Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-04-2024 22:37
General
-
Target
2024-04-27_9def2537d5484c36bb131b6f00691b69_goldeneye.exe
-
Size
180KB
-
MD5
9def2537d5484c36bb131b6f00691b69
-
SHA1
4cee1ebcfb15b0e63d43cb24bdd559b967a0f48e
-
SHA256
10a9cb999ba12834fc841acd3948abb2dbfc6a546a9432c8b1b4baeb256958e3
-
SHA512
f2a68138d56c318e564c88ed53f3552c3cddfb8b0188e2eb360b5770d4997d3555993eaa801b454e003aedf9d22701f29dfe48c240321ff9aad3b6c30ec4c5d3
-
SSDEEP
3072:jEGh0oXlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGBl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_9def2537d5484c36bb131b6f00691b69_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_9def2537d5484c36bb131b6f00691b69_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{486F4F7D-4C13-4351-B661-543607A2F98C}.exeC:\Windows\{486F4F7D-4C13-4351-B661-543607A2F98C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE6C982E-DFEE-42fc-977A-187C5A7506CB}.exeC:\Windows\{AE6C982E-DFEE-42fc-977A-187C5A7506CB}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA24E63E-611C-463f-B4C8-AA8E6A7386F3}.exeC:\Windows\{CA24E63E-611C-463f-B4C8-AA8E6A7386F3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24056AC1-AAB8-4cd0-9D45-63477F2380CD}.exeC:\Windows\{24056AC1-AAB8-4cd0-9D45-63477F2380CD}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D19A655-FC91-4ff9-96E9-DC44519E4F29}.exeC:\Windows\{7D19A655-FC91-4ff9-96E9-DC44519E4F29}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79C8FBE2-F8F8-45b1-98EA-89C75D07A955}.exeC:\Windows\{79C8FBE2-F8F8-45b1-98EA-89C75D07A955}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC2B82B7-76B3-40fb-8C7C-9EB576EEA708}.exeC:\Windows\{EC2B82B7-76B3-40fb-8C7C-9EB576EEA708}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EBA17853-3CDC-43ee-8E14-35638CC8BC30}.exeC:\Windows\{EBA17853-3CDC-43ee-8E14-35638CC8BC30}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{7B3EED53-28D2-4924-9635-A800F77505A5}.exeC:\Windows\{7B3EED53-28D2-4924-9635-A800F77505A5}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8716C771-6EA7-4aae-89BB-899FD56E9F00}.exeC:\Windows\{8716C771-6EA7-4aae-89BB-899FD56E9F00}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{78FC61FF-4A8A-4f5c-9BB9-C8F129A97B1C}.exeC:\Windows\{78FC61FF-4A8A-4f5c-9BB9-C8F129A97B1C}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8716C~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B3EE~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EBA17~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC2B8~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79C8F~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D19A~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24056~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA24E~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE6C9~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{486F4~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5dd7c631bf68509672dda32cb698c1a94
SHA11089a341bde21ab1391b55d2ccc2e286263cb77b
SHA256617f421d0f4f2e4f0136c0ae62930dd381fdb9aae09a6eec8e69edd4293cb600
