Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 20:01
General
-
Target
2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe
-
Size
180KB
-
MD5
6c95a31298c2f30c2ebd563aa054f496
-
SHA1
70c2ae1b4d89a6a27aa08ebd07cda5e77390f20c
-
SHA256
9cd5791ec2b1578dd2c882a4c74e660649b60416780ca921984bbb2de16b69e6
-
SHA512
6a3b3bbbe87e2f121c3e4ca6943ccbf67ac0fb4939594a3f369151cb23dda4b50823b8fa9fabbbfb61ebe131236b1f624f5058f421c3de4ffeaa04cbd29b2cd4
-
SSDEEP
3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGKl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_6c95a31298c2f30c2ebd563aa054f496_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF243A63-FAA7-4667-A4F1-A29854F89FDD}.exeC:\Windows\{CF243A63-FAA7-4667-A4F1-A29854F89FDD}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BF45106-F83E-4061-9957-51971623C978}.exeC:\Windows\{9BF45106-F83E-4061-9957-51971623C978}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BF45~1.EXE > nul4⤵
-
C:\Windows\{6CF8442D-EB01-418a-96AB-70B879B19042}.exeC:\Windows\{6CF8442D-EB01-418a-96AB-70B879B19042}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D98A143-19EF-415c-B865-BCCA1BC4968D}.exeC:\Windows\{7D98A143-19EF-415c-B865-BCCA1BC4968D}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B9478E2-5AED-4339-9D14-992A1E28BC4E}.exeC:\Windows\{9B9478E2-5AED-4339-9D14-992A1E28BC4E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2C37729-E137-4592-BF6A-837D089B0A01}.exeC:\Windows\{B2C37729-E137-4592-BF6A-837D089B0A01}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{221211A7-0A5F-4e3b-9047-20C51B1039FB}.exeC:\Windows\{221211A7-0A5F-4e3b-9047-20C51B1039FB}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA21769D-E59D-4e79-9BAE-02E82B9E3C55}.exeC:\Windows\{DA21769D-E59D-4e79-9BAE-02E82B9E3C55}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2DB8776-B4C6-42cb-884F-C52B314D64C7}.exeC:\Windows\{C2DB8776-B4C6-42cb-884F-C52B314D64C7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64B1D5DD-0F7E-4e18-9833-79BFCA20C1BF}.exeC:\Windows\{64B1D5DD-0F7E-4e18-9833-79BFCA20C1BF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79FACFB7-4216-4c9c-94AB-9BFA98342272}.exeC:\Windows\{79FACFB7-4216-4c9c-94AB-9BFA98342272}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{46EC41C4-A813-49cc-AE29-D0D6D7EC66ED}.exeC:\Windows\{46EC41C4-A813-49cc-AE29-D0D6D7EC66ED}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79FAC~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64B1D~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2DB8~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA217~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22121~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2C37~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B947~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D98A~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CF84~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF243~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5e3e07a61ead8013d98585dc1f880135e
SHA1d0ac798981c8f40ec8c1834ba551798f19816d54
SHA256f5457577f80b6eb89a075410ca0f02c6c798149e4b2e55cb9f869ecb4e98eb80
SHA51278904ac89022318db64d795b253e85001aa063f0e3b52b3572ffb2a4c0e1f00fccdbbba825834142e736d3274d00a2a8df3836d137127bab1a0bc605b4d2290a
-
Filesize
180KB
MD5b49b19e2cd3e13ae3600e63f75fbae5d
