Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 00:51

General

  • Target

    2024-04-05_a4c266cc954c77f25d03766ddc0020d6_goldeneye.exe

  • Size

    197KB

  • MD5

    a4c266cc954c77f25d03766ddc0020d6

  • SHA1

    d2747f60cd9717c6cd5bc96a5979e7d8ecde906c

  • SHA256

    6238eb1fa499270e786624d44452013e6f8f1e0f797751926b2abb441a1cbed8

  • SHA512

    22ee60ba5519a0a88139b379e2ad0ef10e35d2572c7f0b4734e5bf1360d4cca132ecaf7cc15448eead6360749a422bf81f5a3324c21d0962a30c40ab496cf6ae

  • SSDEEP

    3072:jEGh0o5l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGblEeKcAEca

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-05_a4c266cc954c77f25d03766ddc0020d6_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-05_a4c266cc954c77f25d03766ddc0020d6_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\{FE835FF3-BA85-4c92-9061-48E503C4A983}.exe
      C:\Windows\{FE835FF3-BA85-4c92-9061-48E503C4A983}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\{BD56EC4A-19E3-45dd-84CB-B63878481F6C}.exe
        C:\Windows\{BD56EC4A-19E3-45dd-84CB-B63878481F6C}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\{75B0544A-7A3F-43f8-ABA3-A9FDEDC56E10}.exe
          C:\Windows\{75B0544A-7A3F-43f8-ABA3-A9FDEDC56E10}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\{9513CDCF-7394-423c-9855-3187B5979DAA}.exe
            C:\Windows\{9513CDCF-7394-423c-9855-3187B5979DAA}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3028
            • C:\Windows\{DC936013-AEAA-4505-8A62-2F47178BF7CC}.exe
              C:\Windows\{DC936013-AEAA-4505-8A62-2F47178BF7CC}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2888
              • C:\Windows\{43B80431-39B8-4d5b-80FF-3B1FBC0EC50C}.exe
                C:\Windows\{43B80431-39B8-4d5b-80FF-3B1FBC0EC50C}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2536
                • C:\Windows\{650DE937-61CA-4eb8-B39E-228C4058739F}.exe
                  C:\Windows\{650DE937-61CA-4eb8-B39E-228C4058739F}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3036
                  • C:\Windows\{C986009E-DB8F-4f44-9F98-43FDEF986D1A}.exe
                    C:\Windows\{C986009E-DB8F-4f44-9F98-43FDEF986D1A}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1792
                    • C:\Windows\{35101E36-CDA6-4fa3-9B56-15407C21E2B9}.exe
                      C:\Windows\{35101E36-CDA6-4fa3-9B56-15407C21E2B9}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2708
                      • C:\Windows\{814D38E5-2104-4357-A455-07B293561906}.exe
                        C:\Windows\{814D38E5-2104-4357-A455-07B293561906}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:692
                        • C:\Windows\{CD1421C0-DD0E-479f-BEBE-102E3FC94582}.exe
                          C:\Windows\{CD1421C0-DD0E-479f-BEBE-102E3FC94582}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:2952
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{814D3~1.EXE > nul
                          12⤵
                            PID:1336
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{35101~1.EXE > nul
                          11⤵
                            PID:1128
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{C9860~1.EXE > nul
                          10⤵
                            PID:2384
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{650DE~1.EXE > nul
                          9⤵
                            PID:2200
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{43B80~1.EXE > nul
                          8⤵
                            PID:2896
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{DC936~1.EXE > nul
                          7⤵
                            PID:2556
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{9513C~1.EXE > nul
                          6⤵
                            PID:1956
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{75B05~1.EXE > nul
                          5⤵
                            PID:2064
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{BD56E~1.EXE > nul
                          4⤵
                            PID:2868
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{FE835~1.EXE > nul
                          3⤵
                            PID:2624
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                          • Deletes itself
                          PID:2020

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\{35101E36-CDA6-4fa3-9B56-15407C21E2B9}.exe

                        Filesize

                        197KB

                        MD5

                        c3920bb62f491ac2850d8d566e32dea4

                        SHA1

                        335575a8013b167fd52e409568fbf6292fd5c025

                        SHA256

                        22c08805131f37089af91576ead325dae5fa9210cd98c45e9f61bc1f5b2d8422

                        SHA512

                        35636c0e4e44f37450cf663a0ca44aee7f34c9fbbe89988f516c59689e70ac1fb8621fc9129b0f35a5cfe02f79370ee46c694cde413c90b495aee0c899f58b55

                      • C:\Windows\{43B80431-39B8-4d5b-80FF-3B1FBC0EC50C}.exe

                        Filesize

                        197KB

                        MD5

                        8d7ce7b767ebad7f12a6faa197694beb

                        SHA1

                        487b9a21064c22e4e2eafe90f4ab05dcf60d90e8

                        SHA256

                        958870b840bf3f21ce381db9a2e8694c2d6a6254f4400ad3c0a5ca0e8e2673d8

                        SHA512

                        3a19a7a61b82d7de0f879159a38cd7337cef73d06808ed3eeba1c681a7c464734a68687786ef21653a3b23ca85944e041b4f560d4dde588b7c21bb175bf64c29

                      • C:\Windows\{650DE937-61CA-4eb8-B39E-228C4058739F}.exe

                        Filesize

                        197KB

                        MD5

                        3d8f12b2cdc31b076384d9e726822e2d

                        SHA1

                        57436aa059b80d74fdf32547acd122c514cfb969

                        SHA256

                        660650546b71f60af339d2eff9d9b914606a0effc19be8ae7b47e8d00ccee095

                        SHA512

                        3cae787629913891d05e242513f0c12b6978aa1baba412418532445a7b20f89015c4080b42f7be08f5904099deadd909ddcf292b0203d1582d3a500f9faf86bf

