Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 22:37

General

  • Target

    2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe

  • Size

    344KB

  • MD5

    9d2c783cb14279201d52177459fe9b69

  • SHA1

    343287523da81b036d0c67e144532dbe6e7b29e4

  • SHA256

    4ebf7ebf8d69d2f4f266f12424424acc8e876b6f0cc5697137f205a0e9aae6fc

  • SHA512

    3a4f09184b9bb8746d01216d38f41d3d3f5bd912eb18d43913daa8d5fb8a5c8b9bb18731224f9d8d32d546083e2fafe5fedb39286fc574a3f76363dd9235d355

  • SSDEEP

    3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
      C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{74AFE~1.EXE > nul
        3⤵
          PID:2444
        • C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
          C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
          3⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3036
          • C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
            C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
            4⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2460
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{F3CF3~1.EXE > nul
              5⤵
                PID:436
              • C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
                C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
                5⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:672
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{14A14~1.EXE > nul
                  6⤵
                    PID:2856
                  • C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
                    C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
                    6⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2512
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{B6EED~1.EXE > nul
                      7⤵
                        PID:1132
                      • C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
                        C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
                        7⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2304
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{BB648~1.EXE > nul
                          8⤵
                            PID:2472
                          • C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
                            C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
                            8⤵
                            • Modifies Installed Components in the registry
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1948
                            • C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
                              C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
                              9⤵
                              • Modifies Installed Components in the registry
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1124
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{7501F~1.EXE > nul
                                10⤵
                                  PID:848
                                • C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe
                                  C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe
                                  10⤵
                                  • Modifies Installed Components in the registry
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:900
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{37078~1.EXE > nul
                                    11⤵
                                      PID:2080
                                    • C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
                                      C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
                                      11⤵
                                      • Modifies Installed Components in the registry
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1232
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADA0A~1.EXE > nul
                                        12⤵
                                          PID:820
                                        • C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe
                                          C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe
                                          12⤵
                                          • Executes dropped EXE
                                          PID:2132
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c del C:\Windows\{FD1C7~1.EXE > nul
                                    9⤵
                                      PID:2288
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{8A9F3~1.EXE > nul
                            4⤵
                              PID:2964
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                            PID:2624

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe

                          Filesize

                          344KB

                          MD5

                          74189b3d1a51ca47d21fb89c86542ef9

                          SHA1

                          0c882c9e509af0d6371d2954d9f53da73a01bf25

                          SHA256

                          a9bdb60ac9fc524d63c8a0624619b5420c781adc1243cc65c32cb2c3ea9edfda

                          SHA512

                          6364358b0acb7632c3081a528d34a28a9538c70e1338eb1b28a63f7c54fa749f0c9adcaa4f250da8841cd599e7026bb5120be8190a5397660da92a1a0afb2b85

                        • C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe

                          Filesize

                          344KB

                          MD5

                          ad9d50835312313d9922aab67b2c626d

                          SHA1

                          d5c0f9d23d6722a001429b56194822c7c6ac85e2

                          SHA256

                          b41a3991f95fb9c11d56b8cd74b5a3fa1d0005e0e9ddf0d288338d8af6564170

                          SHA512

                          5427e89c5ac5b68e6871a6a998c8e47c8a44fc032220cd2af1da3b2c76b77765c3cdf1cd6f9e5c205d65d067df7a5ca414508ec5d3fa7ec63eea59f9f60b7612

                        • C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe

                          Filesize

                          344KB

                          MD5

                          09a2ee257b77db907909f6fe664acf99

                          SHA1

                          acbb8b00136e18d5daaacbd0e8a24d01de10b729

                          SHA256

                          7a040bf8c970708715407ab576965ebd37dcd9418fd3d82203ddec687faeb00e

                          SHA512

                          99f9feb75568784f721d8e341696768acd4234e2e9e62835098236dd2e6fee367df35d8f45cc7d2d3deb9a998f92db002be794163cbd0d5dd136062798def5ba

                        • C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe

                          Filesize

                          344KB

                          MD5

                          aba0917e5947d6b9a39145fbbb9465ff

                          SHA1

                          97b8a237cf2a1861ebb7711f6f59b6ac6a961ad6

                          SHA256

                          e361f0e8700833c1159efb7381ff8d9e6d90afe1e2b2d91ec4202d5e9ba2e134

                          SHA512

                          8e26e72b763d5b3bde982bf58f8345b2e9e2cea38602c71bdac0371ee837331c4a48664d630c4f94b79447bb38078bc4465ae37316648fab7d25abd6f8d36a3d

