Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 05:52

General

  • Target

    2024-01-10_819f46a2012ce0cfd9460f36183f0ef3_goldeneye.exe

  • Size

    216KB

  • MD5

    819f46a2012ce0cfd9460f36183f0ef3

  • SHA1

    29f6a4b681bbc5a4724b5f6aaba6cb9f45567f8b

  • SHA256

    d2e175588fe5ed613f374d4ef5486f3536a88e97d9f510970d8abfdc7127ee01

  • SHA512

    0405ab6ef6e7e35564eecde754292a0851bfb49315a9ff74c4b6ce326f9a24b0bd0a851f91e59da2e7b85392af38ab6ad7179d86a859eb80b46c903b2a88149b

  • SSDEEP

    3072:jEGh0oRl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGDlEeKcAEcGy

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 12 IoCs
  • Executes dropped EXE 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-10_819f46a2012ce0cfd9460f36183f0ef3_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-10_819f46a2012ce0cfd9460f36183f0ef3_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
      2⤵
        PID:4276
      • C:\Windows\{51F1AA54-5759-40a6-BFB8-21A65B8CA953}.exe
        C:\Windows\{51F1AA54-5759-40a6-BFB8-21A65B8CA953}.exe
        2⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Windows\{EF5EE4EA-550E-44ad-8BA4-0E2AE00D4745}.exe
          C:\Windows\{EF5EE4EA-550E-44ad-8BA4-0E2AE00D4745}.exe
          3⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3304
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{EF5EE~1.EXE > nul
            4⤵
              PID:2928
            • C:\Windows\{D26DCF25-9B9F-429b-807D-E2296FEC85DF}.exe
              C:\Windows\{D26DCF25-9B9F-429b-807D-E2296FEC85DF}.exe
              4⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1832
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{D26DC~1.EXE > nul
                5⤵
                  PID:3044
                • C:\Windows\{2E651CF6-87FF-4590-A61F-283AB35733FE}.exe
                  C:\Windows\{2E651CF6-87FF-4590-A61F-283AB35733FE}.exe
                  5⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3996
                  • C:\Windows\{D39B062C-1E15-427a-BB9C-F8E0216087B5}.exe
                    C:\Windows\{D39B062C-1E15-427a-BB9C-F8E0216087B5}.exe
                    6⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1408
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{D39B0~1.EXE > nul
                      7⤵
                        PID:4776
                      • C:\Windows\{4BA8DA94-769C-4a3d-A4C3-3D10C8D1B8DC}.exe
                        C:\Windows\{4BA8DA94-769C-4a3d-A4C3-3D10C8D1B8DC}.exe
                        7⤵
                        • Executes dropped EXE
                        PID:4436
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{4BA8D~1.EXE > nul
                          8⤵
                            PID:1764
                          • C:\Windows\{E4EFBED4-9B66-4f10-BB4D-6EA1C398F5CA}.exe
                            C:\Windows\{E4EFBED4-9B66-4f10-BB4D-6EA1C398F5CA}.exe
                            8⤵
                              PID:4724
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{E4EFB~1.EXE > nul
                                9⤵
                                  PID:748
                                • C:\Windows\{3C1EF2E7-674B-4290-AE9E-FA277482B8F7}.exe
                                  C:\Windows\{3C1EF2E7-674B-4290-AE9E-FA277482B8F7}.exe
                                  9⤵
                                    PID:4872
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{3C1EF~1.EXE > nul
                                      10⤵
                                        PID:2872
                                      • C:\Windows\{0A9C6E12-799B-4229-8367-56C563B8DE6E}.exe
                                        C:\Windows\{0A9C6E12-799B-4229-8367-56C563B8DE6E}.exe
                                        10⤵
                                          PID:64
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c del C:\Windows\{0A9C6~1.EXE > nul
                                            11⤵
                                              PID:2472
                                            • C:\Windows\{4850709A-964C-4c38-A40E-96160A9B54B7}.exe
                                              C:\Windows\{4850709A-964C-4c38-A40E-96160A9B54B7}.exe
                                              11⤵
                                                PID:544
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c del C:\Windows\{48507~1.EXE > nul
                                                  12⤵
                                                    PID:1528
                                                  • C:\Windows\{02A3EE65-7B63-4018-8F04-70D69F14BEC1}.exe
                                                    C:\Windows\{02A3EE65-7B63-4018-8F04-70D69F14BEC1}.exe
                                                    12⤵
                                                      PID:1896
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c del C:\Windows\{2E651~1.EXE > nul
                                          6⤵
                                            PID:4184
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del C:\Windows\{51F1A~1.EXE > nul
                                      3⤵
                                        PID:2864