SHA1d30b845c8897db3c09c04abdc1efffc519514f6e
SHA25650a60b17c7a14da093eaa2eb0086dade07bd1947ba9c4a449832eeedfafc90fb
SHA512e7e41bfc91c3488db7bfb150f9a45a8de78d83112bcf85c7b3660313378699be91c188c1b3905ad8532d3ca8d94cbb691fe6ccb539a420e3a28ce02f27d8b075
-
Filesize
180KB
MD5926c2ace6f0ffa16bbfff615578d321a
SHA1d13fa70b3ac6317ddd80674f9d0dfe23ede4624c
SHA2564966565b1066e039ca028edd282e7b3d3e1c7abf41d771c1c41b5e7ee56c354b
SHA512362737820dfb193ace12ca07b182640c986cde456527798d3847c04e4dac5d7fb01849b28304b8309c72153dfdcddfbc69536297abeb6daba43c19fc8dae83f3
-
Filesize
180KB
MD5804b8c976e85100aa067d00190442971
SHA154b1ae8c555610aabc864f8fe6b1e31dc9e7570a
SHA256d69a66d0fd4cf35f6cfe883c5085f7a921e22cd04ad02395844bf0f6631c4ccc
SHA512c714e21d1a33f532f93a0c6af1d2bb53be2699d7e7e7d079e4797e219deb54eb3b32262de184996700dc3af0ac70fe8f3966409c353488e56d4f2e87f2c1eb6a
-
Filesize
180KB
MD5929b3c5063989b781c6a22ca57d96c8e
SHA127f7c76905b4205e05f1822b1e561521000b31ce
SHA256c533d796be1de23b21f93208b6f74a6d39007537850e302318f5c506e8cc16bd
SHA5124634821011928022009ff230da076eea83f0abf9f9312a818f767c2252cf97663ca53f8802a12846492854b747d99f2317cd0253afe95cf79a1c36adb3023ea1
-
Filesize
180KB
MD530a4e8c8867510482371e2256fefcc7b
SHA1208edb6c8b4766a0fb11720cb26086f12dc4f341
SHA25657feb4c57d34a46ab1d6911e731896d932b77006b0ce1f8007837413bb49f5a9
SHA51261598cadd315f79a970c34ae84f3be880edcfbf2b64fbaa1fb8377f4355f0985af72f15a4b426c757225159aca77da64738b41e36d1ca755b71daf070c0cc19a
-
Filesize
180KB
MD5c8765f8aaf6e4f51c209e9e644bc53d6
SHA1a4d5cc7eee6478e2e2f1a5532ba71b0ac19bccf4
SHA256101d77cbda7709e3903523b599253063297b8d7fbba10b6087493d2df0d229f6
SHA51296c8723fbe8d778467d3cb71506463eec010bcd7e9e85413be53bede26dcdf0f99f773baff930b1aa452cffd218eb307229be09e1f6965850d949faa62f334ad
-
Filesize
180KB
MD5b1878a454f3941d5911b8b312bf6c592
SHA100943e7498efe4fdc684a4f31632bb3495704720
SHA25642527682f4ebeb361f2b1bb0a555402a6dbe5bf15a208444961f1f101584e6f8
SHA5128dbd666ef5ff965c5b9bfc0863c6b5ce83e12f032cd5d6bddfc97b9864a793f64193d432b536fea5e9baaeb7759434c31150a0c45f6f783bd19965ee4418fd9a
-
Filesize
180KB
MD5fdbe7fb9e58643da025de3df1384db4f
SHA1e4aead64938bffcb5fdd7d754cb03758d0fefbf6
SHA2562dea4ca286c3872eec182cf6c293121336796c9ddca16ec7d7b9eca54456f884
SHA512b0f7633bac1941a0e94a1cc5c21d96819401efefd46b7b7362b193fb9c606b20dd4e4936fe459abbf418cef040bd369174b4606f61a381e9601e800727199263
-
Filesize
180KB
MD5593502586e2465dacb53bb57546d3c9e
SHA1d58595391b4bef1e019802379535c73783cc2332
SHA2562c85173c777bd9b972f861ae4c760e024d373ecd76252f2853de9700f29c6d4d
SHA5129f2811bb5df801e462caa47d4626f4539104b6807909fcedb764c7e417f2e9dca6cfadf1efcbe06f0a6236560d9b30123e4bdc8f57e02859d4d038cd7b1ab244
-
Filesize
180KB
MD591ffec7362a5f18b5e240279874df43b
SHA18f7cd145577832d07b9ed6933eb17b32f261b5a3
SHA2562483f8f7cc28e6d4a154ee818bc4de4c47b6ba7e1006ee2e087c779a75ebc3a1
SHA512e82d0bf8c28a47f0fc5acccc57bed10597b509d61efbf14198a5d11bbfbffdeaeae719729183f63b2396ae56449a3fa6cadd4c2ba22beaee8308fc655629c348
-
Filesize
180KB
MD584270c478d3850c254433d613f3d8017
SHA1115b462a82c2b43b302810dae149526860dfa467
SHA256512d2e5b7609848cbf378f8b7379f6c4f6a3cc5b4ed27331f970066fc930466e
SHA5126f215eddde37e05de0194414756d02a77199f1ad66d1896b0f888c9b28be02f37757d266c73a40a2d18d4376d182e6a5cb5c185f27cafb835125a07e8f87b2ec