Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
22-05-2024 21:33
General
-
Target
2024-05-22_3c54dfa7f5dbc7b2ab206d89106b8a07_goldeneye.exe
-
Size
344KB
-
MD5
3c54dfa7f5dbc7b2ab206d89106b8a07
-
SHA1
33e3d25d7efac7ccb29f47f0a1c91a68f6b6cd39
-
SHA256
eb8618b290072d1b82d72dde55fd6751058bb2743e5ade71ecb6e49064367501
-
SHA512
cd24be223e47d37c0a891ad623963543c1fe8c919f6112f877a1d42c68a3640520dc23ef944e9e9fd1f44af1e30c670dce50c8a35a9ef5472e87718d6acbfe6b
-
SSDEEP
3072:mEGh0oqlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGIlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_3c54dfa7f5dbc7b2ab206d89106b8a07_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3c54dfa7f5dbc7b2ab206d89106b8a07_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B006DF63-9CA2-46db-93B7-1B062557229A}.exeC:\Windows\{B006DF63-9CA2-46db-93B7-1B062557229A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{869FDBB6-1B3C-4f77-AEE9-286F0BA58A54}.exeC:\Windows\{869FDBB6-1B3C-4f77-AEE9-286F0BA58A54}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6E8B1C4-EF7F-4ce8-89EC-C87B17AEE589}.exeC:\Windows\{E6E8B1C4-EF7F-4ce8-89EC-C87B17AEE589}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B835D103-D97E-453f-B868-9B841418B729}.exeC:\Windows\{B835D103-D97E-453f-B868-9B841418B729}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{663B12EA-1424-40e7-89E3-93CCB2F5DA60}.exeC:\Windows\{663B12EA-1424-40e7-89E3-93CCB2F5DA60}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C89A6C5B-0A24-4360-A9EA-4B2CF531AEA1}.exeC:\Windows\{C89A6C5B-0A24-4360-A9EA-4B2CF531AEA1}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD5812B2-51C3-4a4a-9B14-DA9583BC4E91}.exeC:\Windows\{AD5812B2-51C3-4a4a-9B14-DA9583BC4E91}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1C6189A-A977-47d5-8483-0D98B22874F3}.exeC:\Windows\{D1C6189A-A977-47d5-8483-0D98B22874F3}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A0FB91DD-21D6-4562-A836-29EE60D1FD21}.exeC:\Windows\{A0FB91DD-21D6-4562-A836-29EE60D1FD21}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C088CD10-EF86-4c44-A54B-7FDCB5D722BA}.exeC:\Windows\{C088CD10-EF86-4c44-A54B-7FDCB5D722BA}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{7FCE66BD-E385-45c1-A1B6-AAACD5E4D456}.exeC:\Windows\{7FCE66BD-E385-45c1-A1B6-AAACD5E4D456}.exe12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C088C~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0FB9~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1C61~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD581~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C89A6~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{663B1~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B835D~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6E8B~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{869FD~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B006D~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD51cba9d39e79ab5b9100c23e798c0b886
SHA185f4fb420d791f8d1716dc488dd64ef6c18753c1
SHA25642550d663c46e02c1679ca7ed8ed90583beb6bcc57e41bc5467590d73994248d
