Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 21:38

General

  • Target

    2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe

  • Size

    204KB

  • MD5

    6030608dbda6f24061302a8b96132583

  • SHA1

    cd1e19ddf03775d138f6fc00ba20572f68d2690d

  • SHA256

    3c8f713770473a68fa2f70b65f1c2298547b78ca26462e0d7db89518b8fbe950

  • SHA512

    bda887b542d4825d6583addc4fcefa68ea03e67e2d093ee85d5bc9c6291899add0486f616458619a55b1eec9b2ff5debad8e3f4202aa29ae324c1bf63f1cdcbe

  • SSDEEP

    1536:1EGh0oGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oGl1OPOe2MUVg3Ve+rXfMUy

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-06_6030608dbda6f24061302a8b96132583_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Windows\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe
      C:\Windows\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\{89E72E84-049C-44e8-A114-B65F8736614D}.exe
        C:\Windows\{89E72E84-049C-44e8-A114-B65F8736614D}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe
          C:\Windows\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4548
          • C:\Windows\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe
            C:\Windows\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3092
            • C:\Windows\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe
              C:\Windows\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:720
              • C:\Windows\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe
                C:\Windows\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5004
                • C:\Windows\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exe
                  C:\Windows\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4420
                  • C:\Windows\{4596DCFF-B727-41d9-8C06-38B209A66420}.exe
                    C:\Windows\{4596DCFF-B727-41d9-8C06-38B209A66420}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4964
                    • C:\Windows\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exe
                      C:\Windows\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1660
                      • C:\Windows\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe
                        C:\Windows\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1624
                        • C:\Windows\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe
                          C:\Windows\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1404
                          • C:\Windows\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe
                            C:\Windows\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:2288
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{082CC~1.EXE > nul
                            13⤵
                              PID:4628
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{8A416~1.EXE > nul
                            12⤵
                              PID:3896
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{CB26D~1.EXE > nul
                            11⤵
                              PID:2688
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{4596D~1.EXE > nul
                            10⤵
                              PID:4432
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{10813~1.EXE > nul
                            9⤵
                              PID:1356
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{8A045~1.EXE > nul
                            8⤵
                              PID:3112
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{9A975~1.EXE > nul
                            7⤵
                              PID:4328
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{C18F7~1.EXE > nul
                            6⤵
                              PID:1332
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{DD620~1.EXE > nul
                            5⤵
                              PID:2840
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{89E72~1.EXE > nul
                            4⤵
                              PID:4196
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{F41E8~1.EXE > nul
                            3⤵
                              PID:2776
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:3068

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{082CC7B7-F50D-4c02-9ADD-3FC61038A49A}.exe

                            Filesize

                            204KB

                            MD5

                            2f55271c1f7fa228f2e407fae7431fea

                            SHA1

                            373a078cee52df2dcf0a6501deb2b994a4ec856c

                            SHA256

                            4746a30301d6521a6a93536d41db4c19576d3c871528f987bb086720fcabdefa

                            SHA512

                            f1cd427c73d2500cf051068bdc23d48ad10bac0487d617bacaca37357aa990070b9e3f268e49829f84b54255922626b479ef22d556a97f67ce6e9e67a5a641f5

                          • C:\Windows\{108134B4-B6AF-4668-8F16-CAED54D980FB}.exe

                            Filesize

                            204KB

                            MD5

                            98b22da199f32b1242533c603d23480a

                            SHA1

                            4d5636cb728dafb9fa8843984a79dcd882dc36e8

                            SHA256

                            cf0cb716ebc31f66d6311aab6e06d5e4bc8faed8edb7653593f27cc53c1b3491

                            SHA512

                            f669a6a48897118d022cc3f8833ecf7e8bf74c3ce612188c06daa9ed2c937c041fae2abc7295cc0dd2850e51c179ab660504b11b2fd5b6f580ebe8622e60b217

                          • C:\Windows\{4596DCFF-B727-41d9-8C06-38B209A66420}.exe

                            Filesize

                            204KB

                            MD5

                            de223f4d099942c112d3a2218d995ba5

                            SHA1

                            25aedd8015623450d0cb0198d6f69dee39af4962

                            SHA256

                            d4b19bebf9df83612ac5a34e2589c5f1fefc73bf5f0524f003d4cdeaf552d3e6

                            SHA512

                            a65ffc56ca4dfd98bf0473e7416b6b65cbd38e393a1866f7f3628db718cd160e4b8fb1645284e189cb1e11cbf865b7fd275b515976e2c4e20cb3f842359dda28

                          • C:\Windows\{6499CC57-06F0-48d9-B4ED-A8C2B311B531}.exe

                            Filesize

                            204KB

                            MD5

                            7631ce79fd0f38d9532aaa38f8b8b487

                            SHA1

                            3db3d7acfc243e196a7961fed61a0424b6e7198c

                            SHA256

                            89594b34419287d6f4e38c4913026a9741842d9776c07d3edbee9181266779b1

                            SHA512

                            7a3244276878e6bc39922cd1dfd1bc410707aadfed56442e83ea9dd25804d956690b31e5391cc5fd1f65c5fea614f219429a6e95d5fd3c5cedaf85bf71fe535d

