Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
211s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe
-
Size
204KB
-
MD5
4a1948e3c8ae3826f3ef36f7d4afb07b
-
SHA1
3a9e15be7c536a899403e0e46165aabe0ca34fa3
-
SHA256
e77b268b9b1255d0eacc07b7e9760b9ad3c9a4802127e9fcf5bed640399a318c
-
SHA512
29511d3fa5ad1982911eb7e36aeb8c652efed2cc1dbb3f7417df8893653bc75e842ffe3f495cac92264e9b4e1a16e5b490eacc81726b1e1a7dae2fa498b8cac2
-
SSDEEP
1536:1EGh0o1l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o1l1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45985300-4201-4454-9BC8-244740619292}\stubpath = "C:\\Windows\\{45985300-4201-4454-9BC8-244740619292}.exe" 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94618E9B-982A-4c3f-8F53-86C2D455E518} {45985300-4201-4454-9BC8-244740619292}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{660D45EE-D7C6-4196-991F-0B3948BF6F07}\stubpath = "C:\\Windows\\{660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe" {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4715858-B09D-4291-912B-77520AA7C901} {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45985300-4201-4454-9BC8-244740619292} 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94618E9B-982A-4c3f-8F53-86C2D455E518}\stubpath = "C:\\Windows\\{94618E9B-982A-4c3f-8F53-86C2D455E518}.exe" {45985300-4201-4454-9BC8-244740619292}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79459B21-42F3-4229-A061-8DFD78B6DCB9} {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79459B21-42F3-4229-A061-8DFD78B6DCB9}\stubpath = "C:\\Windows\\{79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe" {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{660D45EE-D7C6-4196-991F-0B3948BF6F07} {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4715858-B09D-4291-912B-77520AA7C901}\stubpath = "C:\\Windows\\{F4715858-B09D-4291-912B-77520AA7C901}.exe" {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe -
Executes dropped EXE 5 IoCs
pid Process 5004 {45985300-4201-4454-9BC8-244740619292}.exe 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 1768 {F4715858-B09D-4291-912B-77520AA7C901}.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\{45985300-4201-4454-9BC8-244740619292}.exe 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe File created C:\Windows\{94618E9B-982A-4c3f-8F53-86C2D455E518}.exe {45985300-4201-4454-9BC8-244740619292}.exe File created C:\Windows\{79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe File created C:\Windows\{660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe File created C:\Windows\{F4715858-B09D-4291-912B-77520AA7C901}.exe {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe Token: SeIncBasePriorityPrivilege 5004 {45985300-4201-4454-9BC8-244740619292}.exe Token: SeIncBasePriorityPrivilege 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe Token: SeIncBasePriorityPrivilege 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe Token: SeIncBasePriorityPrivilege 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1584 wrote to memory of 5004 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe 91 PID 1584 wrote to memory of 5004 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe 91 PID 1584 wrote to memory of 5004 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe 91 PID 1584 wrote to memory of 4720 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe 93 PID 1584 wrote to memory of 4720 