SHA5123bea397de20b5515f6a4c3726c8972aae71e494e3c761935513e6e4ae1cb58b75b9cb5efc99278ddd089079907d2948cadfd23ee2451d1f00015c2501b3051a6
-
Filesize
344KB
MD51e5aa0ce41c6b3112cdbb05dfa01ff8c
SHA19f099d09f519eab5c883e069a3512443d5c76801
SHA256b22549e9d4745a8c442ba50f01e063273365f9ff82162e63ee3b10109ef6f550
SHA51299af5db2b241034ed8bd48d74b5ce3dfa24b8cec33c798e8191dfd219a988ed733e9869f07d75239689ee4271f3a2a239ef5da629b3ba3d7ed6a90dc8332e771
-
Filesize
344KB
MD5f96eb0e0f9725a2f962f123a17e5352c
SHA1d03bf43a826d9485916afe1e4038bf9498b843e2
SHA2563a8fc1906310a0d45b934582215a5863540691f442999591362b4d29f36fe87c
SHA512bf0bc896449dc1e16ca20e9b43761a2008b6321aeb149b3ef876c99d0bb0ca4ce06bcc8603991d5c9c8f407dbda198532e3ff94cb206bb3328209ff10b4b83c6
-
Filesize
344KB
MD528fdafa8a31e9c2d031fd2b4722a0778
SHA13668090a8563918e0dbd65aa7bb0c10d7ed2164a
SHA25625890bb232fc18742af41f8948be0f79a7c51a50140ead2e6fc31a88c88392d1
SHA5129aa0297afc4a1c64c694b8905bfb2ede2ab4849abf6db617be901ec842e3e40297dd2e29d9786de0a7b100a184e6371684974ee6a70b7de2a0e3dc821b925e2f
-
Filesize
344KB
MD5449b20590e5055e4c56cac7f59a9790b
SHA12d0967a91b24d60083ab679b1384fa576f0026d8
SHA25676572889e1a3f67725f4e2eb9c8f1e09fd8ef0474a5d33938b351957775843a5
SHA5123248e8d0afcb8891cba087a0e53e9a60765e26cef2a71c4752fab9c65188028e74e32297796b8b119ac5c4e67409c55330f0e1b2890abb1ce61dd2e222e7203a
-
Filesize
344KB
MD5d5a4a5d37ecf212d915ec9b9ecb5fb3f
SHA17b0fcb3f14eef78d432a127ef6abdb6eabbed9ee
SHA2560bb8a70fda247cedeafb4b82bf1aac4b87c101103df0490d2f520cccc0d68455
SHA5129ab8c14300c2a31b530d36f79aba6f9178c9aa8fa2b6b98ccf1ffb93d3d3cdb1101bc5746ec10bf186d8ec4b052cae28a7c5c08fdda8825c1a5fbb858d404079
-
Filesize
344KB
MD51db62b07c3a58dc6fc886dc80ae0d0d3
SHA17e6009b9af07c10fa3cdfcd3764d4d3903479b7e
SHA2563b7d1215f2ded88b57e2e80c46cda91166f5fedd377044cd5c84cab39a2ed94d
SHA51284a6c3471641a779f2762976e845fc983276137c1203ec4b14848b07fc0e79cdb84cd5c46f11b883c2b20492342b8ef7e6a97284af6cbc4735c59ac873eabfa5
-
Filesize
344KB
MD5ae7d11ef91323dab5456979101b1c9e0
SHA12b900e1db58119eae87235a22c7444de1f214055
SHA2562be533d586c4901f79f776b80519fe6f38f9241e3dc2aaee605274d96bde2ad0
SHA5127e0c0920484c065bfe7732e27d72102b2282894bb6702b0501ad9126736ee55ee96787f002c3bb3bc4d2d624287375af1fad01385a6be8ecb805b858c4228f2c
-
Filesize
344KB
MD5d25b33a2943b3840edd6b4e5e37b6737
SHA102cdfeaa859c33126539bd5551443fbb4dc2776f
SHA25624a10a1928298ca9b23c69ddd1b4c0a84b88c7009c237ee871829ae22b2d5994
SHA5120f940ca3166ae26f5c75cc40c8e2e8dffd7cbf2d3c4879e70f5b67c0c933ea94d9503865245592c6c46dd8c7582a8795e18d89b27cd7539d1f825272bee73890
-
Filesize
344KB
MD55ab20e29e30df17386c112878b16ecf5
SHA11791f6e75025d33d52d5535b131ea9ef1e7316f3
SHA2569ea9e831554ae53340f8ebf8ddc7df747bc46b4a333bc7dca411012225acbc12
SHA51209bccd7efcb6b6065c367b7cdd9586a8dffc4493d6dbb9c0392fc50ae6fa73297b4a19cb9ce1bb174e0f9597465e5e2c74ce75a8fca8efb6e859cf89286ba0e5
-
Filesize
344KB
MD5b2dfe866f3f237fa0ce8e8d66d36622c
SHA144f1baf061d9b69d413bbba8481cf6f054fcf752
SHA256358c6ecabfd2d8bef4ad1bc4603f57becfaa8e9350bb1dd39c73b82b7d8fc47d
SHA51246679b07dd87a76761c5a0ea48a57037365150b513c07b81a0599c411d1eaecce14ce88d2c4a4e2b7a73c19509ca8af0dab88d19758ce5baecf1e965edf9b43f