Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 13:32

General

  • Target

    2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe

  • Size

    372KB

  • MD5

    39fc6a37b1b3a7574cbf8d757353b255

  • SHA1

    52c8610784a3c7a649a3da285bd506843d1747e1

  • SHA256

    59fe019f0c6741b09bd88bb33b1fae93c7a49bb20652ab79a431d06d6c22c70a

  • SHA512

    58c03076fbdcb0e64939c97be7edcb48984ac82c56924680cdd947a06094b5107d494d85a2373dec9f68e29d7659393dfa992b3f896acd6babeb2ef4206c0ea7

  • SSDEEP

    3072:CEGh0oLmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGcl/Oe2MUVg3vTeKcAEciTBqr3

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3336
    • C:\Windows\{2B4589D2-CEBF-4dfb-9302-58ED2C8AD7B2}.exe
      C:\Windows\{2B4589D2-CEBF-4dfb-9302-58ED2C8AD7B2}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\{11310318-5B63-40d0-88BE-5E5505F5B05A}.exe
        C:\Windows\{11310318-5B63-40d0-88BE-5E5505F5B05A}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Windows\{324C12A6-AC6A-412e-8379-96FF8EFC5E96}.exe
          C:\Windows\{324C12A6-AC6A-412e-8379-96FF8EFC5E96}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Windows\{CDFE64A9-382B-478f-8E15-3EA91FAA8614}.exe
            C:\Windows\{CDFE64A9-382B-478f-8E15-3EA91FAA8614}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Windows\{13FD7BF3-DA57-4035-AD7F-7272E378F641}.exe
              C:\Windows\{13FD7BF3-DA57-4035-AD7F-7272E378F641}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3224
              • C:\Windows\{BF093FF5-4A53-4be3-82DD-1CB09111C0F8}.exe
                C:\Windows\{BF093FF5-4A53-4be3-82DD-1CB09111C0F8}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1448
                • C:\Windows\{101D3378-4715-49a8-9770-380FF0643F3F}.exe
                  C:\Windows\{101D3378-4715-49a8-9770-380FF0643F3F}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:988
                  • C:\Windows\{B56270A1-D7BD-4649-BD6E-78DD56D98956}.exe
                    C:\Windows\{B56270A1-D7BD-4649-BD6E-78DD56D98956}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4344
                    • C:\Windows\{3AA8BE9B-E65E-4498-B482-EB6BC71024FB}.exe
                      C:\Windows\{3AA8BE9B-E65E-4498-B482-EB6BC71024FB}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1852
                      • C:\Windows\{2A97E711-5BE1-46c5-BAE1-C8D04AF2B47F}.exe
                        C:\Windows\{2A97E711-5BE1-46c5-BAE1-C8D04AF2B47F}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1836
                        • C:\Windows\{254C1CAF-167B-40db-93E9-07A27EDC9D50}.exe
                          C:\Windows\{254C1CAF-167B-40db-93E9-07A27EDC9D50}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2748
                          • C:\Windows\{E89BAEF9-01AA-481e-B53E-79DD59A33F81}.exe
                            C:\Windows\{E89BAEF9-01AA-481e-B53E-79DD59A33F81}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:2340
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{254C1~1.EXE > nul
                            13⤵
                              PID:2288
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{2A97E~1.EXE > nul
                            12⤵
                              PID:4460
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{3AA8B~1.EXE > nul
                            11⤵
                              PID:4540
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{B5627~1.EXE > nul
                            10⤵
                              PID:2412
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{101D3~1.EXE > nul
                            9⤵
                              PID:4260
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{BF093~1.EXE > nul
                            8⤵
                              PID:2444
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{13FD7~1.EXE > nul
                            7⤵
                              PID:4292
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{CDFE6~1.EXE > nul
                            6⤵
                              PID:4984
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{324C1~1.EXE > nul
                            5⤵
                              PID:3488
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{11310~1.EXE > nul
                            4⤵
                              PID:2364
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{2B458~1.EXE > nul
                            3⤵
                              PID:4996
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:1796

