Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    66s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 05:49

General

  • Target

    2024-01-09_0de931adc01c63cd69043ec38cc399bd_goldeneye.exe

  • Size

    180KB

  • MD5

    0de931adc01c63cd69043ec38cc399bd

  • SHA1

    a69acffdfd1115140334b3f77b3ca76034aed313

  • SHA256

    3bc5bc83ad3dbea6e0c65783be4c837d51be389fd65811a16702189b1b53d2a4

  • SHA512

    9042a9bc730843871e7761b7d39e7ef503f86b713ec035f34e18effb57f6857398c8d1a952404df6c7d8ed99152c593114ec8ef926343092d8fb5584b5610a8a

  • SSDEEP

    3072:jEGh0ojlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGFl5eKcAEc

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 10 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-09_0de931adc01c63cd69043ec38cc399bd_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-09_0de931adc01c63cd69043ec38cc399bd_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
        PID:4936
      • C:\Windows\{EE170DEC-5603-436e-8B97-31F9C9E999E0}.exe
        C:\Windows\{EE170DEC-5603-436e-8B97-31F9C9E999E0}.exe
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{EE170~1.EXE > nul
          3⤵
            PID:5024
          • C:\Windows\{368ADB6B-62D1-4c38-90F3-E1D8D2DDCCEC}.exe
            C:\Windows\{368ADB6B-62D1-4c38-90F3-E1D8D2DDCCEC}.exe
            3⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4392
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{368AD~1.EXE > nul
              4⤵
                PID:4544
              • C:\Windows\{3BDBC10F-8324-4e8c-A4D2-586076C8C2A2}.exe
                C:\Windows\{3BDBC10F-8324-4e8c-A4D2-586076C8C2A2}.exe
                4⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3372
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{3BDBC~1.EXE > nul
                  5⤵
                    PID:396
                  • C:\Windows\{30EA52E1-48C6-4816-B986-ECC6FD40469D}.exe
                    C:\Windows\{30EA52E1-48C6-4816-B986-ECC6FD40469D}.exe
                    5⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4824
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{30EA5~1.EXE > nul
                      6⤵
                        PID:1172
                      • C:\Windows\{975E7746-51DA-40f0-BEE0-24B6DB314A8E}.exe
                        C:\Windows\{975E7746-51DA-40f0-BEE0-24B6DB314A8E}.exe
                        6⤵
                        • Executes dropped EXE
                        PID:1528
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{975E7~1.EXE > nul
                          7⤵
                            PID:2600
                          • C:\Windows\{C173195D-2665-45af-B452-5E32EF85EED8}.exe
                            C:\Windows\{C173195D-2665-45af-B452-5E32EF85EED8}.exe
                            7⤵
                              PID:2256
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{C1731~1.EXE > nul
                                8⤵
                                  PID:4984
                                • C:\Windows\{7C701A9E-8AFC-4d74-A4E7-6D1149D24B4C}.exe
                                  C:\Windows\{7C701A9E-8AFC-4d74-A4E7-6D1149D24B4C}.exe
                                  8⤵
                                    PID:700
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{7C701~1.EXE > nul
                                      9⤵
                                        PID:2840
                                      • C:\Windows\{9F9B696F-DAA7-4425-BDE3-2A4C726C640D}.exe
                                        C:\Windows\{9F9B696F-DAA7-4425-BDE3-2A4C726C640D}.exe
                                        9⤵
                                          PID:1040
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c del C:\Windows\{9F9B6~1.EXE > nul
                                            10⤵
                                              PID:4540
                                            • C:\Windows\{C5FAA937-BE3F-4372-94EC-BE9A30930CE3}.exe
                                              C:\Windows\{C5FAA937-BE3F-4372-94EC-BE9A30930CE3}.exe
                                              10⤵
                                                PID:4840
                                                • C:\Windows\{0AACDE14-0DAB-4a3d-AED1-D7312539B505}.exe
                                                  C:\Windows\{0AACDE14-0DAB-4a3d-AED1-D7312539B505}.exe
                                                  11⤵
                                                    PID:536
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{0AACD~1.EXE > nul
                                                      12⤵
                                                        PID:3372
                                                      • C:\Windows\{DA246302-5280-4ab8-A455-73020838CA7F}.exe
                                                        C:\Windows\{DA246302-5280-4ab8-A455-73020838CA7F}.exe
                                                        12⤵
                                                          PID:864
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c del C:\Windows\{C5FAA~1.EXE > nul
                                                        11⤵
                                                          PID:1976

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Windows\{0AACDE14-0DAB-4a3d-AED1-D7312539B505}.exe

