Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 09:29

General

  • Target

    2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe

  • Size

    180KB

  • MD5

    4326dee944bcc8c239eb01e4928c0058

  • SHA1

    c7cca13f118e4eeba6b885e0d20f314fa38722a3

  • SHA256

    955cafb96504cbc14aec61936f3354dc4460e0743901f187e6b6b1603deaea2d

  • SHA512

    ee6aaee7ce0a9fc49fae6e12cb5cf3d4959ca7f0bf218e77e4fcb0352c26439d85a42f8c13eead0200472105f0e8fa2b47b820c4b90b2dc22dab45522520c930

  • SSDEEP

    3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGWl5eKcAEc

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-29_4326dee944bcc8c239eb01e4928c0058_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Windows\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe
      C:\Windows\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\{711C2C51-040F-40c2-90B5-823419E89B21}.exe
        C:\Windows\{711C2C51-040F-40c2-90B5-823419E89B21}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2508
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{711C2~1.EXE > nul
          4⤵
            PID:1556
          • C:\Windows\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe
            C:\Windows\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe
            4⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:836
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{7E9A0~1.EXE > nul
              5⤵
                PID:3156
              • C:\Windows\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe
                C:\Windows\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe
                5⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1992
                • C:\Windows\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe
                  C:\Windows\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe
                  6⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3600
                  • C:\Windows\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe
                    C:\Windows\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe
                    7⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3844
                    • C:\Windows\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe
                      C:\Windows\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe
                      8⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4848
                      • C:\Windows\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe
                        C:\Windows\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe
                        9⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:636
                        • C:\Windows\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe
                          C:\Windows\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe
                          10⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:792
                          • C:\Windows\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe
                            C:\Windows\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe
                            11⤵
                            • Modifies Installed Components in the registry
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2224
                            • C:\Windows\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe
                              C:\Windows\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe
                              12⤵
                              • Modifies Installed Components in the registry
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2568
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{7AAFF~1.EXE > nul
                                13⤵
                                  PID:1908
                                • C:\Windows\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe
                                  C:\Windows\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe
                                  13⤵
                                  • Executes dropped EXE
                                  PID:3808
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{020F5~1.EXE > nul
                                12⤵
                                  PID:4124
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{FD2BC~1.EXE > nul
                                11⤵
                                  PID:4028
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{2167C~1.EXE > nul
                                10⤵
                                  PID:2572
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{D6943~1.EXE > nul
                                9⤵
                                  PID:5000
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{BB259~1.EXE > nul
                                8⤵
                                  PID:2636
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{ED7B0~1.EXE > nul
                                7⤵
                                  PID:4608
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{5FFBA~1.EXE > nul
                                6⤵
                                  PID:2856
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{B6963~1.EXE > nul
                            3⤵
                              PID:4428
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:5088

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{020F54E9-98EA-45b3-B1EF-B63FE8C8C2D2}.exe

                            Filesize

                            180KB

                            MD5

                            dda06fb03a766e11e9e9f0559207aa39

                            SHA1

                            fe408a54a4c3a35f389e8c19471c8dc9a0359377

                            SHA256

                            929d2d657100073e05731eab831818f8521727c4c8137ada197038bf3f217996

                            SHA512

                            03ca8970ab74d08101f2c5e805327ecb0effb51fde0db6a55f04dd67ff207c5a9d39a3024535868fd73d36bcb05314afb14abad1d90ff29c6cee61a0c0914321

                          • C:\Windows\{2167CB92-19D1-4696-8EEC-04E82FD3CAD0}.exe

                            Filesize

                            180KB

                            MD5

                            d07a23ec1f1312df74e9dbafe226a14b

                            SHA1

                            a879032778207a9799d3a4bb8de2f46da26dcba6

                            SHA256

                            0229d1c8a2b50b379c0ba6c205381ae80a39c994010211c2ba7e8280cbca6e5e

                            SHA512

                            88a188a6a5cb2858e964d793c2e44c36529f00dfd93a116725e8fa07f0aa08961aa8dcae12a788d7414052c3a49ad6966f1886465739c5f0dda56630e3a66938

                          • C:\Windows\{5FFBA6BC-24E3-4228-B338-6864C472D1F8}.exe

                            Filesize

                            180KB

                            MD5

                            75fc095f8a2bb66e9ad2a206d2416214

                            SHA1

                            8db3e999ffd5ea0b9ab73b173bfff17f49a4911c

                            SHA256

                            becba5ed422d67dda11a3d3cab3994d3f255eed1eb7ea954500a2928e91cae7a

                            SHA512

                            ac633dd597bb8dba7799e9050ef74f3f1d41f54394b8e46d9829305d2ed2dee45117e31c808f22286006383f9ed6332e36a51b8145988d0e1c93745d7d3b0bfb

                          • C:\Windows\{711C2C51-040F-40c2-90B5-823419E89B21}.exe

                            Filesize

                            180KB

                            MD5

                            1604a3b7c05caf021d2ff64838e0b342

                            SHA1

                            267aa52cec623c1e38f92e97ae80b2525f3d37b8

                            SHA256

                            04adac248b9f4c945a8eba26f7f7fc7b5a21f2b090a49636e579d48cf9df77fb

                            SHA512

                            2d4415fad0f5b2f10666e9dd41c187a92f173b829560bb7e2984dc71707d971e08fca6cbc85d669ab93ab712af0081e46d53b265aeced213bb5d372627d16715

