Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 20:05
General
-
Target
2024-02-12_83052f06014ba3284f9cf8ccaba105fb_goldeneye.exe
-
Size
408KB
-
MD5
83052f06014ba3284f9cf8ccaba105fb
-
SHA1
2fe6c06734e5e283d36b35243583c35cd1aa2d1b
-
SHA256
20a914e065277ddf631c84d45bf538b7dc1426f8360c02e40c6d2ce94b0ef395
-
SHA512
a50f6a2943c2badc68c830a6173329cce2ebad01273572e24daad82cddc1150787cd90fd11ce13e28d974440251bc74f713fb10a3170dd2a3411f10f27d603f4
-
SSDEEP
3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG9ldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_83052f06014ba3284f9cf8ccaba105fb_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_83052f06014ba3284f9cf8ccaba105fb_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F64C5232-E0CB-47fe-865F-15E2FAAFFCFC}.exeC:\Windows\{F64C5232-E0CB-47fe-865F-15E2FAAFFCFC}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F64C5~1.EXE > nul3⤵
-
C:\Windows\{EB3C1B08-256B-4dd0-B38D-2BDD2F546268}.exeC:\Windows\{EB3C1B08-256B-4dd0-B38D-2BDD2F546268}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46C361E9-B927-49e6-8C17-341F7C7096FD}.exeC:\Windows\{46C361E9-B927-49e6-8C17-341F7C7096FD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46C36~1.EXE > nul5⤵
-
C:\Windows\{A3C3E2AA-DF59-4d30-96A6-7FFBEEDB5676}.exeC:\Windows\{A3C3E2AA-DF59-4d30-96A6-7FFBEEDB5676}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3C3E~1.EXE > nul6⤵
-
C:\Windows\{CDFE542F-4E22-4600-A838-E67A8CF3870A}.exeC:\Windows\{CDFE542F-4E22-4600-A838-E67A8CF3870A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79997AB7-8812-4b96-9F32-43E4DFEB284F}.exeC:\Windows\{79997AB7-8812-4b96-9F32-43E4DFEB284F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79997~1.EXE > nul8⤵
-
C:\Windows\{D4F9164E-55ED-401f-9BFF-2F5EA2A80EF0}.exeC:\Windows\{D4F9164E-55ED-401f-9BFF-2F5EA2A80EF0}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4F91~1.EXE > nul9⤵
-
C:\Windows\{D1B1922B-1E23-49e0-81CC-6739AC5C70E2}.exeC:\Windows\{D1B1922B-1E23-49e0-81CC-6739AC5C70E2}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{48D45D43-AC0C-490f-9271-AB11E364948E}.exeC:\Windows\{48D45D43-AC0C-490f-9271-AB11E364948E}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{67E5AB20-FFBA-4125-A4D4-62BA5F720ACC}.exeC:\Windows\{67E5AB20-FFBA-4125-A4D4-62BA5F720ACC}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67E5A~1.EXE > nul12⤵
-
C:\Windows\{B40D2FF3-1448-4585-8AB7-CD0EDEF3D73A}.exeC:\Windows\{B40D2FF3-1448-4585-8AB7-CD0EDEF3D73A}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48D45~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1B19~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDFE5~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB3C1~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD53e9538d85a0eacc3e012afb8414ac968
SHA13d1b7027be0e3f17b0abd42218d0e3afad5e8948
SHA256a5314d9a77c6b4c628d9ef51a2a7ad2bb9c79ad14af41d3869be344c7fe92958
SHA512466751c8cfe3ce700fe2b960fd8a04ad9341617b0ab4caf5acf03378929631fe38c4546f7149f8ed5b0f3a7d5aa3b996d48f16b88c7ec53171ae7dcf65103de5
-
Filesize
408KB
MD519f18cc247bcba8d8ce1301abf91ff18
SHA1fce2ff08ce9313de6d536aafdbd5a0176b79a670
SHA256dd7d9ac202527ffccabd38723a976b39d31e820e16cd5ae1cb016dc88ff7004c
SHA512e5716f2a292628fcdfee8fe475310fb5c92bd54631c0e935bb4bd0515984d1cf44be0e036822ac740738e423e00ea2983878019d02daf02866caebdfc8dd0d7c
-
