Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12/02/2024, 16:42
General
-
Target
2024-02-12_22d143f4e3a1228a8c9b83cc3e27e085_goldeneye.exe
-
Size
197KB
-
MD5
22d143f4e3a1228a8c9b83cc3e27e085
-
SHA1
b3488ae67d7c54edb64443d51516cc15df10cdc3
-
SHA256
69b8593f1239f8450e433391b19415e5097922293a4e89bfff29e32a647338a9
-
SHA512
43bd4c30e7d03ce0cfe99606bcf82abee315907d4b3c2461a0f05e75d4d9625c68365818fdf22eb8f3cb122ff86118acdffb0c93e740896c3c21ab46a92471aa
-
SSDEEP
3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGrlEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 13 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_22d143f4e3a1228a8c9b83cc3e27e085_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_22d143f4e3a1228a8c9b83cc3e27e085_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3ED18F92-E040-4e59-99AA-EFE52F1E3A57}.exeC:\Windows\{3ED18F92-E040-4e59-99AA-EFE52F1E3A57}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFF5E9F3-0EE2-43f1-9B0B-4A630E29684E}.exeC:\Windows\{BFF5E9F3-0EE2-43f1-9B0B-4A630E29684E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFF5E~1.EXE > nul4⤵
-
-
C:\Windows\{F4AFEE09-C361-48a1-8F5A-A824DDF10F8B}.exeC:\Windows\{F4AFEE09-C361-48a1-8F5A-A824DDF10F8B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{95187887-F740-490a-9328-F7DDF5453151}.exeC:\Windows\{95187887-F740-490a-9328-F7DDF5453151}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A54F441B-4827-406b-B09D-D2320A347D37}.exeC:\Windows\{A54F441B-4827-406b-B09D-D2320A347D37}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A54F4~1.EXE > nul7⤵
-
-
C:\Windows\{144E233C-D937-4fe6-B960-2AEA83E25C72}.exeC:\Windows\{144E233C-D937-4fe6-B960-2AEA83E25C72}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9CCD91B-95EE-42a2-BACB-79F4B6131D76}.exeC:\Windows\{D9CCD91B-95EE-42a2-BACB-79F4B6131D76}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8869CB27-9577-44e3-894A-61A7EAD01D64}.exeC:\Windows\{8869CB27-9577-44e3-894A-61A7EAD01D64}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F624C74-DC79-4586-94E2-1624D143CCB1}.exeC:\Windows\{4F624C74-DC79-4586-94E2-1624D143CCB1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{120D2460-401C-41b0-BFAF-B147A2FCF588}.exeC:\Windows\{120D2460-401C-41b0-BFAF-B147A2FCF588}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A433BCF8-601C-440c-B6C1-F2BED0FF3E25}.exeC:\Windows\{A433BCF8-601C-440c-B6C1-F2BED0FF3E25}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{736CC8E2-1D9E-471c-908D-FC7130D42048}.exeC:\Windows\{736CC8E2-1D9E-471c-908D-FC7130D42048}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A433B~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{120D2~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F624~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8869C~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9CCD~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{144E2~1.EXE > nul8⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95187~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4AFE~1.EXE > nul5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3ED18~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5433af0b74db9e2542533ed4d619ee578
SHA1cd1f5e61d27faee3a721f5ab0a991fbf07e59557
SHA2560825c0ed3c4a348d774987c44edcc27a723b1a4e2222f90c597426b565808a27
SHA5121790f712b909efce53ee328f9511ac4329f11e47ab792ec799aa9b96725c1a71e0349434d7c872034773574e4863fd8ceba9efabe3b220bab04f7512d8644d8e
-
Filesize
197KB
MD5b24f8bd69c3e17d1aec496b425f9b5c6
SHA13f8e13c4e5a98c303e83529ef38e25a2c16f87bf
