Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
22-05-2024 03:44
General
-
Target
2024-05-22_18b5b21bd8f7dd6fab9e31343ca249b9_goldeneye.exe
-
Size
380KB
-
MD5
18b5b21bd8f7dd6fab9e31343ca249b9
-
SHA1
d12421a811622b8015efa619419f5fd3ce4eb2bc
-
SHA256
5a861468f261c6de09ec5e0836a607df7fecaa4252503b6ba15c90e91e4d7105
-
SHA512
f9aa43c8f8e64627d4c2a215a6b2b43ee5b003be35b693f04e04b6f199c03ca8a5bb7e978fbbb0444e80e5e9435abc7032c61e98501738965d2424da08a783bd
-
SSDEEP
3072:mEGh0oRlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG7l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_18b5b21bd8f7dd6fab9e31343ca249b9_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_18b5b21bd8f7dd6fab9e31343ca249b9_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9B8379C-62FE-4beb-ACA2-0A4B52A59DC1}.exeC:\Windows\{B9B8379C-62FE-4beb-ACA2-0A4B52A59DC1}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59666088-CA27-4f81-86D8-03611604EBCF}.exeC:\Windows\{59666088-CA27-4f81-86D8-03611604EBCF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8BBD319-D475-44d0-B1B0-6E2D3E3422DE}.exeC:\Windows\{B8BBD319-D475-44d0-B1B0-6E2D3E3422DE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7215C213-6196-447e-8F8D-95298ACAA215}.exeC:\Windows\{7215C213-6196-447e-8F8D-95298ACAA215}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{671DDC63-1387-44c7-AE56-6CBAE13D5951}.exeC:\Windows\{671DDC63-1387-44c7-AE56-6CBAE13D5951}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D49B27B6-992D-4964-9967-92C95F434995}.exeC:\Windows\{D49B27B6-992D-4964-9967-92C95F434995}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39B160D7-397F-44a9-9F0B-DCE28A7D9E90}.exeC:\Windows\{39B160D7-397F-44a9-9F0B-DCE28A7D9E90}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1CC123D1-3AEB-431b-AFBD-95C26BF5F8BD}.exeC:\Windows\{1CC123D1-3AEB-431b-AFBD-95C26BF5F8BD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A98E1A48-1942-42ef-BD7B-FCA6987764E7}.exeC:\Windows\{A98E1A48-1942-42ef-BD7B-FCA6987764E7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FBC1CCEB-3199-461a-98BA-696770C2EA0B}.exeC:\Windows\{FBC1CCEB-3199-461a-98BA-696770C2EA0B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C4F0D5AF-6654-44a5-91B2-544B1E9A41BE}.exeC:\Windows\{C4F0D5AF-6654-44a5-91B2-544B1E9A41BE}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBC1C~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A98E1~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CC12~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39B16~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D49B2~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{671DD~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7215C~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8BBD~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59666~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9B83~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD58dcef15af3261289450fbf55fce600bc
SHA134bccca62bdf45623bec1ed313da537e65f99c74
SHA256e107b35324792e1c7e38d8d6dc39752450e8a30bbd506efc86f7b83a5cdc2a87
