Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 21:41

General

  • Target

    2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe

  • Size

    168KB

  • MD5

    7cef5df66ff7e58f9788b662f6f660c6

  • SHA1

    3be730923e04347c9b10dc89f65d08b4619d4517

  • SHA256

    4428b755338c423f4b0d8e3273b77918208171919fc3cf38b86df7565eb6bfe5

  • SHA512

    49d07f6427139419338d4083e78b6787e7f1b0e2be447b2cbba96630948a039862813ac5afbe759345a2e4fa75ed28c7b500256dca2c8382cff9fda75ec805e9

  • SSDEEP

    1536:1EGh0oflq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oflqOPOe2MUVg3Ve+rX

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-06_7cef5df66ff7e58f9788b662f6f660c6_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
      C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
        C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
          C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2684
          • C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
            C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2472
            • C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
              C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2712
              • C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
                C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2884
                • C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
                  C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1548
                  • C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
                    C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2436
                    • C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe
                      C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1400
                      • C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe
                        C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1668
                        • C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe
                          C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:2020
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{FCF36~1.EXE > nul
                          12⤵
                            PID:296
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{30FFE~1.EXE > nul
                          11⤵
                            PID:1652
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{8CC7B~1.EXE > nul
                          10⤵
                            PID:1172
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{29CE7~1.EXE > nul
                          9⤵
                            PID:2656
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{43718~1.EXE > nul
                          8⤵
                            PID:1648
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{43936~1.EXE > nul
                          7⤵
                            PID:2620
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{2972D~1.EXE > nul
                          6⤵
                            PID:2744
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{0A9E8~1.EXE > nul
                          5⤵
                            PID:3008
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{4FCCD~1.EXE > nul
                          4⤵
                            PID:2800
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{FE376~1.EXE > nul
                          3⤵
                            PID:2696
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                          • Deletes itself
                          PID:2476

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\{0A9E82CD-37C0-4e7e-AFC0-42B4CBB64BA5}.exe

                        Filesize

                        168KB

                        MD5

                        991c39e2ede9ae4d2a60ea652cf04506

                        SHA1

                        af302222f7d1d7f8461cad11e34aeb9fc1c3e6e2

                        SHA256

                        41b1e09ac96959c7be420c2cd32a7437fa243b67abcc260469860903723e280b

                        SHA512

                        245bca01b8b88e25ba8c04490feffe135c316bd8948db867ecc032e9770e7f76afc5ab3f6c815dc06e9366ebb1d1ac11bbb79f55d9ed9e4f5ee3fdfc5231406c

                      • C:\Windows\{2972D8E3-39DA-4b29-BB84-2766F6478DA2}.exe

                        Filesize

                        168KB

                        MD5

                        bdd73b4422d2d6e085d596164c59d751

                        SHA1

                        60f93eb59a89ecd33a7d5ca2fd61c149aaedb15f

                        SHA256

                        a4eebd156f2e941e2162e23d100c02ed23acfef8ebc33367453853f5894d81e3

                        SHA512

                        4b2ae8bde0d151f58f1fedb18d1ef891a3832cb72b15b2a260e310c105f6ed0f68e337edf9a8d19201565c71d04b060f18a40b06df88fc480805e7ca9c9be6ea

                      • C:\Windows\{29CE7A06-2207-4147-9AE1-5E026110F827}.exe

                        Filesize

                        168KB

                        MD5

                        b2d0b3374cd44fe2bcc9b79eedfe6605

                        SHA1

                        5f06a620d3d2a7edf9036a72723d19e1c44942fc

                        SHA256

                        1b9082e216cbac73b77e76d189c2393b0b5810837d9a27f86a44b88c04849069

                        SHA512

                        beb50df4339ccafc1080152fb6013bb8b2cbeac100449cea5afc3a880e36cb326cf629b1245d69d7082d88ddc8eb4e899c279ffec73bec56b6d7a5c748eb08cf

                      • C:\Windows\{30FFEBBD-2DA6-4dec-87A5-C3BA8969E1F7}.exe

                        Filesize

                        168KB

                        MD5

                        b84c53f83f74de9dbdc2712c54831525

                        SHA1

                        a9c45f6a2d3bc2fae451b7471c8f125d87f330a4

                        SHA256

                        0ec07c6a0098c56ae533bf026e8f0841672d0ef1ed5c3418c598f51315719c56

                        SHA512

                        4495639d68ec1380fbca8cbfdcdc0477f6f8e6d21145ab7300a70927eef0939b8549a1900fdbacd3ed65f881a8cbe6936fd138b7da8c8d43e6903c125fb80f3f

