Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03-04-2024 06:43
General
-
Target
2024-04-03_6ea662178e68cbc0d41cad8835251e7e_goldeneye.exe
-
Size
216KB
-
MD5
6ea662178e68cbc0d41cad8835251e7e
-
SHA1
b759874a2bf2bfba2a06901880a4b439aa610876
-
SHA256
0aaa3248f1accdc3ddb86274b9306c420fc143fb01583ea6e6f8499302260cc7
-
SHA512
33410822191a5c96382bc9a9ef1e79f9815d0c9cdb1afb9b3751ebe8f9c2ce10abc331b9e0b232eae21771f142f09e441dc1e09a026d3b3b0284d4087ce9e21c
-
SSDEEP
3072:jEGh0oVl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG3lEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_6ea662178e68cbc0d41cad8835251e7e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_6ea662178e68cbc0d41cad8835251e7e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB3AD5C6-EC90-4781-83AD-462FDC721531}.exeC:\Windows\{BB3AD5C6-EC90-4781-83AD-462FDC721531}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{523B092D-F6F8-45c6-B580-A081A3BC165C}.exeC:\Windows\{523B092D-F6F8-45c6-B580-A081A3BC165C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64A3EB9A-91E2-440f-9814-80F7B6DFA3A1}.exeC:\Windows\{64A3EB9A-91E2-440f-9814-80F7B6DFA3A1}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A427F14-D02A-4983-A1C5-B5367D110E5C}.exeC:\Windows\{8A427F14-D02A-4983-A1C5-B5367D110E5C}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EBB776F4-6ECC-4658-8E34-964A8765125F}.exeC:\Windows\{EBB776F4-6ECC-4658-8E34-964A8765125F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5C833FB-D2C6-4c32-9A03-0B4B5EC34B82}.exeC:\Windows\{B5C833FB-D2C6-4c32-9A03-0B4B5EC34B82}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EE6A7BB-EBB4-4f19-8611-919512AA9E07}.exeC:\Windows\{5EE6A7BB-EBB4-4f19-8611-919512AA9E07}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{818B71DC-5807-43a3-B7F2-E8EEB36187CF}.exeC:\Windows\{818B71DC-5807-43a3-B7F2-E8EEB36187CF}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{266988D9-8169-4e93-9923-062259DC12EF}.exeC:\Windows\{266988D9-8169-4e93-9923-062259DC12EF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01E60386-5CBB-4074-8D8B-CF83ECC4D006}.exeC:\Windows\{01E60386-5CBB-4074-8D8B-CF83ECC4D006}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3708E3C4-1D8F-4d89-B486-437B6D642158}.exeC:\Windows\{3708E3C4-1D8F-4d89-B486-437B6D642158}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{95424C85-3C5E-43b7-86EE-28683B498783}.exeC:\Windows\{95424C85-3C5E-43b7-86EE-28683B498783}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3708E~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01E60~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26698~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{818B7~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EE6A~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5C83~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EBB77~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A427~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64A3E~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{523B0~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB3AD~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\{01E60386-5CBB-4074-8D8B-CF83ECC4D006}.exeFilesize
216KB
MD5a49de3b465c17ab8f174431427c8116e
SHA167fe3d24839a34d09226e057fc19b784d3e58e10
SHA25699ee0eb612ff05129352e428e3037648704a701f1fe6ccad52ddf1092520fae4
SHA5126da5d165e0d8506413679c307904f77e84e6aa97e57be9342bae7eed234b1c010a09bb38f9c58ad7321c136c6c0679c9dbdc77b7ce9dc43a63a2ad141770cced
-
C:\Windows\{266988D9-8169-4e93-9923-062259DC12EF}.exeFilesize
216KB
MD5ff118f8210388df5fc5e9bdde7f7e1c1
SHA18e3f1c7ec78102ac311a785ce43f585b051ae020
SHA256e941a515e11ede811b26cf3f4142b6c74b0ba04e5f8f3c9487421b92764ab125
