Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/04/2024, 08:47
General
-
Target
2024-04-10_ee5b303eaabfaad6215e31c52a0acbf3_goldeneye.exe
-
Size
168KB
-
MD5
ee5b303eaabfaad6215e31c52a0acbf3
-
SHA1
fd82920c63b3929b5cf578838ac71c84bd6cd741
-
SHA256
410fe386b8a73c2fe31360338629d61d01a44ef80d781cae1470b9d0fe7f5a5d
-
SHA512
b4f288cb6c931b9c5959a668e319978638ac086644e36b23636fd26fd7e634ec7b6b9b2e48eacee40f089bac231a5302bb5c2fadc5fc216872c63b6a1a42cde9
-
SSDEEP
1536:1EGh0o8lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o8lqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_ee5b303eaabfaad6215e31c52a0acbf3_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_ee5b303eaabfaad6215e31c52a0acbf3_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16757A09-B971-425a-AEB1-5F6C8CC4B5E5}.exeC:\Windows\{16757A09-B971-425a-AEB1-5F6C8CC4B5E5}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A6825A39-3F10-4dc2-913F-EA01CEF280E5}.exeC:\Windows\{A6825A39-3F10-4dc2-913F-EA01CEF280E5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C30F17F1-5EBE-4a1d-83AC-2C8E495DC21A}.exeC:\Windows\{C30F17F1-5EBE-4a1d-83AC-2C8E495DC21A}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E71EFFA-203C-466b-9521-49F443371950}.exeC:\Windows\{1E71EFFA-203C-466b-9521-49F443371950}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0762B7FE-3229-4d9a-98AC-6736BE4C24CE}.exeC:\Windows\{0762B7FE-3229-4d9a-98AC-6736BE4C24CE}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2C72589-23C6-4d9d-A74A-8C5E183DE7C0}.exeC:\Windows\{C2C72589-23C6-4d9d-A74A-8C5E183DE7C0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9F9450B-B4D0-4871-BFCC-2ADFF404EEE7}.exeC:\Windows\{F9F9450B-B4D0-4871-BFCC-2ADFF404EEE7}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A503F7B4-3026-46cb-9157-5B2798BD9B4B}.exeC:\Windows\{A503F7B4-3026-46cb-9157-5B2798BD9B4B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53297F86-D616-48c0-820D-594286E9F2A5}.exeC:\Windows\{53297F86-D616-48c0-820D-594286E9F2A5}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEEACE8A-50C2-42ff-AA1E-833FD9AF9DCB}.exeC:\Windows\{FEEACE8A-50C2-42ff-AA1E-833FD9AF9DCB}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C937963-0CC7-41b9-9936-B155EF59D073}.exeC:\Windows\{1C937963-0CC7-41b9-9936-B155EF59D073}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B938C68D-5C6E-49f4-AA56-487939A70DEF}.exeC:\Windows\{B938C68D-5C6E-49f4-AA56-487939A70DEF}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C937~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEEAC~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53297~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A503F~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9F94~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2C72~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0762B~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E71E~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C30F1~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6825~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16757~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD501c7f0435d5207a387d7462e29a65993
SHA111fc6fbc42a23ac0e60340d3a12cc7ecb9f776ed
SHA256f26650aba5d693ebfe76eaea01f19efbfebfdb3704b3770b8d8b198718b48c21
SHA51211f625d44d869eff2e69e849fda5def19b5fa5ec0ebc6dc422e137789385209cba6bacb824eb70a61b983a77f8bcc621efc399016f10289720ca76943d53b24b
