Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/03/2024, 12:51
General
-
Target
2024-03-05_a1f4550fcb22d668204987bb810420d0_goldeneye.exe
-
Size
180KB
-
MD5
a1f4550fcb22d668204987bb810420d0
-
SHA1
9de01b3307fafbf333b3970d7cef460f560bd15e
-
SHA256
b9292755ff74daf07292c57826dfa3f05e02aa114992afbe16e985943363ddfe
-
SHA512
5e6aafa11ad1430f44b1c5adbf26d829aced40da7b3a2bc18b9681cea97929d3b5bb3e47701727d0296d403e4e6763f47e4b3393bf57c8cd281e7f67a61889e4
-
SSDEEP
3072:jEGh0oHlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_a1f4550fcb22d668204987bb810420d0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_a1f4550fcb22d668204987bb810420d0_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{25EF3FF4-5A52-43ba-ACF3-47F6119E068A}.exeC:\Windows\{25EF3FF4-5A52-43ba-ACF3-47F6119E068A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5DAB933-3C98-4f11-A4AB-1FAA5A6B4487}.exeC:\Windows\{A5DAB933-3C98-4f11-A4AB-1FAA5A6B4487}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A045BCC8-438A-41af-BE3B-14C71A450AD3}.exeC:\Windows\{A045BCC8-438A-41af-BE3B-14C71A450AD3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE3E094A-97E0-4ff5-87B0-031CDA11EFAB}.exeC:\Windows\{FE3E094A-97E0-4ff5-87B0-031CDA11EFAB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C89CE80A-7D3C-45aa-BD61-26908F05D7F3}.exeC:\Windows\{C89CE80A-7D3C-45aa-BD61-26908F05D7F3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{859665C6-235D-4be1-A6A8-F07EAB4DDF05}.exeC:\Windows\{859665C6-235D-4be1-A6A8-F07EAB4DDF05}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87F7B6EA-CBAE-4364-BA9C-9E57AE201619}.exeC:\Windows\{87F7B6EA-CBAE-4364-BA9C-9E57AE201619}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{735031F5-D11E-4d8a-8EC9-A207D85519E6}.exeC:\Windows\{735031F5-D11E-4d8a-8EC9-A207D85519E6}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F51F7DC4-349D-48eb-A0D0-01315FB04FBC}.exeC:\Windows\{F51F7DC4-349D-48eb-A0D0-01315FB04FBC}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0387E585-222B-45a8-8357-EEB8D28F5678}.exeC:\Windows\{0387E585-222B-45a8-8357-EEB8D28F5678}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBC8CB2E-D388-4e21-A21F-B74364796DDC}.exeC:\Windows\{CBC8CB2E-D388-4e21-A21F-B74364796DDC}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6E4222BE-107E-46c1-952D-FAC693907AA1}.exeC:\Windows\{6E4222BE-107E-46c1-952D-FAC693907AA1}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBC8C~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0387E~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F51F7~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73503~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87F7B~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85966~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C89CE~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE3E0~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A045B~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5DAB~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25EF3~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5d7bda592d17cf5baf5d1a1cc129352a4
SHA167c2502d944fe3db9b52d51baf0d1e195b3e4daf
SHA256113c02d822f511297190bd376bccbaaf91874b30745b977c014e167cca82cb9a
SHA5128649b317422b33ae53fd5044b14e957d0ebd66cb031389f418c37b51656dd363f3a02c4ba957b0b0b27cfe3d30017874918ef41f37fc893eac35205d5a98d0c3
