Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03-04-2024 06:47
General
-
Target
2024-04-03_ce91d0c905bccaba39047e0175c6b6cf_goldeneye.exe
-
Size
168KB
-
MD5
ce91d0c905bccaba39047e0175c6b6cf
-
SHA1
a3f82237a9838a73f60542f1c5fef3fbc41111e4
-
SHA256
d74c9b9e40f432e631b7dd623eb5195680242079fa0abfb2d34d3c15d91e615f
-
SHA512
cffde8743d59216a2988ef01044139ad08740c99574e79cb71a3840a87df9d7bdedd15ee0122b86920a1e2b16832e45a1b0af871d4c278fda03ffe44014c9842
-
SSDEEP
1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_ce91d0c905bccaba39047e0175c6b6cf_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_ce91d0c905bccaba39047e0175c6b6cf_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6052A84-8B05-4f04-9E16-B5BB966B9D45}.exeC:\Windows\{B6052A84-8B05-4f04-9E16-B5BB966B9D45}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1812ED7-2F28-4cdf-989A-D544FC8E5C4F}.exeC:\Windows\{A1812ED7-2F28-4cdf-989A-D544FC8E5C4F}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1C4FD0E-E1FE-455d-95DC-855052738201}.exeC:\Windows\{B1C4FD0E-E1FE-455d-95DC-855052738201}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47BDFE32-7C4E-4980-83A2-05CE05E8AD8B}.exeC:\Windows\{47BDFE32-7C4E-4980-83A2-05CE05E8AD8B}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E765B3C-7FCB-4b02-8362-1277E45BAAEA}.exeC:\Windows\{4E765B3C-7FCB-4b02-8362-1277E45BAAEA}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F683A9CA-B8A5-413f-BB99-A695C4C59BFE}.exeC:\Windows\{F683A9CA-B8A5-413f-BB99-A695C4C59BFE}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11AE05B6-2BE5-47ab-95E0-52717B675D38}.exeC:\Windows\{11AE05B6-2BE5-47ab-95E0-52717B675D38}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C149CAF-58C2-4d67-AC5C-89F46D5723DD}.exeC:\Windows\{4C149CAF-58C2-4d67-AC5C-89F46D5723DD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{421FBC1F-EDB5-443c-A188-EE44C635F847}.exeC:\Windows\{421FBC1F-EDB5-443c-A188-EE44C635F847}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4F9847B4-BC43-4037-907B-801AC38693D3}.exeC:\Windows\{4F9847B4-BC43-4037-907B-801AC38693D3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{30E4F62A-0675-4264-B950-945C98EC020E}.exeC:\Windows\{30E4F62A-0675-4264-B950-945C98EC020E}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F984~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{421FB~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C149~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11AE0~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F683A~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E765~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47BDF~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1C4F~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1812~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6052~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5db16272fbb86d52bd496a84e1eaf83ad
SHA1eae5927b71de78b939734559c6890a47fc6434e0
SHA25655ea48be6d9c45921fb50e5d0cd77b1c3c5cdaca06a92a0f0d301e7fc2b90d7e
SHA512ad7244778605d2fe896e100c8d5faa795ed5174ae5e5dbe6aab04183f0700e1b2992c9ad8571ff539d8ac48070673ec974defab6109122fc184efb59f0abf775