                          • C:\Windows\{7AAFFC82-5398-4fa4-8151-C45378B0F09B}.exe

                            Filesize

                            180KB

                            MD5

                            5bb09be2d87d05591925401fd314ad34

                            SHA1

                            b3bc95a02d548da6767d8edc31aac6803b817416

                            SHA256

                            84c5f79b1a03affca4c8f5a4b397d9bee698b9ffbacbec098c2bf07329c1e502

                            SHA512

                            a4fb46fa99951222444709c45f991d8db306aa84a4490e073e46c78e4555df6e40c705a78bd2be0355a1b7d2ee5ae3fee4c6ff0d1c9f44a1b270b525bd71abbf

                          • C:\Windows\{7E9A05DD-9DE4-4a60-9648-5F2653D1B861}.exe

                            Filesize

                            180KB

                            MD5

                            d2a67a0a428a1032b9d0bf7ef0c2cf0d

                            SHA1

                            38c8d344d0c5b55312344dd5e2d5e9680b8ecaf9

                            SHA256

                            665e4f516604fb81883dd44bf1aa22616a900d722c580c98769c5dd81ffa93a4

                            SHA512

                            8d027cc442eef916947c6f0c40fc01c3de30225bfe326762fbabcfa54303196a6600e992eb17814287700e9e9cd628cde44db8b148c6ca557df78f17683e78ff

                          • C:\Windows\{B6963156-1B3E-491d-AAD7-5A1EB90738CE}.exe

                            Filesize

                            180KB

                            MD5

                            34324cca096a08d34dded85961e269d8

                            SHA1

                            131790662ef577e9ca274d2d9c7f371bf57b26b6

                            SHA256

                            2cb73d3164c749701492e33a9c25a46b2af631bce161d2faafc47a258dfb717a

                            SHA512

                            31a8f5a752bb38d5c63dd0d3950e43eb21a5fee80394319986b80edc0da5b49990a12a7756465cfd6de1c7af35df1f25d34b5704587b804411b6aea89d7774e9

                          • C:\Windows\{BB259EF2-B813-49f5-BBD8-C99034FE65B8}.exe

                            Filesize

                            180KB

                            MD5

                            10a3cd236bdbb517fd948472ed4107c6

                            SHA1

                            a4e74326655eaadcf4dd096f1e4c32bed21656a7

                            SHA256

                            77515efc4299be53ed24b971a3b890a084899cd673a5eb21c1785a4bece254ba

                            SHA512

                            bffb1c6d75bc87f0ec3fdb47a9c6aa5071f0b5c4beba36604f0bf032094b74c1b7c016909d715784477fdae9c6945f5c4cb2ebf3a77a8ee3e2c76c31a9ecdd80

                          • C:\Windows\{C693D759-D7A6-4f9a-93E9-F92F87C3262D}.exe

                            Filesize

                            180KB

                            MD5

                            5deb3e47b703a080a6cd0b6f1f5f76cc

                            SHA1

                            fd9eaad6053b92a4ddffaeb3097f281ff0bfd9b4

                            SHA256

                            98f8f81fa4b5f515ba22e63e4e5e2c2f8e1016f6a0b9870497fe0100d65c1075

                            SHA512

                            e85c8ea83b2a2bbbf5087d6ac4fda2057b47b37597047440c1e5d0b5f4c2fc1a54c4ce414184f80fe4aa4589764f4cbe543f61f7c3d6ec6d93eeb430f6e3b81c

                          • C:\Windows\{D69434D5-F5FF-4f98-AEEC-3C2053E8F6D9}.exe

                            Filesize

                            180KB

                            MD5

                            b5ca5dca24b083e8220688af190ab736

                            SHA1

                            28947ed86d5f7a8abc9906d4f1f59f164efa883a

                            SHA256

                            a80a166172943d5cf84ed6df3ce91a449d4b9922518a6a52bc7c6781dc89eceb

                            SHA512

                            88c2326cbab4df83c422bce54533c8c466aa8dc1b47fb231b886c9ef15d14dc25aec9acbb8beba0d4c38a3946d9a79a8f3cbb279d774b04122839f44eed1d16c

                          • C:\Windows\{ED7B0499-3D96-4336-A793-1E0F93DD2FBC}.exe

                            Filesize

                            180KB

                            MD5

                            1d66a2afb3532887210526e86ad10698

                            SHA1

                            71080192f4637a1ac05b1523f3b88e5fb1b7a144

                            SHA256

                            1627ddcb71b2d4a7c709111f49acefb03acfd44647485f7bbe560c61e631ce50

                            SHA512

                            c120cf59f572ce8ade0654b86c4d319e1f9a3f85eee51b0c71798887f6be973648745d0f8abab3eea8947e2a484589e08ba94ea505ff6c5e76e9fcc15d2ec49e

                          • C:\Windows\{FD2BCC84-CF08-42df-B29A-EB24C0222BE0}.exe

                            Filesize

                            180KB

                            MD5

                            be8f59d08905c08a59f2948d1e55df3c

                            SHA1

                            85f4cafeb1a139a965837b3e87396ec13a5faa3c

                            SHA256

                            f33ac18e0e2ae3c4e294021430adfb45f2c842d062fe47559e9702595d1d64f1

                            SHA512

                            3af3ee30f8f573a71a9b9f60b30a0074fed8483fe7f3a9167ee6eb9e62f4dbed26e8d5a8eb69d09d9ecbf70607aa2940cee9d12aaffe510f85b11568afaadbeb