Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13/03/2024, 01:48
General
-
Target
2024-03-13_cf00cb6dcdec71c0319f95ce18f251de_goldeneye.exe
-
Size
344KB
-
MD5
cf00cb6dcdec71c0319f95ce18f251de
-
SHA1
9bebe76ff0f7318a95f7f0aa12d2a95bdc214038
-
SHA256
19ebbfbc12b19ac420e6fe662d8942d9f55a53e1ebcac21c813480c25c8a8362
-
SHA512
c63f9e0dbf2c5cb9880f185a48ba1e75b83ca1d2505d0a17f285aa3843725c56ecc86552b7f78041ccad05cd9b168749c861c3e895a2afcf89a518c5ef832e6d
-
SSDEEP
3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGLlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_cf00cb6dcdec71c0319f95ce18f251de_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_cf00cb6dcdec71c0319f95ce18f251de_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B05BF6DF-B466-44ce-8151-322485F0F533}.exeC:\Windows\{B05BF6DF-B466-44ce-8151-322485F0F533}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{503AC1DE-C694-4196-97A0-7338639BDD8B}.exeC:\Windows\{503AC1DE-C694-4196-97A0-7338639BDD8B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F291197A-C361-4d39-801F-65B1EEC39E39}.exeC:\Windows\{F291197A-C361-4d39-801F-65B1EEC39E39}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11EF428D-B29D-4f13-99F3-4143754EDAFB}.exeC:\Windows\{11EF428D-B29D-4f13-99F3-4143754EDAFB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57239A30-7913-42e8-939A-1A7BE18B726B}.exeC:\Windows\{57239A30-7913-42e8-939A-1A7BE18B726B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E451225E-9EEC-4eba-9BB6-CB658B24A7EF}.exeC:\Windows\{E451225E-9EEC-4eba-9BB6-CB658B24A7EF}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F4DBE4A-B373-4d61-8FBD-457E079AEC7B}.exeC:\Windows\{9F4DBE4A-B373-4d61-8FBD-457E079AEC7B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60C6FCAB-D658-45ad-90D4-DA417727C656}.exeC:\Windows\{60C6FCAB-D658-45ad-90D4-DA417727C656}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4378738-B906-4c5a-8B5D-CD4BEBDBBDEA}.exeC:\Windows\{C4378738-B906-4c5a-8B5D-CD4BEBDBBDEA}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA28C237-4819-4c8d-AAA6-4C942EA638D6}.exeC:\Windows\{BA28C237-4819-4c8d-AAA6-4C942EA638D6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77953CA8-AD3D-46a2-A3BB-12FB02DE0156}.exeC:\Windows\{77953CA8-AD3D-46a2-A3BB-12FB02DE0156}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{68F5D706-6E43-43bc-888E-941CB14EED0A}.exeC:\Windows\{68F5D706-6E43-43bc-888E-941CB14EED0A}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77953~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA28C~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4378~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60C6F~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F4DB~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4512~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57239~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11EF4~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2911~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{503AC~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B05BF~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5703260d165afe8f185b60072040d372d
SHA1cb99a6dd54a9ed35ca62b771778963649b88f6da
SHA256bee57e6e94351f5163b10d04513323e6f0915849652e3597006c732358d7f6da
SHA512617394ba41e8787d127775aee010b3462a506aa8f9c18eeb307a7067cb229ad68ea16b0c029555de2f90b00dffbfd6b80a6df9b337e302d365b53c087befbc95
-
Filesize
344KB
MD509c3949f98677ef83987f114249de6dd
SHA1708a99b69f06a6e93a59d52d707fd72e3d339881
