Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    88s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 05:46

General

  • Target

    2024-01-01_91aaa7f6c51ea68922dec30577645691_goldeneye.exe

  • Size

    180KB

  • MD5

    91aaa7f6c51ea68922dec30577645691

  • SHA1

    e38afdbb634c0bb3c3d1505757c55a30a49f6b68

  • SHA256

    5ec0ed8b8df1d975726b12638a9178f52e1ed12a15b52b8dc5886b58ee7f9d67

  • SHA512

    81e20d44070a45db9477b98a5d8f3918396f8ed4d20bf4b76a600ba2962e733940b9c326e8a414788ed55db60bc393b7b8d4b02df9b6405d5bad4f74ea194af9

  • SSDEEP

    3072:jEGh0oHlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGll5eKcAEc

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 14 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-01_91aaa7f6c51ea68922dec30577645691_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-01_91aaa7f6c51ea68922dec30577645691_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
      • Deletes itself
      PID:2920
    • C:\Windows\{BDB9C555-8C52-45d1-B9A9-DD506A5D033C}.exe
      C:\Windows\{BDB9C555-8C52-45d1-B9A9-DD506A5D033C}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDB9C~1.EXE > nul
        3⤵
          PID:2596
        • C:\Windows\{6B25CCA9-57A0-457d-A3FE-71E1F347DDBD}.exe
          C:\Windows\{6B25CCA9-57A0-457d-A3FE-71E1F347DDBD}.exe
          3⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2652
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{6B25C~1.EXE > nul
            4⤵
              PID:2620
            • C:\Windows\{6EFFCD22-5973-42f9-B459-E85F1C146CC3}.exe
              C:\Windows\{6EFFCD22-5973-42f9-B459-E85F1C146CC3}.exe
              4⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2688
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{6EFFC~1.EXE > nul
                5⤵
                  PID:1484
                • C:\Windows\{05FFA952-3B8B-4d56-BDAD-3D253BC0847F}.exe
                  C:\Windows\{05FFA952-3B8B-4d56-BDAD-3D253BC0847F}.exe
                  5⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2952
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{05FFA~1.EXE > nul
                    6⤵
                      PID:2924
                    • C:\Windows\{981613B5-C133-4038-8169-3C80F0903EF1}.exe
                      C:\Windows\{981613B5-C133-4038-8169-3C80F0903EF1}.exe
                      6⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2828
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{98161~1.EXE > nul
                        7⤵
                          PID:1792
                        • C:\Windows\{3369E5C8-28B6-4103-827B-01C1E2DADA4B}.exe
                          C:\Windows\{3369E5C8-28B6-4103-827B-01C1E2DADA4B}.exe
                          7⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1168
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{3369E~1.EXE > nul
                            8⤵
                              PID:2796
                            • C:\Windows\{008B72F4-7768-4f4c-BBF3-4C9A9BFE2E9C}.exe
                              C:\Windows\{008B72F4-7768-4f4c-BBF3-4C9A9BFE2E9C}.exe
                              8⤵
                              • Executes dropped EXE
                              PID:2824
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{008B7~1.EXE > nul
                                9⤵
                                  PID:2976
                                • C:\Windows\{DC395E6A-6902-4668-A8A8-8F931C4159BE}.exe
                                  C:\Windows\{DC395E6A-6902-4668-A8A8-8F931C4159BE}.exe
                                  9⤵
                                    PID:320
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{DC395~1.EXE > nul
                                      10⤵
                                        PID:1964
                                      • C:\Windows\{F51E26B1-80A5-4c62-93AE-43F2D1C3C21C}.exe
                                        C:\Windows\{F51E26B1-80A5-4c62-93AE-43F2D1C3C21C}.exe
                                        10⤵
                                          PID:2104
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c del C:\Windows\{F51E2~1.EXE > nul
                                            11⤵
                                              PID:488
                                            • C:\Windows\{2A60AAB6-0E04-4f0f-871F-D111EB116CA1}.exe
                                              C:\Windows\{2A60AAB6-0E04-4f0f-871F-D111EB116CA1}.exe
                                              11⤵
                                                PID:592
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c del C:\Windows\{2A60A~1.EXE > nul
                                                  12⤵
                                                    PID:2096
                                                  • C:\Windows\{05BB26A5-32A8-42bd-B41A-14463327F188}.exe
                                                    C:\Windows\{05BB26A5-32A8-42bd-B41A-14463327F188}.exe
                                                    12⤵
                                                      PID:2420

