Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/04/2024, 12:00
General
-
Target
2024-04-06_dfc07a647c746e2495351336407a88e8_goldeneye.exe
-
Size
168KB
-
MD5
dfc07a647c746e2495351336407a88e8
-
SHA1
c183f86115f5e74b712807e064cdf3983ed3f77b
-
SHA256
285932479cb96763784c922cf1e4d6829f22938d7bdf893c50b563228ebdf3c3
-
SHA512
beaef43d0821cddfe272314921a3e8fa2a5098957979af0b803e8fae56f22636008e5a30dddfed87315096c49723c95df6fccca70c60baa32edee6e1a8f56f11
-
SSDEEP
1536:1EGh0o7lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7lqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_dfc07a647c746e2495351336407a88e8_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_dfc07a647c746e2495351336407a88e8_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D665979-85CE-477f-940F-9AA7D91A1A78}.exeC:\Windows\{2D665979-85CE-477f-940F-9AA7D91A1A78}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{90DA8C5A-1F3A-41d5-8E0F-395BDC871EAA}.exeC:\Windows\{90DA8C5A-1F3A-41d5-8E0F-395BDC871EAA}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C20D757-6111-41c0-8A9C-CBD93030C1F6}.exeC:\Windows\{4C20D757-6111-41c0-8A9C-CBD93030C1F6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{414578D7-6615-4008-8ECD-0FF5037B34E1}.exeC:\Windows\{414578D7-6615-4008-8ECD-0FF5037B34E1}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{655F7C5F-D74F-4776-BCE4-584C77299C81}.exeC:\Windows\{655F7C5F-D74F-4776-BCE4-584C77299C81}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD6E82AD-D31A-4c07-BACA-1A508DF9AC0C}.exeC:\Windows\{CD6E82AD-D31A-4c07-BACA-1A508DF9AC0C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CA1BBBF-3269-4368-BEC8-1FCCD4739073}.exeC:\Windows\{4CA1BBBF-3269-4368-BEC8-1FCCD4739073}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{810DCF95-404C-45d9-BD84-3116E57660E2}.exeC:\Windows\{810DCF95-404C-45d9-BD84-3116E57660E2}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7DB233C-780A-4fcc-A8EB-4663B2ABCB9D}.exeC:\Windows\{F7DB233C-780A-4fcc-A8EB-4663B2ABCB9D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33BFD2DE-AF4F-43fb-925F-1CD688D22BF7}.exeC:\Windows\{33BFD2DE-AF4F-43fb-925F-1CD688D22BF7}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A129C9C2-3ECB-42bf-8C58-DB99C8B47247}.exeC:\Windows\{A129C9C2-3ECB-42bf-8C58-DB99C8B47247}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{31F268F1-988A-4097-8D1C-805BA24562B8}.exeC:\Windows\{31F268F1-988A-4097-8D1C-805BA24562B8}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A129C~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33BFD~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7DB2~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{810DC~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CA1B~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD6E8~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{655F7~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41457~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C20D~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90DA8~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D665~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5913e4eb13bfbfa2af52aae5c47ae4147
SHA1d2c3d5581ebb20c50c1bf4e2cc3881d7c2c4adc7
SHA2568d28b25c2e4998537420356f95f78f59b9d41ff8ff574a6dd66d4948339e8b04
SHA512bb263d00a4e17069dd63e4f378a20922c197fb4e01a738ede3ae539f2d2d9f380ab473d7be86d7ac72e3474a47ad75e4902174a3ee4cf336fbeb85039163eb30
