Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/04/2024, 19:23
General
-
Target
2024-04-08_330dd73facdc2b18c38725b1ae19561c_goldeneye.exe
-
Size
216KB
-
MD5
330dd73facdc2b18c38725b1ae19561c
-
SHA1
b877298cf2d39e029a05723b512373e0d44b2c8d
-
SHA256
2be2af95d009ff1a3f02f970b0a61f4d366fcfc7d16e294461b5308b406874e3
-
SHA512
3e6cfca8f064c41612be91045a53ddd542103fe5087aa9e396996fbbdc95df754cbcca6df4cf07d6760acaea8a37d528697a40225804eabf4b3d97657083cf53
-
SSDEEP
3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGQlEeKcAEcGy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_330dd73facdc2b18c38725b1ae19561c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_330dd73facdc2b18c38725b1ae19561c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CB95849-901B-4105-A6F0-CE1030D33F43}.exeC:\Windows\{0CB95849-901B-4105-A6F0-CE1030D33F43}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD10CCCF-DB6D-4baa-95A7-1C86A7F0D72A}.exeC:\Windows\{CD10CCCF-DB6D-4baa-95A7-1C86A7F0D72A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B62DFC3F-2383-433e-971D-60EE7D5B89EE}.exeC:\Windows\{B62DFC3F-2383-433e-971D-60EE7D5B89EE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DEF891E-C36F-4dcd-895A-1CBA0DA36B5F}.exeC:\Windows\{7DEF891E-C36F-4dcd-895A-1CBA0DA36B5F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78C08F6B-58EA-45c7-AAA9-0646EA04B427}.exeC:\Windows\{78C08F6B-58EA-45c7-AAA9-0646EA04B427}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99826A89-A9B7-47c1-B962-33029E98CE38}.exeC:\Windows\{99826A89-A9B7-47c1-B962-33029E98CE38}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14C16C5B-A014-4ed9-A32D-F7CA51F22F7D}.exeC:\Windows\{14C16C5B-A014-4ed9-A32D-F7CA51F22F7D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64AD94E9-BFA7-4107-B8C4-EE46F61A0A04}.exeC:\Windows\{64AD94E9-BFA7-4107-B8C4-EE46F61A0A04}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76758718-B2F9-428d-AECA-36C8F7F0CD13}.exeC:\Windows\{76758718-B2F9-428d-AECA-36C8F7F0CD13}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97A3BF95-8C63-44e5-BF43-6A96EA7206AC}.exeC:\Windows\{97A3BF95-8C63-44e5-BF43-6A96EA7206AC}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDFDA58C-A7A6-4e47-B2A7-61F60412EAE1}.exeC:\Windows\{EDFDA58C-A7A6-4e47-B2A7-61F60412EAE1}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AD5E63D4-8458-4671-A408-6CC5346AB348}.exeC:\Windows\{AD5E63D4-8458-4671-A408-6CC5346AB348}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDFDA~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97A3B~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76758~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64AD9~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14C16~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99826~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78C08~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DEF8~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B62DF~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD10C~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CB95~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5672e35bcd9ad12c94d317b1a0f314bfe
SHA187bd4ec8c81142a07bb89929cde40fb984e9a363
SHA2563c01c79cee20afdfa6566b295ce9f4c48e21fbbd62f69fec668c903af0e74b67
SHA512ba8c49071a2642a5a1f7841f59c93d21d02a3cda81897c59a95212dc0473e1db5becedd8b1905475f8694aafd541a964bd934c1106028279c70471752beb58a6
