Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 20:05
General
-
Target
2024-02-12_8213a2c675d9f27dde8949fcff8ee215_goldeneye.exe
-
Size
180KB
-
MD5
8213a2c675d9f27dde8949fcff8ee215
-
SHA1
5c0c73121b78b10cab2762b5183369495e8ca139
-
SHA256
6602224d2faacc3e3bc165392990c3e6902d6970f4113a8225a2c0e4ebb12742
-
SHA512
17876229bd28cacaca2edf4df7460391a9cf0a2c18bd508eb5da9217163d4092bc0c179b70d909fa238434a6325884b4f9c942c1b949ad0146ffd93b6030442d
-
SSDEEP
3072:jEGh0oHlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGBl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_8213a2c675d9f27dde8949fcff8ee215_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_8213a2c675d9f27dde8949fcff8ee215_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86EBF6AD-3DE4-4cd9-B229-CE3C57D23877}.exeC:\Windows\{86EBF6AD-3DE4-4cd9-B229-CE3C57D23877}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61AC7A91-7C0F-441f-B881-725BEA73EC4B}.exeC:\Windows\{61AC7A91-7C0F-441f-B881-725BEA73EC4B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61AC7~1.EXE > nul4⤵
-
C:\Windows\{12C4E42E-A8A4-46f8-BFA1-11E7B17329CE}.exeC:\Windows\{12C4E42E-A8A4-46f8-BFA1-11E7B17329CE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1994AC4-0DC4-4ca4-81A8-06FE20BD6C65}.exeC:\Windows\{B1994AC4-0DC4-4ca4-81A8-06FE20BD6C65}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E6A555C-02B4-4c33-8390-E3BFDCB19016}.exeC:\Windows\{4E6A555C-02B4-4c33-8390-E3BFDCB19016}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35FAC471-FD0A-4603-B975-9923F83F199E}.exeC:\Windows\{35FAC471-FD0A-4603-B975-9923F83F199E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{035A1D33-C30D-4861-8E9D-B053A409B2B2}.exeC:\Windows\{035A1D33-C30D-4861-8E9D-B053A409B2B2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFE2BDC0-CF30-48e6-9781-7B1E68BA171E}.exeC:\Windows\{AFE2BDC0-CF30-48e6-9781-7B1E68BA171E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{343F35FA-E0BB-4fa3-877A-3881A90D00F1}.exeC:\Windows\{343F35FA-E0BB-4fa3-877A-3881A90D00F1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9ACE401-9175-40aa-A627-62A8CBBA605E}.exeC:\Windows\{C9ACE401-9175-40aa-A627-62A8CBBA605E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EF3F064-CCA9-4d7c-83BD-F82C65F11729}.exeC:\Windows\{7EF3F064-CCA9-4d7c-83BD-F82C65F11729}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2F4DB662-AE1F-463d-A932-45543134FF5C}.exeC:\Windows\{2F4DB662-AE1F-463d-A932-45543134FF5C}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EF3F~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9ACE~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{343F3~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFE2B~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{035A1~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35FAC~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E6A5~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1994~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12C4E~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86EBF~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD520792c7d45e57deb6266b4d44e626c06
SHA15a42d4682315c161c82c8ffb2e9033336241e9e7
SHA256ef01097e6c20e0867d6ffef1adf3891ae98fc48bb42dcd53ebd7c7292af3534d
SHA512db487aac92824a45236f257edc178556d945780147df3d90a4295c2fc3d2204636ce40782c6d841e8bf173aa47695fb9f75e47ed9daddda73bf2c678bcb93544
