Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
11/02/2024, 20:36
General
-
Target
2024-02-11_9658e0d58bd8127d42e2598f9331ab02_goldeneye.exe
-
Size
408KB
-
MD5
9658e0d58bd8127d42e2598f9331ab02
-
SHA1
f37c3c2802f59b27cec19943f33576ab8663670d
-
SHA256
27c5c1359062d74db18eb6016eeacf9353b1d947fb999970485418003498a246
-
SHA512
a3ee60a013943f21de5c9d504b3d3ed9aadfe31db06c2c02cccbdcfaf36fe5b0ebe67ab5b4d72561e76f021eb0f0fe3065c011507296c28402c7f15e251861d3
-
SSDEEP
3072:CEGh0orl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_9658e0d58bd8127d42e2598f9331ab02_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_9658e0d58bd8127d42e2598f9331ab02_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FA4DD9C-EFDC-413e-B543-C58F4EA8CD95}.exeC:\Windows\{4FA4DD9C-EFDC-413e-B543-C58F4EA8CD95}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5A7EA6F-6466-4d32-BAD7-0C85638B01DD}.exeC:\Windows\{F5A7EA6F-6466-4d32-BAD7-0C85638B01DD}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA9E6A79-E7AB-4f8c-B36E-00CF8CFE2606}.exeC:\Windows\{AA9E6A79-E7AB-4f8c-B36E-00CF8CFE2606}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{900E7BA6-CA6A-4747-A38B-52714909D4A1}.exeC:\Windows\{900E7BA6-CA6A-4747-A38B-52714909D4A1}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09E6E862-E3C5-4c76-B9F4-531184AC11DE}.exeC:\Windows\{09E6E862-E3C5-4c76-B9F4-531184AC11DE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E806558-3A94-45e2-9A0E-DA4CF6600AD0}.exeC:\Windows\{2E806558-3A94-45e2-9A0E-DA4CF6600AD0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A5C5A24-372E-4258-A0C3-CF7D684BBCC3}.exeC:\Windows\{5A5C5A24-372E-4258-A0C3-CF7D684BBCC3}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82F37170-0A94-48ce-BB84-55FB27619156}.exeC:\Windows\{82F37170-0A94-48ce-BB84-55FB27619156}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DDD551C-64C6-4993-A81F-576709459FE5}.exeC:\Windows\{2DDD551C-64C6-4993-A81F-576709459FE5}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFA68BA1-874B-4288-97C7-126229F44DE3}.exeC:\Windows\{CFA68BA1-874B-4288-97C7-126229F44DE3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFC6F225-8E68-45ee-A91C-DE9152B50997}.exeC:\Windows\{BFC6F225-8E68-45ee-A91C-DE9152B50997}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{388EFD44-2D3E-423b-8863-24F4636AE7A2}.exeC:\Windows\{388EFD44-2D3E-423b-8863-24F4636AE7A2}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFC6F~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFA68~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DDD5~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82F37~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A5C5~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E806~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09E6E~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{900E7~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA9E6~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5A7E~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FA4D~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5e7988481f5974ebed403655c884d9f7b
SHA1c5cc6749beb1ca5b913e87e35270344499cc7aa4
SHA2564101e7b27d4cc2988fd488921239992ff20b899eab74ad19611947211f55669b
SHA5123f97c628514283fd480405d9dca077a51041a5fe874cf291c759b1f5735224929ea629b4a0c568759a357a9340c02b9ee7b226e0dd9d4b7eeb426164ecbb052c
