Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 05:51

General

  • Target

    2024-01-01_de265f1d58d2189362a23041d25c9d13_goldeneye.exe

  • Size

    380KB

  • MD5

    de265f1d58d2189362a23041d25c9d13

  • SHA1

    a59a7310b53180b2f8a4b54c82000413ccc97fe8

  • SHA256

    d8c017dd39444cc5496ad22cf3be7502f00c739e01492d7288fab0118c5db4e0

  • SHA512

    088fb3810e249783d1d8bcb360f08afed3b0904d4c648e6f89be131c0922ad16b932b2688faf9d057d4f81dcbd99277083a23be738e50425f1962d70be586f9f

  • SSDEEP

    3072:mEGh0oElPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGal7Oe2MUVg3v2IneKcAEcARy

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 10 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-01_de265f1d58d2189362a23041d25c9d13_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-01_de265f1d58d2189362a23041d25c9d13_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
        PID:4180
      • C:\Windows\{899328F8-2D58-422d-AF1B-E13AFAA38223}.exe
        C:\Windows\{899328F8-2D58-422d-AF1B-E13AFAA38223}.exe
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1580
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{89932~1.EXE > nul
          3⤵
            PID:1828
          • C:\Windows\{4479F9F2-D96C-443e-8B72-2D025B6C97E2}.exe
            C:\Windows\{4479F9F2-D96C-443e-8B72-2D025B6C97E2}.exe
            3⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:320
            • C:\Windows\{CC045370-C224-424a-AFFB-A483139ABC17}.exe
              C:\Windows\{CC045370-C224-424a-AFFB-A483139ABC17}.exe
              4⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3588
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{CC045~1.EXE > nul
                5⤵
                  PID:4308
                • C:\Windows\{81207C72-086F-4fd0-B69E-2EC212EDDA47}.exe
                  C:\Windows\{81207C72-086F-4fd0-B69E-2EC212EDDA47}.exe
                  5⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3580
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{81207~1.EXE > nul
                    6⤵
                      PID:5032
                    • C:\Windows\{FA12DA77-064E-403e-92F9-1AB3B1F53A38}.exe
                      C:\Windows\{FA12DA77-064E-403e-92F9-1AB3B1F53A38}.exe
                      6⤵
                      • Executes dropped EXE
                      PID:1580
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA12D~1.EXE > nul
                        7⤵
                          PID:1844
                        • C:\Windows\{4007AEDA-44EE-4cdc-8890-923D7FAB25F8}.exe
                          C:\Windows\{4007AEDA-44EE-4cdc-8890-923D7FAB25F8}.exe
                          7⤵
                            PID:456
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{4007A~1.EXE > nul
                              8⤵
                                PID:1828
                              • C:\Windows\{E96620B7-CCD6-4070-9712-B40267DCAF82}.exe
                                C:\Windows\{E96620B7-CCD6-4070-9712-B40267DCAF82}.exe
                                8⤵
                                  PID:4328
                                  • C:\Windows\{8A2F6A76-7B79-45b3-85F9-EA31537FB2EC}.exe
                                    C:\Windows\{8A2F6A76-7B79-45b3-85F9-EA31537FB2EC}.exe
                                    9⤵
                                      PID:2052
                                      • C:\Windows\{3695CF60-5B76-443a-9B93-98D34B8E7943}.exe
                                        C:\Windows\{3695CF60-5B76-443a-9B93-98D34B8E7943}.exe
                                        10⤵
                                          PID:2520
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c del C:\Windows\{3695C~1.EXE > nul
                                            11⤵
                                              PID:220
                                            • C:\Windows\{F8CDB80F-A477-4ace-AF8D-B6F9D6A1AB7F}.exe
                                              C:\Windows\{F8CDB80F-A477-4ace-AF8D-B6F9D6A1AB7F}.exe
                                              11⤵
                                                PID:2276
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c del C:\Windows\{8A2F6~1.EXE > nul
                                              10⤵
                                                PID:4780
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c del C:\Windows\{E9662~1.EXE > nul
                                              9⤵
                                                PID:4640
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{4479F~1.EXE > nul
                                      4⤵
                                        PID:1544

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Windows\{3695CF60-5B76-443a-9B93-98D34B8E7943}.exe

