Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 03:47
General
-
Target
2024-05-22_3480295d4e449a8897d32a9760a2c882_goldeneye.exe
-
Size
180KB
-
MD5
3480295d4e449a8897d32a9760a2c882
-
SHA1
0e37af742a4d29d767527f2f267b82e2af391e99
-
SHA256
42ce85f9d05ea1ef4f8679053217fa684af0f466a68da1a517649ae5e0ee952b
-
SHA512
0b13da85699c3d910df00a298e460a1803a84c03aac726914c21190ac09f71c59b0a609f79cce1e61ab4ba1e18a6bd4731910c02a674e8515a7b0f9a3615c897
-
SSDEEP
3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGJl5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_3480295d4e449a8897d32a9760a2c882_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3480295d4e449a8897d32a9760a2c882_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1660835C-3F17-4f3f-A2BA-81133AB619BA}.exeC:\Windows\{1660835C-3F17-4f3f-A2BA-81133AB619BA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4180DEB3-7A40-4c81-9B60-BC3934AA9149}.exeC:\Windows\{4180DEB3-7A40-4c81-9B60-BC3934AA9149}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C81D9165-5047-4af2-A90A-644377912C9F}.exeC:\Windows\{C81D9165-5047-4af2-A90A-644377912C9F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{264B8913-2DAD-4d6c-BDA1-D671CC7DCACC}.exeC:\Windows\{264B8913-2DAD-4d6c-BDA1-D671CC7DCACC}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81A6B338-E07E-4dbe-803F-8315F064E03F}.exeC:\Windows\{81A6B338-E07E-4dbe-803F-8315F064E03F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A74B22F5-1781-4f25-B82E-4FE797EF69BC}.exeC:\Windows\{A74B22F5-1781-4f25-B82E-4FE797EF69BC}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E82669CE-7122-4854-9985-CC409D0AAC10}.exeC:\Windows\{E82669CE-7122-4854-9985-CC409D0AAC10}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B21E2B5-F7CF-4264-92E8-2B6B9BC46159}.exeC:\Windows\{4B21E2B5-F7CF-4264-92E8-2B6B9BC46159}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39E1F2CF-7139-4e8e-99AC-C34DD0575385}.exeC:\Windows\{39E1F2CF-7139-4e8e-99AC-C34DD0575385}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39340979-D4F2-4c4e-8DEA-77FAEDC53A24}.exeC:\Windows\{39340979-D4F2-4c4e-8DEA-77FAEDC53A24}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A9D35F0-1913-448c-BF58-89FD4E4035E6}.exeC:\Windows\{5A9D35F0-1913-448c-BF58-89FD4E4035E6}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{476AFACB-449A-4919-B9FC-545D31BFBF46}.exeC:\Windows\{476AFACB-449A-4919-B9FC-545D31BFBF46}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A9D3~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39340~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39E1F~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B21E~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8266~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A74B2~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81A6B~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{264B8~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C81D9~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4180D~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16608~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD51447b80f8459525ecb478e5a002fc939
SHA198093da976c046a0deee6273265524fe0c7a1db4
SHA2564efd2271d314472320b5be533573d86f53474eca9cb7b85490293c8fc903171e
SHA512e927f359f106364e4b86781becc3d5b4d4401acc256e8edf9b28809763c52cb53eeb6df0c5eb1bee73ce5de7003ea5fa073e17a6db703c7a03ccd191f25db366
