Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
27-04-2024 22:39
General
-
Target
2024-04-27_aa399fda7d6d1372a3e9ec581cd54229_goldeneye.exe
-
Size
408KB
-
MD5
aa399fda7d6d1372a3e9ec581cd54229
-
SHA1
3d765d7c6f2dff137fb70880eb93e03f55c0fdb8
-
SHA256
d6ba1e53c4e1bfd19a20b204acaaf38b1feaa68ebad0d61e5899dc9e7734c0b4
-
SHA512
b8f09ed062be054135e9b23b4d8828fb1567df0c7b64d3b231dd4c177a7cb085c9fcaad19ecd1988db06d0472b4782fa8173336da079d225881d9af7a83a1f24
-
SSDEEP
3072:CEGh0orl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGhldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_aa399fda7d6d1372a3e9ec581cd54229_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_aa399fda7d6d1372a3e9ec581cd54229_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99A5E0F4-250E-4582-A7CF-AFDDCA4B9040}.exeC:\Windows\{99A5E0F4-250E-4582-A7CF-AFDDCA4B9040}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B10D3EDB-EE7B-422b-BB2A-0E60CDC18178}.exeC:\Windows\{B10D3EDB-EE7B-422b-BB2A-0E60CDC18178}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0E1A40E-C5F6-41a1-825E-3F0E87C18FFD}.exeC:\Windows\{D0E1A40E-C5F6-41a1-825E-3F0E87C18FFD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58DB831E-09CA-4522-8E01-453F542DF3C3}.exeC:\Windows\{58DB831E-09CA-4522-8E01-453F542DF3C3}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B54391F-5E39-48e9-9E17-97AE6ABA170B}.exeC:\Windows\{4B54391F-5E39-48e9-9E17-97AE6ABA170B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C73C478-AD58-4787-A17A-7B5A4C56F323}.exeC:\Windows\{7C73C478-AD58-4787-A17A-7B5A4C56F323}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EADD3F4-118E-4d4e-9CCE-0F8E42BBFF4C}.exeC:\Windows\{7EADD3F4-118E-4d4e-9CCE-0F8E42BBFF4C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAD6B4D0-0B17-4683-B7E4-0033C6021BE0}.exeC:\Windows\{CAD6B4D0-0B17-4683-B7E4-0033C6021BE0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{BA812423-1E2A-4ea3-B35B-AFB332FBF34D}.exeC:\Windows\{BA812423-1E2A-4ea3-B35B-AFB332FBF34D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{18B1BB36-8E63-4c98-ABA9-09985782911C}.exeC:\Windows\{18B1BB36-8E63-4c98-ABA9-09985782911C}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3A3205D2-51E8-4ebf-9535-5C8687D9E9C1}.exeC:\Windows\{3A3205D2-51E8-4ebf-9535-5C8687D9E9C1}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18B1B~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA812~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAD6B~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EADD~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C73C~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B543~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58DB8~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0E1A~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B10D3~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99A5E~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5833bcd03f196a4d3f9b2be34fe16aa1f
SHA1c1b418f59ebc45a28eef5cd59644dfd51cd229d7
SHA256587e34ce7e5c395e86acd53d211d3248033b71601f0eb211345b63fb369d704b