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Windows\{02A3EE65-7B63-4018-8F04-70D69F14BEC1}.exe

                                    Filesize

                                    41KB

                                    MD5

                                    f73856586c3c962be271716ca00202e1

                                    SHA1

                                    4615c5e4facaf2eda56202e1a12b1af8a80e4598

                                    SHA256

                                    cb47a59cfed95b9b3a1e6c85b4c7c1ee1de9a7ad54fe2fbbb5954832cf04e5df

                                    SHA512

                                    bb6c5b153d2f73fec0cc932f387b1653eac52906caf2412ba67cfaf74ecaee877136149ab1447caef133c48fb9fb30d6988bf219a4fd9caf0bd7bc0fd96e5fce

                                  • C:\Windows\{02A3EE65-7B63-4018-8F04-70D69F14BEC1}.exe

                                    Filesize

                                    38KB

                                    MD5

                                    ba3e09d797e6c1699243b17dc9dfc665

                                    SHA1

                                    b3e6accd784eaf67b6d025e751369acfa428d83a

                                    SHA256

                                    aedeec84e56aaabe5f7767922f6f47c97f4efa52b763e20610eb54fbaf25d469

                                    SHA512

                                    6c8f2569ace557b216560ce94e01bc8e10e71c4c85545784a34ab65ee21f4b00580659ea3220bd7e39325894881383e70dbebff6d1158efbf28b88be4199ac95

                                  • C:\Windows\{0A9C6E12-799B-4229-8367-56C563B8DE6E}.exe

                                    Filesize

                                    60KB

                                    MD5

                                    48fb0386f07c9d0432dfe0dd32faf083

                                    SHA1

                                    269b42fdcaf3a8c6f5ae6d1a2f873c4183e6d1c7

                                    SHA256

                                    c1cf21d60de5864de2fd651162129c3a457f407eaaf8a95d9d1f5ed7c3394670

                                    SHA512

                                    396defa1fdf20435e6f6488d9912487fdd38f8b61d2ce069d8b8e0e60aefa09005c3bdc67c242beef6db755aeba2c0e1142dd4e7cc3cbf145e543f361a0bd698

                                  • C:\Windows\{0A9C6E12-799B-4229-8367-56C563B8DE6E}.exe

                                    Filesize

                                    82KB

                                    MD5

                                    a2801da54186a71ecea33ab7d8935d75

                                    SHA1

                                    e99195d56ac720138aa3f64da22aa8f32f9e9d7e

                                    SHA256

                                    8c7dc80b4ccb25c65bd42b33d80148dcb8e9e655abb5c7515c5a10be8a2abbe6

                                    SHA512

                                    f1076901541bebc4ce0401208309b6d13d7331d6d4ca64c409021cd630c0df6e28cc2a572fa7d3b535f78f0680351e7d3483e367841fa1f1f778f52d3ca943bc

                                  • C:\Windows\{2E651CF6-87FF-4590-A61F-283AB35733FE}.exe

                                    Filesize

                                    104KB

                                    MD5

                                    ca559083f6860034018ff32bcc88edd8

                                    SHA1

                                    3f606d7259b2fc042d85173cd764a922b8d16775

                                    SHA256

                                    7027467a2006e86edce69b26180728ea8d9e57a4d58bca5ad62842d84d21ab71

                                    SHA512

                                    7c4dfc2080653f4d8d22b25025e461dfc7454e3c7610d9664b0d0c0f7e7bbfcf045b417565c90f50e58fdf8af212557cc6e48a070145bc6a67285ab3fb9eefac

                                  • C:\Windows\{2E651CF6-87FF-4590-A61F-283AB35733FE}.exe

                                    Filesize

                                    37KB

                                    MD5

                                    ce2a6b942d7ff4b7514fe30d5ccb0157

                                    SHA1

                                    562d1496e07fa03323174a7fe2a4a333cfbc79b0

                                    SHA256

                                    19cd3890d059d9a310a8e259bb3a3b238ecbccbbc64780264618c02b6ef167b6

                                    SHA512

                                    11e7b0ca77b759ecdb405906b90fad8aa26734940237fa2be18336e0ab0e8f1f086b316dacbab2a3ff6c7c1832f4802379c9256ee7f8231798aeeb30c54d9015

