Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe
-
Size
408KB
-
MD5
9022259a9a557ca9471301f0225ac924
-
SHA1
990c820f56b8cc608693ce19dcade1f6cf375135
-
SHA256
b4f32d5bcf21bd1d3b25053c653aec40b8f98dcb3ae68667dbba5be4f633ba5a
-
SHA512
c3eaac7dc81ec4876a0a3ea3ef26920f4133a55a1b4487f099fe839cc83999c58ca2f0639f11aa4418d947fd4c17da83083bd5bcca00c3f202f1a3976c566c43
-
SSDEEP
3072:CEGh0oSl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CEBC275-086E-4840-AF7E-8AA6DF3D7982}\stubpath = "C:\\Windows\\{8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe" {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F707115D-4630-42a6-9665-0EB7F0BBC4F4}\stubpath = "C:\\Windows\\{F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe" 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC501AB2-9805-49e9-BF37-87A2F9F46C86} {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC501AB2-9805-49e9-BF37-87A2F9F46C86}\stubpath = "C:\\Windows\\{CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe" {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CEBC275-086E-4840-AF7E-8AA6DF3D7982} {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C37CDD0-D654-47cf-B163-D38877B8070B}\stubpath = "C:\\Windows\\{6C37CDD0-D654-47cf-B163-D38877B8070B}.exe" {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F707115D-4630-42a6-9665-0EB7F0BBC4F4} 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0F2D579-8BBA-469c-A600-7862596FBDD2} {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0F2D579-8BBA-469c-A600-7862596FBDD2}\stubpath = "C:\\Windows\\{D0F2D579-8BBA-469c-A600-7862596FBDD2}.exe" {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C37CDD0-D654-47cf-B163-D38877B8070B} {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe -
Executes dropped EXE 5 IoCs
pid Process 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 3752 {D0F2D579-8BBA-469c-A600-7862596FBDD2}.exe 4556 {6C37CDD0-D654-47cf-B163-D38877B8070B}.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\{F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe File created C:\Windows\{CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe File created C:\Windows\{8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe File created C:\Windows\{D0F2D579-8BBA-469c-A600-7862596FBDD2}.exe {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe File created C:\Windows\{6C37CDD0-D654-47cf-B163-D38877B8070B}.exe {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe Token: SeIncBasePriorityPrivilege 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe Token: SeIncBasePriorityPrivilege 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe Token: SeIncBasePriorityPrivilege 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe Token: SeIncBasePriorityPrivilege 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1596 wrote to memory of 3408 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe 100 PID 1596 wrote to memory of 3408 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe 100 PID 1596 wrote to memory of 3408 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe 100 PID 1596 wrote to memory of 4488 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe 99 PID 1596 wrote to memory of 4488 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe 99 PID 1596 wrote to memory of 4488 1596 2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe 99 PID 3408 wrote to memory of 3172 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 102 PID 3408 wrote to memory of 3172 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 102 PID 3408 wrote to memory of 3172 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 102 PID 3408 wrote to memory of 3532 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 101 PID 3408 wrote to memory of 3532 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 101 PID 3408 wrote to memory of 3532 3408 {F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe 101 PID 3172 wrote to memory of 3116 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 106 PID 3172 wrote to memory of 3116 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 106 PID 3172 wrote to memory of 3116 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 106 PID 3172 wrote to memory of 4572 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 105 PID 3172 wrote to memory of 4572 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 105 PID 3172 wrote to memory of 4572 3172 {CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe 105 PID 3116 wrote to memory of 3752 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 108 PID 3116 wrote to memory of 3752 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 108 PID 3116 wrote to memory of 3752 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 108 PID 3116 wrote to memory of 3472 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 107 PID 3116 wrote to memory of 3472 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 107 PID 3116 wrote to memory of 3472 3116 {8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe 107 PID 3752 wrote to memory of 4556 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe 110 PID 3752 wrote to memory of 4556 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe 110 PID 3752 wrote to memory of 4556 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe 110 PID 3752 wrote to memory of 628 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe 109 PID 3752 wrote to memory of 628 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe 109 PID 3752 wrote to memory of 628 3752 {93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-06_9022259a9a557ca9471301f0225ac924_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4488
-
-
C:\Windows\{F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exeC:\Windows\{F707115D-4630-42a6-9665-0EB7F0BBC4F4}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7071~1.EXE > nul3⤵PID:3532
-
-
C:\Windows\{CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exeC:\Windows\{CC501AB2-9805-49e9-BF37-87A2F9F46C86}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC501~1.EXE > nul4⤵PID:4572
-
-
C:\Windows\{8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exeC:\Windows\{8CEBC275-086E-4840-AF7E-8AA6DF3D7982}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CEBC~1.EXE > nul5⤵PID:3472
-
-
C:\Windows\{D0F2D579-8BBA-469c-A600-7862596FBDD2}.exeC:\Windows\{D0F2D579-8BBA-469c-A600-7862596FBDD2}.exe5⤵
- Executes dropped EXE
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0F2D~1.EXE > nul6⤵PID:628
-
-
C:\Windows\{6C37CDD0-D654-47cf-B163-D38877B8070B}.exeC:\Windows\{6C37CDD0-D654-47cf-B163-D38877B8070B}.exe6⤵
- Executes dropped EXE
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C37C~1.EXE > nul7⤵PID:2728
-
-
C:\Windows\{D7C67FCE-C341-4f4a-A20A-C4280F627D5B}.exeC:\Windows\{D7C67FCE-C341-4f4a-A20A-C4280F627D5B}.exe7⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7C67~1.EXE > nul8⤵PID:3908
-
-
C:\Windows\{7F61C145-9F10-4ff7-8A82-A97AC12CD664}.exeC:\Windows\{7F61C145-9F10-4ff7-8A82-A97AC12CD664}.exe8⤵PID:3868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F61C~1.EXE > nul9⤵PID:4820
-
-
C:\Windows\{26A88C99-6025-4a90-B797-FE733F50B700}.exeC:\Windows\{26A88C99-6025-4a90-B797-FE733F50B700}.exe9⤵PID:4788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26A88~1.EXE > nul10⤵PID:3444
-
-
C:\Windows\{93F3C868-821F-45a0-B615-FB2F9AABB59E}.exeC:\Windows\{93F3C868-821F-45a0-B615-FB2F9AABB59E}.exe10⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93F3C~1.EXE > nul11⤵PID:3976
-
-
C:\Windows\{D8BE0893-8E20-47e6-B93B-FE0D517DCAE2}.exeC:\Windows\{D8BE0893-8E20-47e6-B93B-FE0D517DCAE2}.exe11⤵PID:1432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8BE0~1.EXE > nul12⤵PID:4812
-
-
C:\Windows\{7A7AA67E-B225-4699-907C-20270A0690B6}.exeC:\Windows\{7A7AA67E-B225-4699-907C-20270A0690B6}.exe12⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-