Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    163s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 12:26

General

  • Target

    2024-04-19_19ff94abde1f2f976ede0fb076ba666d_goldeneye.exe

  • Size

    197KB

  • MD5

    19ff94abde1f2f976ede0fb076ba666d

  • SHA1

    30d997c7010e392248833444410a3680f8a80b71

  • SHA256

    1ee7387805bdfdb6d145033d4c5df25235eb204f81699ff69613b840922f8c52

  • SHA512

    2890da9ceddbc6528107eb161f876cfaed015e1e1084320d4e4254cc5cc02559927e252d5494db366e61f155e6f8965415bb074c5bc43814809a4202eca87865

  • SSDEEP

    3072:jEGh0orl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG5lEeKcAEca

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-19_19ff94abde1f2f976ede0fb076ba666d_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-19_19ff94abde1f2f976ede0fb076ba666d_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\{9615AB74-9258-4921-BE87-94D61C975FB4}.exe
      C:\Windows\{9615AB74-9258-4921-BE87-94D61C975FB4}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\{4F6F3536-FC5B-404a-83F9-0E179A62F2EB}.exe
        C:\Windows\{4F6F3536-FC5B-404a-83F9-0E179A62F2EB}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\{8C8FED8F-88CA-4f93-B215-A7A8EE2C9CFE}.exe
          C:\Windows\{8C8FED8F-88CA-4f93-B215-A7A8EE2C9CFE}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1292
          • C:\Windows\{84455BA4-9931-43ef-8DDE-48B00CBA1838}.exe
            C:\Windows\{84455BA4-9931-43ef-8DDE-48B00CBA1838}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2792
            • C:\Windows\{8E110445-950F-4206-876D-7F72012C4371}.exe
              C:\Windows\{8E110445-950F-4206-876D-7F72012C4371}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3012
              • C:\Windows\{F51AB4E0-06AC-4a5e-8494-8968DF5E9454}.exe
                C:\Windows\{F51AB4E0-06AC-4a5e-8494-8968DF5E9454}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1996
                • C:\Windows\{24293A5C-D7F1-4048-BB28-CD8270434699}.exe
                  C:\Windows\{24293A5C-D7F1-4048-BB28-CD8270434699}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2500
                  • C:\Windows\{61F7F39E-063D-4562-9282-BCC587B111B5}.exe
                    C:\Windows\{61F7F39E-063D-4562-9282-BCC587B111B5}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1608
                    • C:\Windows\{10C2C68F-BC58-4b55-BAFE-AE0209B7E554}.exe
                      C:\Windows\{10C2C68F-BC58-4b55-BAFE-AE0209B7E554}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1384
                      • C:\Windows\{C98D13B5-4318-4ac0-A28A-F3DC7E22E362}.exe
                        C:\Windows\{C98D13B5-4318-4ac0-A28A-F3DC7E22E362}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2092
                        • C:\Windows\{740B7DD7-7383-4c77-86B5-023D0ED182E8}.exe
                          C:\Windows\{740B7DD7-7383-4c77-86B5-023D0ED182E8}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2264
                          • C:\Windows\{FFE8DE68-BEA7-4046-8E74-6177C9EF7023}.exe
                            C:\Windows\{FFE8DE68-BEA7-4046-8E74-6177C9EF7023}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:436
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{740B7~1.EXE > nul
                            13⤵
                              PID:1520
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{C98D1~1.EXE > nul
                            12⤵
                              PID:592
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{10C2C~1.EXE > nul
                            11⤵
                              PID:3020
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{61F7F~1.EXE > nul
                            10⤵
                              PID:1712
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{24293~1.EXE > nul
                            9⤵
                              PID:1540
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{F51AB~1.EXE > nul
                            8⤵
                              PID:1388
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{8E110~1.EXE > nul
                            7⤵
                              PID:1656
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{84455~1.EXE > nul
                            6⤵
                              PID:2216
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{8C8FE~1.EXE > nul
                            5⤵
                              PID:2780
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{4F6F3~1.EXE > nul
                            4⤵
                              PID:2416
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{9615A~1.EXE > nul
                            3⤵
                              PID:2444
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                            • Deletes itself
                            PID:2856