                                      Filesize

                                      33KB

                                      MD5

                                      12df910641e7d497b34c07b1a31e5153

                                      SHA1

                                      8d785ca14d990a73e56dfffe7c045bec854b9354

                                      SHA256

                                      7e7f670098d921101b67953a20a0847f9d4022f4593d37bceffd1f50569df2db

                                      SHA512

                                      4f4aadd26fadc2d69d9f4e24efda9bab06cf2d77e922dc4901786a2a808bff7d22ddb69aadef9458472af81a4d588f449888fa5f783ad4a9ad8fa1debfd7ee98

                                    • C:\Windows\{0AACDE14-0DAB-4a3d-AED1-D7312539B505}.exe

                                      Filesize

                                      10KB

                                      MD5

                                      965dd431d10e0e85a284c786befe5701

                                      SHA1

                                      6ab3662097c5b2e8f5645485b9f6425bc93862e9

                                      SHA256

                                      0ffc78bdaa41983de302b4a3ffa27dccf7d8df965a34200a0afd743d2e2c60eb

                                      SHA512

                                      98d238f9d0f557e8bf5280e438f92bb0a17c0476a4325127e217b2fedf85449a836774d72d98558081df54ec07906020210578e83ad359dff49579b9b1dc67ff

                                    • C:\Windows\{30EA52E1-48C6-4816-B986-ECC6FD40469D}.exe

                                      Filesize

                                      42KB

                                      MD5

                                      cb958763a61194f6170b7a40df105dea

                                      SHA1

                                      15aa4761868989ac513e592b6c8b0909d2470044

                                      SHA256

                                      4074ef181c07702cf8495f33ad965e176b958eb0fe1461705f67146ed309d5a8

                                      SHA512

                                      622c6e5e2de6a502b48f397726499ca69f68d7209b00e48f6ba88a973a5ae2e5d427207fc2a4acb929be64559ed6750143d8f6eb73efa5afc8b65e85cdb94526

                                    • C:\Windows\{30EA52E1-48C6-4816-B986-ECC6FD40469D}.exe

                                      Filesize

                                      77KB

                                      MD5

                                      c585500f8d8cd69292d7bd547c6f2362

                                      SHA1

                                      d9c0153dc22694268ecfdc9a14aaafc138fe131f

                                      SHA256

                                      60dd8902b730b0760313467965bd26b3ce65c122ee317916a0d1d144cb93f99c

                                      SHA512

                                      35c8610f2914eba4717458dbe6c4b73a3803eda1f97c1e1d6cfd3b87aacc167c4e7b5c7d64d59a1ce2133a9a801f72f40016cae295dcf1858f585cfba2dbfc60

                                    • C:\Windows\{368ADB6B-62D1-4c38-90F3-E1D8D2DDCCEC}.exe

                                      Filesize

                                      5KB

                                      MD5

                                      00867a7d504be5fb031101c2050f9bb9

                                      SHA1

                                      1e2cdeba51e41d81713eba021b269fc0c7f4530b

                                      SHA256

                                      229c08cf8ea1198e9827ec146a8ef445e2d0a1eccb1358ea8953e82bd7536a60

                                      SHA512

                                      aa2ca57eccf9c8f2113051ee0371e20c3f03f4927c822a05ea87da16b23be0ad2c4d0872ef00c610f9b8909f7d539f4ce0c9a64c4edac0a6c9d90fef89417f5f

                                    • C:\Windows\{368ADB6B-62D1-4c38-90F3-E1D8D2DDCCEC}.exe

                                      Filesize

                                      61KB

                                      MD5

                                      9eb9f9592d79460f06b3269574989dda

                                      SHA1

                                      bdba1413d3376026cf80a4e22a87f4a16a97fcaa

                                      SHA256

                                      5c9a55ecf173a1a947607a75365b883fd979fc0af992e9593a9717d537310f70

                                      SHA512

                                      73aa56d64197eba9a0238e57057b1da6cb6bc8240504d159fbbf9fa39e569f42a283a2ad026503c0fcb0adc70b91c2a4a9b055baf3c9d1cf6f3b8f6644d45bc8

                                    • C:\Windows\{3BDBC10F-8324-4e8c-A4D2-586076C8C2A2}.exe

                                      Filesize

                                      145KB

                                      MD5

                                      3e874c04b74579ec989f614126c5ab27

                                      SHA1

                                      51b47e00989acd17abe02347cf88f34e6706c3c8

                                      SHA256

                                      a83f5c51824e14fec5f5aca1ef8ddb232eaf41c135fe622e0325718591d9510e

                                      SHA512

                                      047e9580eed1c4f59a2a12731f2af555d66f5e3c026dfcb0e760bc60df1471101b09f75bb955cb06552ff2535c7440bb4bff22f363c5122536166bc1d8fcba85

