Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 03:43
General
-
Target
2024-05-22_0cd20ffec964472cc4a54e8b4e619260_goldeneye.exe
-
Size
408KB
-
MD5
0cd20ffec964472cc4a54e8b4e619260
-
SHA1
038a39a7a43f12af68aca4ce322712f56662fb89
-
SHA256
717b21cdfcc9d7270fc85aaa2ebd8e865e45b584f862cbfdf9f544f7482d46e7
-
SHA512
ac46f8b1ac716289c42260f4f3bb6338da409b9872470cf5c83b629d965ac0cf9e2f99f08c2206507d6c4166b88d24e0f63f67b56f63bdd93bfe02e301e9bb4f
-
SSDEEP
3072:CEGh0oyl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGEldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_0cd20ffec964472cc4a54e8b4e619260_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_0cd20ffec964472cc4a54e8b4e619260_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24422CBC-CA56-498e-8AE9-4BCB2A0D2612}.exeC:\Windows\{24422CBC-CA56-498e-8AE9-4BCB2A0D2612}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97068678-2415-4ca4-8484-2A93ED361E44}.exeC:\Windows\{97068678-2415-4ca4-8484-2A93ED361E44}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C74C146-A00E-4ca6-9E2E-90DBE2624C06}.exeC:\Windows\{8C74C146-A00E-4ca6-9E2E-90DBE2624C06}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96D020FB-1311-4ea0-A770-638B370EBA99}.exeC:\Windows\{96D020FB-1311-4ea0-A770-638B370EBA99}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{895F70D5-F6FC-4264-9C44-256BD0A7ADF1}.exeC:\Windows\{895F70D5-F6FC-4264-9C44-256BD0A7ADF1}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36035558-B448-46a2-99FC-CF716295BA4A}.exeC:\Windows\{36035558-B448-46a2-99FC-CF716295BA4A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64A45B99-6F35-4e58-8176-0A67A67D2D7D}.exeC:\Windows\{64A45B99-6F35-4e58-8176-0A67A67D2D7D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEFE05A6-A807-4798-9F68-3D7775BF7B1A}.exeC:\Windows\{DEFE05A6-A807-4798-9F68-3D7775BF7B1A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F44D29F-141C-4747-A03A-EBEC25AAC950}.exeC:\Windows\{0F44D29F-141C-4747-A03A-EBEC25AAC950}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B4700CE-CF59-4410-8C01-C103B8BA2222}.exeC:\Windows\{9B4700CE-CF59-4410-8C01-C103B8BA2222}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37835512-14FB-494d-B2DA-677F2F2D906D}.exeC:\Windows\{37835512-14FB-494d-B2DA-677F2F2D906D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{22D34907-1757-4e82-ADAE-E8E72008B3A9}.exeC:\Windows\{22D34907-1757-4e82-ADAE-E8E72008B3A9}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37835~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B470~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F44D~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEFE0~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64A45~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36035~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{895F7~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96D02~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C74C~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97068~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24422~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5cd0b4816ee86ab5d1b28a1dda755e228
SHA19e468fad23e24cfd129002c4910fca5fdeec1175
SHA2566d22b464fee7b4a2ee2429633ca6fbc5428df1d70b89cd1654ab33e246f7b5f6
SHA5122252bf1cc0cc41b184c2f3171f3b2e1d805dd97eb53bc3ca892875bc011c724540b8613df707123e5f09c054aeba27eb29e14643101db5a67d0b3289242dd4e9