                                  • C:\Windows\{3C1EF2E7-674B-4290-AE9E-FA277482B8F7}.exe

                                    Filesize

                                    3KB

                                    MD5

                                    c500142b8061603cd1d64c9b56080b57

                                    SHA1

                                    ce4f3d74272e3bb89eac0df81ae7f61b9a8273db

                                    SHA256

                                    3c0224e67e4320ce91aece01ee9175c28b10eab0fe3d1d519eb4ffb65167abd6

                                    SHA512

                                    f31c23ae395878c973c1b69a930b812473ad9193249b949cc6de7bfc68beea7e14bcc0473065468127484680e3554cc796374a33c1fa4cc5a6b9c0837d95f322

                                  • C:\Windows\{4850709A-964C-4c38-A40E-96160A9B54B7}.exe

                                    Filesize

                                    50KB

                                    MD5

                                    b60aa2f211ab7f3d0f598299ec5fe942

                                    SHA1

                                    c982407f5d7ddfaf7fde796db17b58a4bce4d870

                                    SHA256

                                    6e3635f781696eb55e602db200b6f559f72093edfce2c9b93fe4d7f1b032a68e

                                    SHA512

                                    00968170104364bc066984444b09544878186455b60d3ee000e2efeaea2020f806ba8a257787a3da83be8fcad4eef66e04f3bbea8b7d00d908bc259f9a23c177

                                  • C:\Windows\{4850709A-964C-4c38-A40E-96160A9B54B7}.exe

                                    Filesize

                                    26KB

                                    MD5

                                    76d2b70f444468e06a2bd47f55c23665

                                    SHA1

                                    ab12bdffcbd5db3b7521727af47dacb765db340f

                                    SHA256

                                    9bef13bc4a3cd38dc85925435f8eea3da44764c8ded379a60eded98d31c0124d

                                    SHA512

                                    a9535177014ff990398f8251c026279c3e6c54ed5930f087ec0aa5244ea39aeb7b9178f81ddce29569083a93dc08b759af22546f17e6b73386ab02447cc7b10d

                                  • C:\Windows\{4BA8DA94-769C-4a3d-A4C3-3D10C8D1B8DC}.exe

                                    Filesize

                                    37KB

                                    MD5

                                    d2a441011be5f3384ded6df661b9bbbe

                                    SHA1

                                    cbea086a94fadb9d6379b86546ac05c8f482488d

                                    SHA256

                                    683c4a03c3ddee1447015beadf5917251937079e433d3058f57c1bdcffb96f14

                                    SHA512

                                    9b7cb6e6e287acf10a29f764411748c5430932f0693d289f97fcbe387668b9d737518041b4e9bd57536219ed35774a61b83ca9bb7b22e9dd46c4846c27396d2a

                                  • C:\Windows\{4BA8DA94-769C-4a3d-A4C3-3D10C8D1B8DC}.exe

                                    Filesize

                                    92KB

                                    MD5

                                    749b3bb0cb5d1fb774539c6e496bed6c

                                    SHA1

                                    59ac74ea93127332f1100c93a232cbfdb49a3301

                                    SHA256

                                    8ae8cada60d88be823f17f257a2d3356e5c67bdc44c5aa486c1ef10437f3dcca

                                    SHA512

                                    f61dc73ed76dca77ca8edf017c4b732117b2d72c8345be324c8bf52c550f934ab8118f6d99769d3f55148c689926197ba0c3710c061d8ec9d4719274d21f745b

                                  • C:\Windows\{51F1AA54-5759-40a6-BFB8-21A65B8CA953}.exe

                                    Filesize

                                    19KB

                                    MD5

                                    44d6e713064e2aab2b027cb35ba8ee25

                                    SHA1

                                    d6774d6f70d0a0ab1a22ca3eae75896c18df28b6

                                    SHA256

                                    b794525fe1e26a9280b3462adb92c2b39db6fec014af76224e554759fc0c8c6d

                                    SHA512

                                    174a66e95448501a5a2d8cb40d2b2702d59294f948ad5437f17992f09b4c8f21a4a541723b8748b41749b9fed0c67eaf022c90f9e17cc97e5e8551b9bdf49f90

                                  • C:\Windows\{51F1AA54-5759-40a6-BFB8-21A65B8CA953}.exe

                                    Filesize

                                    4KB

                                    MD5

                                    17b24983c4b3f3bdbcfdf2daf2e2f932

                                    SHA1

                                    14aca3523872c44db18b63df4f891d52579b5493

                                    SHA256

                                    49bd85c2d8540da305bca9913ef02c46f47a9515594ee68bf26ef456c8694396

                                    SHA512

                                    909dd5a972f6ecfc1ba1f7b109146a14713e17c8803e9d1f5c09b78b142d8974b31114eda6a6d92a69af2518e7fcccba6ca2184b6f976225514fe6cc07c1b5c0

