Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/03/2024, 05:29
General
-
Target
2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe
-
Size
216KB
-
MD5
1192bb5f2954b454eee6b0997f14f14e
-
SHA1
20e60a0cb9f42e7a451ed7165b20464e3278e8aa
-
SHA256
a3413ebe071d4c0b594fd321976c8caba4e1b93b86173bf069fda108305d0ded
-
SHA512
0876ac9a970e19fb87b9123a5272c0c122368e17c251765a213c05ae6b617c7e90511ea00ca72fe14ef125837d3fa9d0d199a20d2681cb40b82d99878a459a24
-
SSDEEP
3072:jEGh0oIl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGWlEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_1192bb5f2954b454eee6b0997f14f14e_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F414D96A-663D-4237-9828-F9F30D720F9B}.exeC:\Windows\{F414D96A-663D-4237-9828-F9F30D720F9B}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E134DADF-DDA0-41ac-8165-385A778448C4}.exeC:\Windows\{E134DADF-DDA0-41ac-8165-385A778448C4}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{12056D03-F863-4c22-9ADA-F6FCD5479349}.exeC:\Windows\{12056D03-F863-4c22-9ADA-F6FCD5479349}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93AEEDAF-83DD-4064-9740-8D2EC34D34BA}.exeC:\Windows\{93AEEDAF-83DD-4064-9740-8D2EC34D34BA}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5274DF38-A35C-4663-86DA-B770E92F8E59}.exeC:\Windows\{5274DF38-A35C-4663-86DA-B770E92F8E59}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{035C15E7-ED60-4b67-8041-F41B526FE198}.exeC:\Windows\{035C15E7-ED60-4b67-8041-F41B526FE198}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10210D19-2AF1-4e27-AAA7-4B83BE38EB43}.exeC:\Windows\{10210D19-2AF1-4e27-AAA7-4B83BE38EB43}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE15E2C5-84F1-4e8c-AA5B-00FEACE32AAF}.exeC:\Windows\{EE15E2C5-84F1-4e8c-AA5B-00FEACE32AAF}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14DB636E-1E24-4d3d-9B98-F5B8AC6442EA}.exeC:\Windows\{14DB636E-1E24-4d3d-9B98-F5B8AC6442EA}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B5416EF-740D-455b-A152-4B88062216BD}.exeC:\Windows\{9B5416EF-740D-455b-A152-4B88062216BD}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6CFD1230-4583-4e69-8B9F-1C724D630EDF}.exeC:\Windows\{6CFD1230-4583-4e69-8B9F-1C724D630EDF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{630E8E50-4950-4ff4-8DB4-8CC20D489128}.exeC:\Windows\{630E8E50-4950-4ff4-8DB4-8CC20D489128}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CFD1~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B541~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14DB6~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE15E~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10210~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{035C1~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5274D~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93AEE~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12056~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E134D~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F414D~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5f65cc2b7262586f4ca9227808d42cfee
SHA110ad8386ab1094a9793fc919b8ee22560a32e720
SHA2562852166294ec0961fef8c65eee3afbca69096dc5769427ed0f616d342a3f2c8e
SHA51239b266ea606f77dbbd81a53f1e8b1f1f51a7afcecb62c56d5ecc77b41083c138c05acfda541343be8c048faa3cc164ec7365d4f8b91c6675548c6eef97598104
-
Filesize
