Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 03:44
General
-
Target
2024-05-22_137c0d0b6237fe97d74aec2aeca0d674_goldeneye.exe
-
Size
380KB
-
MD5
137c0d0b6237fe97d74aec2aeca0d674
-
SHA1
f453d1f7e3383c04f0689227d42402b069659d46
-
SHA256
7b25b20b5edb6335fb45fafba44e9943c73ee673fc7b17ba0700ccf75952a482
-
SHA512
d7784cf955a6086e61d6ba5adf068ac8a8f47b19809d935dc91d3e0a66da66f037bcf67813dc01e5a0c055f48700c31951026ed49166e32cfd15c9b10500a437
-
SSDEEP
3072:mEGh0oYlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGKl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_137c0d0b6237fe97d74aec2aeca0d674_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_137c0d0b6237fe97d74aec2aeca0d674_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F04D7CB5-3334-4feb-A6FA-161F46199148}.exeC:\Windows\{F04D7CB5-3334-4feb-A6FA-161F46199148}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58CAEED6-43E3-4100-A47D-0C9DAECC9AD6}.exeC:\Windows\{58CAEED6-43E3-4100-A47D-0C9DAECC9AD6}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEA7442B-FD9E-4a86-B3B7-28F587D8BF99}.exeC:\Windows\{CEA7442B-FD9E-4a86-B3B7-28F587D8BF99}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A7277C4-BBE1-4d9f-A20C-E480B6A0FFB0}.exeC:\Windows\{0A7277C4-BBE1-4d9f-A20C-E480B6A0FFB0}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC76BC6D-F980-4b7e-875F-5C920A3C2E9E}.exeC:\Windows\{AC76BC6D-F980-4b7e-875F-5C920A3C2E9E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{111D8CEB-F5B0-4645-8C20-094D9F2D9743}.exeC:\Windows\{111D8CEB-F5B0-4645-8C20-094D9F2D9743}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06F70F07-5F07-4325-A317-E855F08493BD}.exeC:\Windows\{06F70F07-5F07-4325-A317-E855F08493BD}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{954AF349-6793-4142-A24C-CB86B1641C75}.exeC:\Windows\{954AF349-6793-4142-A24C-CB86B1641C75}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FF73A7E3-AF0E-4ec9-B874-D1E1F79CF007}.exeC:\Windows\{FF73A7E3-AF0E-4ec9-B874-D1E1F79CF007}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0F8564D7-CEDB-4096-B7C7-FB752F2834B3}.exeC:\Windows\{0F8564D7-CEDB-4096-B7C7-FB752F2834B3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{65ABAB29-6B5C-4388-A1FD-3E1BDB75DE7C}.exeC:\Windows\{65ABAB29-6B5C-4388-A1FD-3E1BDB75DE7C}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F856~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF73A~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{954AF~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06F70~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{111D8~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC76B~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A727~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEA74~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58CAE~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F04D7~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD54561ef0b1d9f49faa0275dba76516de9
SHA1e3faede5e95a227001c0d6c0744e4e1382227afb
SHA256031f6d54beed1960d91843069259289e598f8d9440ce8fec9e15b63a20581650