Filesize
290KB
MD58e0fecc247dbffde0d2e4a07b654c587
SHA12340e180ed56826610c23baf3d980a2a235ad7fa
SHA2561b3e91193afc3841145199c92c3ddb32022e0758b32a586aae86cd2274da753b
SHA512796971fd8ec2f0b34e3a7500c4159f0c83f05bc2ed13ddf66308ed0346854bdeda03ca936efe2f4c60724553eb0fa6164fe6db44007409a6e33e1dbfff570c91
-
Filesize
408KB
MD518350e240dc043bb1e638f4c94e01801
SHA193b28e60d0a07cb087ea838a70b97768483692a8
SHA256ac2371c41b7c004a4be64b3e2f797be7f1bb496ec8a822f11ed718c9a0cafa4d
SHA512ecdac1d025f8b560bb61a9f380969db8460923579b15742d9c2118e6880f0e2121be21c6245524d68427026b98d6f2d46b1a7671ca0ef8dac53b5133adc8512e
-
Filesize
408KB
MD50e2efe7d2bfd1db598bd5e064e6430f4
SHA1d5a76ab456728ee78b63a81e081314376a65e7d8
SHA25632905bc79ad8c25d1b8c6d8cdb7eb97593a640567a34a5767c435a2b7a4ee762
SHA512f1ea8c77f76ee1c5b7f2295201cd77b2a18a449a49966888bcf5c492712a50a8f80c1fb6352e4bceca8486154cb1f249b8450c2001a2b3419408d502810b1744
-
Filesize
408KB
MD5822df23c9a905773bb6a99cf6912fc86
SHA18ddd2b4d3b67c0ca8e3c1659126d2bfed17067d8
SHA256f73c113724f4c63f2576829e8ef01b4c828bc2b81dabd3776487ec716c8365d8
SHA512a5eaa11beae2eb1ba5a6332b3716cbc1950aec7cb45f13bb1f32ca33d634d00c0a1a193f5ecf6b10399fd8df4caffd942fa33973f13f3e84344cab65fec3358b
-
Filesize
408KB
MD5e5830d7c39e2df106c7e0bcd654d72d1
SHA167e06c05b63f4e219ae3cff493ff906676f245aa
SHA256f26cadef5798974955a68306f5b8043608552e35ea1e75c97e1499f7cd665ef0
SHA512948a0b0697b06c8508699ba9c1f54de0cbf70cc8c8bbb4f115cfd875760ef290ed76b5f3509e367ee9d04233e261bde6634c9a832770067ff2a0de670bca0f64
-
Filesize
408KB
MD5b0e9c843591c192a754d268b6364b9bf
SHA14a0266dca0b0edf814fa708849ab0e540829a678
SHA25635947b9b10498ce157843d6eb7f3394102e90c4b0e160ee73ab5edc67f72390a
SHA512cef4b66e0780dbf83e499ffedfc8a59a12d6bdf48f34ca76fd21888306a217ef65609acb6637541e64a932f7c4a34ddfbcf45deb82c031cbcf6bfda408ec6691
-
Filesize
176KB
MD5a5e1e58efb0e1afbcf565007962388af
SHA1ccd6a4bc663ffb84d9ffb3eb3be41173732554c1
SHA256abad27047c0e1e36e5d5c58f8cd4aec9b54850dd50c0d027854ed9c9266b03eb
SHA5126414e93db018283d94a8ba65b08395d880a09777abf77a2ded5ad2c29c04197ff660d198f4e3cdda77226375c4181010f4bb3c245c055d54449791a6493f73e4
-
Filesize
408KB
MD5915d385b55522deddefe0b5fd4ce3246
SHA1ffc50999e8a09d35af6a90e9cb86c005054c42a5
SHA256536841bd872aaea0f17cd826d568fdd1d3b2d5fd0e22eaa729a110409964a868
SHA5127a7bd6a9d10e2ba123f7b1cdb5cd7fbca248c0a218ae72f5a4a73c6dc6ab70ff35bd6fcddd6e6c05b0b385e0fc87a1783d774f1cc95c62be80f2f33cba63caba
-
Filesize
408KB
MD5b13836d47a6a8d26b6e7a76487b26c9e
SHA14d135b4d3714290e06bd6ab98049d022c23d57bb
SHA256c7eaf7858821fa23c005a319f2d9b4025018631dd2200981638acd6b75618d60
SHA512da7d641007b53f5d5a75d35849b72c6cf47231a097d23980473169b1636ca839f92d6f83e80bfec820f3bd7b763799d6a8658a29fa1a913c04395629c29ca1c4
-
Filesize
408KB
MD5b465042a1800ff4e5712b3ee881f16cd
SHA1a717ca417f8bd8f3e7a2661ebeb7e1a2cd8ae607
SHA256fa9df02f779d57c7d778de8934dc79ee369b7fa2eaa764eef4a4f88384404fa0
SHA512baa838bfaa230ee47467ea4c2a8febf8eefb3443856c321c0a8ab1d4fa443d5729d0e420b1cbbf1a9457816b72b2e319d41952b8449c85a251650a37991556d0
-
Filesize
408KB
MD531b98f6972e6a644aee61ede28859486
SHA194a075e1ef0398e35c80518f47f28bda597ec7c2
SHA256ad276a790222b8223fdeb62e8de0a6ce5385f35ffea7a80652e169e46a122b75
SHA512b52639f26cfe1dec1b05e674e5e57f862544e06ed1d2d0824762e28e5af29ef73cd761a82e4a5aca0dff18ec4c4ea005cf4e1acd024b387aa75046e029053c58