-
Filesize
408KB
MD579569ae1c373523cdf76b75a78438d31
SHA10dc44cb4457db2b9e1ae8eeae7c10f05abf112bf
SHA256837192db467ef0ffb1d95fcffcbe7ef927c4b73575d44370dcd1c975a93949fd
SHA512701d9c6b3372f3ebf36ab0c142b56300be5f1049596d154fb5fb8cae059a4ad466c01f4041c706981bbcc77e5ec774c8f64449679f983555eaa25027044d70a0
-
Filesize
408KB
MD500c9b601c288a38fffe77996999a2058
SHA11d54438229a4e8d4a6c73c15f1a15907340cc1c2
SHA2567ca4b588e5aa4394479b3c393869094cec41a315bba5d0bc736cad1ee7319052
SHA512a744d47c4e6911a8b1236f0c361c034b9c2481419509a8feebdf7e19ece4c5cf07d3df55aaec0cee2f254984574381e29d7f636bf54fc0a8f4d7de92eeb6fd51
-
Filesize
408KB
MD5da877b026b3df6e1774caf6b16d30ba1
SHA1c835b93ed8f675b1a9eb92a1052b73eb63566a68
SHA2565245f983a8b6b4f8f579cb372d501a07ad45240b3cfa607d186116a82a8bd72b
SHA512ef6be3ae35b3b81eaa7b62b62efdad21d01fc043b46f8728ccc3f0be4170dd372f29ccb4bfa37d585f50077abe6e40a9c4c309055a69bc5455bd3d85ee2c3b09
-
Filesize
408KB
MD59f7c2ad29b246311bd878fae4fad0c27
SHA1f9e42b61b2c5be357be7144fead3adba761d4c32
SHA256e2c2858395bec66f7cf1be9aa05eadf8590a059a7e275f4fa6e3331ae9847e3b
SHA51232dd1d6655c7aad82eac5ad212f1f5eba2efff0b5d792d7081c2e57c9eec0ef40159591e4b67b80068bf66eba9ec60bb7e9c6428b84f55b370e53f788a594d12
-
Filesize
408KB
MD5c3bb13d3a5dd3035fc3622d991d948e2
SHA101e8f693d7879fb3b47ebab0f6d042d4fbb12246
SHA256f3375f3132bcf0acf554dd9d8761de70453c9870113989f66c66299305e026c5
SHA512b1568aadfc3edebc7828cc5b40000edc2935448500498ccd3bd750a136a733c2a64da7b9be952d7ed3625df3279674382cd7e742f2edc4f07aeb6e9691cc0ca6
-
Filesize
408KB
MD5a7bd9ae236c81130c1d1f70c19da735e
SHA10e86aae28b14aec7ca61f99d9106c2a17eac4c65
SHA256de77797088097befb276697fdeb51b6304b894fe17f1e7755071b611faa82795
SHA512edad5866be45fed570a997cb440d234eed5508da0ee85bc0ded20e0ea4eadaedc624de0f3e188558a8f8712a671f4f22ffde21229066fff065375361a4b6f673
-
Filesize
408KB
MD5fdd55a6aafd132b4041c8149b5267b45
SHA1e68455ac2a1abeff454a4b811524bb7a140b50c2
SHA2568725f44decf36bbe1640fad4ada14cfb40d20ac9dea2cd0e009c762858b9599a
SHA51221a78258b23e8bd4ba39b4dcb2cb03ce53de3fc9ed1dcd8c16d23ff0bcb90bd78293cff9ff673c1af83f4727a27add77975660fd8e24580036cfcd19abaf1663
-
Filesize
408KB
MD5677e47631f1520c7174b7d0cc49def8f
SHA187a310d4b4f7d123eaadb4dcc8e6fd4fac8b721f
SHA256f2e76ff70d75097fe987a3e07208ed602b2bae87051817ce121597c4ff0db810
SHA51235d94e5678fe2bed4fb3216e2536e1aff3846e6ad476a983106f29312ce522237ab2dd01fea1caef70bc7aa4b14164fd023f7b3ee7c913fd6a45865156de96ba
-
Filesize
408KB
MD5c83a726bca922c424f322cf7efff9957
SHA1bcab103f70855713519ecc3bcc0e9f60c9dc8680
SHA2565ea15051ada8a526e9bb9619e3ce57105a81addfb5839ff453b72243d80174cc
SHA512d139dc20e5b5d193953a66406b9a0bf0049978fdb1210cc7049db45ee20605d8276974a4b521941425cf9370468b5a72b952747a49aa55010abae2d72337af95
-
Filesize
408KB
MD5c36c6603779f7fb498745cda094b1530
SHA171ee273f93a99e88d6523bb38137786c9a742313
SHA2568cbee9fed1cf71034db2287df7df0df7cfc003ed6ef823e3599a9da9a4b87b7b
SHA5128b5beffa27db98993c8e2790335ed8ca0d14c8eb11052f3b357688604fadf3b28bd5ccce449a88e8c9c2fba8f9e31688d96ff2c6e73877a9d3e0351f11a38585
-
Filesize
408KB
MD58d6f2f2da1f37307be6bc1aba949c1f8
SHA1e6a0f2754c2424ce7a28502fe92a31bb4e2952dc
SHA2564e7d12defffa79f6bd3fc445a21a66522902ef4db5e51f798b8ff5650dce4c2b
SHA5124300c4adeafb7971b900f51646adc5d380edcbc264554faf0d39acf101fb141ce28658e0b9e910690216f2050c506da7d1c73391d88500e35aa761619ae51931