Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/04/2024, 15:37 UTC

General

  • Target

    2024-04-08_9dbd6af397555824fb7c58da23e7c4a0_goldeneye.exe

  • Size

    197KB

  • MD5

    9dbd6af397555824fb7c58da23e7c4a0

  • SHA1

    7f770ae62dcebc902fab13561885ea128d1f433b

  • SHA256

    d3d3ed679b181d1d2467b7a2314b6148ff1ddf30b6bfb557ae1816df3635d13c

  • SHA512

    42c7a959dec27e7cba8434d9d39dd8b6202aab954e1a4f6da39bab2c069723c77984a65fba0ce6c4715bfe3c44d25dd8b2f56b05bd321098f670e6e9c64bd272

  • SSDEEP

    3072:jEGh0oFl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGjlEeKcAEca

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-08_9dbd6af397555824fb7c58da23e7c4a0_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-08_9dbd6af397555824fb7c58da23e7c4a0_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\{CE1DA119-3939-4e3c-A1F0-CA32D733E84E}.exe
      C:\Windows\{CE1DA119-3939-4e3c-A1F0-CA32D733E84E}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\{30F78ED5-E579-41d9-ACC5-A68065F95F29}.exe
        C:\Windows\{30F78ED5-E579-41d9-ACC5-A68065F95F29}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2628
        • C:\Windows\{ADCE578F-7E47-4da8-8153-BA1C62B8D9C9}.exe
          C:\Windows\{ADCE578F-7E47-4da8-8153-BA1C62B8D9C9}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2504
          • C:\Windows\{98AD0080-352F-4a13-90F0-4EA069921598}.exe
            C:\Windows\{98AD0080-352F-4a13-90F0-4EA069921598}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2284
            • C:\Windows\{4BCA9E00-8BB2-45a7-A269-976C7F04394C}.exe
              C:\Windows\{4BCA9E00-8BB2-45a7-A269-976C7F04394C}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1092
              • C:\Windows\{2C7BBC39-6D9C-45ea-8795-942E3323D959}.exe
                C:\Windows\{2C7BBC39-6D9C-45ea-8795-942E3323D959}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2688
                • C:\Windows\{9009C71C-D834-4188-9B70-91F2859707C2}.exe
                  C:\Windows\{9009C71C-D834-4188-9B70-91F2859707C2}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1908
                  • C:\Windows\{AC15890E-096A-49ba-9ACE-1F7507191F5E}.exe
                    C:\Windows\{AC15890E-096A-49ba-9ACE-1F7507191F5E}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:576
                    • C:\Windows\{70662763-AA87-43ba-9178-F5619C318FD1}.exe
                      C:\Windows\{70662763-AA87-43ba-9178-F5619C318FD1}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1752
                      • C:\Windows\{F4FA484E-0631-42a6-9E95-A45DD543F398}.exe
                        C:\Windows\{F4FA484E-0631-42a6-9E95-A45DD543F398}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2044
                        • C:\Windows\{BFFBFE5B-9E20-4d7c-97C3-184A1DE5290C}.exe
                          C:\Windows\{BFFBFE5B-9E20-4d7c-97C3-184A1DE5290C}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:1444
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{F4FA4~1.EXE > nul
                          12⤵
                            PID:1336
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{70662~1.EXE > nul
                          11⤵
                            PID:1288
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{AC158~1.EXE > nul
                          10⤵
                            PID:2744
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{9009C~1.EXE > nul
                          9⤵
                            PID:2692
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{2C7BB~1.EXE > nul
                          8⤵
                            PID:2584
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{4BCA9~1.EXE > nul
                          7⤵
                            PID:1872
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{98AD0~1.EXE > nul
                          6⤵
                            PID:680
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{ADCE5~1.EXE > nul
                          5⤵
                            PID:2996
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{30F78~1.EXE > nul
                          4⤵
                            PID:2424
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{CE1DA~1.EXE > nul
                          3⤵
                            PID:2676
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                          • Deletes itself
                          PID:2940

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\{2C7BBC39-6D9C-45ea-8795-942E3323D959}.exe

                        Filesize

                        197KB

                        MD5

                        e96569fbc76868837546b6d7a566c098

                        SHA1

                        fe60ec482c0c6d694d2df26269975577b1866a70

                        SHA256

                        11f2ac99baf0d382d1138394db855cd9fc1dc55f8efc315023af50d9e7013e93

                        SHA512

                        4a9cd55f150328c1eda89affc6b7029dd399a101c550fa6b75a6f1f4e5e32a4f206f363220906283c1a47689c631b362f9bd9f08f533549a0879ddd0e49c99f9

                      • C:\Windows\{30F78ED5-E579-41d9-ACC5-A68065F95F29}.exe

                        Filesize

                        197KB

                        MD5

                        c80dc87a81cf5a0e92d5eccee3a6f89e

                        SHA1

                        ccc5871506459aca03d02c5a211b7caaae7fd3bb

                        SHA256

                        e6bfe011125b2df7c78cb51766d26464dacd3a7cc8e3f42480570b6c9f10189b

                        SHA512

                        3733e25a04459dc10ab82f41d5b0af4fb2745ca3fcfe9b89219d74fd10a29c3bb914a1cf564b7bd2e4f6fbe98d22965d40cb688e992212031ea076bdb4e4fd24

                      • C:\Windows\{4BCA9E00-8BB2-45a7-A269-976C7F04394C}.exe

                        Filesize

                        197KB

                        MD5

                        a789773d9e0f5f3e1e8a82cef1cc9fe9

                        SHA1

                        dccb4b20eabac645d191c8aefce33578f958efda

                        SHA256

                        69001ab8aa91298ac590bb596d1dc32971224f7aae1448e53d79a9d15d2e015d

                        SHA512

                        43f00504789646116bc6c21dfb93e5e7d7ba2680b543ee653616fdb7f4510cb5a0d836b5b369bf7117bf720fff9c2ef7f9c8e333397cfd2afa0e6927d4411b57

