Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13/03/2024, 18:51
General
-
Target
2024-03-13_c7ee460d323c5578ec8d56c1aec7d099_goldeneye.exe
-
Size
344KB
-
MD5
c7ee460d323c5578ec8d56c1aec7d099
-
SHA1
560ee81d8b7f4ac4ab0661c1b38b8039f5522c67
-
SHA256
efc87d650b9166e5b73e00b19ef95f70c28bae06ec4e87def95da60bf051dfcd
-
SHA512
f874ef9b36352eb2ead20f1ef3031a5b8c1076530c1825385d60b0a7c90ac4a104404164cde3893c6d7f95d08f052bfd9490001d5c92799469acbcb2dc4b1614
-
SSDEEP
3072:mEGh0oPlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGhlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_c7ee460d323c5578ec8d56c1aec7d099_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_c7ee460d323c5578ec8d56c1aec7d099_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51A5475A-0D2A-4fe5-8B9D-894BD62B6287}.exeC:\Windows\{51A5475A-0D2A-4fe5-8B9D-894BD62B6287}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C2D3B11-3CFD-45d8-B458-085DA92F8AAF}.exeC:\Windows\{6C2D3B11-3CFD-45d8-B458-085DA92F8AAF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{929A456C-AD75-45d1-A2CB-5054DAFF35C8}.exeC:\Windows\{929A456C-AD75-45d1-A2CB-5054DAFF35C8}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57384EF3-3C2A-41a7-B4C2-1F1BBAE9E7E8}.exeC:\Windows\{57384EF3-3C2A-41a7-B4C2-1F1BBAE9E7E8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D8F27DB-1B15-4f08-ADB3-23CA89CA3A14}.exeC:\Windows\{9D8F27DB-1B15-4f08-ADB3-23CA89CA3A14}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC37E728-492A-4fd7-AE4D-F3C87FD1396E}.exeC:\Windows\{EC37E728-492A-4fd7-AE4D-F3C87FD1396E}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D2BC822B-0F3E-4381-B99C-55B1C38C57D4}.exeC:\Windows\{D2BC822B-0F3E-4381-B99C-55B1C38C57D4}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C463151-D75F-4b3d-B92F-FB2529A1CBC1}.exeC:\Windows\{3C463151-D75F-4b3d-B92F-FB2529A1CBC1}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C8694B9-9B61-4c26-97B8-840F7CA461C4}.exeC:\Windows\{7C8694B9-9B61-4c26-97B8-840F7CA461C4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EBC3868-0AB2-49ff-A637-B252ABF9AAAF}.exeC:\Windows\{9EBC3868-0AB2-49ff-A637-B252ABF9AAAF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EAF57E7C-B7EF-4587-ACA6-D3A1A53ABA9F}.exeC:\Windows\{EAF57E7C-B7EF-4587-ACA6-D3A1A53ABA9F}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8538856B-176D-4394-966E-F75005ECACD8}.exeC:\Windows\{8538856B-176D-4394-966E-F75005ECACD8}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EAF57~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EBC3~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C869~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C463~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2BC8~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC37E~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D8F2~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57384~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{929A4~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C2D3~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51A54~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD59c7ddbcc8b3e24c5df03880db1a73aa3
SHA17a55cc4a7e1cf1ea1fca5354081064277dfa0a54
SHA256c21fc3e7464efbc86200bf183807eedab8dd5ec934a8a45765b2137ea296be54
SHA512509ba2a6366d479792a0cccd9fc43f8fb0501ff378efbb5e622ad896b78b9699cc4710446a0c6972cdc62bc8af2c470154f91f133040409f8ac377ce57d49fa0
