Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 03:44
General
-
Target
2024-05-22_18b5b21bd8f7dd6fab9e31343ca249b9_goldeneye.exe
-
Size
380KB
-
MD5
18b5b21bd8f7dd6fab9e31343ca249b9
-
SHA1
d12421a811622b8015efa619419f5fd3ce4eb2bc
-
SHA256
5a861468f261c6de09ec5e0836a607df7fecaa4252503b6ba15c90e91e4d7105
-
SHA512
f9aa43c8f8e64627d4c2a215a6b2b43ee5b003be35b693f04e04b6f199c03ca8a5bb7e978fbbb0444e80e5e9435abc7032c61e98501738965d2424da08a783bd
-
SSDEEP
3072:mEGh0oRlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG7l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_18b5b21bd8f7dd6fab9e31343ca249b9_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_18b5b21bd8f7dd6fab9e31343ca249b9_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B6D25C7-92C8-4954-8FCC-92BFD6B990E3}.exeC:\Windows\{0B6D25C7-92C8-4954-8FCC-92BFD6B990E3}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5721F822-1EC9-490d-BEE3-D647854D6989}.exeC:\Windows\{5721F822-1EC9-490d-BEE3-D647854D6989}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6144F0AF-9604-441c-92ED-BE523E5C94B1}.exeC:\Windows\{6144F0AF-9604-441c-92ED-BE523E5C94B1}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1014D08-BC46-4d4f-AE87-B8AA89DF76CD}.exeC:\Windows\{A1014D08-BC46-4d4f-AE87-B8AA89DF76CD}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AEC6959-5E84-4a89-AF7F-0F9FFC5B92AD}.exeC:\Windows\{1AEC6959-5E84-4a89-AF7F-0F9FFC5B92AD}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0603DEE-60F1-41eb-825A-CD615E795CF2}.exeC:\Windows\{C0603DEE-60F1-41eb-825A-CD615E795CF2}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C070204D-5A64-418f-B2F6-FA5B89127C63}.exeC:\Windows\{C070204D-5A64-418f-B2F6-FA5B89127C63}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F4D8EA8-B58A-4101-8E2F-73179D7B93B9}.exeC:\Windows\{4F4D8EA8-B58A-4101-8E2F-73179D7B93B9}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE098086-CFED-42c6-9901-CB397676562D}.exeC:\Windows\{DE098086-CFED-42c6-9901-CB397676562D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{299556AA-CF46-446f-8357-AD6ABCD191EC}.exeC:\Windows\{299556AA-CF46-446f-8357-AD6ABCD191EC}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B865C9F0-F8FB-40a1-A55C-569B706DAAED}.exeC:\Windows\{B865C9F0-F8FB-40a1-A55C-569B706DAAED}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{73E0A065-7A64-4bc6-AFC1-B120FC2D5B10}.exeC:\Windows\{73E0A065-7A64-4bc6-AFC1-B120FC2D5B10}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B865C~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29955~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE098~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F4D8~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0702~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0603~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AEC6~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1014~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6144F~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5721F~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B6D2~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5444152e4e26e8be3229ce32a3d2549d2
SHA1ec4d878d18c7cf491f4f03c4917ae79254608585
SHA256e17b083b2617adba79a5e018cd33445bf4940e0273c97dc713a394e85b1b0a6f
SHA51288fade47a3698d55d3a5cf59c9eeae660cada894ff0e2dd92bf1bd75f93283c746f6d6089115d4e607b6142c921ebff5e6c13c7f1f73bcc5f5b63b3a80ad470e
