Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/03/2024, 22:39
General
-
Target
2024-03-28_9dbf5d744873cb1e25a96ceca175fb8f_goldeneye.exe
-
Size
168KB
-
MD5
9dbf5d744873cb1e25a96ceca175fb8f
-
SHA1
d229c9212ef48715cd4cc176441672cb23bbe6f9
-
SHA256
e63b32362cb7ede50d8014a040901beea0c2403fb9d000824b165de49c3acdbf
-
SHA512
2ad68e6caeb1d8546ab92be4e8f8bbf8835b6efe4389c02759efb044d96fee070998530bd8a03fb0e7c09a53979dd46dd349cbf583e09d380bf4e21809c1ec77
-
SSDEEP
1536:1EGh0oOlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oOlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_9dbf5d744873cb1e25a96ceca175fb8f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_9dbf5d744873cb1e25a96ceca175fb8f_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFAB043B-8F05-4c48-8C0F-59DEF69C8F96}.exeC:\Windows\{CFAB043B-8F05-4c48-8C0F-59DEF69C8F96}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{481698FB-E972-4691-AB3E-825286DBEE25}.exeC:\Windows\{481698FB-E972-4691-AB3E-825286DBEE25}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B5416F6-D27B-45a7-9A25-DFF414E7808E}.exeC:\Windows\{9B5416F6-D27B-45a7-9A25-DFF414E7808E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21EBBE0A-1130-45be-BA42-93BCF0DFF790}.exeC:\Windows\{21EBBE0A-1130-45be-BA42-93BCF0DFF790}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08A37B8B-6E16-4e62-BDC3-29BAB32D977E}.exeC:\Windows\{08A37B8B-6E16-4e62-BDC3-29BAB32D977E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{268C4B74-E421-46fd-B5FE-212CC97327EA}.exeC:\Windows\{268C4B74-E421-46fd-B5FE-212CC97327EA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C1D8ED7-605A-4b31-8CFE-A346E741CFD4}.exeC:\Windows\{6C1D8ED7-605A-4b31-8CFE-A346E741CFD4}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{605CDD4C-AE3A-4ce4-9577-22A1B5AB5D3E}.exeC:\Windows\{605CDD4C-AE3A-4ce4-9577-22A1B5AB5D3E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92279C5C-FDAF-4f62-A1D0-677D128616A7}.exeC:\Windows\{92279C5C-FDAF-4f62-A1D0-677D128616A7}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{942DA72F-12CC-4b78-86D0-95F322DE84DB}.exeC:\Windows\{942DA72F-12CC-4b78-86D0-95F322DE84DB}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F72FDBF7-4C5B-4c5f-AF4C-E6D58ADDCAEF}.exeC:\Windows\{F72FDBF7-4C5B-4c5f-AF4C-E6D58ADDCAEF}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{021F0A61-AC9F-4946-9D4E-11280D71EBB9}.exeC:\Windows\{021F0A61-AC9F-4946-9D4E-11280D71EBB9}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F72FD~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{942DA~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92279~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{605CD~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C1D8~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{268C4~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08A37~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21EBB~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B541~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48169~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFAB0~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD520e5cbf49bdd47962933db08f6bcc173
SHA10836b6919bc3a62f4ff905f3a408b921af516988
SHA256608e8df4e98feecc86ad33c49463d6d3dce372521247ce5d9847293bca973024
SHA512224c3a8c6bc94e27657c1708ad922260fdf336c49c273745f174506d1bf0786996afb3e70b60e092a055604c11eb41704a2a400f2181c3cfcc55fb1abe1d9d70
