Analysis

  • max time kernel
    149s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 11:49

General

  • Target

    2024-06-12_66182377f7188dad8ae4d1fc3a2df772_goldeneye.exe

  • Size

    344KB

  • MD5

    66182377f7188dad8ae4d1fc3a2df772

  • SHA1

    a56b8a187405e47778c6d647d6a3c88992bc6ab0

  • SHA256

    904147c27963f3c001688455bbd6deea0a3cfa28e20ad908578887709fe828ad

  • SHA512

    c07ff812870c82c4851a49f86d931420e71f77f731283fdb58e9fa03968a14c7145b773e7d6709d9efe23b327f7ae8ab16cb47c9c4cd941ee58758c5a8fa2b5f

  • SSDEEP

    3072:mEGh0orlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGtlqOe2MUVg3v2IneKcAEcA

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_66182377f7188dad8ae4d1fc3a2df772_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_66182377f7188dad8ae4d1fc3a2df772_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\{558504F3-EAB7-4abe-B41F-9B37FE62640A}.exe
      C:\Windows\{558504F3-EAB7-4abe-B41F-9B37FE62640A}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\{32C4C9B6-475C-4323-A153-DADA05AA4762}.exe
        C:\Windows\{32C4C9B6-475C-4323-A153-DADA05AA4762}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\Windows\{2E7BAEA1-015A-4659-9954-77313B7F771E}.exe
          C:\Windows\{2E7BAEA1-015A-4659-9954-77313B7F771E}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4916
          • C:\Windows\{B6EA3EBF-1B22-46b3-B8C1-FA7589AC4FEF}.exe
            C:\Windows\{B6EA3EBF-1B22-46b3-B8C1-FA7589AC4FEF}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1720
            • C:\Windows\{200D8153-9EF4-4400-AFB7-DFAD7E53E387}.exe
              C:\Windows\{200D8153-9EF4-4400-AFB7-DFAD7E53E387}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3860
              • C:\Windows\{1D990A98-00BD-4d1e-893B-68FFB48BE673}.exe
                C:\Windows\{1D990A98-00BD-4d1e-893B-68FFB48BE673}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4456
                • C:\Windows\{E814F545-7F3B-479c-9393-03A6B8122C61}.exe
                  C:\Windows\{E814F545-7F3B-479c-9393-03A6B8122C61}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4880
                  • C:\Windows\{0ED4953E-9180-4697-B3F0-38200F798114}.exe
                    C:\Windows\{0ED4953E-9180-4697-B3F0-38200F798114}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1220
                    • C:\Windows\{4DE175F5-3650-40c6-867A-D9246683F225}.exe
                      C:\Windows\{4DE175F5-3650-40c6-867A-D9246683F225}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:5048
                      • C:\Windows\{B3C88C07-E324-4e00-9744-969BB0863CBD}.exe
                        C:\Windows\{B3C88C07-E324-4e00-9744-969BB0863CBD}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1040
                        • C:\Windows\{A7A0B0DD-A362-4812-A8DA-84A5F2299E89}.exe
                          C:\Windows\{A7A0B0DD-A362-4812-A8DA-84A5F2299E89}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4364
                          • C:\Windows\{E2083DA3-DA7B-4757-8AD5-D448A0BC179C}.exe
                            C:\Windows\{E2083DA3-DA7B-4757-8AD5-D448A0BC179C}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:2792
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{A7A0B~1.EXE > nul
                            13⤵
                              PID:2780
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{B3C88~1.EXE > nul
                            12⤵
                              PID:404
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{4DE17~1.EXE > nul
                            11⤵
                              PID:4380
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{0ED49~1.EXE > nul
                            10⤵
                              PID:3588
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{E814F~1.EXE > nul
                            9⤵
                              PID:1448
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{1D990~1.EXE > nul
                            8⤵
                              PID:3416
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{200D8~1.EXE > nul
                            7⤵
                              PID:1996
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{B6EA3~1.EXE > nul
                            6⤵
                              PID:3928
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{2E7BA~1.EXE > nul
                            5⤵
                              PID:852
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{32C4C~1.EXE > nul
                            4⤵
                              PID:5024
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{55850~1.EXE > nul
                            3⤵
                              PID:2096
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:4136