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Windows\{008B72F4-7768-4f4c-BBF3-4C9A9BFE2E9C}.exe

                                Filesize

                                60KB

                                MD5

                                ada12c38592810dd5b0bf9aa1e9c1ac8

                                SHA1

                                8d8e76ace4a9d84031ab73c5617315b659ee8221

                                SHA256

                                9cc6fa9ca43a763a1edd7c582c6a23e1d97f0bdc10e0a5177dd2bd1048df4a60

                                SHA512

                                8670577e261c95f7cca659a786e130574598ae49e29014920b1d222fd69ce499c048dff20bd6847dbfc58ca255e8136df9ae96b74325393422e9c367d27a43d2

                              • C:\Windows\{05BB26A5-32A8-42bd-B41A-14463327F188}.exe

                                Filesize

                                30KB

                                MD5

                                146d507438c3fa43dc59402f180af19e

                                SHA1

                                6be7bcb332380250b3b364a1d09c33c8e4ab4f04

                                SHA256

                                2a5239ccc07c30f0630dd52781a4db335e0008b4a3ba0596cfe065c5a6de7e46

                                SHA512

                                25d7c8705bb2af90cb7f1b7fc0444e0800d13b131f9c8481ffb1c52e6146e7616da0b67a1d7fe6e9ed070db67c140ab3ae454fcdedcc9ee4a8e7f7e7e62a172b

                              • C:\Windows\{05FFA952-3B8B-4d56-BDAD-3D253BC0847F}.exe

                                Filesize

                                180KB

                                MD5

                                7fef832148683bb8348dd31baa7d52d3

                                SHA1

                                def46c576a750d0d47681a579ec71265b1706674

                                SHA256

                                3a08396645fc6d243fc94f27c9e378086c928b89759258209d81bdf8f4d99dfc

                                SHA512

                                ea6770b04fb2bb598c266eca4e04bf0fd54be2bfc371a1ba699d217b6a949276549c178dee09f2fa58f2792d20020c5dccd51a6834ef4d54f7fa77c4f46d3379

                              • C:\Windows\{05FFA952-3B8B-4d56-BDAD-3D253BC0847F}.exe

                                Filesize

                                1KB

                                MD5

                                4bc0c8a9188ba80b6b1d123f1538b01c

                                SHA1

                                f970f1d1eb981593f5dce6c92a843c45a5c93db2

                                SHA256

                                8d808b2a37d78acca7fb3cf18ce2a6c378433f6f09a1700955074eec9d0673ec

                                SHA512

                                c9ee2ff3915c0df23c16a774bcd2e4a8584e4d938b10e998e95e7095975d88c825c7d1d681916823e64f9076d739769afadff629f6aa608e4e14a41b9d5b5bd4

                              • C:\Windows\{2A60AAB6-0E04-4f0f-871F-D111EB116CA1}.exe

                                Filesize

                                55KB

                                MD5

                                76feee9756f38a799e47b6fc59c116da

                                SHA1

                                3b6d023b06cc925f0cb02d88996259d2dcae378e

                                SHA256

                                b512e37a8f52374dd0d4c0c866bf7b28ffc23b2b1195168eb22d175c545d970c

                                SHA512

                                0d3ddda30003ef3e595a7ca9d10e43ef71b76a05462b2ba9d8ab2b1fc9545cf5a991188118773fa5f692015dfb4bbc967bb0853965ad1946a592dd6858484f4b

                              • C:\Windows\{3369E5C8-28B6-4103-827B-01C1E2DADA4B}.exe

                                Filesize

                                116KB

                                MD5

                                89b88edcff478d8557a76f8bfa0fe5ee

                                SHA1

                                7aaf133bb57133e9f6da088c17bb8f8aa9324c7b

                                SHA256

                                c5bddd06ab94aeeba03ce13cf58061dbba02514f3959ef54349ea643ab3d736d

                                SHA512

                                2ebaae66217643e65d592f234a02d14937ea0c1cdb7dce76656c3301513595a8a29e159aa2eced521f3453111f85fb49f6a8f5b22f680043a6e3c236307c31a5

