Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 20:55
General
-
Target
2024-05-22_5f208f387c3fe70c261e333cc1be3e6e_goldeneye.exe
-
Size
168KB
-
MD5
5f208f387c3fe70c261e333cc1be3e6e
-
SHA1
e2978e6eaae16cea813da6941ec90e8d8eea7fc8
-
SHA256
63efae601c02303208faa5de329f051dd0ac4e2fd081f232a3df21733aea27ad
-
SHA512
3b22be12675e214b935adaf3826caf248cd06b72696b7a9b2474d0fbd1bd8845d324ed63d60a43a1c1af9a30f6098774534762d1bb2713c8abb47c6c7b5190f1
-
SSDEEP
1536:1EGh0o8lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o8lqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_5f208f387c3fe70c261e333cc1be3e6e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_5f208f387c3fe70c261e333cc1be3e6e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{468FEC8B-AB12-4e03-8162-AA4B9F620183}.exeC:\Windows\{468FEC8B-AB12-4e03-8162-AA4B9F620183}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEE2960E-21F9-4263-AE7A-AC72A76F5612}.exeC:\Windows\{FEE2960E-21F9-4263-AE7A-AC72A76F5612}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{960792B8-F07B-409a-8531-EE5B438713C6}.exeC:\Windows\{960792B8-F07B-409a-8531-EE5B438713C6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F7A77A2-D1AC-4e5c-AC27-9BEAD961F9ED}.exeC:\Windows\{9F7A77A2-D1AC-4e5c-AC27-9BEAD961F9ED}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7B62F07-11F0-4681-A345-FEFD50CB29FB}.exeC:\Windows\{F7B62F07-11F0-4681-A345-FEFD50CB29FB}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5A30CC5-B0FC-4474-9F16-BC4D86DC5A96}.exeC:\Windows\{D5A30CC5-B0FC-4474-9F16-BC4D86DC5A96}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7809B9D2-2357-48c3-9565-810027557ABE}.exeC:\Windows\{7809B9D2-2357-48c3-9565-810027557ABE}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50460187-0768-437a-9ACC-FBBDEE072042}.exeC:\Windows\{50460187-0768-437a-9ACC-FBBDEE072042}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8E312CE4-F3CE-427e-9E91-DF0918DFCD76}.exeC:\Windows\{8E312CE4-F3CE-427e-9E91-DF0918DFCD76}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8FF03EBA-F750-4f7a-8E7C-67E9AFF360CF}.exeC:\Windows\{8FF03EBA-F750-4f7a-8E7C-67E9AFF360CF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1174EAF5-4CCF-4b37-96F6-0B452FFB7874}.exeC:\Windows\{1174EAF5-4CCF-4b37-96F6-0B452FFB7874}.exe12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FF03~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E312~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50460~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7809B~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5A30~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7B62~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F7A7~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96079~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEE29~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{468FE~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD52af81fea141eebfbce0df26e872b40ad
SHA10237042800284358aafef1d1db6f1619511acfa0
SHA2564b8f8eab1c42f24df5fd98227225bbe813770df9bd402871edb49eeec59f64cd
