Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2024, 10:56

General

  • Target

    2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe

  • Size

    380KB

  • MD5

    ee8677e786d37814a7200bf9e430c69e

  • SHA1

    cfc28d1d0223cb0d18ead6b421645828509c7783

  • SHA256

    1783e0325fca91b73a56961d301bcbd451ab0392613d54e0393fd0f3b3fd1d00

  • SHA512

    692e41c25005a3d11705506708581881d1b87aefcdbd83adba254bd7754ef31c282ea71265617a70f19f0c30f35f746e9b3a1479405ad8aaff2cb2e3beb8bba3

  • SSDEEP

    3072:mEGh0oHlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGxl7Oe2MUVg3v2IneKcAEcARy

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
      C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
        C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6020
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{2DF04~1.EXE > nul
          4⤵
            PID:1660
          • C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
            C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe
            4⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5876
            • C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
              C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe
              5⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4868
              • C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
                C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe
                6⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1280
                • C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
                  C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe
                  7⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3900
                  • C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
                    C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe
                    8⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5176
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{933C6~1.EXE > nul
                      9⤵
                        PID:5216
                      • C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
                        C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe
                        9⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4952
                        • C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
                          C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe
                          10⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:6136
                          • C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
                            C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe
                            11⤵
                            • Modifies Installed Components in the registry
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:528
                            • C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
                              C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe
                              12⤵
                              • Modifies Installed Components in the registry
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1820
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{6DCB4~1.EXE > nul
                                13⤵
                                  PID:3180
                                • C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe
                                  C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe
                                  13⤵
                                  • Executes dropped EXE
                                  PID:5776
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{7A06A~1.EXE > nul
                                12⤵
                                  PID:3540
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{C7136~1.EXE > nul
                                11⤵
                                  PID:4916
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{935B1~1.EXE > nul
                                10⤵
                                  PID:5212
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{3DC98~1.EXE > nul
                              8⤵
                                PID:3748
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{EF278~1.EXE > nul
                              7⤵
                                PID:2008
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{19045~1.EXE > nul
                              6⤵
                                PID:3476
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{EA77D~1.EXE > nul
                              5⤵
                                PID:2816
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{69F08~1.EXE > nul
                            3⤵
                              PID:5500
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:4168
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:5540

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Windows\{1904574E-766A-416a-BC6D-ACA6926A69B0}.exe

                              Filesize

                              380KB

                              MD5

                              32bf3ff282f5e410284469c47012aac4

                              SHA1

                              6c882f123e6d49540f5fc5e34b5995bea6db11b9

                              SHA256

                              963728c671f3a2be9b7a31d8c13446ab642f310b4ac58362f7575287faccfbf6

                              SHA512

                              157aca937cef12f84b91940fcf903c32c757938e2aa0ab642946cd84c025a0fb7cc5c827edbbd1086081d9a14ef55ebd2f05cefa865bbab63a051bd23857f03b

                            • C:\Windows\{2DF043BD-8341-451a-A1A2-148090872A6C}.exe

                              Filesize

                              380KB

                              MD5

                              cf9e6617e6dadea8b6695d804df520b1

                              SHA1

                              a8976d122edf38992557cf485a6e6302ada1b508

                              SHA256

                              dd3079a682083ed7d033a2a60017eb81fe7c301342396d11b81dfccbb9b1b196

                              SHA512

                              688282d2ac314343f60d2d3631140e64569ba8e041f99d9753a574387d59644191d58b417dd87bd6f2b9e2d9e8e1cf3bc2da950823eab75e1960ffe325873ec2

                            • C:\Windows\{3DC983F8-ED6B-4907-AD21-C23B136816ED}.exe

                              Filesize

                              380KB

                              MD5

                              8b9c4dd52f42b083e60c820c3e9abe90

                              SHA1

                              df45073634f2ead6ca1e4afab30448ac209ec649

                              SHA256

                              d41a8f6d5b0007a6e5d5a7347b9df839f0c8f8224d6cd0798114b4cd56720c15

                              SHA512

                              805fcf3e0e2eb4a6cdfe68d2ed215a6630730d372c90f607c9e9396372fda6327d2c265ab990b23eb18713a22ebcf7895e80aee1115aec3ffb56be19b5280886

                            • C:\Windows\{69F08AE6-B19D-420b-9E4F-5CC24B1D27F1}.exe

                              Filesize

                              380KB

                              MD5

                              44fb49434ff0076ae9f8181b8a0234e3

                              SHA1

                              5c66513fc6898dbbdedf4b333cfeda56fa4147ef

                              SHA256

                              edfc25ba18106b683de6e06e4cd6dc99b5c080652bae1f7cd567cea81487fd4b

                              SHA512

                              062b92a0f9c69f54f41651504d8753c0ae7eadae8c41fa36286cf888cf39b7fb608d4f595c4dd70b103d0042bf2279e23cc59f474c2b864e7d95e097a8e36eb2

