Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2024, 06:45

General

  • Target

    2024-01-08_ab1277242a6b4aa8e18db0602804abc0_goldeneye.exe

  • Size

    344KB

  • MD5

    ab1277242a6b4aa8e18db0602804abc0

  • SHA1

    56fa4481f7a8c06b4e9b4d38f3b16c920aa56c85

  • SHA256

    ba7c061fc829aacb4170b9fca8d6337b8c3324cdbdbfcbfdb26d2a92d06f7d2b

  • SHA512

    71fdd5e615ed9aefb4bc76770b188c7cdcb8d7a0bb0215143a63adec048b64f2b32e103ff3e5e328018e25ab31083d385c97ece733e92561a4cdc0bd99ed823d

  • SSDEEP

    3072:mEGh0ozlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGJlqOe2MUVg3v2IneKcAEcA

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Modifies Installed Components in the registry 2 TTPs 10 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-08_ab1277242a6b4aa8e18db0602804abc0_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-08_ab1277242a6b4aa8e18db0602804abc0_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
        PID:2508
      • C:\Windows\{DAA97C71-C909-423c-9283-F0F3F749BF23}.exe
        C:\Windows\{DAA97C71-C909-423c-9283-F0F3F749BF23}.exe
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{DAA97~1.EXE > nul
          3⤵
            PID:4920
          • C:\Windows\{D78F0873-5F70-4aba-A0F1-CC85365B80F3}.exe
            C:\Windows\{D78F0873-5F70-4aba-A0F1-CC85365B80F3}.exe
            3⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{D78F0~1.EXE > nul
              4⤵
                PID:4872
              • C:\Windows\{A72188CA-A337-4cd4-A560-D407EACA8DF5}.exe
                C:\Windows\{A72188CA-A337-4cd4-A560-D407EACA8DF5}.exe
                4⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2292
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{A7218~1.EXE > nul
                  5⤵
                    PID:2312
                  • C:\Windows\{5EC38A4A-5B87-461f-A178-CF93587F8FFB}.exe
                    C:\Windows\{5EC38A4A-5B87-461f-A178-CF93587F8FFB}.exe
                    5⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3208
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{5EC38~1.EXE > nul
                      6⤵
                        PID:2996
                      • C:\Windows\{6FB22F4E-B4D1-40d8-9FA6-058D0E9F0511}.exe
                        C:\Windows\{6FB22F4E-B4D1-40d8-9FA6-058D0E9F0511}.exe
                        6⤵
                        • Executes dropped EXE
                        PID:1544
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6FB22~1.EXE > nul
                          7⤵
                          • Blocklisted process makes network request
                          PID:2356
                        • C:\Windows\{C2EF38E3-2B3D-4567-902F-E2B9C5A782AD}.exe
                          C:\Windows\{C2EF38E3-2B3D-4567-902F-E2B9C5A782AD}.exe
                          7⤵
                            PID:8
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{C2EF3~1.EXE > nul
                              8⤵
                                PID:1540
                              • C:\Windows\{34A49436-9893-4d54-82C5-47714CEE1F45}.exe
                                C:\Windows\{34A49436-9893-4d54-82C5-47714CEE1F45}.exe
                                8⤵
                                  PID:3396
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{34A49~1.EXE > nul
                                    9⤵
                                      PID:876
                                    • C:\Windows\{0634A832-530D-4b2f-A4DC-7D2DED71C337}.exe
                                      C:\Windows\{0634A832-530D-4b2f-A4DC-7D2DED71C337}.exe
                                      9⤵
                                        PID:3112
                                        • C:\Windows\{35821CE5-6265-4308-9737-306E4ADCF2D7}.exe
                                          C:\Windows\{35821CE5-6265-4308-9737-306E4ADCF2D7}.exe
                                          10⤵
                                            PID:3180
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c del C:\Windows\{35821~1.EXE > nul
                                              11⤵
                                                PID:5048
                                              • C:\Windows\{3067E61E-2DA6-4bac-9E74-0D9261F3A377}.exe
                                                C:\Windows\{3067E61E-2DA6-4bac-9E74-0D9261F3A377}.exe
                                                11⤵
                                                  PID:1156
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{3067E~1.EXE > nul
                                                    12⤵
                                                      PID:2888
                                                    • C:\Windows\{A62D3E18-48EC-45c8-8164-DDEBFF2967B0}.exe
                                                      C:\Windows\{A62D3E18-48EC-45c8-8164-DDEBFF2967B0}.exe
                                                      12⤵
                                                        PID:3548
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{0634A~1.EXE > nul
                                                    10⤵
                                                      PID:2884

