Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 12:08

General

  • Target

    2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe

  • Size

    180KB

  • MD5

    3cd7da474f975728c7a6858e88bbc988

  • SHA1

    67462fb564581df2b43a5c34b5a32ddbf098e53f

  • SHA256

    c2112cafa52cf87e7ae0ee50ec0539b87fc154a04c9b2070fef51fbf7e22204f

  • SHA512

    99a94411e15648f18ad4faa61ce20e6a7603e7df358a980578639b0ee1c958fc3c3659774342995a5153a49a8e8e3e7232bdaa13e8968874af51af8de067a81f

  • SSDEEP

    3072:jEGh0odlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG3l5eKcAEc

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 10 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-06_3cd7da474f975728c7a6858e88bbc988_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
        PID:2044
      • C:\Windows\{622CD2DE-07FD-4e81-A57C-071F4E787517}.exe
        C:\Windows\{622CD2DE-07FD-4e81-A57C-071F4E787517}.exe
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4136
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{622CD~1.EXE > nul
          3⤵
            PID:3264
          • C:\Windows\{29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe
            C:\Windows\{29ACFC9C-A08F-410c-BBBA-75E576740E88}.exe
            3⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4604
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{29ACF~1.EXE > nul
              4⤵
                PID:4304
              • C:\Windows\{038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe
                C:\Windows\{038E2DC1-DD20-4364-80EB-C8946AC5D599}.exe
                4⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3904
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{038E2~1.EXE > nul
                  5⤵
                    PID:1896
                  • C:\Windows\{92DF545E-148D-4194-8925-F453B8C8A1E6}.exe
                    C:\Windows\{92DF545E-148D-4194-8925-F453B8C8A1E6}.exe
                    5⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4472
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{92DF5~1.EXE > nul
                      6⤵
                        PID:2284
                      • C:\Windows\{C135F95C-13EB-4c89-9168-1050F1FE801C}.exe
                        C:\Windows\{C135F95C-13EB-4c89-9168-1050F1FE801C}.exe
                        6⤵
                        • Executes dropped EXE
                        PID:3220
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{C135F~1.EXE > nul
                          7⤵
                            PID:1376
                          • C:\Windows\{FE46689F-5F91-432b-87DF-74C33381DC28}.exe
                            C:\Windows\{FE46689F-5F91-432b-87DF-74C33381DC28}.exe
                            7⤵
                              PID:2184
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{FE466~1.EXE > nul
                                8⤵
                                  PID:2892
                                • C:\Windows\{0F195E58-DAD2-4ffc-9E11-1EEC85C46D02}.exe
                                  C:\Windows\{0F195E58-DAD2-4ffc-9E11-1EEC85C46D02}.exe
                                  8⤵
                                    PID:4812
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{0F195~1.EXE > nul
                                      9⤵
                                        PID:4744
                                      • C:\Windows\{52CCE7E7-94DC-46cb-AA87-15CEEB80AC6E}.exe
                                        C:\Windows\{52CCE7E7-94DC-46cb-AA87-15CEEB80AC6E}.exe
                                        9⤵
                                          PID:1924
                                          • C:\Windows\{C2789AC9-69C0-4c72-830F-808C50F329D8}.exe
                                            C:\Windows\{C2789AC9-69C0-4c72-830F-808C50F329D8}.exe
                                            10⤵
                                              PID:2284
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c del C:\Windows\{C2789~1.EXE > nul
                                                11⤵
                                                  PID:4648
                                                • C:\Windows\{D364487B-A391-471c-BDD1-04105C2E8715}.exe
                                                  C:\Windows\{D364487B-A391-471c-BDD1-04105C2E8715}.exe
                                                  11⤵
                                                    PID:3964
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{D3644~1.EXE > nul
                                                      12⤵
                                                        PID:1660
                                                      • C:\Windows\{04A44E87-0A2C-4127-B9EC-D963735A0C57}.exe
                                                        C:\Windows\{04A44E87-0A2C-4127-B9EC-D963735A0C57}.exe
                                                        12⤵
                                                          PID:2136
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{52CCE~1.EXE > nul
                                                      10⤵
                                                        PID:2036

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Windows\{52CCE7E7-94DC-46cb-AA87-15CEEB80AC6E}.exe

                                      Filesize

                                      180KB

                                      MD5

                                      f082c5d85596d5d70659c35ed7d06af6

                                      SHA1

                                      336c99df82ba76a811feb5eb4ea0b9815677b8cc

                                      SHA256

                                      87d573b42f5fe60e4ac3d830bf73898bced7139edb25575bbbc5b23f8f48be67

                                      SHA512

                                      1c146ac700ab1ea8353bf79d89989cd54a60ecd14b990962f2ed57a987e27e59adb74d3e469d41c1896c925630988a2fd6a70b60194e03581d893cbf1963063f

                                    • C:\Windows\{52CCE7E7-94DC-46cb-AA87-15CEEB80AC6E}.exe

                                      Filesize

                                      92KB

                                      MD5

                                      b5a75a5518940776d5d638ae1da27137

                                      SHA1

                                      79e9ed045d665236cf1f31e2fd8e14585da231f3

                                      SHA256

                                      218c61e5d58695b225691882f9bbbcab07b50d92ae5431268f9107661a01e353

                                      SHA512

                                      35143fbb3e41a508532641785e544889c3d7ce562374ac7ae1412559097ec5830f3efe476a7c00338305e89b1849c2392c95860c44241ccb3fb5b19f53b2db4b