-
Filesize
216KB
MD56b35d6a210809aed29aea71dcaa337cc
SHA1e1d8ad07d576a348687bde62c1ca606f4e545476
SHA256f4f2a46985455c6da2023b21a67787c1a58da5c05f2ee40bfacfd25cbff4d7cb
SHA512b58ac5dcbda807de88a36bd2025fe554d228d72783d1f5b28391e2654e67f2ead572e4306fc96790f5ddf9f0987de4880c9abbbdc294e548a4b8aa87efafcafb
-
Filesize
216KB
MD523ebe613e93d0690708926ddae5bc7da
SHA1936ba03e28b631fef811b4f6b775bd0ce65914d2
SHA2567b4a242ca2b0a745c9e5ff55fbf514cab21f451f8e4e125bcd9f98ff2c74b8a2
SHA5120f263529e08f4004f95d9b345660063fcd06fcd2f331316b3171b8c77c644ea88161bbcdade504bdf245d4f1f7b620ff46e3d5759c1df58afc9c80901dbb7730
-
Filesize
216KB
MD5aa79394a2a32ad09a557b674f7f27ed0
SHA18d1f075923464e63134cce8bf151a3b99f13fe4c
SHA256bd2aab2792c82bb0bf36605c040698cadc8bf15bcf4f63e2b9e1d636dfbd4fd5
SHA5124e5185853fc78f3149870e110132c363a1fdcd17c4ccb2221eeb730bc40d6ef23850aabfeeca1ba74809bee4ec0aff96321c7a0fe78f7debea111a087b9bff0a
-
Filesize
216KB
MD53659540d45e8a2792e3d77f5bbbf4088
SHA1646bb11496679f65c994ae226c70fbdffbdf9bad
SHA25607cb0f7ab6a84dc28e212cdb0db5d3cb72c5d013f8910d936b0a60442a53c127
SHA512e9a992d9445bc785fd221039e8f3cb3208c3682474ba051ca1c96dc1158471868d878cdee2484060c65469feef9047d79a0de20fbf8deb53f98f0fbd461efd86
-
Filesize
216KB
MD5d14d1a8544962d5d326e511d23d4ce27
SHA1d55a12c407f00c51d33db3ae31bb7235214785db
SHA2562ea28b4826f61d5ceca0db494c4bcfc1a4bdaa24ebbac20e622785769e380a64
SHA5124e9c724c2be53b43db78bcb725dbc1dc441c931a638888614980ea7ea68718037ebeb00015ad4d63f6d65b7e502b5c1632c4fcc7a3001e20b5c533d4173cebac
-
Filesize
216KB
MD59299c15ba0fbf3ddde897c4249f4ba61
SHA1e097baa98eec40395d8adf93b6f9223e002197bb
SHA25677e6839ddd03873ec168f2b1c48e60cbb791f11ac794ff037bebe9a2cbf85c22
SHA5129ed1de2057e9f7655815b7f51dc3db892a61bfe4c0f1df4577ca41b5388c473188f90cf12126dec48e57411024b934b465836189517b2589d0ebb67a10bd2adc
-
Filesize
216KB
MD50b8136041b91a0fa43fc52dc8bcd0348
SHA1a389e96e5eeaacc83b36233bb00877ff36c00a13
SHA256b56be9448b491b3e0d37702721fcc04b353f392baddf4cd4f2f39c18235b523c
SHA5129af9eb5d27ec8bf25dd9a7c993243182f658da7d97972a73bd96e90cc41220442a9f593ae43d9b8ff7202ebb6bf052b79ade94664f78062e86a70e2545f0dd0f
-
Filesize
216KB
MD5addf35a604e93398482183f76cef7fdc
SHA1b5ba32529633b290a3c846c78e20a4147c30085a
SHA256c6256a38a34b60fd9f05aee4bc9f9622208c48690c0a5176831a83c97a3a8f16
SHA51205f6b98aa42f6b97a261f835c3b1e069ee6b5c57f6a3d1d0bd68678da43fc6afc4e22cee7d9603c4174103e81624931599084da965421f408287bc5a2503ed53
-
Filesize
216KB
MD5909abddc169cdc233f07cc18b22bc764
SHA12bc17ea6d8781d32cd3b2ee8b2a7c8a61efe976b
SHA256b68b4e5c773e3431f56266be0b058848d0c7ac6ff8b1965ff7cade42ae5a5df1
SHA5127a17a07bf1f5c6237d4aa9198ff6f3c8cf40bcbeb3bdfcecf7b33079e51c9cb56427d9ad2dc143d971a2cebde6bb0f2b537807d2be1f0c219ee4561315379b6d
-
Filesize
216KB
MD5f86cdb1c7160228dd27c5fb32c70d4c9
SHA19bbe565c9df7140fce1c4f5c4f475e655595067e
SHA2564944b5ec31ed5362c54072004fd76e195908101b22d7b5b8849fc78a7e47525b
SHA512aaf5d1bb5ce3eab3241fe500ad1974a52310274e46d65bcf03ec84fc7b9dd994fb61a460138636c5557d597bf00bbc4e74ec326d9b0dffaf9a2e09f5dd16e334
-
Filesize
216KB
MD5b497e4b188bbb27b92c159360b612045
SHA1ec687abbf51ecfa2881b567d81c991d55a232dd4
SHA25621247b03d0c47bbbc2e35ef24abce7b4c9f25b390e600d75027ab650ecd9c083
SHA51233915b981eacf6c96d94b25274ec4abb41297cd86fef62952e928a74cc2b11e169e4fa43c9b9a28b5d064ee5028479486a2fc564c26a3d2a306347570f43e2e7