Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 19:50

General

  • Target

    2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe

  • Size

    216KB

  • MD5

    ab7979e053e0ede9be79b519d214bf3f

  • SHA1

    639e81bc22dd049fd5381c53d88b7c54fb84c40b

  • SHA256

    e2114f8c89797588def452c718ca697e3b20e0940c8f9b1ff37eb365d1854be8

  • SHA512

    be06265ec58caf1ab602ee45ad6ad7b1c62264f45aefed5ad87c577aabcb7b0397a1428f07600bb743de0a3caf8c8dbf38addd052c1376de4a617885def69d64

  • SSDEEP

    3072:jEGh0oEl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEG6lEeKcAEcGy

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 22 IoCs
  • Executes dropped EXE 11 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-17_ab7979e053e0ede9be79b519d214bf3f_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
      C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
        C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2220
        • C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
          C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2972
          • C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
            C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4176
            • C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
              C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3376
              • C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
                C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4656
                • C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
                  C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4976
                  • C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
                    C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3128
                    • C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
                      C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4088
                      • C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
                        C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2976
                        • C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe
                          C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe
                          12⤵
                          • Executes dropped EXE
                          PID:4204
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{8BFC4~1.EXE > nul
                          12⤵
                            PID:4108
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{44D68~1.EXE > nul
                          11⤵
                            PID:2532
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6CA15~1.EXE > nul
                          10⤵
                            PID:1600
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{EA4BA~1.EXE > nul
                          9⤵
                            PID:3240
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{DED34~1.EXE > nul
                          8⤵
                            PID:3672
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{6FE9F~1.EXE > nul
                          7⤵
                            PID:3456
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{27D83~1.EXE > nul
                          6⤵
                            PID:5072
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{D1830~1.EXE > nul
                          5⤵
                            PID:2824
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{1D862~1.EXE > nul
                          4⤵
                            PID:2740
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{7A5CF~1.EXE > nul
                          3⤵
                            PID:4540
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                          2⤵
                            PID:3832

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\{1D862842-BD3D-433b-B076-9C1E7608DEEF}.exe

                          Filesize

                          216KB

                          MD5

                          c3655887d476261b12941b4656bdc8a4

                          SHA1

                          43b2444a799d9e7b81b04b27ac8b384d436ec197

                          SHA256

                          363464c8be56c53207091628357f00dec3805e75f85b48c459ae34519cf71b89

                          SHA512

                          dd5c79b534d1f797557b440ee0fba55d5254cc2766e93c029d9f43f437fe13d8d10238247d063ce443915e08aad9c8d00cc42b09ec36444dc79c59f9e2f07330

                        • C:\Windows\{27D83BF0-D299-4cad-B646-59F03E24B238}.exe

                          Filesize

                          216KB

                          MD5

                          12205b946b72b9c3746cc7d11ca7e1c5

                          SHA1

                          8565febcf66e449f77ff3ea781ac14f6b70e8469

                          SHA256

                          e9ebedb686c60f33b240d3a0943c25c9fb68ad4aed2057a23a6b0c56390162d8

                          SHA512

                          712dfdcf35409c73fe91fdb4fda7e7225a0227671e782d584e9f07c06cabd84772c8c0d42d3a3fb1c4be121091dbdcbb36463d533da2d1aa7bea0810240d7afc

                        • C:\Windows\{44D68A13-8C7C-4319-8114-389D641E6E2F}.exe

                          Filesize

                          216KB

                          MD5

                          ab85c5bfbb0d0bb9414316012647271b

                          SHA1

                          da2192e550fc1c3f5c5d6798f3d9dab2e3f1b199

                          SHA256

                          78bf3486a89ba07239bfc95dc83a59a6f9fb2c9768d83b08718f7b51fcfca487

                          SHA512

                          15d4d6756c05067895e914b1712a0553d1f1ba8fbedc8dd1ee98dffffccdea5c33ba2d8fea29be6b78cd6fb4e0883830336100b3c2277af04619a9ac57cfe214

                        • C:\Windows\{62F0641A-141B-4ec6-B63C-CA95E34B4DDE}.exe

                          Filesize

                          216KB

                          MD5

                          2c77d67a8401b226991c34a0380c0184

                          SHA1

                          d4ccadf6e3496335c5c4ec65fe094b9e0e51192c

                          SHA256

                          63d6a7082f7c454f1a4e1fe60a0607f6e7d373eae654d8383224fd771e38d632

                          SHA512

                          87a00fa8325adaa63368098d8ede82567eaaed604606a77d45c7e6bef75cd070f22ce7a8e59e98dc54059981b4bfb8bfc2c9a32270fc774ca00ea8e00a6b72d2

