Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
22-05-2024 21:05
General
-
Target
2024-05-22_de2fc918cceb98699d3f15fa118cce3b_goldeneye.exe
-
Size
168KB
-
MD5
de2fc918cceb98699d3f15fa118cce3b
-
SHA1
74a5c3b7e9b16302e8130019b49d742815bd5110
-
SHA256
62cd6866193905ba7615c62a89c649792867976636822cfe3db07c5f3dd25442
-
SHA512
73b2b797dbe9d744eb1d22773e900872fcdaa1c1caa5daa3c419e194715a67fd751ed578c5053322da8f13d244f986aae29de665bc1799172c19c54fe0df3fd8
-
SSDEEP
1536:1EGh0oplq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oplqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_de2fc918cceb98699d3f15fa118cce3b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_de2fc918cceb98699d3f15fa118cce3b_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{061E5094-8495-4ac0-B5F9-D7DB2553E514}.exeC:\Windows\{061E5094-8495-4ac0-B5F9-D7DB2553E514}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BCF9025C-BFDF-4c69-9A29-0AA72DB4C92A}.exeC:\Windows\{BCF9025C-BFDF-4c69-9A29-0AA72DB4C92A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{764F17BA-373A-4a53-A438-C4C1575F2598}.exeC:\Windows\{764F17BA-373A-4a53-A438-C4C1575F2598}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3298AF5B-E95A-4f34-BD07-3CDC1C974211}.exeC:\Windows\{3298AF5B-E95A-4f34-BD07-3CDC1C974211}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02D6E290-E341-40a7-A8F0-6A30ED4F3022}.exeC:\Windows\{02D6E290-E341-40a7-A8F0-6A30ED4F3022}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71C3DE24-83E6-486c-8061-3D34509B2A7E}.exeC:\Windows\{71C3DE24-83E6-486c-8061-3D34509B2A7E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DDD45CFD-B1B0-46ae-BEC6-7E36B712DBBC}.exeC:\Windows\{DDD45CFD-B1B0-46ae-BEC6-7E36B712DBBC}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{937F4A65-0EE8-45e2-B237-64E27831E928}.exeC:\Windows\{937F4A65-0EE8-45e2-B237-64E27831E928}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0AC27D1A-D800-4090-861B-63251C83E7ED}.exeC:\Windows\{0AC27D1A-D800-4090-861B-63251C83E7ED}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8A01A12E-6F56-44fe-924F-84CBA3484C1F}.exeC:\Windows\{8A01A12E-6F56-44fe-924F-84CBA3484C1F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{65824847-8009-49d1-95FD-87718ED5FBC3}.exeC:\Windows\{65824847-8009-49d1-95FD-87718ED5FBC3}.exe12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A01A~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AC27~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{937F4~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDD45~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71C3D~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02D6E~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3298A~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{764F1~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCF90~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{061E5~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD589d12916509e75496add3299bcafd995
SHA1de26d9c828743687aeb45f9a29dc53e86bf6a8ff
SHA2560934cc6c8560d055e0c253f01a005e4c7c92adb93e5eba4b09d152e3430827ec