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe 93 PID 1584 wrote to memory of 4720 1584 2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe 93 PID 5004 wrote to memory of 4944 5004 {45985300-4201-4454-9BC8-244740619292}.exe 94 PID 5004 wrote to memory of 4944 5004 {45985300-4201-4454-9BC8-244740619292}.exe 94 PID 5004 wrote to memory of 4944 5004 {45985300-4201-4454-9BC8-244740619292}.exe 94 PID 5004 wrote to memory of 3352 5004 {45985300-4201-4454-9BC8-244740619292}.exe 95 PID 5004 wrote to memory of 3352 5004 {45985300-4201-4454-9BC8-244740619292}.exe 95 PID 5004 wrote to memory of 3352 5004 {45985300-4201-4454-9BC8-244740619292}.exe 95 PID 4944 wrote to memory of 1040 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 96 PID 4944 wrote to memory of 1040 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 96 PID 4944 wrote to memory of 1040 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 96 PID 4944 wrote to memory of 1924 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 97 PID 4944 wrote to memory of 1924 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 97 PID 4944 wrote to memory of 1924 4944 {94618E9B-982A-4c3f-8F53-86C2D455E518}.exe 97 PID 1040 wrote to memory of 4552 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 98 PID 1040 wrote to memory of 4552 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 98 PID 1040 wrote to memory of 4552 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 98 PID 1040 wrote to memory of 3416 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 99 PID 1040 wrote to memory of 3416 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 99 PID 1040 wrote to memory of 3416 1040 {79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe 99 PID 4552 wrote to memory of 1768 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 104 PID 4552 wrote to memory of 1768 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 104 PID 4552 wrote to memory of 1768 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 104 PID 4552 wrote to memory of 2900 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 103 PID 4552 wrote to memory of 2900 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 103 PID 4552 wrote to memory of 2900 4552 {660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_4a1948e3c8ae3826f3ef36f7d4afb07b_goldeneye_JC.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\{45985300-4201-4454-9BC8-244740619292}.exeC:\Windows\{45985300-4201-4454-9BC8-244740619292}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\{94618E9B-982A-4c3f-8F53-86C2D455E518}.exeC:\Windows\{94618E9B-982A-4c3f-8F53-86C2D455E518}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\{79459B21-42F3-4229-A061-8DFD78B6DCB9}.exeC:\Windows\{79459B21-42F3-4229-A061-8DFD78B6DCB9}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\{660D45EE-D7C6-4196-991F-0B3948BF6F07}.exeC:\Windows\{660D45EE-D7C6-4196-991F-0B3948BF6F07}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{660D4~1.EXE > nul6⤵PID:2900
-
-
C:\Windows\{F4715858-B09D-4291-912B-77520AA7C901}.exeC:\Windows\{F4715858-B09D-4291-912B-77520AA7C901}.exe6⤵
- Executes dropped EXE
PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79459~1.EXE > nul5⤵PID:3416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94618~1.EXE > nul4⤵PID:1924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45985~1.EXE > nul3⤵PID:3352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul2⤵PID:4720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD530925ed1aa34b05589f70b7c67477313