                                    • C:\Windows\{3BDBC10F-8324-4e8c-A4D2-586076C8C2A2}.exe

                                      Filesize

                                      180KB

                                      MD5

                                      1c11434b55a569fd04623c184c0ef208

                                      SHA1

                                      19cb9b452294aad059b5d2a9d11e043ab9879445

                                      SHA256

                                      2095c439a69a9a7e6c125f02c9e807aca9e9533985ab6b884485ee2d0442737b

                                      SHA512

                                      de490cacf42657e6a7421107d6c0d3a23dcc636c3110accdd095d2c83673009e10e5f348f9c7ff124b27684e23a598af7a8a9baa3be0193b5db6f67331362c01

                                    • C:\Windows\{7C701A9E-8AFC-4d74-A4E7-6D1149D24B4C}.exe

                                      Filesize

                                      92KB

                                      MD5

                                      dbf41fe71f47267ef0376a7a3ac32902

                                      SHA1

                                      e36933e11634908a7e04c6f1b2a3a479912f9639

                                      SHA256

                                      49c7d2ad0494da8bf83dd811daa9fe5197fe49c51230d67f175ddfa9c0101391

                                      SHA512

                                      7c5716606a70a898281a69adfe4b2a77d6e660aa9e04d7a52f45e8ebc6bdcc37e2f7680ff0dfc313acc944b5ca251c482773e8cbbd868c522afe8f443ce5fbd1

                                    • C:\Windows\{7C701A9E-8AFC-4d74-A4E7-6D1149D24B4C}.exe

                                      Filesize

                                      36KB

                                      MD5

                                      6704b8c41817385ac5eebaf7fb42b9a8

                                      SHA1

                                      e38bfcfe2336445582c40c2ad82cfc63462bfd38

                                      SHA256

                                      ab02c75f8f4ff79749a1723234a6b9c1ad2b4460456782c1f137f6fd813f50f6

                                      SHA512

                                      531a234d875e3f3c060406354d94608e4900e83789c94e201f6caa72d6e85637d24bff9cf5359fdd69ef9e82c52c36ec59221bf1b8f2f1a0e1050f9f496b800a

                                    • C:\Windows\{975E7746-51DA-40f0-BEE0-24B6DB314A8E}.exe

                                      Filesize

                                      103KB

                                      MD5

                                      64757a4cbcd5f945ad1d27e487f9f40e

                                      SHA1

                                      3781f0af1f3860dca5930d1106c012ade0305970

                                      SHA256

                                      322b9a134c321014154cbc6d2e6bddcf9c0168744b731e3b425018e36a6ef14b

                                      SHA512

                                      3aa083ac250cbef7dd64d3e3550cfb604cbb0f356cef3d0fb154d03f262f2b9051d21977289b2a89c1fbcbccdbf8b26e7f46dfd1522dee9362e3f2ebbcf4ad93

                                    • C:\Windows\{975E7746-51DA-40f0-BEE0-24B6DB314A8E}.exe

                                      Filesize

                                      75KB

                                      MD5

                                      d9a010aa51bda372f1cadb56748d6282

                                      SHA1

                                      5eeed216593ccf3dba76d5346a15d8deda03cbf6

                                      SHA256

                                      db822634ca0b5980d4a82073de99a361f063478c028506ddcb1ceca8f69f4a36

                                      SHA512

                                      4a6fe9c3cef7d89b1eb436ecb1a258390487b7297f68c157b152b0e9bfe519d423a51ce39910ff21f087f1dd482aeceda658fdba3c6f08d1f38f86b8ea42e5d2

                                    • C:\Windows\{9F9B696F-DAA7-4425-BDE3-2A4C726C640D}.exe

                                      Filesize

                                      1KB

                                      MD5

                                      4bc0c8a9188ba80b6b1d123f1538b01c

                                      SHA1

                                      f970f1d1eb981593f5dce6c92a843c45a5c93db2

                                      SHA256

                                      8d808b2a37d78acca7fb3cf18ce2a6c378433f6f09a1700955074eec9d0673ec

                                      SHA512

                                      c9ee2ff3915c0df23c16a774bcd2e4a8584e4d938b10e998e95e7095975d88c825c7d1d681916823e64f9076d739769afadff629f6aa608e4e14a41b9d5b5bd4

                                    • C:\Windows\{9F9B696F-DAA7-4425-BDE3-2A4C726C640D}.exe

                                      Filesize

                                      180KB

                                      MD5

                                      7818c3294c038009a41d982628551fba

                                      SHA1

                                      531cb62dd7cae3e13401c966c1a0f4b418e1a0d4

                                      SHA256

                                      f6ec3e3c3d51940832589d0f0aab7542416823ce712d13ec0c0103b4c4526062

                                      SHA512

                                      749627ed45e07cec5e16923e6ece6bb9798ef0c3b22bae343ce220c22b9136dedfa19e2ef62aa0211397443417672ed764067faa5793e5cb9d2abe3f31baebc1