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Windows\{0634A832-530D-4b2f-A4DC-7D2DED71C337}.exe

                                    Filesize

                                    17KB

                                    MD5

                                    cf95c12951d78ef75e8e5d79c42b1417

                                    SHA1

                                    ea6050e8bdc58ebcda1b441653313df884af0d0c

                                    SHA256

                                    c25c08516d164ffff55d29d31b9c2edf688b54c40dcb05e4f388c0fdddd905d9

                                    SHA512

                                    854eb0a46d6d0b35afa9c24b8cd77d1f7703219e18dd96080f7f715c80c10b371312e58f76f2475d3aa413d89d5813af3d47af4d5b6249317315a29a9739781a

                                  • C:\Windows\{0634A832-530D-4b2f-A4DC-7D2DED71C337}.exe

                                    Filesize

                                    35KB

                                    MD5

                                    b47b1147a94b06d07cb2cea1ce7b28fa

                                    SHA1

                                    0a737150ac6faef5fc08ad031fae4d827f7718cf

                                    SHA256

                                    f22de30de0b5110688e4067e0bb37f6f57eb3c8cac0e6e4f277e2602f0ba9078

                                    SHA512

                                    d3b1c3ec973dee8943080826ce2c3fb718cc70ca75e0200f535002fdf0b7247cbccf1b547f9e1808b84f1863581be9a64964a6e3578522ac2fb5f432af130e3b

                                  • C:\Windows\{3067E61E-2DA6-4bac-9E74-0D9261F3A377}.exe

                                    Filesize

                                    2KB

                                    MD5

                                    3cce3c2124a4e779d26e4bd7847635c2

                                    SHA1

                                    244448def30cf10e1f68983031b4cab34e5cd6aa

                                    SHA256

                                    eb23107d8f6aed39946ca46b5d3eba2b41bf6d99dc5b0d44c80cdc751b468857

                                    SHA512

                                    ffedc498bf218de7e1468fe3c8c935978b2ea3507c119fee798a4bc894f0b9733a091b78341354b5534ea8a46bd50d293d5b90b6453202664af6a3fcf70d2da6

                                  • C:\Windows\{3067E61E-2DA6-4bac-9E74-0D9261F3A377}.exe

                                    Filesize

                                    16KB

                                    MD5

                                    e9a3de71951e79e1401bc643f910b1bb

                                    SHA1

                                    4fb84a566470850934bd733a8828788cd6d0f430

                                    SHA256

                                    a218a5f4d6a29b841e6379ee0934e3ff7b58f3ea5fa45448677f3d3e86fc0d2b

                                    SHA512

                                    e91b42d3e295d97565bb720859aabbfae7b2b9fbb5756d394e565814c33bd6da77d0c390a83af7f5f298f4ff1b5b3ddb63ef8bda435a242718f5c9b62f07cf55

                                  • C:\Windows\{34A49436-9893-4d54-82C5-47714CEE1F45}.exe

                                    Filesize

                                    30KB

                                    MD5

                                    db978ee3d5e62a4ea30a832d24a19fae

                                    SHA1

                                    e99822f98ee1b31731108f9c60c74d94bfd5b477

                                    SHA256

                                    8c71988289076e6f34be5f0a197d6d9cfe5507d3e431c78521dc4c52c803a129

                                    SHA512

                                    a7ff8706599c1bf4540f3063a881c946454ae61588df69b5ed9e53c71fd0d5cb8ef53e8e64c9e77bbd53329bf6e29a040b4d5aaebcdb7b9c7753d2081a7db873

