Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 01:44
General
-
Target
2024-02-23_425e78ca4e5cd2ee29bb3d7dd85f9507_goldeneye.exe
-
Size
380KB
-
MD5
425e78ca4e5cd2ee29bb3d7dd85f9507
-
SHA1
c5a38c358a469f3e9d50901c5cc481b5a39d124a
-
SHA256
97a7b359719e9be6bf9d92846a7460e4e4bb732822453cd55ab2348cf3eb2ff1
-
SHA512
615547eef61f91607b1e50ba01fa5da0580d90f2394baa0ccdefa0d725e2c2d3ce105fe52e2473c19e7d610ea867048e5660c9d569dd9a216fb4b73e71e2e0e5
-
SSDEEP
3072:mEGh0o5lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGjl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_425e78ca4e5cd2ee29bb3d7dd85f9507_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_425e78ca4e5cd2ee29bb3d7dd85f9507_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D03EF92D-159A-4c10-B611-833A3B8F7E46}.exeC:\Windows\{D03EF92D-159A-4c10-B611-833A3B8F7E46}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8449C5E-53EF-4003-8A34-A8E7439A64A8}.exeC:\Windows\{F8449C5E-53EF-4003-8A34-A8E7439A64A8}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD3E156B-BFF1-4212-9E60-2C448F38D105}.exeC:\Windows\{DD3E156B-BFF1-4212-9E60-2C448F38D105}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6544C7AE-DD0C-4346-9590-49F61C1D11CB}.exeC:\Windows\{6544C7AE-DD0C-4346-9590-49F61C1D11CB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83F4846D-4DE3-443e-B89E-8C16B8ED6D8B}.exeC:\Windows\{83F4846D-4DE3-443e-B89E-8C16B8ED6D8B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CAAE0C1-73AE-4241-B160-4A197EF9A8E3}.exeC:\Windows\{3CAAE0C1-73AE-4241-B160-4A197EF9A8E3}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3720D28E-9916-47cc-B846-DDFF415351DF}.exeC:\Windows\{3720D28E-9916-47cc-B846-DDFF415351DF}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72AABE8A-EFC6-424e-A4A4-80929B0CCB23}.exeC:\Windows\{72AABE8A-EFC6-424e-A4A4-80929B0CCB23}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{386E41EA-8216-4265-B06E-97106A4F86F6}.exeC:\Windows\{386E41EA-8216-4265-B06E-97106A4F86F6}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9546126-5FE9-4f15-8492-9651EA05D43E}.exeC:\Windows\{D9546126-5FE9-4f15-8492-9651EA05D43E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E83AD3A-5F57-4f02-BF4D-FFA79A43119F}.exeC:\Windows\{5E83AD3A-5F57-4f02-BF4D-FFA79A43119F}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D9E20C48-5613-4eaf-8A34-5EA2B7C32178}.exeC:\Windows\{D9E20C48-5613-4eaf-8A34-5EA2B7C32178}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E83A~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9546~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{386E4~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72AAB~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3720D~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CAAE~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83F48~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6544C~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD3E1~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8449~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D03EF~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD55798cee6c08319b372a14185b40fca09
SHA10b17979835e15b12aa794c485cdd96af4e9bda48
SHA256705c26bd8b3cad2a571f2b5d3c85f1f2d4b5f0e8d95332fbb57ad172038c48e9
SHA5129589713e2d2cbea5cb22359782e9f620d728d129abc97932984f07acfc3a034def9c95282ff75a5d96ba8b338d9eb9dab34caf8b3c2d66945b5667b4e814995f