SHA5126aba83a23e2304af7d195a29cf07f9687a99aa8216e123a88b5ed7028f1a9e08dd65c01e347a32bd5b9b51cc80008c240774824475f5e0c55bcf2b22afbbc84a
-
Filesize
168KB
MD5e15026d1121c92f4cbb3f3b9e3b47cb7
SHA1fa72592d35eeea19855f8f4ef93ca8ccbedb2be3
SHA2569fba6760365fc4a207a1c7b13f4f7a7053f9fa96cc010a6d4d14479cd89eabd7
SHA5120c18bfc37d47ef6191f25dc89d8f5d90e6183bfd829265216922d28cb55749258b6121bf628a683f4473be02c32f463768abc0e2e3f0e9d0a6c4c103ac009ac1
-
Filesize
168KB
MD58a814e04d568cf2ce34561b80b1c50b6
SHA1048873109af6f99e1dc56a01e62a6fbc2eba0bb7
SHA2565c53c12de3e5419866dc6e0bcb637a5bed45f4825a330ab6b2d9adc2b5aeb772
SHA5126e3751564830e53c6d5ba2700743925832737f68d64867da2ab8029f2dce722220b5ee1a55b0a21b3269ecc2d8c317f1612d4caf473adf9dcf98f43459724005
-
Filesize
168KB
MD5c583bd2889a4647ab5ae5047ce6c9bc9
SHA1f0dc0e03b616f8929be7710685ef18d67007c7f4
SHA25683f1dc98540464f4ed3a97cf0240c40cd7a6c20c2a13f8f7dc74cc7472aeceaf
SHA51231bbc3b0287a23c5192f1663249eedc903a8e106404003fb248aadc419a70d60b006bd8440c1b0eabcff85ecc965492a5482f23a737c9fa1cd3e8802b7d7cada
-
Filesize
168KB
MD531a189dc9a29b7ddf355a9ef50437b97
SHA1276878354b63070172c23c34a07cdc884ccb9b53
SHA256b4617057995e4721b2ec2e571f29d1de9c3b760d61746515f8a62c6fdf54f1eb
SHA512527e1f313f8cf9702cba847b541e935098d7743d3ba31234228cd5ec6903fe6ebe9da008d2898fd6de8788c0e15b5f196796709a77ac587cd9e7a16adba75ecc
-
Filesize
168KB
MD5f83524780a8904b7f170799883c537e8
SHA1496c50ae4cd2ec46c0b18dee9c163b55a4e5f4cb
SHA2567d1eef2419bca062b13859e3ea65683464d072f3ac6b8820fac03c4d48b0c24c
SHA512ce32469eab44d916d33f3adbe714ef6646909208572973f2450c44037f6a8a79acdbaeb8ba309e4ebf7eab0ddf367a65e8bc0ccd8eedd643f018aadebed12845
-
Filesize
168KB
MD58f04a341e4ccdc305975317fb66900de
SHA10e918421340d71d8e39b025a4c84ba854830c61e
SHA2562c6c4d9cbc8fa4a73e61b9a17b946d67800380298474d4b40f07175b16f94132
SHA5128148d4953942780ff81158aadc892023b49e212fba4a15c54db7b5d0479c350ac6a7a14147be7ba1e8448fa48a7876ef22de1d51d1ac5688c7d8cfbb56f417c8
-
Filesize
168KB
MD55c01170b9efb2e50363108cd87306ee4
SHA17d9bed92d66a1e091f7107f29e89f425898ef77e
SHA2561792abb4442a77115f94549de1feb0fec5dab8b9fc778060186a61b31d372154
SHA5120f64b1e051231ca2a295e7722983db6c99eb31326446f1bfaa8f0fb300d6ba63c639f99ad9331c969964e2cd3ffa641bd9ab6a98e1475d7017cefa0c492827de
-
Filesize
168KB
MD5f0c5a75ef96ef9a00864e3692f1dfc70
SHA10998c764f7d7e0af6d1ee2c3a8459f2397f53622
SHA2561194acf7e2fd60e4aca113dc1d3d04461dd3e2a382280b1e8a085e6f51938a2e
SHA512b6e7f71ff5a80b6f856e31a84ae0a768d812f184c0d8ae677411e55700834962b82e09c03fa09de47e3a977299a511f091c15a2f49afc414d7e942a6185a103f
-
Filesize
168KB
MD59612d53795dd68d810b92397f898165d
SHA1e622c074669e9e50a38c670d1b677cb6484262f9
SHA25661d0064972efd72b2b29917cb1958c6beff28a0c85ac52043071a6b89b40ad30
SHA5121e13e909ca3fa096addf1d6c47728d2253d05543bb42bcc1adf79f466978c2eb92de5905dc53a34ab461696a7f6e23114bba65f34762b7deb7956e5bf4359c27
-
Filesize
168KB
MD5cf41419ee63d29c38944b437553fd33b
SHA1516525d5c31b5f34d613a0844286154e57a4f8a8
SHA256a5672e9b198ae317cea55f0f8bdd8fcdadb0a78c3358bb8f90884590de8b2e37
SHA5127be245e0799e4f3497996ac24e1445971cb08b249388ffb5ceae6a29ee8106268b86e7e7b79f535a1ef9b1111cbd2a55397a1de0ea102d0d98285dcb2a3fabd7