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\{10C2C68F-BC58-4b55-BAFE-AE0209B7E554}.exe

                          Filesize

                          197KB

                          MD5

                          10f54c98fb08c7107ce393d81c814f5e

                          SHA1

                          1ab1f5f899644d20cd8d92e0b864077dedf144f5

                          SHA256

                          f69aef79d2f0d1568d78194c008e5558aa45b6c0a766eba7a63d5f307b689cb3

                          SHA512

                          d0e6e4adc6a84fde0d478bd6951468c0da7937bf845f65f407f125f80418535496b9b17f4946752df8abfff5b17ee2478f0b48ae28b514180dc1723bc3f42a30

                        • C:\Windows\{24293A5C-D7F1-4048-BB28-CD8270434699}.exe

                          Filesize

                          197KB

                          MD5

                          edfb1275e01400b3706be6246f3c5865

                          SHA1

                          f575bc6c6b2d56e79ed845f8e97e366816ed23eb

                          SHA256

                          5a9f9a0db996f023481380998f63724bf63bb490b026700ef55e8c0ed95189bd

                          SHA512

                          2799143073f7033181a5a69b9b884d74b74e36b05c33cf170d72f9ddc62f4ef49fcdfa520c3ae1426ace71b870a7074267b860555cb3572609e35babb72572b6

                        • C:\Windows\{4F6F3536-FC5B-404a-83F9-0E179A62F2EB}.exe

                          Filesize

                          197KB

                          MD5

                          c3db96df45196a40c294ce2a7bd9807a

                          SHA1

                          42fc6d42daf5935c655fb1255d1ed43830eedae5

                          SHA256

                          c4d28dc8b184c5727a31509ba243ee717c884c5728db61d0dec4ba6c02cf6f55

                          SHA512

                          993af84a4370c4ed6bb4df522ae9feda469a748f242f8177df5ae1d9684e9dc57f64d8936482ffb0f015af271bbc98de56a7ffc74b2da7d01ce1cd8680aed5a1

                        • C:\Windows\{61F7F39E-063D-4562-9282-BCC587B111B5}.exe

                          Filesize

                          197KB

                          MD5

                          8a2f3a47a649addf80e67c27f5ea921b

                          SHA1

                          7c5334d7c0932afff329dae4f54e6d08d7496ee6

                          SHA256

                          cf1d8538a6427b4ab1be9ea38fba9908ae4d8316150eb0283eb23f6965298fac

                          SHA512

                          1c52b4804b8b023a998bfe335f91cb5c6ee60e8bf3680f565458415443fc48743c458eb0340b1efa3b922bd36c65368fb8f5688179e01e8223a7e30517f1d67d

                        • C:\Windows\{740B7DD7-7383-4c77-86B5-023D0ED182E8}.exe

                          Filesize

                          197KB

                          MD5

                          079a6f64e23570ae17d6804eab4a6fe4

                          SHA1

                          456cb6a48bcdc32f9f5302e900d1531289ee443b

                          SHA256

                          eedc68ece9501088b4dd62f4697824dbddd6188204a9487cbcfa8e9a0be1508e

                          SHA512

                          0d4fdeaa7e5089383fcb30cb2fdfe2a198e31b15a464d3bb2a3ec4d9704aac6608f413a018ce46a940e3c2d1b3fcd071817aa81501e48699b6f6b196c46cb723

                        • C:\Windows\{84455BA4-9931-43ef-8DDE-48B00CBA1838}.exe

                          Filesize

                          197KB

                          MD5

                          2b31de9a552dc43ee00e9519494330b0

                          SHA1

                          e80f0409769e9dbd7ea46193fa632e2170f508e3

                          SHA256

                          5a4b16c9ad91afedca8b897ed2bac36139b600866a83bf7e502c4eb3bc5d385e

                          SHA512

                          0ec7d50ec39819106e8c68f9169b72c52d8c1461d90460b8cb74d76ad38df0ea1211acfeb91fc4afb17d9a4896fe060fe2a4a4b6f172bfa9189f303555c93376

