Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 19:58
General
-
Target
2024-04-20_be88e9f3659ed88417a027d48a80c7c4_goldeneye.exe
-
Size
372KB
-
MD5
be88e9f3659ed88417a027d48a80c7c4
-
SHA1
21b78812b075d8cd235a9fe48c23d9bc5ed4d5b2
-
SHA256
8dc285437443f7230148981a2f7d866060b56e514f027e376fea66ae4e6e70d3
-
SHA512
75ad84997565917dad634015531ca3eb848f861cad5b93a50c5de9312841db605f01a0cfa3310ae861939451316a76a0e1854ce7a5aadc2ff7e70aa78086f2d1
-
SSDEEP
3072:CEGh0oNlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG7lkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_be88e9f3659ed88417a027d48a80c7c4_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_be88e9f3659ed88417a027d48a80c7c4_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D58A931F-69E2-446a-9108-77143AAE1743}.exeC:\Windows\{D58A931F-69E2-446a-9108-77143AAE1743}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4BDD1E9-A00C-40ab-80D0-72BDDB32B732}.exeC:\Windows\{D4BDD1E9-A00C-40ab-80D0-72BDDB32B732}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73FC54D3-AB4E-4a97-B31D-180B4524F9AF}.exeC:\Windows\{73FC54D3-AB4E-4a97-B31D-180B4524F9AF}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B3FFA02-7765-4569-A0F9-4A5C5CD4DC7A}.exeC:\Windows\{7B3FFA02-7765-4569-A0F9-4A5C5CD4DC7A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8130B0C-6266-4828-8C84-7267BA61727C}.exeC:\Windows\{D8130B0C-6266-4828-8C84-7267BA61727C}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FEA64C5-EC79-4264-B9AB-4391112E2718}.exeC:\Windows\{4FEA64C5-EC79-4264-B9AB-4391112E2718}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E9F9B3A-2594-46f5-889C-5D61FCDBA756}.exeC:\Windows\{3E9F9B3A-2594-46f5-889C-5D61FCDBA756}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5835B9F-D7B5-4642-8540-329EAD794999}.exeC:\Windows\{A5835B9F-D7B5-4642-8540-329EAD794999}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED543E0F-6684-467a-8061-FB744A5BA80A}.exeC:\Windows\{ED543E0F-6684-467a-8061-FB744A5BA80A}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E214105-DF26-416d-B6EA-410A576BAC34}.exeC:\Windows\{4E214105-DF26-416d-B6EA-410A576BAC34}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3B571B4-BB04-4d96-9752-0A26541FCDF9}.exeC:\Windows\{D3B571B4-BB04-4d96-9752-0A26541FCDF9}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9D7DED2B-FC6D-4e15-BF21-EAA45E1B98E7}.exeC:\Windows\{9D7DED2B-FC6D-4e15-BF21-EAA45E1B98E7}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3B57~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E214~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED543~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5835~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E9F9~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FEA6~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8130~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B3FF~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73FC5~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4BDD~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D58A9~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD53af7738191dd9f880658f1a634a81ee8
SHA1e46abc041dede3117206266554a05d033ac66107
SHA256cee2aba28c48baa51c55834a955468217a9af16c1bdae0fa3f63306d6f9cd77f
SHA5128692b1271207d5efa56d39b1375c8b054d9f48f76ce64878620e325f60df1a069ec36f2ffe0366bddfac435d4f1267209a74749f57feb893027a97499c6b4c80