                              • C:\Windows\{6B25CCA9-57A0-457d-A3FE-71E1F347DDBD}.exe

                                Filesize

                                44KB

                                MD5

                                eb3e18dfa916523a39d00cce3a2f27b9

                                SHA1

                                60ec1455422fe9253d9507eab3102ea890a3bc40

                                SHA256

                                6df79d5ee7b8181304f5ce120094c6df5a1eb38a8ffcebaa3561f93bb6e3bdcd

                                SHA512

                                3dea66d1dac87fbc6d7dde839b6412a03589e79d55ac7d06680382ac6cbf5b1bf8abc98187b34a5f98a0a08e7ba9622e8da85ca0a2e3babe97dca32cafbd33bd

                              • C:\Windows\{6B25CCA9-57A0-457d-A3FE-71E1F347DDBD}.exe

                                Filesize

                                18KB

                                MD5

                                0adad4577f30e421820fef3d9b566859

                                SHA1

                                1de8dde5ba0ffe04f5a76216724f05c8bbc7beff

                                SHA256

                                11bec48d6395c595c3863157074df3cc84445817774bb618be2bc2f3aef297c1

                                SHA512

                                c338f596e4e324e9f8e4bd328aa01e7957ff61fe8aa3a161ddbed83b5e6588eb9e84fe2e74fd9e779e39f1d0cd09bbdc5a29ccf44b48ff747c5783359e40a486

                              • C:\Windows\{6EFFCD22-5973-42f9-B459-E85F1C146CC3}.exe

                                Filesize

                                9KB

                                MD5

                                fae24c70d6a1c10cac84c8eba7bfce2a

                                SHA1

                                c7e249df9cf95e7ec6179b4afdb27073829a34eb

                                SHA256

                                b854c2da89f6a3e40b5d45cb476f45c2fa354bb8e2a3378a691ea3d33fb72318

                                SHA512

                                4afbf2c12cf21e8cfca114970f27c945321e692d374673194e61364c411825b7092e363d18d4ee0fbdd3d9daeb2d1659147a566999a1d0381892d0f62dea9fd5

                              • C:\Windows\{6EFFCD22-5973-42f9-B459-E85F1C146CC3}.exe

                                Filesize

                                180KB

                                MD5

                                fd399b7f6df5c91fef14a86bbc8eb6a0

                                SHA1

                                1af4451da78e29d12dc7d40e96a76ba7ef80a314

                                SHA256

                                658b1407b58d1c4b9fbb04fbfc1472418f5020ec6ed65cee57b4ef4ab5c97d95

                                SHA512

                                965e4b11adc5cc34a6b27a966631dce0eaa0f4f86297df135a6ecf4f7a28433f46710fa2ecfa66ecbf55d5415be324e48043f33375d89838cb0ef5b81dbd2827

                              • C:\Windows\{981613B5-C133-4038-8169-3C80F0903EF1}.exe

                                Filesize

                                73KB

                                MD5

                                9b42ebb0d8903716b932c647773bd6ad

                                SHA1

                                83cc3b6d7977cd8b9eb4651a88d08f4c262f664b

                                SHA256

                                634fa24477f002a2535ff92bbae76b6acc5084b5f5de9a68ac1be9ca7a5bc9f3

                                SHA512

                                a547bbb2597b16c9344001a1f1d2d38da1e3f8b3364382c8b0c76f5f1da607860cc6969fa8d9fb0b03a38e135d056b91a1e79547d27fc3a9323b218d05b81618

                              • C:\Windows\{981613B5-C133-4038-8169-3C80F0903EF1}.exe

                                Filesize

                                23KB

                                MD5

                                1eb41fcb2f42ea371fcbd50937c6e432

                                SHA1

                                2724576511cc04b1487c9f4d07836b2fcf59c9f1

                                SHA256

                                26c9c344e202e18053b6e005aaccd0163c1f73a2029e7fc12a541cc48454db9a

                                SHA512

                                99338cfeca0e7cdd7cd09226a06b7e3634ef902d450fe831f5d616e111525a01760e31552c28cd072d4c3df0c5f8a6c1c943a04eb4934be9b0c9939c14b805bb