216KB
MD5b29a5b0f38e7bce67c34414027bf979f
SHA1ca9d09e4d8b5f215ce6f986faeed3af857934a09
SHA2565569d9781531e55335b671271b8d1bbb91b787e10505a8b6e7ff021d8d0ac881
SHA512e818ffce48bb2bd2311a920df86d561649706dbd9cc9afa34ad3916ddc2642e3221ab1c7add1d76ffe5286bca345dfebafa03866de957a942741a07c7a0aa8eb
-
Filesize
216KB
MD598defb59b7548bdd1d47dcdff9d15c47
SHA153d02ee230138dd87a1aeaf95afa7be855558e18
SHA2565746d3569cf6d0eb85369cd96d71f370d8baf81c68f4a65a500e0910661b9f89
SHA512534481db73ea92d010174a40288c4a75c45506b161569c1ed0c06d2fd987883294bedc479b162d4310165a098691b53c7c84a8b075323c63d6cae7d34a7775b2
-
Filesize
216KB
MD56948cbc341e5b0f6da5e9d3d9cec74e9
SHA1a6b20244bf447e98340d9da64cebc2f5e7f912fa
SHA2562e7cbc78ad34f31e393c66fd17921c214dc8f90df90c275982d0780698d0ed53
SHA5120945c00645ab1ab62b5b48700f26d28fcd13867d848d349d5bfa001740c0e68879efe176efb120d9c8331a69de855a64ff8f04046da80595463457a0ce9570b4
-
Filesize
216KB
MD53e8c873fcede234b8c3a7acdd68d8c24
SHA1426e491befcec3f89e336217637f3e5968b98c28
SHA256c27e58d8f7778c60abde7e8461eb04f39aeabea3d96f05638f6e859dc4310337
SHA512bddc506fe69cee81d55d593624fda780c0fad20cc701a24618edf6393ae4007d590409839675224e59946f4ad8ac3d1b5749721b6e5d12900741ca55bafe4d47
-
Filesize
216KB
MD5e37161da49f1c8882d29aaf64c114867
SHA178b92cd3d1bf1219e3449f52e984d749b524e8cc
SHA25635d49d3c14e214227542331546279bdf57ff7133a089e7fa2474d8b02dc41c9d
SHA51258d1b26cccd963971ac91b62fd73b8d7c83f549a3c856c0504411e28e830765260f2c8b056942588edf99dd9c7978c695345535849fc40cb4d2845b211a5a73e
-
Filesize
216KB
MD596c798e187d8cf45d15e3af5b0bbe8f4
SHA198f6aa3e6acd2f9feb758d23bc6515f6aa0b0ffb
SHA2560b67b412fc51cd090c7b30cd9bb569473caa58f6ed27b034d4915c46d59914bf
SHA5129dd327e22e68cf6894b7745b451b2ee31bca6c9a8aafebe490a0ab4736a01fbadfd81d05e5f87b5445517084d6ed15922134cd2d3276513a4d95d865916d84fc
-
Filesize
216KB
MD538ca437223306f10a18213a114aa410d
SHA1212fcda1175ff7508ec847e92f5ab6e8b73519bd
SHA2569bacfdc12f30aae7820807dcdc86042c83d2dda12f6d793fd9a5284212a26215
SHA51207901ba59576051980b22456e912383a5dcd9eeb57cc416f03d803b6082d1621e443899a6ea0cc7d80ffd5f7f1a76274c45bc51771f1c3bd79d811fcc3a84084
-
Filesize
216KB
MD5fea987d1030a87436024dd49d544d392
SHA171732640487d5b72bc56a1230f57d2541322cb06
SHA256603510da879cba74363ed62fb0829944d71c0a853d7c682255bb445fc491462a
SHA512d52aa838ffb2176f1285c930d3ddf9c3ee307413848b7534c84584aacb806d573e055d579968427e339ddbd10d04e476b78b939b8e9fa1b44d52a8f9909eb838
-
Filesize
216KB
MD50372fc7256807c8ca543eb4b995b6aed
SHA155683f7ece51c5abecf4ea41346b863a5bb8bdfb
SHA256698f57e80186cd143205afe2e2bd3d5d442994d1288f6706ff128ab600ed598c
SHA5124992c58950129b4c0006ce4f88a814fd48776c10694f0ce7f990ddb723c31d3421da6944f9cec12624a585f6e1c0f55786592dc585d9d32aa17bf5b4a70d5b3f
-
Filesize
216KB
MD50049e013efe40fd4d06bb260018a13d7
SHA1c33360d326193dec828fe867f6cb488a2c26ae94
SHA25694e423665ef3c15536606fa9e79c747f3d80967543a88248674e3c6ca6e9b15e
SHA512d9d574d98dd6051b6f9c12a7207ae0993c25d85436c0b03144949500c2460bf2661add3bc68128db033eabff3cb20f774425a697f410f91fed0134c5bd8acd97
-
Filesize
216KB
MD51dca8d254983039bf3cecb9f54c3fb69
SHA1e7a8e9ff3ddb3b6fd66e7dfea581aa58d6ba8c45
SHA2569d483a128b80904464469827e3655fc9311d5eb1c07b792f369c104ebec04f57
SHA5129d6a06160527c420a12346d03e8828aa5b85d2c8b61a078364bc42826566551eaa93ea91fa10eca09270d112ecef49126248fbfbf63c9d43c52a6fa270da5902