Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 21:33
General
-
Target
2024-05-22_3c54dfa7f5dbc7b2ab206d89106b8a07_goldeneye.exe
-
Size
344KB
-
MD5
3c54dfa7f5dbc7b2ab206d89106b8a07
-
SHA1
33e3d25d7efac7ccb29f47f0a1c91a68f6b6cd39
-
SHA256
eb8618b290072d1b82d72dde55fd6751058bb2743e5ade71ecb6e49064367501
-
SHA512
cd24be223e47d37c0a891ad623963543c1fe8c919f6112f877a1d42c68a3640520dc23ef944e9e9fd1f44af1e30c670dce50c8a35a9ef5472e87718d6acbfe6b
-
SSDEEP
3072:mEGh0oqlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGIlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_3c54dfa7f5dbc7b2ab206d89106b8a07_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3c54dfa7f5dbc7b2ab206d89106b8a07_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2D3BFD6-771E-4dd7-9D7C-F5A32B94270F}.exeC:\Windows\{B2D3BFD6-771E-4dd7-9D7C-F5A32B94270F}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57D3ED60-A53A-4aeb-961B-76F9B57A0404}.exeC:\Windows\{57D3ED60-A53A-4aeb-961B-76F9B57A0404}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{318CF849-B63A-476d-8B4F-2192DD4925CD}.exeC:\Windows\{318CF849-B63A-476d-8B4F-2192DD4925CD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2228996D-891A-497a-A831-7CAA6AA6DDC8}.exeC:\Windows\{2228996D-891A-497a-A831-7CAA6AA6DDC8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE707686-6B0E-42c6-B23E-8161BA3CB2B3}.exeC:\Windows\{CE707686-6B0E-42c6-B23E-8161BA3CB2B3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75662F03-4C00-4953-82C3-74A277D83D4C}.exeC:\Windows\{75662F03-4C00-4953-82C3-74A277D83D4C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CE17F13-CEF8-4bad-8A85-F85627A9BDBD}.exeC:\Windows\{2CE17F13-CEF8-4bad-8A85-F85627A9BDBD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B50E5BF9-7ED5-417f-866B-8EFE339E472D}.exeC:\Windows\{B50E5BF9-7ED5-417f-866B-8EFE339E472D}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89BDFF75-ACAB-456c-B4F8-5116D04A70FC}.exeC:\Windows\{89BDFF75-ACAB-456c-B4F8-5116D04A70FC}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC4ABE24-2280-4336-A638-1D92BD3CBF00}.exeC:\Windows\{DC4ABE24-2280-4336-A638-1D92BD3CBF00}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74167292-F9DD-4cb7-A658-4199889245DE}.exeC:\Windows\{74167292-F9DD-4cb7-A658-4199889245DE}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{081AC82E-150A-42cf-9FB4-0E9EBB2D0018}.exeC:\Windows\{081AC82E-150A-42cf-9FB4-0E9EBB2D0018}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74167~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC4AB~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89BDF~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B50E5~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CE17~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75662~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE707~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22289~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{318CF~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57D3E~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2D3B~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD551731f7ac6129533fdd43f430f6d0939
SHA1341f1386ebdfe637330de440902f996beffd657f
SHA256cc59831e0d827ce71c09dbdf71646aa73e0648f1f74ebeb1ae09d291a4525dd9
SHA512d8026020aa29edce01fc320e1fbf6edf773c28679a715942dc7f07acabcee5c3d093fdde64c7ba519883e0681e167e82d57b11c5584e555ae66c4987ec656453
