Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/04/2024, 04:30
General
-
Target
2024-04-09_e3e4959489cb3a62c8e40c9a0d40a97b_goldeneye.exe
-
Size
216KB
-
MD5
e3e4959489cb3a62c8e40c9a0d40a97b
-
SHA1
4e23879e251c270d51e6b55e25361ca9a9676cf2
-
SHA256
65fe210acb7b5c75f214300dbc0731a1d8646d990237e434a27c56b4bc85d981
-
SHA512
7d1708bf45b17667cb81f583c2a92b3cf7c8a2d552c24f20f0aa97e8c8468b28bdff4b81b43691566c580ed3182ddee3c91ce20b67ac9a7123be569617b204d5
-
SSDEEP
3072:jEGh0oBl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG3lEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_e3e4959489cb3a62c8e40c9a0d40a97b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_e3e4959489cb3a62c8e40c9a0d40a97b_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12E699A6-9263-444c-A354-B5D2B2119D6D}.exeC:\Windows\{12E699A6-9263-444c-A354-B5D2B2119D6D}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFA95D80-30FD-410e-9305-C4AB8CFB9F8E}.exeC:\Windows\{AFA95D80-30FD-410e-9305-C4AB8CFB9F8E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA1E20DA-EF0B-4832-B251-6B1D9A117D58}.exeC:\Windows\{FA1E20DA-EF0B-4832-B251-6B1D9A117D58}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB3AC9E3-4246-484c-9858-B8A658FA7BDD}.exeC:\Windows\{FB3AC9E3-4246-484c-9858-B8A658FA7BDD}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6164FC3A-D7AB-4e03-BA91-ACA13CDE8ACE}.exeC:\Windows\{6164FC3A-D7AB-4e03-BA91-ACA13CDE8ACE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F6B87D8-22EF-4d82-B263-7CE5899209E0}.exeC:\Windows\{6F6B87D8-22EF-4d82-B263-7CE5899209E0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4850B10E-24EE-4421-8C72-42CFB22895D9}.exeC:\Windows\{4850B10E-24EE-4421-8C72-42CFB22895D9}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F462136-A538-496d-8EED-6400E407423C}.exeC:\Windows\{0F462136-A538-496d-8EED-6400E407423C}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C05F1BF8-DB37-4051-854E-E0CCE9EF6944}.exeC:\Windows\{C05F1BF8-DB37-4051-854E-E0CCE9EF6944}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B341307-4978-4094-B53A-6C234B3EE853}.exeC:\Windows\{6B341307-4978-4094-B53A-6C234B3EE853}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3FDBB3A5-55D8-4dbd-B032-905E3C581E31}.exeC:\Windows\{3FDBB3A5-55D8-4dbd-B032-905E3C581E31}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AFB5F3FB-4C16-4982-8E25-63A0264593AA}.exeC:\Windows\{AFB5F3FB-4C16-4982-8E25-63A0264593AA}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3FDBB~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B341~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C05F1~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F462~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4850B~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F6B8~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6164F~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB3AC~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA1E2~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFA95~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12E69~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD558f28293d256674ac24c36e62c154e58
SHA1d4061f67e61d2b9ec862b72b5af293ccd28399d6
SHA2562212cad50f19013c364f70f06b6ea408bafdadfffe87b6946021f85058b7eb34
SHA5122a706c272696f13a5c7fe936a547f097df58cfe7b72050d86ac37b1a17d9a31ce063506434deaa18275ae341fb41095bce25a6e01f6d4c580b2c91b17926449f