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{0ED4953E-9180-4697-B3F0-38200F798114}.exe

                            Filesize

                            344KB

                            MD5

                            888e279e348c8fa4be3bcc81616f07f9

                            SHA1

                            348f94752916dd253007cb8d8e05f634fbbc7eb1

                            SHA256

                            9ae7c57bbca2695e69a52192f18abae24e9e9e83ecdd83f2e68bf297459732cc

                            SHA512

                            0003fbdfaf45a01d60aa6a3a599209594a215469ebda8b9b796eaea4ec1fccce102353e291749b2ebc50412ef8e700a2979dbe0dcd68e3836f0f9646666d07f6

                          • C:\Windows\{1D990A98-00BD-4d1e-893B-68FFB48BE673}.exe

                            Filesize

                            344KB

                            MD5

                            c5b0ae1e056ee34cae1212b23ffdd687

                            SHA1

                            434b6f2f7cc0aa46c73e612b972437d216757ca0

                            SHA256

                            ac6da8a441afbb762bec115570f19f151b5bf028c064e070d4fbb6d24a578370

                            SHA512

                            288ca781ba4833c1fdfb0ce0092fdb1ff3ae7ad6eca6d016b6e9094acbbf70eaa0b5a90759f2e649d7f2d1a97cd6a7a52f3cda07c2e04f5b08e2167d3dc251e6

                          • C:\Windows\{200D8153-9EF4-4400-AFB7-DFAD7E53E387}.exe

                            Filesize

                            344KB

                            MD5

                            15cd55539a0f2b8fea8eee4fb6248c54

                            SHA1

                            63bca56168ac913de1e72e21f263115c50341ab0

                            SHA256

                            7b925ccebbad85072cebe0efc11cee70427ead52312a21f2621381472c500cb0

                            SHA512

                            fac5ac1b342fbf3366cd6043bc461cf1ebdfdd9ea1b73d5edfaceb049bc4a440d4d012f932868de0ef472a1d1641e7ac05c80269c88502c9aedb1dae5fb39fa6

                          • C:\Windows\{2E7BAEA1-015A-4659-9954-77313B7F771E}.exe

                            Filesize

                            344KB

                            MD5

                            4b211834647423bb9f0975e60aa5b2cd

                            SHA1

                            38eaa520668a7648b6726fa2f1a55ccae67ae922

                            SHA256

                            da15b10fdbea1ac068a563d03f2049994920a8cdd4e5dcc25c33c3424e50dd82

                            SHA512

                            3200e91c73b35b17c2cf4e1a532f076e7db0d55d3c7a0583f457acea6c5eb5c810c5aeaa158fe2357ba876af44cab2453b51431ab393e032669c72f4637176a7

                          • C:\Windows\{32C4C9B6-475C-4323-A153-DADA05AA4762}.exe

                            Filesize

                            344KB

                            MD5

                            acf871d8229c8d582985be26048db743

                            SHA1

                            c2030ab5d66a12aaddc17f90e19865c3cdf574b2

                            SHA256

                            6cf884840737fe9c64b1372fc064b41580c207bf3d074f9156a963d8720338a3

                            SHA512

                            dc7692c22642f1c49fc81e4a0024637d7b7a37b9c7e6e0494470ce5f6462168f3a121091abefe2b52ae52043f5f5e97c8927e93b96e229b8f06e525e2bc58331

                          • C:\Windows\{4DE175F5-3650-40c6-867A-D9246683F225}.exe

                            Filesize

                            344KB

                            MD5

                            5d2acf2ff51cebd27d7149ee35ff16a8

                            SHA1

                            3de4b53c63e1d45daa6b76b0244ca899e20fd0c5

                            SHA256

                            1487773d2e5fee0e792929c416bff144fbfb9c75cd1e7b08bc1ff81340f335c7

                            SHA512

                            04db85bb600cfb3a846dea8050cc724913a00d34b7ec47a492c38fd6ff343a7c90b69a05cffe0782bcc49395106b9a5d810a9f7205ae4d12205e1a5ec106f374