SHA5129162067214b6bb1ddf7d12539254e923c44ab9e181ee0ee08ce65d99d9ddd6314f331bedf99c6fba81b17f352e44c548169b9931ba392b5f189a619478b11438
-
C:\Windows\{3708E3C4-1D8F-4d89-B486-437B6D642158}.exeFilesize
216KB
MD5edeb827652dc5f2c3571cf333fe33e28
SHA1f95160e30e7adf5ca0d98ce82f8a27a7549a8288
SHA256709ab31405f5cd916ae9e6fe04db1ca2e7d7495e515e0f1b9c87a58da633f271
SHA5128f0bd5e51def6684741618bcc3c6f0f4720a6f36cbc7e0670a8301909839769ddad604de2b96b10fbcb39d14e4021a4079a9dfe65d9f8911a92e33d1e0da6962
-
C:\Windows\{523B092D-F6F8-45c6-B580-A081A3BC165C}.exeFilesize
216KB
MD5b0d2c7c24e6faf50c3dad0723defd93a
SHA10e3580e4af8600daca23165b5a0565e3165100d4
SHA25619f2b8cae03d777ad2c390be0ec52b0aba4fc32dfeb152508cafca6fd84dad17
SHA51216cee8d2992becb8e346dae62245808d7f8b31ebf7082549c69a57a82838f180f0f287f5b793d0d426d80922261510c25f7e6cfc00f830a038a8ec468291eb43
-
C:\Windows\{5EE6A7BB-EBB4-4f19-8611-919512AA9E07}.exeFilesize
216KB
MD50056585ef23e6486c7ef88e0a14de656
SHA1f6db00c753b4906895f122fc12b27d59ecb8f3eb
SHA256e38d01e51b1ad3eca568f73558442d7715a114e9d62aaae17778ef1690d70c04
SHA512f46055e51b951b4effb06406578197640f5e5b9634f37625fb86d23153c318a19d574f95fb43c5cddbc7894274eb0cb55e5f28f226b37a1175d5459502808e4d
-
C:\Windows\{64A3EB9A-91E2-440f-9814-80F7B6DFA3A1}.exeFilesize
216KB
MD554009691a5fe5493a93de5158b1ac00d
SHA1d00d73b56fc16eabf7002a2a09e2eb9556847506
SHA2565d913feee3b5606c5a28ffce7e7268b63bad03a6e5a17813cb6e5ccb97888215
SHA51241fff6c8b08e54657df9cb8dca819b2017a867ae3625fc8a7eaea6ad7a341c486e6660b7f329892a50f931c19e0cdd897e3fcc9b33b1f650da2e04e6e237fa82
-
C:\Windows\{818B71DC-5807-43a3-B7F2-E8EEB36187CF}.exeFilesize
216KB
MD59a6444c8f54e74f9afa345ede4fa2fcd
SHA1bbb205629ea768ec0d00b4f0fc716098d3c92252
SHA256d9d3865fc797bd094731763ac0a52ef9f09138d10c8c48d3077765ee32442c4a
SHA51275e010b84470cb714f7a0de6a296e2ac33914a4f4a82f776084df35808e8aa130a67b20ccf7e7efa93964dad336ca25f98e97fda6af5efbd3047d374d6a14f20
-
C:\Windows\{8A427F14-D02A-4983-A1C5-B5367D110E5C}.exeFilesize
216KB
MD50bcd052750cb78920245094725ccda6d
SHA17e49ac482dcef6f7c881c540520a7a941ff7711f
SHA2564b575ccb8ae21ff4a86b3b97db1abfe0e594f5368adec6488a419a67da85bd15
SHA512599eba29414c5a3b571e6dabab667f15b969b9e7ede1328cce3ca859bbde60959bbaa036d88fa631ba8265769788b3c019e0d637843799d89f68d137def197e6
-
C:\Windows\{95424C85-3C5E-43b7-86EE-28683B498783}.exeFilesize
216KB
MD54cb7ec6e18eb95c665ab4261fbf02af2
SHA1e1ca44879a1cb65161f6d8dc5b21c75a23aaade3
SHA25647461efe75222a6f7f7cef0468ff9ba2c717ee183b6d0846e74861183553e3b0
SHA512e1ec2dc8307a4d8d06cf19cfbe56d534daefacdeef2560035cec495a680b551102a431dec1d53aa09f7d88523c8ce668732a0a93b0beb8787316263f490d6e9b
-
C:\Windows\{B5C833FB-D2C6-4c32-9A03-0B4B5EC34B82}.exeFilesize
216KB
MD507c25bc9ff755e224e2628e478f9f6ef
SHA1ea14dc1bcdb42777fe47c4925079ce88a55d4dba
SHA2566d582f3a8c5a359f46d494eb6b44d50ecd2ade34c1da648f297b6231dd5b66eb
SHA512ee6ce59f541c6f364b1262de116b18e5347ff2e06f3ab727e0425e870cdf46b678ddd21ee6a665cf5235c127bfad80d6d0bb36c814ea19c7ec630d0b9e2b689a
-
C:\Windows\{BB3AD5C6-EC90-4781-83AD-462FDC721531}.exeFilesize
216KB
MD57994028ae2172cb487b2d1c5e096730a
SHA16b9359ba16821d104486e1a146d799619d1df5b9
SHA256fbefdf9f58777252b40d6aca78b8b3d6b4c5b864e0f17391f1e6ac7bc7853612
SHA512e9ad93800d6a9fa73edb6efe954a7f7b1b49f54c933268f1aea5e8ca6994164e0c932e359485cdbe0f4c92f7fc9d1805961efb3a7090fe5f9ca76919ed96eb72
-
C:\Windows\{EBB776F4-6ECC-4658-8E34-964A8765125F}.exeFilesize
216KB
MD568296513568d73025c2630af10987a20
SHA13ee667eca6e4ba96a73ae9f8f6e7c5d4edcb70c6
SHA256f916930b40e6a94f6086c824b6f9a52d98dc2df8203ae1d2ca43627be37eaf01
SHA5120839ead908687dc648adf3f5c5f35ecabc1be087551b34b880ca32d37523d36a3ea5986d9775b252a5afdf405b56fb97477d8fada4922890d49be66f6d733813