-
Filesize
180KB
MD5f31639f5543f9872b8e69c0d6d5c67d8
SHA1c7b003c070218b5dc5077ce1187100ae933e0e16
SHA256a822b0bd17169c7d98e1b13f03a350cc0eeb5b6f9552847d76048ed8b1f036bb
SHA5123ef84a2ca34a381fbd7c1e2a5283f55569185ffb822dc71453a3167af51a19659c2113faa1814d6e6f9bf1783ac58433f6eef472e6c3db8fa212052a35507a61
-
Filesize
180KB
MD511a196c1797f911744e1ffa5f45e3735
SHA1720cb62ab3662078f771d5682ba382e718a05240
SHA256c461785f3e7cb142f8b8da16aba004d7ffc0eb952560a9cdcbaa417f54fc34c4
SHA512e28a6adaa2ac146ab6f042133deee8dd20a5fb6da595ae141d3f2e3f80ffdb3c0e2fa513fdf424105c8761d9e2f7ddcd0d7f2096a706a16dddc394dd61aadbce
-
Filesize
180KB
MD5e623526c25cc65a385ca0f0295d882b9
SHA17468ef3bb23f673a03b68f48e6ceccdb3edd18e6
SHA2569c334384349dad73bca65296364d6816813aed06715f278290d02bfa37ab159a
SHA512a3d963ace3939d98351346c2c8163c192e74dedebedb939d0bfdc820d5422977eb6a5600cf10d5fed813a4945055f7efbb2b325f299e774bb8398b0d504381b9
-
Filesize
180KB
MD5672d6cee8e20d08ceaeb0412b9180ab8
SHA18fd7e6123e0ea358fbc09d0357eb6b5562bd8af7
SHA2561a4db20fe4a9dd1a4364baae0d09f6fd96f76b817b4474110c0f19eda4df2f1b
SHA512a98615cc841e4306ff592bb2f63c2c640867dee252ae62124f9f8e0b9aaddf2c34846d31d1943e56727aa74bc907975a4d16750f7595bae6ed8c90a0f8616e43
-
Filesize
180KB
MD5a0c9a0a754a9a3f654a4aa42653f52ba
SHA195fd4b69fca967b0e556288c545ae14cdc6379f4
SHA2568dff96816030da791c059caf5cf0fe37d5306fe52c792fa230f159cbda53853a
SHA51287b88768f1937b13a0f3327c07e0e1edb37e618f0319ef1465b3eb0ef7bc0f221ed39df045dc25add54165fdc9d7c40dd1cfe46fac8879d5cc992f6ca0d2dde8
-
Filesize
180KB
MD5de6cdae47a12647a48f576065f01ce23
SHA1b9c3de904e5dad493f6991af85cbf47c6cbc5000
SHA256cd0c60a77499466942ec77c49dbaa4e96ba8c92af27389c88a71163a7123c3a8
SHA512c6a4ec8b57b3398141933dd7f85c5907d0f4803c60c2aee93c1ab95c86342a95414df52b672a4efd00de94bc775738926807e1ef3544dacea2b3147f10550a4d
-
Filesize
180KB
MD51d163510dc234abc0aad5ad338bdb463
SHA15d8d2b23f83a037770c5d356b2c7f52508315c16
SHA256179f3bd798ff328aac073dc546e12f36bd446556753c96ee9b107a8bc4e1fe41
SHA5126952e31741b74286bd7c46540314551e3d47b574d2d0ff8b2bd661585257949ae748e11cf10f274d542f70a345f1b8e229cb9969db50eaf89b98643758263b95
-
Filesize
180KB
MD5f83b1b1d5a3e9657d4a58666d08a77d5
SHA1287123f0d493f1de6026353312449e61ccfa4a41
SHA2564125eb76bff3bee65c55243d600a5465115dda1013dda91561945283c523dd0e
SHA5122c06dbcdc70350de91d89b79f3deff3b2b7cfd255f1d56faba567668d199428432680d231f5cfdf41746703261e315f99f6b278143cec2d1a055f2a548817dc7
-
Filesize
180KB
MD50744dc612c7db7f2b6bb66d895b21fea
SHA17d2fbe145f20f97664d3f3056f349728b0d5e060
SHA256b415df9ee8be96a9551cca8282d550652c9aa5b5c0ab22a5bcb495af2e3bac31
SHA512b09fb5e4c39bea87c13d7dcd31e3e157880dde0a1514441695bd44fe1583a4d4f38422781f723ef9e34de8efa66ba125f789a9a3e29ec076b9a06ab027c61e94
-
Filesize
180KB
MD522bef019ac9e7cc87da14ea460e7274a
SHA11f3db26356b1152dfc5de2099f706068a7a268ed
SHA256147cd24f1fbdbf6d7defa3437a5a4105ce000fe0c773a17c1ddb8d841cec66db
SHA512683a2430ceec75b9f3a3819ed8fd8f4042a83bab0141e5417985e7464dbab8f73d9a3e45aa35b5a14b0264ad49b00d0ec242ee09e8c396a9166c341d2a17b625
-
Filesize
180KB
MD529a142ccbf9d6cee4158f4b6c510f1c1
SHA18ef4c33491b8819592a2d9e2896e0976e79e91d8
SHA25605dc64e6fc29f931b8a57b3c1325b450dc7d4a2bdd58a24828aa971cf68c8986
SHA512175631959f27131a96f3cc51362e29577d7b2d4942506b82698fc8ce371cc6d08386dbf0805318b30a39a7d95b5dae9b10ceace53fc2c96208deb90f898169ae