-
Filesize
216KB
MD532a8fe79c4b075b040f33715bcca301d
SHA1a2679fcb2e7dd55d762535425f1fa3f1d38f713f
SHA256e415d27c6c9eb75c9d3fa25b76097bfcdf01fd9ec332d0f9086e49f429186bb5
SHA512b466c43d4dbaa0be35b95576d012af9ee80644b30a866b603387bf33b037644bc484bc558d814110de884eb87b087d6b8e5f568092aa9cfe930bd2df08a5d389
-
Filesize
216KB
MD5336d58fa24d2511a3bb0c64f459b6498
SHA195cb50bba9dcaeef0a628abf511a9e90cc10fda4
SHA2569defe22bf5f41c680a5c1febf10ec4eb2b3b5689b65fc017fadaa4f26c5cb890
SHA51247e1c63bb64ea8b1b37e9a454d68927f3fe0812d94517ae5b28030fdb20962710fa112dd1dafc2dd47be14b224b703e2decdb032ff3338b060bc49f790990ed3
-
Filesize
216KB
MD53f8d83b426adcf74acbb96af88d8f13f
SHA1d6f393a2a925955de18cdb8701b4552468788388
SHA2569329f202896f813d4bc16e24595dbdaf32bd6face58e31a40d43a8c0c4e1d785
SHA51222a94706b8d3faa5e77f178e6546ec4d40bdc2e80909efadfc3f5067da811e4151f41e1eee2fcaabe50e84429d8c28cdae841a44bf4d3730643e9e00080de8b7
-
Filesize
216KB
MD525ffa07513d247870563d0fc87ae21a0
SHA145562c524c26bd0cac8dfbabf02cd77410b918a3
SHA25624cd585233f2d07e6ece43b008d6fc02c20673eb6c7cc748d3f78dcf1c9c9224
SHA51286d6b1a43e2c8777b256876763691a42a4fddd33eea9f9b75349440c1048d94a2910c104e4b8040f18d8c3fa49ca1bd979adfbf7ba5b826c9ca20e470ad33cd3
-
Filesize
216KB
MD5e1f2d8d347ecf326c073f2aed3f108fc
SHA16af97c62908e01dc39efd156bd086cb3942918f5
SHA2562da008cac50d68062001eb7d2cb3b3bcba857d2ca6046b1af491348fdaaf2b9a
SHA512b5d7dce44ff9e89c3323403e6c0d29116a6cfd5dbdc44d18d2200010e41c19db15027f1d6e882470bddb7d50427d793b17df42a3187d696866fe2f19ce726466
-
Filesize
216KB
MD516b4a04331554c3acc76a5941490167a
SHA1f4628b018d81de5bb144f281756ce41549482100
SHA256efd7f9118e95471814033aaaadb6a8af0a9db14b4842dc5669df610c9bbc0045
SHA512870f32bab9bdb0e2c87e9e164449568873e53dcef13cf918eef98503bf3090e9ae2386d3b7d15454d3fe6d52b0c971e854505a64106d6c95f830243c05ed85e7
-
Filesize
216KB
MD507a926a97a3d8f4524c48e242962eb88
SHA18510d2df41c8da7103ed1457bcb57df0239acb24
SHA256ea78beeffa307e28e925df06eff4dfd5e9111ca4070dec53a27993fde15f0988
SHA512acbc8a9263102b442e2e696abab4d34100dba1331d25c40c49ac83151e39e91848f81c1a513a062c2fda35b677667e74db949e8b7b6e0e98f4fc0cec9e28e1e2
-
Filesize
216KB
MD59cb09e88d4d523cda77f5d595ce896c3
SHA148b42e4de73146f87d83511946361042a677d09a
SHA2565b12a90bce8659878a6150b9efd39e3d5960d742d9d94095bd86e42d54fd46f1
SHA51238e09a739cb739c7d7592b7e171acadb70c4dcb3b5c69d83ffa9453b29a02710f7e2a6de95b053d01f8d90439d5217690ebd16e7b5dce09bc6831bfb6145e16d
-
Filesize
216KB
MD54df3154aa6e28b6eedeb65c844367758
SHA12f04818e5a975aefe63f473a04e3d30582229fae
SHA256af6526e13693ef21300b8c7bfc75399e0fa8f001269d6c9bc5153125e50f2e3e
SHA512e1d200f9817efb97d99f9980353fac71e8e2ff7518d60a1acd2646d4b0fcd59a6810ad43a85ca317bcb62fc6f06ca20a3ced8a2703a3a2a214251a7464a8a0bc
-
Filesize
216KB
MD5c683280bd4f8f8b920d1afd978b9e0a1
SHA12ac61017b8d4058468393f2a92136dd30ac969d7
SHA2560168ac052ad261fa5d397d3bc5f7caa34acdc8bbbc5d34cfbedf0fd7acdb76ff
SHA5129d37711a5c2bbe6ba0dac7c62b046912bf5b45330de380d151204b968e29fe05cec33bfa67d162a5daaee39ea6c4b03e54f1d52b00fbb2519db3541ded5032c5
-
Filesize
216KB
MD5bb0f93a8798445845e93d87cf957e626
SHA1cfd8af233ead195b1b24f73bd4ce211a2ac827ad
SHA25631e6005aec9bc640be5630bcaafeca084e8668a8a3a9c4538e8f98149f5a74ad
SHA512331c699c5958f725609439583d196326250a9136477778f5dedcc65bac819adda72eaf960e62c88cf00b1f4c1da6dac13c9821c838b2ba61f3c928f612dec187