Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 00:51 UTC

General

  • Target

    2024-04-05_a4c266cc954c77f25d03766ddc0020d6_goldeneye.exe

  • Size

    197KB

  • MD5

    a4c266cc954c77f25d03766ddc0020d6

  • SHA1

    d2747f60cd9717c6cd5bc96a5979e7d8ecde906c

  • SHA256

    6238eb1fa499270e786624d44452013e6f8f1e0f797751926b2abb441a1cbed8

  • SHA512

    22ee60ba5519a0a88139b379e2ad0ef10e35d2572c7f0b4734e5bf1360d4cca132ecaf7cc15448eead6360749a422bf81f5a3324c21d0962a30c40ab496cf6ae

  • SSDEEP

    3072:jEGh0o5l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGblEeKcAEca

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-05_a4c266cc954c77f25d03766ddc0020d6_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-05_a4c266cc954c77f25d03766ddc0020d6_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\{FE835FF3-BA85-4c92-9061-48E503C4A983}.exe
      C:\Windows\{FE835FF3-BA85-4c92-9061-48E503C4A983}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\{BD56EC4A-19E3-45dd-84CB-B63878481F6C}.exe
        C:\Windows\{BD56EC4A-19E3-45dd-84CB-B63878481F6C}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\{75B0544A-7A3F-43f8-ABA3-A9FDEDC56E10}.exe
          C:\Windows\{75B0544A-7A3F-43f8-ABA3-A9FDEDC56E10}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\{9513CDCF-7394-423c-9855-3187B5979DAA}.exe
            C:\Windows\{9513CDCF-7394-423c-9855-3187B5979DAA}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3028
            • C:\Windows\{DC936013-AEAA-4505-8A62-2F47178BF7CC}.exe
              C:\Windows\{DC936013-AEAA-4505-8A62-2F47178BF7CC}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2888
              • C:\Windows\{43B80431-39B8-4d5b-80FF-3B1FBC0EC50C}.exe
                C:\Windows\{43B80431-39B8-4d5b-80FF-3B1FBC0EC50C}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2536
                • C:\Windows\{650DE937-61CA-4eb8-B39E-228C4058739F}.exe
                  C:\Windows\{650DE937-61CA-4eb8-B39E-228C4058739F}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3036
                  • C:\Windows\{C986009E-DB8F-4f44-9F98-43FDEF986D1A}.exe
                    C:\Windows\{C986009E-DB8F-4f44-9F98-43FDEF986D1A}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1792
                    • C:\Windows\{35101E36-CDA6-4fa3-9B56-15407C21E2B9}.exe
                      C:\Windows\{35101E36-CDA6-4fa3-9B56-15407C21E2B9}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2708
                      • C:\Windows\{814D38E5-2104-4357-A455-07B293561906}.exe
                        C:\Windows\{814D38E5-2104-4357-A455-07B293561906}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:692
                        • C:\Windows\{CD1421C0-DD0E-479f-BEBE-102E3FC94582}.exe
                          C:\Windows\{CD1421C0-DD0E-479f-BEBE-102E3FC94582}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:2952
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{814D3~1.EXE > nul
                          12⤵
                            PID:1336
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{35101~1.EXE > nul
                          11⤵
                            PID:1128
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{C9860~1.EXE > nul
                          10⤵
                            PID:2384
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{650DE~1.EXE > nul
                          9⤵
                            PID:2200
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{43B80~1.EXE > nul
                          8⤵
                            PID:2896
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{DC936~1.EXE > nul
                          7⤵
                            PID:2556
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{9513C~1.EXE > nul
                          6⤵
                            PID:1956
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{75B05~1.EXE > nul
                          5⤵
                            PID:2064
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{BD56E~1.EXE > nul
                          4⤵
                            PID:2868
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{FE835~1.EXE > nul
                          3⤵
                            PID:2624
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                          • Deletes itself
                          PID:2020

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\{35101E36-CDA6-4fa3-9B56-15407C21E2B9}.exe

                        Filesize

                        197KB

                        MD5

                        c3920bb62f491ac2850d8d566e32dea4

                        SHA1

                        335575a8013b167fd52e409568fbf6292fd5c025

                        SHA256

                        22c08805131f37089af91576ead325dae5fa9210cd98c45e9f61bc1f5b2d8422

                        SHA512

                        35636c0e4e44f37450cf663a0ca44aee7f34c9fbbe89988f516c59689e70ac1fb8621fc9129b0f35a5cfe02f79370ee46c694cde413c90b495aee0c899f58b55

                      • C:\Windows\{43B80431-39B8-4d5b-80FF-3B1FBC0EC50C}.exe

                        Filesize

                        197KB

                        MD5

                        8d7ce7b767ebad7f12a6faa197694beb

                        SHA1

                        487b9a21064c22e4e2eafe90f4ab05dcf60d90e8

                        SHA256

                        958870b840bf3f21ce381db9a2e8694c2d6a6254f4400ad3c0a5ca0e8e2673d8

                        SHA512

                        3a19a7a61b82d7de0f879159a38cd7337cef73d06808ed3eeba1c681a7c464734a68687786ef21653a3b23ca85944e041b4f560d4dde588b7c21bb175bf64c29

                      • C:\Windows\{650DE937-61CA-4eb8-B39E-228C4058739F}.exe

                        Filesize

                        197KB

                        MD5

                        3d8f12b2cdc31b076384d9e726822e2d

                        SHA1

                        57436aa059b80d74fdf32547acd122c514cfb969

                        SHA256

                        660650546b71f60af339d2eff9d9b914606a0effc19be8ae7b47e8d00ccee095

                        SHA512

                        3cae787629913891d05e242513f0c12b6978aa1baba412418532445a7b20f89015c4080b42f7be08f5904099deadd909ddcf292b0203d1582d3a500f9faf86bf

