Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 12:48

General

  • Target

    2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe

  • Size

    344KB

  • MD5

    e27a0a0b1ba49079e57afae075de9c57

  • SHA1

    34d24e9511f097743831fd29e939a29700f81375

  • SHA256

    84b1445750574bc4c5aff2a40f5c88cd953b66fabec1321f8ed08b46f1768fc0

  • SHA512

    6957c89c48b366447a8a8d3dbafeeacd2342ee40b0b6f34ad38e6f5e24f4f1118c44000ed505d28d2cb37d499b9c0502f7ca7a727df78901295f451b0c44f3f3

  • SSDEEP

    3072:mEGh0ovlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGJlqOe2MUVg3v2IneKcAEcA

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 14 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-16_e27a0a0b1ba49079e57afae075de9c57_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
      C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
        C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
          C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
            C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1364
            • C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
              C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3636
              • C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
                C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2960
                • C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
                  C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2628
                  • C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
                    C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3904
                    • C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
                      C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3260
                      • C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
                        C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4496
                        • C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
                          C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1928
                          • C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe
                            C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:4916
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{6A1B8~1.EXE > nul
                            13⤵
                              PID:4748
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{8778E~1.EXE > nul
                            12⤵
                              PID:3900
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{4BBF2~1.EXE > nul
                            11⤵
                              PID:3812
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{BB18A~1.EXE > nul
                            10⤵
                              PID:4616
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{92D05~1.EXE > nul
                            9⤵
                              PID:4724
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{21CCC~1.EXE > nul
                            8⤵
                              PID:4268
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{883D8~1.EXE > nul
                            7⤵
                              PID:768
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{7DCDF~1.EXE > nul
                            6⤵
                              PID:1028
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{4FB99~1.EXE > nul
                            5⤵
                              PID:1988
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{41B0A~1.EXE > nul
                            4⤵
                              PID:800
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{65A7F~1.EXE > nul
                            3⤵
                              PID:3656
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:2716

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{21CCCA6D-5686-4821-BEA5-8C2B92270244}.exe

                            Filesize

                            344KB

                            MD5

                            98cfdc8dd4ff598b24bf84f2e098ce89

                            SHA1

                            f845cafc8b0895e0b85f8d46f51b50d02f0ff711

                            SHA256

                            3fd3e247e5fb526371e1bb01d581f6e0e4c06bb9fa18c2d16e079359d2a025df

                            SHA512

                            c1aed6be8fae6ed7347969d827f72c0d11f44ab03874e5ac80d62c94f910a046849e67f50a6b16f76e142600ffa35f72153c1bdeda391ce3ad325238bb49faed

                          • C:\Windows\{41B0A4C3-463A-4096-8FA5-8479B2B102A0}.exe

                            Filesize

                            344KB

                            MD5

                            aadabbe0a224da6c80cbd2f9ae436aa5

                            SHA1

                            d8c5292dc672b21060568dea6d9388fc72426e5a

                            SHA256

                            27f9cdcb06ea8eb587000f213438b963d036a42954eff2e2b9912092bb0d48ee

                            SHA512

                            f0cd7b50e63c270b750ac8f5421bb60498be2a427c7ed6a26601453629b5e75cc7e68c22c24150c8f5a2ce9caa7f9b6af380e973cfa8875482c104245cef7ca0

                          • C:\Windows\{4BBF26EB-0B4E-4301-AA6F-8A680543B540}.exe

                            Filesize

                            344KB

                            MD5

                            779d3f5d0e84b305dff3aa6b9cdabd52

                            SHA1

                            f4f932b4c44c5f7725c3e59687767c1fb3b548c5

                            SHA256

                            a940c7f1536110ca7b11b01c251cfba8a2f28d9c0fe4db0d5e5f7c7a652982a4

                            SHA512

                            3e32da0b548a12e353214305d77d8364e56919aff26b9440b1230ed0b9f062d3ee03efc91c30a41105cb74f9fa659dc56ebd42ab9ed287baa03c91a0ee43064a

                          • C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe

                            Filesize

                            256KB

                            MD5

                            0f78be301e9835f3bd4c1ae2c95fc097

                            SHA1

                            8b86c4d593952eb2d96e790c67ae4c51b8ab7d97

                            SHA256

                            4a4894ef87fa4acf16039217551420c0d189f7ce82febcd461d34c1bf7b0f7af

                            SHA512

                            bd49746bce538230c2958fa26a1fa46da5f5a1bc4a5a6894f2fed83e5f2def6a4c0bed8e352ac4e5a392209357a7c1aa349906060532f01cc0d00f0a3d8ad732

                          • C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe

                            Filesize

                            209KB

                            MD5

                            d0b8f1b99678caa3668499f71d4155e7

                            SHA1

                            629d6dbc27a50cc5d6953f36bb4057fcc59d09a1

                            SHA256

                            7680a07526f91893e063a5b89a2a60a619b84e9b3fb2d1ba0e84da5f288f85ca

                            SHA512

                            22c1c284bad49fb285cb4a235e48ad3696b5ea6e9dc3ab567c5f6c284a2942e1d6309817653dc8202739a01810caf810af31cf68021a96bcb2aca1abaa8fed65

                          • C:\Windows\{4FB990B4-2996-4c70-81DF-4C725B16EEF7}.exe

                            Filesize

                            344KB

                            MD5

                            7ef19e0a7f0b4985cbb7accfd076d68e

                            SHA1

                            94ab44bf0a00de3ceb49e77347744e8129404c28

                            SHA256

                            22b69458defa18a0f89640766b350703a2074f39ba37e63a2b69f5875a3c0f96

                            SHA512

                            fd9c902a6b250a8c412901d90f7d5a4cb9d67b3340cc736d08a51d1194e0de01c7bd3d3633162804ec980d6a7c70da01eba9017a8d28f01b66cd18530b600c42