SHA18fe591d911de1657ca31b1fda456c2d6da141901
SHA256711bebbf74ee5a5a16b2cb148ffc18a912643e76bd1b147127f31d02c81aa228
SHA5125e02f72b83b1955192863cac38c9f4bb72ab62627b4f36424390455314323751b9ae5c48ed09955f5a3eace4fbaecf8a35d2948702fdebba903c0b34dd30b3aa
-
Filesize
204KB
MD530925ed1aa34b05589f70b7c67477313
SHA18fe591d911de1657ca31b1fda456c2d6da141901
SHA256711bebbf74ee5a5a16b2cb148ffc18a912643e76bd1b147127f31d02c81aa228
SHA5125e02f72b83b1955192863cac38c9f4bb72ab62627b4f36424390455314323751b9ae5c48ed09955f5a3eace4fbaecf8a35d2948702fdebba903c0b34dd30b3aa
-
Filesize
204KB
MD540d3a52a7decaa00c5048296654383a3
SHA1a81fa7acfac33838adc75ab5fa92659aa041ce73
SHA25655e32bc54f13fd155e1b825d552f8db8325e0ace45848afd03f12e3a380aa9a9
SHA512f39cd4a231f3474fdceed84868ebe3a241efa74ab9ab3cda21bc6de679f95e76c73ab6daa9b0b67866b1d1910814b889ee78f94992edc4b520a4f5a251b42e18
-
Filesize
204KB
MD540d3a52a7decaa00c5048296654383a3
SHA1a81fa7acfac33838adc75ab5fa92659aa041ce73
SHA25655e32bc54f13fd155e1b825d552f8db8325e0ace45848afd03f12e3a380aa9a9
SHA512f39cd4a231f3474fdceed84868ebe3a241efa74ab9ab3cda21bc6de679f95e76c73ab6daa9b0b67866b1d1910814b889ee78f94992edc4b520a4f5a251b42e18
-
Filesize
204KB
MD50a849a401fe6b00e3ea0091205195a63
SHA1ebffc9495d54d5844946983b679ec1fc106730b6
SHA2562b2c120867ee3ecdaa28189dcac725cbc6bb13c83d28ab18a6aabba5f7621b7c
SHA51204c24bd41fc0960637749c10dd7bd750b26ae60b1f8974b7875d0ac89d5a7336f7e12505ccd23ef1eb05748a80e75773e0f52e9f1aa85c3f2aa2d0009022398b
-
Filesize
204KB
MD50a849a401fe6b00e3ea0091205195a63
SHA1ebffc9495d54d5844946983b679ec1fc106730b6
SHA2562b2c120867ee3ecdaa28189dcac725cbc6bb13c83d28ab18a6aabba5f7621b7c
SHA51204c24bd41fc0960637749c10dd7bd750b26ae60b1f8974b7875d0ac89d5a7336f7e12505ccd23ef1eb05748a80e75773e0f52e9f1aa85c3f2aa2d0009022398b
-
Filesize
204KB
MD50a849a401fe6b00e3ea0091205195a63
SHA1ebffc9495d54d5844946983b679ec1fc106730b6
SHA2562b2c120867ee3ecdaa28189dcac725cbc6bb13c83d28ab18a6aabba5f7621b7c
SHA51204c24bd41fc0960637749c10dd7bd750b26ae60b1f8974b7875d0ac89d5a7336f7e12505ccd23ef1eb05748a80e75773e0f52e9f1aa85c3f2aa2d0009022398b
-
Filesize
204KB
MD5c1af92df9dc53162ec7b736c5c784617
SHA11d3b8246dd7a4bf319976dfa76eaaa139dfc2a35
SHA25654a8e077259631f14abeb7ab2dcc35f298e41d3149c95d872c676e3d05403ab9
SHA5125c59f58cc25e17dd17e9f408c82e1dd7e05e7ca74a7b6a93929ec3941b4070fef42c19797c071277a2c6c0f1ecb3bfa3f6744abc5b79daf3fec35cb84e40200a
-
Filesize
204KB
MD5c1af92df9dc53162ec7b736c5c784617
SHA11d3b8246dd7a4bf319976dfa76eaaa139dfc2a35
SHA25654a8e077259631f14abeb7ab2dcc35f298e41d3149c95d872c676e3d05403ab9
SHA5125c59f58cc25e17dd17e9f408c82e1dd7e05e7ca74a7b6a93929ec3941b4070fef42c19797c071277a2c6c0f1ecb3bfa3f6744abc5b79daf3fec35cb84e40200a
-
Filesize
204KB
MD549a1707a2f727b0bfd61dcab5ea667b8
SHA1117ba2dc570ace8d7b174dea5640d721764e22dc
SHA2565282a7a9fa0053708e9171bd0ae1f65d2d6cd86c2352d4d0ac8cf749f8139141
SHA512f1b1f1998ca03a370c6b3de7a9ff33a1b813830e3550053c9a3ca60dce900ae89eaa2f27127c08b25f360fd7788c7a100242d753b59401d67e7936769f611927
-
Filesize
204KB
MD549a1707a2f727b0bfd61dcab5ea667b8
SHA1117ba2dc570ace8d7b174dea5640d721764e22dc
SHA2565282a7a9fa0053708e9171bd0ae1f65d2d6cd86c2352d4d0ac8cf749f8139141
SHA512f1b1f1998ca03a370c6b3de7a9ff33a1b813830e3550053c9a3ca60dce900ae89eaa2f27127c08b25f360fd7788c7a100242d753b59401d67e7936769f611927