Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 03:43
General
-
Target
2024-05-22_0cd20ffec964472cc4a54e8b4e619260_goldeneye.exe
-
Size
408KB
-
MD5
0cd20ffec964472cc4a54e8b4e619260
-
SHA1
038a39a7a43f12af68aca4ce322712f56662fb89
-
SHA256
717b21cdfcc9d7270fc85aaa2ebd8e865e45b584f862cbfdf9f544f7482d46e7
-
SHA512
ac46f8b1ac716289c42260f4f3bb6338da409b9872470cf5c83b629d965ac0cf9e2f99f08c2206507d6c4166b88d24e0f63f67b56f63bdd93bfe02e301e9bb4f
-
SSDEEP
3072:CEGh0oyl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGEldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_0cd20ffec964472cc4a54e8b4e619260_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_0cd20ffec964472cc4a54e8b4e619260_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{22821B23-A79B-414b-8B13-3AE6FDBE54B0}.exeC:\Windows\{22821B23-A79B-414b-8B13-3AE6FDBE54B0}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A14883C-EDD2-41fd-8913-1179C15DFB8C}.exeC:\Windows\{0A14883C-EDD2-41fd-8913-1179C15DFB8C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CDEE067-9F0F-42da-8FB4-7E5AABEDE54E}.exeC:\Windows\{4CDEE067-9F0F-42da-8FB4-7E5AABEDE54E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA62DC99-EFD6-44ad-9D50-8ECED1059DA2}.exeC:\Windows\{CA62DC99-EFD6-44ad-9D50-8ECED1059DA2}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEE1CAF3-EB68-44dc-9DC9-BE1E9ACD614A}.exeC:\Windows\{EEE1CAF3-EB68-44dc-9DC9-BE1E9ACD614A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CB3B170-4D14-4819-BB1E-77012A8B3E0D}.exeC:\Windows\{9CB3B170-4D14-4819-BB1E-77012A8B3E0D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3975957-EA70-480a-AEA7-0A0B493F3A7F}.exeC:\Windows\{F3975957-EA70-480a-AEA7-0A0B493F3A7F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C68BD396-7325-4243-8A30-193760BCDBAF}.exeC:\Windows\{C68BD396-7325-4243-8A30-193760BCDBAF}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D2BB9E7A-BBB8-4027-B8CE-BE6E823B3EC6}.exeC:\Windows\{D2BB9E7A-BBB8-4027-B8CE-BE6E823B3EC6}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{955C6EC2-26FF-4856-ABFA-C053D52B9FFC}.exeC:\Windows\{955C6EC2-26FF-4856-ABFA-C053D52B9FFC}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{36B96264-2C08-4e8c-916A-F51D6722EA09}.exeC:\Windows\{36B96264-2C08-4e8c-916A-F51D6722EA09}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{955C6~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2BB9~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C68BD~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3975~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CB3B~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEE1C~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA62D~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CDEE~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A148~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22821~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5a129b171e635c9561602ee9adb93bcca
SHA1830d03a60300c8c1cce4e1623073e373cbaf3f71
SHA256542867a79b668e8ab9d9cfd5491f7f7427aa5c4b3bc95f41ca8c1d4892739b66
