Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 00:48

General

  • Target

    2024-04-05_3d938cf1cf3819b7ade33ae44c0af079_goldeneye.exe

  • Size

    168KB

  • MD5

    3d938cf1cf3819b7ade33ae44c0af079

  • SHA1

    78a46a9758095990867ef2dea90b88decd89ce80

  • SHA256

    ca812f3efb73d71f9bd9009f9499574193a465209cdc1fe8df2234793d0bf812

  • SHA512

    5752345fc39307675e18a49519c42b455a6b1f9b9f092a4e0f631fc4857939166cbce00eeef54721cdf3a3bf626ef2cb8381cff97083c4d5fd3042a971225c95

  • SSDEEP

    1536:1EGh0oXlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oXlqOPOe2MUVg3Ve+rX

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-05_3d938cf1cf3819b7ade33ae44c0af079_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-05_3d938cf1cf3819b7ade33ae44c0af079_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\{14150FCA-F0A2-4a6f-8B36-F648F7FA4D1D}.exe
      C:\Windows\{14150FCA-F0A2-4a6f-8B36-F648F7FA4D1D}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\{488AF874-0767-4316-8578-CBCDABFBB111}.exe
        C:\Windows\{488AF874-0767-4316-8578-CBCDABFBB111}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Windows\{049AB883-A0A0-42e8-A986-40B688539F37}.exe
          C:\Windows\{049AB883-A0A0-42e8-A986-40B688539F37}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Windows\{482489AB-931A-4a34-9CA9-EB60454F37A1}.exe
            C:\Windows\{482489AB-931A-4a34-9CA9-EB60454F37A1}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4460
            • C:\Windows\{CEB39379-322F-419f-AC18-92E94F36C2DD}.exe
              C:\Windows\{CEB39379-322F-419f-AC18-92E94F36C2DD}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4360
              • C:\Windows\{937BB5B4-89DF-4abf-9EDF-1CF8EC8F909D}.exe
                C:\Windows\{937BB5B4-89DF-4abf-9EDF-1CF8EC8F909D}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1760
                • C:\Windows\{478D9E42-3030-4248-A2B4-A2717C211022}.exe
                  C:\Windows\{478D9E42-3030-4248-A2B4-A2717C211022}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4312
                  • C:\Windows\{494AB0A6-C19F-437b-A079-76A6150C1DA8}.exe
                    C:\Windows\{494AB0A6-C19F-437b-A079-76A6150C1DA8}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1600
                    • C:\Windows\{2BC4B758-9895-4e3c-B86B-0F2E3EB23876}.exe
                      C:\Windows\{2BC4B758-9895-4e3c-B86B-0F2E3EB23876}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1248
                      • C:\Windows\{C3EC2730-19D7-4c36-871C-09BC5DB1B395}.exe
                        C:\Windows\{C3EC2730-19D7-4c36-871C-09BC5DB1B395}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1100
                        • C:\Windows\{3A320539-B5A9-4745-A0B7-FC128FD663DA}.exe
                          C:\Windows\{3A320539-B5A9-4745-A0B7-FC128FD663DA}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2028
                          • C:\Windows\{0A4F60AA-C145-453f-B13F-F234CE006DC2}.exe
                            C:\Windows\{0A4F60AA-C145-453f-B13F-F234CE006DC2}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:4020
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{3A320~1.EXE > nul
                            13⤵
                              PID:2200
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{C3EC2~1.EXE > nul
                            12⤵
                              PID:2760
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{2BC4B~1.EXE > nul
                            11⤵
                              PID:4748
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{494AB~1.EXE > nul
                            10⤵
                              PID:3912
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{478D9~1.EXE > nul
                            9⤵
                              PID:4900
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{937BB~1.EXE > nul
                            8⤵
                              PID:4320
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{CEB39~1.EXE > nul
                            7⤵
                              PID:4488
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{48248~1.EXE > nul
                            6⤵
                              PID:2416
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{049AB~1.EXE > nul
                            5⤵
                              PID:4984
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{488AF~1.EXE > nul
                            4⤵
                              PID:3200
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{14150~1.EXE > nul
                            3⤵
                              PID:3652
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:1596

