Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04/04/2024, 16:54
General
-
Target
2024-04-04_b58f875eeb051d5b64adcae5f66ff507_goldeneye.exe
-
Size
344KB
-
MD5
b58f875eeb051d5b64adcae5f66ff507
-
SHA1
ae4b843ecc3be28acf53251c5b69db99e3561339
-
SHA256
452252f66fe1100f3ae1dcebefd24a8d1ddd099a4fea68260e08d0a5b2f4f0ca
-
SHA512
5ece80002880fabebb89af00f4d268cab0554433240c0609b4bbc9aa60b8a7a4ec3d41c5064d7541b3b84737b2d61cbda06490243e99ef025ae684d6b74eb62a
-
SSDEEP
3072:mEGh0o7lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG5lqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_b58f875eeb051d5b64adcae5f66ff507_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_b58f875eeb051d5b64adcae5f66ff507_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F44877D-0EFB-4290-A642-9BE4D1127768}.exeC:\Windows\{7F44877D-0EFB-4290-A642-9BE4D1127768}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5478597-B1E2-462d-9A32-D257DE82547B}.exeC:\Windows\{F5478597-B1E2-462d-9A32-D257DE82547B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B09F6E62-7FC4-463a-BE95-11FFC6EED4BD}.exeC:\Windows\{B09F6E62-7FC4-463a-BE95-11FFC6EED4BD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E249C30D-50EE-435f-A517-DDF86DAC0E56}.exeC:\Windows\{E249C30D-50EE-435f-A517-DDF86DAC0E56}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F16E2E5-9ED1-41a1-BA04-C2ED223CA590}.exeC:\Windows\{9F16E2E5-9ED1-41a1-BA04-C2ED223CA590}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9DCEA958-E004-421f-B679-D5187ED8AB62}.exeC:\Windows\{9DCEA958-E004-421f-B679-D5187ED8AB62}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81654FA5-648D-421d-9AAC-95C12DC1AB56}.exeC:\Windows\{81654FA5-648D-421d-9AAC-95C12DC1AB56}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E7F08BC-3378-4522-A64D-B88825965FD6}.exeC:\Windows\{4E7F08BC-3378-4522-A64D-B88825965FD6}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F60C9C4-9327-4c0c-B9C6-57B2C93F1F75}.exeC:\Windows\{2F60C9C4-9327-4c0c-B9C6-57B2C93F1F75}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D710CED4-AB3C-472c-8244-983C0EF22354}.exeC:\Windows\{D710CED4-AB3C-472c-8244-983C0EF22354}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6838A6A0-7CE2-420f-8BD7-92103CDBA1AE}.exeC:\Windows\{6838A6A0-7CE2-420f-8BD7-92103CDBA1AE}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{50E3E65B-11B7-47bc-8FAD-B15D5A6F2CE4}.exeC:\Windows\{50E3E65B-11B7-47bc-8FAD-B15D5A6F2CE4}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6838A~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D710C~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F60C~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E7F0~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81654~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DCEA~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F16E~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E249C~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B09F6~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5478~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F448~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD55f7a760fa1690ce7c9cb1c3aa36c6c4b
SHA178bd991affb896ee595813f27d147cdb62bd8f53
SHA256136f3d90f92c57398d6cc98df0149f8b29c4b4fd608c97fe3ecfcc1d65aeaa36
SHA5126671c2960d463d39dc66fe5eafcbcb26e243b561adce89f29dc99bd5ffdd210fe1fb2f38189d45aa7521fbbcc888bbc5529566a2804cf9104ea5b79a6e0b61aa
