Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe
-
Size
180KB
-
MD5
3cd7da474f975728c7a6858e88bbc988
-
SHA1
67462fb564581df2b43a5c34b5a32ddbf098e53f
-
SHA256
c2112cafa52cf87e7ae0ee50ec0539b87fc154a04c9b2070fef51fbf7e22204f
-
SHA512
99a94411e15648f18ad4faa61ce20e6a7603e7df358a980578639b0ee1c958fc3c3659774342995a5153a49a8e8e3e7232bdaa13e8968874af51af8de067a81f
-
SSDEEP
3072:jEGh0odlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG3l5eKcAEc
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29ACFC9C-A08F-410c-BBBA-75E576740E88}\stubpath = "C:\\Windows\\{29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe" {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{038E2DC1-DD20-4364-80EB-C8946AC5D599}\stubpath = "C:\\Windows\\{038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe" {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92DF545E-148D-4194-8925-F453B8C8A1E6}\stubpath = "C:\\Windows\\{92DF545E-148D-4194-8925-F453B8C8A1E6}.exe" {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C135F95C-13EB-4c89-9168-1050F1FE801C} {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C135F95C-13EB-4c89-9168-1050F1FE801C}\stubpath = "C:\\Windows\\{C135F95C-13EB-4c89-9168-1050F1FE801C}.exe" {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{622CD2DE-07FD-4e81-A57C-071F4E787517} 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{622CD2DE-07FD-4e81-A57C-071F4E787517}\stubpath = "C:\\Windows\\{622CD2DE-07FD-4e81-A57C-071F4E787517}.exe" 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29ACFC9C-A08F-410c-BBBA-75E576740E88} {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{038E2DC1-DD20-4364-80EB-C8946AC5D599} {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92DF545E-148D-4194-8925-F453B8C8A1E6} {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe -
Executes dropped EXE 5 IoCs
pid Process 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 3220 {C135F95C-13EB-4c89-9168-1050F1FE801C}.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\{92DF545E-148D-4194-8925-F453B8C8A1E6}.exe {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe File created C:\Windows\{C135F95C-13EB-4c89-9168-1050F1FE801C}.exe {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe File created C:\Windows\{622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe File created C:\Windows\{29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe File created C:\Windows\{038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe Token: SeIncBasePriorityPrivilege 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe Token: SeIncBasePriorityPrivilege 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe Token: SeIncBasePriorityPrivilege 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe Token: SeIncBasePriorityPrivilege 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1012 wrote to memory of 4136 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe 98 PID 1012 wrote to memory of 4136 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe 98 PID 1012 wrote to memory of 4136 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe 98 PID 1012 wrote to memory of 2044 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe 97 PID 1012 wrote to memory of 2044 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe 97 PID 1012 wrote to memory of 2044 1012 2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe 97 PID 4136 wrote to memory of 4604 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 103 PID 4136 wrote to memory of 4604 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 103 PID 4136 wrote to memory of 4604 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 103 PID 4136 wrote to memory of 3264 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 102 PID 4136 wrote to memory of 3264 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 102 PID 4136 wrote to memory of 3264 4136 {622CD2DE-07FD-4e81-A57C-071F4E787517}.exe 102 PID 4604 wrote to memory of 3904 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 107 PID 4604 wrote to memory of 3904 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 107 PID 4604 wrote to memory of 3904 