SHA512c1ff0aefcf10fd4b8c72729cf5a9355a984a3368d489f07493e8bccb179d100086d849fc7be826eeb37f75edae1cb2accc671bc7faf02bfe796ffff603e94c7d
-
Filesize
408KB
MD5be8c920a993dddc29144cb56ecddc91a
SHA1046b7d3a9bccee44618e0742798dba6f397bc295
SHA256c6da086e4a72fe4e646ee2ef84297abefbde88ffcb7135fb10624af712377f74
SHA512e4a4a9f011462abae62103700364609b9a5e5a29060f2534747db719e744cc9ca3aa4039e66bbcecca5e1d3af342b04f44096f6f4e06c8e4f9f4f03077b02010
-
Filesize
408KB
MD5fc5092352f565094661450931aa013dc
SHA1d5283b5ee034b11691f1e5dd1b42ef5ed2e99340
SHA2562f7ae4a8314248e9f0d1b1791e8198b868d7d6608cb972712d257326e8fc90d5
SHA5125b0d366918b2a4b0572e3dbf6f2ed5260e862d1ae6d565e55d362096a7f62523f0f3c494b1b1d06a3dfa58853ba07c0ba75bdb07a5b421ee607ef9a8cb3a713d
-
Filesize
408KB
MD567ed862e36be43fbfc4b0b2051ccb67f
SHA16bacb3cacaa60d6cbd18dea4eb9dd9e51247cb47
SHA256d9613165f54d24998873af72a1f0fb3d213aa2d71abb76b0d78fafe7bdcbaf23
SHA5125e556316081b366a9f945c6882df2751f23af046bad4466c25c7b00a58b60c2fbd4eb459646c777fcac65edb5708d759433a28cae510193d594197cc094ec0ca
-
Filesize
408KB
MD55fa460a065148fd880ec3b807db6d4b8
SHA1d5deae54ce284a5c4a06f736918e5fb0c12a8f19
SHA256224213958582780cedf03a6338880a260aec362865c725e560fb13e4ffe3e72e
SHA51261d308618790b855774952642ad91908296ab12d970a5234262fc08215c7555e8deeb34f4903cabe0c1e789735cddd0e3f87959a270abafb1c605f9c69eaef85
-
Filesize
408KB
MD5c1f9a21667e8b18e649759d0ebde7ab7
SHA1a64da9a03517928b0993fca69432b8e5239a0190
SHA2567cfafc4fe3bfa7939831f9f31c70a5fd4b0db009d3226d4184288670cdf02abd
SHA512b6ddaa602b28cb94eab885082f1c772fe704252f69c96964e3f35971534aee7fb31ae7086702e05008780b2af7a536f9c368ecd468bf1105c8bcdc6f5438f771
-
Filesize
408KB
MD57954f5b317f8eec1acb3190ffa8ddcd9
SHA1f60216223a549e285d78e09b129517232b44174a
SHA256e2fc9cd9ae9bc92e573b2c76a8c1d89bee6b56dd80fe1acf1f56e19cc05e8efb
SHA512125026e04387521cd8bf0200fc55a25b88175788d23f9c90a733d6ff2b3b625b346477cf4b717c985ba5c78fba9d4bfd48d05db3183f926b029aba99f2fe14ac
-
Filesize
408KB
MD543e710aa8622dc9f8a75deb392e69bc8
SHA1a28188fa0fa846eb56a4b28da2e0d0a69adc5412
SHA2562ab9a3b71a69b8e714ce00ffdf7e0af1f54629222d0f72523a6c2e0bde76d29d
SHA51227a06ca61620512c2ba8ce687ab3e3e6d27315c1b0529d8add70acc113e1e8036c7c4130cd43826a945a1d7a36fd15b7f202f406c46c01b47ddc68159060a563
-
Filesize
408KB
MD5ae2c89aeb927bd44bbd8108a46292705
SHA10bf7f3318b4a4094b7326544b0889ec192a0ab5c
SHA2566d7d697ab82e6f4271fc66e94277c027398a78706395d554c935271efaa00700
SHA5125e0cd32d0dd5740e2a5bd5d773a782df150d7bab6d7c35ccedebbc4dd433a0593210f42a86dfbaa0546a1c7425570a52f58fe90e58f8df8e737e275ad6c6882f
-
Filesize
408KB
MD559ff054d9b6a1a9eff1a65493e1c93b6
SHA1d0065a18b373cc6253ff1c056b6e2717b5295812
SHA25697abe0156963d559da8016c31d544abaca5c1076f7ea2d4d0572b1f953be64f3
SHA512a1908d7cf61ccb18a3f431e23dd3fc70450b4a951b95acc6d461a8c706e1b44379b3a500002c7e37804e71c77d90f43bdd0b6c0f863ba4b35c5ae39aacf84a3f
-
Filesize
408KB
MD57dfc2e88152a916bbf09d3f0b6ec5272
SHA118f3f5b49baac421f218f76828ba27bb15846196
SHA256d7b731bc91703fe9429aae452fc8181da5688748d576f16cae0479f61be3ade2
SHA512cd4e3e57c66dd3eaa74f39cb537da26f6e117eea62a0d44d59c6f2072d2a72cdb682c07eab16a67e234b203df834a9aded4d828374ba3c03b08a7331b06e4fbf