                      • C:\Windows\{75B0544A-7A3F-43f8-ABA3-A9FDEDC56E10}.exe

                        Filesize

                        197KB

                        MD5

                        5bb54a8f4e128fe4186c9120cf0bf61d

                        SHA1

                        6cd4b12df2afc70e712fddbf2de78a22d2da9192

                        SHA256

                        6e35f3d1d944e4cc124f90babfdf813c9d9488ed2d2440ad6d9d2d2b0fe52bdc

                        SHA512

                        e78a1e70dd863060c9382e03d5d1a8710c00804e3d07406d64a7f2350284956994cbf8d3972c0394da985c95bed51531d179a98e6d21d32088defd220f1ef15f

                      • C:\Windows\{814D38E5-2104-4357-A455-07B293561906}.exe

                        Filesize

                        197KB

                        MD5

                        1a90e76e146121f2f45e854ba21634f5

                        SHA1

                        667a5c7a8db37689be01b3c5170ddd7327d16d2f

                        SHA256

                        e739c72a2bc4e79d28de088e30fd14c96df155b5d648fff20841a02be2ff9e25

                        SHA512

                        97c45cd6354246d2dc46d717c814eaa8b14eb794b4795698f3f4bfbf28ba1977c903cad1176d587d0a36d5dbb0edfdfd179892202c76b1b5eda55d59d6df20c3

                      • C:\Windows\{9513CDCF-7394-423c-9855-3187B5979DAA}.exe

                        Filesize

                        197KB

                        MD5

                        11821ab1e3b690bc2baa6cca0879b869

                        SHA1

                        126b1e7979320e3162cdd55302d5003c53ce10d1

                        SHA256

                        4f3c6f6da1c4f880a3e63db066d1256a8685be65e7e95008b4fd32e33c746c05

                        SHA512

                        c0a4b5827799b0e3ba7f5625381624838fc036cee4d57f139e60fd0c91483497d2bfc7eb217f427d8fceded0d64441608cfd77b855e3a373f24611f8a5ca756a

                      • C:\Windows\{BD56EC4A-19E3-45dd-84CB-B63878481F6C}.exe

                        Filesize

                        197KB

                        MD5

                        3c04bdee129ec35b7928737011dcfdb8

                        SHA1

                        f96e0e500722addd47192b366dc33c53e6732794

                        SHA256

                        aab7ace51ef819d4b986c0cdc85fe2b35c60a21aca8d5e4148000e0c3d7da4cf

                        SHA512

                        350dc99b3c889ef6b83e27f948377f3b107ae26c5d23d93eb619a64748e97eb7684445af301eb6e66d02e8ae8db20420344dd961875c49a9f30d6616dd7dfd83

                      • C:\Windows\{C986009E-DB8F-4f44-9F98-43FDEF986D1A}.exe

                        Filesize

                        197KB

                        MD5

                        a425aba5f120a2d4ad3381b7189c800c

                        SHA1

                        8f0de136fa707e0facabb2053afb27a778c37d1a

                        SHA256

                        a024b0f6d67bf398b64401a013ab987ff889cb16c80c385114d42def49aed9c5

                        SHA512

                        dbbbccb418061780e9639654c777f8aeb8e6fb0fea4cfb4f515cae34b7ddf1178ea408f5616db10e9d0706c4646e07dfad8cc89a671b69d6a3916bab8a96a5f1

                      • C:\Windows\{CD1421C0-DD0E-479f-BEBE-102E3FC94582}.exe

                        Filesize

                        197KB

                        MD5

                        0a36642da02fa70d9bc82958bcfc24a0

                        SHA1

                        31db3b3155fbf79620bd1afea0b83868ca8e8ed3

                        SHA256

                        37c40b20576ee9226cd2f67e2b3b0354ba362ab125c3a96e0410b00801f03245

                        SHA512

                        5ee1dabb63c2872035b27bd1f9fd26851d59411e12b74acf2ae862bf9bbf2af5961ce7224db6e0af65b063a52840b1e9ec9f46f372727d944f13042cd4143444

                      • C:\Windows\{DC936013-AEAA-4505-8A62-2F47178BF7CC}.exe

                        Filesize

                        197KB

                        MD5

                        927d63ee834d7e321b77ae2a341a73d0

                        SHA1

                        a51f423b708823a283b708bd1706567bb6287f4f

                        SHA256

                        728a5d67bfe3e668e36431283aa272acefe2dd1636990f7885f91cd0cb919fc3

                        SHA512

                        eb9e4472715abdfe20dbc564727f8b61168dadcfe46af30e9f75993d19a62854976388f3004c0a2e75c785ba89ce19597c17e2308b820e89109d00d3dd9d813c

                      • C:\Windows\{FE835FF3-BA85-4c92-9061-48E503C4A983}.exe

                        Filesize

                        197KB

                        MD5

                        4c1897dd2d4bd362cfb679327935bc57

                        SHA1

                        183a4dbf865bf2173864ac9cdceab583bb760c1e

                        SHA256

                        35b456204f4a906a9640554a2ce674f699f2645649cb8570fac071023f4092d2

                        SHA512

                        fd38678f7666b76138ebedc291861d6de1e86ec1309776222ce1899a372dd0edb94ab8b77f1d0dc84bfdd22a99ce9b124c142e04fc698123103059af47c4aae7

                      We care about your privacy.

                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.