                                  Filesize

                                  39KB

                                  MD5

                                  736d8c322660c105087789116e128c76

                                  SHA1

                                  0c68e828f0346c2948eb8f03bef64c1297bb1189

                                  SHA256

                                  38f5ff8c680016f16552c4c749f4530a73962c3dc3170349e66325f3b59edeaa

                                  SHA512

                                  0a3501da507d0ec1d33f0a806e79b9ad106a3d100b90dc1bc2397f751b0ee35e8d3f1114ad3dbf7f82522b9464727ca86cebdf8c6e1d0d2f8399be87206a4b78

                                • C:\Windows\{3695CF60-5B76-443a-9B93-98D34B8E7943}.exe

                                  Filesize

                                  5KB

                                  MD5

                                  dabeba366592ea19dd7423473f7e3d08

                                  SHA1

                                  5d5b7d1618570387475d31da6d4c44b65c872068

                                  SHA256

                                  bab682ef9376331bc5b63d2a6515c8c4c144559ca1971c5ca20d04349c072fe6

                                  SHA512

                                  02aea45a57d43640b9decbf93dbcb8be7c1c9dce698be3d0e63fb8e552e660b0ad853ec40008e6bc96be71082ece7f08c22ed2c205be15d452a06740d7c72d71

                                • C:\Windows\{4007AEDA-44EE-4cdc-8890-923D7FAB25F8}.exe

                                  Filesize

                                  58KB

                                  MD5

                                  1fb8815cb6faae14e71fe723cbd86f55

                                  SHA1

                                  fac7d1f8b9f228e7db0bdfe596097d5ec0436644

                                  SHA256

                                  5ed31d9b1a160a8316b64e6a95e21297f356ae8abbf0ac587776154e7080382e

                                  SHA512

                                  3debe8523d4e747e9eb4ffea4b501420c0a363abc38485b3a921c209a7a26543f0583d50641cf690a45f3cb1e36b81581b993281cc50aa1e1d1bac62616ce9ba

                                • C:\Windows\{4007AEDA-44EE-4cdc-8890-923D7FAB25F8}.exe

                                  Filesize

                                  75KB

                                  MD5

                                  bf2de288bb0492a8c31740a92a44f8d6

                                  SHA1

                                  8cadd3e32bf6dae0f9823627b18d32eaa76d52ab

                                  SHA256

                                  65050931f5df4e79f29368bcd52f4dfdf6b8f3bb927226fb498c43702a169ab5

                                  SHA512

                                  69f8d45c4bd553e50f52cc9939654c4c58586893fa18804ac23bd699320063f941c76673b06edecbc55cca19d7442c79a324d2a7ba39530a123f23f7507f7120

                                • C:\Windows\{4479F9F2-D96C-443e-8B72-2D025B6C97E2}.exe

                                  Filesize

                                  19KB

                                  MD5

                                  88876e2d081b0bc6f4b20f0ff586ad3a

                                  SHA1

                                  4417774e4738c944295c8c1b3b9d290774c405a4

                                  SHA256

                                  ac4530b6b1e89bdf973ea08b2523f6e47c26b8ef64a71c85b1245fdf77dfa4c7

                                  SHA512

                                  91f252870c0f0e7dc62fcecfc3d9cf72bd0790bb6d90d0b1022469409d31e4e5098f9abda7d52508e9c87795419965746fa3a67a14d3d0dc5de7a33621c49d1d

                                • C:\Windows\{4479F9F2-D96C-443e-8B72-2D025B6C97E2}.exe

                                  Filesize

                                  58KB

                                  MD5

                                  20549c941e7609dc73374502e2627963

                                  SHA1

                                  9a4ea48dfda032ad55425aa24b9923644bd70d4d

                                  SHA256

                                  c3e1e7f50534a2724004965dadfb55c60e8f85cf382da7d531356d9f9b391b12

                                  SHA512

                                  faf837186f942934f055bfcee103ca318a7493285672ff9f3b2e80da43f495267857294e135c5cef8905a967cef3a5d62b6eab896295715b8bb8daeffc357edf