                          • C:\Windows\{558504F3-EAB7-4abe-B41F-9B37FE62640A}.exe

                            Filesize

                            344KB

                            MD5

                            b8be1c735f5d74dadf7e2c86fc35231b

                            SHA1

                            87f0f99fb97aa05ac793a0864a0763fe1ccb9bf7

                            SHA256

                            73ca68341ab9a1152fbcd5bc751569f6ac2c9ee7d63df1913cb456397cfaded5

                            SHA512

                            07689fdd8d326e20f38ab797a20a76537aa971bcd11cd5d4a634acc9c756acdcb43886f20266b4b798707a9b659c900e6f9acfb4668df7122b27c6e54c4ef20d

                          • C:\Windows\{A7A0B0DD-A362-4812-A8DA-84A5F2299E89}.exe

                            Filesize

                            344KB

                            MD5

                            fcd5d467db5a5a905a0d1a54f287a7c5

                            SHA1

                            0da24396dff21b476aa61efa5575c7a134e5248c

                            SHA256

                            74ddc39b7019bf3883691b284ac83fa9957939bf6ed113ae5fee669121a2fb2e

                            SHA512

                            d4fdbc6a95876d631bb875d47c23d445e0a37bd5669280e4963e8ec2fb8156dbe862ae1187ed9114ac382ba4a3eb7cfdae877853b58d593212acc682ddcdda35

                          • C:\Windows\{B3C88C07-E324-4e00-9744-969BB0863CBD}.exe

                            Filesize

                            344KB

                            MD5

                            9ad89b9e031ebc9c42fd0778f0ad66cf

                            SHA1

                            154c804cf7bccab5388b27e6481642ef1407dede

                            SHA256

                            4582cc904a38ee95137eb77fa6665bc9e2b2259ca00ae0b7bcee2555f3bbde97

                            SHA512

                            a24b25a7b25ee686ebd835563024acdb979a3b1572858f30c6ff20b8be5b6372684359d1c7d32b282616aa232df3b5096b005c4c14d69602ccc5267bc82f25b6

                          • C:\Windows\{B6EA3EBF-1B22-46b3-B8C1-FA7589AC4FEF}.exe

                            Filesize

                            344KB

                            MD5

                            65e30ebdaabcf354a55013c0615d8d29

                            SHA1

                            2afa5f6b1f6d4a47495c0f2f140a7b4938763bf6

                            SHA256

                            05df05ebcb4485016af4eac1500d684428ecadf57e9284e2480430446b0e8be8

                            SHA512

                            627f4934e69e1622f5a76561d4046ec0eef705216cea297e99106b7947ad01ba0a69eb534c936730786a54471557e04388be494737deaa5307e2d7a66403e8ce

                          • C:\Windows\{E2083DA3-DA7B-4757-8AD5-D448A0BC179C}.exe

                            Filesize

                            344KB

                            MD5

                            cb6cd5bd10f5307242495a5fd801a2a5

                            SHA1

                            0f9211b80775d2b8be1cf29ef11c00b735439334

                            SHA256

                            b0d85d539184e6a4a8fc7beeb655ff31a86c09672453001546593d532e6d1602

                            SHA512

                            fec3a09826dbe03bbcb8b77cbbea6482c70852c1e7065bd5b55ab7cf2df2867e72858b7ef10f53a9e9824dbe15064aa9ea79ffe38fc283d21955c039d4fa505a

                          • C:\Windows\{E814F545-7F3B-479c-9393-03A6B8122C61}.exe

                            Filesize

                            344KB

                            MD5

                            6e3fa410ea64fa3527ff1cd72a6890b4

                            SHA1

                            a32f18ee78b4d08524bed4c10129365575ece286

                            SHA256

                            8d35cae32e16285d3192ae0be0f3ddaad3523882741e354c24843497412e0a30

                            SHA512

                            9a339e36e3d064fb6c2498b6b1561da5e8a538092f0eabf170d14ae297a92dd2d9a04bcc3a627da764eabfa921120613f0e4b6aecad7f02ab24e3d642e311163