SHA5128e4d311a5b52adc362d30f1733f2c1ae24c05f0ec681f1d77cdfa0c93f9252411bf3a30530f6310421d3899965a005d9fc33f82bbab5406909277eba79138cfa
-
Filesize
168KB
MD5105e97db2f7b57c092da154943e93c70
SHA11cb3859cd064f8228543b7b9e1585b659449eb4e
SHA256820b72cbc012f50aea676d16581508339f3f4cafd5961aa6e020a032a9d837c8
SHA512a4a8bfee9f1bb05648b326d288fea61013ecd333b4ce5deae39b877551c1c8c0ed517bcc2c12e8c415d607061ecacff9c0af35b9acd1fe4a199c5ffdaebf1fae
-
Filesize
168KB
MD517b31331721bcc648ddd193648aa7e53
SHA181fac2a6c0564aa9d062425aa2752b734b9b7e08
SHA256b13e3053253dd0f95a7a1eb4ef0f4d168b8e68298a3ce961435808f9883e4555
SHA5125a6beaa70726d03bad1517ed669fd741ab3697aab718933cb7fa19bd93947dcd88da479688ca49b32a21ad329a24345541090984d0118423dfe9a5dd1910da81
-
Filesize
168KB
MD5420fc7ced8107c86e8139b4a801bda15
SHA10e3f5ba7f8169a6c852082d59b22132357650950
SHA256171e4f41704b612b2c0179d44b8643cd66609572b318954f613f1b22544a02f5
SHA5124251a024db527067b510f4310f3c28ab075b5fbdf496b17d82a5cc88765c08a645e968aa55c1a372f9a735258909090a1eb4aebba75cf5167d9c93276055115d
-
Filesize
168KB
MD538c186a553457d02e4254b26010a5c67
SHA1890a2ab4a389bc4ed1263d055e0477c19f8358f4
SHA256b8d7019648f941acb8481d4880d1945e4f7c5652e30ca15926b7d743954301e6
SHA51224f664680ce2d29f75876abf63f4cd46950d0448cb2f6965a6dd0a997b7d45d5d8e4b7df6521cb727e22f44989909e344fe8151279efd7e5337d1d109a962c3b
-
Filesize
168KB
MD532ef5fd0bde8d249d958fbbe6993c190
SHA1e606fcfd8c044b89bb3afd83b18cff04947b05fc
SHA256a477a79a8c7ba2def29c8ae042ee6d8623d4e7be43f7bba8f7c91aba68e8fe5b
SHA5123a1fd3974899f2a66385443b3d58bec7efbc22bb76c869b70c9cb39202877794f5f8e6e6be37df4e9579fba9b5aaa6b42241ff9d947433c74027fc832e31f8a0
-
Filesize
168KB
MD5654654c9bbb4faabb15bf135bd396d6b
SHA116ed6feacaec87534636e578d6cd6e96c081164e
SHA256c34d3596118d18c637624520ab0f3bc00943661b14efa630247e08a8cd0bcf59
SHA512fb3e054ed4322886d1953bc98d03c3e9be1478e555ae1060b583b5b0c3fea7580cc5ac28f41eef2ce06e11d94cfea7b3b0a5e3ffecf39a0f510e9861862d6173
-
Filesize
168KB
MD5e4da62aad8158304b8504802f9cd3499
SHA1ece741ce26383d06f388a7ccb9e1446b4adfc920
SHA2563f0467c6850a85658c14684cb8588ea12cbc5174353b85ff531fe76853321ee8
SHA512d990ce5495ef5c7d4adda23b2f9fb919b149a20669363ef7ac946b810f9813c519ed7866606c20d5aceab8051b78f59d4b66e9f5f3da7c822c626bf00d082276
-
Filesize
168KB
MD597756e8bb2154f84142695094f1e5979
SHA1f66780a39f1331f2c64f310df7b014487764dbda
SHA25602b6384348df3a4186ec7cdf121cb4c783b0b1f76cfd4f77f55aadeb0a3b5060
SHA51260723a416c30fd93ea631188edf5196787cfe34c1a580cb618ef5aefd3ce58bc3dbbe21c4b8e8d1f79c37dcaa2a56b6408c1a781f7b70df47db21a54741320df
-
Filesize
168KB
MD5bfaff97b7ffa15d931abf9e256bbf87f
SHA169772de0948ea360fb6edc54db113571c3352fa5
SHA2569706c70d14fb56fabb7ee98139a80a8a6c8dfa702ddb12f5936e7c14d600a430
SHA51210eabf9221147954d2177f7b457f97cbf19c49a5af21b54cab95206347f2e0248395a7dc08d4176ec76a3206279fdf15215959824cd94b961f578c2e282b35c7
-
Filesize
168KB
MD5703eb5937f8d631b931c49a58cf13acc
SHA1982da8aa2c67bcc127f9579c983de46dc1d2d718
SHA256fa591a629d9d1121427c2b995284b28f92989e209d496646c358c20ad5ff0606
SHA5127e4161874c3749e8131be17ebde23110d7f15515f3bae9135b79c3e7bbf5a256469be0308c6bff10ba0e63fba6725de416c561d0cbad5f729240473fc51f7712