SHA51206c0242cd3cf5a87a05a3f8fd5818ed0404b830efbdbb81299057f0ab6cb3149d8c35f286ba2f31d9842d64990cdac3e34c7324c4efe6a5ad697f87aea1c2006
-
Filesize
180KB
MD544ebaa6cb10338138481e125ad2119a4
SHA17e6358b9938a1fad4be9c2ecda499c9e760f2daa
SHA256f19adbc8100c913e708bb7d72b9277e4caae00a5fb37b566ec5117da1d67e420
SHA51211c9a26e0205a42a5158b7711c85132658d470e91dc1064d9f3f92439d0435eb284d8b8cf27847d78f40a9e2f8e533e8836bd2aebf3d18bfb1e6879c3a2e6e9d
-
Filesize
180KB
MD51cf969e200fe1ec4717f1739a2bb17ea
SHA1853562fbd2518d2d94f0810fcf68ef47ed4d6baa
SHA256358c566745378fd632bfa1554971bf34bcf3f5a2c333a6be659a823b9f478412
SHA51288068f79fa9398dddab32b664a879fb9441f44ddcdcb5750eafaef18319dc65ed85531b769444785a27a4ed9308a301bc9dad19e90553fb78d8f6cde8c6acce3
-
Filesize
180KB
MD577216fa044b023a5407d8fe6c1c3e8f2
SHA1980af4fd8e5067f0e413feb42d59433bec088e9f
SHA25646361a4350db2de26ce4f9f2d1c8460c4d9cb33fe6b28ccd9f684ba06c5ea3fa
SHA512b06449f8cfb8d5465a44fb073f15134e78f6969087ea7ab965491a8a5ed391e63f4484285ca676b60541a20503df7e910a5dac47b53a8c95fc91d97f6d5241c5
-
Filesize
180KB
MD5bc3eec4be46c0b3e9446cc3d008e42ab
SHA1e6c4988f03078793f74c4e816ae4e26597e0fd7c
SHA2560fcdb8ebdf6a1ba08e269b2619ff0070613f28f158a9afe0d7fa9272c43f0563
SHA51226fdc099fe726fbf6aa526ee41fc2c71fb61f1d45f1f3d1e2c0d6e740826ad2e29e90f917cdfeb787a6ab73878e369743b324d55a3f431afadbf708150463402
-
Filesize
180KB
MD51c90d94c5458d40435c051555505c10e
SHA1f928f03d557177c1b4cef3688ee2ef20d4aeb3cb
SHA256d7a5c895f123e27c54903ac5262494a0f6059dad1a11bd7467f439ec67b1ac25
SHA51253642dd65487d7cd737cb2ae894cc19f53e2873a2c7318d51b4277a88b3d23ab504a6dc1ac07e1622ff3015c0536444ca1916545f093608d40ed5f5c56a3caac
-
Filesize
180KB
MD50441ef2723a20afc82537192377de599
SHA125888f71ff53d665a6ad27c75000ff6e35fd6825
SHA256dac6ec82ea23892225f9ea050eff65a89e790fddf516edbdedb4f94a8b0ee125
SHA51252fe54f04cd4e02cd4a4f05f46143cf7449bacc7ca078b72dd4ccfedfcb1da375bc50dfc14fa15c22c9a90471419520b0b7172c8f5ca51d9798c9fc398c4a074
-
Filesize
180KB
MD57cf4a9b7a31a46bf2e07c48862e409cc
SHA11aa5a95fc6f187149b2a8547452e8bdfd72defae
SHA256e9b973cb6e7810338c9e56c59982ce8d0c3fb7814948e92fba07a90d6372177f
SHA5122307f5a8f1a7f325e4b28b5d8a3e5272afeccb924fc7c61867e8882b6b9cc8006af3548c54bca0d49edd430baeeb32798fbb0bf85d449b0fe8daafb885f87544
-
Filesize
180KB
MD5ac00ef361b2d2e7b8422ca72e8e6c514
SHA13114748df855a4fd4763685ac88a3ad8188b4078
SHA256fd0b7769eadeb385b6be065bd2117c56d564c02d838ca37624f3832f92eddd3b
SHA5123065e2ff452ca02ac6014291dde22d79649cb96310ad2af35e4673336c48f70f0d6e4b4062e47a0f393751ff88371e7ec35868cc7b6991da9910d29d41b49b2a
-
Filesize
180KB
MD5b6489f27cf4ea067442d31f615c0f4e9
SHA14048bb4a9d2ebe986d3bd98e418c2ca54797e65c
SHA2560cc5aec2b074692767f135db83aab576acee85e299ab10269b30e44ac80f7472
SHA512bb2193510bc340f5cde673b321930ce67aa538c585597aa22c8a202a88571d6e00876c3f71d4bcee4b11245a644a786e91bc04b6dfc33ad0fabb11489a1dddb5
-
Filesize
180KB
MD5da682e9fbb7c4d166459a8c4030f8aa5
SHA11d546cf27b7dcbeb9cacc17e0d3067437e7cbce4
SHA256a35d63d32781ad16e04df3a3c9d941362ed3ba0663cbf5e701a55f28e1e4c3b8
SHA512a42bf56d81f848dfa1db2ddbe99b6d448c9176abc5b341aadab0c01e205be1b716ded330d2bc835fbf31e1a5e39e1d182a5bfed48d93bb798e5374987c1fa268