                      • C:\Windows\{75B0544A-7A3F-43f8-ABA3-A9FDEDC56E10}.exe

                        Filesize

                        197KB

                        MD5

                        5bb54a8f4e128fe4186c9120cf0bf61d

                        SHA1

                        6cd4b12df2afc70e712fddbf2de78a22d2da9192

                        SHA256

                        6e35f3d1d944e4cc124f90babfdf813c9d9488ed2d2440ad6d9d2d2b0fe52bdc

                        SHA512

                        e78a1e70dd863060c9382e03d5d1a8710c00804e3d07406d64a7f2350284956994cbf8d3972c0394da985c95bed51531d179a98e6d21d32088defd220f1ef15f

                      • C:\Windows\{814D38E5-2104-4357-A455-07B293561906}.exe

                        Filesize

                        197KB

                        MD5

                        1a90e76e146121f2f45e854ba21634f5

                        SHA1

                        667a5c7a8db37689be01b3c5170ddd7327d16d2f

                        SHA256

                        e739c72a2bc4e79d28de088e30fd14c96df155b5d648fff20841a02be2ff9e25

                        SHA512

                        97c45cd6354246d2dc46d717c814eaa8b14eb794b4795698f3f4bfbf28ba1977c903cad1176d587d0a36d5dbb0edfdfd179892202c76b1b5eda55d59d6df20c3

                      • C:\Windows\{9513CDCF-7394-423c-9855-3187B5979DAA}.exe

                        Filesize

                        197KB

                        MD5

                        11821ab1e3b690bc2baa6cca0879b869

                        SHA1

                        126b1e7979320e3162cdd55302d5003c53ce10d1

                        SHA256

                        4f3c6f6da1c4f880a3e63db066d1256a8685be65e7e95008b4fd32e33c746c05

                        SHA512

                        c0a4b5827799b0e3ba7f5625381624838fc036cee4d57f139e60fd0c91483497d2bfc7eb217f427d8fceded0d64441608cfd77b855e3a373f24611f8a5ca756a

                      • C:\Windows\{BD56EC4A-19E3-45dd-84CB-B63878481F6C}.exe

                        Filesize

                        197KB

                        MD5

                        3c04bdee129ec35b7928737011dcfdb8

                        SHA1

                        f96e0e500722addd47192b366dc33c53e6732794

                        SHA256

                        aab7ace51ef819d4b986c0cdc85fe2b35c60a21aca8d5e4148000e0c3d7da4cf

                        SHA512

                        350dc99b3c889ef6b83e27f948377f3b107ae26c5d23d93eb619a64748e97eb7684445af301eb6e66d02e8ae8db20420344dd961875c49a9f30d6616dd7dfd83

                      • C:\Windows\{C986009E-DB8F-4f44-9F98-43FDEF986D1A}.exe

                        Filesize

                        197KB

                        MD5

                        a425aba5f120a2d4ad3381b7189c800c

                        SHA1

                        8f0de136fa707e0facabb2053afb27a778c37d1a

                        SHA256

                        a024b0f6d67bf398b64401a013ab987ff889cb16c80c385114d42def49aed9c5

                        SHA512

                        dbbbccb418061780e9639654c777f8aeb8e6fb0fea4cfb4f515cae34b7ddf1178ea408f5616db10e9d0706c4646e07dfad8cc89a671b69d6a3916bab8a96a5f1

                      • C:\Windows\{CD1421C0-DD0E-479f-BEBE-102E3FC94582}.exe

                        Filesize

                        197KB

                        MD5

                        0a36642da02fa70d9bc82958bcfc24a0

                        SHA1

                        31db3b3155fbf79620bd1afea0b83868ca8e8ed3

                        SHA256

                        37c40b20576ee9226cd2f67e2b3b0354ba362ab125c3a96e0410b00801f03245

                        SHA512

                        5ee1dabb63c2872035b27bd1f9fd26851d59411e12b74acf2ae862bf9bbf2af5961ce7224db6e0af65b063a52840b1e9ec9f46f372727d944f13042cd4143444

                      • C:\Windows\{DC936013-AEAA-4505-8A62-2F47178BF7CC}.exe

                        Filesize

                        197KB

                        MD5

                        927d63ee834d7e321b77ae2a341a73d0

                        SHA1

                        a51f423b708823a283b708bd1706567bb6287f4f

                        SHA256

                        728a5d67bfe3e668e36431283aa272acefe2dd1636990f7885f91cd0cb919fc3

                        SHA512

                        eb9e4472715abdfe20dbc564727f8b61168dadcfe46af30e9f75993d19a62854976388f3004c0a2e75c785ba89ce19597c17e2308b820e89109d00d3dd9d813c

                      • C:\Windows\{FE835FF3-BA85-4c92-9061-48E503C4A983}.exe

                        Filesize

                        197KB

                        MD5

                        4c1897dd2d4bd362cfb679327935bc57

                        SHA1

                        183a4dbf865bf2173864ac9cdceab583bb760c1e

                        SHA256

                        35b456204f4a906a9640554a2ce674f699f2645649cb8570fac071023f4092d2

                        SHA512

                        fd38678f7666b76138ebedc291861d6de1e86ec1309776222ce1899a372dd0edb94ab8b77f1d0dc84bfdd22a99ce9b124c142e04fc698123103059af47c4aae7