                                  • C:\Windows\{34A49436-9893-4d54-82C5-47714CEE1F45}.exe

                                    Filesize

                                    5KB

                                    MD5

                                    7b75e3026782df110d7a5fa2166ff764

                                    SHA1

                                    78e104780270877d95738c97167af944371ae19b

                                    SHA256

                                    508eca70968bc2ffbd35e4119297bd773e676a4b92564e2dcf10e6ed40066d39

                                    SHA512

                                    c6f8551a9e2526c58418eebb1d4484650c45e75e2850be8644a18d6ac854cf598f2375a2c00adcb12d2c900ad9c682717de4654a7032ecc4493424344781d7d5

                                  • C:\Windows\{35821CE5-6265-4308-9737-306E4ADCF2D7}.exe

                                    Filesize

                                    64KB

                                    MD5

                                    2129390d9b309ebc55bc4bfc1f226e05

                                    SHA1

                                    e4164565ab0f2b655bac54cc90c65f2181180777

                                    SHA256

                                    2ecf081a6bbd55ff6951d251d7b84413c5b8393cec1b71b9e20ea5d6b610edb7

                                    SHA512

                                    6604d900c899c481141b95b03df7d0eb12c4502e09f7afe47727249f02b4c10fe84676ed92921a59da1535a84ad2350e72f6357cf60c77ad336c1d587c5216e7

                                  • C:\Windows\{35821CE5-6265-4308-9737-306E4ADCF2D7}.exe

                                    Filesize

                                    76KB

                                    MD5

                                    7b32251f76ccef32156a40f6f63b16fc

                                    SHA1

                                    8326bc70c2b441c62ce83fb36f227d5524cad2c3

                                    SHA256

                                    680e4562bde798e57392726b4361625c339d54c5c5c53fe3002974a1ea925adc

                                    SHA512

                                    15e44dba425829f10e2a23942d1226693916a2ffe7fcbaa384390656e74fda9b6333d4fb8f04f936ae78fb00b228b11aa84946cd7c14e01a9d73ac02c4ef12cb

                                  • C:\Windows\{5EC38A4A-5B87-461f-A178-CF93587F8FFB}.exe

                                    Filesize

                                    46KB

                                    MD5

                                    9e5d0cc2f81e3b150f4394b7cfb0e6c7

                                    SHA1

                                    6802d3f58600774728537f08761f3d22fa5c1e5e

                                    SHA256

                                    de51fc30f5bb513cdfd756c16bb66f710a3f25db7fb5bacbe4314b03419669c2

                                    SHA512

                                    b16c6b9e87f1c0a4437ddcedc040c7afaaa822a01c3a2dfd9acd86a539af5c09eeaaaae94133921aa127107b94790733c97b36a219dc94cd9377098823cc5803

                                  • C:\Windows\{5EC38A4A-5B87-461f-A178-CF93587F8FFB}.exe

                                    Filesize

                                    77KB

                                    MD5

                                    954f63c225a433161155e1712f4aed3f

                                    SHA1

                                    03e993fa398f9345efc34e449ae80ce076b838c1

                                    SHA256

                                    3000215ce2065fd649ab5a92e5eeba7cfe3211d8301259ac5d96dccc6598472c

                                    SHA512

                                    e508796830edf5a8a0978e4a4f87b7e65363e2d6bf984656c0d75dbce1f9cbe869d3d1e8d07055792084cd22a72541a8dfe1e469838d0fb69c9bc44305250992

                                  • C:\Windows\{6FB22F4E-B4D1-40d8-9FA6-058D0E9F0511}.exe

                                    Filesize

                                    92KB

                                    MD5

                                    227ea420d8dbc4f1dde7d17c438a4ab3

                                    SHA1

                                    f54a25ecf768328f3f615dc4f1637ea370e56db9

                                    SHA256

                                    3b3ea40218bec64599b19cba85fac802b7961d16d80de35a6d777201d20abf65

                                    SHA512

                                    1f7f2da442e4767dbac2fcc729d198456f260732ad7410d7cda0c19f3bc4d7267ac0864aea4535e276f09ccbbc788eaa2cf498b8c0f8e0b43fcd957d9487452f