                              • C:\Windows\{BDB9C555-8C52-45d1-B9A9-DD506A5D033C}.exe

                                Filesize

                                68KB

                                MD5

                                04cbed29a7572ec49b3bda5379741c88

                                SHA1

                                a62d5578ddb09667a8530eef243f7fa72e54fe83

                                SHA256

                                70fc4da1829e3ec734f36d934f63971af050113345d8008697658202c0418162

                                SHA512

                                0b6f68e57b73564f837e93d62c3d6b65f6edc7b0e475d513a483ccc5d93054cf503d0047bf6f7dfeee8fc4aac7aa3f5eeb0658c7813acff1cd808378bba1ee64

                              • C:\Windows\{BDB9C555-8C52-45d1-B9A9-DD506A5D033C}.exe

                                Filesize

                                11KB

                                MD5

                                45cbb4aae2b9d7aca568c93e873b5008

                                SHA1

                                2d98dda0e119b15503fba166d378982bfba1b068

                                SHA256

                                b0c9153c6cf643906640fc9d652f921cf8e70fcc0a82a63040aa495b81339f4c

                                SHA512

                                1d5e4925e5ad3f68ca778c4434c108ef1db86c0729855227cf4a3905854ee2c85d8d5f3f907e300c82042313add6b2d06b0610c8c4d2fffec735f60328ccdb83

                              • C:\Windows\{BDB9C555-8C52-45d1-B9A9-DD506A5D033C}.exe

                                Filesize

                                35KB

                                MD5

                                ac4bda6af0c9c12a616c188be3d3a9b8

                                SHA1

                                91431d48005e6176f860c15314fb9b430b484655

                                SHA256

                                25d41d85c1d71ec8b50e3b87b009b85b3fab635546682af688b068189f05b3c8

                                SHA512

                                3456395d4b93f8385398a9aba85547c866504197a7bfeccb9489f07e50a0e0af190616815cd0766eac2eb3d19065c59d70ea26b5af0babe7d5d68ef9cf857473

                              • C:\Windows\{DC395E6A-6902-4668-A8A8-8F931C4159BE}.exe

                                Filesize

                                11KB

                                MD5

                                6a36b6d751c4c58cfdb57d4e4aae86c4

                                SHA1

                                5f57fe54aa75d6ea16716cd3bbc9604f9a36994e

                                SHA256

                                9791c7dda620c4f8c4d679cb04374eab8acea7054919752b4f5040b12a61a03c

                                SHA512

                                51e256d1c919a620620e5350d846b056942f59d5acc9b1296e74887b67c762bc369483b3da147af83252e4ea28129cb094e2c7201cfdaff3d963b7497ead66fa

                              • C:\Windows\{DC395E6A-6902-4668-A8A8-8F931C4159BE}.exe

                                Filesize

                                19KB

                                MD5

                                1fc629bf43bc0af04466b633428d9e1d

                                SHA1

                                cc58906e2083f890717a3f3b841936ca9e01948a

                                SHA256

                                0568916ba4c3db459b6988fe95eed40b9bafa38447d6f744138118dc43258585

                                SHA512

                                a6dfb260ca2938f02aca80cb441cafc67fad1bb090204420aa487555acda53143a8a57fea35df45be24e5c772711aa8654e0e3ad88d06e486a56d85dfb334c41

                              • C:\Windows\{F51E26B1-80A5-4c62-93AE-43F2D1C3C21C}.exe

                                Filesize

                                92KB

                                MD5

                                a02b199a6f5e917eba1ddb28e3b0223e

                                SHA1

                                e87f3b0f3863c6874e24569fac6d3b8a022595fa

                                SHA256

                                fe4d95ae785b2bfd54b0c31e35c2424fd3dc952c37e60dbda47d203d2acddae4

                                SHA512

                                cceba129a639dabd24da40fe98b683d12efdb0f42ca98f558ba99f449906d9237fa7bc6ce08e8653eafc1b64bac7b7a3b28b39164f05b4e5ad77c29e1718d143

                              • C:\Windows\{F51E26B1-80A5-4c62-93AE-43F2D1C3C21C}.exe

                                Filesize

                                35KB

                                MD5

                                87a84365cd5c2c1f1c88b3ffc3131ec6

                                SHA1

                                6e13c15bac4d5813d334816142896004e3857449

                                SHA256

                                28f6704ede05d57a822979cfbefd280f3b8c1ab46408cfff47c6673373c1b853

                                SHA512

                                0f8a3fd9d6d5833fba10f18a1734a8bcfbcfff9f1ba66d28635b3ca6debd108f822b43437009164c34f9e3b00cdc063678376d970ce20c46f93e6b496c491c60