Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 20:01
General
-
Target
2024-02-12_6a8772d5dc2c1f05c2df1b455339b5a7_goldeneye.exe
-
Size
216KB
-
MD5
6a8772d5dc2c1f05c2df1b455339b5a7
-
SHA1
8b4c7b1b03883aab91ed9f4cd8fb3b89f19cfe6f
-
SHA256
32ee44992f71b79e2d8647ec4218bd7a3a61786da619d9fbcbef6b9bc86438a5
-
SHA512
b89c5609b0b73e4773f5a350fc8ebd9866c111d3c1bcca6d31db1c88725b4a5175ada99f54a63fd465bab801786fa8d30b55b9040f4288a02fa9e7be64dc6eaa
-
SSDEEP
3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG+lEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_6a8772d5dc2c1f05c2df1b455339b5a7_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_6a8772d5dc2c1f05c2df1b455339b5a7_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD312402-6F19-4739-8A2E-89EAE88CB644}.exeC:\Windows\{DD312402-6F19-4739-8A2E-89EAE88CB644}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6F78CB6-AE9F-412a-8477-FF006EB94008}.exeC:\Windows\{B6F78CB6-AE9F-412a-8477-FF006EB94008}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4203C36C-5703-43f8-969B-2331F5C747F3}.exeC:\Windows\{4203C36C-5703-43f8-969B-2331F5C747F3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30712BC5-3EB4-48b0-8D50-FA764DADBD9F}.exeC:\Windows\{30712BC5-3EB4-48b0-8D50-FA764DADBD9F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98F31E87-5F7C-4acd-94BB-CCE350B506C7}.exeC:\Windows\{98F31E87-5F7C-4acd-94BB-CCE350B506C7}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7002FDE-6CFE-4fe0-93E7-259D8470E338}.exeC:\Windows\{E7002FDE-6CFE-4fe0-93E7-259D8470E338}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C93970D-A510-49d1-927C-599E8098E1CC}.exeC:\Windows\{8C93970D-A510-49d1-927C-599E8098E1CC}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A11D879-33B3-45b2-910E-9EDA19080D75}.exeC:\Windows\{7A11D879-33B3-45b2-910E-9EDA19080D75}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9A8894E9-B578-47cc-9699-70234732011A}.exeC:\Windows\{9A8894E9-B578-47cc-9699-70234732011A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{01FD6290-D688-4f73-A46F-AFCEB3100E51}.exeC:\Windows\{01FD6290-D688-4f73-A46F-AFCEB3100E51}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9EFEB9EA-D396-45ae-AA1C-772D0CB9B5E9}.exeC:\Windows\{9EFEB9EA-D396-45ae-AA1C-772D0CB9B5E9}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01FD6~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A889~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A11D~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C939~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7002~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98F31~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30712~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4203C~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6F78~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD312~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5f0498d0f25196d5c840a3f0cd32800cf
SHA1a2269f783b90bc14af13adc751cd8b000336c25d
SHA256b5c3d13e86daa4db50128cb0778e205bceba5a9a68f4d96fc3d31be975f8861a