-
Filesize
408KB
MD51d463c3fc186c1b10b829d16d1b6df25
SHA127c5633249af52194d8e20196157a95fd0c8207e
SHA256b17e48690febc8a8d5a02d5544aa37e519c98c8fd1708ca9085a5b5c2f0c0c4a
SHA512797790fcb95bf3e0f689a7be18e3e550f886d123ba9a4eadf88877076a124fb36b330fdddab4aad6ca9d9d940d2f1a19fbdeb200037c9616ca034b9b53aefa21
-
Filesize
408KB
MD5905b3fd0ef705da91eaab6d388531104
SHA15f1e012a2ae2f8f2c89a4972e86ab08e2a9486ee
SHA25638b632529639573d2483c2e37ae87c8ff6685b77f432015fb0194935a6344d27
SHA512dff8de0652a388ed051eadee731a4e6115f3342b6863731d7c473d1584b02def5f62e7e1f957d687adb883262831bda4c672c0b227039220ce38aba697bffc1f
-
Filesize
408KB
MD5044efda5e574029ba46dde4853e756ce
SHA164517ced24c5c099fae58e19fa591c0b4e61cd30
SHA2562c382e9c3a8e71d311ce8122abee4cd379ceb9058bfb9b847463f7d12aded335
SHA512333195165515f341eb8811b068bf141b8f0477ec14bd39db7735d0ce118e4335089ea08e22eccf89a21e5e1164ab419ff1d66c9727cb0da1fb3f4d6b414161e5
-
Filesize
408KB
MD5dc2cb18a147adce6b82c606d56e9aec7
SHA15828ca954c8381d4c217925d63ba1e56a658de30
SHA256924faa566dab4da6d8d3983e60338105bb27a6555d61dcf4bff971a38f745f3c
SHA51220aed7a391143f6fded4c63ebe8e685516eaacc22b836667031cb6a99e8cc1268412c547dfa69fd013a730e7b66cb590c476e1a4a989c32d2de39df67843fcb5
-
Filesize
408KB
MD58334ede08c281b120bcb5d37491c30d6
SHA1bc45464445c631c09bfadf1f48bed3b71939dabe
SHA256ecdba2fa160eb1b64fee6e4a7d3203b93f4446dee971e0ff56aa145da309b318
SHA5129839fe32beb5bbd3bd978403578255c96ebda08513281e3b70ccc0fa35fce4384566424db1e7dab72b056f130c9a66c7e5ec9b244c6e156af5ac6affad66485f
-
Filesize
408KB
MD54c1a5608be08e0270db270a8464456d9
SHA1139fa74d5014040cfd6581160f5bfac92f9f6ab6
SHA25696bcfec3a2f291b4b0051308b0d64cbcb8fdabdd1969719709184f97da6e388b
SHA512dca00327db88cc81bd89c9378e3c5d4d83f75bf5ac36822daa8fec8fc521d0b84ce077721bff471de263ba77dc923f436c8a52c00b4a8b07da217756c52f1dec
-
Filesize
408KB
MD5706af81496ef5590f8824886e0bb3bc6
SHA1bf62f4eba4c73540b7153ff8b770cdf7921bcba9
SHA2568d362d162fae9dc98f03b4712d0377c292a5be58f3d0a4b172bfbd348d63ee7c
SHA51223f221efc5b643d869803a8dc4b28348cec5b667f6e9fc864ab189eb2ecc47564738bea3143dab26b68f86fbce78656bd3d9e7beaf0cff78bd7d52c641216394
-
Filesize
408KB
MD52be2c0d3fa653c1edc03cf3a2c5e3984
SHA11703b0fbe672c3a02d77774a467d16a34bfa6303
SHA256be434de3832c88a7060a564560125f4371e4f3a6d93b468387923e5cf386c6f7
SHA5127b991a3e6f797c4537d246899ec7247658345c27e04a803b3afccd9b0d5d35f449dd6f65aedf49d53908d1b8067e544b6f7d751f680e8103cba4258ba20aaec0
-
Filesize
408KB
MD50047ae3ad2aae6145951c389afef1174
SHA19c0408041290128a599107e8e86bb310e4dc9cde
SHA2560e52c58ff3dba21cf064f71d01d80678d5283673c8bbda7decfc374648574509
SHA5128d84251c465784e10b167aea5700ccefa38560fd873ae52b873035b33b5cd6aa745033af1df1b9940a8e7da19e8f0573614f55259916a846cf065d5496a8529f
-
Filesize
408KB
MD5cdc03a0b69dc463e356b8052578cd4b5
SHA14ee66c04ebe882709a949660517a55c2ee3e3e9b
SHA256c7041c2450ce0e8a2faba9169f0f3eb55741a3426bfd59a2e5835e219666b284
SHA5120ee907214955f6aa902d6e592dae2ecae07dc38ccb57c6d9b32b9f77286c2f5eb3a5d637442f430bf7794596ae0e638099910cd6b86e35c9bd3422074a568bd4
-
Filesize
408KB
MD52a5ddcc7a98473f7b32cab870313b4b5
SHA127460bf316d0be27ce2df0857b79fe959ee02cbb
SHA256248cfb5af9c3938d1949e1671bc22ea1adeceb0b5c603de84fbeaec8ea41bf20
SHA5129508983dda535e4e4324fdc9554101eaf36ddc72372353d8401340df0b151c9c0cbcf8a28331757b3a86a02a708d8774aea5242556bafc21ecfec42d7fc8ac5c