                                • C:\Windows\{81207C72-086F-4fd0-B69E-2EC212EDDA47}.exe

                                  Filesize

                                  1KB

                                  MD5

                                  0469c37c06779c374b10516f746e54cd

                                  SHA1

                                  a554cdfb5bfe2fdbef5626dff44175a0a14c9aa7

                                  SHA256

                                  42a50b9c0cdee18b6513ca0684fe36d5108fee23b4202466ba22f5312f2c43b5

                                  SHA512

                                  8116e597ca3fc7d7b801424a1b37533ade4fbe62b33f7045e6eaeb6b03275c7e981498b4e237230262e157aed9d257faadb6ba1586191f0ebb8d87f292cf4ce0

                                • C:\Windows\{899328F8-2D58-422d-AF1B-E13AFAA38223}.exe

                                  Filesize

                                  68KB

                                  MD5

                                  c4fbb3d9cc9f3dd3262c5aeaea566472

                                  SHA1

                                  e0083a5c827b4665b5abb64b11147002dd177292

                                  SHA256

                                  8f6861b0677349b9b67023a8443220f3965b2aad98ec1ff3105e0c60f944f3fe

                                  SHA512

                                  39ed46d8298339f5e38fb088492366d442230590bb43ded0c4498c24b911cd6cefafc628ca1399f3e629f82a3ce3387c17b36334e1ff26b6dafcffc8b9fe590b

                                • C:\Windows\{899328F8-2D58-422d-AF1B-E13AFAA38223}.exe

                                  Filesize

                                  54KB

                                  MD5

                                  571070a49dfd472ca9be6389251e1dda

                                  SHA1

                                  c8abdfe009403071e2b247a851d5287a5c0bf1a3

                                  SHA256

                                  66b73eb1fd885227834458a6dc4604077fae2194116108794afe88ac9e48f278

                                  SHA512

                                  f3589a9571076129312c92cbc01e26ff833f9f63393974d80634524eb1f190d083aa884a3a17845b5296f5a8aaa4cdc830106e0a4cdd02a2303c8d06f4216bca

                                • C:\Windows\{8A2F6A76-7B79-45b3-85F9-EA31537FB2EC}.exe

                                  Filesize

                                  7KB

                                  MD5

                                  5f16e6556bdc59b3a631d4d6c4f92802

                                  SHA1

                                  d0bc74ef35a45722fbbe96f657bb69e68d110c8c

                                  SHA256

                                  a81db1e26dfdf86465e9da5a1c175af65f07aabfb22254fa1444f05a14edbea1

                                  SHA512

                                  2398611a454d9eac896e6cc05bb7c167fa4d7b39ed8127cee4635589a7d276a85c6e4cbe568b9eee6bb1bece284855cea5302895ed7a098e7d28452f9167881c

                                • C:\Windows\{8A2F6A76-7B79-45b3-85F9-EA31537FB2EC}.exe

                                  Filesize

                                  19KB

                                  MD5

                                  eaf857acabe69595658c2c87d7a7862b

                                  SHA1

                                  882c647037f1e240304943f39a5802049cf25089

                                  SHA256

                                  61b025a002d788d5abc48b94f44ea9bcee080f7cab25c82fc32cbd45471be227

                                  SHA512

                                  8ce0602a8c53c4d7f493450684d7385ee38aff67361471dfd34bafad9812b4dcaa3a05bd845be5d76ac32ae50803f48c598af1f550d900ecf8c81f124238426a

                                • C:\Windows\{CC045370-C224-424a-AFFB-A483139ABC17}.exe

                                  Filesize

                                  33KB

                                  MD5

                                  8f73265c6c29859e1d24f64c6014b285

                                  SHA1

                                  20e4aeac965795ab0fb703f8ed5983ec4c5718bd

                                  SHA256

                                  c1bf22d61327da2abc39cac07fa4610708711392933d527fac2c14b2b73de7f2

                                  SHA512

                                  2380ebf1fd2b8ece842b12c726fca2383c26c18fb0162e7920e00582d70f41c37f4de44c0910ae002bedc49e2d3ae060c392cbd3439672f51f5581c52df3768e

                                • C:\Windows\{CC045370-C224-424a-AFFB-A483139ABC17}.exe

                                  Filesize

                                  35KB

                                  MD5

                                  39faf9d7c9c6e918e0e1d77b07034821

                                  SHA1

                                  7fe2333fc04476ea9da5a8b279d302f3135d9370

                                  SHA256

                                  7e595b7e08628d796ef87c70408f0a465a6ee9152da08445f793bd39d04846ef

                                  SHA512

                                  993803781178c511bb8a18902458daf4d716fcd2b6288061b253e6b64e33ba9dfa6e613525cf0f359fb6a3682aee28dfe7520ca1f1ab7b42528626e8e4624054

