Analysis
-
max time kernel
149s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27-04-2024 22:28
General
-
Target
2024-04-27_3828e76af810dc84052a5d4e7732ed6e_goldeneye.exe
-
Size
197KB
-
MD5
3828e76af810dc84052a5d4e7732ed6e
-
SHA1
45f2e7588f93d12770c74a09d69ba99864b0a8b7
-
SHA256
0ed038ddd9478e825662f32d8e4be7505ae4c574867bb4bcaf356333e692918e
-
SHA512
c00bd08c2e92b2e11a6f5a42246ac6b07ada9f368d9aff4c5405c2f3b6662e196defbc6b4ccc3e8462578e21ac397204ae9241b5548d1da92a933f6d6c0e43e2
-
SSDEEP
3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGylEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_3828e76af810dc84052a5d4e7732ed6e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_3828e76af810dc84052a5d4e7732ed6e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A5FC5AB-7909-490d-9C7C-583B8668D6CB}.exeC:\Windows\{7A5FC5AB-7909-490d-9C7C-583B8668D6CB}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0638BE67-8D0F-4163-B3CA-B4E347D43E6E}.exeC:\Windows\{0638BE67-8D0F-4163-B3CA-B4E347D43E6E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{311C6C9F-9B40-46d8-87E0-92E503F59A75}.exeC:\Windows\{311C6C9F-9B40-46d8-87E0-92E503F59A75}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E4D3C6B-F863-42a1-9840-37497B22355A}.exeC:\Windows\{6E4D3C6B-F863-42a1-9840-37497B22355A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{081C1A21-A916-4fd1-A993-B4ECD8FFAF61}.exeC:\Windows\{081C1A21-A916-4fd1-A993-B4ECD8FFAF61}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAEE4BE7-E1B4-4818-A37E-1E538F00C60A}.exeC:\Windows\{DAEE4BE7-E1B4-4818-A37E-1E538F00C60A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95DFFAF8-F6CC-4125-AB95-A155A8186526}.exeC:\Windows\{95DFFAF8-F6CC-4125-AB95-A155A8186526}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C01842AD-0F2D-4f71-929D-67E63FD14D1F}.exeC:\Windows\{C01842AD-0F2D-4f71-929D-67E63FD14D1F}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74623187-E499-4dad-A106-DCEEC735CE80}.exeC:\Windows\{74623187-E499-4dad-A106-DCEEC735CE80}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{372E75EA-CF86-47b5-B3FF-E126020C1B69}.exeC:\Windows\{372E75EA-CF86-47b5-B3FF-E126020C1B69}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72BC861C-04BE-49c5-A708-6CC90CDAB91E}.exeC:\Windows\{72BC861C-04BE-49c5-A708-6CC90CDAB91E}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{654BFE2C-B1C3-4c30-8CCF-9A1D9384CF84}.exeC:\Windows\{654BFE2C-B1C3-4c30-8CCF-9A1D9384CF84}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72BC8~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{372E7~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74623~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0184~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95DFF~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAEE4~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{081C1~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E4D3~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{311C6~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0638B~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A5FC~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5446068bc73909597e2da6f670ede6734
SHA1596926aefd33f7f0c5e110f93f11dd8cae0b3dab
SHA256f1174a20453e8eb25dc1b6ea68f15ac600ab98d0d6448960b191164f08799bbe
SHA512e57116722c8aef13d9730a49064290c23a1cd80f06f857dc56fd72022ec486c9dddbc148d99eba356dc30aa1d307ba6c92ea62b94323e56238ea7ee0bce709cc