                        • C:\Windows\{6CA15D92-14F1-4a6c-8865-58BA9A59B553}.exe

                          Filesize

                          216KB

                          MD5

                          b2d973ffd33ceb990bd135db35ecfac3

                          SHA1

                          98ed17542f6960e61d69a295b3d3b16af08c3b7d

                          SHA256

                          0c1299145b308970271a0558942978ee3c1210ec8f2a1b11a87248e0620c2b52

                          SHA512

                          7a76c0d6666e43869e17f21df698b5a3418288939b5c26f8540d4b7d54fcb163b9be09430ba48a592e4e6f664624a56cd90f5b39c963127038c5ddb128f546f2

                        • C:\Windows\{6FE9F6F1-C7F9-4225-8C27-F1FF794A4759}.exe

                          Filesize

                          216KB

                          MD5

                          8bebb33b99d0c86ccbe6543ed80ba4c4

                          SHA1

                          d4cbc73a665d3c15ca8a46dd7228048d7ee57f7f

                          SHA256

                          60ab97591aa344c48f1145c66cc8119ac39fac828e8d0e4167789c17352b5167

                          SHA512

                          5e747237de024dafa1c92321aef48ef916fae7e142104e1eaefc601d23f2394838a429fd02c6e11c7fc5eb5971b58078d229065d19beb4b9ec2ed78824516256

                        • C:\Windows\{7A5CF9EF-215A-4dfe-AC59-BC073E1097F8}.exe

                          Filesize

                          216KB

                          MD5

                          2b3db6ecf13037301804b382f2f8848b

                          SHA1

                          37755416a35537e7d33c1678ad757affcac11b71

                          SHA256

                          bcaa74a575ba48dccc76b1e0850ddc753c3eb47cd9ecd0aad381f1628bd5c4a1

                          SHA512

                          c189d2d71d6b6eed1675d2b2208ad99b51ac5725f39c5b057f260bd033fcd304827efe8ff2182e137788c304feb950b03eaf51aea1280737f71c73e1b0bc680a

                        • C:\Windows\{8BFC415C-F904-4fea-AF6A-66AFEB2D2AC2}.exe

                          Filesize

                          216KB

                          MD5

                          9b3284015d0091f806708a68ac828076

                          SHA1

                          a5063f1ffead6f77b4c4cde1a1b135f36726a7fc

                          SHA256

                          5f9d9de224f86015795897dff545c1d1159d9d6eea9005c637d73c657e5027d1

                          SHA512

                          a297325d7c279aaa8109a6df7cf029bc64b12a5c8631ea4928f5f018665c7a351f3a22f702360c4976b5f5cdb80f07ddfbeb0312d92c0bada6ccb16c56629d64

                        • C:\Windows\{D18304BB-AF3C-4d9f-9451-6C65E9C3710E}.exe

                          Filesize

                          216KB

                          MD5

                          52efa711c6f6e9b979f54f4b913548e2

                          SHA1

                          5314af5093a7b0517ed32d5d0acc60852516ae25

                          SHA256

                          299268bdd8558e34c38c8556e25ca6a439e7f6b9b2e5d6eba38d0c8ddf7ebc97

                          SHA512

                          8424651e52ddf4c36120387ad7d41ca77371fb4cab6de7bd1b370b1fb514fa8d470d5390a434f804a38221f9de6d68e005eff96fb8665ba2180a927b0fbf3f03

                        • C:\Windows\{DED3417F-24BB-41bd-B167-B027CCFC35EB}.exe

                          Filesize

                          216KB

                          MD5

                          03ff14f268bed3de3d1835c29525dec4

                          SHA1

                          5a5d38770b91ab44f7a230e11bf6c8d7a2ac2985

                          SHA256

                          a40efab0966d48bdb4c124e2548f9647c1b7f143b9ed337b7ce9e712a981b105

                          SHA512

                          5adfee9a8bdb0b2343e2ceee39df3a49b156acdfb5a41617e0ba4749f3e3eb69a7edd4f6181c860efa8d6cfbe3f2d6caf79db5e6d80adc7903a2c0fecc7befc4

                        • C:\Windows\{EA4BAF81-77EE-4915-A748-4D87434D53B9}.exe

                          Filesize

                          216KB

                          MD5

                          fb2606b3c999d1ae7ce5dd4f3c3d5e70

                          SHA1

                          f9ee813a8a8a006c5a53960424e890a2aa56e726

                          SHA256

                          bdd530bebe899e4b5cd56c7cff853217b6bd14a69cff3de502c279e7c636b3ee

                          SHA512

                          3d53d2c2f6f33e7ecbb51e0ad0e70b5f1248ed45902da131453d1617d379564cc9b0854a82030fb6622c29148e6f65163ebe1bf12c5268c86e2b7d3a87b678fb