-
Filesize
168KB
MD53677e80ba03d4f38271b27fb1e32cec4
SHA1cbffbf2f32b626e968ffc66b18087f512f0cd999
SHA2560a9045300a1573a2e5fe3fa8b87300cb2dede525a40f6dc639f8c64bd6f80fb1
SHA512ad276da80840f8dd96d1c41f3018827ca160122136e02821a2e05b3bbd22fdcc79af9b551c088dba12f3c1468733102ef2ea3e5e80f9b902b630d6f4d4efc5c1
-
Filesize
168KB
MD5e7e3c301d32aa6ce18bb5eb227d1b62c
SHA1bc0697ff135f27b74661fed75383f8420b646e46
SHA256147fbb395fa85aff016bc57623de8a58de02e4a20059b30411f64d6bd83410d9
SHA512c77e8d3f0487c2b539488f152e13088d4912d15bca5eefd25dab46af22e536c64c5b97ccb784944937dba09d12ad0ac554321928c6ad4b20a80a4ff5adc79f9c
-
Filesize
168KB
MD57f2e7759e7d5ba832404f4c74ad8522d
SHA1803e7cbd3d2484762cc892f55fd6acb9ca213c2f
SHA256b3add1de4baa6b1912087e7495fd100def25007669da672c2d4ab37d69eaa7dc
SHA5121c5d763294b68050728dc3e565a7a07c244fca85d5b720fd815e11dde0a6b711e856df5fee01e4c601c1914d7b075ac7e915bd700ca95a2647ca11ccf232ab17
-
Filesize
168KB
MD503ea2b7e2cf9828d040eb60f4f9f6555
SHA121d14562595dc611f4971f308a65aeb01479e6fd
SHA2566fa711672310dd0093c01681af2cbd2e0489a4fce14894dc3c488259cd24d18d
SHA5120321835b9f58a76980f2a3ce227864fa0559619fc7f604b06fce747081af19451a98059856a68ed669b9900eaf1b604d906e5052a1a94580e412b636ed1076c2
-
Filesize
168KB
MD51c4809b5d983d31e45aa29fdc41fb3ac
SHA10fd052927902b5ce6734f0e20874104d9c9ab248
SHA2569329d8b4e6e35b888ae07c242f517400302996640f9bfde09bc9ef046be84238
SHA512d6ef6829090dd90795a059239669f4e46d4f70445f5214c6ecd65b6590eab51d6155fd71a9281b5b6317b78e799fe57426a4300cfbd9cf08c34280327e942b60
-
Filesize
168KB
MD5653693315ee1116ee826c33a1461b414
SHA1ec01ed42de2ae9e856785d2f79fbc9f07586a705
SHA256289265b6f206e9a7092791e67530df8ac32959541d37618f934d1afca3a213d6
SHA51285f27c41d1c8c30f37ed4d6e34f1d9ad723179275eb13d207697f2076a0d834fc93e020468fb27d2c6bb982b21f5d1acb8137b513f02d8f810986921ab06e914
-
Filesize
168KB
MD5eccdf89c0f2c25d6ee1d709eb406e57d
SHA1246eee6142a43b35270cf4287e8fa37ba543d42a
SHA256a5a314d551ed71726bd18f97fff8adeeed77b2dbf800c0e51eac864d2879800b
SHA51243eff0d35bca8e06b902b4c73e2f24825dab4bc1b5ae85c25a8adfd47eb015fe4d3bf499b5c6cdcc3327fbb606866f3ee8daf5ce8b8ca4ba504ad5a8d68adf67
-
Filesize
168KB
MD581ec72644a1f642812a6e059df5fbeae
SHA1b74f37d40209c7e724cc082e720c4e1b19146b92
SHA2561e9e03932886ead8a4a3e14886d9759a57e8d90ee1b9986fd37bbdd772cc27a2
SHA5126fdc7f59ddd0a5dfbbcf39efe31b6ad411c750bef656ce70616edbc2b020c42dea2bce57aa5bb848c426773c60e15da60e88bb6b311f637795e461180ffe1851
-
Filesize
168KB
MD51b8b19950b20ed0cc3656debb6d37010
SHA1394e9dd6a58f8d217a8801912bfa0dfdfeb648b0
SHA25604f881e084ffde8f87b38e83d0483a5cf8681b26b272a6ebbb74c305778fd6b2
SHA512357fef48624ea41d8b344707dd938d4af40a934c21d17b1f53963f3f38da1d1f319c94ee7fecea22abbfea88b94acd965afdf6920c7a1e6db416d0e2bc37ab34
-
Filesize
168KB
MD5dd6348a3097d18eaebdcd790e8dd328f
SHA1b5f1d66dbdd7dbe1ffd995e34266681c76cff249
SHA25621f4c5cec4895ada0e48cab9e957c7a3ea55f907ff479618ca58f3d73895131a
SHA512410ee79fef604cdc60da249989a95a3f9fd55867952d50d1ba9aed9cc00a0da0cab012858ca9aa2932fe448b90b4039316b8e8d5b346b912380f61b3b8a2a7f3
-
Filesize
168KB
MD57cbb6bc0266ffc83d42bc8592db76e81
SHA16975b863ae932d84af390002201d74a1a5489e24
SHA2560218755e155941972b9f7651b5707a295fde0668e00e4fc8319bd3288a5b6aff
SHA5124721df95e793407fff5e57d116d5bb6faa5e91962a5ba03674f352fc791ee96f64e47cfb04cbdde8178d831a9be7a789637790e539bcd69f86474c48136c7a7f