Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05-05-2024 14:34
General
-
Target
2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe
-
Size
216KB
-
MD5
77c616e1c8e25a4c9234a851fabd7fb6
-
SHA1
ae77da10ad413d5a568e7410675b7ba9592a6e2e
-
SHA256
605e762fd6fd732bf7d34ea46f2d923748cc205f3574e4e518add14b8d75d7e6
-
SHA512
22c1e4872785982a70d539401ab057539a6be3f8054185c19dc85ef085583f60b48ab8e0a67d26990c7ad526295b9ec07f202fcea12be273cefcc7b2e76f1022
-
SSDEEP
3072:jEGh0osl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGWlEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-05_77c616e1c8e25a4c9234a851fabd7fb6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{688B62DA-B946-4335-AFED-C722FE877BBA}.exeC:\Windows\{688B62DA-B946-4335-AFED-C722FE877BBA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A566C8B8-3668-4f52-BDD9-BBE0A6B4BAB4}.exeC:\Windows\{A566C8B8-3668-4f52-BDD9-BBE0A6B4BAB4}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A511FADB-9BCB-4e6e-B957-7E86916DEB0C}.exeC:\Windows\{A511FADB-9BCB-4e6e-B957-7E86916DEB0C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09E686C4-5F2A-4022-B46F-3DAA210BA3EE}.exeC:\Windows\{09E686C4-5F2A-4022-B46F-3DAA210BA3EE}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F938211-C0D6-4efb-9235-1700CB154E8F}.exeC:\Windows\{5F938211-C0D6-4efb-9235-1700CB154E8F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B1B8284-8881-4d93-9F00-6D22BE2DA443}.exeC:\Windows\{0B1B8284-8881-4d93-9F00-6D22BE2DA443}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B72E0311-DBC5-431d-81EF-9D895B93F9B5}.exeC:\Windows\{B72E0311-DBC5-431d-81EF-9D895B93F9B5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D2FD5F80-D308-4dfa-B151-CDED30E56A01}.exeC:\Windows\{D2FD5F80-D308-4dfa-B151-CDED30E56A01}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCA8D1EE-78D2-4437-92BA-886057C3CA9B}.exeC:\Windows\{DCA8D1EE-78D2-4437-92BA-886057C3CA9B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63DF0694-A181-4055-82DE-5267DABDDEE6}.exeC:\Windows\{63DF0694-A181-4055-82DE-5267DABDDEE6}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CA46B4B-E38F-4c63-8C9A-AB360D6B4819}.exeC:\Windows\{9CA46B4B-E38F-4c63-8C9A-AB360D6B4819}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{CDB637FE-F0D6-4751-AB2D-071A3722CC06}.exeC:\Windows\{CDB637FE-F0D6-4751-AB2D-071A3722CC06}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CA46~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63DF0~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCA8D~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2FD5~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B72E0~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B1B8~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F938~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09E68~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A511F~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A566C~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{688B6~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5b47eb0114837193374683473424f8c25
SHA10aa5cf5456b24e99a13b7269c3b628ac95b13e38
SHA256598204b8ff9d178785d0fb20ff3cce42601a951930b3ebc0ebf05c07623ec350
SHA512f96e1062de40acea259d5878297451c638b7facf4c84333b359fe98bf6ee32600e4790b2e24144fb3f931a03c52a78dd04d4c3978b090e960bca70282f3aa5bf
-
Filesize