-
Filesize
344KB
MD5be5fe343ebf84e38d6f0e9b4c8fe77ef
SHA154909ac72c3d65ef97908893a77f9e463a1fd2a7
SHA256dcdceb5d0e6d0fc2c6335e89db8047cf750153383c75f2d965720cd9f3aa071d
SHA512f15eb0e3b4a263ce3fa0e1095b47ef5908174f7acd7ac2c7a016099288c946d7f201760205bb37f348e6e5cbf45a00d93c2cd6ebe2e7ae5ff1d14ce718d38d30
-
Filesize
344KB
MD5692498f188b20fba10f17949e62916d2
SHA1b3d9347b4b6bc10eeeebe276496192bab4b208fa
SHA2566c2d781e1fdc2874f9ad1fe8d6ec974ddaad71cc662b0d0d28841e848354b123
SHA512dec3f7239339f4a4985d12f472533689d84c3f066f75862973d1a2bd2aa00e5d781c352b5b616631f9560a012fff882044366e35909fb2fc57c477d7ec29b199
-
Filesize
344KB
MD5bc5ec022f819ed6f62bf9cc6002e3561
SHA1e8b926e3b67f4a0649d90b3c5ac71267f4842cef
SHA256611013d92006a912a71ab4ad422f12036e5301e309a0f5ca3fc049486ff388c4
SHA5125da61098eaa07493da221023796d3faaf47cebcb73a8e783859273d56538a9953f271d7c24408902ad5c45e7941cb6112f6866d28109b18e757de3b9f728c2e3
-
Filesize
344KB
MD50a5f06dfa37756ad50ace496b80fa513
SHA14c3d3bac957119afb3a048ca8f1a3bb6fbdce055
SHA25674aa10b4dad0c28e2ac16673d130eceee890a8750adfaadd1e0bc72599d96357
SHA512245c050b107ac5f848d807bfe1d20966ae61532e3e638f113d4b9145b2b64bc4be6cababc372afc65f68819498fbaeabd90f47b02992b8f9889552ed356dfc61
-
Filesize
344KB
MD58dbaaefaa4319c10c20490f640e7273b
SHA1646f0ee991a48eec5534226b7d8d5b4acaa09a40
SHA256ab3a2ec082d2876cc95af62dcec501f463902d5a40bf44ae5bd85b5313c14f2b
SHA51244cdff11e572c4bdd70eace1a1eec40121ba14e8d3b0fb66b48064afa8cd4b985d66a49fb532884c9472e2ebf4a51dec5a110bcc845760821f4b5ebd76a6261c
-
Filesize
344KB
MD5aaf8a946dae76960b9c478b0b3f32bef
SHA13dca1e62d22b9984866582a4508b760ea65326c7
SHA256f4ff99a8c63a47b5247135b5e965f72e09addaf2cfecfdc9280d5befe5be6933
SHA5126c1e8944df191754ac0c2587813d3aef34b285803922538d8b12e76234c4dcb385d0da6dc32e8a334ad89325b0853913e4167a2f9b4fafd53a7ef34ce1907c34
-
Filesize
344KB
MD5c7eb79709620e1df30670369ba91aed9
SHA10e8b3d705ea4eb31aa48f200f773b3bed542e58a
SHA256d72b5a6c5d188a88b29c40f79d4314f36d9bc3ceee52b962d059b2503fff832d
SHA512a82a4d985fe73b2b822a6e47c0e4d2cc11cd1f7e203d792d4962c39946f2905f3189dbee0be01fa194d600d1f33b2efec37675dca7d1333c4368c9a3fdfdd744
-
Filesize
344KB
MD5391030fe9309565156426ef79374b8cd
SHA19cf4d005d1213d115f1f28b4d893d2dc94599594
SHA2563194cd6adbd893edde7e04e259757f06d47af7456485cb72a434eeaab4b636ff
SHA51289927268fb11d5fc505d0313980583aca0f637f980ee67faca161d14cb4c39c8629818114a870404bcb0141bedddcf783686cc86d4922abd2ac5a093ba94c520
-
Filesize
344KB
MD561b7ca4b54587814ccd5b95af89ef687
SHA1bf9b11be900769911d924bf28c512181f90f07f0
SHA256a920c2d0bb40266a755acf9bdf8e28693465de82abbc43a0c4bd06f1001b6009
SHA5127297acce050c3495e0fad12918add0fc200893d37f97fd92e5c6aac7a3cbda0ed85280fbeaa5577c719cd894746072f09e122956fa421dde13c5b2b3983eaa31
-
Filesize
344KB
MD55bd14f579090a59f9916975e636d8fa3
SHA1d3e28ce6d5231c9e67bb86cae0d8a748a8433e3f
SHA256bfeeceeb3120e69317acec8b7dfd4d940e1e1e1fe68113a3bf562845b13ba954
SHA512def29ee4827fb49e486b8d6f747f2e41517ee7f42e7a0a3550e363b175380f4682fe7e301ad1716e631dc745a1bffb414c0a3d8d398fe672931d6e62518a29d7
-
Filesize
344KB
MD59d6eeda021d9e527be0fe1ff2bc5c674
SHA1bddab1a983fe7bd74001a1b932055387cf42c741
SHA256f3f1cf98a721c235eca4bc89e1977ee0983f7f0ec8786ddd94cdcf77bfb9a19b
SHA512e66250bae5edd1a27bd63f52a8af88f09543354e7a6c4d936e8b71ef1fb34eebb431bee0fa5bcf324598935536197d2372b209df965684a0da0f6e129a0c3245