-
Filesize
168KB
MD50d9905e874375729dc4040b6b6c351b3
SHA126a06b0488fb417b67c7bc1341c0a20983a31621
SHA2566f91d4f30a4262ffdc660a558315917f6a2a7da4bf2e08b1822f59527dd5b14a
SHA5124a594f3a1efd697e0778fbc9eaa02fc7a59442ada53867b818e8d3c96aad36fc98a91fd461ccc390f09bdc8c8ffd91ae3b6c10bc08a5696d3137ca3d2d019a0b
-
Filesize
168KB
MD578963c6a310b1a09654844991ce4575a
SHA1b485bf8c17caf740bf332e4ff3c7f2f2e5dc3e07
SHA256577a8d20f8ed5f0fbee45a466a7e790c2586658b76e76fc289462751db4a14eb
SHA512816354f029c5468efdaaf437d73171c7cf17350f1319a604c2df93c2d4c6fcfdc72e257323b5533fcc5ed8ada06707e837cdbcc8c54373f605a478498b02b891
-
Filesize
168KB
MD55964ea80ce6a9571705e4a86eb18c09c
SHA199279bedeb553877f849725bdeac1aa229badc49
SHA256ae34f64004418a68a21b8c9270cc6b571b020de8ce65d325f494c5b899417d87
SHA5120aa14dea3a16060db2607dd6474875d29735262db9c6d33d0a3a6fd2799946621150b4a8a3bbdfcc1426f7dd6302b6b15f9ef7eed8266eb41bec051349bab429
-
Filesize
168KB
MD50990c1403d9d23e6db42cd8d7cb7788c
SHA1ce57717773bf360ee7341a153fcc2cf36f9e2210
SHA25607806bc953a5c4b8372639767cfec2ff130f0cb260708c8a8cb7aa96a4d2da45
SHA51230871cfd543e2dd94db5b909a78760de60831e31b72d59f75de3ded4f75dc8d5acf31934672bffdb907ff68f73e85e33b53d565697d1fa5c8b3b2e62fb467930
-
Filesize
168KB
MD5e243fdb59d62ef7d193a7002b5b47b02
SHA16dc8e59be203df1fab68d7f118e0a64b72d4b10b
SHA25631fc4c767fc711219612c978e8b09702e5d0123d02897cebdbb8ce262e4cd6cd
SHA5127c9b6a317c48586f4db4e45f0ea10be47f78b2f28c29f2099e88c6e9488e1016056ed27083a7e268cf8e435910932ebf94743b0d8b5f80f906e98bc899f56247
-
Filesize
168KB
MD515f58e64b0a1fc2f479ca74b55b4aa19
SHA16d4265aeaac04c9c4daccbf094c9a4c03632178f
SHA256668c939ced654ce60c16697b26e05093383305b42fa956afcac69e969d1e745c
SHA512a7193d9a49647a455e4e4062a096f58d4c320c05e67fb035009524d5399e0717618d2a6a191d2d29ded388b40a61fc7f59e814395c49e83fe2085543a528b096
-
Filesize
168KB
MD532e98cc749ede9297681a3c3b29a9545
SHA1569a07639df836fd475429c2b3c734d113c4f186
SHA256faf792dc5c4e3f075074a2fc239de3fcd11b78f5000505967de6d88006c426ec
SHA51289d4fd9737d4c33712aa97d37fab6a779e0067748e534fffeb1b27846d7e96a729bd6b73c3e23a09d63d4249191ccac6632444dd7c8e10f822b578846d78725b
-
Filesize
168KB
MD53ca1676667ef849026376ed3a4140a4d
SHA16ef3b38c6285ff8216ebc61723b764084136490f
SHA25694ccc4627f60fa5425135ed58a8a8e2bfa5e7e072eab521eaa830cd2b50933bd
SHA51282af282c2ba93f2678ed5784fb97ea0ba221c74272caffbb8eb0a6df1612e03b481809725224c6585b55bb13d2f6246609f0caa23edce37a695cf3f9e1213139
-
Filesize
168KB
MD56795054f36fe7fe037909053aad251a1
SHA1723a62f11bf5e319184de8e3e8c6cddeb8b49335
SHA25641bfcff430be33c3716e08d0ed4118a63e7a5544bd312ed480c9cb152eeec412
SHA5129432ba9ad78f9a4184ea3a3f4aabfbbb36d0ea07190b2ccc7e05340e5af6df0aab0fa81669e8b5a0000458cbd71d870347d3153092a6dd1892e76917e917c498
-
Filesize
168KB
MD572dbd8fc624244fc2f90450e93bfb939
SHA1d16f38dccfe3f1afcddb60c9ba1d717e146cf92c
SHA256c15a4583ae0b141d52f15ab485cf3283d3a72b985cac6fdfd4ae9c62a8af113b
SHA512881c536cc40aebe12b018d2481cc1e2e2ce448aa0c7ed31ad5228416891ab2d974dfb37fe2a511dbc1fdac3b1bb4908810cb5caac15a9fa788feb5b0b1480914