Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/02/2024, 21:24

General

  • Target

    2024-02-19_09f7d941f77ab2ab067eab1fc0e08989_goldeneye.exe

  • Size

    216KB

  • MD5

    09f7d941f77ab2ab067eab1fc0e08989

  • SHA1

    39e8a2274029eac1867271872d1bfaa16eaf473c

  • SHA256

    8be62f5445c27ddf6f28c68f524377fa1fd7801bca0dcea71bb7e5ed46336a94

  • SHA512

    9740214327092df31da129d872a2c8945e534360f70c48d22d4feb359a0408d5e5c68700a10f524b2a546dfd57da151fbcec041073ce393a51d68bfeaa69a48d

  • SSDEEP

    3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG/lEeKcAEcGy

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_09f7d941f77ab2ab067eab1fc0e08989_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_09f7d941f77ab2ab067eab1fc0e08989_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
        PID:1524
      • C:\Windows\{07DD4CFB-8936-4b78-AA54-E0DA9110A998}.exe
        C:\Windows\{07DD4CFB-8936-4b78-AA54-E0DA9110A998}.exe
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{07DD4~1.EXE > nul
          3⤵
            PID:832
          • C:\Windows\{5EA41148-55D9-4253-998D-7F26956565EB}.exe
            C:\Windows\{5EA41148-55D9-4253-998D-7F26956565EB}.exe
            3⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1636
            • C:\Windows\{CA89C8D0-FF69-40e3-B5E7-D336C323BEC8}.exe
              C:\Windows\{CA89C8D0-FF69-40e3-B5E7-D336C323BEC8}.exe
              4⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1068
              • C:\Windows\{2592048B-5BAF-47d7-95EC-F271BE987113}.exe
                C:\Windows\{2592048B-5BAF-47d7-95EC-F271BE987113}.exe
                5⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1800
                • C:\Windows\{63B800FE-6AFD-4e02-937A-6E24FC578093}.exe
                  C:\Windows\{63B800FE-6AFD-4e02-937A-6E24FC578093}.exe
                  6⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:436
                  • C:\Windows\{E99319BF-AE5D-439c-BDCA-391E2E0DAB6A}.exe
                    C:\Windows\{E99319BF-AE5D-439c-BDCA-391E2E0DAB6A}.exe
                    7⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4852
                    • C:\Windows\{F73BB7A7-EE3F-45ab-9FC0-0EC56CAE4C41}.exe
                      C:\Windows\{F73BB7A7-EE3F-45ab-9FC0-0EC56CAE4C41}.exe
                      8⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3712
                      • C:\Windows\{D82DE82A-1A77-411d-8EBE-F5C3698968EE}.exe
                        C:\Windows\{D82DE82A-1A77-411d-8EBE-F5C3698968EE}.exe
                        9⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3280
                        • C:\Windows\{12730446-251E-4a25-8F4A-7138FD2DE0D0}.exe
                          C:\Windows\{12730446-251E-4a25-8F4A-7138FD2DE0D0}.exe
                          10⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:232
                          • C:\Windows\{D06AEB19-BF1F-4845-980F-D9A8CFC2210D}.exe
                            C:\Windows\{D06AEB19-BF1F-4845-980F-D9A8CFC2210D}.exe
                            11⤵
                            • Modifies Installed Components in the registry
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1116
                            • C:\Windows\{622E1C8D-2C9F-4bbf-B80D-B103FABCD486}.exe
                              C:\Windows\{622E1C8D-2C9F-4bbf-B80D-B103FABCD486}.exe
                              12⤵
                              • Modifies Installed Components in the registry
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1548
                              • C:\Windows\{8E3F393A-B1CB-4fa6-8C81-313989B9E134}.exe
                                C:\Windows\{8E3F393A-B1CB-4fa6-8C81-313989B9E134}.exe
                                13⤵
                                • Executes dropped EXE
                                PID:4272
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{622E1~1.EXE > nul
                                13⤵
                                  PID:1420
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{D06AE~1.EXE > nul
                                12⤵
                                  PID:3332
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{12730~1.EXE > nul
                                11⤵
                                  PID:4376
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{D82DE~1.EXE > nul
                                10⤵
                                  PID:1568
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{F73BB~1.EXE > nul
                                9⤵
                                  PID:3468
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{E9931~1.EXE > nul
                                8⤵
                                  PID:60
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{63B80~1.EXE > nul
                                7⤵
                                  PID:3304
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{25920~1.EXE > nul
                                6⤵
                                  PID:1064
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{CA89C~1.EXE > nul
                                5⤵
                                  PID:4892
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{5EA41~1.EXE > nul
                                4⤵
                                  PID:2056

