Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 14:21

General

  • Target

    2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe

  • Size

    380KB

  • MD5

    925db37e64ce50f8464d24e057f580cc

  • SHA1

    0cd316396f158653171f720bbe0d8dd42fd4577f

  • SHA256

    726ad4976c5a73933c4c68e37d62af3a8ff039762c02769da26bd952d430b613

  • SHA512

    a42b81bc02cc728a66c6b2fa56aa45187e3bfd2167a5262321554f98a8a328b73b8cc77651422d17fdbcf1478ba15a5527955eac5d923feb7dfff46eeeea0169

  • SSDEEP

    3072:mEGh0oXlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG5l7Oe2MUVg3v2IneKcAEcARy

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-29_925db37e64ce50f8464d24e057f580cc_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
      C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
        C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
          C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3904
          • C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
            C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3592
            • C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
              C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1912
              • C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
                C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4452
                • C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
                  C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4352
                  • C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
                    C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:868
                    • C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
                      C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4408
                      • C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
                        C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2052
                        • C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe
                          C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3080
                          • C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe
                            C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:4780
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{CDF85~1.EXE > nul
                            13⤵
                              PID:3272
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{FA7B8~1.EXE > nul
                            12⤵
                              PID:4844
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{BD3BE~1.EXE > nul
                            11⤵
                              PID:3952
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{0DAB4~1.EXE > nul
                            10⤵
                              PID:4752
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{E5001~1.EXE > nul
                            9⤵
                              PID:2816
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{A5EC2~1.EXE > nul
                            8⤵
                              PID:4548
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{56577~1.EXE > nul
                            7⤵
                              PID:5040
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{79956~1.EXE > nul
                            6⤵
                              PID:2708
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{A4C2F~1.EXE > nul
                            5⤵
                              PID:4008
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{AB478~1.EXE > nul
                            4⤵
                              PID:4424
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{BFE2C~1.EXE > nul
                            3⤵
                              PID:2488
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:404
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:1116

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Windows\{0DAB4A9F-1C46-46a3-86C5-7F73D245893C}.exe

                              Filesize

                              380KB

                              MD5

                              a76f6ac017157853286f74b4b803c6d6

                              SHA1

                              62a2914e36b5cb43100a4fffba72fd9943f0dcee

                              SHA256

                              a58c1f18f7c6a8dbb0a491f7b1411166683047690d737f9cca7047690c898c0d

                              SHA512

                              fa5d3b8d5377c07adc4a239c2de34ce5686070bf064cde47a4be135db315c9f1e2164663fa485596e3e84ba568ab431be295cc23ce8e97ad14f08497c9cfb102

                            • C:\Windows\{129822DA-159C-4a9c-AF28-643E1E85189C}.exe

                              Filesize

                              380KB

                              MD5

                              5dabf115c2b16ed5d864d7214a3255f2

                              SHA1

                              6bb2da33b7ab5e642d39f01778419ac96b932236

                              SHA256

                              2649d247dea48292ea4ff72f5c39ccd8297f788f37861efa4d49b6d1a2aec96c

                              SHA512

                              8a84fc812905fcc920232cd9b7f747c8819039963a07d4f4ac4fd6df6b21ecbc7c09a8318a594dbafc821ecef3e8e834be40c7ff223d50a77ab2c04f2a72176a

                            • C:\Windows\{565775CF-5AE9-4f97-8F74-9C214F4B4F86}.exe

                              Filesize

                              380KB

                              MD5

                              865047b0d2df69154e127ed41c898c9f

                              SHA1

                              c62073beeebb14c98b1ed45181905ce60971802d

                              SHA256

                              51c923b4af2f1bd9f9b97ffdd0c673a43740227eb9632aaf264b38b68f7417cb

                              SHA512

                              8f0b8f7d56e9f75bc09605d013682d6e27c7307b8110e2967db04065de2ddab3a7028fc1f29c858212f7b949adecdb3b7e7040839cc296e6992eb052a2072997

                            • C:\Windows\{799562EA-6B33-4459-83AC-1A8853559BB9}.exe

                              Filesize

                              380KB

                              MD5

                              b5e9ed335c458429894d52af9a9e7e8a

                              SHA1

                              269cf61feb2c9674d642b4dd9eedd019bafa120c

                              SHA256

                              398564c91c4f4ae1eee16fddb5fd59202011645e05a9861b633e627275ceb3c4

                              SHA512

                              cf4b20c0fe92ad4a6f9f13a723be08a768a2460d6201c9a25d1f3d80393fe73f8d713da8303d62742fd845a1bb7e9cb77873f75633529fb384f13598dfa38a26

                            • C:\Windows\{A4C2FF91-F972-454a-95BB-4F7FB6B5CC7D}.exe

                              Filesize

                              380KB

                              MD5

                              4c87b6dc16f2e998b4ccde468e347e04

                              SHA1

                              191538cefe6f173648c0e07a2ac96b58d8b32eee

                              SHA256

                              8deef616ba2a35d8c65955d831dd1e4eaca7e66705755010e115c7f5a78f7694

                              SHA512

                              0d7085c659e1e80809ff40ed17fbf4679d1ccb3e82aafbcf330134570d06520e5a6bcccc720cff9b0ed19fefd9e5c97f2ed7ab508a93ea1eb5ad2928779c5d40

