Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16/04/2024, 04:43
General
-
Target
2024-04-16_5245f1929d0dd081a4186160b9482bdc_goldeneye.exe
-
Size
380KB
-
MD5
5245f1929d0dd081a4186160b9482bdc
-
SHA1
8b8d4b1b6530533aa984612fcb6b650e5ec092ee
-
SHA256
ee5219178226dd1c21654374a5ac7b5ff17bb217f1770c33b79341870bbed897
-
SHA512
05208bfe150b198ac7d36766106f23a7c32ca5b2c2bdb1bb03a6e79f27f4bd8484dd8483ce6580e416322a7a07c3367cc5368c9e0dcbf84684d078ccca142486
-
SSDEEP
3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGQl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_5245f1929d0dd081a4186160b9482bdc_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_5245f1929d0dd081a4186160b9482bdc_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A9E8FFD-B6F8-435c-9369-0E489874BDE8}.exeC:\Windows\{2A9E8FFD-B6F8-435c-9369-0E489874BDE8}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE491542-05BA-42bd-B0F7-2A65926B621D}.exeC:\Windows\{BE491542-05BA-42bd-B0F7-2A65926B621D}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88BFFEDF-682F-4118-85BD-8BF0561D1128}.exeC:\Windows\{88BFFEDF-682F-4118-85BD-8BF0561D1128}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A55A445-885E-454f-94FA-09E70DF3FF59}.exeC:\Windows\{9A55A445-885E-454f-94FA-09E70DF3FF59}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{990C730F-ADB0-42c6-923B-AD13C32A443E}.exeC:\Windows\{990C730F-ADB0-42c6-923B-AD13C32A443E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C707E72-A484-4f9a-B1E3-E8EE2A580587}.exeC:\Windows\{9C707E72-A484-4f9a-B1E3-E8EE2A580587}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E91DFFF-4AB3-4fb0-AF4E-052E285AA923}.exeC:\Windows\{3E91DFFF-4AB3-4fb0-AF4E-052E285AA923}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C94E209-7496-469f-9151-0AFDA56A9B3B}.exeC:\Windows\{4C94E209-7496-469f-9151-0AFDA56A9B3B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{035FDBA1-F77A-4f98-A268-3E4DE2907EBD}.exeC:\Windows\{035FDBA1-F77A-4f98-A268-3E4DE2907EBD}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AD52A90-38B1-4a40-80B3-80D3AA9C6F47}.exeC:\Windows\{9AD52A90-38B1-4a40-80B3-80D3AA9C6F47}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A5F8AEF-0694-4237-8152-1D16742B8F4D}.exeC:\Windows\{4A5F8AEF-0694-4237-8152-1D16742B8F4D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C2381C99-A743-4072-B2A8-BF8355C13992}.exeC:\Windows\{C2381C99-A743-4072-B2A8-BF8355C13992}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A5F8~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AD52~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{035FD~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C94E~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E91D~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C707~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{990C7~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A55A~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88BFF~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE491~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A9E8~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5cd229d8d9ae8737a65251df13cca81a9
SHA19810f3f50d16cd053c5238c8baa28981fbcdf455
SHA256c231f7efd8ba00c14ad134e164023aa83c03d4202c14cecc71445ec37754715c
SHA5121be54f00c8c97761857a1c0e7aa4c8a6950e59336cb15eded5a44c64255a486d9418f70f8a96be9a5aee3047d4060cddb2699abbad1be9c16a85d8d546e5aab7