                                  • C:\Windows\{6FB22F4E-B4D1-40d8-9FA6-058D0E9F0511}.exe

                                    Filesize

                                    64KB

                                    MD5

                                    7043730e665a2e1534d01fbbea23faa7

                                    SHA1

                                    557e93c6782d5bb119fdde83f50d04c6d5042f7a

                                    SHA256

                                    7dc22e73086b7eb63d8f8e84f966de68b2e8475764fa0e53cf81ce02e1530ebf

                                    SHA512

                                    853d38a6da508bbbf5beb8571f72bf888b758eedf675bc4509295a0e07443d834d27cd014fac05b1c67c34105b55594552dbdf657b62dee63a3fa375d20b5e14

                                  • C:\Windows\{A62D3E18-48EC-45c8-8164-DDEBFF2967B0}.exe

                                    Filesize

                                    45KB

                                    MD5

                                    46c2e122247884b36b92093574ec6b10

                                    SHA1

                                    f00677d983b46dd44dc974e05177e694d63994f1

                                    SHA256

                                    b8569615090534d96bbdae536123291c72938ed61a6339888879bd9e6b2561f5

                                    SHA512

                                    bfc112faddd7c9fa94aa252d3f4058b4b5d069bd59345c88d9d670974b26ea7c3a698bc072e14d0513a908fa9793cf82773926ab84a83003e659b133adc7f54b

                                  • C:\Windows\{A62D3E18-48EC-45c8-8164-DDEBFF2967B0}.exe

                                    Filesize

                                    13KB

                                    MD5

                                    8334fecf8afeb8aa89dea8853601b54d

                                    SHA1

                                    85f995f64431c9c0699251bd03252cad684b5c56

                                    SHA256

                                    239e1e6ccc7a6df4b2c2270bf2adce0061ed7c2249dfb7772a5f2a37bc66dbef

                                    SHA512

                                    cc48c70f02c11ae46a12cdd5823f3f26dfc461927b312cfde84e6de0f2c4761167f112edcd11506ea3c1c2cc5c7738b8de035870947ec3e12e389e656c79e82f

                                  • C:\Windows\{A72188CA-A337-4cd4-A560-D407EACA8DF5}.exe

                                    Filesize

                                    46KB

                                    MD5

                                    65aba279fce6a098c0fc29092ca84341

                                    SHA1

                                    49f41e9bed64f3197ac78a490b8fff5a1874ed10

                                    SHA256

                                    4cca9b902e3c011a8592303ee0bace46fab8c391c2e6daba1a65a5995d9b436b

                                    SHA512

                                    0bdcb49d3a527a3ecb48ba48fc49e5c2b236284508c83b2042e21a784e20e11c060aebc25de491dc7fe848840138a940dff3eac109b9a23d4e18ee24c3f917e9

                                  • C:\Windows\{A72188CA-A337-4cd4-A560-D407EACA8DF5}.exe

                                    Filesize

                                    18KB

                                    MD5

                                    c1272bec03704afd9f14fc90046f788a

                                    SHA1

                                    5c88b72044d415b8fb255cbbf9cc0af1a037596f

                                    SHA256

                                    d515f12405f0988c1bc37cedfc35613c2d6ba000f383cbf34f6c9b0b693b2c06

                                    SHA512

                                    bc4fe52317424dfd6ac476670abc124327c338d81a826cebd040a79c6596eac5152d31de4e201b1cf975b0d9e715a6b4d3fee730b86c111aba5ada6034a9e8d6

                                  • C:\Windows\{A72188CA-A337-4cd4-A560-D407EACA8DF5}.exe

                                    Filesize

                                    82KB

                                    MD5

                                    7e4a8e364cc7ab6d9a6d00eac84cb9a8

                                    SHA1

                                    35241c00df48b439f73a738c82327d72d8565c35

                                    SHA256

                                    98c8082a5f2da47fa6fcd2c799ece2cc2fd1b233c955f3cf81d383fe1be9c927

                                    SHA512

                                    3ee62ae8c59c82eb733c9b3a195e1069af98edd3da66893cafe8a6cfe7f75f454dbb02015d802816d5cff530d3d49623f188f045077bada89d56386188189ad0