                        • C:\Windows\{8C8FED8F-88CA-4f93-B215-A7A8EE2C9CFE}.exe

                          Filesize

                          197KB

                          MD5

                          7223b835c2b707f73b59d05c2717cd83

                          SHA1

                          f07b08a9a5286538a635412ac88eeb00454cbdad

                          SHA256

                          bc5339dea120f342ac79840861c0b7af65c9b9bec7df62af74c302a12cf16fd3

                          SHA512

                          31833dbda14059b99bbe641c76f4fa45c14f6ec04dcf6d60a82452143cc7aedc13550b6cd3216704230ab24a15ce882f0c9db520569b117379b93183a4c4dd60

                        • C:\Windows\{8E110445-950F-4206-876D-7F72012C4371}.exe

                          Filesize

                          197KB

                          MD5

                          70a0054fdae24ca02450b23db0c6b9e2

                          SHA1

                          398cca838c76d4dfe8f6be77f55f394102fe95d4

                          SHA256

                          e3172b79c5e0ead791baea44613ed3f74fc84d1d91e4b81680c413464e1cc3f3

                          SHA512

                          4775b7b8d6b74dc2272962a52858a48db1da11b4440b13f02ecb135a8fc37757e0378e280556c8d541e62bdb671e52bbc3bb48e30948b3a8d28b582823c3b7f5

                        • C:\Windows\{9615AB74-9258-4921-BE87-94D61C975FB4}.exe

                          Filesize

                          197KB

                          MD5

                          d6aafbe99801755febfd7ed1de3c76a2

                          SHA1

                          920d7012a2097df8d439cd3a858e0acc67a29db1

                          SHA256

                          b10e46d45450b7fc034c7f75a59541bc33454f9117cc2501d4cb1c526f19ff61

                          SHA512

                          2c9f91ee1bfc092a7ffce450c1f0851dc01c1783fb763f1f73cba3cb485d21f12b3ee5ea2d591dda5a027ec54abeb9d11fb945455f34e06ad3e28b44eb87a1e9

                        • C:\Windows\{C98D13B5-4318-4ac0-A28A-F3DC7E22E362}.exe

                          Filesize

                          197KB

                          MD5

                          48d68666a0d809dbf5e9419e0bac75ac

                          SHA1

                          20fba1b42f9553c44396ee863e6a4c9a2bbdd925

                          SHA256

                          1727c36044feb9f420623d96cbfb8e305b2a50b514eaaa94a9b90c66e13fdd43

                          SHA512

                          475a6440c610f2cca780c1f474b824bbe21e3980ea2381aa05ea3549f25d5afe782366d2be3c2e9f60ea637df927aaa6b60492d7a206c1f9dabdc4abd42dd591

                        • C:\Windows\{F51AB4E0-06AC-4a5e-8494-8968DF5E9454}.exe

                          Filesize

                          197KB

                          MD5

                          2db9fece82e030a444e3a63ec2741ce3

                          SHA1

                          f6c184ee5769c6535233516c72bf20ea59bf1dd2

                          SHA256

                          4db4fb1d44de6f3823bb0701222178293e8f577dbdb2637ff9ae2da2c7211f42

                          SHA512

                          88cf4c73eeead450ef43020d5f924f9191b9966fb32fff27d5b57ed4c229a18b07705497a27d70b4c526b0f78b55ba0de5a3df38de554d8c53f5b124e3d4d26f

                        • C:\Windows\{FFE8DE68-BEA7-4046-8E74-6177C9EF7023}.exe

                          Filesize

                          197KB

                          MD5

                          95010e3c197eb638612d799569470716

                          SHA1

                          bc29c00db86597f42f0d62a46ae9d4a052037269

                          SHA256

                          99cd23a974cd9120f53c9a55ed4dc47848e0edf79e40728cbd90c64af64151e1

                          SHA512

                          9bf9ce2c30addcaf4d91f4762baaba48ce549aab7e6b74d84d36735415be18627514e8fdcd4ce16da109f2083f3fda502be8a7b7e86116cd39b3360ff3207253