SHA256235d004cfbd5a073581a8d9770987b4011d18d215318a447cf2afbbe2f98a590
SHA51232044b159f6b6d674536b272dee8f237881c566d5481f005d718e89a6ab3b9c07fedc9e84d0835cca9870186c064806cd285326c4a108e48d7b55c06b508a759
-
Filesize
334KB
MD58a15fba7878512416700b7422484afc5
SHA10731889eec2ef2eef703934b4bc85e8d4ed71735
SHA256ed975fb77a8d46a77ba10002caf304bf9cbdd335021748acce980ab67a17e542
SHA51298a13fc79f88570f10518655adfed922cdbe94b9f991f54bf31b0f61fdc875d91a93fb9726347d71c7028e5b436fe8d0e00a5ccb40cbc3c993493dfbcdd99c37
-
Filesize
256KB
MD5f980df745a7720c10096e1941da80a7c
SHA143726a75e5a34e6f1ffa1cb13645fd085b94e741
SHA25611ce2c7a9f757132ac0ed15209e334db670786aa65ef0b91526f99bb1029f556
SHA512d25301879fefc95078bb8a3227c3acdd66e7445107340162f3ab2f89ed32b72cbd3b217b609aa26dde6ac8faf4398b420b498f9b456b9d0149263644c8cb6639
-
Filesize
344KB
MD52c45376493239c5d15dde8bb476b5d17
SHA1af0969ecf52b845881f493b9cfccd5288873c68c
SHA256fcb18a9cf1165015359cf2414229beae6706ff01336cbe17a7416962b29bb736
SHA512dccfe69c06bf348ed61f1870a6c75f9709a1b52c8541e0bcebea5733d76c99db247df54b6877272fdc5a023831deebefbf00e13cc77d45b2f0b4048836847e2d
-
Filesize
344KB
MD53359b19828c7a96fd006a86655da1582
SHA181e384ee541e5ef56e08bb2babebbd20d310d981
SHA256241898113437bace0c580583bdfbb21d4001275e153fe67a3808ee4b2f7a300b
SHA5125dafed4a443ae54fbb1ddf600d5d137ab84c089a06e7eb588387ceaf45f7d785b42b6217b4e570c8dc6c8647b07bfc64f7826217095407357c8c3aa40663877a
-
Filesize
344KB
MD536f8b8cd21b41c2bb158fb95661aa2d1
SHA1a7d70fa63a4134cc48e5d6fc3ca902af8151dd9d
SHA25626de825b1739cfb3ec29034f2e3ad0d46731b69037a6b6c82f22f230fd390c19
SHA5126baef8ba6f7e6daba96cbac18bea39f895fddfb13e1b8ff208ad29e3fcdfacdeb1dcece4bd7a975597178ec349e54b9bb50e81de5de9c9fd3d5eaefa5680883d
-
Filesize
344KB
MD5766f9738a1acef75fdb2360aab655ff3
SHA180ee66937cf5cb56f31aa2e3f0660a30d90cfb73
SHA256cbdde9e9d41437bcc19f1ff43f6d82c58d8a97db730c8343480adbbb6ee7ee3d
SHA51201b0a8024327213f573b0d1211329c68ddb2a76dce63eae5981198422da45ad0f4ee1cf39969ddbf9c324a3d54530ec99aae38f43a6fa16244ffb2bee979da12
-
Filesize
344KB
MD5024956aa7b2a48237e3b8dd59e3f58a7
SHA194b05f246717cd996e9422ff116cdffd06b0799f
SHA2562fa6c005e4db21b0c9bd8b5f20f336ba332fb51d2c90cfe5257dd095f0267226
SHA5121fd7daf0da25400c7c8d2640c8feb798ea4cb49e434617fbc5e82b0701320aacd92ebc2d7f195c2fada73059893422612c2b2c5ffaad03c66f704325da283f3d
-
Filesize
344KB
MD57aa28c743b7c71801fdb257b04572aae
SHA12c37e86d07425037a30375652c8106cd9a6808a0
SHA256a9b656cd35b0e4507ed1e45f9c95a9082f023e463706960a65713eae7293e722
SHA5127bb5adefefe6c7d5caac47340c93b8b8e2e53759b5956a688090e4d6d88895ee15d0f90a5ce63da02f3934df54b8ca8bd9c7e573622ee2354c0573801d62cb97
-
Filesize
344KB
MD57b4e1b3801c0dad9715f60bbaee398d3
SHA193d66587496f3686011d235420fd137cb8035b7d
SHA25640c08ccb20226684807e885cbd18249f47bd87222affe3b88375d3d1e35c16fc
SHA512308701f4175dc06658c667bc63d6884532764df87bf717453e29453571e242202d502559d7311a3dc30e5eadcd72c8f574169a82a1afffa4ad628e51c375051c
-
Filesize
344KB
MD51a95a6632176f6ea727e1bec33683cc5
SHA1d2d2aad6d5996a3ce4cc526aafa19dec4f18d218
SHA256ed890c783783cb2f04eafafc43873fce89f49190a04fea4e2065f4461da38864
SHA512f0f6492c3045d06a866b9669a81fc94e84c0797c25760b8610dc422edccd30f72c6491145bdc472a478bff476a7438a211fde16b6b0c8c299943f0cc952453d5
-
Filesize
344KB
MD5c1dda923f2b58e83b7c02f0497f096c0
SHA18cdc308736a036a5749de5b0b676c3f188540d73
SHA256ed5b230cad991d18a2aace6ffedb72f9fb638ee04e98b3bb67ed18a6cb5dd681
SHA512278ce1863ca8d8f98d9feb5513d56e8f17bd4e60cfce7e26a12b746adf6065cb35855b24ab4c2d7c3a6e239d66be45ec8c56d9cff16bbc589ea2311c95386d80