Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 15:24
General
-
Target
2024-04-17_019c8a65489a527e9ecb922e1f7bdd7d_goldeneye.exe
-
Size
380KB
-
MD5
019c8a65489a527e9ecb922e1f7bdd7d
-
SHA1
4163253e449f2f36c764fb6dc7d572438ebd50c8
-
SHA256
2c742682ea48a9372e9a632cbdaa1f9814f739d1efd889db6722937476d12e04
-
SHA512
29a12b2cea1f3726f4ef2148d4c30f5ef8f1b9bf8237a3400a4f8a82d833e58cd4109254ae9999865a0488ff45d1e48588481a45a8124ffbd2d6436e0b0db2e7
-
SSDEEP
3072:mEGh0o3lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGFl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_019c8a65489a527e9ecb922e1f7bdd7d_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_019c8a65489a527e9ecb922e1f7bdd7d_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1E803A8-9EEB-41b7-86F8-4D15A8BD0E07}.exeC:\Windows\{E1E803A8-9EEB-41b7-86F8-4D15A8BD0E07}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C5B34FE-CF4C-449e-85C4-712483E75567}.exeC:\Windows\{1C5B34FE-CF4C-449e-85C4-712483E75567}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9DA526B-4148-43f9-8C7C-A85BEA321757}.exeC:\Windows\{C9DA526B-4148-43f9-8C7C-A85BEA321757}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED3A2F78-BE2A-4771-8C06-41B9B0D7312A}.exeC:\Windows\{ED3A2F78-BE2A-4771-8C06-41B9B0D7312A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0036DA7D-A76C-4b06-9FC2-C2B38B8768AF}.exeC:\Windows\{0036DA7D-A76C-4b06-9FC2-C2B38B8768AF}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08D5C3C1-A3D0-4fce-A7C7-DF536B153E6A}.exeC:\Windows\{08D5C3C1-A3D0-4fce-A7C7-DF536B153E6A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED78009E-3F68-4900-9A06-BC78E7474D44}.exeC:\Windows\{ED78009E-3F68-4900-9A06-BC78E7474D44}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5F338F4-D7CD-403f-956E-82906C372710}.exeC:\Windows\{A5F338F4-D7CD-403f-956E-82906C372710}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19CF9B7D-B1BB-4dac-B0F9-DC19114230A4}.exeC:\Windows\{19CF9B7D-B1BB-4dac-B0F9-DC19114230A4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD910705-A19C-4c18-98E7-29CE87636CCE}.exeC:\Windows\{AD910705-A19C-4c18-98E7-29CE87636CCE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8AFEF6F-50CC-4114-9AE2-A587B743EBC8}.exeC:\Windows\{F8AFEF6F-50CC-4114-9AE2-A587B743EBC8}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{699E27E9-E7C2-4ddb-9289-7F2908762514}.exeC:\Windows\{699E27E9-E7C2-4ddb-9289-7F2908762514}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8AFE~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD910~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19CF9~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5F33~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED780~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08D5C~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0036D~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED3A2~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9DA5~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C5B3~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1E80~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5ad29282ef728d51b7a68c95b03b013cc
SHA1450a6f7fe0abb23764864bb7dbeda3247eff8e1d
SHA25601fc140dff9f1830f70c1a6712d9d7f243533a6be54f3423c2a432a17f0dea4a
SHA51232a878f994988c077194ac3d5ea7d4b11a824d6d52bd3697ecbb093e2dc9b989d5098b1a36d83461264022e197004be8310dd4d820b3f8cc2395d2575b8306c3