                                    • C:\Windows\{C173195D-2665-45af-B452-5E32EF85EED8}.exe

                                      Filesize

                                      94KB

                                      MD5

                                      d45a0be88c2e4a20fa9f214a5ed9ac76

                                      SHA1

                                      73cd92211e3bfaec90d66cdba697aa0fd772020e

                                      SHA256

                                      2296f929c0eef35be9b6470bbe7227e47188d6e6d2274c4ef4931a910c125758

                                      SHA512

                                      f956b1bb75a7136549500d1ad3e514d4f9ef752d4b277d6f46407ccffcb688358c0a2ecc7dd737584d2be57b2295c90adc7f8f53e4ea1d9ed448dbc9478e2799

                                    • C:\Windows\{C173195D-2665-45af-B452-5E32EF85EED8}.exe

                                      Filesize

                                      77KB

                                      MD5

                                      c4b12ec4679da4d145fd7cf6e85954a4

                                      SHA1

                                      a8f2f72fcf8a7d5e2b795f45013396293e93da5f

                                      SHA256

                                      ff7fc5bcf99802543f2a8bae006b2c01465c1a114aaef99b0a2c479f81f6cdd2

                                      SHA512

                                      14b2714424aed8974643e6149fffdcf8a8b1df2489fec66ad7d534c073eeec3297a31bcad26f216d8a12f81185389e10dad1ccda1118fab2527a3e8251f28c63

                                    • C:\Windows\{C5FAA937-BE3F-4372-94EC-BE9A30930CE3}.exe

                                      Filesize

                                      31KB

                                      MD5

                                      a7f95b4421bd935fcb1620e9e83905fc

                                      SHA1

                                      2486430d5e22a415d15b3af1997631f68f2846c0

                                      SHA256

                                      f4fdecb6267462de6a7fa22c9e1652d0ea915f2c20a42ec67aa5e4348737e033

                                      SHA512

                                      fcfd63e0f8ab7feeb28ed2c4d60037557f61207f98ffe5e928181f811e73e313902fc18bf436bb7a6902ac00c5acc45709133ce0eaff4fceb8ed18719af1acbc

                                    • C:\Windows\{C5FAA937-BE3F-4372-94EC-BE9A30930CE3}.exe

                                      Filesize

                                      54KB

                                      MD5

                                      e10448246e4d80d3c62709d76de5f22d

                                      SHA1

                                      95cb1859e1110468bc32f53f4bb595c58f169137

                                      SHA256

                                      e6d566f8a60dfb1f9e59c5ac893c52ff126c18c5bdae3297b0225d2f3d2b734f

                                      SHA512

                                      d398afd9c1f7293e172d1a26aec62db1143eb7d3350588af94384c42cf3bcc6b467711fe1362b60cfda669bde0ef3741d0577d205206427b29ec0c7782624b73

                                    • C:\Windows\{DA246302-5280-4ab8-A455-73020838CA7F}.exe

                                      Filesize

                                      17KB

                                      MD5

                                      c8c66d7d8856ac49e2a827320e84eadb

                                      SHA1

                                      d0157031d8aeeaa002d6938f8df7b26e5d840a0b

                                      SHA256

                                      726ab778d7e05a75c1b2fcc004ac804fb25c8db23a644233814170c95b1afa55

                                      SHA512

                                      c4bde6c1d894c10418c0a748610ba2e3b77df9aeb1c1bc8b7bba8308041a7e2738cb63cf52732c70ef7c736bd453d2a8e5687cbdac699052003c4a8cfd2e4e74

                                    • C:\Windows\{EE170DEC-5603-436e-8B97-31F9C9E999E0}.exe

                                      Filesize

                                      68KB

                                      MD5

                                      005ead8eae14849407705c0bbb1a2b24

                                      SHA1

                                      283ca62f4faf107f5e1898910cd44faf131bd3ba

                                      SHA256

                                      29c7aafd6e3bae22ddca3e503f89806ada24cd5bf39c666c9438fd9ad9c9c549

                                      SHA512

                                      0121109051d069053765dbcd9d33cff9f63c34a716c7a7825004eb5ac6bba64ffbc9adf02daf06191af70bb16197e0d5ed2a41520f3dae5c4ce1c5669d4123f4

                                    • C:\Windows\{EE170DEC-5603-436e-8B97-31F9C9E999E0}.exe

                                      Filesize

                                      19KB

                                      MD5

                                      0d733d5e91c57b0dcb8ee02ce95519a3

                                      SHA1

                                      ca7cb8c3b1e0ad04489143f257214c5012382fab

                                      SHA256

                                      1aa3e273b8831dd58ad1e0bcec8fda2abf84e8b212f520a97bbe17cce4e7bf3c

                                      SHA512

                                      e121e4f76dd5739c8130e6a33ad22f9fa349971cd5c12231e61635d856b09ca398fb4381b91381962853681707f92147f45fb4b0ec4567e552467fc7e87bd18d