SHA51200fa2c57808d047c313faf622eb26227c9c0ef88af6b29a927b850235b431e03f1d3d1a52a7242a52ea8e29db2b59cf9493f426b3bfed63b3865324b07574d57
-
Filesize
380KB
MD56b386e059afc6e30abeca776bf9d940d
SHA1f445d27aa648ac0ee908ce4f170c96bbd29e175a
SHA256942fc20020e0fcf44a1c70d41637fa803e3513b8bb80002fb4d0f6598d959700
SHA5127493d30868fa6624b7bd0ddbb95eefbf368824f6db1dc0fe03a621f232ef1e81d1c7835714ad014cb475f1a7160a052c92ebd25bf61f0432852ec827aa527921
-
Filesize
380KB
MD5a3e31c768969ead1c423ef3257e3123f
SHA1d80739c0925a9a18c2124f60e900a047ea5ae0d2
SHA25666abc61a30e6a1facc57c286e29599655a9fc49dfc0cd904df07753f1cfb268c
SHA51246876620d59a5b05ebc864a3633b366fc96f690ac610b0236e773fd29bcf8ca7e1e3e08dc4829df6c585a790d911cc477683143ae7d67f25e7628a49c5cad71d
-
Filesize
380KB
MD544a22f1bcb54e1c97e8f2dca3b73f2fd
SHA1c4750ca11be6e8a534401f74615e95582ba4ed24
SHA2562b5e6c4d1a3c6b4395df5cdba2bf8ed969b704eacfb94f3f623984c94aa2458f
SHA512b42be17b8352d1c6abafeced83dc040133121be85c4fcf22bda703e57801169ea32a2a7978286ece65634f586a7feacbb7ee78938c4f201882397a93e133e49d
-
Filesize
380KB
MD539f38fa119703b51a623936c2fb201e7
SHA13976e3c5b192808f88f163d7120e4511a53744e8
SHA2568116d51d004b77af58d5738c0e45e339304ff84e3d49a0cd912032e1cadc0c99
SHA5123e6283f52e2089725e107f968aa11869205101f319503dc8fd7411c134bbbd454fd3e730208a7976fc6f04b0847708ca66ac63c729ac78a215c2419e12fe66d3
-
Filesize
380KB
MD506838887465b74df847550b398fef4eb
SHA1e05eda82742e6f8055485740af168fa5139d8910
SHA256c449fd1acacb750cfea669359301c1d615bf2add19646141ac14481925a0d7a0
SHA51224bd564a5d31a1ca50c82af234be0ea2ba19601ccc50b214f22d59cd967804b2aab78fb27d2b7c68cb7295c9b2bf773e4b506e97dc1d80a12cc866200ce61467
-
Filesize
380KB
MD5eeb560e9c48e1454227d631cd1a34f29
SHA1f2aeec1d776857f565bee8eaf70a5cf4fd96cf60
SHA256aed8d4ec776dae3fbeec65c13c358e6bbd67836ed8c8e95a2690c5fea8a486f8
SHA512fb621b9939d0d372eff97cb6f0366a8b509b0d0256b26c6127a176b9f54188fd43b6d0fb311ee75a85f352d1daaaf079a467ddf56e48b07e76539898e355fc45
-
Filesize
380KB
MD5487886380b14984a5c535d9a394276cc
SHA16b8ab2da2e1789264c598ddd5708a746e70e4f8a
SHA25645b2ef6629def349ca19b24cda03c09c55de768f78f0b3da91525594837936c5
SHA5123de91dd28d55d62682d458dcf30e39478ec4966775e036eea37e5335c09ae084ed15257c1ec14aa96237944bf9c134d2f2ff5fe271c98ad0cb4a78a91b971f75
-
Filesize
380KB
MD5cb8b911d6a50bb6aeb26dd9250f77ee3
SHA1cf972fe53168b9b2ca75291cd88f3f95e6b98f57
SHA25616207add767c0fea007d1dda9c5608f6a1df83994fc173fcb46e53151aebeccc
SHA5124467d88e39c096a88e8e42494678dfff6858d6185cc925c91600de85792d7988c78337b0956d3a4ed76ead069180d5cc066b228d5ff5cecb1e0b4764b43b1d67
-
Filesize
380KB
MD5196aedfc30e5314c9c0a9f1cb707faf4
SHA117e1291c008d34ceeaab075918efc99a958ca0ed
SHA2568224ca0b238bbab8c1552cb3ea21d741a46c27d62c4688b075cb97815d6c7cb8
SHA512a57c6bc98a852519fbe75119ef59e1e3b7195f7988d67be404c55795f9f7de88d4908ab53ad8999eb416c6174052d407ac88ee3f3542ddf701768d88a2cb1e9d
-
Filesize
380KB
MD5f7ead1a6dc8d7bcc517747bfd9647615
SHA1ee9ba4ceeb34ca39eba991c9f1b0fdc764811cdc
SHA256e19c670169d8c51b36586bfc8469fa38dd2615ceda96d79e13289695f8006d39
SHA512b7fe7483ed78f560293560efed48332a4afcea78c2beaecba48eb3e2a2f12c1a16aae3b8c6b73e576630f995532d1b1ff41e6fea21fa4239e5204e23cfcfd75f