-
Filesize
380KB
MD5da60e12368d34fe313fd003820923d8c
SHA10bd62f9208cc43dbe085ae3d473600d9354daea0
SHA2563226e46195992a529dcc858ec13d5cea31166e7b771a143c8479520ca4176108
SHA512617938876f3b8ff05cbe65a0b133986b2e21c4e8064fbff84e1c38f87af6c63e3aadad388d6576c0228273b2b504be290f3e3eb3a30f181e319a86e4e9b7ebd1
-
Filesize
380KB
MD51621feca287597e150828d7f88a7578f
SHA18221f4a51511e5639d727041ad909141151830b4
SHA256cc2de7322ff83e04f6a725e49847e36bf1ac379bef9232598ed9bab0a398312c
SHA512be9b0007a75bce95ac1eb884dc36a2d2e1c242c928bd437db40a4f712ba487bdcb71bdc3a3ca57ac78dc378db0b8aa053854470ea340bd7c1c3a5a305a11914e
-
Filesize
380KB
MD52d34c52d71a79231bf14539685a78321
SHA1b4ade6998776f6e3976a5993470fb4d530322234
SHA2560044c3cda5e6b7c67881ae9ab223c5565160732d4691e8d24084e929768925da
SHA512e94c220d6ea40c4da2af4b2a4cf0e84e30883cb402beef5ddf278a1c87858fde6023153f0c27cc48e2982cd5d025ea6432a855fe7f8ee5199b03f79a8ffb7df0
-
Filesize
380KB
MD57bb461460ceba1687ac5588670bf3d0f
SHA175dbab5f250cd368f90cb46df0cfa3240d16f37d
SHA256c3197ab62bce91fbde4e9d1af3fceef6a940e59d0b0d96fd674914fdac039f92
SHA512035a74108d3953e99270822a62100202de0cffdaf73168252b9bc1bad30f8c29a38f432cbd996ae820a470b1f51bd7fa3dff54b29f5ff5c93d7f4d872333342b
-
Filesize
380KB
MD5514e852ec24dc48e11eba12470e3ddab
SHA1b3a7ff61c1ff7c3e4189e830b39804324e9b09a1
SHA25608818982ffddbfc1749fb6af383a72568a0aa0d80bf011706fc2b2cfa1bd2f47
SHA512f3e5bbeec54c42c43b2a4c620240c4a5836dc3f58a8a48aeab2c9ac6ebdec5a3a9028a4c6a0b63810431ff4e9e2104c98ccc9bff9d1f389e54ab9edbcfb584b5
-
Filesize
380KB
MD5a811972205b4aae7acbe52901c2f20ef
SHA115445826c367d773881ba35a9c5b31f7da84be5b
SHA2567b669ea4f6ba912c7624dcb7abb6bc9ce2ac2f4485dc0ca19b3bf27960d1c8e3
SHA512fe349a1719ae66ff2eab9a62752f723786be342fc0c57124eaeaad91f6355720b55460870c2f8d0eb1c1d6075adcf23ad73d3c53d7db755f863f1121bd8cb13d
-
Filesize
380KB
MD5426b23fa07d79b727d2030203ec0f4f8
SHA1eba1852b30259b036df72c161d1e0ec7409a5a4c
SHA256e75b745648dc84daea84eeb373debb021e3425252241b8bbc8bd163ad7f9735d
SHA5127a9dbe104e46aea71ac602f743ca32b8a4409c1578983e2f7998f8decc69f64bc278796387607bc263100f6066d2ea608c47d840b91b0712f4465fed9de4dc32
-
Filesize
380KB
MD5dc38189f358df5bdb2368ff5b345ac23
SHA149e4bedbe7342a5dd7ff3834e97a4e83f049d183
SHA256c359b01fa6833e838fc8f420b23d91e069f54a710aa7af9a4b8097d45d3f7e46
SHA5128bc489b1fe88eb698b1f2c949e6d7e116919e16506fbd74bd6fa8d5f9108791e11454fda4250a186ec4737ea677997c38e56e4c5ded6e25973e185e37653d7fa
-
Filesize
380KB
MD5f27db4a6924312a6f63be479fe42c1f9
SHA1481096b7cfa7e92d83fddf43ea087ead4bda0065
SHA25619cf02cd0e9dbf834e697b299fe5fce1be123720d1114f8c6555df893eca8506
SHA5125316f2a928531fe9f4ba5062b608edafd29dd7367487b8d1d87af50300e82a286ed0dd0c758cb39e1cca9e16f03c8df764b4673dd23fb38c5442229590e09be4
-
Filesize
380KB
MD5f36f16549397025ac5d3d9bd45e501b2
SHA1d18d5d25bc59eb5579f2d57c38cbc423e49b6bcf
SHA2565f2b0a97dcd79f41cdd633b6132e539bbbc8eb70227fc06033b3d83124d04141
SHA51275af14d285de480159b50ee31179fbfa62c76f7871aa646e7bb271babf4d5ba25b088f4e55eb59f3e89c5a62edb49f3f7ba521fea27a8b53c50792ff5f7c1d6c
-
Filesize
380KB
MD5468e09ff8a55483d212002d597a59d27
SHA150d9fc1b34b46a95e3b9af55c3fbb6019184991c
SHA25693ae95bdfc343004d77b344a522e5020f0a9f365a37b91dd4c5773dfbf984598
SHA51247bc1ea75708512194158b9b941df54bf5bb128654a5763122fd20964e07f88ceddd74170596b0bedf8a1c612e004af656fc53df41f0b0b2c094e61700f4f8f1