SHA5124bdd31fe71d619f57836400e3a7c1905471b1c1bad3caafdf711a0c4e204a0765a55720b4ea3b0342b2bddad8b908f25550a7a5a55edf2112a297c83db3991b7
-
Filesize
216KB
MD539f503a1294b0441bd48a5d37f3a370d
SHA182602126feebf930c40c413c344ce5b9b650f7d4
SHA256dcbfae381e36c7db06fb8a937a83177b1c1293f55bb2f4404db8c82c781b8ffa
SHA5127849ffcd0d13a761a585207d0f8afdb5899e9c7c90ab3c4dd1a5187fc341a3cd565c9e5b045b9f1c25722ff04d4589f1fd66712685f70023816834a7cd6deeb7
-
Filesize
216KB
MD57d4e1a05efd89f5e9576a85c7228bd9b
SHA169b1c84553c724f353b8cb0b32e5906429ae3438
SHA25693f2c562b60b81125ac2e7868809fc09c1605b5752ed283704bc8e82ae52e7c2
SHA5121df8ce0528cd710575033f04412d6d89a5ed6e2c6ef93b65614ab67267306e6ad02ea68af0f3da85da0169d5e428183f9033466c20c40b83e0b3d5ceffb13f4f
-
Filesize
216KB
MD5bd21547e4c40a1baee34926a6fd5c9c3
SHA1ef734014b35ca47937f6853cad6db155950e67c9
SHA2563498e8635cc333fa99b60f46b942e4249ae22b335f20ad5eb25ee4668eb165d5
SHA512d009f8ec591dda5fe170b5809f9d52a8bef4231a086eb6aa359cb364700e251012c1f493532ee629242617e6155fbfcfa87d3ff79cef493dd4317d442b54ba92
-
Filesize
216KB
MD54f547524322c7b337ba6d489b60ef7b8
SHA1d5d3e1d2d10e1a7f09c7f046afb551a5ded796a7
SHA2564b6cb5e7d49b2913a8a9dea58df6076236c3a3d9439c2665f8bf63098f0d3fcf
SHA512ec5c5703819392f4d62bc69fdbd0bd012b28eb48e31516504a4d9b366abffd434a34bcd5500cfc14f8d2ef71300cc0f7b6729d29a93692255a76dcbc785ecdbf
-
Filesize
216KB
MD56d05ef486df43ab7933b128c93aa238a
SHA13f00cce752c4092b73f6b7c84140f615f2680c61
SHA256d46b77542187950fd71d1e27a7ac8c910e5a7a037acdec53fabd2bb6a6ee09e0
SHA5121c1a05c01873a7b1b88712e34dbfa572c98adca3b3545a69f9cd473fca1345a85231f7ba48a5c8ccb041ec9982df7b481e18e77912ba161e546a8d045d494909
-
Filesize
216KB
MD5cd215a4e584ebbb63e9460d08240c830
SHA1d2b0ad46cdbca28d5afe4ceba5f1957d37873ff6
SHA2569a731833733ba887667e7e4da614f1272087c796f1701ecf3fce1b2eda1113fa
SHA512927ce610da71ad9d515fde47d0bb7660bc95727e521aa1329c699be918815205aaa3ba1f1e287fe1882841dc450b65ccbf8beb2651239a5dce87f068abf59d85
-
Filesize
216KB
MD5dce1aa685d3300b54ed477f05d0eb10e
SHA114cd358ecff6239be871ec654c836a3844bac415
SHA2569dffda32e217a39277e50af95d764af944953561a1898aa0678e5685e3fd7f66
SHA5128ffafab51b957bf003460ad4b74555cdd60858c5ba98c4cbebe266cb953e2a48d57d3f633247618a79d9a427b65dc45037c94f5f79cf0b63e5c7b0c885d9f201
-
Filesize
216KB
MD516e4e259d408c2dd6454db021c96a102
SHA19393dd4331fc7aeefd49e4e85163c1a272a865d8
SHA2563106f45c8c485fc28c5e8867e059fa9fcf169f00b58d348280f524e4a8ca1216
SHA5121774518ba84359c3036107d086fec0cf51f0440721b4edd4f250831d1d14662c034c5a519efc13597d23675b9ff9f512cfd7bc5914a1eb35865763cecf2afcee
-
Filesize
216KB
MD5b267cfd49d1cf2e710d389b3667310a9
SHA10c2bf36dac437d7d07295c40d40d69f43f2fb26a
SHA256a89ec142979647d0278a6f2f4156370efc812d470d5f40a8dd13867cfd10bc1c
SHA512bd761110d2e5a9a91cd76d240351cd8c929266e4c07ea4a42fd5b0f64a91baac943c46a984712b2a4945da6665d276f8c946c74cb9e5ed22af214baf6c6a6f7c
-
Filesize
216KB
MD57fba4cced291879a650176b0b9415fb7
SHA187bb13d6f1cda1b9cd3c2021a35ca799b88bacd1
SHA2567a07a5aaeaa4b82f1b89c53e2add63c17efdf1d2a9ed58d87d75ecae32411336
SHA51253bd437b961d6a92ae5da294496ea2db29d356df4a9d23cf0674c9bcabb39dcf84236c780eddd90a0a5c3af18d2e228c10fb489caf035d51db03b48a06c29023