                            • C:\Windows\{6DCB4109-92ED-4847-B621-9A99C20F0971}.exe

                              Filesize

                              380KB

                              MD5

                              a9637112b1ac10975bd353c94ddc5f14

                              SHA1

                              6ef1c93fe3729c90202d6b7a632e36b3ef7e438f

                              SHA256

                              3670de3353a0ce1a1b526c8d9cdcf1ed199c6d980c7204eb58e14fc91a5ff6a7

                              SHA512

                              3ce052f8f825a0574a351281b503f845a2ae00cd11921babc28ebf310adc7be6068d51a388827320e562b4c4eab901e8b045d9a5143acd8a37be1e523434abf8

                            • C:\Windows\{7A06AAA4-A708-4c9c-A775-364B1288501C}.exe

                              Filesize

                              380KB

                              MD5

                              f65c0436a0edc152bf01effa56eb74bc

                              SHA1

                              eebf319629d09f32d0bfa8b5e2698cefdb62857a

                              SHA256

                              5e24964b1203e26b6df04387dada0798ecfa0f1fa12bdf536228191eaa521b81

                              SHA512

                              e39bbab746993b9292571cf5224cc2d3806f4f0752b08bdacdd0f4d3b0026de7a62365f088a8d35d09b7219c25a20428f4e82867d1836f63cb55d47a554f2a04

                            • C:\Windows\{933C6816-F87D-4c6e-A4E9-C7B590BF7D0C}.exe

                              Filesize

                              380KB

                              MD5

                              9914926177fcab611e7955e2bedc05e8

                              SHA1

                              6353c47026940c628fd3070d6a20e29545315373

                              SHA256

                              cd768864a36135a9c053656a2d62a418f34f2a6f7d73d1bf369935949d260637

                              SHA512

                              2f5093b8925fd57f22fa1097ce833fd75aed3042d2ae349fda519007a6ff7e431080b593124adee7e18794e466e530846573899449587848139cca1d63eebcf1

                            • C:\Windows\{935B1144-46ED-4a68-AA9C-6F78103FAAB7}.exe

                              Filesize

                              380KB

                              MD5

                              a88c877f895d0fecc835d1fd8c28ee7d

                              SHA1

                              55c2b5ae6914167f01c796d73a9b3c486155a3a7

                              SHA256

                              d9acc7fe98a27fceab64e15fa17300f269eca946ec370a4f97a772ed5277f23c

                              SHA512

                              b601af04b96e23601301b0f3d3992afc52844ab983769245f734918c41cfcd9eaccdfe4f0e79834cb107db0177f1c7978a96d93992443fe16c4d2f8dc2d45641

                            • C:\Windows\{978FEA1F-EC7B-4dcf-8B38-D81108EF7F6C}.exe

                              Filesize

                              380KB

                              MD5

                              153bbda2de51213a88715a42b2453a09

                              SHA1

                              11c286434ddabdec765c808ef585dacb6fd52f62

                              SHA256

                              453147859ccc37208e69889d0b0a94e6065046955cac56eca21e24b7e564df42

                              SHA512

                              8b6d9f38900c9f22694df933c3f80cac5c4aa2751548680a9beb3e0048af34b76d6d879e59950ce24e51d9d8b0f6224e8af1428e83dadd573e3ee8578f67f8b5

                            • C:\Windows\{C713631C-4D68-44c2-9BBE-F9A0F3919F77}.exe

                              Filesize

                              380KB

                              MD5

                              f98218955a3f2c5d1a58d4e107496ffe

                              SHA1

                              222ba37bdd59a82aecf4e3a7680722cd667590e8

                              SHA256

                              4b8ff02a86b5d6fdef66ec66dac986813cdae39176297349ce03467e63f0d0c5

                              SHA512

                              5eead8a1629e8531ed664a216ceaf6ee363cae5e63901bc2bd6fccfe5684ffc7d92f981207ba55c130ce153b06039c4974f0dc1d195d304e14251ae63d852700

                            • C:\Windows\{EA77D3EF-A28B-43e5-88A2-52EFBF09B1F2}.exe

                              Filesize

                              380KB

                              MD5

                              f7d4017541ab6f68f4a66a75578acd2f

                              SHA1

                              ea471339896e41144092e2e2a318a5845844b5a0

                              SHA256

                              6630e42d85eaac068302f81c3733f1b4eaf694301d9c81f8c3c0e3d6c9712b9c

                              SHA512

                              37d003cf680fc1e30a1f3b1e71d6cf10fb9e6312f94719bec9dfe09b4436053b49ea4a210bcce7b22bf40b8e49c304323b4b76e0546ba32fbc9e0f0ce0b7e47d

                            • C:\Windows\{EF278CB0-1C77-44fd-8AF0-29D2A4167516}.exe

                              Filesize

                              380KB

                              MD5

                              f64a985f4d9d921f335716343493a08c

                              SHA1

                              ca4ef93a6c3a6e9251eb637d340ef1d83514ec7c

                              SHA256

                              8eef8cab4dfcd1d95ac4b056ca4198a3ffe8e513596bb952ba73f09bcdf39ac1

                              SHA512

                              7577f3f4bc0c5736a237b477dbdca1b777d75ce6a71dcf7da0cad53114c3cfd0984f5b1ae453310208b639e086d6e93af500c33c65bdf5a89b1d4c238783f4e9