-
Filesize
168KB
MD559e6e86d749d4efe58055861f1466017
SHA183c0c4e18256bd6ec3e476e330467a7addde5293
SHA2566848e4b1fd5c4c8d75c7e680ca2944751ad0f4c251c199a16d0bf70ce2a5391d
SHA512d523d1dbc0133d44feb528e7c6f45396dcc0600f61fc61ff9cebef78cc2c3a0426a0b807e95c6a3f8c218a451f838f30478de7f8dc24bf94cf9a71adc787aac9
-
Filesize
168KB
MD580a5d9535e208b56ef9b592c5e34b270
SHA14bc5fba3bd435cbe14ea33a65151a069f6ae8f4d
SHA2561fe48f259124a9c78af205ee04f090224ba512d7905322f4144245df13c1c275
SHA5122231e746d2c9b0df32a0aaf1222382d035151324717f823e412a018d7ed5bec109d12dfee0c8d6707ff57ec306dfcd20a20840085d23c0dada285084b50bc055
-
Filesize
168KB
MD52e26c9e6e6e2c8b391f8bed7791400be
SHA15f9df13011dce289670883509b13fd7b340a6561
SHA256eb885ea95392ae0ce74c0f52063e451c153045f4900caf168e1f1a66db1eefa1
SHA5121f588fbc9bc7bc6e0d1251c833f01277a51c555bd76a50f5baf3a8a7662998fb2c9e4bc2ba0ee8d34688e1fe390151b72f0551d0c6d6b305ae5757c2b4493314
-
Filesize
168KB
MD53c49bc61451d22f7ec271d1acc8fa8ee
SHA1030683d5a5cb87bafb876ab032491d999832a3e4
SHA256eb1654a8d787ad601d822e8878007cba556441a18a034b1063d185daad0e1c36
SHA512e1fc9ad635cd9eec4c4dc4f6415c4f963d424cbec2b018686968fae47e10c917863aa01eb38ba897226e05c563bcb19430f9cda7d804ffdd1388553c4a8a86d6
-
Filesize
168KB
MD579d2cb9be19a91838804475e48e7c2cb
SHA1c929735cc5fb46429ca2dc2f62ad872d1efc8f87
SHA256f2a68c1f9ec9a28027461cfe4ed581d1fb7af76f085f65ec63ca1e899a48b629
SHA512ca9be7a928c77dfe604febe21154c7c7c62203c9c6a5be172e3e034178df07fa0d7d67465dc08c4565487a8bce42f4f8c3fd60aeff4f2456fa76ede1bad26723
-
Filesize
168KB
MD553015525f8964b2fffd5073fb9ea7fe1
SHA11efdc84adeeeb3d7bedbe6287071bc0957a8bc00
SHA256bd2b85530688f43222a82dddfcdcce3695765d0d2aec4b18ebd5dc4c8df348db
SHA512df859947ea53f311c1ffd0ec6453815dd7c66adbe32f7f151484e04637fcf62cae9f17cbe5765ce9b2ea5846209b84f3cb2a60f5791c622be42068bc0623f0fb
-
Filesize
168KB
MD56bc3a21969fec5a3f2489b95a0eccfe7
SHA136ff068a19fbcab622b06bc26fd07a2e2b71b2ee
SHA2566413213cc58828717a1718c5294281ff9044c3bdf0d8f8abad4e74e74e690615
SHA51292409e4abefd7dc3bde77eee498c937cb60980d26a499ba1b017df1e659e734b1dd692395856654f915d63a64ef12131c280befb71b9fa59f69dda9c66075cd4
-
Filesize
168KB
MD56ad617b68ec4338f5aabd34409a7e9f3
SHA19c92b6d34aeff3acc9245291d1c979f610b84bb1
SHA256532844c1487b36a00703c5abe5e6a383297d3e60ddbc27f27c31dd06865b1861
SHA512d8e4b26527ef0450bfe972d134007a6486f0b31215e5c2919a6637992bb4a4792abfa6dd0352c6a8d3398fa98de4b7ddd19a18025a5485d26a9559e860443766
-
Filesize
168KB
MD5467ee3282525c28a3890ac7e9d7aa703
SHA121cf976a6aa71a5481b6c4eedf535fc6c78c36bd
SHA25613e6ddbd40c9c9caf19e8f130d31281a671f03ee2bf645710bcaacdc16b05bcc
SHA512b17dc76d35ec3a298565aa39559e04b222fdd3ff0ac2402e4766d1bc4fe66deffafb043eaa1a8b7672b50567857f2fa2e6036ef3c91d0d8c24a700c9abb81897
-
Filesize
168KB
MD5f23673ae3bd7df2a70d183f6759dffd0
SHA1a9eb3cd37ee2fb298e94deb8ad388a78ee5b795d
SHA25655fca448620aaebd7ca4162710932429ea3af7c684b32cb5c6ea2c299a1e2550
SHA5129d874c8a4f21e96c4ca863122d0e9d9a669c6d84a429938e054769174c6bfa5421f528cd46fa344a0ed4a07fa1b0ce9686b576b6a1f60ff53cf251ec00882859
-
Filesize
168KB
MD52986ebf969df37797812313522302292
SHA146c304b0601ab88da27d7f2aff5ffb9511950527
SHA2567ce4416bf808b1877e7b4b918f34c6cc6c2fcca42417f2b03e416b482071d3d5
SHA5122f2556b012bebeb311a83b6a4ce6ddff71be8a964c1444fb1b8a9226c9f32e48e4e72f0c3bdb338213ed4d797cb6d2a7dcb7c2945987329b09aafb518c9fcff6