Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 16:45
General
-
Target
2024-05-21_a77d647f9b70ef02833d0306d10ba5fd_goldeneye.exe
-
Size
180KB
-
MD5
a77d647f9b70ef02833d0306d10ba5fd
-
SHA1
a85be9473ea65b2ceb6d8dda9e37c68b4094090a
-
SHA256
5dc31b140a627a8191a3883ed171b137693f76cd3544942480d9304f551087e1
-
SHA512
fc40e979ea70b8c93fdd49a31a30851c18e0e801602ecaa96b08133e3a53b8b841c63aaf2f779cb309d479a58a45f52bfb8bfff75b4732af1e7e1102274d0afa
-
SSDEEP
3072:jEGh0o0lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGGl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_a77d647f9b70ef02833d0306d10ba5fd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_a77d647f9b70ef02833d0306d10ba5fd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD7539D0-D6E3-4e9f-B1BA-0470866F6354}.exeC:\Windows\{DD7539D0-D6E3-4e9f-B1BA-0470866F6354}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{551CA909-2122-4746-B1F9-9B521246186B}.exeC:\Windows\{551CA909-2122-4746-B1F9-9B521246186B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{926BD4EA-E8AF-413c-8F32-62584FD78C38}.exeC:\Windows\{926BD4EA-E8AF-413c-8F32-62584FD78C38}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA14AF02-E417-47f4-88B0-7B5D1AE8BCA5}.exeC:\Windows\{EA14AF02-E417-47f4-88B0-7B5D1AE8BCA5}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF81896F-DE1D-4cd8-B797-4109625D93E4}.exeC:\Windows\{FF81896F-DE1D-4cd8-B797-4109625D93E4}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA00BFA6-7443-4d9c-95BA-0705661E91B0}.exeC:\Windows\{DA00BFA6-7443-4d9c-95BA-0705661E91B0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BBF51FA-5218-4021-B23C-9347F9ADDB21}.exeC:\Windows\{4BBF51FA-5218-4021-B23C-9347F9ADDB21}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D93984A1-33BB-4539-B14C-E57506267775}.exeC:\Windows\{D93984A1-33BB-4539-B14C-E57506267775}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99A99194-950A-4b72-86A8-66981C4CBC0B}.exeC:\Windows\{99A99194-950A-4b72-86A8-66981C4CBC0B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C071CBF8-0B25-4ae8-A44D-F34B88042005}.exeC:\Windows\{C071CBF8-0B25-4ae8-A44D-F34B88042005}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F57A3DB3-1B27-4c8e-B6B4-EB3F767B28E9}.exeC:\Windows\{F57A3DB3-1B27-4c8e-B6B4-EB3F767B28E9}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4AD5D072-B9AD-4fe4-9C30-797FCE9DF2F5}.exeC:\Windows\{4AD5D072-B9AD-4fe4-9C30-797FCE9DF2F5}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F57A3~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C071C~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99A99~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9398~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BBF5~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA00B~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF818~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA14A~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{926BD~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{551CA~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD753~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5953305e6f0500a76020ca9db272ee4dc
SHA155f976e487123ce06b15606c89c2d978f7ffbeae
SHA256946b58bc873a07d07549e6d68e844b65de16efd7e5a5d371f66020283fd4fbe7
SHA512afbafd64d7c57ad61a05f1a270a9641da6fe64f0dd49eaa2f0f02f19fa9e9ce854a5b64d75ece44cef99429e9f618621e42b9913d201d0849f79102df7d58ef9