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{101D3378-4715-49a8-9770-380FF0643F3F}.exe

                            Filesize

                            372KB

                            MD5

                            6f85a3d37dc38f326eed2cbee339d696

                            SHA1

                            df4b7a36101d129e178a1522645768e40d0e8f11

                            SHA256

                            e453c0e9e7e4a685809718f69128cf9a762b130374ac0db9cd908d86c3d3c310

                            SHA512

                            833c46da88cd4063ab8d0e910bd572801e1a9cfd2bb0d73584173eaeb2f736344f16197a0e1cf4f37a67c59de5633f7e30854b8945b90ace34afb9a60ad6e2ae

                          • C:\Windows\{11310318-5B63-40d0-88BE-5E5505F5B05A}.exe

                            Filesize

                            372KB

                            MD5

                            c0fe769d15008df84452615bba8e2a91

                            SHA1

                            93c63688f65dd6a97b0ac7c5c695b50a2c52fca5

                            SHA256

                            040b469aef2e960b4f4fb621acde3a50d014ff51f24b86bf16192567d519bb10

                            SHA512

                            eda85bf1116e060505b043567b8438aa829e25a9f5cf1cc85d0f69ba62edae1d99a8780cd1bc043088b16248773a1d425c4625229d01909851eaaf9c8134e6e8

                          • C:\Windows\{13FD7BF3-DA57-4035-AD7F-7272E378F641}.exe

                            Filesize

                            372KB

                            MD5

                            b9fee3990f38c950f8d27a05acf75be5

                            SHA1

                            7d26e73f6488358fb35cb31d9fbd3e36bda0505e

                            SHA256

                            06afb9ab9dde009f3c5378dc8fd2663dab1ee21ce007e963d9349511fa212e9c

                            SHA512

                            d83427e2024a838b2d93e2d0790e1a0b0d4ad54f4ae49a263ad7b2eab65989da588288c4ddcd0983744b90b1cd800a44218ad371bba4ff7bf15aa8e7a0c99963

                          • C:\Windows\{254C1CAF-167B-40db-93E9-07A27EDC9D50}.exe

                            Filesize

                            372KB

                            MD5

                            1afa07058db2fc65a0888f9bf6af6b39

                            SHA1

                            48c342f65482e42000a9d5d4228bc781ad709cf2

                            SHA256

                            5689d425a3c6910bf3947e9fa9389233409602b04bbf0359652f68f0a04ea454

                            SHA512

                            c97170c2111e66a0e21de3b4f54f19e5c4d5ca87d993030f43be8d76c2c2cb0d6e272c06ee38234ad44963bd5db766f5f8771e3816a59165476b551114a36fc6

                          • C:\Windows\{2A97E711-5BE1-46c5-BAE1-C8D04AF2B47F}.exe

                            Filesize

                            372KB

                            MD5

                            4265184bef268c3a5bf0d9288e8879bc

                            SHA1

                            5094ad7921a042c333d5942b84df9c8b2ed720d3

                            SHA256

                            4ea61fc41f5d4f46a996255e60e5918b5b70da7649d8bc2ad2480e6d3ae96290

                            SHA512

                            a35e66c9a8ae5b348e630139294338da8c0a594ef9da5f955639faf86a49c877d84819f2e5dba9141d919b900cf317cdc8ff056cb628de89dbe4b5d056c1060c

                          • C:\Windows\{2B4589D2-CEBF-4dfb-9302-58ED2C8AD7B2}.exe

                            Filesize

                            372KB

                            MD5

                            c8a3a3268f4f09d5c783f5a2834844d8

                            SHA1

                            309ba9ebf059e842dc4e9e82f2323a0fcbe48223

                            SHA256

                            fd11e8e4e3446d187b0b09f5ca738a1de066c29e8885e459bec9d675447006d2

                            SHA512

                            b688aa13455c0b37cfd65a338f55e499041089164a52f2f28d9706708136270ef5ac97cf8b7600294b4aae21f935b8845ace8f96ab2d7c0b2caa91e92946fa7c