SHA2564d3f9dbca0178733a2fee449bd4d003121fb15c3e5482cc2759f1f6a450318f3
SHA5121e266d2304849ab1b454dc86b2ae368f725f25b013e63c233dcab42e9d1ed725107888b0d386ab4071e62bd72dd81db343e6ebe00ac21dac90d125ca077099d9
-
Filesize
197KB
MD538493e4548d4b766004017b3d726b762
SHA1c5d05db24e5181332f23efbab026ad844869f75e
SHA256bb83df5ca11ef58396fa0fbb02319cfccdcb69ed47668d5d78c74e03d97620fd
SHA512f1c7dd640ed43f5314a92b1f6b26d5b7c793a6e6adb3e0ea4fa60335747533b28e0eb0b3006078361239f9f013f9bfb1336d9b2cfad619a54861b52ec3108944
-
Filesize
166KB
MD5f72b352a93cf1a9deb18dd046b0b35c5
SHA1a4c8f7f87ed15787eb0695259872d080ffa3be86
SHA2563bb9980e81f5207c41e8c161a1a9e6ce41f2ccbdbf469850afb0b087204aa383
SHA5122b730312ea665d27975a9ec1251022dbb1a03947a6c1a937e8f0b57383cf185d6fa0c7f02fd27e49660122407bde0a1931ae48540d36cf48673cf21c1cf4dbcf
-
Filesize
197KB
MD55a65aa5acd33c6d4c136459cb797ba6f
SHA124a4a4c7d189b960cfb47ff2b515ed734429e4c2
SHA2562c30feb7751d1a366dc7b55c5c774c87bfd0f781d962f0d295b5a0565b87fb6a
SHA512eb7264cf56908406023a06bc8d3990f4a1e95548fc027cc08df531e2eb8afe6c4a1a93085a479c2e99c5de14a9b60b229acaaa9dfd3ebeaf0a613d0bcdb03415
-
Filesize
197KB
MD55fba0b8c19d68a3a7bd84c278d7d81f9
SHA106afa23e33c15887d1574f6db341da500bbb0ae8
SHA2568b0353da68e4d00511c14e617538ca0407ad9f93fc3fedfe01fa730b4ef54787
SHA5120f5ca90e745ba43470345852f0644b636764fe900a9ae530310678150dade9eb4cfadaaf8af0277c936a55e3dafcba3a076ce49e7b887e3fff4ba5d800c00407
-
Filesize
197KB
MD5c5e5e5f31feea67d5141ede4485c4094
SHA17452226fe9ea1396b4f20a022a663eacc1025c51
SHA256a87e189128acd44a42b54cd9f3eb24f62126765abb62ef1d8ba0bf6aa7a75d43
SHA5123bfc4510dc7320e6d53d65ebd7a46ea4e61b4ac11fe55e8ec5de2b79651dab63326957f06db13c305aeacf0780205a9a5fb48d01b6f3a48155f12995469cc01f
-
Filesize
197KB
MD597dee705b0aba5a38bca96c5630659fb
SHA1a583cca63880860493874b5d14df353c219bddca
SHA25633f42598d74c77a929e57fafad55e63bb75bc6d3fb25cd4795d1f11b8a7c857a
SHA512a6b23e76f75f49ac3b3779eec7c7a7bcf37b6de7d25e38319b79636d0b7febe7c4150fa39d5a466fd87edc082639f1c6c3054a50614a01a69d87e5a343366d19
-
Filesize
197KB
MD5910dbaee08ba01565a7a26a1ff45ccdd
SHA1577f89a6a74825bb4cb21bbfd8bb2f4be91ac019
SHA256d8d691182a73b450cdcfeb9cff9f4ba2abcf8c51b72ac81e304055977897c580
SHA512007bafd60760b0b0e1e12417b584f98d9eb84ae58e253d4ff342683a6b45328d65727c7b21118650bd2958bd0a87d7079a01c484d49f8ac908b31e0bb00e05db
-
Filesize
197KB
MD503caf45bd6eacb5f750d5350d39f2917
SHA183e5e027a37658350a0eac6435330b18fe1575c3
SHA256d55098e16623b366816b387601b656d841215fe0cb87797d7eb99efaecadf3e2
SHA5128098fbe854d4385c7e27ff95c44ecf4f766fc945b5a05f1eff7bcc6e126fe94aee047e82be72399dbb14e435208400cc144dd245d5c6b14753ea90a7c5a2f891
-
Filesize
197KB
MD5a926d4761939e19988b15120e1b86ebc
SHA19ad8b855bb12e61e405019a1e4596428bd134c6b
SHA2562f8904ef8f8272a628a10aa19c9a4b3eb2a865185e52f6f4c370e3647f37ad6f
SHA51274785b57136dded9f5a1b5ddff522b9a6e57962da4e50fce1430c974aef320b1186de684f032b48ab78600704954e58f08a30d52b9b13f5e8d4b98a97d54b162
-
Filesize
197KB
MD503f50f4457a6436413a6912bd93bbfb7
SHA13014b12ae636a2ef3cc47f870235d7c11c4c921e
SHA2561a36752a86d4a39441ca002361391ee77bf797f1b44fa8c178ac46f569321d9a
SHA5121a0aaddb161241bc9d7f3bbd9059882ccc8c938cd9a135da853c2c163e20984fe9457f28d1bf56e743729943709b3b1f6e284eb41f443e0ff57fde8313f656ff
-
Filesize
197KB
MD569f51d8bcc987777686d951148fca4cc
SHA15fa274f66d3da88a7d95557768e639ff259ad0b9
SHA25697bd5c82f7e83dbd3841b9b794859ee1fafe6b8139aca400f4e3681cc4302cc1
SHA512f894f7c17dc891ea0a8b54c09f76d3e2024abedf176b1018ae989fd64eedfb8d17479f7e29f1927624f9be68f5ee040e724f54dd06198d81b46230c395f77085