Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 02:45
General
-
Target
2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe
-
Size
380KB
-
MD5
d5cce7bfe07889865487b2d81b886485
-
SHA1
22f06018275b07eddcaa4b297aa06f42edbfcb79
-
SHA256
ff61ca5fe75ef4a28044cb1f7a68f36d2d8472866d35f01fe1fb7db67c02e33b
-
SHA512
895b6821aa17d896d90c4087d821983e811b31a8f0f17e69c3fde83c39701ac196d5b39905d3380bd895c7c2f516029e5533f415ea92a6ff02bc0dd0f6cbd461
-
SSDEEP
3072:mEGh0odZlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEct:mEG1l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5cce7bfe07889865487b2d81b886485_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1D75B9A-7075-4025-88D6-3FD87945FF41}.exeC:\Windows\{A1D75B9A-7075-4025-88D6-3FD87945FF41}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC1611BA-636B-42a3-BD29-AF5EAEFF6D89}.exeC:\Windows\{FC1611BA-636B-42a3-BD29-AF5EAEFF6D89}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26EC38AB-5B2F-4ff0-B0EC-70D3F05E06D6}.exeC:\Windows\{26EC38AB-5B2F-4ff0-B0EC-70D3F05E06D6}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{304E4416-8BEE-4e1e-B52D-F32D11F029F2}.exeC:\Windows\{304E4416-8BEE-4e1e-B52D-F32D11F029F2}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FB87E3A-E012-4c04-8F45-AE7A9B11ABE9}.exeC:\Windows\{7FB87E3A-E012-4c04-8F45-AE7A9B11ABE9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B699DBF-5255-4c3a-9029-4FD75A62B6AA}.exeC:\Windows\{6B699DBF-5255-4c3a-9029-4FD75A62B6AA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AFA36B5-773B-4600-BD23-5F8B7FD78267}.exeC:\Windows\{7AFA36B5-773B-4600-BD23-5F8B7FD78267}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C1A9CD5-B8F5-48b9-9631-9C983A977D33}.exeC:\Windows\{3C1A9CD5-B8F5-48b9-9631-9C983A977D33}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BE68DFA-47A5-43d0-A3F6-BFB33FE72B63}.exeC:\Windows\{3BE68DFA-47A5-43d0-A3F6-BFB33FE72B63}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{014BACD7-D87B-4a5b-A6C0-4151F5B90FFE}.exeC:\Windows\{014BACD7-D87B-4a5b-A6C0-4151F5B90FFE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1D7170C-B1D8-4b78-B94E-A3F58DD53CE2}.exeC:\Windows\{D1D7170C-B1D8-4b78-B94E-A3F58DD53CE2}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FB616BFF-CF29-4d37-9F4C-A752B8A7684B}.exeC:\Windows\{FB616BFF-CF29-4d37-9F4C-A752B8A7684B}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1D71~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{014BA~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BE68~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C1A9~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AFA3~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B699~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FB87~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{304E4~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26EC3~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC161~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1D75~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD55db6ea07fb3beb31bc79a1d902670df8
SHA1e4da74eaad2fdfeb8274943981802f242b4c4836
SHA256523dd15ecd3a3657ffd579929cc7e52174e4c4be680f1f3ae18980b2935110e3
SHA512c6ec9cab23b62ea286b6bbc6d9c2507d9a351d15b799217352bb0c5155d0a913112fc692695dc06411d9e38b86e9edf1737002013c6671e25a6f22f011e00aa3
-
Filesize
380KB