SHA5123da47ec047778f43a5a0a5807bfb0190643ba48bcbc968e4c522f78e5e1eb9559177b3757767bbefbe3e1b4d11e30335ca94b802948ab584d655841ef7055d79
-
Filesize
408KB
MD5c3d388e1370e740a8f42be52d87e3b63
SHA18201f5044d2ce10773f593c1328ea5616116ef36
SHA2561a5e54c4caa02d7e7e63960aac0d2b75541c7ec2cc7c1c5470a93fbb90eb520b
SHA512ad7eb134f18466f4212e415d2e92081962d6fb024f5b03e19554ad911e81744f1a98ae4b7fd8545a27bfc4b204d5a1611535a67cbf0292e1ac2f718abf0bc568
-
Filesize
408KB
MD51dac11e178c86a7d51fa1c5c11f2cd91
SHA180ebecb137afd03078da076d48fbd994b412f42b
SHA256c320de82b7852fca85054b1aedaa1796cb3af13a03b10e792590b80fcab3e31d
SHA5123bca861127673750fd020043809c06381650499019616e5ce2b80eb6d3131dbd219d464367d18d6a479ae6564185a5499a4380b7db11cf24fc38438bc6437f3a
-
Filesize
408KB
MD56ebecfd26ea28f65fcf43a120dd229e8
SHA109ed2d6d842f2c8c58fcbb57d559c1500bca5476
SHA25625960eda6c569cff01b2a801044b0cefd8541cb3ece40763e4a4f8770b27c5d6
SHA512d37da5661c9eed29987d3b4886b5faa2b9b9148d6e1fbfee3789c3071d88900b9c8abe75dd71532b6a5cb33a8bc44f379c36e3c4190646cdd4c40142d57b823a
-
Filesize
408KB
MD5bf535a5a2b3e26d1557db6e1fbbf692c
SHA1379b5e8c0475ecf3dd8f5488c537d8f8c439ea2b
SHA256e3c716a95bb1ff1c87b4d60f935e5ee87ebe4860d400b451c8d3e74c9e5b5f6a
SHA512d640b81095f0089c86b0be6dfc294fcfe979fe2a921ad86ccee0421fbc2a143007f953100bd4416025ed4691b522f690943f79793178abb5e123e63121dabac2
-
Filesize
408KB
MD5decad5ec1e3227df242d41c248171a53
SHA12f3b79be16751f395873c27319ddb4bb518df93a
SHA2565b311bf307118bef0adc04ff9f107100c4ce8b6118e208894e4f830c73810885
SHA5122bfa7d97ce95810c43e06bdccbc3beb364c009633f2f9a1c1042b1b04efcf2abc17a1f8d627d2c049c321463d0f9ff77d4d7fc50faf6b034ec5e8f1c7e712ada
-
Filesize
408KB
MD507224c7ddf1f03e190df4f41af48b2c7
SHA1d8a504b12d1ad34bbba4c56262297af9b9f513ad
SHA25662fd182879f2aeefe026b058b267adb5f34dfb63af1360304e5cf145508f496f
SHA5121889d1ec20a8b77e77042065b7d46404b098365a08b53b0475f6928a19eac7afc217f54f5104460a3157aa40164722e07735b2018ae8db11114454ceffd98753
-
Filesize
408KB
MD5bdc18d441f3ad1f026181d685849cf78
SHA1ca439f61c56f0ef8fa87ae7955b3194e465fa816
SHA2565b854b101610f1ebd652c34dc71f2700da2fe89786dd652664fc785ed0be19f4
SHA512cf78a7b9309f96238a0be1536037fcd9a10de47749a72c232b13c825840d7ff277d76c101a54a8d39901d8b166c1df9d3fffe7207eb265b5cd556770aeea6e51
-
Filesize
408KB
MD53bd374530c7319b168bf2a2077e2ae5d
SHA1b0082a7cb4cd85a0f3a1d7527ac88aa8a9d31ec4
SHA256d81d8322ca209afb695f48368096ef8acf4a9055fe3ebccf89dbf8dd08f4d787
SHA512323db18805d13b35a0bd81e17d00befa127ee92d26610c211d9eef4548398d5f66a1aae5a5008748eaae6487b03e64dc58aa50202bd5f067f02bed5f9a405c51
-
Filesize
408KB
MD55e40bf201d15f9b682c4a95b7de22c76
SHA1dada49726642032d5433b08c5e6fb66e9f4666df
SHA2565c52433d398425bc63a20e16f2d4463558a0037ebe2497ccc9aadd119dd1fe70
SHA51239797390f0dd83858bb91ef07f30ed9d0d5ec42451df671a732e478df5bd1e65117ab3f905563b2f94da8ddb0f2ae1951f36ac8d308433dc4ad6e3264938a5bc
-
Filesize
408KB
MD5f2195e796cc87c8c65c0f85425bb97ec
SHA1ded5709ba468de9ab9ab7022aae912b41077a440
SHA256654ca191f8542415e88e5b9d00901c00b6ab2a4d32c69b969171fd0997eb003d
SHA512cf58946497ce7986398b4f7f4404f8c6127d0e4d80dbd253d78adf27a01dada18a65296b8a7bc707546eee17efa7cb9bbdc502cad12a475087d1dcf0e3dd4b21