-
Filesize
344KB
MD5328dcb3c68bac12436ee338ebea559dc
SHA18cad9c78fbf8556cb84cca38b4ce60ae415e3663
SHA256411eb9207f5ab387eec84819bba41757eb6c429e916c993ad81a46fe280537c3
SHA512aabefb38f334b261be0fb58b455c875d046a54f7c10a47aa4ee6d55752ef7988bfb461239e32023a4ef9603fba82365a0624d2b14204d0b6012b080b1e8432ff
-
Filesize
344KB
MD5b9dcfee7153e116a0bce6f8d1bd13440
SHA1602e720546d2670871bdc11cbed30c3bc2a4d5bc
SHA256d5d20829f1ec0e62e1d641663e0f7d93ea80e990ec815442d3cc56016311b4dc
SHA5125b1773abaa8dff8e61b2d209ea42e98f07004029f305c0139defdaa553385d3341a052a5fc1c6da93396001eb908c4d4551bf7677a6820251370a9917d25dae4
-
Filesize
344KB
MD5038f47e2baca2b860ec781b4281d166c
SHA10a88ed0465c6ae77779b41a2db6687c04e6d9f96
SHA256403226c6c04f847b44ef9c299b28c4279e162bda45fd17ac2699c50e08c2ced0
SHA512fd8802421fc8c4c2fa64aa7d5e382fd01c19df13e5f06712a4a9b1779a9883aee9de887489261aac2d93393f5af31293f3291b2c4fb8c3491e55500206108743
-
Filesize
344KB
MD5cdb89ff9b56bfe24a912dde404b45032
SHA17d8e852169b3704247291309faa7a62eb8421eda
SHA2568325695128a05e5a222d418527938340abc3ecf9fd16325a2f73db3de6c47178
SHA512bd1d49d601ed81e3290773ddc47291c48b0cd520bf03f54038afe45b09482e717764d056f915aca33b4521a9919a501516a5d12ef52571fd6dd4c7c44a5d527b
-
Filesize
344KB
MD579c66a27782555f1967dabbd4fd80b35
SHA1c7b9f46d713570300d73ff2b504faf97f93ad3b6
SHA2566e4772e76d09f75dab21154d90e7b2d83389a3a0183432da218ce697a811563c
SHA512d983722793c2e2a9333927a674d470c52f3b0c195d222752df12cd68af52c6e66436f9cf6ee6921b5514158e2b6e2d903c7c1c6a62aba82dec6cc089109819bb
-
Filesize
344KB
MD5a05b3e06a8c3437d0d25ba029e9a380f
SHA1341704afefcf2d18119f636467e7a6b444ca6211
SHA2561e121405fde23cfb743250e91b999eb4a480dcbf223dcc641c65e99b8a6d8889
SHA512185861da6366f04951373df9eef35d837291443d70f16a9a6d155c0231bc87c6293c1a7e49a6f7e753f8e40cdbb3df10a0f1b3c20bb8b1f8ccedf080b4b854e9
-
Filesize
344KB
MD526bc91cc8f090cbfb09d4bda1fa7a18f
SHA11e6033cc6afb20679864d058fb3e3e85519cc5ab
SHA2564d00554a5b62bfb40e531d6f13f894a54cacf3fc9a1ce7a70ab76e6efea97f08
SHA512b926afd52cb3523666a547dc593246ebf825862b53244fc824124b660737cd1ff6c9ab3176f5e4bdb38bff821bf6b3fa7f47236951c1b12a04bf9ee984460797
-
Filesize
344KB
MD519288af830d4e8e88c21f1b95e622761
SHA1bae43c64222b987fb472022cb25a4f31a4f25887
SHA2561db502c70fbb6e1fef7082f46ae403aa37cf7ed715d2c97af283638e45120c26
SHA512016c05039cdb360d02161eb5e5fcf192b5538f7425e0ce7fef78feaadc890150693a0597accfd7d53edef3c1abc841104aa9fa22d9c574f4fe6175b6f3eca9b1
-
Filesize
344KB
MD596fc27d8048643f5d899083d51f7916b
SHA14b1a818dfe24986e79176ad7dbffb594c0590d34
SHA2560455868cce9449f0e83f6eb61a25a9b1895d3168b638906d4be177b5aabdc7a4
SHA51250cc682b78aa75ee49e27dd5afd1b6737a51cce32b3adf6e7729e5d9923cd5d66b6e23931ce1f3d1dd87c413bc6d22b942365f390851dbf08696bbd19fdbc788
-
Filesize
344KB
MD5096795dee202824e11810c63f380ce5f
SHA15f41ab4c5d5956eb4b11f2b36260e32b3468a699
SHA256ed9e05784871bc0ecff8cc8919b56d23044f330791b932845a2f0caf4246bc17
SHA5128519e70d5f9bb8fe49159b8abaabc992f6898f1f775b6005816bafeda98cab6cb79c2e329a5d4d013b94e77c2ef3ec6cf96a645f6ce64212d44145bd84769590
-
Filesize
344KB
MD5f7f287ab5443b105fa6fcc28df67437f
SHA168a280226cf5ad5c09b88f5fe7975a36069d93b6
SHA256ac14c8c7bd26f53ee27fd63be754f1c99a0e0becde9873343154718bba2b8c52
SHA5120c6abd3014e37901ce45748371caba485df1517adc4bf6f31a51be43e53fc9e1217e47097b48990f42a9c4fd6a1c62aafa2c82507cc5b71ae60101a181408f17