Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-04-2024 22:28
General
-
Target
2024-04-27_3828e76af810dc84052a5d4e7732ed6e_goldeneye.exe
-
Size
197KB
-
MD5
3828e76af810dc84052a5d4e7732ed6e
-
SHA1
45f2e7588f93d12770c74a09d69ba99864b0a8b7
-
SHA256
0ed038ddd9478e825662f32d8e4be7505ae4c574867bb4bcaf356333e692918e
-
SHA512
c00bd08c2e92b2e11a6f5a42246ac6b07ada9f368d9aff4c5405c2f3b6662e196defbc6b4ccc3e8462578e21ac397204ae9241b5548d1da92a933f6d6c0e43e2
-
SSDEEP
3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGylEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_3828e76af810dc84052a5d4e7732ed6e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_3828e76af810dc84052a5d4e7732ed6e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{419A0961-3F96-4851-ACCE-191C38E7A416}.exeC:\Windows\{419A0961-3F96-4851-ACCE-191C38E7A416}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A91B22BE-1A50-4c84-8B38-C40A7FF8CCEA}.exeC:\Windows\{A91B22BE-1A50-4c84-8B38-C40A7FF8CCEA}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8534BE4-F446-478b-B8E6-E79DE53EB72F}.exeC:\Windows\{B8534BE4-F446-478b-B8E6-E79DE53EB72F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7266922E-1C76-4249-9F33-3B9165AFC72E}.exeC:\Windows\{7266922E-1C76-4249-9F33-3B9165AFC72E}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE4AEB03-722C-4e1f-8393-4F75C41F8CA1}.exeC:\Windows\{EE4AEB03-722C-4e1f-8393-4F75C41F8CA1}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E1981CE-DDB2-4a2e-BA38-71C197DD4C13}.exeC:\Windows\{2E1981CE-DDB2-4a2e-BA38-71C197DD4C13}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C54B5CD-803C-4439-A2FB-74EFECAEF61D}.exeC:\Windows\{7C54B5CD-803C-4439-A2FB-74EFECAEF61D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7045F0BB-430C-4a19-9C85-8EDB411CF0A4}.exeC:\Windows\{7045F0BB-430C-4a19-9C85-8EDB411CF0A4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D042D631-6635-46f7-BCB8-41330F230B9E}.exeC:\Windows\{D042D631-6635-46f7-BCB8-41330F230B9E}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{97A8C61B-F283-473b-AFDC-5278F46BE382}.exeC:\Windows\{97A8C61B-F283-473b-AFDC-5278F46BE382}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{536E84B2-F878-4349-86F2-BC710ABBAB2C}.exeC:\Windows\{536E84B2-F878-4349-86F2-BC710ABBAB2C}.exe12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97A8C~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D042D~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7045F~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C54B~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E198~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE4AE~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72669~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8534~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A91B2~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{419A0~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD55bf3955d9ca13ba332c209ff90a39815
SHA1e75a7fa6758748ee1b2d28ffa0bc799bf26ea526
SHA256473e8c0b899befa0b0414a954c6ccb45902c990ee5acf54265f779438a427fb5