                      • C:\Windows\{43718F63-390C-4991-A7B2-8069AB9C063E}.exe

                        Filesize

                        168KB

                        MD5

                        3a471ee6a3714b30805891c8ea0dc458

                        SHA1

                        f3f0ab50f99049a8c6cc1a51c18017cd570eb6f6

                        SHA256

                        dca091b8bc2ae4c2a5bcf306348bbfdb81073ef8da2f082efdb3c071f2d91055

                        SHA512

                        f5b2a2633ec52f0521bc30a5ea6fa0dcd43817926e06fe7748571d0c822133b3322f5bb0521bb6a0141db42fe3c06c365a78f4c46fa3c983ed33dfd42abda080

                      • C:\Windows\{43936A58-A620-4de2-8776-D2F71A729056}.exe

                        Filesize

                        168KB

                        MD5

                        f13f8974e550a514d8e0a11538741e3f

                        SHA1

                        c4955f91a3e6d338028c502f2c0d0a6706519316

                        SHA256

                        976a82d56d8cd021248b436e36dfd8d1490268b73e2ba3223315a35a06847091

                        SHA512

                        2d85158ac7c32bd15478a9a49c9bc492384c2c7b0267b914c7d0fcadddb509810126d5dca7489473fe03a409193cea9778fcbb4c619bc1dae0f9cee32b2c7302

                      • C:\Windows\{4FCCDBEC-BBF7-4945-96B7-EA4D3B40776A}.exe

                        Filesize

                        168KB

                        MD5

                        9b6fb2aa39f4b74d0342cbffc8d925fe

                        SHA1

                        3569d9b6dcb4474dd16dbaea63b6fa6d6e973082

                        SHA256

                        810019b2ca25e1f4a315502182ec3581dbd7400f099a69f97e793c0efbe25072

                        SHA512

                        1fb01a90872c9a06d75fae1eab97bdedc40484b39b411a7b91230835e641cda0c90f74dde8de544b255824420b8bcaf8b7532c4f6e2db9c0d1a62a11681a77ab

                      • C:\Windows\{8CC7B88A-035D-40ad-960E-28ECEC034048}.exe

                        Filesize

                        168KB

                        MD5

                        5095cbfa261a0c20d25f94735a0b3ce2

                        SHA1

                        ec52e21704b3088c982ffdfe377c6c4218298aef

                        SHA256

                        fa78f6710e3ea4adce82ac21ed17f483466b391fb3bbf233e4ef3c63741e3892

                        SHA512

                        9d7cacb320cc67de01708063287875a913e25f28293b2a837ff873c3a67a3418bb53dd1733ea66f08ad98221b9cdd977a0ba47ca01735d6a22f3d7c28b8fead9

                      • C:\Windows\{C5C06666-CEF8-4db9-9A41-AFF93C1EBBED}.exe

                        Filesize

                        168KB

                        MD5

                        1ece3c80fdb05c0da196cbc435f25419

                        SHA1

                        a6a39585fcbbd491aa34b49883785c69ce3660d7

                        SHA256

                        a47f22d708917cb0ce0d6379e95b2c35ebfdd93db9f6cda271481f662dad46a1

                        SHA512

                        e67b0aa3c9b238126a3a6fc141f0281bdb28cf3d25b98462b54a5cee697af7aa21e02979c2780fb180bce7dd4f7239e6af9fe873c8bd2bdd6aba3d87e5ad4532

                      • C:\Windows\{FCF369AD-7648-47b2-9702-E2992FAC89C1}.exe

                        Filesize

                        168KB

                        MD5

                        568614f9a0189101cc695146ea085523

                        SHA1

                        64eeb19b44711d6a87b26c30fc57fabcbaa062b1

                        SHA256

                        65068179e3212802565666dec0cc193b2edccff1902e2b11a17fd0ce5e8c7b69

                        SHA512

                        5b5c78cc341ba58e1e5baa91999c8c3e249bec101e6a2387e57f84b1cc99a4452e5d8b959fbb64f2785870b1c9452c84fa4da04f47a2ec75e4eca5a08a677f96

                      • C:\Windows\{FE3766D7-BD84-425f-A273-861EF3A863B4}.exe

                        Filesize

                        168KB

                        MD5

                        0d4ffd22cf722d08267fe7be755ab611

                        SHA1

                        2cdce78c0a19631e3b1bdc6b9b30810fe677fcac

                        SHA256

                        1bd669eefdd330dcabaa6d00b9339c391ce67975c1a3910d48d97483e32c6be7

                        SHA512

                        2a0cb21d5c769487d43ac6b778e215c88ea45d00d2323405f98da934e110743f5086a58facf594e39e8d0fe4722052c8704d79c9258eac58353ab66844bb2015