Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-05-2024 16:45
General
-
Target
2024-05-21_a77d647f9b70ef02833d0306d10ba5fd_goldeneye.exe
-
Size
180KB
-
MD5
a77d647f9b70ef02833d0306d10ba5fd
-
SHA1
a85be9473ea65b2ceb6d8dda9e37c68b4094090a
-
SHA256
5dc31b140a627a8191a3883ed171b137693f76cd3544942480d9304f551087e1
-
SHA512
fc40e979ea70b8c93fdd49a31a30851c18e0e801602ecaa96b08133e3a53b8b841c63aaf2f779cb309d479a58a45f52bfb8bfff75b4732af1e7e1102274d0afa
-
SSDEEP
3072:jEGh0o0lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGGl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 10 IoCs
-
Modifies Installed Components in the registry 2 TTPs 20 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 10 IoCs
-
Drops file in Windows directory 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_a77d647f9b70ef02833d0306d10ba5fd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_a77d647f9b70ef02833d0306d10ba5fd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6ED77D9-4C6E-4f47-B3FB-7C17BCB18959}.exeC:\Windows\{D6ED77D9-4C6E-4f47-B3FB-7C17BCB18959}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDD9801F-C35E-4b2c-B93A-0F3C64412200}.exeC:\Windows\{EDD9801F-C35E-4b2c-B93A-0F3C64412200}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5909802-CC1C-4e1c-B7D7-6A198E7D9D50}.exeC:\Windows\{B5909802-CC1C-4e1c-B7D7-6A198E7D9D50}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C6AEE55-E48E-414c-B1B1-02571C1E2B81}.exeC:\Windows\{6C6AEE55-E48E-414c-B1B1-02571C1E2B81}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{893DA21C-68DA-4604-B27C-F88E0AEA2573}.exeC:\Windows\{893DA21C-68DA-4604-B27C-F88E0AEA2573}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2601779-1A51-48bf-A037-21174D6361A7}.exeC:\Windows\{C2601779-1A51-48bf-A037-21174D6361A7}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8BA85BE4-CD5B-447a-936D-19FD094D9BEF}.exeC:\Windows\{8BA85BE4-CD5B-447a-936D-19FD094D9BEF}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4A2989A-A18E-4775-880F-16761F0C1E17}.exeC:\Windows\{E4A2989A-A18E-4775-880F-16761F0C1E17}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{28BDDB5C-7599-41c6-B0BC-1B2B85F4A3A0}.exeC:\Windows\{28BDDB5C-7599-41c6-B0BC-1B2B85F4A3A0}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3A231EE0-5DA7-435f-BD84-CDB107B80981}.exeC:\Windows\{3A231EE0-5DA7-435f-BD84-CDB107B80981}.exe11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28BDD~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4A29~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8BA85~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2601~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{893DA~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C6AE~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5909~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDD98~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6ED7~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5826db8ab3afad1d3dd04edf1e61b4c41