-
Filesize
180KB
MD5293933da71ac3da40bd7e1449aa8f289
SHA19b74c7d48328cc7b9dab2bce972c384ada0704e8
SHA256d4b762308d4cf3b5ac8f6459c8a4b6828db64249a16bd92c53a17751dce4da9b
SHA51283dd7945bd65f7b6851bc558c11252e66b973573893b2f4e7760edf40a3cdb702db5ccdb2d4ed561bd1f07eb28507db79f6c4e7e9ecfc54abf16668e24dce849
-
Filesize
180KB
MD59bd7e489f40f8977636b27899c49daca
SHA1c2bfb9f61c8076768d254c06a7fca56d619984f6
SHA256d481d0806922a9e1a2101080bc469c43a3262cda00ff4f1d5e9cb55dfe4ab2b6
SHA51224205535ce79ae1c25cb6b361a96c9c3ec0105f07bc52bcc94c022400cdf0b7ddff3ce07cf647c9bd34c0f2f07a6b271607b1a1ef26b1ce41aeab6877f232faf
-
Filesize
180KB
MD516a90594dca0c670701705741cfe8a34
SHA17ab30148b49a03b0b6fd06e4a35bccb3517bbbd9
SHA2563fd4c7a382035114c24fa2b07bf46d2e88c0ee3c8b83292efc5d7b6e5e1e493b
SHA51274fff5e632484e7abb32e6e6121bd548e5be068bcc4ddb9865ccf8bebf94e154c60b61069211f9676cb9f98e6757131ddd8ae5b4e3919388fddc5a7829c39d07
-
Filesize
180KB
MD56f441c5b4ccc8c4096e3f32432115721
SHA1b56d384ce2d9ea1e23fe0d76d2fa7e4ad313c5ca
SHA256b7e2cf5ee37fff221ad55c6b5af4ebcc975b2da170f6944a0a85d0e26c85b11a
SHA51282c452023fa0e6af761b5006b1b728a2cb1962cfdbef4d8efb84931deff14f4923b04f9c6054335372725c5b1f72c0c46e8b6428e46162d65fd259f46d7c4cfb
-
Filesize
180KB
MD573f7c998fac995f89eb0609225e3a003
SHA1ee6fcc500d0806fce4b12f0137ad902f32fe1699
SHA2563fc7b90ab5ab5a45e6563efc408a1a80240858d62749a70ac8249ff824b12946
SHA512d20aa3ae196750fac2b93d6a26cb003a6a3e2ca28080d4bd9d2a7037409822ef548eef5b8fc5928a76710cde8513ae2403a40e651b8625f5ce3afc6582ec7b4a
-
Filesize
180KB
MD5eb022bbae46875e8d00a18c2e547707a
SHA15723940626223ff8f2b26e26a59fd532e16648b7
SHA256a2902fd53d84736bf35c41c0a1e12a40a47bf916546332d2c56b391071c368dd
SHA512242da0b3510188012cc279c9af6a8ecd6f3e1ec46d686fe7c15687ab38ab65e4a01fae7906d0aa81b6197f562ac66042d8cbeb40941c1604feae5c9f6e42c7b1
-
Filesize
180KB
MD57cfe30030cf39ba6d42b74daa9bfe4a9
SHA130c11a5de06fb6cb63b98a3ca496ec7571031913
SHA256535c16b0c463b645d35e931f6c90683e3bc0a0ab1fc57c72984978ebdb4089cf
SHA5125738e15f2ba29181bd0aa041c0da9b2a977f21267da42d3f5955d9a55712cec00c437212d407a56fa32943c21666f5138226fd7ddcf9e23dede7ca6529d97857
-
Filesize
180KB
MD5d37a90656bdac702e8d8a102326f8116
SHA10618c4f26b822ae6bbe12e211ca91deccb43240d
SHA25641d3a1294e9061e25895a54c8ae27321b555d74fcae4abfbed5f45649a18b730
SHA512ea726496e1bb707baaa5ea5f5c27dcc1f2af9be4c5cb024d36f6308a44f17ca99dc62becd172075767e949c4f331ccad799743543e6bb01f5837ee680e82fe85
-
Filesize
180KB
MD53e8b4b85bf7a84730aef4d7da3b7a2f0
SHA1319435d979aff05cf21102651a22054f9b1355a3
SHA2560b6c4f237cbd4e3da3396cf627bc99462625b9d6d3d087618e5c75a6459b03f6
SHA512e90f859d0a9cf3d783af11e4aca6f4d88f5741c4b91fb05879666ff2d33ee3011a0ebea685846b14ce65e3888729d2ebe33ffeaa5ef2f8c4576d65e35eaa96a8
-
Filesize
180KB
MD58a061e2ed549cf6996b65b13fe94e676
SHA1388e1bffa27e157532bee391732efaa8598ac9fd
SHA256395a5067a416d6038d3d4c9b3d9247066594ae03b759b04d80bf4bd588d85193
SHA512927cd939456bd250acbffa6a133e8992e5db770cd49da492463d890e1a99df27c79189f781663d2ed243cdd8d78d5a0b45c7cee94102fc1221f55c3756a104fe
-
Filesize
180KB
MD5abeb56a995e405349479021fa4ddf0b0
SHA1ca6bb1f4d36b4f987d4bac1ca58fccf999703cf6
SHA256c7a669bde44b8148a597b00c5646d182b9ab88945156ba1d322ee552ff3a4cd2
SHA512b7455fb840042f641d8c6664bf4858da1c3ee61872f98eaf4dbe60ad5bcc02eeff4e0f853702bf6d922beabc9b1398ec5df771d2ba05520d3cbc6fe084fffbfe