-
Filesize
380KB
MD5aed9db784212732914e3d8212e9db162
SHA19739ea8463e73139adec41440c0bda31a0506ac1
SHA256c8b91a5f8b3edd5e503fe8f4d38e772a06b9e469a6bd8db4a3ae5c7bc685a297
SHA512f3d94c0a8385fe09770dbf348f4f0501ab48780f79f248f7a139d99dd0c4107c978b0e30bf850186deb81d8b82125f1eb7b4a5a7d83728626efd2e8db24afac7
-
Filesize
380KB
MD552168987d20f1b58ecea1823fbc64a93
SHA15154c3ee4b82c40775569ab1b975a260a6db8f27
SHA256c1bb310af7b466b24b5a8f86d415ef33ad90f364227d818d84aa37ae1171739c
SHA51208a077bd9348faedc3beb6ff8297f58ec84821c3e30902213540bede9df55b9bfdef06ffb90acbd4a25d064b98395c9abff6e7a7db716f37a523349b62d986e9
-
Filesize
380KB
MD5a2ada33711c247a237c0de212ba8667d
SHA18ade972244072838c58488d0dba816f7ccdf7086
SHA2568ae7b535a5a7b01f02723b80934a43f67ba46acad2d3b2a8fce689118017a470
SHA5122c7728908f1efd0bfd03f6ddb2e55c4b39b9f72c9221a4aab25a2f309fcadaa08f35a3e31682eeadfadb58e59650037c1048693c05841cfdde22bb556cdd394f
-
Filesize
380KB
MD5a4ee4ca20b7f7b4e33534aedabbcbaf6
SHA1d7123aa1f4e2f356853c9990d88824c156ba47f3
SHA2569404d3e7431fac728c96aa144e2a364ba4cd0a952e7796a4ada3ceff7953af3c
SHA5124c98c4d8e57e993d56a3c434da54d0d4b83b23a13b4dcc70d394fd24c912ce0c11090f5feae4891a18c5919b6357a5b4a45c6ed1f0050ab1dc19c51a0620e9a3
-
Filesize
380KB
MD5fcc38bbe5f08ce543e086ba931bf4c16
SHA1e3835e4275b2846ae86d72de8025026a01942062
SHA25691d8c020fa066be472da29d7093c429dea6f0fe71f37e4dc13f900dde924b4f1
SHA512789e8864aa334c6ed390031183432eaf97d425129751ba5b3f622d60e8a6b8d2ee2bb3671fa2441cffddd3bb4412f056d02d36e441220667b659e9cc979351ed
-
Filesize
380KB
MD530933cff558342e1006d11d8a6d64fcb
SHA1d3cd6a8029ba05dabd6881a0040abaaf9b3282ce
SHA2562d05e9565426d6719c2a810e4ade4bb2cc8ba1de198aab8c06be210f85b1b46a
SHA5125a2150d620b9332d678828e3e04ba083980e61a3d3b8b2a2a0cc01c23c9bce96295baa0bb0ebdf692a80f9d34417ad44b623201a2f724fdd96604679bdf85f36
-
Filesize
380KB
MD58947fd2348b32c8b78c74b7ea8635c36
SHA19b2e58022ecb87120dc6261f1599ff89d7b0ef15
SHA256f895a8b895e500c12cd7b33d003ffa5cd3493f2a321e21091cd112799dd15282
SHA51202288fb38f22b03ccd09ad74c100c3e39b81871575ffc4529ae95e34b83fa97d4825512849ccf7e82db88b5dafba9df369ff0b82df2bf07c4b10a90804a5588a
-
Filesize
380KB
MD5ce650984d73d2160aa8f1dea33acb98e
SHA1f28fc8182f2d8bc81b67443513949d92dd99b156
SHA256d6a4c6c46113e710ee5ef97541d505348922565712763a7cfcb7e3c09d0ce152
SHA512fa1893715dd9bd6ea59034af2a21b449685f53fbd500661b9c445bc7e184d1eb2bf2ee68c345e01c29694158cb8088d22e206db0eafadb61f5dbdd37d60e7f44
-
Filesize
380KB
MD567d2162ae4aa63719144c2106c6717bb
SHA1c10adf220b5adb0845d8c0688e41b9958d67dc4b
SHA25602c8223bb42819bb79da99239c5840ea67aff8b6614b190e8926677714cf64ac
SHA512ec04439a5c2bec1994926b828e9e7e78a184b198246700d26d5c8b98026878bce2a66eb883273c6c9f50a8ac4f6bb48a36bb681274e0eab7b1f7cbdfcdbdb448
-
Filesize
380KB
MD59e2c5cba0d6566b6f62ed73047249cc7
SHA1b55e390cd0dd18f0dbb9cf8ee7400bbc4aed7611
SHA256cfd50a206d326d56a6db0675bab362d30696a130b99c36b3c503cc382b605a86
SHA512da01fa8e7a094012af519225685c2fa9a643848b9b04db256d32a9eeda22ba2db03c557a90a6aabf58126805a01b9ed73c8dcb412c838a12f3d8e7055520aeac
-
Filesize
380KB
MD54e1e03057795ff1a3f0b808cf6115283
SHA1a8ce0a04cc6ff6717ebfcd03604360a0c791a88b
SHA256c72c489cc24a7e0a210d152e001242f4a4d9d50f2288a7d0f617c96300d37cbb
SHA512f062e252b8a9caa16ee416a7306f55c856cf8bd7995473a024e6cee7eea16e15d444284eea82172d8b6d5af2ef33f68777e9826b1421c4786969dfd3ec21f377