Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 06:02

General

  • Target

    2024-03-14_cc1809ea83b2a6765964d176a2733531_goldeneye.exe

  • Size

    372KB

  • MD5

    cc1809ea83b2a6765964d176a2733531

  • SHA1

    ed2e45daac7b3349748d0c2bce51c77e95a7fb8b

  • SHA256

    01f7813938391a5f29c8f297e6a439ddc4687fe80b0c119c256848a269368d8b

  • SHA512

    e9bd7d1b0a330147acf243879870a046b64e74772d5398a3c12b760e060d01bc34aac5a67a109ba68d3ef098a3661addda625428c5263565efad3d30f2696352

  • SSDEEP

    3072:CEGh0oDmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGol/Oe2MUVg3vTeKcAEciTBqr3

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-14_cc1809ea83b2a6765964d176a2733531_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-14_cc1809ea83b2a6765964d176a2733531_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\{E721494E-251D-4745-B765-78E8302E6A13}.exe
      C:\Windows\{E721494E-251D-4745-B765-78E8302E6A13}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Windows\{6A459338-6FED-4f45-94F5-617853AA1220}.exe
        C:\Windows\{6A459338-6FED-4f45-94F5-617853AA1220}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\{02070DC2-042D-4b2d-B2BD-A30F6ECF49FC}.exe
          C:\Windows\{02070DC2-042D-4b2d-B2BD-A30F6ECF49FC}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\{2BAF8C7E-EDB5-4505-A840-714E4A24292B}.exe
            C:\Windows\{2BAF8C7E-EDB5-4505-A840-714E4A24292B}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1652
            • C:\Windows\{A5EE89F7-58F4-454c-8202-84EADAB7FD78}.exe
              C:\Windows\{A5EE89F7-58F4-454c-8202-84EADAB7FD78}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1644
              • C:\Windows\{D5D06E42-8602-433d-9CEE-DA9C9400F95E}.exe
                C:\Windows\{D5D06E42-8602-433d-9CEE-DA9C9400F95E}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:364
                • C:\Windows\{6C1F9C1C-637D-4a80-B85A-8E0BF2E6558A}.exe
                  C:\Windows\{6C1F9C1C-637D-4a80-B85A-8E0BF2E6558A}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:556
                  • C:\Windows\{30AC2818-5FC6-4d83-A45C-C49EEC6468B0}.exe
                    C:\Windows\{30AC2818-5FC6-4d83-A45C-C49EEC6468B0}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2804
                    • C:\Windows\{19166403-F0C8-4c9b-9C9F-B45EC7001A1F}.exe
                      C:\Windows\{19166403-F0C8-4c9b-9C9F-B45EC7001A1F}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1364
                      • C:\Windows\{1645E6C3-CB33-49b5-B246-9585445160FE}.exe
                        C:\Windows\{1645E6C3-CB33-49b5-B246-9585445160FE}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2156
                        • C:\Windows\{E084BEE4-74D1-439a-9A68-0E62EC3B0810}.exe
                          C:\Windows\{E084BEE4-74D1-439a-9A68-0E62EC3B0810}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:544
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{1645E~1.EXE > nul
                          12⤵
                            PID:2388
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{19166~1.EXE > nul
                          11⤵
                            PID:1944
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{30AC2~1.EXE > nul
                          10⤵
                            PID:2892
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6C1F9~1.EXE > nul
                          9⤵
                            PID:1956
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{D5D06~1.EXE > nul
                          8⤵
                            PID:1320
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{A5EE8~1.EXE > nul
                          7⤵
                            PID:744
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{2BAF8~1.EXE > nul
                          6⤵
                            PID:1588
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{02070~1.EXE > nul
                          5⤵
                            PID:2484
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6A459~1.EXE > nul
                          4⤵
                            PID:1992
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{E7214~1.EXE > nul
                          3⤵
                            PID:2548
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                          • Deletes itself
                          PID:3052

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\{02070DC2-042D-4b2d-B2BD-A30F6ECF49FC}.exe

                        Filesize

                        372KB

                        MD5

                        f0e39fe2d40d5a37ec7484859a4d016e

                        SHA1

                        08e59fcc89b4449113f8710f74245b87b98067a4

                        SHA256

                        5ca34f0e2585a3194f802ed15ee09fce875e52c51844c2eca541ebd610a2ab75

                        SHA512

                        f87c7fc4c1d3b8264e09412bc3a16ed846f39495898d8bb5531c88013a03fb792d34bdd82a9c308413b2a779092d78b846476e7d3c6ea9ebb0a396027fbed4a7

                      • C:\Windows\{1645E6C3-CB33-49b5-B246-9585445160FE}.exe

                        Filesize

                        372KB

                        MD5

                        44551dd423e830cbb81e5a2e5339b2a1

                        SHA1

                        9115b080484caa82b704f71c1ef0a73cc297971f

                        SHA256

                        947d7a3d3922f3d39d70c1875e6fc72488565e2ae8482879eb7499d535af81de

                        SHA512

                        fe93386dcaabbf652af1ef5a901845b46bf8689f1fd1373421513e81f652b4b661ff91b8e87b58e962a682745766260ad2bac51fd0574dee7164035ce41a9416

                      • C:\Windows\{19166403-F0C8-4c9b-9C9F-B45EC7001A1F}.exe

                        Filesize

                        372KB

                        MD5

                        cbc15eeddb6a4c9244b050bd2a5ef081

                        SHA1

                        4d94ab0cd1920b02beefa712f31d506843b89a92

                        SHA256

                        58a11c722b40609765d836c5973c624f601bf91830fab4ab542dcb3eb201d76b

                        SHA512

                        71313da62df4e09a317d6f9e278a8252a330e29578726dd72c17f03ded16f68705a2736ee51822beeb6edaf60bf06754a2e33e15da6ad251ee69c492bcc657d2