                          • C:\Windows\{65A7F89D-4BBA-441e-BFBC-DB2BD349600F}.exe

                            Filesize

                            344KB

                            MD5

                            ef58fd906f80f27c338c37fa8abb38af

                            SHA1

                            947f103114adc3b96039381e4da08f3e0ab29561

                            SHA256

                            5a379c8ddcc6430e20b05609e310c060652c8bf65cdd655c3644401bbeb73ce3

                            SHA512

                            c7a3d5185afc33f837cc909a69c4e783896b4356cb78853fc3ba1655e1eb2fe7d446dad095ff9e6fbb1c6c68d62a5d9ae049e5bace750ab2f461444ea6283990

                          • C:\Windows\{6A1B86CC-E5F0-4b32-B769-5501B4B237ED}.exe

                            Filesize

                            344KB

                            MD5

                            d6b3526d1ba145d7e0660a0c68e83411

                            SHA1

                            32b13330133c23022850e89169ae640286005095

                            SHA256

                            52a9a2d0951c1aa208a7ef736a27fecfc01fd3ec84195b8c5061f50d25e94a1b

                            SHA512

                            16cd45233438b42d0ae84d5375fd1300dc0f216d957453b00f31d37e65f1fe72320002c24c14dc404c2d6f3160bb5bb076ae654987c81fb0bee2c5bd57796e2f

                          • C:\Windows\{7DCDF6B8-0FA2-4b5f-8EDE-106FE76014D9}.exe

                            Filesize

                            344KB

                            MD5

                            9727ffe657f5be0c78eb88fba0e2296a

                            SHA1

                            817591d0617f5a6fc39eb8d972b4b0cb91e80996

                            SHA256

                            029a580d1bf51d9e6d7dc832a0380bbebf3a3df82220fe5014b9d26e7da8fc09

                            SHA512

                            ff94063889f498b4ccf8663828b82e7d7ed4ed6d0eb99f4c90d241f8e5cec941bf7d2fee9c71281a5e01fd6d907542725086aac1616a84570b2deac7c32f65ef

                          • C:\Windows\{8778E5F1-B81C-4711-A7C0-A0B29A98FA08}.exe

                            Filesize

                            344KB

                            MD5

                            62d3aaeb4c6540a7c2336b91ab4f8791

                            SHA1

                            72ace4b0a3f74e5d98949c823fdc7dc612f22e48

                            SHA256

                            3587c89e598770ac50cacbb610c483f74ad61f9f54187b6f30436948083acc0a

                            SHA512

                            400d4c1944587c5f62756525638d8967f2e1bc20fd3537fa48ef19cb68f7174dc1036bfbee8b839fc33fba29e86169b723153eb624dd8b17b5af6f8b558e7e63

                          • C:\Windows\{883D8F1C-C7BC-4a09-BDD7-095856DE3E58}.exe

                            Filesize

                            344KB

                            MD5

                            7baa941cd74121d0a078b1dac893ca93

                            SHA1

                            f00e816d55369b0118141e2d2372a5dfd5141e6b

                            SHA256

                            148b3ba5ac8837a4ba28a029974095b65bca51df4e41c505d95da771108e7332

                            SHA512

                            04bb17ca10057cc375440f8c2752e4a2e0181651f37a52a812388dc0f245d5b73063c0304db0d785aaf5af63447ccab425865d9da3aa266c036f8643d86fc626

                          • C:\Windows\{92D05591-C1F4-4ef3-8CED-0ED1CF1D3144}.exe

                            Filesize

                            344KB

                            MD5

                            50bd12f3313fbe5d94cf1633fe82b6fb

                            SHA1

                            a770c3b57f8e3badb1cf97028e9e56daff4d888d

                            SHA256

                            dfed87c1af3f327e30dd15619c464faf6009833c195b92c1ede8dea7256827b9

                            SHA512

                            95c6d025a9cfa8c8a5830308d6c3ae76a61edfd6784114a40a295641e55bdfcef7c044edc89737d2f8565b275e32c2f04aa920aad332944f1ec5b25bacbcf758

                          • C:\Windows\{9ABB2D05-47A2-4025-A0CC-991FF5073193}.exe

                            Filesize

                            344KB

                            MD5

                            19437dbf32c5027daeda21d68194f7ac

                            SHA1

                            3b626388cc72a536c513fad41ab72a5e30d1f901

                            SHA256

                            426c84d56bf1094920cd67f1491ddf03ace19a85e96e68f82d97d7e8fec0db7a

                            SHA512

                            b631495be515eb4044f632455f5fdfc18f1c3e85628b8c9125b14ca4df9b5b5cfa1679d3968ee36e6e7f39d4b880b73cf35a04ec39f1413b938a5f0c68a30b48

                          • C:\Windows\{BB18A1E6-3BEB-435e-8AEA-FAB1C84D2D1C}.exe

                            Filesize

                            344KB

                            MD5

                            588787ae078abfb2ce801fc4ccb4f5a3

                            SHA1

                            516e7c2e79e85aacbe8bd0f69193722de4fdfcdf

                            SHA256

                            e53f2e31dcfa891be1c28f53f9b22c92a5c3e5357f574e8e8d44f5127b931d5d

                            SHA512

                            629781315ae7c2f6fd169318eb48d63b5f269f7c52a72a6c3cd63717ba1b3d2bd336f417fa963717bcadbce5a18b70eab83aa76dbc526191a71ff094ded544e2