-
Filesize
380KB
MD5d97ecf62729572a9bfeff38cad34a859
SHA1800b9698fd73ec1b76688fbc051835026038254f
SHA2563f25532d5d60df6bf5af99c1dce5c637f4b905f4c75d53dc1c60022e6b71b3c4
SHA5126513bf1fbdb09f70b105cbe51b1ad1dff9c113099485644ad3647689aa96042f2e9d662e5c3dc6d653205a29185b7dacda227ac478bde98c0ced3f9b65af8af0
-
Filesize
380KB
MD538a03edd2db9056f2abf82fd0daf7c5c
SHA1dd15c89025a00a03bdbdac1689879da463505f70
SHA2568d0b4eab7791c4aaeabe33aff2199b26436c8554b50250e522b7624a286ad658
SHA5126fd3b1a7ed5af030f69cb7b0bb42232f31338a7860b2adf0e153639331a1a28da6220aa9839ee9ed86d26a34dfdb8172aaff25d97a1ca3b45ace14e4258920ee
-
Filesize
380KB
MD558514fbed2639a3b7f4bf38ea307a1ea
SHA173963a46fbdd9ebab8f6784d039538b4dac1424a
SHA25617a79680fab2dc5b60f4e84d5711469b0d1ea43f7e10c01bd7e925513b51bf52
SHA512763e68dfe28a3b8469b068c7d3c3af7adeddf8e26444b357fa7f14cf1c87638f788b263e451612a12a608a83adcdda18dd95c63e17096f556150dfca0522ea9c
-
Filesize
380KB
MD5e142cd64a52a4f16c3aba71e5631319a
SHA19c33932d76189d158e95c7ebad0b73746dd8cf26
SHA256e11d0593acfc03fbb48c7921aee4ffb248a27e2d97556cc8e80c48de339b161d
SHA51278e2dac41d88bf35536843f68827a2387315ca6bb479357db6ea9abcc78c24f3b773e1b71812ae3554ac0c029eb3e7869893991782a7c1dd7d37aa0ae0b76537
-
Filesize
380KB
MD5b8eef12fd3feb2a393381026f116c329
SHA182ab139c57f1d8c191958cf6d42e4cd12afb4506
SHA256020c2d9484f11790d4033c175fde98b65b03403bcdd1a1e67dcbe77321840c7f
SHA512d593eb30fc646112d0515007a0f27535e7d66bf2f40d4e1b9c8160cc32f7345c7c6564b4d7617276906b774944005a9d921970eef4ef2fcc0051fb3cf5806c59
-
Filesize
380KB
MD54fc8f15bc5fad7527312ff585d51dd5f
SHA1c670eb18faf5290b5b5bd5096900986ece1ee694
SHA256d367e3b1657998c5ef891f40b860fae37df76e2e988da36c6169cba807f9c1d8
SHA512107c393a9166bed807df62282998663f2a10d699bd7cd5b2184ed35cbab813a9f0588e93f02404e9092009a240e41bae1f7475c478dd845edc38b353b5bc189d
-
Filesize
380KB
MD5cdc3c57233c58d6979130a015b59203c
SHA13973584813ed9e4c1e831dc281dc608df5eb7aac
SHA256aeeb69d956a78b7dcad753f16f8a5c3af1c2281745bc85fc6957539d6500bf84
SHA512ab3e9bd34fc29495efad4a5d4c7112e89004d1c413127e304db184fe4bfdf3355c83eae0a48cb53d5133aced877f9e2216f2fbd18d3f4b3211dd1c60a040900a
-
Filesize
380KB
MD5cc05e1984a61c0a25030c2dc47f2cee9
SHA1b2e64de83c56b3186d5ec244280c952b514d360e
SHA256e076f66bca35cab04bd08d3f0d9a575f351d11b5797dbfba464629b5f4e32712
SHA5127b72c46545931574f6e706cbb4cb25fa2eaca2f2baa6a1863ec134322691589a88c5cca0456995981f4a33a51be271405a68d21eb126f2ec78218e551c835e4d
-
Filesize
380KB
MD50bca5f0059afe9faa77d0e833f75f404
SHA16254fd49806dc86238dcf3e887cc0f11823078b1
SHA256f20d6eba11c2eab863e2c7f0575babb54abd0cb65c28f6e756fb6f7e1c1bb0df
SHA5127e8131d566e8a9af54285095c175e2f8dd91290a672d6de78a591f5eac74823b5df62b6ddb64c52ed2d6cb37429e3a0fcd319e42fd77736d80e27ad19009165e
-
Filesize
380KB
MD516a5b1caf1431337d05ec10644659098
SHA140c9ccd93b7975a89c9a59942dcd3afdab522eab
SHA256637b0597d9e1908918532867e76a5682786687d62777be753654254e8816ee78
SHA5128f200ad2e1c2226adfdf35f2759f2c25bb7fdc9fff783ffca5741ad08b1ba83c4c5dce0b168a95ea2eb33bd1747efc8c9be19f039d9347e475c7ebfe8b20be7f
-
Filesize
380KB
MD5a78ed6490196da4d825cf971562f1bbd
SHA1bab898f6fac76258f824bedecf5b74b1e55a2325
SHA25603e5d5d87b987b7b64e893b25ee5f9d09239bb51751a05e069a4fcd443a3ca65
SHA51218fb45d5f85f27a4b22932f81c358ba9df5f6dff9157c12eba2c7eb1e9b78bb69874af910fb962cc702e4b5fec22d27a925ba390281d321449230a126c9f9103