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 107 PID 4604 wrote to memory of 4304 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 106 PID 4604 wrote to memory of 4304 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 106 PID 4604 wrote to memory of 4304 4604 {29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe 106 PID 3904 wrote to memory of 4472 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 110 PID 3904 wrote to memory of 4472 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 110 PID 3904 wrote to memory of 4472 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 110 PID 3904 wrote to memory of 1896 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 109 PID 3904 wrote to memory of 1896 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 109 PID 3904 wrote to memory of 1896 3904 {038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe 109 PID 4472 wrote to memory of 3220 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 112 PID 4472 wrote to memory of 3220 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 112 PID 4472 wrote to memory of 3220 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 112 PID 4472 wrote to memory of 2284 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 120 PID 4472 wrote to memory of 2284 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 120 PID 4472 wrote to memory of 2284 4472 {92DF545E-148D-4194-8925-F453B8C8A1E6}.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:2044
-
-
C:\Windows\{622CD2DE-07FD-4e81-A57C-071F4E787517}.exeC:\Windows\{622CD2DE-07FD-4e81-A57C-071F4E787517}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{622CD~1.EXE > nul3⤵PID:3264
-
-
C:\Windows\{29ACFC9C-A08F-410c-BBBA-75E576740E88}.exeC:\Windows\{29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29ACF~1.EXE > nul4⤵PID:4304
-
-
C:\Windows\{038E2DC1-DD20-4364-80EB-C8946AC5D599}.exeC:\Windows\{038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{038E2~1.EXE > nul5⤵PID:1896
-
-
C:\Windows\{92DF545E-148D-4194-8925-F453B8C8A1E6}.exeC:\Windows\{92DF545E-148D-4194-8925-F453B8C8A1E6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92DF5~1.EXE > nul6⤵PID:2284
-
-
C:\Windows\{C135F95C-13EB-4c89-9168-1050F1FE801C}.exeC:\Windows\{C135F95C-13EB-4c89-9168-1050F1FE801C}.exe6⤵
- Executes dropped EXE
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C135F~1.EXE > nul7⤵PID:1376
-
-
C:\Windows\{FE46689F-5F91-432b-87DF-74C33381DC28}.exeC:\Windows\{FE46689F-5F91-432b-87DF-74C33381DC28}.exe7⤵PID:2184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE466~1.EXE > nul8⤵PID:2892
-
-
C:\Windows\{0F195E58-DAD2-4ffc-9E11-1EEC85C46D02}.exeC:\Windows\{0F195E58-DAD2-4ffc-9E11-1EEC85C46D02}.exe8⤵PID:4812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F195~1.EXE > nul9⤵PID:4744
-
-
C:\Windows\{52CCE7E7-94DC-46cb-AA87-15CEEB80AC6E}.exeC:\Windows\{52CCE7E7-94DC-46cb-AA87-15CEEB80AC6E}.exe9⤵PID:1924
-
C:\Windows\{C2789AC9-69C0-4c72-830F-808C50F329D8}.exeC:\Windows\{C2789AC9-69C0-4c72-830F-808C50F329D8}.exe10⤵PID:2284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2789~1.EXE > nul11⤵PID:4648
-
-
C:\Windows\{D364487B-A391-471c-BDD1-04105C2E8715}.exeC:\Windows\{D364487B-A391-471c-BDD1-04105C2E8715}.exe11⤵PID:3964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3644~1.EXE > nul12⤵PID:1660
-
-
C:\Windows\{04A44E87-0A2C-4127-B9EC-D963735A0C57}.exeC:\Windows\{04A44E87-0A2C-4127-B9EC-D963735A0C57}.exe12⤵PID:2136
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52CCE~1.EXE > nul10⤵PID:2036
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5f082c5d85596d5d70659c35ed7d06af6
SHA1336c99df82ba76a811feb5eb4ea0b9815677b8cc
SHA25687d573b42f5fe60e4ac3d830bf73898bced7139edb25575bbbc5b23f8f48be67
SHA5121c146ac700ab1ea8353bf79d89989cd54a60ecd14b990962f2ed57a987e27e59adb74d3e469d41c1896c925630988a2fd6a70b60194e03581d893cbf1963063f
-
Filesize
92KB
MD5b5a75a5518940776d5d638ae1da27137
SHA179e9ed045d665236cf1f31e2fd8e14585da231f3
SHA256218c61e5d58695b225691882f9bbbcab07b50d92ae5431268f9107661a01e353
SHA51235143fbb3e41a508532641785e544889c3d7ce562374ac7ae1412559097ec5830f3efe476a7c00338305e89b1849c2392c95860c44241ccb3fb5b19f53b2db4b