-
Filesize
344KB
MD59b0455a7967b4e8cd74c264dfcdbcf0a
SHA1e672a8bc65fa3be79623c5f467e4952847488782
SHA25674356ce3d1d76febd92e33437e5d194707a6ea36dc286f54b188d215cfe7e149
SHA512e9ae4b5345282b74e18adf99511bcb05cb7e3d8ea803687486bdbb15fe879964a625fd9945817f9b835ede22b41789bae03958baa4a1aa29e029fb963c3a3b40
-
Filesize
344KB
MD5bfad43b776b0a0a33fc132e7c74476b7
SHA185ff5ded835cf3f858135a0bdd3d313c3b296a20
SHA25635cf18d125643144f776626b9f52f96b8b66c9a2caf964a1f5f774677f5d55d4
SHA512d1bb74b84df27c2af4cfa26d55daa5388638192eeef851ba0031f8091e921ddb7562a3b2a725939a653eef86e180dd5232fca7f4542c32b0634652778b99f04b
-
Filesize
344KB
MD58f6e4c3978479dbdd7992dba28be14ea
SHA1db9662b70e8ec6f9d6a61d2a22130454249e8481
SHA256025c263ee97878af1baf13dd8299f68a932ef1b83f7a60d98b864eac10a65cdb
SHA512070ae61f2fb06603166a261c6e00c07595668587fc8c23133e5046d7b87435d16ad0f4d22d5b59c23e172f7ba97be3a141525531ddd23e5f9efbe4749a91a122
-
Filesize
344KB
MD5bc322c7fd6157bfb493f96fdb7e26cfb
SHA129f7c0e17ae4f800f4935995b0ddcae21ae2e6d0
SHA256ccbfa6d105202bae402f29d8ac6e06069111cdae5932b6162da8ed86d1f36786
SHA512c11d2ae01376014bbc52f42b55bb9bf9b9a04c485a084e11f6fb911ca02638774c87b0b9284c639c4af37d16e876f4d0f21d601ec1ef439d5c8116bea20a7bcc
-
Filesize
344KB
MD565dd6a34f0671547f75df96111029119
SHA1394aa0bc2355e00f49b0982b44541a8181b384f4
SHA256ffbb38b359743e4641cd276f18662acd880191f2bb6caaffdcb7b11979ff5d26
SHA5125d424810c998d2eb3011f0acfc4a5900770d4bc2ddd1b019fc979638daa278024e328f7041f668d0a07b23fe5847ef47f6f1e545d4dba8163d5c096af1b3c18e
-
Filesize
344KB
MD54334a1ba42c1e996e54c8cfeb3a34d83
SHA1d8cc90a029b5fef67f7264fd04565ae35a416a41
SHA2565a6da907e89f349a9d49112d81288380b88da5806cd89e3d9091e4c452d4157a
SHA512c7517697c00f1095d46559bb54d673df878963b8de4d215730d07b1211841359b1dfa516d5c01398930dc3d45fc5a6c96ab7e85d0e8cb2dfb787cf7f02c59fd5
-
Filesize
344KB
MD5e327c78fc1a8afaea29e3b2546f029e2
SHA1000a5e0dd20ca42b4caa2b8ca58a62c4783c21d5
SHA2566ce81021975f9084af8aad240714b858e1d7058d5fdccd9f54acb7555ce0661b
SHA51263e68e51a884352e454112f688f0eb09eacca61b23b6cbc77873b2ccca6212483015ebfa86bf4c10ba00464e17a3d139176b23f85e4b070e8a8c583b8408d360
-
Filesize
344KB
MD5bbb5275caef6ad28b8fa7a26c23ee44e
SHA1f56419ca0ec1aca4df3fb9b4449bcb2e31ef4372
SHA2562dc8488122b7b0958d4b59ff31daac9075a1a906081766240474a4093bf0111b
SHA5128e222cd9b5bd1b26aa95f208eb07294aac6c5e404b7e275b13febd73103d7170379e42f9079e3331680149227f5045c4099f8c6936359e688bc56f9adfe07d03
-
Filesize
344KB
MD5fa10537524b4211dc838f31ba4693d34
SHA14e4d77e43b5e31094d6506dddca330dea01c0837
SHA25661a063b2735558d53ff67aced694b646293d73de89206ec80553beedc33e62ee
SHA5128ac1d0618196a15030407be8c0a45264d5617864905ceefda0803266ce309a3d127ef4e1827465f6a1dd30b02ab69d0ad2c3c193283e6083a4bc932185569f2e
-
Filesize
344KB
MD5ae160ca1083a4359b8152f14b40ec310
SHA1d319a1357355452011f72da94b5c0557d5573586
SHA2566681bbf73f814fded67186b6c32ccef7168140e151191838005f7717c75ca657
SHA5122fd3de04f761829ef13e5b4dc1aaa0918ac37df1226387c47f79fd78a40e0320624489df2097a63c571eaeacc01edbfd1d626f1d2b3cea5b1656e0a064947c63
-
Filesize
344KB
MD523e1019be6f8ede9eefb0385356ce94e
SHA12b165a799cf1170eb33cc6a6205089bd2d5b9b7e
SHA256c056d61f4b01c3b523754097ba5cfbf8be5cd4fc0b4fdc2a40490c953f5b50e9
SHA512fc82ee9ef0d0e6b6cb6c127ee9444a03b49b740f3bb190ddfaa85bed64b96cc31d70f31b9cfa695f10e4045a51aba5592ec5683cabbbdf06f912b408e23c58b3