Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08/04/2024, 11:03

General

  • Target

    2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe

  • Size

    197KB

  • MD5

    cd15fa97891c8af713617ca8c67ba747

  • SHA1

    5f0f18c020b63dc0282197bea8300e42300d7d98

  • SHA256

    a67882e897555523ecb3e1de3b8dd6b3ace0f5d104a47badb8359d7a50975efd

  • SHA512

    c47857c76751b3becf37bdaa59c716c0724ce53393b385bef05e881d5a2cfdabff6c8b93a221fd709ab70664db27a49e8fe908a6d6d9febccb4431a1eac139f7

  • SSDEEP

    3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGvlEeKcAEca

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-08_cd15fa97891c8af713617ca8c67ba747_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\{406BD0AB-9EE7-41bc-A33F-F62D4A08A870}.exe
      C:\Windows\{406BD0AB-9EE7-41bc-A33F-F62D4A08A870}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2172
      • C:\Windows\{1A0EC4CE-9FC2-461b-BE62-8A26E0373201}.exe
        C:\Windows\{1A0EC4CE-9FC2-461b-BE62-8A26E0373201}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Windows\{FBBF3FC6-3986-4fe0-A19F-0E081E5A73F3}.exe
          C:\Windows\{FBBF3FC6-3986-4fe0-A19F-0E081E5A73F3}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Windows\{BA25CCCB-7E2D-4dab-BB48-52629207288F}.exe
            C:\Windows\{BA25CCCB-7E2D-4dab-BB48-52629207288F}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2432
            • C:\Windows\{B2DF8A8F-AC5F-4a44-B5D2-498938CAE56E}.exe
              C:\Windows\{B2DF8A8F-AC5F-4a44-B5D2-498938CAE56E}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3052
              • C:\Windows\{7678B291-5773-43f8-89C8-BADF43ADA2C2}.exe
                C:\Windows\{7678B291-5773-43f8-89C8-BADF43ADA2C2}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2760
                • C:\Windows\{25B414CB-E3DE-42ec-8E31-4F21C50098A6}.exe
                  C:\Windows\{25B414CB-E3DE-42ec-8E31-4F21C50098A6}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1940
                  • C:\Windows\{DDAFB319-B9D3-4a63-BF6C-2F57921FAEBE}.exe
                    C:\Windows\{DDAFB319-B9D3-4a63-BF6C-2F57921FAEBE}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2772
                    • C:\Windows\{A0F7EA28-92B0-49fc-B2B3-BE18C1DA47F9}.exe
                      C:\Windows\{A0F7EA28-92B0-49fc-B2B3-BE18C1DA47F9}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1676
                      • C:\Windows\{EB580680-8FDB-4bf5-85FB-BB329A096FF1}.exe
                        C:\Windows\{EB580680-8FDB-4bf5-85FB-BB329A096FF1}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2280
                        • C:\Windows\{28C8C11E-7B3C-4b34-96C8-FE112F395A48}.exe
                          C:\Windows\{28C8C11E-7B3C-4b34-96C8-FE112F395A48}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:356
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{EB580~1.EXE > nul
                          12⤵
                            PID:1028
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{A0F7E~1.EXE > nul
                          11⤵
                            PID:1076
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{DDAFB~1.EXE > nul
                          10⤵
                            PID:2092
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{25B41~1.EXE > nul
                          9⤵
                            PID:1184
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{7678B~1.EXE > nul
                          8⤵
                            PID:2408
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{B2DF8~1.EXE > nul
                          7⤵
                            PID:1976
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{BA25C~1.EXE > nul
                          6⤵
                            PID:2392
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{FBBF3~1.EXE > nul
                          5⤵
                            PID:2464
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{1A0EC~1.EXE > nul
                          4⤵
                            PID:2708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{406BD~1.EXE > nul
                          3⤵
                            PID:2540
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                            PID:1616

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\{1A0EC4CE-9FC2-461b-BE62-8A26E0373201}.exe

                          Filesize

                          197KB

                          MD5

                          8610c9b9ae639a3a8d7490d9b84c908f

                          SHA1

                          afc7db5d9063ff02a87d554a3bef1c95c8f041e8

                          SHA256

                          f52a4f9f9b43882e04ccb5e055201451cea21dde4a8f9742a8d4549b3f5a6a41

                          SHA512

                          6dbf41b5c876e29b7dc86793afc452d3835d37951db32228dc227c6ccaba5ab9030a3be09ebb0315f2f3fe21d549b1ca0c567c66cb3d2778e2bcb03160939658

                        • C:\Windows\{25B414CB-E3DE-42ec-8E31-4F21C50098A6}.exe

                          Filesize

                          197KB

                          MD5

                          8bbe4170bef718352ae1bd7b42616914

                          SHA1

                          50a1d40842d7d3d86b3e05b3774c809f89d4ab40

                          SHA256

                          c76f3b87c0c77975bfcee13207866b7d4fb8062cb6b0099a425aec11255f6bd9

                          SHA512

                          3ee384573bed15f9fb7eadf386fd34507221a1d8d6bfe50b5cb7f1156601d1f1dabc09d3754a7f8669870f2d60ceb6d184611375eb65d99c00ee5c90a2b383f2

                        • C:\Windows\{28C8C11E-7B3C-4b34-96C8-FE112F395A48}.exe

                          Filesize

                          197KB

                          MD5

                          bb46ef0faf0ce0e897968ca21cb75fa6

                          SHA1

                          e7c7d6eb0cba0dc8ba63a8a8dcf07c966342ccae

                          SHA256

                          8c77f18c4d333aa32346ce5fc3b4432b3d3ede9e81fbd3800c00f10fef810bbe

                          SHA512

                          ba74d9cd804e0f36ae264ce4760fb8c10b2206378a3a78a4098455011399e97884c950b9b5e4802878773d82012bf43cd9a80e6422e22c8fa33f827f27af689d