                            • C:\Windows\{A5EC2C8E-77C1-4789-8737-9CFA65AADCC3}.exe

                              Filesize

                              380KB

                              MD5

                              e805050ccc427f3cce4ab9c93831f301

                              SHA1

                              0ddb64fb4ca964e3db05a18dea5513b5522cec6f

                              SHA256

                              8015f7e6f8cd4b5e20554e75d1df856b8322d840f9767f9ab889124a24532d19

                              SHA512

                              e7fa07e394a4367ecd8bb0b6124eab77d7aea98e7fb49c351fb7596b85b30ef7a7452cbc914cd70e071bb6c90f6e37d86d5aa0d4eed367d4f020ee55c3ee4f90

                            • C:\Windows\{AB478CF5-6D1A-4dad-ADEE-87F80281EA67}.exe

                              Filesize

                              380KB

                              MD5

                              dd5700b59c0d694e5d9b4f05644c8d00

                              SHA1

                              975142f6ebfdd4e0503cd129cba165bc6064cf19

                              SHA256

                              74e066f9ce4b67228f48a204978eab37b2e2519474e4c2cce0c194d9765e438f

                              SHA512

                              9dd9fdb3fe8639f2785eacac2465ec50e1c2def6c8831f1aeb36f0e1d35d8de8e7f506703addb786d145d20708d843e814c26aef88c2ac69ccb398a182768d3e

                            • C:\Windows\{BD3BEA08-38DC-42d1-88BE-79B385FAA4B2}.exe

                              Filesize

                              380KB

                              MD5

                              1ca919c371885bd6782f8a821081a9be

                              SHA1

                              dccabd986c17c5e93df78d10ba61b1f18f52ab48

                              SHA256

                              20c8727d9ada2512107609b075c537b90134dad00667d215b2c4ec5b2ced7912

                              SHA512

                              418a87082cf2df6a01f80d970ce1292a479dcad9732a37b21958695e1ddcce1370fb6201d30aac337d023c4e53c90aef733033b6df3ba5cff55b0381b978656d

                            • C:\Windows\{BFE2C966-CC26-4a7f-8C79-25B28AB30C8E}.exe

                              Filesize

                              380KB

                              MD5

                              63099603362d4ddefcbf13209573d2e5

                              SHA1

                              c316730f694828f5f07966c17d190f616b25ae2c

                              SHA256

                              dc4f1449123c7cc6d8e2097c7b88262cd1d06a7957d47f006b2150d7d79b22e1

                              SHA512

                              fd9c3aa618ea7f7ad0dd6ef38e3aa342f78a7195e9be28a531e5edfdbd8cb6d401cf4c0c2a0d16393cbbb1b02d4f02f5b00036b2f26f26c15f1d7011ed45bf33

                            • C:\Windows\{CDF85273-B026-48e8-896F-1340726C28E1}.exe

                              Filesize

                              380KB

                              MD5

                              160180ae22c3605f6c77e109f05e79ce

                              SHA1

                              38b940c132e73aef63dd8117130ddfe9267205be

                              SHA256

                              7175b2de6c5a1f369e2b39fad3fea5b37791173a7b16762eca1cbb1e2a3274ce

                              SHA512

                              6abf66fc45e8687bd5d40f537a28fa8075a50028cb79dc22787151b61f1a23e3c6b76964337d66cc73915415a1ba41e1d5da76036567f0827f579796e9709489

                            • C:\Windows\{E50019F0-FB76-4698-B1DC-26C3D84D8BDC}.exe

                              Filesize

                              380KB

                              MD5

                              156035a9ea5c11d90195d5765d9ebf3d

                              SHA1

                              0836c0e490bd4366a00adf8e8b2c052b2c42c2a1

                              SHA256

                              e5d0b55a4fb40166229beb7436545151eb80123caa5d6f75c1fc3da37d6b0e8f

                              SHA512

                              c7ca4aee83a8bf9f2aac0fa99bcca9138275f9b4261a7aedb5991f5bec6534597ee450cb7ce72a186bbe62f98f8623003c601566882008c97d65dd357537ba76

                            • C:\Windows\{FA7B83FA-8529-467d-AAA1-A2528149205C}.exe

                              Filesize

                              380KB

                              MD5

                              fb751c559dfcfe238f835945f4d0bec6

                              SHA1

                              d538c39c545c222d810f2a56cd49c67cdf2d7070

                              SHA256

                              4af800c1265e2c5409d86bcee1164e1e839aad3b4bc999cc319aa18dc6708e0e

                              SHA512

                              b81a855c5ef6965c0a83146e5e865b7bba0aaa37c9f31d883def10f3c58626a2d81186c457dbd57d26d5166eccca20835a57c240f4a0b6f3e8da434e00dda13e