216KB
MD53d8ad5fb707a9f77b5867f35653c1d84
SHA151034cae6ddd36a1996943ec46fc752c00c29e36
SHA256e0646b614ac4febf17832ebf4b998ae7c41afabb888364ea8d338ca6d760dc00
SHA512974527d7d62a765bd8b3127264aee230bc76f56bdd4a43a26dcd70c99852fea18012da5433d37f2b611dd90248908997ab41091ce88d307db9bd55043c446a0c
-
Filesize
216KB
MD5d63fd0388198dab3837abe0fe22bbfc7
SHA1f89dffeb051b04704293b7e37e50dbf1325454ad
SHA2561c1e982d894b79f8a2ae2810e2f24717b627f6d5075b3e12e3d27a26c383d228
SHA5121f16ea33de6bdeb3bbeedb11718dca058ffad9cfd94e5973021157487d8af567c0f2c0fa079ac803e2320f5549984f008ad115683917bb93afcef96a2aec2820
-
Filesize
216KB
MD57e77cb9eca1899fe81a0b3a6f7afe979
SHA1b633d6a5fcc6e6dabcf44919cef9d26c759ac9f2
SHA2561c55d8ccd817c45c2dd85351863d34addff7792082d81746c84c47625086b936
SHA512fa61d6649a87a076025e83dd656c5aacc3dd2d06c4cf99dd63949cf9f9302909773dadd213760f970f1c129930b905d4a065376b3a2983a9bb8c0f9bedabbb83
-
Filesize
216KB
MD5d1b618cf7d62bf42f55953b5732019d4
SHA1870f1db46083167c062350ee91cb0abee9791a7f
SHA256b3bfb54f6ef09c833c2c04447f4bac02527245d0452110c3a840a2d8b97f7302
SHA5122280f79a8fecebb54446b7ece3122f0201850f68e9c5573645d637f39836716a6932075cde2456d8f92943e73694062c90f44ba2275d19b8b79c402276df8840
-
Filesize
216KB
MD5f13d415a7a49f6e4cb84020e4a4869c6
SHA1ad2be98c6971951723e21ca207964ce82a140e40
SHA25653f4179c656efe3adeafe1282387e624d4b54aec095155eb2a646d8fb5097a04
SHA512598950a9d2aaa6adf061dc6756b03c8db9ab026df8893a73d87a9e1fff567564706046dfc56f2975f58bcceb06e8a73b13825ae35da75f2a80e50cbefd8d98c9
-
Filesize
216KB
MD550e9f5b5b7fa20752d7d8d5b1ec82b70
SHA1c2fbdc9110b832f9fe95ae72c636a25270549579
SHA2567b6ee733a6b5c3685506826d11cfc65923c06efa81f59cb415f4793a6002bf76
SHA512362d4816dd9f2c13ef48be00db2dba46c6608072934c9d804aada4e9c01ec0463809c0b31fcc949d1d1b26873a69535a3c98260cf9bee538b98fbafcb90bf311
-
Filesize
216KB
MD5689785c0c6cae4448545c214d7d7c6d4
SHA18ca84a3d78a32b78d869756a54ff7ebcb0b29d47
SHA256876bfab5c34d12ccab9247aeefb19898697b45eb7918a8a1a0ffaceb1f778dea
SHA5121d778ba2dbdcbbc1285064e4a134bdadfc4d77cdfb266c64eaca1ad3218cf5df49473031a8c50a7b001d7164d84332c7eb7a1292425f596bb891f111e37fc8f1
-
Filesize
216KB
MD5b09f3b8d3cbf0fc999521e2eb6f8f9b1
SHA18ddeccf87358e125bcf2de491e24d002abdd510a
SHA256bfc12b415501ec6573e29a8e985b8470273e48ed308c25d51f64da8876b43ea3
SHA5126db1bdfe72b7511fb2fe5243557becf902ff17a5e1835e7bb6cb7b78e7e8d5df44de4d6a67ee1ad1ee4cf0c65ecb6c44e5d62422368715305118266c3abfa08d
-
Filesize
216KB
MD5dc00338caf1f4f2d0f7bf972bd11240d
SHA1bc7325bb69f06b084d12d61380c5d3bef063faac
SHA256375488645866eb4d3011955b4ea7320b71947511a1e908089de823567b2847f0
SHA51291f23bec8a887a1b104657390cc960316e3733b3fd9b106af735cdeacb8ce37a4776d29d1a5ff664c3f911f19f6c367ffa9ffb442b396402b3697c6a8d006bd0
-
Filesize
216KB
MD568e9042d09b5c73e7151d483da92de30
SHA13c6afc70332616685969ca971a06fff463cd6b61
SHA256d92d72e5bef3c309fbe22c7835869e919f7ab4b2f946e26882ed45d029ab3729
SHA512088d09008952016b7b11d745beef28399da565f9c6ab76fa702a14386d65091bb6ff5d54d935fe140eca50204c29f073ea6000086c10f70c0ef9b5f1d9b7abe0
-
Filesize
216KB
MD55626f20bb402d3b4c4cfb7293d90282e
SHA1503ef24ea928cab36dc1822c65f248262c08b027
SHA2568d4c0cdd7b762d842fc9bfe33c680fa18622dc92e2700dcac36b9eddfd5e5a94
SHA5120861bd902cd3c7ddce7af9cfd7b5659795f03360e6b6f92eb331accc9072f7c181b83f4f604e47d94eb6afd0fab17921dd98de63b3d4218bf115fe27b1bc2eb3