Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 18:02
General
-
Target
2024-03-19_f427301dfc3c2af8d510edb9a9c29293_goldeneye.exe
-
Size
197KB
-
MD5
f427301dfc3c2af8d510edb9a9c29293
-
SHA1
5cf1e65e7c00c4687f8a02c7da0a0eeb7f12d8eb
-
SHA256
6dadb3c3bcf9ff028932aaa2a95e62fcd7292ff54c56647aced136422306dcb2
-
SHA512
957e9bb1f92d791028a1f19fa2bccf2effca155ed83b3ce7c006759b5bb3f2a7b903d13279001fbe987e71f959ec8303533b19831012a548d6d95d72b3efcae5
-
SSDEEP
3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGTlEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_f427301dfc3c2af8d510edb9a9c29293_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_f427301dfc3c2af8d510edb9a9c29293_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73DEF08A-F15F-4322-897E-8E731D4E42EF}.exeC:\Windows\{73DEF08A-F15F-4322-897E-8E731D4E42EF}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DB61C77-D960-4a34-8E67-0EB3927D9F66}.exeC:\Windows\{2DB61C77-D960-4a34-8E67-0EB3927D9F66}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{476060ED-BB84-480b-9677-6FC974AED9AE}.exeC:\Windows\{476060ED-BB84-480b-9677-6FC974AED9AE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAE111F6-3C7D-4a69-A183-72EF94DA3678}.exeC:\Windows\{BAE111F6-3C7D-4a69-A183-72EF94DA3678}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E7C401C-C5A3-427c-BA58-096BFFB127CE}.exeC:\Windows\{3E7C401C-C5A3-427c-BA58-096BFFB127CE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3117A3F-5E92-4694-9567-ABE0831DC024}.exeC:\Windows\{E3117A3F-5E92-4694-9567-ABE0831DC024}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72E0CF41-3BD5-409a-A332-2E894ADBEDFC}.exeC:\Windows\{72E0CF41-3BD5-409a-A332-2E894ADBEDFC}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D68E014B-6826-4345-9FB5-512C24CC7DF1}.exeC:\Windows\{D68E014B-6826-4345-9FB5-512C24CC7DF1}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A155C9C-11CA-47c7-BE24-FBB2223A7DA1}.exeC:\Windows\{5A155C9C-11CA-47c7-BE24-FBB2223A7DA1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7682B3C9-C9BC-4e87-9C32-58F5E8D2B934}.exeC:\Windows\{7682B3C9-C9BC-4e87-9C32-58F5E8D2B934}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CDCD6F7-BE8E-427c-914A-2A0FD2986645}.exeC:\Windows\{0CDCD6F7-BE8E-427c-914A-2A0FD2986645}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{23532CB3-3BD5-4c47-9BF0-BC1C3ED6296E}.exeC:\Windows\{23532CB3-3BD5-4c47-9BF0-BC1C3ED6296E}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CDCD~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7682B~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A155~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D68E0~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72E0C~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3117~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E7C4~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAE11~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47606~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DB61~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73DEF~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5d4b5ce1a2d6a61936be9a9982d6f0d58
SHA1c37cbaf53484b158acf2f5d35406d8095d4d40d5
SHA25642c59d831b7dec38edd49960aa87e23c7847caf5ad5f40487bbdc05b6300e167
SHA51264188e04dd7a68d382277b308207e63f4468922e41f09694d0dc11e0e5611fc122c44c1e09025a65e8480000a90083b9208bab90914f6488416e4b7cca295a40