                        • C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe

                          Filesize

                          344KB

                          MD5

                          25942a20e279a185b5b9ca5218bf338a

                          SHA1

                          fa06253543431400d231cb3212cd1afe0b6798ff

                          SHA256

                          e7e5e8fa089069d376151172cc0746d483cca32046e498c609d5a622a34680a9

                          SHA512

                          c626dd26c0817d0c74084eed7d80cb3e2d47e74dd740c200e283ce71f8ec2763291b08fd652718d4c7f5f1b564d4bd3b8016ec2e533b70f5e8521fb13d3e0646

                        • C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe

                          Filesize

                          344KB

                          MD5

                          25227b3a5e42a2d675d1d4b9a41f6723

                          SHA1

                          3602b9f1aee845378f0c148f6e6a720a3ae2057a

                          SHA256

                          f8371584ddfcb7b1819fa39ce5dd96027366dc1a8fa0d6e801ecc21fd7b97688

                          SHA512

                          7e5d7bb088ca0e72f85aa0b819494ac3f9ef8c3f099e00a3daf57c1c2b3b4229d7654ffa8c1f47f4961ff71e453a6f9daad4cc7697ccaf10d29c1490fdb08d5e

                        • C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe

                          Filesize

                          344KB

                          MD5

                          6b6f6bf137fb43fc03d9aae8188a3755

                          SHA1

                          908eb3bf49edec20247f335c7b87326a7e2385fe

                          SHA256

                          61237280bd59daaeac3384456123a155c4c9b3164d7bb9c64387ed0f97ec102f

                          SHA512

                          3967604cf3df0d50e369a154cbdfd453450d67520d80103ac3fb7888f7910c3b502132c70b70f66c166857c0f35b4d55a365c40a267e1b3ecbcc1be2e428e5bb

                        • C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe

                          Filesize

                          344KB

                          MD5

                          0f6de5f7e2e6055e8e020416b3e61fa9

                          SHA1

                          e1ead32db1f57c304c89726b24be4ea9ad2ed73a

                          SHA256

                          2e37ac7c5684e73361f01abc8845b072210925f1cc918cf195769aec6df4890c

                          SHA512

                          ed7ecc6b163c2ca8cc9b0007f0574bd6adbbb7ceadc59085d075ed43e3531bd0582ef59114cbe8151324a82c74b94b32322ae922b42c39a2f2004ccceb5b9f32

                        • C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe

                          Filesize

                          344KB

                          MD5

                          d1205637706594620f0f06d7d8cfc295

                          SHA1

                          8233be266bcaa2442da13920dc3464b486c9fc15

                          SHA256

                          77eeaa482e403475ac61710a98cf333fbf607b061644fd07636b51dd8d0098e2

                          SHA512

                          bc928f824f8bc64662dbe12d9284897b5daebd68739bbb3c680d5551318c723d8960935cbfc17d9bc778cca8405e6a8839063d15f746b25b1bc487ee6c1bc75f

                        • C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe

                          Filesize

                          344KB

                          MD5

                          dbbf1ab7c71544cb4140e9458f102c3b

                          SHA1

                          29d44fbb58165dcab61cb85340f610435b1a4926

                          SHA256

                          35de9b12a29db0c38d5c119f38365a6a0a8496c6a290bdff40eafd1d84b0d5ae

                          SHA512

                          f547d5983b755895f038e2521a12899ff9aaa2cecce96629db8df3287beb58054e414e6ce2660860349a1b801e55fe315f2cb59bbdf42bf24f21c6a0e2e41220

                        • C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe

                          Filesize

                          344KB

                          MD5

                          2d3e9c5ba017c3c57c01d9afdfabe6b6

                          SHA1

                          c9b75dfd91ba782861f7cfa53cbaf99c2d12e6f6

                          SHA256

                          b9f773120685b204ea87e52a778ec7d0afb36cc7cbdef55e840563b06932b2c5

                          SHA512

                          592b865763ac62902c4614035ad2dde5ef41b6c925d3641ac7312064c8db5618f5fd174607066f942083c5b8ea6ad694d59f3ea548906437b7f69ab17302a1ed