-
Filesize
380KB
MD51021a5625b06f2a71498cdfa71c2f7c0
SHA1eef299b8347bf9ee10ef8aa96826b73c9827670f
SHA256c72dd1ff50095c02106fa8ec223134a30b85a4534670cc8a2e19455b97015385
SHA512c75857e2298317634f6acf59b014755102fde169e557e0a52385a623f8246df07b49ea20a16b3a390ddafea68c45f1c7b35326942719b44c65d73aa61c5cc5b9
-
Filesize
380KB
MD55f4a7fe1ee1b9cc7f5d70fd2d7a4b50c
SHA1eae4c5599d0f72db075d2e8b527319191e4c2afd
SHA2562a9044f6b0c7c45fb65c81c698c6dba3838d5ca61392c16117293e77b39a0663
SHA5124e4ba75c590755fef6c6134cc0e86adc49bca3b2fc93600a04469fad9ece292eab657b92988d50ca3179f1bcf1f8f2908c43ae8476ded94c5b515950e564a51e
-
Filesize
380KB
MD515d8403e1aa118c09bd3d11e736227fb
SHA1e2bb9e8a3a2ec256c57cac9279ead895813c470f
SHA256a8c9d5e71c0e25fc1de34c7adb27179e9cb295f29a8a9d6bc151da5897dec6e3
SHA5122f277c5f78c3130574143ab6fedb8b2a6c522daf3eb016de28a5b33acdee74e8498ed1772fe4c0fd3107edcc49504376f1c758cd5401c7ca5cc4ddacc39d0c75
-
Filesize
380KB
MD5290d6642d8c92147fc37db8191a624e6
SHA1485fde008fe9b19539d133c5ace3ca457f22671a
SHA256dea3b6da4aff744f061389d13e7eb33975301fd26efe0544ef42c706b2665cd1
SHA512509a9a259a903b4234d8f01d0018a45b0b42122166318b8c57d584cde7d3a2dce3c0715125a3ad270785be903e625aa5f77c291f4c9565dc536fe9263eac7d35
-
Filesize
380KB
MD5d565a7d0d6dfdffb54b6accbad561003
SHA1031fb0f20a6ec1a5f83e8e63fe17534b715d03c4
SHA2566d13f359aa4914bbdcb159de85ce3591ab5e98aa689d5f250c7fb62a0af99c4c
SHA512c1e0d6d6f98046f5ec55d5f58a67471e7452ce0b5abcdc2e34c2eec1032073f41f4caf746c0f9532da99282bea75f3400f4fcd5fc4ae885c84dc04594fc85bb1
-
Filesize
380KB
MD5248598c910bb37b004eb7ade196897da
SHA1b6590a0b6393c8831463a29bfb23df8b37544b40
SHA256f5ed3f11f92127f249a49dbb04a7f8d970439c30732d69d2c5055e62f8bfd4a5
SHA512bdc7c0e0975682d4b3547e80b7533e66aa3e310d4f86689993c26f4664c4b67d1d5bf27acaa7b77011e74531d41ed2a72c0bf31ceed82e0525b241e0c449fff5
-
Filesize
380KB
MD5dc40ec8e5c1d2fb29351e8a67f6f3eb8
SHA1cc3c42872e744d0fb4ee12bf24afcaa6a5141d43
SHA256ee27bfd30b73b1e3dd0536a01a97e9f33407b4ce6b040369c5dfdde9232417b9
SHA512b67e8245bc43ba5592ea387392380dab71a35e3d584a2956b35e9975cb050f27ad5fc8acd81df091f458116d2c1a54b097babad2589f4137955f5f1db1b6e1bf
-
Filesize
380KB
MD53a010d86f4cd37a82b399a84cbd56dc5
SHA18f102118694df440a34c93abccda3b38020f757e
SHA2563237abf27b2f5dee54b3518330b986649659143c01130ef875103dfccedec9e6
SHA51203b245e3e3d5b6c2c7be4ece3eb030fa8f334d43ca94e42de4127a842c0c6768a8ff8c4a436cff0e0358ab616657acc221c6bf23c94b476e094341e7e22d8e77
-
Filesize
380KB
MD5655d45812220f49c57089d80c2bc4651
SHA1a717988f1d89ee2e08f1de9b52291647aac386da
SHA2562529a73b8a81cb6050d4d628248f84e6dd7dee1c4f250406654440748c977457
SHA512a3731ec43ca7f5d576d8cb48c7cfeb32f84ce9676df9ef26db9e84eec72362b15c19185ed731eb99bb90750fef1572aac26cd3bc976dcba21fe599b010188857
-
Filesize
380KB
MD522201021b7e22e45012c034f713d8ebf
SHA119721f6b32453be7848097369efce5961964cb72
SHA2567fb264f0a30bf8f030e0e90ce4020750551565e28426493923743fe127a74ad1
SHA5121fcdd186400dcda840c978be305c74be392b81dcd1f8bdb7e8573f395c0780179a4780520849beeebcd725a825c0466e0a39d7952863bf398a52487e9824dc5e
-
Filesize
380KB
MD5fde91f562225128da726242b2e8125a2
SHA1ab429aa6676ac0e5ff14c02738f6dc86683bcafe
SHA2567e4be634a90cd0c0b8a662815fbdb33d234a420e62d044c7095236e44fb85da9
SHA5122525466e33daea1025063cb832963753d24f258ef0805f197c2cec04477450c8b4a27cf3c7db41b7e5317d3b42b32e89fe7ade6da1c61cddd255e6790cce4d6c