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{07DD4CFB-8936-4b78-AA54-E0DA9110A998}.exe

                            Filesize

                            216KB

                            MD5

                            47a802129ab80861703911b58ccb94e6

                            SHA1

                            b441300a21c54e7efaadf05558b9d077cc3af947

                            SHA256

                            2a550c3235096bd4892e11b5b484ff26cc123e33e67fc63b655f3530dd812e7b

                            SHA512

                            08a61f4dda8ff8f3b90613602f56ebaac1c7e082276a1fd76c7f7e69ba063494a3a41f9d430a6a29138959a948f6ae51cdf653a172769519d3dacb637646ea8e

                          • C:\Windows\{12730446-251E-4a25-8F4A-7138FD2DE0D0}.exe

                            Filesize

                            216KB

                            MD5

                            7ff480a40e7391fa9f5297c6eabbcbbf

                            SHA1

                            80114760ca5ee48ac8d5fb3b35858a1eb788adf8

                            SHA256

                            efdf7d5b8363fb983e93f2601c15ff0ceb6e72290e72a47b76739233913f86a6

                            SHA512

                            5d2a09ee892bf94be8955850bf8c29bf07107b6e082e3a754aa0230feb176fdaa404300789f94d88bd375f3b0c48bd5fef6e6cb46f60bae1aca7a7b67767f053

                          • C:\Windows\{2592048B-5BAF-47d7-95EC-F271BE987113}.exe

                            Filesize

                            216KB

                            MD5

                            440cb2091dfe96298f57fccc4ef10f38

                            SHA1

                            4bd7ff711fae32a89de778b4352350342ed0bd5a

                            SHA256

                            0edfc7aa04309889ada72e3534c2f578e5ce76a06546431978922308880d0d90

                            SHA512

                            909dfa3652a27dce4b387680d093740613b26ee6b6959ef3cb50ec9014e51f05eb0f08e6fe87a5249fa9c4baac54f519c80232119b03755fdc2d814f164a4308

                          • C:\Windows\{5EA41148-55D9-4253-998D-7F26956565EB}.exe

                            Filesize

                            216KB

                            MD5

                            febca7e95bd6a003bd78bf3739fe1600

                            SHA1

                            6cbb67d9d8a2abea574b53f11831ce2707e7d429

                            SHA256

                            2ddd654ebfcc60c2fbd8c939ca61270cf373c745b5c9f20b437191a257dcc39a

                            SHA512

                            b2aab534055832b94a1cc1bcd70867e9acdca6ab5af8b4a86b3aa0ac4b04200d5456ded73c5db0ccd0f8ddd26802c291f4c426142f6432d72b6eb36abbc185b2

                          • C:\Windows\{622E1C8D-2C9F-4bbf-B80D-B103FABCD486}.exe

                            Filesize

                            216KB

                            MD5

                            e1d21f3cd6a690e7813760494ade29db

                            SHA1

                            e3d6d50418f643db6beb30507986124b31cc930d

                            SHA256

                            79b2d188b4cf926231e2b5adb33e8b2614e482749c3b18330096d37ef0439247

                            SHA512

                            f1f67cb5ae6d92cb8f3c0b4a4a5c0ea4006cdd5f296981d91f2406b28eee6dc901297e189d06a7302c130379534c662a0225b935cd3a78bae35694a1bba9e3c6

                          • C:\Windows\{63B800FE-6AFD-4e02-937A-6E24FC578093}.exe

                            Filesize

                            216KB

                            MD5

                            23d44accffee801c58f02a5493e84a3d

                            SHA1

                            37892b9d5391de40852ce012ac8ba19b94451892

                            SHA256

                            8d6e08691463203f68f1659ed775a362558b5d9459ec125ef8b888f5e95d6dc9

                            SHA512

                            8ddc0a4e00a7d96de81cff7b725fb65b3bf93f568b9f5b7dfcba4ef15211e6572af7d59db170c00d46853ae64415f0d5d497e7b6f4c10e1c5b45722d2f68e514