                        • C:\Windows\{406BD0AB-9EE7-41bc-A33F-F62D4A08A870}.exe

                          Filesize

                          197KB

                          MD5

                          62214b18e99d7d33274b71b249690975

                          SHA1

                          d72b5b13f6b9a506274bf9dd27cb03cc22ef07da

                          SHA256

                          e8b98af0b10b084ecd268d7dff9ca7b968ce4f66fe59cc1457fc56f099048914

                          SHA512

                          913949dcdd5a4684e190758f1ae27713fda695363580c6a00af355c2b0a6bbc2747c4b86cede3f1004ed9a3dba542e01ef95ef14945b2e694f9d0e5c8f7662ad

                        • C:\Windows\{7678B291-5773-43f8-89C8-BADF43ADA2C2}.exe

                          Filesize

                          197KB

                          MD5

                          084aeaf3f0dab3c89064b34b34cb8430

                          SHA1

                          edaf5c2aaaf64a4f1b45c857c0f2313407f0c722

                          SHA256

                          10d78d3ac50741e5fb9309df02ba4e2926e6d494961a00932e7168aa061113c4

                          SHA512

                          57db4cfbb8aa7092a4d6e2217b9ffceaa26dab316e1652dded2b5bc050aa7e1f077eff255fafce295d383a13581ac1737634d064efbe7b8b2e77682a0441f353

                        • C:\Windows\{A0F7EA28-92B0-49fc-B2B3-BE18C1DA47F9}.exe

                          Filesize

                          197KB

                          MD5

                          588abab083e1b66f1be1a2ebdb412f1e

                          SHA1

                          3d23e3d46e8414d501cd678572547be6ff576207

                          SHA256

                          59cd9de7d666edb1125a2ff3de555a9b43524ade52656bfd29a96a44bdef5524

                          SHA512

                          730d1c5c04d6b619b2013abba95c71736fa74176fcaf53269878685e423a9e072ab9348b023be8acc98051f32a24145a6c23816200ef2105b94ded75bfb98ef2

                        • C:\Windows\{B2DF8A8F-AC5F-4a44-B5D2-498938CAE56E}.exe

                          Filesize

                          197KB

                          MD5

                          c36579736b856e0b8a6c66cc8d795f90

                          SHA1

                          e51dd19b7c6ebfa003b078e2b29d8a8632bdc08a

                          SHA256

                          7d8d9520dce2b4f9bdbfa331c1717d3b9e39598356b71b1043ab96005bf1ed60

                          SHA512

                          89f6e453b104660865f94a8d78d7bd2eb6a131b2bd24cc2562eb753d1321bc7aa22c6f5583785ac6956b6496f318222a00ebb078d0abce061f4753dc129ab341

                        • C:\Windows\{BA25CCCB-7E2D-4dab-BB48-52629207288F}.exe

                          Filesize

                          197KB

                          MD5

                          5432d0307d89bfa1078e1f6924950fa9

                          SHA1

                          d8ca610a741322c412dfd8dc749cc77979e21acb

                          SHA256

                          cd8dcd9d137a7e72b3c6c0af5377917a99f078f0b402b725d4d857ee5ccf63bf

                          SHA512

                          a6a3ae5628890fe64ea3fee6bdeff22e1ab086ac70d8dce4a296b661c5ed0ae142f524c155b53639709bfe4ba0c32cf7c35b758908c7de3bb1cad1dae977cb01

                        • C:\Windows\{DDAFB319-B9D3-4a63-BF6C-2F57921FAEBE}.exe

                          Filesize

                          197KB

                          MD5

                          370df1ee023f9099f36c21072203bfc1

                          SHA1

                          d434e0220d5ba77fc372ff2a726cf42b0b275c32

                          SHA256

                          251b19ca0ecfea5db4b03dd8a37917b60703428011f1a82e6cd458c2e288301a

                          SHA512

                          72cf38d27595d6e9dcccb57fd4440ccdad51744bababca4d14d35ed5a01f6cf65e37eaba6f336d884fe146412345827aabf1c18783ae3fc05125f01e4bbf6b5e

                        • C:\Windows\{EB580680-8FDB-4bf5-85FB-BB329A096FF1}.exe

                          Filesize

                          197KB

                          MD5

                          0d5c8d7026d737087cb029270d1271a6

                          SHA1

                          19525a6ee44752458013d12230920f0e211da34d

                          SHA256

                          75372f22c54eaf743ef2b8829286ad12faa600904203b99a79b86bfb181008b9

                          SHA512

                          92835f59d2eb766950b759691af3e142297c7948518bb20274977ed33a257560dce9701ccc07d2161c448eda64084a4ec4f16839276d6c5dc5de825270ba6712

                        • C:\Windows\{FBBF3FC6-3986-4fe0-A19F-0E081E5A73F3}.exe

                          Filesize

                          197KB

                          MD5

                          4464e10461b93adaae062f95c4444746

                          SHA1

                          f38b5cd295e3df4fe97da3192be6423f2cf475f9

                          SHA256

                          1fb3f66f5e4e5ab39d5e37c3c12377bb8a6bab0a0a6278112969508644244955

                          SHA512

                          023a8504c887ca3a286c927b0d99c9b136049c370830c8361322129df8f21fe4921e7954b076ae0a8b8bb6ebd90f3e6e50342b2eb2699db452974b2db354a784