Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
11-06-2024 18:26
General
-
Target
2024-06-11_e5cd53dfd9d4625865b52742347b996a_goldeneye.exe
-
Size
192KB
-
MD5
e5cd53dfd9d4625865b52742347b996a
-
SHA1
30304db75841d5fa303c8f84e345780985ff4c83
-
SHA256
6efa5377b05d8c30e3f99e578f23615bea098710f52964feb1085a3e278cecd3
-
SHA512
c668afab0cb5b6ab095cba079b81c8571d5cb987d88a62b33ac692c1677884980d472340ec10c19c6a9aa3446db5b25bd586a85a680795046a65659c79f20fb8
-
SSDEEP
1536:1EGh0owl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0owl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_e5cd53dfd9d4625865b52742347b996a_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_e5cd53dfd9d4625865b52742347b996a_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{727C8E66-6CFC-4584-9257-E9D2B874ABCA}.exeC:\Windows\{727C8E66-6CFC-4584-9257-E9D2B874ABCA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{209204F7-0B0D-413d-B2B4-CDE22733B553}.exeC:\Windows\{209204F7-0B0D-413d-B2B4-CDE22733B553}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C096CD4-C5D9-4626-BFD9-2C643DBBDD7F}.exeC:\Windows\{9C096CD4-C5D9-4626-BFD9-2C643DBBDD7F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68993F54-6CA1-4927-B883-867DDB701B11}.exeC:\Windows\{68993F54-6CA1-4927-B883-867DDB701B11}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1610A64D-6FEB-4c5a-8DC9-667022E87511}.exeC:\Windows\{1610A64D-6FEB-4c5a-8DC9-667022E87511}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85542EBA-1B76-47f4-9B61-2C85D20927C1}.exeC:\Windows\{85542EBA-1B76-47f4-9B61-2C85D20927C1}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1752B51E-B54A-4917-B562-99449F59C252}.exeC:\Windows\{1752B51E-B54A-4917-B562-99449F59C252}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B1674AC-D97F-4d9e-9AC2-E310203F754E}.exeC:\Windows\{1B1674AC-D97F-4d9e-9AC2-E310203F754E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{864DB085-9236-4382-A0C3-2085DABAE57D}.exeC:\Windows\{864DB085-9236-4382-A0C3-2085DABAE57D}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D0725A0D-CFAD-4cee-9354-E383CD30F453}.exeC:\Windows\{D0725A0D-CFAD-4cee-9354-E383CD30F453}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FD004404-FC5E-4740-AE21-E411C91B6E60}.exeC:\Windows\{FD004404-FC5E-4740-AE21-E411C91B6E60}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0725~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{864DB~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B167~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1752B~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85542~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1610A~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68993~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C096~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20920~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{727C8~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD59813cc8dc77d4c18016a7c4582a27745
SHA1e7f4994cff2ead97964deb894f3f2afd0ce09b9b
SHA256a8b2139ed6530a7048cba863fdcb0fe65fdb6c729013edf81c244ac6e03e1bb6