                      • C:\Windows\{2BAF8C7E-EDB5-4505-A840-714E4A24292B}.exe

                        Filesize

                        372KB

                        MD5

                        5793809d26194bd65a00c12b6253a6e1

                        SHA1

                        4b434263a651963b4cae4ed1cd630ccfb19dce48

                        SHA256

                        083e53d0ebcb00dcf495e799bfc740a26627d953966a05a6a97723eebdf1f832

                        SHA512

                        14383dd4d85401447ce7ce36eba66de9f2c83c446592b7478e5345d59e188e25b879191b132fbc2f7f83cf539530f1e6eb7b70e1bc83a162cf9871b92fca5026

                      • C:\Windows\{30AC2818-5FC6-4d83-A45C-C49EEC6468B0}.exe

                        Filesize

                        372KB

                        MD5

                        66a401f51001d5103f5b0fc4696b927f

                        SHA1

                        6b75ca5b0ac1327a37a5becb4a3f7bd754885757

                        SHA256

                        08d3febc314aebce563bba35b07e53556cbd20796265c09cc4c43a29b44d2aff

                        SHA512

                        7fef40e945df3d50c796d73c41fc8225eccbf09dc3fc778ef20e3e533a85f970a943e6f08a20557bae7797c374be6a19b8c51fe4969e9cefeb5b3b60abac7134

                      • C:\Windows\{6A459338-6FED-4f45-94F5-617853AA1220}.exe

                        Filesize

                        372KB

                        MD5

                        15caa0e461057e1db7fbf04de46343db

                        SHA1

                        3c04eba33c3378cadcd35b8874ce69c5085181c3

                        SHA256

                        928ff7ca729cb06eb6773170edba6c21c31bc6b21fe866f7d72c9f30950c623c

                        SHA512

                        ce049024eaf649c408786965a8c1217c84e9ad30d0a225bc98285c87b9a685f0b8d841ba7153388de5a371e07b0daf1a1f6060ff921f5dac9efbc8069d111d66

                      • C:\Windows\{6C1F9C1C-637D-4a80-B85A-8E0BF2E6558A}.exe

                        Filesize

                        372KB

                        MD5

                        e166f42fdabd0a612c7599365d06c196

                        SHA1

                        7d180d83eac3ad1d390600f025a0c4c7703931a2

                        SHA256

                        32d70b5ad9b7f6bb2a75a899e4340fc6586976812b9d0be5a6742a60691bd4f8

                        SHA512

                        adad7dba20153774d5e860050565b45cc5c5699f44060ba1c0b695211c1d354ad2977879b0abb7088686edca7752adf4222ab3e63a7259c2eda8a14a549a7a0c

                      • C:\Windows\{A5EE89F7-58F4-454c-8202-84EADAB7FD78}.exe

                        Filesize

                        372KB

                        MD5

                        8ac50933c58097841eea525fe53fd036

                        SHA1

                        dd5723402e44eaae49dea33d3ff876ac1f374234

                        SHA256

                        0254a629b600344b20180c3923724c48c3f3d8b6b4ebfeae467e4c88e275370f

                        SHA512

                        1f4a7daba647941951f35ad144adc67686a895529a16e9965daf0578f6cda49f784d4820388b06a1a937f4e20066ead7424a7c8003558d9acadc079bf584fe3f

                      • C:\Windows\{D5D06E42-8602-433d-9CEE-DA9C9400F95E}.exe

                        Filesize

                        372KB

                        MD5

                        efd9a2fcd95014142164b8dfe03c57c0

                        SHA1

                        f782f6c03a8d1b91f6eed269129847a915dffbcf

                        SHA256

                        45a6ad903aec8f7051b530b6fd3172fe224273ee507c1c0e8c32840faa1170ff

                        SHA512

                        f074691cd0978a2e1e2b2b1fda67a0c2d569965bd9967f60a11d3fe101f5d6f0fffa18c8c01ff81fbd7a223d5e38eb5bc6fe6af968524b044783aa95c396a4b3

                      • C:\Windows\{E084BEE4-74D1-439a-9A68-0E62EC3B0810}.exe

                        Filesize

                        372KB

                        MD5

                        cc5961e394556921dccf22cb48975bb1

                        SHA1

                        c2d361d7e90db973123a1c49609d045158c038ab

                        SHA256

                        109bc9bdc559dcd8d83094d6463b7d1c827707bc06cc0cfda5a42f8d74bb466a

                        SHA512

                        ad8024b55e83fd0f6c945212f57aca182a8b87658aed2223b30cc6b4ef046fe1868d5887bb4bba3243aa4afdd7e020e6d6f19ae345e989530909820a309afb3a

                      • C:\Windows\{E721494E-251D-4745-B765-78E8302E6A13}.exe

                        Filesize

                        372KB

                        MD5

                        5e7bca7ec192223acc49eb5ae885b07c

                        SHA1

                        aab9ed012b921987d73d3756ee1672857384d11e

                        SHA256

                        916adf24f80e1c7e604e3a108a84fcff33d6fbd765ea76b2bd10afb35d870189

                        SHA512

                        cd04fa6327bcb37344665833c0cfbf517a4c78d11647ca3651fa85168760432decd06e6acdca8296000b82c61b585e1905b533708af63eb4f15484de6aa22a4b