Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 02:50

General

  • Target

    2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe

  • Size

    216KB

  • MD5

    a55b3fbaab5a66224abffa43a0d38ea6

  • SHA1

    5571d0bd22526062f73b7ac2d3aac012461663d6

  • SHA256

    db91628f2e212116cf5d67f72eb988cf9e9226face956f670daa8ac86a6f46f1

  • SHA512

    033ebb2bbf15d06819a1a7a5bbce244432b6ffa30b46b6eac96fc97d877bc3207bba6280edf4ec47e87b29a9037c5b390115b51632f20f112d300a6fbc559f05

  • SSDEEP

    3072:jEGh0oll+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGLlEeKcAEcGy

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-15_a55b3fbaab5a66224abffa43a0d38ea6_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
      C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
        C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
          C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
            C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1872
            • C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe
              C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2988
              • C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
                C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2776
                • C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe
                  C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2632
                  • C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
                    C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2956
                    • C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
                      C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1308
                      • C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
                        C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1864
                        • C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe
                          C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:532
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{DA9B1~1.EXE > nul
                          12⤵
                            PID:644
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{A05E7~1.EXE > nul
                          11⤵
                            PID:2420
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{DB477~1.EXE > nul
                          10⤵
                            PID:2312
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{7ED95~1.EXE > nul
                          9⤵
                            PID:2328
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6563C~1.EXE > nul
                          8⤵
                            PID:2744
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{003D5~1.EXE > nul
                          7⤵
                            PID:2032
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{7C05B~1.EXE > nul
                          6⤵
                            PID:2832
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{12369~1.EXE > nul
                          5⤵
                            PID:2708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6B195~1.EXE > nul
                          4⤵
                            PID:2692
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{59278~1.EXE > nul
                          3⤵
                            PID:2640
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                          • Deletes itself
                          PID:2024

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\{003D5929-ED58-4082-8735-A917B5DF0365}.exe

                        Filesize

                        216KB

                        MD5

                        5b058638a3124b8503c869495a5a6e63

                        SHA1

                        17eaca6db07c3d7db67f78617acdf6e7481eac3e

                        SHA256

                        a3fd39284534b4c8dd025174ae9261fb47bac81ecd302d8405252e99a5ece09f

                        SHA512

                        0aaebc224fde8be797dd49f3ea9cffa34881fb93eb8d340582dfb5c88d5b05c9cbfc09867c8903b76ed98858590feef58bcc46d32325c8f69168864aa3306d29

                      • C:\Windows\{123697FE-08A5-4abc-BAEB-942A36E5ACF4}.exe

                        Filesize

                        216KB

                        MD5

                        1d473076b43c78d70eeab9dc11b33cf4

                        SHA1

                        f9a3b895a67acaf2c0551a945506f395c3f5524e

                        SHA256

                        110bcfab5b2a32459e209081fe9243d89d9fa0ad766f5246084898d15f5f0d9a

                        SHA512

                        93a5b9d29e2e8e8ca552c76ad4fcecdde246e67081243b8c0c67735f8dc751f8f644f5548a2640c61e53c3149fc94848cf105fdb1329139bb785fa1f60eea8b7

                      • C:\Windows\{1F59D33D-9AAE-4895-862A-FBE507FD489E}.exe

                        Filesize

                        216KB

                        MD5

                        5e1df17301e9874ee73875c825cbbfb5

                        SHA1

                        2528961df2a15775bad8f76d459d9224ac9eabca

                        SHA256

                        087de790177307a2b9bb4feeeabb62dbcef97baa4c1eeba1b30f1f6767a2764e

                        SHA512

                        cc314e3a4ddedefba4d4942683c926987c58bab8372cd2c5cc0269b91b61f7c50cb706b26fe672eece541ea1b8af934d0fa9fef947cef3e65b3d8e85d3a019db

                      • C:\Windows\{59278C6D-C34A-4710-950C-5EDD9A9DA654}.exe

                        Filesize

                        216KB

                        MD5

                        f88adca653d2beef480f27a941a7ff49

                        SHA1

                        de0f8ed0ca4e0e6d2df73fb4213df2082d7a8edb

                        SHA256

                        9e1d33df3a6a4134d7cd09938d46a1356955a23a2f21c99acdf18116a1428145

                        SHA512

                        299f6ae00ef61b09b5368c98c8b21cf144d90f01669dca287d31a725e04cc9c118181fc64295023d0daed0dac5f4af2ef7f845be910b6f15cc75217052baf1a6