                                • C:\Windows\{CC045370-C224-424a-AFFB-A483139ABC17}.exe

                                  Filesize

                                  19KB

                                  MD5

                                  262ca9d28190a317938c4c8d32986f11

                                  SHA1

                                  2f627f2e6f9e50c05ecd7920019182ccc51e52fd

                                  SHA256

                                  82eb91b46d597ca215130d4621ece935ac7212c314a116e1f08735876c3779de

                                  SHA512

                                  d3bf46f95a1f21239126b7198406b6bc2590deeb93f8409dc64bc0e3c311f82c3ef02bc89050049be6fb9696a74af0eac21a3eaa433ae281a601665d7182b6a4

                                • C:\Windows\{E96620B7-CCD6-4070-9712-B40267DCAF82}.exe

                                  Filesize

                                  9KB

                                  MD5

                                  78f53a3f4130d277b34d09c0c13d871b

                                  SHA1

                                  03be4f54dc8f6fac128dd31aabd13ca8220480b1

                                  SHA256

                                  d0ff16eed32103f73ccbb52673c279cf54229a879b735993559c5bff7fb87f5f

                                  SHA512

                                  f69b88971cd89f22c673856334c7b7c61a44c22d9092eb2b4eaee43fb6dcb1b10ff25e7d6323ec61f90819f42930dab69224cfadf5560e319f9e37799e1f2bcd

                                • C:\Windows\{E96620B7-CCD6-4070-9712-B40267DCAF82}.exe

                                  Filesize

                                  43KB

                                  MD5

                                  bed85b9a4975ab3be8e0313062289f15

                                  SHA1

                                  5b9ac7393ec6362933142598344fcc73d1cdca9d

                                  SHA256

                                  75603d9c9bf5668fdea3ee37d2f8aa17557fdf09f7193765b4257e1c70cc7cfe

                                  SHA512

                                  cf6f94d2ae9341fbba063c65b67863b7eafa4b26a58d522592f9738caed3d7abc1099c9d26f30305674e348b265e1251a88b9ed5ad847db845c8783933972e4d

                                • C:\Windows\{F8CDB80F-A477-4ace-AF8D-B6F9D6A1AB7F}.exe

                                  Filesize

                                  13KB

                                  MD5

                                  3039f3ee36a59df36baa1f6736c58983

                                  SHA1

                                  d463cf56db342b9a876812d90d8329685a8bd2e9

                                  SHA256

                                  6385e36c4b2156dcc751472983d6d60036d07e7d2d118678870dfcb6e16b154f

                                  SHA512

                                  0bf832058cf58ed2f94a1b0b76e819a84fea0ec2d90efdcc2c858f4feae2742c97066a782e175a9c4860b01111cc413d5a7fe539816fd17790f6a41cd27ea459

                                • C:\Windows\{FA12DA77-064E-403e-92F9-1AB3B1F53A38}.exe

                                  Filesize

                                  39KB

                                  MD5

                                  26c6e8227a04a8c55d22491cc6495981

                                  SHA1

                                  a91b4cd2e747d142ae87a177a6b72c47083f3506

                                  SHA256

                                  53b831dfc65661f759731c8a2d87bc402ed32c71f1ff3c6420c516aa863fb956

                                  SHA512

                                  46e76e4e15c5c36d89842d5e2adb6307026877702fae316e4c8dad341214895361f336be7af88fa07cae479ac3685fb206b363f84dfdbf9d8a26eb4fe212c33e

                                • C:\Windows\{FA12DA77-064E-403e-92F9-1AB3B1F53A38}.exe

                                  Filesize

                                  10KB

                                  MD5

                                  8b6d7b19909cc32f2d52f5da58f855fb

                                  SHA1

                                  44b5e4b15e8ae109aaace1349f55243c1bf41676

                                  SHA256

                                  d61ff39c57ce2f93f20eb9382a406715d13fcf3c00d9ac2d711a23a42893dbc7

                                  SHA512

                                  1929bf31a67b9bedfa45063e7da1e67cc601c5da8746713b220430b1b6c315bbb75a9fc0534aea25684dc53162fea332b1f123bb8e2ce385b7b04726e5b96040