-
Filesize
168KB
MD51e7f402cded8d1c109a898dcde6ba144
SHA1ff2012f8cc6442899bd01b87e473972325a1ac62
SHA2561745c500fa10d6be5a126a85e248bedc73ab37218b257967544ca76453d0f31c
SHA51238aad47d806e7e5ba5f1482f9ab601e840eaab961d582e3638535af48c0ce61656e9e72db5a568ec022c6bf048ebb922ebc0afab74331ab06a228db02ea506a2
-
Filesize
168KB
MD5c78a53a423c22d8b7b31a1a6fed776a4
SHA1718b5184bc739848dea04f2b2919167a815e39fe
SHA256daf02f9d7ba4c74124722d0f3ed685c9b7788314aa8199bacb65c5c280c932c9
SHA512c9c3c362539e1679e966ed8c874f03a4474e823c1c4f5ad8ff4e68d6510ac6f76388b7fb0976ca98295837620843a686f8cc73e5944d0d5d1418d9f6bce50c39
-
Filesize
168KB
MD5eb9a433aa93c3a8ee20a32516cb50d0f
SHA1e25926634ec4fa628bb2deb213d194722070757d
SHA2564624b91a753f44e535969c04f33da162c29798d60f7b7731123bb1540330cb2a
SHA512188f9aba5ae19d609ffe9a6ab1d967af71f3fa8e283bfc693aff7aef45d2468b815af5360943ae2f2f10b5e3449ccac96d165259d84e5279e7ce3c7c71e066e3
-
Filesize
168KB
MD5ab7f25ab1adfbdb2ca900cbf181b2fea
SHA1516cc6786254fedf9e4e342a47c442a8b10a9b55
SHA25680a132d4e80605ae81e206c84cf8271bff964bc509f5e79d0e9e61831c72bcdc
SHA5127e7afa6d23e06778e5d395b67daa4d7405b50a78c7a6e1777d54ae414145d3c4e3bd6339a99b63e449562df0df51e57e4606fd6983028207a56180e7c59b7471
-
Filesize
168KB
MD52968e0bf827aed4237453a16ad4fb67f
SHA1425469e0ead5d85ded7e2a7b50fb960a2edad9c8
SHA256ac09337b2b158283a926fa68a7170bb5c99eb762206f92bb2809d87d2ac9444d
SHA512dc1026ba1f0b9fffb98a7e51ed94230d25f3f828979d6be0f2103fa7ad5def2fe40de47a26e7d4d7e6ecb8f34c79b6a30e265589b837fb22bd57de353d3b6940
-
Filesize
168KB
MD57181b6645d2a86ea3a9bfe84bc45275f
SHA15cc40130923169bce8a374fde673b3820b1cb7e5
SHA25652d6f8604548ce37e69c157564bb9d43f5799ed34588b5847a5264db8cecc6d9
SHA512f5fc5f1fc060e8e6ee426f4c2d4f90fc01078a1f7336b96c4efaf2c593463cb3562d3d770a28318e84a32d7cc98e54a806ddb0123c0fc879e5e57ee7cb71f146
-
Filesize
168KB
MD5d09f175940a8188f2874627bb8d2fe6a
SHA1e939e4dcabffb4a9b7b3e08005fbb31ab2a9a2fc
SHA256cda1edda64bfae57ab8d7f262995e366d3912fe03e02d09469bc2c6819ef572e
SHA51246b33f7281781afcbc234e423c5d913b1a4272673db0d30bf48dc070c9a5f3393a47af301018746f75be1b253e1f7020fd0c7a39c8756503769e5734635a6ecb
-
Filesize
168KB
MD56daa2a8577e8fa76531e8c6ba8e0e8f5
SHA151c3e5c6e1b4220b1e068fc3a0c119a25f19b08b
SHA256e3c919fafa083bb0a1f77dd77b784da454e09922366d9fbe2a8083382247fd2e
SHA512935b10e5982da8078df68c3b7ac12948ad8550cc37ae0e9ddd3414bb05398438a52639b533f4b6a89551fe176b53379a820c47d607b5c48fdaec05f57b4ca9cb
-
Filesize
168KB
MD5867f7e435342698b255188c3a4b94e08
SHA181d17487908debaaec73e6c8f2e20ec65849b1c2
SHA256e7b1b2dec47994de1e124cc0da28804e33d68fd29c03cd045dd26f0c74e41c5f
SHA5120c3998703f27656aad72134299c91e4a36176392c21692c6436521398416d58f2038cec533a7d5b911c673d3117b114c6d0214f61bbc4c15a611720b15baedc0
-
Filesize
168KB
MD594f3cca89ae5e1c216dc0cd0c8ade927
SHA160360b18990b583d51c71db724a61758f1cff5e4
SHA256fb5d3af3d004879db612b1dc56c82bc849425dc8eb74b2dc006755b599baf580
SHA512370cd0918500f2d8e310eb3c871d4341197e615db13d2bad5259da9e0e666be96729b5a8527161d9967024dc1d7507b2e22903df774855faefa87bf7aa46a514
-
Filesize
168KB
MD5ec64f9e255bb51f2c506b0323205978b
SHA18ff6f33da97a3c0984b959ca2ea64fb26092b4db
SHA25686e8067f234bafc882a76d36fb9e965ebd367cd85602333485591c3ec469bd05
SHA512a148a39abf98cb6e20dc3e36824d70504a78a9eea480422c0473995386cddf6e994888a1a4ec5650556e182c211fac6ab1f042ee1e19d9b6619ad848ce5a78bd