                      • C:\Windows\{6563C690-5EE5-4848-B23A-42D42752B3A6}.exe

                        Filesize

                        216KB

                        MD5

                        dc81f5419687e8e2a85a47034e239b74

                        SHA1

                        5a6de506c5db02494d2ce3cba818076becb03304

                        SHA256

                        3e74ae7fda6ea8476397567cfd74ab445b519c8ac29234f8a17ba916eecb51e9

                        SHA512

                        04fdec002382d055c0968d1eca7621939f7e665f5ab930d80b6a02a73b358065f4ec9e8dbdec7752f9696b52266fb4f3db22dd28f30a18bf5636543a4e408ccb

                      • C:\Windows\{6B195893-D49D-4516-9E75-2B69EC20368E}.exe

                        Filesize

                        216KB

                        MD5

                        615e368ee28e60cd95bc76ee26eeb680

                        SHA1

                        d477c9e2bb9b97a0fc4e91e41502499502c61478

                        SHA256

                        7979454486bb05209a6d933419d91e1ad609750d2d1c1e2df7660ac02dfc6e14

                        SHA512

                        0da67568e72ce07ac228ef86ade36f48d9eba62e07bf60dcc3dbaa86589ac0324b988d60ad4c2f84178ef853219b1d6fd73a0bc32b9260d9fdc3ac4c082aae75

                      • C:\Windows\{7C05B314-2671-4dec-9F55-BFD868DF9E70}.exe

                        Filesize

                        216KB

                        MD5

                        d41dcedb52e5d60b15ac9b017bbb5015

                        SHA1

                        0fdc97b0e0e4bbbfe628115fb60c4345eb9f56a6

                        SHA256

                        a585db4a1bf92129d238c0daa5360e674d3c76c4636ce9488f1859498867e5a1

                        SHA512

                        c92be9ba4594a52a11da5140a1c6662d34e570510c0e2d97262dbf38433fe5cb62cadc8c6cb571f7862911186f601226104b6ab95ee4e869d24b0a4a70bfec70

                      • C:\Windows\{7ED95881-8B6B-451a-A946-4C854609336D}.exe

                        Filesize

                        216KB

                        MD5

                        d9d7b7107bb58925b86abd385a5b8b14

                        SHA1

                        8ccf7d6fb4e65c3eaad0c1439c89d23e0650b3e6

                        SHA256

                        d07f5760c0b109ad0035da514a813a07815616a2a94b879203ec32b8a998fb45

                        SHA512

                        24aca3af25744963ba7ed98fecd92c9a79583d53272dc9afa6d9e4f7a21b537a2db24ca997e859e252dc2690a91e521054a1cb447d6e289efea54b2ea9e9cbc7

                      • C:\Windows\{A05E7274-29ED-45bf-B5C3-68327BE389F9}.exe

                        Filesize

                        216KB

                        MD5

                        433db0b21e8fdc0a9d5da9516da550bb

                        SHA1

                        fef7d9d50ad25ff0f29358fe8da74e2a1077e487

                        SHA256

                        ab1774aeb4613100b67d17f3b1aaa87a00a0885cc4e6b01d7df368b315b66529

                        SHA512

                        b689feec514c04b8bba4cc8dc442f69b02763c9ec4b1b83c677132f8b5e0921a1cdfcf710e4b8a5efe598eb921ea618ce9a910f94362580226b62312de6272d0

                      • C:\Windows\{DA9B1730-7AF6-4b76-8189-EDD6D8728144}.exe

                        Filesize

                        216KB

                        MD5

                        0a37b1f0817900a94f86608bf48a8954

                        SHA1

                        7c0ea1cef96f3b60760b783667f0db450d5999f4

                        SHA256

                        95e342dfd839da75219dd59e40fbabd3303f5616fc8b2d721eda14f261c89c8b

                        SHA512

                        3a9173cb451fd55401ebe8f212acc41b53ff37680a498a64b3b08ff9c1b25b5caa5f86200f78e4b8a846dabbd3bac5e7ee7c9a5d84429a5d7d8f0362d4981f5a

                      • C:\Windows\{DB477A14-F45A-4aa4-B1EC-5061586F755F}.exe

                        Filesize

                        216KB

                        MD5

                        a204a1e9992ca4b30c76c2a3537fd072

                        SHA1

                        2434c2598d92ac3f8a1b4a8082609731b5a0ee5f

                        SHA256

                        d8a6865cd30f9cefbb3fec8c4e84706b48dfb80488c34f8149807c07581e4c76

                        SHA512

                        b1e4d929ed73c8bc82733ebeb09ef5a281cf95d548127b469051b29466dbaaf490c29718c9970b0bceac6a1a9678abc6dfcf0a9bf13d16bf86b4bce3e0b9ebd2