SHA512e756e633ffc1aae50ab01974dcfaf2b6c1310b46f31af9204cf524e183cd59d0516184fe4dd318ed47fb068a3149b2845008ad1a9603227acb171b8fe2684db9
-
Filesize
380KB
MD5826cd465bfc92f5344e08a3faa74f89f
SHA19412aa562ac210070b2db99d18eab66547bfb3c4
SHA2560b27f08907ac63379be1a0ebc59707ab42063e95d2fe057f4bb73667d92ac4b7
SHA512c9196cc562c41db243572880ce1084d95127517dc343f780fcaad2c3fde8c06266d85fa181f8eb42bb8c472c985eeeca4bb494af1bf90ddd0ec374eb56ed9907
-
Filesize
380KB
MD56c4daa8fa953367ef6fcda8668ff98f8
SHA1de36d55abda31415440aecfdf709f1079468c6a6
SHA256d6da230c0ab1c66c27569c82cb2be6f9512c84c4ba52d9c68d41fde06bcffa76
SHA5125ea90f8df9d62a6988838a02500e8f7d6d47dba3ceff17e97018036b742ad9344d6262884a785216b1760009f3366330128bc125604ad2ebda1faf2751f0804d
-
Filesize
380KB
MD510ffc3432e1ef67e52921694288a5b36
SHA1a23264f84cd8bad87f9e5155d7dd1a114f933ed3
SHA256d281aa3e3973e0104fa38af7582a6dc634164e7f5e51505ea029d4bd07293850
SHA5122855029400321ab339131dd92c7b366d11f3acbc0d3416dec670003f1892eef0bf7d0bf8d3a617b67224075331ea88de30085fd08305c05710724de7589de10b
-
Filesize
380KB
MD5d4da10f3e9299e922e7402342f4dcdbc
SHA199114fbc812b62b9124f6abf51a418c7ee123ba8
SHA256920d91c78bbc38b1db03e0d5a5d557e326c10c473e2c88d7513759e83f669f55
SHA512d1d1d7ca5676a09644c165b5753c580f498f94dfbd8011c4e70f6e4a722aa72df856a97af1fab22bf30ae67c3619ea4e3e4ea44f5bff8e9e6fc3fec885c98364
-
Filesize
380KB
MD516319788ed3d244e1c7b9b4fcf7689a3
SHA16e533a7468c24dba67ca87069aa39d86fd5d6a4f
SHA256e49780bfca9e730479eccd34523867876bcb5c8eeb4278066fc9725fa54a850d
SHA512bca05634cf11ae246180aeccff5cfcdb8b955fbe30b2341042d9716e4f7b5d894c5f00a86f566dd7beb531415ff0231715d4239dbb049717ac7a0f08b5c71b00
-
Filesize
380KB
MD597c1ec9a41027160f1cd3cdbc63d2696
SHA16740d108fe12da0cbc9e5d48f0a7df1e505bd1f9
SHA256385d5339ada6da5a5b74d22f3da4fad79256a0b0b048b4ee8eb108a7ee7f4e59
SHA512064e54ebec160b68ff51aea8ec0e37be06fa5ea143b58c8577bfed68d98a5712d5a23ae68f1ebcc9e9d8920fb5020b64a19cc2377a5c1dc057fd8e868a11f799
-
Filesize
380KB
MD5c73ea0683a6a8a678138af37c62b8ff0
SHA1b6db68059eb4b01d01d1fc7e7732c807620bf8db
SHA2564d6854de9d31ff101bf47a317d3abfbc4f240141d9f08570a416c67763aba8c4
SHA512371d4ccdba55924d0d6f17b2e4751d3a4926d84fab32c11ed2b70f4406135384e629e6cd4a645cfc5e2a87b8da07fe0d431a10ec0adfcc1d3d560d0df90da6e0
-
Filesize
380KB
MD57241918bd64601af1489080dda6955ff
SHA16a1558478b599bf4ef70b4798737f737412a583a
SHA2568747d88fd2dc0f42564fdb3cef53d781a86f9021a6918a0f4e8b58d5a9f43b0a
SHA5121b5e302f3697efa9a44bae2c77c9a4c76d15d0aa7f76cfa90c0c60baee0c4b9c24c10c0bd804ec2a02e814e872c64c089c01716e3af41e3ec7c164ef112c1b67
-
Filesize
380KB
MD5c12c117afebb23b2613a61b189700693
SHA1f010118963edd52308df203d9adda0c1346b797c
SHA256a5f03cf605565a71bfc9664330c7c76250186fe1cbd135b89e8f0595c8a74190
SHA512e323ba5812a4874ea98cf4501a30204e80c9955f2114a2d640061c46b1cef10c6f78fddd8c4b0768647aba1fdbc60016ddd1f2e4fb45bd0124deb64d580b3bb6
-
Filesize
380KB
MD53b8bcff68cadc79c7f5c01adc1157243
SHA156fcbf32a8b45f8735e5cb5ba73bf125f0d0234d
SHA256bd0b2ceb65ac7d3b86712725275903f39975d2095c4dced5bb8b4de7e982f7c0
SHA512d09913820cea323221c6a14eb5d3d1bd14cf5a28a730e5fe1ba19a18ed9090af8a152317aca2efe45b59d681d02a3adaa464f22596e208eca7f4b50bd40a7669