-
Filesize
197KB
MD5283f855b620ac48d610b18c1cfa1f150
SHA1629970dd6fedcc39a296fc0112cb88eb165634d5
SHA2566044219819b19bf7de695e25f7586e1f87466e30df5717ef7dac8c999fa2841e
SHA5120d105904a7b83f717059ef227bd01490087849942f513a7bf6d203aaf39b57cf619558e79167eaed104f979ec60370d9d6f16de4c103a9db262f5b4804a924c2
-
Filesize
197KB
MD5c8b9a153d0173219d92cb22f78292f1a
SHA158f28753e014e003b7be377434f56f735665d2c6
SHA2560457912d3d76611079222991feb9f40138fdc55ca5b5ecdb9396fabfec94c585
SHA512e561c70504d1f000c52f0e820d3e52f37edc9861f3c09d5c17d4428079c84153703980a8ef1d24c3f7cbce4645cee52f7b9fdecf4b944a680ac688e2e0bfb079
-
Filesize
197KB
MD51e1964865ce1ddaa004e0270e02eb4f1
SHA1ccaece0b5e6f75c556ac172ae1500bf7dba6fd7f
SHA256eed287e308d2fac21605a37f0e76a3ebd97410fe9e4c08090fde7c35da3ab0a9
SHA512df9886fa9927f15c5820470b23301bed228ae3b1e2ac508f86e6340fd481f07262cc4d8636d6f806a74313d83dc2e6116e3a279157e60742c39c55cc119ea69b
-
Filesize
197KB
MD599c208004289020065fe6c56719185a6
SHA18083b566254bf397987332432a2e3e590a1c4028
SHA2565bdec5d03d33ce8e67ae2d9a4b78b44bb2f7359d4e65c1f8878f5fb8d436c32e
SHA51289cc9dfd1dd34763359ae0cd0d2b048aaeb632ceb2b11303910f6520b39f402de5e28513aa7bd9125ed20a0206b209158ffa19dfc99892bcab9ce4e1ce8466c4
-
Filesize
197KB
MD5b21ebf318a79f4f29411252f13e474ab
SHA195eb22884a6a22af68c2663eaa1764933c69b9c5
SHA2568bf4aa6a0b9fb70b0e1480cd890a9ed642135446b0bb9aa6a48cdd28fdf9b62a
SHA5124d88847e21cb8ab24a5fc5707d17d818381c0a378be8d74165f4cb22a9b6120825e7dbf39f00d155f3fa4ef6356754e1b214077f7956c2087b4ae0c6cd911301
-
Filesize
197KB
MD5f872621c6672ab483271d184fc932b27
SHA115f7a81bd36c4c2c2db9a91e15310a6646e12071
SHA256cde3ee93f2f0f25133dce1d5a85928c4297ff8a9f73bfcfcd6381796b95a8ead
SHA51218bc8760bf960fdcb3da68d3ffad569e4c4294de08d042cb3452c227d334cd75a3088d3fbd677067e9f70d2c91a1de37738e208bfaa5dc74b6af9d19da228816
-
Filesize
197KB
MD50687124601cd22fb1572dfd8034781c0
SHA1fb5c5d3adc3b8131862ac6fcf4aa49c5f423e6b7
SHA25670e9cfb5d1bdf360fcda188d4e625e1c4eca76369418744e3482236abf67d4f3
SHA512466a426096ae83d7f7c8259d9953c0554501192f04d5104074c6228e2b70a9181bfd50876e18e00c2571fae41b10ab3ed0f871449e2f23bc415e3cff7cb52504
-
Filesize
197KB
MD5f3dc579d338e0a9a0b7b3b391fca552a
SHA10e1195d3eba7392b3c0c68a74de930d9d5fdd1eb
SHA256819371ee81b394f2de47d4abaf3a683fc805c22193405f8f7d119301c270d90e
SHA512b0f8ce18365d3eaff130b77231ef1acc172d41ba1de650dc2df74a803e4acd00d4cb12f4aa377217d171a38a479d9bb6b926913ee90a3021fdfd6b72f2f0b138
-
Filesize
197KB
MD5eba2de462a6eb24d48afc59f8968ae3e
SHA170ffcabcf9f127ea0cb16b1fedc5635cc5ab998a
SHA256466e56b9511d5bb13f8966ed0749373d32f49abd6e7c15bb021dff778ed90012
SHA5120dfef8f61a2939187f328136bf27fcbe9f8e44df0b432b90d9a1abbc47939a65f828ceee3414cd8a1c85f235d1a0ece0a93a783f58065e4157d14baae86f6683
-
Filesize
197KB
MD52412b0607a69783afce02a6b418fd3c3
SHA147aa37196c84c1daefafd0a90c9d2db3998efbd4
SHA2562267a5b4466f42d9bddc976a855b489727cfdb8bd00fe7eeff6e9ff92578de2f
SHA512640048d648435fd44f54e2b6c5c21cb4f941a642fb58ff1b13aa7cd176ac7cd5c11e7ee8502e53b686b89e97016d5523fae3ea6d480791375121f4bc9a4b2362
-
Filesize
197KB
MD5431a06030303bfa1b061bce581adf107
SHA1e9bd08db19aff67fad9b5a9d1f2cb20cd3a4a3a9
SHA2564029953f2bd69da6507a0a7db9f7447c02ddd57f768aac3ca2b172ae08a8700c
SHA51215dda7971cf71700b0bea83e6d2c76fd85ce862b3fe6d8784254bc916edad4774c5d7522f15e7874b633d7b9161a1d9437a1593fa02d572475d8d5a16d485cfc