                                  • C:\Windows\{D26DCF25-9B9F-429b-807D-E2296FEC85DF}.exe

                                    Filesize

                                    101KB

                                    MD5

                                    456f651c506ba30ffc5dab3bf8dd3d21

                                    SHA1

                                    22bcec3d848a554ef3fdf6ab7de062c882797e20

                                    SHA256

                                    f73cdf77d08a6205846a0f291eb0e32731ba482d4388dac8bd517722e129faf4

                                    SHA512

                                    ce85c0c1e5ebb18a6dc999933c84e15c20351867205f3a2f36162bf8455af5fd810a3252e3432ca4d943ea71adbf321a4a01847eb320ebd5220151057d2de8c9

                                  • C:\Windows\{D26DCF25-9B9F-429b-807D-E2296FEC85DF}.exe

                                    Filesize

                                    216KB

                                    MD5

                                    122a1a645a140d7ed0cdeab12d14abfe

                                    SHA1

                                    a399e92bf21df2a2afb7e4984331519edd52360a

                                    SHA256

                                    6422d232b990c43aacd7ac16cacb80269b4431e301771edcb25e3cad265be91e

                                    SHA512

                                    f5080a9cc83d7f1231e344df2b9754e5bd4bfb64734c1b10c28252f5a63158c61e54f7b0483a23374b6b72b161cdc984c2fb546f59b384d9a33d583217eceb3b

                                  • C:\Windows\{D39B062C-1E15-427a-BB9C-F8E0216087B5}.exe

                                    Filesize

                                    32KB

                                    MD5

                                    c2a186a3716cd72c3a9fa3c36754a019

                                    SHA1

                                    a216e8701b9f75aa7f92f2236ba7c2109c0dbc19

                                    SHA256

                                    50318729377a5c3cfc75e65d4da50472ab15770a29222ee6e35497089cc7694c

                                    SHA512

                                    d1747ecd533d7066aadbfb5441a03fb5159d7a8f3acd99ff958a6cb789be4dd7dca7b2420a81b87165e2c37844f65468b7724610d6b4c58d59b81b4da54dda86

                                  • C:\Windows\{D39B062C-1E15-427a-BB9C-F8E0216087B5}.exe

                                    Filesize

                                    10KB

                                    MD5

                                    6d089259e154e3f1f28ffcfc8c736385

                                    SHA1

                                    2f310293d3833957fe427d6af73906dbe86ba66b

                                    SHA256

                                    159b2c1f843b14ac5176317c0618c6482273058965e9f98ec337a4419f4ab208

                                    SHA512

                                    b84b5398509a71b9ef32240708fbfe72ff5a9d1cf4b6910557313a2ca3fc9b16562d532bc15e06f737de78ee2a2fd59996479b84163ea86ac81d2b0e48310c52

                                  • C:\Windows\{E4EFBED4-9B66-4f10-BB4D-6EA1C398F5CA}.exe

                                    Filesize

                                    29KB

                                    MD5

                                    0a3277e2e6c03009cd27b3875819af53

                                    SHA1

                                    737b1294ec5cc6106eabb95dd6c1f4d45fffe80a

                                    SHA256

                                    ef7bdcfa924219bc495e6694081514874634e41c316f0810d2285332b6c8a598

                                    SHA512

                                    d65d4c90d7d5ae91489fc1d24981dd183fc029d2e289af8f1197d1c4fd6a92835a4a8726dd7d2cfafa1289d926bb5041c4926e9bbe6696311e231bd888bf4524

                                  • C:\Windows\{EF5EE4EA-550E-44ad-8BA4-0E2AE00D4745}.exe

                                    Filesize

                                    55KB

                                    MD5

                                    3ad1bae0ebf24f7091eccf06c6b4daaa

                                    SHA1

                                    e68b8b3d824f1cc8810d9123f61dd99c96d6fe28

                                    SHA256

                                    cfcaabe50dbb9d3e69554a859e756bec9e5fa6faa0a56de41e6670241a6643fa

                                    SHA512

                                    65ee31efbdbd0126a0b2cb929c3611cf1c5329958f7de239ae1f98c0783d29cceb7eb6d626d9ad601cb86926c7b1580208d38b7fbe4045befe8daddd43c4e0ba