Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/03/2024, 04:25
General
-
Target
2024-03-29_2a4e6d79bb3ac0a3ce603d3e02940d43_goldeneye.exe
-
Size
192KB
-
MD5
2a4e6d79bb3ac0a3ce603d3e02940d43
-
SHA1
672a9c8ebf45d4dc6f013d5131e0c755536ebb2e
-
SHA256
6de584a57549165150ea67d7df78408a8329aeb510600525bcc6929d4cf12d15
-
SHA512
00f20ff6f2598b9dd227e3e13789910ab6330ec5e08ec92168f68248b882e956bbdcd42cf4728c644a4b316b74828955e11d4a012acb4b0affc3c4fe1f8dcb2d
-
SSDEEP
1536:1EGh0oIl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oIl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_2a4e6d79bb3ac0a3ce603d3e02940d43_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_2a4e6d79bb3ac0a3ce603d3e02940d43_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FF4725B-5429-4c0a-BE29-ADD92275378F}.exeC:\Windows\{8FF4725B-5429-4c0a-BE29-ADD92275378F}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9DA5D8E6-2A99-4dee-9C49-51CA2C8B8F09}.exeC:\Windows\{9DA5D8E6-2A99-4dee-9C49-51CA2C8B8F09}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F46AD940-EFE8-4d32-A821-493C92525814}.exeC:\Windows\{F46AD940-EFE8-4d32-A821-493C92525814}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B0AED0A-BE13-439b-8291-B5665A6D9977}.exeC:\Windows\{2B0AED0A-BE13-439b-8291-B5665A6D9977}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{061FE144-C9BD-456d-9BEF-2076C260B176}.exeC:\Windows\{061FE144-C9BD-456d-9BEF-2076C260B176}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6457226-0CA4-48cc-A254-D12F9DD5E6DF}.exeC:\Windows\{E6457226-0CA4-48cc-A254-D12F9DD5E6DF}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3354E333-082A-470e-8493-5ECAD2365DB1}.exeC:\Windows\{3354E333-082A-470e-8493-5ECAD2365DB1}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{681BB159-2B34-462a-80EA-10D3D4575399}.exeC:\Windows\{681BB159-2B34-462a-80EA-10D3D4575399}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86E1E2EB-3FE1-4608-8C56-691B98A2C753}.exeC:\Windows\{86E1E2EB-3FE1-4608-8C56-691B98A2C753}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7CA39D18-382C-4415-B4FB-4545B18F296E}.exeC:\Windows\{7CA39D18-382C-4415-B4FB-4545B18F296E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E83722D2-FBBF-4a41-B9D9-E3BE9C661178}.exeC:\Windows\{E83722D2-FBBF-4a41-B9D9-E3BE9C661178}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3583729E-32B2-4088-9F27-2AFB9B98CB0E}.exeC:\Windows\{3583729E-32B2-4088-9F27-2AFB9B98CB0E}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8372~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7CA39~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86E1E~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{681BB~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3354E~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6457~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{061FE~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B0AE~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F46AD~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DA5D~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FF47~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD542737a508edf5224cd2302bd0856a6b7
SHA1ce29f4aa6b111c7c5f598ff39907e01521ee6324
SHA256adf4acff3b01a6bf071cc6d6a74a7d0f6ee1187f86366327d699162ca8af1a54
SHA51255d1abc4e39209c427a9d7b8a6e1179f84e798db8f42bbc6655b1d1b40c7dfb665b2111e184dc8f98aa64574438d501b9284fd4d07e1f70b5af9cca313452528