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{049AB883-A0A0-42e8-A986-40B688539F37}.exe

                            Filesize

                            168KB

                            MD5

                            634c25fcf0d7c47675c86d0cdc4e02a0

                            SHA1

                            b87af5cf9ef3d54c69ba5549a78694020552e437

                            SHA256

                            d5852a6d64e9dd33815b6cdaf42ed095a05d9ca224a498bc695a9bd37b3065d2

                            SHA512

                            e4440f01c3968eecf878a24e23aa5757292ed58ab515aa5db42153a4290c4036e4590205bb76c9fe812ba24f8e3ea37c6f72137230f60b06c527ed68927bd130

                          • C:\Windows\{0A4F60AA-C145-453f-B13F-F234CE006DC2}.exe

                            Filesize

                            168KB

                            MD5

                            cf707e8a97e18d77347770aebc3a7b1f

                            SHA1

                            8ff3fd38dd27e6a1abd82ade062c8c4b17dff763

                            SHA256

                            e7fba89cdbde356e89cf73e954260dcd0fca38f82a82d0cb49ddf5283de7bf09

                            SHA512

                            2c010c4a8dfb1174ea29f07821246520023fd32686693463485d7f43ae9f1166a6b34c9323f40c1f323f4ced7406b6f9df8e07e48dd540758f898d09a091c882

                          • C:\Windows\{14150FCA-F0A2-4a6f-8B36-F648F7FA4D1D}.exe

                            Filesize

                            168KB

                            MD5

                            c3691b3f31363790909f9672b1d45ee0

                            SHA1

                            0f5dafb21daaa94b9051913e3b025f3337681c15

                            SHA256

                            3f7dd7046e5588c5a94f294866cfa54940f9d670887d203e5c9dd2bfd99cbdbd

                            SHA512

                            0aa4d316ba53006278d1d169a1cac4d587358c87ba4d79cdde584ace05b8935fc4c3f44735c0319bd15c480d5092cf0f9968c26aacf9416d26f5051ac04ee583

                          • C:\Windows\{2BC4B758-9895-4e3c-B86B-0F2E3EB23876}.exe

                            Filesize

                            168KB

                            MD5

                            ad1409a6bfdbfc105467dc53888c624c

                            SHA1

                            ef11c38fd42b66a22062f0363b2538c76b95daf9

                            SHA256

                            40f744f7bc084f001d087eaa19b66450be10ca453f06cecf8db8099f3ce1f2eb

                            SHA512

                            eb7ea3973dfbdb2eb86e886ab2055c2c8ff381ff71b45b2b3e5b0023ce973853ebf9c30d9999bdb2bf0e1362290a6357080d5b58318964c011b6de5f05431926

                          • C:\Windows\{3A320539-B5A9-4745-A0B7-FC128FD663DA}.exe

                            Filesize

                            168KB

                            MD5

                            87ca777dbc4309c9c416d038ff0e3e76

                            SHA1

                            60f312dd68b31567758bd49205b9cba235787799

                            SHA256

                            3a2af05145caf11fd451733b78c3e6bad2a0f11046887836376b57e8a9be79e9

                            SHA512

                            ca6dd02b95819b6fda36dbdbbb501a6d0ac4a70884bf0dbf8337657536df0df647c919b5a02855c022d9402c3f126fdee5ca3704dce0c0d4bf41c5d36c82feb5

                          • C:\Windows\{478D9E42-3030-4248-A2B4-A2717C211022}.exe

                            Filesize

                            168KB

                            MD5

                            c70af90672afbc8cc7448898a0a19484

                            SHA1

                            860b1382e6cf92cb3d103c875b1483ecad8acfe1

                            SHA256

                            dc844dc649f3a09be2632f0e74ce75456afc6cc7c91b64d3081b4d60ad43dd67

                            SHA512

                            a72e8531917059848f807c7bbdf76ab56549b29a8f71fe0aad74727898d9711d46c084faf7cef3008afd7b83bc2906b3fbe3a0bcbad9307321323ef188053530

