc1
SHA1d7b194baa22443fcfb7b47caa73b09c12f3d5280
SHA256d77bf9580692d61f0ed0f8776931ed8522ceb96b7ebdf4cfb24882e231ef3249
SHA512b07eb0c0c185ad464531730b76d79f2a3d4b69059e545715c29e35035b17737d82620b5f78405bd290c87c81280dbe6e87770087a7ae18f4effa93f6cee73d80
-
Filesize
380KB
MD55301f43fe422546e1d9920e8b6a20e5a
SHA1b1af52cbf0ef2dd78ceae3783bb10c005209f496
SHA256e33bff8499b58b81a3511c1a12ec216da3307f7b47b4cd9d89592c5458209b78
SHA5124433fe71a1203ec0b8ad29c07c49fe7e1d2a8425bb8a3e41bbcb38db304d156400d7e1f950efbcd84056e831a0d8efe2b041c4ef3f8b397e492c902acdef1b0e
-
Filesize
380KB
MD5c04a8a902f2c1596009b6e5e06604621
SHA149cbef55c30bc315c288e6e91b4452cdf917f27d
SHA2568759858787e5028bb06ee0764d6bb67d5ee8af6b7534f8b45a7cfd847cbc732a
SHA512dd172943466c568ab760f091202fb7c0d79e1a3f60e456b6a50dd0a05325f8cbe3ab5c29ac2c3d068d17e46d7b0220db6f36824b59b07b6c6f538b4f2a643a22
-
Filesize
380KB
MD598dd2fff00c73b297bf4a469a07705c9
SHA1db7961bbaf371b6b03e6aeb33313fab723043719
SHA256c1bd67b60da8816614510b49d6191fbb072e0702fd070a5415b00f23c3129ce3
SHA512a335677589d80a8d7884eb80e49fa59cf7dee1a2bf252cfbcce26bb406a51091f78099f44b1156037a982d0fdfa3951686079738b342d6fd22a6c1920fe26713
-
Filesize
380KB
MD5a6496ccd060f22a11ed4f483f85a73b2
SHA16cc2fa9f341a1b2f238d7042213ea0345372a8e5
SHA256d193d6b1777be052f925a4773414aae64cad9371bf32b33245234ae1e6858801
SHA5128fc9ecdf5d006f65e2f8bd8865b8750b166ab2ecdbbcb1944815161bc8a1488fbc152a80837dbcdbbfac9269a2188d30b43934c230b3bcf07ec0002c597a3fc6