-
Filesize
180KB
MD5025c0e061f9770852f789ab37a327566
SHA1f8ba0533321b83451c581238e79ddff07190363d
SHA256f4ee74d49bf2eac2b427953844d95f50ce6272f026be6eea60d2e6ae973eea51
SHA512b533e6ad36011e4d5a24acedd3758cf2bc71b19a86563462383f9a1f222fa9e48dcccf64c745fd2c5066881947e846fe36dfb844c874d5c897238b49f712ad7e
-
Filesize
180KB
MD55044456574ffa7e105bb86f01c428728
SHA1e290b7931f5e3c4a924dfa9a0b00f3c22a81464b
SHA256676e8a69826d27a366ffc6ee23e8675f16c6cbb8c82565fb6e501da8daa569f4
SHA5128f350be5e1c962c247b74caa206c8dff454720e69045f47330217bc30cf91b20bebbd1161f833c15b67ab2e03fb4ff37958dbd482aeca1b750bc65034f498051
-
Filesize
180KB
MD5b16788080a1ab5bdb3d3611073388fe2
SHA15540e7aeaaa2df3b0bc0e2252a56d7625af1faa7
SHA25666f5536aa258af3424c9ec3a6811b3804415791492dc17c1d41701dbdddf6844
SHA5121a2df6e2346277a1cd0ee00523649e5d60d8f0353fdcb0f59a4cdc39e188a12f627e5315dbd269480674724d9992e1719eb1858244990f33f8825a8140e0bbb2
-
Filesize
180KB
MD5fb6be060ea75ae5a84177a5b0bad7653
SHA1e2a994a881928d29ee0ffc1bc791b040e8a11ed0
SHA2561203ec8cf14b7f5cb54af74ed51aa58e9cb75a3ac13a290423ff0aead37c574b
SHA51248387ef3c12f115088dcf66913a4cb09007699fd75ecf02cd42ceb7fda8ea74e96cf9219819f36ca3f8abde367c8990391fd7cc292d84b4913668944a3aa0587
-
Filesize
180KB
MD5a6d9a8fc33185dfebf1f35a18ae137b3
SHA17b5f55fc2e2a47e5b633e9955fe082b3db0eed49
SHA2568c3f651b2549639f62417470722a02f5c26706cf420f528173e5e6c57ee402cf
SHA51292f5aa45c1c548235cb7f45d9447cc32ad9c9a31e477207a124776d4fe4fa92509a5ec537c77985a0ef5e5c9edcf5b6fa3b96322abbd2aa2a490089e57f62cf5
-
Filesize
180KB
MD55f2fd2730ff5ae0ee839e445a3cc053d
SHA1ea294a87377d301b9fe83c60fca74e4d4cf555a1
SHA25608f652f14deb75eb547d10fbb5c2ec314dac232047e56f11b69568476f42e911
SHA512dfe28363fd0d14ff5e069c936d97192c52cdd884142d9c326c9370a022b65e6a7d805152e0fd513e2312fec3d0bd165ed2ec517dd9a55c66d62449b09969c6cc
-
Filesize
180KB
MD565e8f5cd317ec680ed89123b3596b90b
SHA19963d0c87b0c653b67ddba5f42421491604e50cd
SHA256018bd297e6a1abada24aa388073611c8516d3b754487ab0271813662787de854
SHA5128ad869efc759cad8c3851b5a397bb324ca54350042fa07a44b29485846a3f85bb41109045ce1c662b4761b5d6c592db5ef7d6614cc3296cf78a418acfa1cfd0c
-
Filesize
180KB
MD514ea29ed46ed160210977dbc8db6d2a9
SHA18b869eec8c814ae2cc378f4d45eeeb0210a53fca
SHA256baca51878ee2bb4670bf51d04c6e624317f007b76dc98ec3005b3ef615c7fbe8
SHA512ea8eeeb9465f9b6c41ab1bd6391fd46863e6f7c349ec71a672d74e92405ef02c7832f88b2bd9c9dc6bc1d3b949c01efd843b34c6c9c94692c4948acb8f68079d
-
Filesize
180KB
MD51f7b61d0f9924b8d1e8f6cdcd6943f0a
SHA195532f806243863f2c38ab5ea67e951b3dae67cb
SHA2568ab3c1bc5b237e1035ab0c893d05ab2ae5ac5a5a82ce96b2a5554831918d4f3d
SHA512299463d067e6910611974a57a8c05fb4d4a59eb085152693cd903190363c2e58966567e10043158686fa8b397127127fd16ffb6976d91b4dc8454d5d796161b9
-
Filesize
180KB
MD5586978c8e0f08ff2c999761c61a7d47b
SHA17a026e8aa30d7df6247ae7d5b7205504f589878b
SHA256bae9ab58b1edd92134355e0c63243e594388afa763101226cd0be7093a24c217
SHA5125907f896f60b5e735c9ef8f5b06fb6d2ea4f4121bcda4471c9a80ca83357314896859efdb89fc4a0e2a07a8915ca12339b64e1a342fc26fd13aebc2f677ed652
-
Filesize
180KB
MD5c54bb696410ea09468e22c3bb7f08b89
SHA15ff05ec6f2591ab84dcfe20120e53d555dc525f6
SHA2563d79fe212aceb613454e2427ac88f94c65d1906d6fef2b690279ed9f5c8d788e
SHA512625c94ce5f352f75e4c78db0099dbb11ae16c39d1b9d63ce77d0e8c6c13cc48e7f023f91693c58e9170e0701755a3054c583c227a822c328a88498153a144f76