MD5bc04412ed00878ca04c6a9b159f91c86
SHA15ca0ebf112d8019b2a30895dd33b271fab984836
SHA256b27970007085dec10edfe658efb02a189aff0f3f6acc88446729ff3aab52f7c9
SHA51228943845625703581d47fdbe30e0ded06724b01f352d729037b60c3702df42d30ff851dcfeaf8f6ceedb6ddc63c11a33e9daf2418c9210ca6e6defa29f53d02e
-
Filesize
380KB
MD53df77c90e584f5fa4f989b1bd9f58b8c
SHA18153ed80253b91f18f29c0e80eb9b65d34de897b
SHA25640c3d5f7e187018e2f24a0d4e2c80cc1cb501766522ecde918e85aaff80b0292
SHA512c0b482ccadc8d56263fbbfcc051016a7c555852adf91ebffac7e86bf53f540efbfca097c5b62796ef340a0b62a23252179fb0dd6d6c5ae9a6c0656bc51429a69
-
Filesize
380KB
MD511f40792d516a3d629a40de731a04a97
SHA1f93cb8b40b6db621203a7a40d755a3de13dc55bf
SHA256ad9944f80052972d494c9853c93691bf531cbef840c2020fdff7d14ac2dffa80
SHA51222c1b823ffaece22e0c8ae9bba6f05166492603e82a31d7eea817a4fbf950bbd8de3fb0e9dbe4b2e08c9571e6d9bbc1f019d16000e178c4efdb52d31c15f2175
-
Filesize
380KB
MD5032ada94f4cdc7bb96041ae33749db4e
SHA1b46852ff5d3cd6e4497cfaa362fcdf714e15e849
SHA256364f247da33349d90f191b764b7239deff7f3fea10d5ad88efaa038e3beca0d4
SHA512d24f4c2f18a7fee25d4ec5ba2b753a1a348d287fe2f8726b8a31ae6a921937e1429e9b405d7d857df70dd9a6e7080daf4de93710bc51709f557e1c5b375ed83e
-
Filesize
380KB
MD57b11e374d452bd19d3d5dbebee1451d9
SHA13c366571c03ff2510ec391722717bd95b377efb5
SHA2563a7807eda8e626e73545d4af815bb6311f6809d8e168dcb6e65fbe43483934b2
SHA5122b5c1edf4fa63fd0cc886433665c5765a7656edbbe6b24b7b6da943ff431a22b62f9cec08d9f0feb4dd1aed4f80d2146c7609b3f842003bd38585373f6f60540
-
Filesize
380KB
MD5c0e40e0e9963962295fea68978c8caf7
SHA12da0ee13b98450fa599329d8cdb33a415cecff08
SHA2566d6dd8bcbc970883b54800b67a0dc82830018bba5367418d1b3a99a0bcc8591a
SHA51256ddef0422b0e39cd289b0d2761256efb9e49219c855e572de1ad71bbad022f1b6438f928e8d7f89b293695c36adc4f9a7bb8c7621cfdbc5060e269dfc3f8a7d
-
Filesize
380KB
MD5d6538007b432bc698a01f5522fee4499
SHA10c49e48a64db212b174e0516621d9a74ca9b70ab
SHA2564ddc8c2d444f04e2532a960a29e54f290d116fe84a8843f58f9e5d3337db00c4
SHA5121c05a71404fd9715c8429f2c39e4b106247a6d9ebe0b4eff10980e1171c4f80c840e6288765a49b531f772382e223ee3bd22a2cac8f92e2d8a8c2c90c986d4df
-
Filesize
380KB
MD5dc15afd3e04238781f5c383d9176b202
SHA1db0d8877fc2e09fce755cf9f0de53c58ef357db7
SHA25638ab4027e35f7c359a52e77203e05d87f5f3907b73d3f589017cb2a087163a39
SHA51248212c813d55797c8cd6177d634bedf8a62aa192cf8a0d8806bebf459b6336c551d7a229ac8574e29a97cac07caa210b727da0ea15314de0899e3ac3370b6b2c
-
Filesize
380KB
MD58db4ddb7dc05f1f1c078a3f1199e2d88
SHA137e8036dedeb10ebefddfcfd4b5ea55a79facfcb
SHA256dbac77f1de88b1111bd106e01342be48f63c7b97e2b0896799fe8257f182f402
SHA51223d982d3da0d5dbb3d3cd9e409eacd4ef5caf3115fea91f7efc2a17b1e9f5588212e649f733017d75b0c3aa076c9ebcb3a139e945fbf702a86d1275a5eb5b4b4
-
Filesize
380KB
MD599e41841c91f534f378b6d9eb956a649
SHA12556611e7f209403d5820ece47c3b8b61d97d7c8
SHA25621db14155dafe06a6dab554c6f60306e3ff489e299fcec7298b99282dbad1c4c
SHA512ba8538033ed9798cfbf395d36180a4aa221f7b31634f6b987c586031614783c3f6431cd97dc561a394541a2e3df73f1e8541ffac054ab07184d049b6b4e1d13c
-
Filesize
380KB
MD51e63024673b3493d356c7eb9ea26ca76
SHA1a5a017c10a8ffb06599ec5fe142bb168cd748b7f
SHA2562c455cc0059d335ecf2dd0efd2e503d87f1f20cf4e05d46fc2a33d15929b2933
SHA5122f2a2c83bf596b395628d6f0c2b6bba087d85da5a9fd223c948fc0749b0ca809e36e44d826952bb76a5b4dbac133e016951a6927cdf1a07b53fbe720b17cc122