                          • C:\Windows\{8E3F393A-B1CB-4fa6-8C81-313989B9E134}.exe

                            Filesize

                            216KB

                            MD5

                            7071bfeca00759bf960f688b752e8a29

                            SHA1

                            7d77a85464d2c1b4d381e7bfc72f24b199ef0987

                            SHA256

                            c6e0cb0392b2985c3d149af3d819204e7b1945b4bbbcf20f3eae9b9b637c4a47

                            SHA512

                            a9581a3d35f748a5fb16daaacc5c11dcb0fb1c687db817068fbe78a78d01b9fa15fe8d3f97b750f511c8328c165b7b25801f959c5df449143bd672bc2bd0ed12

                          • C:\Windows\{CA89C8D0-FF69-40e3-B5E7-D336C323BEC8}.exe

                            Filesize

                            216KB

                            MD5

                            7f49b3fa2c6397b1d64268c9a5799dfd

                            SHA1

                            89d97dd28015ac4bb8db3300d560e29253eb4bcc

                            SHA256

                            87a80e088f6f981014309d267f63fa1981b85835522cac8b4b6dda1d1dde3a45

                            SHA512

                            fab0f41feb365cf9121ca60250215359872146a0b86eee1bf324cfe02757febfc43e45164137c19d0bb79faf01a7ff804a46467d5d45f6289144d276c6362e4b

                          • C:\Windows\{D06AEB19-BF1F-4845-980F-D9A8CFC2210D}.exe

                            Filesize

                            216KB

                            MD5

                            63c037ab713f1d391c55bfbeeb63ddf9

                            SHA1

                            c687ee909b43fcb830fd7772d3515298af3ebf5c

                            SHA256

                            3533c97071870e569327081c721f24c28e0c36f99ff5e6b73b5375df5028cf1b

                            SHA512

                            4383903efd3197a7ae620d4756051a1ac10c172a7d337216b8a859549024feb2eaff3dfc2946e9e40288a65c5cc9aacc85dd780d58f77586054e68256512ae5e

                          • C:\Windows\{D82DE82A-1A77-411d-8EBE-F5C3698968EE}.exe

                            Filesize

                            216KB

                            MD5

                            87eaabb7769566501239628b28f0bb67

                            SHA1

                            15865fc883a4c1aa0f813617a8d2a1b823c1cb96

                            SHA256

                            d77f6b2a02f3c9770f3a0d41006f364e676022b23c4bc5562e5b36762c83351b

                            SHA512

                            5824e6ddd29d89bbd03ec0faa649a8eddc450b4834c694e2b9efd2f0e2ee1a7a9ed0cfaad720112929db072fa5bfb450133927fd45a3da9ccedbf56eeb70becb

                          • C:\Windows\{E99319BF-AE5D-439c-BDCA-391E2E0DAB6A}.exe

                            Filesize

                            216KB

                            MD5

                            a392f7c4ae34552fcb749edde2a31f80

                            SHA1

                            666f4187bc264aaf0f694282a42ac73aa88f4c63

                            SHA256

                            a2ff1819c73181c7fd3509e65ccd7aad0b3313ce0edf4b84009c998778016c92

                            SHA512

                            c824b9d08e75815b214c8a836bb09ddc8d6197189756de9dbdc3adc97d1077a92248a920b6f0f1dc0eaabc8e455445d6d5b058eee46ef8460947cdc0116e06f9

                          • C:\Windows\{F73BB7A7-EE3F-45ab-9FC0-0EC56CAE4C41}.exe

                            Filesize

                            216KB

                            MD5

                            0607b381a17e903efa50e699e6b38acc

                            SHA1

                            eaed8fc1de47921b8890051860b522a055e2c39a

                            SHA256

                            8e51d1a212f674c50a9c0a035b47ac644de84c8f217d207337994a81af887dad

                            SHA512

                            e0760756e048cdc3db533e8d4bd6934f1a41c36ea5accf2682635e6304a3c7593f262e9117e8d97e01a258ecdeb922695db3f828308a21563db03c4b073c6ea7