-
Filesize
192KB
MD5162db5acaf60dbbd1e2b9becc75f9866
SHA13337c0af1629ffca366eebbb4e4ebbb0482bf59c
SHA2564ff9de82aa32ce8eb74f454fc3aaa85a60e4cf8587f4d19d0d36e5f1160b576e
SHA512caab771a515474dbc29b9bf8614be3f525fa5fe8eea976ae0a6049df638bc8537aced399eb9b7c4178262b88741b96a6c29ccaf6518ad5c6fff09fc0f8b063f3
-
Filesize
192KB
MD5ede8e24d552b74c7b1e97909e63cdf2b
SHA15e3e3c0e3e444dba4a3494d0d40f70836da36f7e
SHA2560338949e4baa98cf19b66d9bcfc787c15110eff3ba0c6d1062f41c32cd61f2c8
SHA5120a4e9e8312dbb1d4713b51c9c0544017e876cfc359b3a85fa9c26cb5dedf61d9363e95e9415937e67b4162f32751f37166aad0b46592eb26f81df9251982e06e
-
Filesize
192KB
MD5cb9d576ebde9c7ffa867b97f647c47d5
SHA19b1deceb52e69d64488ac2e0b621690249625994
SHA2569a6d0e4f172e6012ccac4e5fc6ea9604d1d90715fec802a213d3cf79f7ec42bf
SHA5121bd7e4ad46eee6a46478f94b214301ca6dde58a20a754d4ef22b85e736761e35423a8dd5dcfd169fb6274f49101ef4d93b237f505e67a10bd3be0c89db1273c5
-
Filesize
192KB
MD50b2e2a042c823f9230b74744928a0c51
SHA1531e54a7374257fbf3bb0dd858c78aacbca04dc2
SHA25622a975c5ec0bdda522cd27e358fa4294d8d8e4d791ebd5f968d607740849f2bb
SHA512d1af20950e762decca65992e15562639a002e0a885264943910ef50825e21a622aa8265f78fb6f732369a29902714531c776a22c6eaea8f1d22bf67b75839c68
-
Filesize
192KB
MD533cfbd3bf3640df420f36238b8d83ab2
SHA1e6f27a3e6ce5ff658130ad1f30346d1ba6f54bef
SHA25662cd7127ec4481729e11b72bd740b049929f0c01d5ccb0836995e9a8b682baff
SHA512f85aad8bd18ead74fb266d91850f2dc142eb5c60ff7e25c389752e0e00f5db7bb27ce151753618bf31e23219330b115c9a12c0efe26d14bb109b909152ba31f7
-
Filesize
192KB
MD5ba47a06fb26e9ab6bcbef5e83f9cabb9
SHA1e6b4a00a786347e3c850f0773b00ae3a290eeab1
SHA25678bb7bc6ab73b27b0fe1ba64b824c9da1289fc728c44be9a2403e7333d594cd4
SHA512afe8a683beac54396238ba93a58d212c1f3fa12d000d7ab24bb6c8683230119dfe933179547cb04cd93413d32d81382b3e4e1a242557c07d8a9831286362563d
-
Filesize
192KB
MD5648e6ab359cb7661a79e72be9fb61254
SHA16d51e1cb2315d2e96e95e77988cb648ad6fcbc6b
SHA256684f604d72d46cce932df0584efbb79bac3d08e39043d1e53cf988a9f7d70d8e
SHA512ee8bf77c264798be0713bc82b5e67ab2af5f7aee6559dfa5932cd89267d2169da41de5912371ff5a2ff773465d880094cd7a070cac4e360aa64f44fa7243dd77
-
Filesize
192KB
MD5c2cfd0356a90ece77b1663b677ebf468
SHA1aa77a02106149387db913ec447ef60868db0b017
SHA2562c52f2e478b4a95ea6df832bbb0659814b5d21467d73a02c9c5c1cdf27c4dbaf
SHA512b9883e6b8a4495afc894c412d1928a669e11435d5b490de01fb4b1e39c8397be5601b5215e434843d5583337f5dc37242681031f496ae61bb9dd69cf08b65990
-
Filesize
192KB
MD5ac416b8504de1cb26f645f1c9764afd1
SHA196900636ee15a5b993815c2124848c9659abd1e4
SHA256b153a05beb5a78eff7372ff28abe4d265d8fd568ef0d86be80f95df9901312d4
SHA512741f3ce75f212aae981d5f1337f86ede116bfbec706efe954e894fb66cccd4cd5239f44a5fd67235ffac77f011e49a57e00114b433c3a0189af050722d84fdc6
-
Filesize
192KB
MD5f1b654c4bbb0ce03c190e43dd9af7702
SHA1248816af74c304026df7a4061a6d982ca7c77321
SHA25693649b84e0b89a67d012eaec886e4a5f22db958c69d5323b1ce5265a4f731af9
SHA512a2c5201130c73653d15ac3fbe9d12db3324daaab77ca61e380690ef49da30d12fdb90a63ccc959fd0e0d6e489a30800f68e7c4fc5ae36526444cb0bc6a8aa874
-
Filesize
192KB
MD56cb3d121f457dbe7a6b8d3b5f0d1eecd
SHA1899e9f5d1a3b39c87b3bd17e6e63ff24a47fc450
SHA2564ba7b4fc1251971a9cf9eeeee8e947ae3900291fdf5bdc39fd369f93317afbb4
SHA512635804a5c8b24ee6b0adcc111d2a1ed007061dd38a3d60e60e28b343394b573847252effed79211e1d78cea855c1ad0926811ac3dbbef5354a37454293b191de