SHA159e487ebe42ca9800a3eaefd6af529a5016a8495
SHA256e3b4a7edf0960cf1b1b2d773c918f2d9b2265d27451824c8d5b5d87c371e2863
SHA5122985da094fefc9a330b8192fc000b37c8ba0c4cb4a98b572ea3f6094bf40d41381fad3a80830e83455ffa058acdd7761f6cb3f69c51ce61ef7a76633d533a7e7
-
Filesize
180KB
MD53f37dff7ae4d508342fac89eed392b64
SHA102b719b4a1e43c88565834d73540f4dd4f7f19e9
SHA2568c29e09af575bebce6f1a495f70b13ae05c48dbc515e2dd252628d3001eec506
SHA51281fdcfb1797b46bc1801acf5176bbe750a70e7751a10071e8d2decd13a41d2eec70fddafc64221e140d13f03fc25f8a7904d35e6b2160f4ccc01d86c5d72730e
-
Filesize
180KB
MD5f8ba3cadc0cb2aca3f1ed612b023884c
SHA143474079326c0d5248ed5579fb82f1916bd64f5d
SHA256575c1071c59a216cb5914a3fc302dd9fb92a7c66d970e71f6e378ff1ef6e4919
SHA5128a67901e953a9ad2ec7ea618f9c4ac7346708e37e4bea94935b9743b29f8a9d59d8ce9af0fb270ac7705ccec1eb920a79fe5e332e043d4ec0e81c216acc10386
-
Filesize
180KB
MD507c32f9b159b460f624aa20cb09b8c8d
SHA12383962db866e367ee37a5ea7e69af9e84aaf606
SHA2562b0c3018ebd2c95a54c1d207685fe0b19781189140bc40daae69418bea3cc6a3
SHA512969ba7e990a5c78f7724522e776cae05e82bd7288a1ac9a190c304c458a7ae29da06d7fdc26d77ee41ae030a57812edb68de44edbd8959fb5eaa27faaac7f72f
-
Filesize
180KB
MD56254eaf4278381474ab73fe7bb0784e5
SHA12ee67d97f04ec060e3420253074aff7d14e2432d
SHA256474db67b23c7289cf89d60cb9c366b5bd87332bb7b68006c2a54d928e3884cd9
SHA512432dfce05d1c3692c76c9515972cdf4f0c01806b0f17d23cae61836e198c68d78cb6475c86bea61accd107fbef26ca1a4fb2a43e6581d7d2fb028d3951a48953
-
Filesize
180KB
MD53f6e8daf922e72880b0403f11da9217c
SHA1756a4f6a999f25517bda0936e85087426d3d7ec6
SHA2562e14282cd8d8432dce4e820fa7d1766d1d94c2283ec314a4c46b8ea7c42d22d2
SHA512998d5ea77ae27218ddf6ac9b372b665eb320fe18c077e6630ecb1fdb7d5830665866db2cc821bdae3f41df49e8e4234e6cf2f8acba67dfdd0f8f9e8e21dab9ed
-
Filesize
180KB
MD592225039b6f59e366d2518a6ac427651
SHA1287ebcb6c6d1db0f0ad308a44f76d0fb32dde2e9
SHA25652b18f691e71db4f024cff449f1531cdb3f2bc305df66d88a6bcf1e7446bb0bc
SHA512b4a97cd5de89219a30f98e41770f57bb5802a4f376abf7b9ee674884a2ff35ef09b34834dcffff4690be49fed297ad1122fde83c3bfd674c5d3b2ae28b526dbd
-
Filesize
180KB
MD526413b9e176c458bd5df5dd1b06f1130
SHA1ebda2e814a022e71209318312b139d65cf053223
SHA2566c1cea1a1a05aad650098a95a413e72bf3dae83584a62111cbd763b7640ff6da
SHA512872c11cf1b7f29276a1f7c4cb5b1338c040824dd94e62fbdc7a681a050b6fe4972609e3ac1aa78a844216f42ad5abcd64a7971996af3ab97a62d3a4484ad4e22
-
Filesize
180KB
MD52ac3e112d26fd09df8c0c6a22f832808
SHA16ea3c181b37064ae44a5c0e61fd78084202664f7
SHA2566af09b9787fe0e66c4975903f47aafc34162d47300225a4d1b88d295ff8f9f92
SHA5126e988283dba30cc783017c2537409953dea7c699fd146ed37e9d15830a6dbd1b4a4136677789cfa862fd913c94b8fe3c5d12a299815692a5cad03c5baaf13cf7
-
Filesize
180KB
MD58dc826b94b50a7699c697e1b11f87462
SHA129e2fba3f93499db4aab014bbfa6726c78019bb5
SHA25624c233aabaf65425b9a026ffd788f1c3034856eeda2368b04e7220cab47e6f63
SHA512bd8e1d8ea075266e17ca4930b53c28d04c290f0f44d4aaa6fc64a367579b8c83ae3beb140a9ac6413936de503a743bf8e60f2eb58f67f6022c2cd7fd0de91036