SHA512d5ed5da6e027eb5ae75f657b19f1f3966a62324483595fdcac74d43ef5ce383242756216b2b2769f28f023a8a7bcdff81714d139aca659684aaa62430f58bc37
-
Filesize
192KB
MD50a408ececbdcbb9ca174c5128426a440
SHA150576f146930f575f1bafcf9fa42df45f6e9b82f
SHA256fa8e315ad71a27d3ef9a6a1142c9093e4878f696a2f130fc025ebe97ab390d12
SHA512d85eac66fbee8abca9b61741f11056efff2876c0237663111186bafc01c157a5eeab9c06709a90671c0cd560015b5f406d8dbe5313f8af807674916d16324eb6
-
Filesize
192KB
MD5b3757937e2e8ee58d0846c8bb2971b72
SHA13840c6b76e97f044dd04cb294c94d5bf9b21da15
SHA256a7e22297a860d2578a4cc8e9fc1f7749582629b9996a4de9ff3d1e75d1b66214
SHA512d2ab8367935fe9a8493c41f1473c325ee69d5ad5e03101e3ebb8267dc9408a2e291d31655992f9ab67cdcdfad1235d6baccfeb9f662aa4db1ab788397d75b14a
-
Filesize
192KB
MD52596a250b3c62666bc68b55287ae400d
SHA13011ca86382fbb1f0a9a5f9236c61dce266dd7d0
SHA25691dcc75593f45c5d2f469565d9621cbb2ce6cc36c52ea66c899dfd4760af72f9
SHA5128e4a0c7b92e934b5184820ef644b4c3beedf2c6c50ef780e5fec3611ddb990ca08de0205741b7142d19e856a26e4fecd2ef20128364d1e0c27dc7b044d798afa
-
Filesize
192KB
MD5cd73ca42ede536606dcaa7c85848981f
SHA1f433c54fc466b7df2b9af920c3ca31e4ec247c02
SHA256f2e2cc068269b9a15567d9a41be84ba2b951dea4cbfd3729e967764f5fb7fe05
SHA512af8ee4a41262540683db03e7ab9f3299748a5777e57f244ce6c9272ec0513577be928cff4018aebdb759e2f76d096932873766536ed022e4cabae3b4bf524997
-
Filesize
192KB
MD52d86289208c91a347a206fe0f88e4d74
SHA1c62a61471408cc22f448f95dd0229f43117fc6e6
SHA256774e2e4a4e479797378b88b6d6e842640758b89d24b8219abb19cd547ca8f9db
SHA51289e65ed84ad7663664df232705b72f6861767f21404ae32b80f49a322d727f3254e8aecc042d78e376ba93cb149ae4e9f6641c7872c4dc7300b5f1ae21c0e6b8
-
Filesize
192KB
MD5d838e9e7aabdc63d03eb8a8e5a422e64
SHA1a810b36e1675e8baf7c4a18c547bbd9b7c175dfa
SHA256331b521ba3d3afaee6d6da4c8470aa27f0ceac0bfcad01aefe8686b317e0a164
SHA512ef2f973ec48cbf16b23ce27f19056f479fe55f6264eb869b8924239ed5f266a7f5570147fc60cd9515d9076b3102649f4b20f2b522f68a765a1e1e43da80a0f0
-
Filesize
192KB
MD5cd4943300084dd0a217c118196dacee4
SHA14510cbb1a65accccce7c914adcca9aaf051bc6fb
SHA256498444ffd5424a1ef14c9d07d176797b8d6176d90ac83237cfeca7902cad6794
SHA5127eb6a17a9c9fd5cc9abc940dbfab94fbbc7ba248feb8775dfa9ddbdf4447f292d887c00b5710a46efde3c30199ca4532016969f742b61b58dc336ef2a13b6ab8
-
Filesize
192KB
MD5a3e7eb33a52c90ea432f95cbb9589a4a
SHA1c4c0b41ed00f2714734ff90603f195d31201802e
SHA256601b62876c083c4a4d384df4cdff217082ccab6ef2f97256b4e75e6a09c086d6
SHA51232d38761a35eb0e31da83758bacde0bf903ab7a8a0bd19933d29fa4b8570cc870827c24b674272fb23c757fec69baa49f5a605f467e19726ffd8948ae9c9fa52
-
Filesize
192KB
MD50cccbdd05cdadf9468363c20e0b9d5c1
SHA1232d5aa253054d77344d919e00e97ef38cce11e1
SHA2564a119ebe591950c03688e2957dd87b9aca9c327bdbf62fde2c79ef47ad9f1fe4
SHA512c879fcdc7664661e6d7c09e941a967ce8cdf45e5e27db3618d32a8b68f5928b7be7e4c33314bd7071831d885a661e63a20a01e924e3a258109a44dad1b184509
-
Filesize
192KB
MD53abb5f9063f395f0748dc0650a36239f
SHA17a108d71be66dd7c339b1a9e9596fa109e1c0871
SHA2565278b7f4aa300e23ecdaffd1bffe41fa9b036debb3ca98012aa52e1e204df02c
SHA512c4f72140d117094f8383ac4a2df006294a0c019a67d382f26c7c481249d3d7ad9be0fafb013311352925ea8be3fa05fbe3a72eddbb850935cc35c59ba19242b8