                          • C:\Windows\{89E72E84-049C-44e8-A114-B65F8736614D}.exe

                            Filesize

                            204KB

                            MD5

                            886bbffa5313033a4177396260837d0c

                            SHA1

                            23e5c987c4b01c5bdb7aa9fef8df34a738f5bb6a

                            SHA256

                            1a06d9971881570242f1740d03249e3f0400494554d87a7966e82b42fce63578

                            SHA512

                            95bdc57eb5a4e45ed50195a19d2794bbb22618b99146a163b75aae6017757e834f1fda73ffd6bcd79009c36471172c946985169d16910bc94bca6079b5749bc1

                          • C:\Windows\{8A045D2E-FFEB-4ee5-809B-12A0B2483B5F}.exe

                            Filesize

                            204KB

                            MD5

                            c64dcffa33ebb2b6ec9179a3a31ee84e

                            SHA1

                            61d17e94a2f8dbadce8a7d6c2fb03b27ff5b8eb3

                            SHA256

                            358ca50c302361c1390d0511834c3f6b8686084f5c3256d48c17ee5c27ae2af5

                            SHA512

                            add92f5c99a729c6bf0e8b4f60247fa06886fe9b4aacec749603ebe974e57cfc8bdd092aded76dc3fc747ca470eb3c61ef073526d16a7f2cf6c028bc004aecb8

                          • C:\Windows\{8A416E20-9B36-4346-9E43-D3823FDBADEF}.exe

                            Filesize

                            204KB

                            MD5

                            242bce61c35ed833f5f25b0d62929b4f

                            SHA1

                            2b967228b72e4e647d476263fdbd5d7cf7429e82

                            SHA256

                            4566f674bbf504569e983859d4bee1d54abf3083c3ba9221819daa248c7a51db

                            SHA512

                            76a47e605d7f12fb88f7cc6bc7c26f7487cdea6cfe35e2913d3e45b78540df789f533c60ee5be998e1d6931c4e3af3dde0ccfffe4fbff25a413790b3e369e4cf

                          • C:\Windows\{9A975883-4A2A-4c58-AEB1-C4D279630A26}.exe

                            Filesize

                            204KB

                            MD5

                            ee14e0fa5db5b055e9cde495316644e0

                            SHA1

                            881e32d948202edbceb623741da70b8a2a0509cb

                            SHA256

                            45d1d81dbfd13d82b1f677fa90f105b52b668d3ea4c4dd14d0a65b9cb820b90e

                            SHA512

                            c35fe92546bec22b48f3fc832a8a7d01e551b71693be675cd530d2a6351d61ef2fdb15a06efd83efa44fd732389606a73c6f1cade40fdcda18da8222b099d4b5

                          • C:\Windows\{C18F7DBC-3272-4fee-A2AC-9CCC2E4829C2}.exe

                            Filesize

                            204KB

                            MD5

                            1bae2fc1c8da90401a0f6620f58acd47

                            SHA1

                            32815dd1e885ad7a0b4716598460be6650757eb7

                            SHA256

                            91a9ca8a3ade3d6b8d26e10f962fa1b07680064841f4c116479db81b7d7530f1

                            SHA512

                            f73ab1292e2deb0975ed5b71a473aef900a4d5961eaaa82a35cea22d9a3d1a9bcbc2bc5de982205e18fb817be6e5ec381b56c03bf6ad2cd2c941abd175ee03fc

                          • C:\Windows\{CB26D8AA-4CA9-4653-B66E-65145673825A}.exe

                            Filesize

                            204KB

                            MD5

                            537b9e76bcd13b39721537decba86e0e

                            SHA1

                            1a8c74c548e1046a463b26af9f69851cc47e372b

                            SHA256

                            66d32fe1aac97e377ae0af7c5e23fdd60645896d07f3ff75d9c3a88d5bb99308

                            SHA512

                            bf2b024dd66685bf729980d2a8f82e883845c92d744a27f574c24c9ab8ea477f223aff3283ba664818f925e35a127725913cc7cab44be11317bf71972538f63f

                          • C:\Windows\{DD620C2A-9F46-4605-8F8C-FE9952BB8272}.exe

                            Filesize

                            204KB

                            MD5

                            4c49fa65433da4f6b772058f0e6be866

                            SHA1

                            ecd01ad428ca4431ab2ec87bca5dd33296b74a9a

                            SHA256

                            640c49575250a404eeec21f3671a0eab4b8ed92c7f21e092e2fcb522d4261062

                            SHA512

                            9b79bd0c4f00476f30cd73fc9d44c25187140fba06b39caad097255ce60c161ddfcb6de40f1b446e41a94ab7a021727cdfffc4877764917a81881779ac221b3c

                          • C:\Windows\{F41E8FEE-6043-4bc4-9B6F-3F012F3E1EC4}.exe

                            Filesize

                            204KB

                            MD5

                            e21404cd1c8330379b22f9d13c6bb04d

                            SHA1

                            43777f6486305c5fdf6c2ef39c4d0df1aabef2b9

                            SHA256

                            f1b6c0e1bca8d2b9918c7bf32795e8775635f8de57c0189b6ba2a3271865b5a0

                            SHA512

                            dc81a4d2f071cfb4ddb0aaa39d031151cb16809415ababec95157fdbc1588156bda8d6d1655d7b980176b7e0d282962cd97c2ac4aba51fe1b6c722b3197a3401