Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
19/02/2024, 21:24
General
-
Target
2024-02-19_09f7d941f77ab2ab067eab1fc0e08989_goldeneye.exe
-
Size
216KB
-
MD5
09f7d941f77ab2ab067eab1fc0e08989
-
SHA1
39e8a2274029eac1867271872d1bfaa16eaf473c
-
SHA256
8be62f5445c27ddf6f28c68f524377fa1fd7801bca0dcea71bb7e5ed46336a94
-
SHA512
9740214327092df31da129d872a2c8945e534360f70c48d22d4feb359a0408d5e5c68700a10f524b2a546dfd57da151fbcec041073ce393a51d68bfeaa69a48d
-
SSDEEP
3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG/lEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_09f7d941f77ab2ab067eab1fc0e08989_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_09f7d941f77ab2ab067eab1fc0e08989_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
-
C:\Windows\{07DD4CFB-8936-4b78-AA54-E0DA9110A998}.exeC:\Windows\{07DD4CFB-8936-4b78-AA54-E0DA9110A998}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07DD4~1.EXE > nul3⤵
-
-
C:\Windows\{5EA41148-55D9-4253-998D-7F26956565EB}.exeC:\Windows\{5EA41148-55D9-4253-998D-7F26956565EB}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA89C8D0-FF69-40e3-B5E7-D336C323BEC8}.exeC:\Windows\{CA89C8D0-FF69-40e3-B5E7-D336C323BEC8}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2592048B-5BAF-47d7-95EC-F271BE987113}.exeC:\Windows\{2592048B-5BAF-47d7-95EC-F271BE987113}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63B800FE-6AFD-4e02-937A-6E24FC578093}.exeC:\Windows\{63B800FE-6AFD-4e02-937A-6E24FC578093}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E99319BF-AE5D-439c-BDCA-391E2E0DAB6A}.exeC:\Windows\{E99319BF-AE5D-439c-BDCA-391E2E0DAB6A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F73BB7A7-EE3F-45ab-9FC0-0EC56CAE4C41}.exeC:\Windows\{F73BB7A7-EE3F-45ab-9FC0-0EC56CAE4C41}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D82DE82A-1A77-411d-8EBE-F5C3698968EE}.exeC:\Windows\{D82DE82A-1A77-411d-8EBE-F5C3698968EE}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12730446-251E-4a25-8F4A-7138FD2DE0D0}.exeC:\Windows\{12730446-251E-4a25-8F4A-7138FD2DE0D0}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D06AEB19-BF1F-4845-980F-D9A8CFC2210D}.exeC:\Windows\{D06AEB19-BF1F-4845-980F-D9A8CFC2210D}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{622E1C8D-2C9F-4bbf-B80D-B103FABCD486}.exeC:\Windows\{622E1C8D-2C9F-4bbf-B80D-B103FABCD486}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8E3F393A-B1CB-4fa6-8C81-313989B9E134}.exeC:\Windows\{8E3F393A-B1CB-4fa6-8C81-313989B9E134}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{622E1~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D06AE~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12730~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D82DE~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F73BB~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9931~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63B80~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25920~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA89C~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EA41~1.EXE > nul4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD547a802129ab80861703911b58ccb94e6
SHA1b441300a21c54e7efaadf05558b9d077cc3af947
SHA2562a550c3235096bd4892e11b5b484ff26cc123e33e67fc63b655f3530dd812e7b
SHA51208a61f4dda8ff8f3b90613602f56ebaac1c7e082276a1fd76c7f7e69ba063494a3a41f9d430a6a29138959a948f6ae51cdf653a172769519d3dacb637646ea8e