                          • C:\Windows\{482489AB-931A-4a34-9CA9-EB60454F37A1}.exe

                            Filesize

                            168KB

                            MD5

                            67bec0f3fd9781ef5d9834c2807a68df

                            SHA1

                            ea3dbc4507baf3454de1f1fbd52c0a106c7a87e6

                            SHA256

                            d2528120aa473ad1e7d31cd183940e26071a9439664bf3ea6231b79b004d5a6f

                            SHA512

                            cbfdcd068539aa420816fde5d3f25e685cf0db2e9f269fa90a83667fced3300ff01cc234596a2a31750bae7484b2000e839fb33f1d0a956f01e21728e5d223f8

                          • C:\Windows\{488AF874-0767-4316-8578-CBCDABFBB111}.exe

                            Filesize

                            168KB

                            MD5

                            2f9f5379fdc3bc2f0a16b78240f51e10

                            SHA1

                            5e1d772aa67431f18443659fab4725dff0fc0bb0

                            SHA256

                            163985f31080f4e37cf67c6cb8dfb59439e0226487864f45241e0bc477799d13

                            SHA512

                            5eb3972329c074e556d313b78477a2ae5fdf8035cd4fd221c04c5b242bce1c1d1f7a32c36a85427698efc5b608ec2a3152ff27d99c93876f23195a91648e4161

                          • C:\Windows\{494AB0A6-C19F-437b-A079-76A6150C1DA8}.exe

                            Filesize

                            168KB

                            MD5

                            8d4493a4245e8063299c2d30d198a544

                            SHA1

                            86748c7a141426171008905304262572c9dcb63f

                            SHA256

                            56f90175325b15068a26e3901ab794785e35660071ff17ea41610baf026818fa

                            SHA512

                            280040f479e1ecb6bd6bce2994473724718fab8215dd0e0986e93e9bcc1802c1caa05a2fa9a3c2b89c5eacfd0fc91a48e1f196578e6cffa6be44c1c400c89f73

                          • C:\Windows\{937BB5B4-89DF-4abf-9EDF-1CF8EC8F909D}.exe

                            Filesize

                            168KB

                            MD5

                            b388de96a93cd6de2a855e34b471dd5f

                            SHA1

                            757aa4ad2ebce9bfa6cdf8f6782574705f70d199

                            SHA256

                            56a077511be670bf332b43772457cea82823d06c72fd4df8481d86b076508c3a

                            SHA512

                            1d346492620c9369dc93f65080e6f4737936e62219f00101625e2f511ccf21add7ab72eeec49b48372b9a100afb4cc03e0616e9971ffae6c71caf44ab4af1c65

                          • C:\Windows\{C3EC2730-19D7-4c36-871C-09BC5DB1B395}.exe

                            Filesize

                            168KB

                            MD5

                            88717be2091fc0b1f6e7ca0237c13774

                            SHA1

                            c73248df7ce52b12df193862732ebb6f74e26519

                            SHA256

                            1fe0b8dd740cbd8e5d10fb681049ad7931e59e03ae87b3943cd72772dda59dcc

                            SHA512

                            aff633c81e165d306dccae18ef36f7248284d8538a1d9ff76e9a874748fcb6dcdd682098f30f1405e7dc352ea7e28bbb29b51a18775ac3657e07d5d8f32d13a7

                          • C:\Windows\{CEB39379-322F-419f-AC18-92E94F36C2DD}.exe

                            Filesize

                            168KB

                            MD5

                            702897da432752de5bd8f40765afae73

                            SHA1

                            c696f5b6fb4b2bf315ffb9036b49a177f2262246

                            SHA256

                            417b64f381c62a39d96ece2328f25cfab9baf2271660fbeeb53392daa06f4486

                            SHA512

                            b71422995ccde73697d380573a40fabd25115c848db67f0db41a96a723ca1c9e50014bc2a5ff5a7506d5e7aa40af7f59b7d8a0f03ca36338f887151f06939832