                          • C:\Windows\{324C12A6-AC6A-412e-8379-96FF8EFC5E96}.exe

                            Filesize

                            372KB

                            MD5

                            8fb30ff1b1dc2dfcda1b42aed2a51f02

                            SHA1

                            55c32985df25e40d92a8e6dcee3f03609de58fcf

                            SHA256

                            fd1b4d2311dfb6757a2c49e04d8a45d21a26a6b66e1abf3858e3cf7907ca0b98

                            SHA512

                            2ff567a963bff751a0085ff9a44f84831bf2e879211e2e7f37d9097bee8762b29f43a668a490067f4d1026fd717b8ea98afc690ce53142b10d308fd75cfb148d

                          • C:\Windows\{3AA8BE9B-E65E-4498-B482-EB6BC71024FB}.exe

                            Filesize

                            372KB

                            MD5

                            9f371c0aff1c923971439b36f8dc5859

                            SHA1

                            d44c636fb9df8c69d90f02bc8a806806cead7303

                            SHA256

                            c9548f3a9e67ed5e1bfa1e23ba4e441efc9545c18ddf8276fcd9e2c4084a8bf2

                            SHA512

                            f6c9c0a6906d18f183c1092ea8e783c700c706f9fef55291924db40e622eb84a82d2493f38b1d5e8d1a0d9559ab56817e92b0397fcf0ae470b8c182d0a404f0f

                          • C:\Windows\{B56270A1-D7BD-4649-BD6E-78DD56D98956}.exe

                            Filesize

                            372KB

                            MD5

                            2e22340df9d276b41dd090143c9804e2

                            SHA1

                            92ddba47474bb13693e30cbde77da1ff8a066224

                            SHA256

                            77d93533c436c01e24746fb5ad692b104c559fe88dee8181cbfa15085f82fc6e

                            SHA512

                            3a2296d311ffdad979994ba948ac0faf89b200b9415f90cd0b737d541b2124619dbcf3b08dcbdfd49f7adec9cc00a951e10730d084e8e2495653fc6f7ad19ece

                          • C:\Windows\{BF093FF5-4A53-4be3-82DD-1CB09111C0F8}.exe

                            Filesize

                            372KB

                            MD5

                            a1add931b7a365bd76fbea2a928b6f31

                            SHA1

                            2d859a3a8cdcb402eee269707418585defde161b

                            SHA256

                            e9a43e76cf21757304967c1373bd8849d636639482bb2c4ab72e63d07e309b9f

                            SHA512

                            7d0df1154f8587bfd22601767f7b03265f946e7829cb6eeeae0b5854f20a9a88f8545e6cee383dc873645620ba322d0449613e4b4e73faaea7f1a7a1b5f780de

                          • C:\Windows\{CDFE64A9-382B-478f-8E15-3EA91FAA8614}.exe

                            Filesize

                            372KB

                            MD5

                            f68d6aa513a39c911d77be6ecd2bd3b3

                            SHA1

                            eea345e0a20275c887eb86dec80f8748cf35da1b

                            SHA256

                            ffabc9bfdb2a1f2361d8e7b501c3193a0a839708b756d457c20aee57ca5840e3

                            SHA512

                            162d592f0e292f9e31ebd2417d4ccd7c947cbe684a48365d5f258ddb7daa515631ed609278f19f86c4f999b3c0f219f79613b87dd7da52f67bcc879791ca87ec

                          • C:\Windows\{E89BAEF9-01AA-481e-B53E-79DD59A33F81}.exe

                            Filesize

                            372KB

                            MD5

                            2deabae5de909549ea60e1641ebbb759

                            SHA1

                            bbbd32a98966aeaaaffabb72f0fb5849877049d4

                            SHA256

                            1395716c9e7decf340759aed9a941ba2d010c00f5b87498adefd80db51e62173

                            SHA512

                            8529a5a605ef59125dd87c3bbf2d8e8c1844243a1efd371bf5038b4b211db534a57912a3ab329350b68d1d4552da9ee1ca95e9fdb9f1080594e4bc0f1e9a8584