-
Filesize
216KB
MD57ff480a40e7391fa9f5297c6eabbcbbf
SHA180114760ca5ee48ac8d5fb3b35858a1eb788adf8
SHA256efdf7d5b8363fb983e93f2601c15ff0ceb6e72290e72a47b76739233913f86a6
SHA5125d2a09ee892bf94be8955850bf8c29bf07107b6e082e3a754aa0230feb176fdaa404300789f94d88bd375f3b0c48bd5fef6e6cb46f60bae1aca7a7b67767f053
-
Filesize
216KB
MD5440cb2091dfe96298f57fccc4ef10f38
SHA14bd7ff711fae32a89de778b4352350342ed0bd5a
SHA2560edfc7aa04309889ada72e3534c2f578e5ce76a06546431978922308880d0d90
SHA512909dfa3652a27dce4b387680d093740613b26ee6b6959ef3cb50ec9014e51f05eb0f08e6fe87a5249fa9c4baac54f519c80232119b03755fdc2d814f164a4308
-
Filesize
216KB
MD5febca7e95bd6a003bd78bf3739fe1600
SHA16cbb67d9d8a2abea574b53f11831ce2707e7d429
SHA2562ddd654ebfcc60c2fbd8c939ca61270cf373c745b5c9f20b437191a257dcc39a
SHA512b2aab534055832b94a1cc1bcd70867e9acdca6ab5af8b4a86b3aa0ac4b04200d5456ded73c5db0ccd0f8ddd26802c291f4c426142f6432d72b6eb36abbc185b2
-
Filesize
216KB
MD5e1d21f3cd6a690e7813760494ade29db
SHA1e3d6d50418f643db6beb30507986124b31cc930d
SHA25679b2d188b4cf926231e2b5adb33e8b2614e482749c3b18330096d37ef0439247
SHA512f1f67cb5ae6d92cb8f3c0b4a4a5c0ea4006cdd5f296981d91f2406b28eee6dc901297e189d06a7302c130379534c662a0225b935cd3a78bae35694a1bba9e3c6
-
Filesize
216KB
MD523d44accffee801c58f02a5493e84a3d
SHA137892b9d5391de40852ce012ac8ba19b94451892
SHA2568d6e08691463203f68f1659ed775a362558b5d9459ec125ef8b888f5e95d6dc9
SHA5128ddc0a4e00a7d96de81cff7b725fb65b3bf93f568b9f5b7dfcba4ef15211e6572af7d59db170c00d46853ae64415f0d5d497e7b6f4c10e1c5b45722d2f68e514
-
Filesize
216KB
MD57071bfeca00759bf960f688b752e8a29
SHA17d77a85464d2c1b4d381e7bfc72f24b199ef0987
SHA256c6e0cb0392b2985c3d149af3d819204e7b1945b4bbbcf20f3eae9b9b637c4a47
SHA512a9581a3d35f748a5fb16daaacc5c11dcb0fb1c687db817068fbe78a78d01b9fa15fe8d3f97b750f511c8328c165b7b25801f959c5df449143bd672bc2bd0ed12
-
Filesize
216KB
MD57f49b3fa2c6397b1d64268c9a5799dfd
SHA189d97dd28015ac4bb8db3300d560e29253eb4bcc
SHA25687a80e088f6f981014309d267f63fa1981b85835522cac8b4b6dda1d1dde3a45
SHA512fab0f41feb365cf9121ca60250215359872146a0b86eee1bf324cfe02757febfc43e45164137c19d0bb79faf01a7ff804a46467d5d45f6289144d276c6362e4b
-
Filesize
216KB
MD563c037ab713f1d391c55bfbeeb63ddf9
SHA1c687ee909b43fcb830fd7772d3515298af3ebf5c
SHA2563533c97071870e569327081c721f24c28e0c36f99ff5e6b73b5375df5028cf1b
SHA5124383903efd3197a7ae620d4756051a1ac10c172a7d337216b8a859549024feb2eaff3dfc2946e9e40288a65c5cc9aacc85dd780d58f77586054e68256512ae5e
-
Filesize
216KB
MD587eaabb7769566501239628b28f0bb67
SHA115865fc883a4c1aa0f813617a8d2a1b823c1cb96
SHA256d77f6b2a02f3c9770f3a0d41006f364e676022b23c4bc5562e5b36762c83351b
SHA5125824e6ddd29d89bbd03ec0faa649a8eddc450b4834c694e2b9efd2f0e2ee1a7a9ed0cfaad720112929db072fa5bfb450133927fd45a3da9ccedbf56eeb70becb
-
Filesize
216KB
MD5a392f7c4ae34552fcb749edde2a31f80
SHA1666f4187bc264aaf0f694282a42ac73aa88f4c63
SHA256a2ff1819c73181c7fd3509e65ccd7aad0b3313ce0edf4b84009c998778016c92
SHA512c824b9d08e75815b214c8a836bb09ddc8d6197189756de9dbdc3adc97d1077a92248a920b6f0f1dc0eaabc8e455445d6d5b058eee46ef8460947cdc0116e06f9
-
Filesize
216KB
MD50607b381a17e903efa50e699e6b38acc
SHA1eaed8fc1de47921b8890051860b522a055e2c39a
SHA2568e51d1a212f674c50a9c0a035b47ac644de84c8f217d207337994a81af887dad
SHA512e0760756e048cdc3db533e8d4bd6934f1a41c36ea5accf2682635e6304a3c7593f262e9117e8d97e01a258ecdeb922695db3f828308a21563db03c4b073c6ea7