-
Filesize
180KB
MD5058407fe43811aadd8d15e5178572bac
SHA100616a61d2f8ea0e37b6e73431f0e60c5198cdeb
SHA2569d4f429df342bc244d369cc25f52dd61c644006d126ce1e0691362866bc9bbb2
SHA5122b1d85bd6be66db20ca1285208f3a6bead96a91e3e7c84cebc84da5c4161a10d28134829b4d1a6e480370729d6e54c9add90511dc99b7bcf74cdb295fa495ebe
-
Filesize
180KB
MD524eb9b7d5af1d889a799c12150c9e6bb
SHA1bd53000478aa34e44e23dc38e5f1b760da62e21c
SHA2561851bdbf72ac2d0344f5a1c19f51d4bb0f626ba217ff9f7b89da2a1c82722718
SHA51215cae659a0d97747b573ebd2181867b4da118572b916b77f035d5c210e6e252ede8fa1e528c5551ffb081100b6349f7db16995cb872d910131cc989df1c27139
-
Filesize
180KB
MD5b98ec67bbbe3961c1186a97e8b98881e
SHA1ed8a46b1b581e4990c263f2b28283946c7dd8b0e
SHA256356192458c42313b91536da80890fcc2fc2681e0fe480fc2cabad33d8aa96347
SHA5120cb74b047fb7117ef77f9b02f27b20a80040fa534213a56dd962cf41b5ce4be1f23bd7b7695c3a1ee55037eb59bafa711b49f42e73300adb5a281143d74bbedd
-
Filesize
180KB
MD5c07d7bb79740fe1022e4c8f29c2ee9fe
SHA1def022b12713ea7d0e15a6f87a811a7995dcdb46
SHA2564aadb80fa2a3c08ce82f3497f47d85a430c34b43f11e12708867a17a8d8b013d
SHA512fcf1c20ef30551449e3759adb01b6e7bef889682f1daa2ab5237e9d1bb7bde6b69c8055d955425896587250ce94727c6d6788f9bd063eebca5e0d45c8c2dc0c2
-
Filesize
180KB
MD59494d83ef7b3356f27c2056d3eea4511
SHA1348d6222fa67928ac226e5efdbb5ebb042d0768b
SHA256107ba26f6a4335fe0bbe8fe1f6d6bf134d88fbad17361df9b6ad9202168a9a09
SHA512c4e56d2b988c4352bb2a2d859e3199b4286de62c01c9fc701b9836d4624dbbe4a7cea8268afe4b9ac364f83af6d4f7dafc8977ae159f6b1d2d54fb67e5714d22
-
Filesize
180KB
MD59f941d1385d4e09079e6c3a778de27d2
SHA12ce07d1636c0b74e087c0c3765ce5fbae0842cff
SHA2563149a7a03ee24c9487388d60b0b9fee595d399dc1c586f3b2596336ee6ca55b4
SHA512e87bede64ac34b6817e12b2e09a56439fdd3fa008d9ec0ea62aec2bc58a1c2f7d16822b8bb6f87360da6a86df5befe5b7437a43102b6a10cf5a0286a94e86dcd
-
Filesize
180KB
MD53f9e33dfe9a0b121d2b9171cd303fd6d
SHA1616c578d6b9e0eadf7dd6bbe9544fd24c96d6da2
SHA25613fdf0579e10789892210101c781ce91bd01be19aae6755c00310788c651548b
SHA512b862201003d2620d2cc6fe5879cd99db8f3763dd2d57fcd75335c397e5f95a78cc35480589cbb279c1834e435574dd24ea7e40b7949652ed4ba0808a8933876c
-
Filesize
180KB
MD597e112b3b0db85e4d2abac09e24c5d96
SHA128afa36556c10586e05b8ae1eaf4cc4174b5ea32
SHA2567ab2f30d379e57004d0e08c017904a69270c6e0c1085c28fe63001563a857533
SHA5126a4ad9eb76eaaa10dda1d3633b9a9e239cbeeabf11db129b85198ebf9a0d2cfb5c3951dcd5803d2a6f592ab9ad1cfcb4d4be794f81a443f22234358f7c370cb1
-
Filesize
180KB
MD51e75ac423dc8e9732a7fa79472b6b1a7
SHA183611c01391805f8af26dfb55b8bd2e0a7eb9edc
SHA2569f9d4afc24e9801ccb4dc1d0e150028531f48d135fde105a4e3094435a6bb1b8
SHA51244420f23dd2b6ec9ceed6e1b79367f8a8b4a44eeff2f2f5175bee6a27bba37e95d99687d7a3dcccf898e13b506a73b80007f864eca21b7d5852825676c1e7d90
-
Filesize
180KB
MD5d2c1becfd7d4132775152abf00f3de4e
SHA17346f46fc23a82bba6ca905866ce359ee294b265
SHA256e89a988072edee66d8d81d643a0ea579e7b893d35cf0dbf167a0a7841ca100da
SHA512666e5bb63495d006843c443758ce43c7dc393ce288e843cd31d62bb8a4016bc9d914f476d886e83044d4e611becefc5299f695e37ba8c88ee1fb62f29d98fbec
-
Filesize
180KB
MD553ce2a04414c9de7485f850c274c0dee
SHA193a08d8d3348cf6962237b5bf0b711b5ae09f384
SHA256b876afa811ebeaaa1fcfb00ec1b65754ce4056e747023ee817dcd511c716ca18
SHA51274c738409000b5d093311d954f3329e109e218fb57668cdbc705b843147c40d3eb6ea02c391c002a1c10bce4eaac9c205edfa9830bffd5edfbc667d02abb8527