SHA51253fe92136c5dc4d1ab6704733022cfdd81f7c077fb071bf4d9e7f87926aa4ccc562d4dc19e469b31fa793794971143b551f8f1a103afa863d122c650615736d1
-
Filesize
197KB
MD55ed8253d1490a024db6db38d92783e38
SHA184c7f0ec1fa0733c98d3f3d02184ec6d37ba2eb3
SHA25647b7945ab90106d0eefa9434d81c6fb33bcb427081896bea3e9e4e61e4f44039
SHA5127c70d6d5779b98d7fff78956ebc91393ee21f89af8a406edb9c483e4d2984f6d1078a3c3069842cd61b418fdecd5520cea12ada321ed46a08ef6adf6bfcdff1e
-
Filesize
197KB
MD536c8fa090e5d18d4519688b89d862ffd
SHA1f288cb9354c7e716c8171b162c587d06f0165365
SHA256192b8970bfa2769bbef3ee3b3f4b7b7577765d868163b4285341ccab672254cb
SHA512edd62f6efe29b625c1b4b2f9e1342c8f7751e18c7e2cd87fabdf9809b13f24a37576e4edf35bbb2aa421b0054c2548fbc54e6735b069d2198a3d8d73d923cf9b
-
Filesize
197KB
MD56089e508c3ba63b8636c40af6f1369df
SHA10d1cb2e827a0344710cdd9ad642e7e4e871ce63c
SHA256042258df5b59f5f36f50dc94ce82555ff4e27aa762bbc8c3ced6bd22036fcfa9
SHA51233b98e02644c97148146bc1676aaf4b09c769296122466d281a6c32688a0ff756bcaa4fd450a60bfae9ff71b749d593ac307d740521dfde5d623a66e415a951e
-
Filesize
197KB
MD5f982ccac78452de7c1d48b2d2b58f8b2
SHA1b08f3a76622ffb6a9daa1af8de1ce38fe003c4cd
SHA256b0406b2395487e1e63930d8466fae1e360c2b7369ec51f65d888889dfb1ed466
SHA512a3b8584bd6342f4214cf60590fc106dbd277f39ee60d42b9a71760f497688f82d794fc76a047c69981fa231b4a75cf0194990461e848dade0c3f31bdda4ca708
-
Filesize
197KB
MD5bb496af17cc2f81342618dfd18662424
SHA171e1002131f51982ea41bc8955ee0389c29b09cf
SHA256dd26c2e2348cef3f916885e1e718b56655f1402e78faaaf1629a5bd9fa0279ed
SHA512b66f9973fabb8445b92a5e1fbdb885a1b2400f353023428ef45ba090b585b4de4d22ff184ef9d83c535a10ddd56dae5cfce22ef7c8ecece4e7dcb73ea95c4006
-
Filesize
197KB
MD5a70568cad76e7cd57c74868dde9b1a83
SHA1c5f9a9f761d4e748edb5e154476064633dc43cfe
SHA256fd94e876fa2310c6e601d3f2d56dc90c270d4d471d434ea3aec10a89e5b26f70
SHA512bd9a8f2efe977e61cd0b107990904d731d46933359898edfd5c2bec9f8866e66c93a0f7b4a1a6d112c0d575ed7641d4a82b4e55ab15e81cd30d79271a8086f1f
-
Filesize
197KB
MD5338f700193cf3d43e66db678090eeb63
SHA1f2f216c7ad72200eed565b0913fd9b9bf3720ed6
SHA256b94139a6a6882233c28cbf204649272bb348a747f420dd5f89a608fd1b803105
SHA5121e5e31475e6608f1538c3fcece69e9192718ddc00f5e0dc764735c1ed303baa7c0640313a15c6826c8bc155a5f2bd620cdbf26bf6d6b2e98f70c8edc6a9cc9c7
-
Filesize
197KB
MD5be2b56038556902da353352ed43a4276
SHA1d1c4e6977b549ac14c99659bd6cb123c417a9b9e
SHA256f031151cf4ae821a670dccce7ee931ef490177dfc3cc2782487e2eb1d6ddd062
SHA512ca758d4e23227673136fdbed21443dc6b42a9570eff2b0a5261eeb8413a239bfee75154b83447659ce2565e846ffda8a650bc7b08ed5bf06bb260c9353a16000
-
Filesize
197KB
MD5452090aeb93cd9fb020b0b93939fc9c8
SHA1b390164c78d27f3f24f849e81b58471894b5b00e
SHA25673d12390de1dcec04c091326e05ff10cd4f9767307f2ff9418e25cd4468ba35e
SHA5121377c76c0213d96ef9e0adcfb0ca759e4c33e27b1f18272a10aa612563c695c569a137587dee107bca4a3f079593407c7eb56a1d140131928a3cc560da6b5cfd
-
Filesize
197KB
MD5ca934aa1dca212522ad79cf92b354684
SHA1aa5994c2fe6089789ce5fe80f438713bd6e7e3e0
SHA2562ca99ecc6a8c551fb75f6b235512b343ae5dde0e1f4dd896953a8be300ccb520
SHA5121c638a48331c4833c5a809f10939a9ef4bc316641b4ea3c9ea0d05f64748039dba567550ed51b1cdc0ec5fc0ab5c9a7095a8eb8974b7396e28633739c7293df7