                      • C:\Windows\{70662763-AA87-43ba-9178-F5619C318FD1}.exe

                        Filesize

                        197KB

                        MD5

                        e71ea21f75b410b38d27ff780f40d71f

                        SHA1

                        1dafbd1a9fd0abf5dbe737e52759cf6c5c903e7d

                        SHA256

                        86c666809bf5a54c5e373551b5c955918c76f3fc69e011b89c75ece034ef505b

                        SHA512

                        a8de5c79d702652a00ef888f740a877ae2b232de48029a4b19c314c3c8a3757903057fafe4cf586202e6bbc3a6ad481c2a569a47e47a92bfd2561c5617804bcd

                      • C:\Windows\{9009C71C-D834-4188-9B70-91F2859707C2}.exe

                        Filesize

                        197KB

                        MD5

                        072d5fd151e3e4d74adbbdb7c5a72d7d

                        SHA1

                        f6cae43f5b8f9109407c9999817ca23164b66089

                        SHA256

                        65e3403020e641fa330d12ecf24f32187e83f033c13d0527c0525a661bd674cd

                        SHA512

                        91bb8cad898d6558efafe5a370e00d354ecf8533d09ea03bd9ce72c808dddf240bb882f3297245fefc02738f431f6cacca2ac9674d599688b6708e0c2b9755c7

                      • C:\Windows\{98AD0080-352F-4a13-90F0-4EA069921598}.exe

                        Filesize

                        197KB

                        MD5

                        8a2bcd545d8bcfdc73f0e3f86e2f12b2

                        SHA1

                        4af9d690990029cdc071c5a82a67554759bd2aa0

                        SHA256

                        231e215f80bf053f8f2bd8fb71ed263d78a4a4b741f57d06603752bd7840e9ec

                        SHA512

                        42494229d6ff0c0c2c5c2077c9ed470ab94650b94a6298e60f079a2ad9e82aac90b069b5b312c284d234f2c99b2ee0dd6a97cbc1ae0be6172de7d76e064bbfae

                      • C:\Windows\{AC15890E-096A-49ba-9ACE-1F7507191F5E}.exe

                        Filesize

                        197KB

                        MD5

                        2387ec3432ae7a53f681abc0f69619be

                        SHA1

                        b900fdf765b0ce2884b2b75e3d3e7dc3ae90424b

                        SHA256

                        3eebe447702314579babc3811d0fbe8eed9ee155b80f90eb6f552b6e34c7b7bf

                        SHA512

                        48b26a35ca4457d68d226d68eec491396649b7fa1ef7c685f37160781d6d155a48c5499d38b1b27c25df3a12c8aee8389332b9143fef7a2a041e7dc3b7ad21c7

                      • C:\Windows\{ADCE578F-7E47-4da8-8153-BA1C62B8D9C9}.exe

                        Filesize

                        197KB

                        MD5

                        71694213db4b15003d4e0db409071e80

                        SHA1

                        2ee3955517f4ec4c8b8601a0891ef2349f0c9d8d

                        SHA256

                        7cf4f3dfd8bc190ad84e8292d66f9ccc2b948182ac4567b90810a2fd4ee3a35f

                        SHA512

                        bd945afd8bc6c2d40bd9cb1e3ee35f2657c127c4201688d200940d7be26fc43991e70ff5d601148694543c19a0b7172ee6a2af4b74b949a7cc54d35901692fbf

                      • C:\Windows\{BFFBFE5B-9E20-4d7c-97C3-184A1DE5290C}.exe

                        Filesize

                        197KB

                        MD5

                        69dfaaf4f17cd0bc2037187c61039fe9

                        SHA1

                        f217447d8a32cbbca90fc142f57b84a5b4bb41d3

                        SHA256

                        d5aacc1dffcb2502e79648a80638b9962dc481a45f10217c1530b4bc163071ca

                        SHA512

                        c9391f3b3d2a614e186c3e286a9d5a26f9792fa67bd4e0f1f9dd4e7d0d3a66bafb0f219327b4d371af3c24d07048be60f56ecaea640fb383877c3652254c806a

                      • C:\Windows\{CE1DA119-3939-4e3c-A1F0-CA32D733E84E}.exe

                        Filesize

                        197KB

                        MD5

                        afed7d8f0974b65eda22efc7e201f4a1

                        SHA1

                        475dca763fcd002a1c36763134649838db17717e

                        SHA256

                        27a5ef6722a7c390fa9ec3a132ee6b2b0dfce6b744eb9919b7db10b66d2ab705

                        SHA512

                        790f2664efc923cb665648fdb4db2c84c51276881670b362354e2701729738f842b332082c449083519ae316fc26d688d4b8ddbd7604cb98cd947000bf206482

                      • C:\Windows\{F4FA484E-0631-42a6-9E95-A45DD543F398}.exe

                        Filesize

                        197KB

                        MD5

                        01c9dd5255b0961f9140a2fb2b41b6b4

                        SHA1

                        75c9f0e5bf7634637923d8d181a9d1f73d50f8de

                        SHA256

                        a6ea7e9a6fdc5a6f580ac06236f5a72439e1a607ed4d4f9cbd2946f954968558

                        SHA512

                        915fed1d787f4f0662b8af4dd1946bfae44a6d7260fb6d59a2b026f503a6a707b76bc1ccfc31a673d09ca049939ec9c774b01f053da495121a59b5b01ef41c95

                      We care about your privacy.

                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.