-
Filesize
197KB
MD5fafaaac171cfce2747b78fe064dafd32
SHA14b14a5c874e4e24f5d8792cea185c917618c2163
SHA2566ae0bfd80473d1e102a01914d38927669bc14e1c84091d1fbe78d8e07045766c
SHA51286b8783186d2544bccb171c1090cadd6d00e3b8f9a70626373d48c85b1e99a658fa796ab119b350fe71402c420b52ac2d0faabe5b45dfb0bc2bc71a1a1d4e8c0
-
Filesize
197KB
MD54c0e4da023eedb0aed056484e913be79
SHA195f28894496cf98264289e1e29aa1a29abb9f95b
SHA256d6085a8c737cadc488ee1226658917fb9abc5ce042f0f076a8c08989b7b27338
SHA512c78ce411fc0929ef6aa14158d7c8fb86b4bc63974af818fd7b11d61b05305075d2f5bd1b7b3a244b2b79ceb702855080e7735836a266fac9f78f77c65006d473
-
Filesize
197KB
MD53fc497074e40b5e26f6856ba6694a06b
SHA1d1807d4853afd2882b6cfded8b0730f99103ae8f
SHA256592e804e0525c0aaa167802a6c9d76cbcdadf72179710e665b71eb41bd6843db
SHA512b05afe296c375259206670bab748e8c47cdaf049eb1fe1b0622e6ffddd3cd27b5a9b4f1a6240ad1db11c33f0ff5e6a638005c571e0503681db23736695abb39d
-
Filesize
197KB
MD5b7ffcb61de81e10a9689db98f7972137
SHA185237c8166f9f8b1ba1d5d4993639db5010ec968
SHA25640c644c911045d298880a3de1cccc030d4649621a16270a08619b1d68781147d
SHA512428408982a204680df5e27c55b1a7cdd1ce109ea0b685460d8d727f089f8cbc484e25de0899eb7d381a05daa5c6112a963437c8fc64b9148732fbeafd074afe9
-
Filesize
197KB
MD5ade3ba2f31d2957bf06edfe26a703776
SHA180e2a01ad966dc1555dcff9454f12707a47d3a9e
SHA25694a34a6028caa990a8d4d3d46a53a83d36b4e5ec74c6161367d9adea9adfe43d
SHA512c6a39ed0066c54a7bee1c6ec512ed7e30e12c25eba5ef6cc41e6ea192b71b01f65dfdf51be999e3b42b184218e02d715427e99f8a1beac5f5fd886c3f0d1782a
-
Filesize
197KB
MD5ddb84aefcb80a39d42068ea14dfcb0aa
SHA13cb0d84895d95a02a39f6c9c34df22d2555d219d
SHA2563254bb159395784f6627407f6c5a608d2febd3a08c7369c3bf394642bd0af227
SHA512f85dd50c266b8411702a5f98b78c4d8f5a497a26d0f52f2f834d42ce971b42d7b2a97734d4d2e09eae5733da9108851ba02f0fb6997e4aade924c07f4af41112
-
Filesize
197KB
MD5c9620ee3752ad5d1d20e3730cef408af
SHA1eb116c5c4506114c399fe054970566a28c02354b
SHA256707d5f7a88dfa0a29a1602a974fc5c1a368f08773cd24276180fbdf168db22ca
SHA5121a16696ac6a437f8e3de4e132772069bbf722285cf70c125700e87f2b689a67c4853f597d1094ce3ef62516997e10671f5dc507d787f1d4c300b399e5c1546b9
-
Filesize
197KB
MD51f1d48b200dcb96ce7423785d191a060
SHA1d26a70bd81202769c179aa30778e2d284b8eed28
SHA256cd7a8e820ac3b1f4cb89ca0ce15f8badc2b6ef0b66125fd7776237f8451c42cf
SHA5120e86c8e840cf13a881a7af56f327a0dddb8f395952f686d4f448caed3e2a5d00b5cd6988cb6eef2ac7132896c0d9233366488eccb3978449046182587dbc5ef0
-
Filesize
197KB
MD5b48bbbb03a5e6da551b6fd8abc48bdd1
SHA1b9506b5cf19bedfd1119622cbbd7e4f9bac57e96
SHA256874fe9ef1926b6442ab1780289c8ecdf24d7a0b4e4a5bb086480be83968f0fde
SHA5126bc4f5f419ee0102310f38fe5a79d1f6aa609cde1de8e8d3c08d17b3e2df06f6f55b5e55dd8e2aca03d2c41097bf15343dd111beb79bc063fcd81afdd5d43804
-
Filesize
197KB
MD55f0612a816ecea567f21d048bf428a57
SHA1b44dec1742a8d5d97bc481741eeadad75fe15ff6
SHA256b8483148656120e758530f980f5217dc2dea2d7eab4295457d9b5ec282ba3f44
SHA512dd993961384140a4d84bcab2d22bd4a98babd2575d35a86b454b9cbdddf0b60e00477a38abb06a6fcdd2068d25c43c52d02a2e0fcb2227bc984fa1c096ea766a
-
Filesize
197KB
MD5eb269a6eafacb177351904c43fc1c69a
SHA15ef5b7c0d4070e79a01d7938cea241004fd256b1
SHA256fd7018823e6c39e92632177c01af2ac8eb19d4cdbf370912c86936e9eedfccc6
SHA5125f8ace5be7b94168c93127cd9625359e8a8857af2be5f9676a5cb2fadcf1c55044e241bcd1b052d81f2e13a4ab2fcf6efccd5cb2eab6d2ddc2c5ef9784c2cb48