                                  • C:\Windows\{C2EF38E3-2B3D-4567-902F-E2B9C5A782AD}.exe

                                    Filesize

                                    31KB

                                    MD5

                                    eb8dca967f4893ff829b70ff04008129

                                    SHA1

                                    288dd4f4c9d167cd81d1afecd3b2f4eac79e1f2a

                                    SHA256

                                    70604be8bc7297aad6963553af49e656db157ec62256ad746aca6acdd6491916

                                    SHA512

                                    a939540a39436340d3ec9b2a69c3a777416be4b281313979baf67bd17b1e823c33d4f6782ac299369c5cb320377300b89ac6b03d130dc84105760e2413058ce8

                                  • C:\Windows\{C2EF38E3-2B3D-4567-902F-E2B9C5A782AD}.exe

                                    Filesize

                                    15KB

                                    MD5

                                    4691f65de7ab8ce3ce376be5e12f9cbe

                                    SHA1

                                    3062718c45b30d150ebe6213ccfbb2858a86af86

                                    SHA256

                                    24252bdafcf4cda639a54d4d58e0afe9d4153f952fc0e858f4cd6a34f92e5ec1

                                    SHA512

                                    fe80b0d71c7b4b76fcd97b9ecd5b96cd9d5a64ba14dca5dc4a98417facec2acc73cf65fc416e27757a6956dc4dc1e4b862ab78b1df55f0fc227bec3109c5d6d0

                                  • C:\Windows\{D78F0873-5F70-4aba-A0F1-CC85365B80F3}.exe

                                    Filesize

                                    58KB

                                    MD5

                                    5236d5654696be68d0100dfe89fd01db

                                    SHA1

                                    52eda0cb527a1ea0722cf4b5233faa4b72364c2c

                                    SHA256

                                    adf6c323123e0cbf9a2c2fd33d846057d0c95c1d6538b13b2d1bc67331841d2b

                                    SHA512

                                    77b7f93b0b0bbd8e42a7afd9ed7e305705ffc6a33ba92e74d65763116da55595836817e2e44b4a0577fa8a2cff1cddac2a3dbd99ec9b21c39b368c012219a9e1

                                  • C:\Windows\{D78F0873-5F70-4aba-A0F1-CC85365B80F3}.exe

                                    Filesize

                                    19KB

                                    MD5

                                    a523cb99e551c0394e7a01d075ae2ff5

                                    SHA1

                                    9fb284cd80ec242466c961f1132365db259c4e9d

                                    SHA256

                                    c577170e1fbaefa78fc48bef754c4aab067ea7664e342ccf0d59165b0a64a497

                                    SHA512

                                    f95ad08aaa7bf9234a56077e4b4b66e2f4b10888ad559315e0e08e5178550e1494fe3fc783adf50c63c5d9001ee7276b3c7723ba4f03d865d1dd9f5c4ae76d8b

                                  • C:\Windows\{DAA97C71-C909-423c-9283-F0F3F749BF23}.exe

                                    Filesize

                                    1KB

                                    MD5

                                    0469c37c06779c374b10516f746e54cd

                                    SHA1

                                    a554cdfb5bfe2fdbef5626dff44175a0a14c9aa7

                                    SHA256

                                    42a50b9c0cdee18b6513ca0684fe36d5108fee23b4202466ba22f5312f2c43b5

                                    SHA512

                                    8116e597ca3fc7d7b801424a1b37533ade4fbe62b33f7045e6eaeb6b03275c7e981498b4e237230262e157aed9d257faadb6ba1586191f0ebb8d87f292cf4ce0

                                  • C:\Windows\{DAA97C71-C909-423c-9283-F0F3F749BF23}.exe

                                    Filesize

                                    16KB

                                    MD5

                                    9c5a5d582213d715889dbb0f4bf7d9a4

                                    SHA1

                                    6bbee6c87b4abda5a3ffb597f719ba021156a82a

                                    SHA256

                                    d781ec6a764dceb81cb19245968630d9b05e3fb6ab49a06391b6bfd7ea701b7e

                                    SHA512

                                    899144804a6bc6f980eb0f7f4cec2a510b26a3438be13e9460d43895fa64dbfa8daa8471767e2eb576d2f9e16beb9f31d9213e4af2556c0c2c5dd17d481b805a