-
Filesize
372KB
MD5ab10f6ef396598036e14e460d2bd1b57
SHA135ce5592abf0c0b31fb4f1851c1ee5d3435e06a9
SHA2568d405fead9c8d4480642e814efaf00fc2210f4b97e9b856c8c3e1028352b81c4
SHA5128bf3cf4a6da7327a02a662a3aec4676ce87fb20dbbf5b84e254ade31184b94ba83c8a935132046988102093d3aa8fed8e343fc911601e38918ba44fd5722173c
-
Filesize
372KB
MD55c8cb442346a434b4ee3ec4c61c6f90b
SHA1bb460b3bc1b7de8ef8863ae0a16c087b7abbd0fa
SHA256a39b223733fe7104fe2cf93fc89d8a0a2e90f90af0e5005c6981d6cdcf813435
SHA512bd8bb3eeb96287d6522d02ebe02a51d4b96f0fb63cc4fc600652a5cbbe40a66f4653efa53b7bdcb6df432fe8e891024d4373e0c5a64fa43d71c58239ce7812c8
-
Filesize
372KB
MD57eeffb0a008ffee474097754137c0c04
SHA14988e31b4bceabf222fcb7c5b0dcdd9fc88873ba
SHA2563a615e44870278e82de6fe1711d20f94ab2b9d4be303e0d6e9c3d3a6b50f1bd4
SHA51252e24d3d33b646f77a0d1a7b86efd67a2a20468a772966fc22824c60ff28f47d57b3e1ac6987a20fddb84d7481973ae4084037b6f0bf45fe75ccecb48b90ac8e
-
Filesize
372KB
MD58531bd59ab8e1ec5217be4d071595a3a
SHA178e51220f173ae5ca2e7cc4bfae9b1a40abd3d6e
SHA2565e47af1b75c8ae9ca90f9ccacf69ed4ed8d9abb18520c493f93e5be8bddda61d
SHA512a8f3a50fafaabba8638e859fe932c03e371656d57224328de80df0e249a6babf809f34c790cb157a9bf30db64db5bb4bdb1cbabd94444b0fdbe9081b98c8df62
-
Filesize
372KB
MD5a96b7aad185647590e34e083cf3d1f5d
SHA10acb78a469bff7946288c1620f5fd0b888111b62
SHA256e57ad291c44f75c3fdcd3b191ef28faaac282d8738e99692b39bee369fc669b8
SHA512b0fc883cbf3c0e0a468f226144fcf8c6f24b84554e25a2e12c5bb38c38754c52ee0b482c53be2d39be90ca59cfa220b428a2f77ea4de24b74985794ac03bf837
-
Filesize
372KB
MD55b727558203851b6cf7ba5f387b8a1d2
SHA186161f13f261fa13d56a92be90f12a6d019f689f
SHA25650fb9005ada5afe623a05378aca4b1738e299f1496e69a8a7b2bf582948b9d16
SHA512b8ca0ba2175b90b1deb88aa7137c77e0db5586391865d338eb10a2294c0365ff0f6dc7de6bee5d70b330ea7dc6351fe1378e93ae7fc838a4291ddb4da7661168
-
Filesize
372KB
MD53984147b0a0b390c12c874a7bd6a16cd
SHA1b535dd938807f30ab8721c311a5a3967b85c5ad5
SHA256be44732f89a1b4c5e8b114a39e57b09b116ba0df3e18790caa2725ae2ef685b9
SHA5127fab9c129f15042583757b7cd22179a514a508392a0986011ebb210972487dec029873ce6a131da26bef265ce627278ead7af91ebb235aef2d502dff706c7e00
-
Filesize
372KB
MD5ea6ea9efd1efb0eea8104e2aff7a31a1
SHA17532f7fa46f53b0727c305c5ce30afe26228669d
SHA2562f834a60ad6fec9218cd7c56db4012c5007fad3fb762e7dd5af106258abcd4d8
SHA512880f66853b4d08449058d9ce11cb2570e6c21d56ac14837c93268ce1034e9e642b68187bc15c7878ede788bb7c75bf9e79cd21c39b847f3eb142defbf4747d3a
-
Filesize
372KB
MD56e84022a7aadbe4c98466b0bb1762f3b
SHA1626e4658a8cf5ebe5cced8df10e5c30dd061f3f7
SHA256004f271fadd3615af383b49b3cf95455e23366c85b432247a11b67d24ca84dce
SHA51249f43f1160456bd650f7734266223b5defe29528d244f3ca2461b44a086fb659d077103b3c0fa2d0e1276931c3d66b86acb8146e47ba97294937ff7efa6ad37b
-
Filesize
372KB
MD5467c614eef9954ee3fec298283bb0347
SHA132b0109fce2dffbb3e9c2487d2503fa67def64b3
SHA2560ba6ec62357f12cfbd66a605f28b3aa608828b64513be05296564a6de6cb088c
SHA5124338a4357fac7f136b48c63288a4019680527832701609b8807b5724143393c70549beec6850d051db6da74076357f6c46fb817e0531dfd31936d01a4f9fc749
-
Filesize
372KB
MD53b10f33c2210d84b4726fafab4b4e92f
SHA162df6c2db4c08878d3222ecb9314ba18b6e88648
SHA256d912a5766f443a9bc90668fb2e65e467ed3fdd3c4e2e40593c5559dad5007d9f
SHA512b5cf3fbbd87d597c43e821dde146e375891a3d8cf3e6634d4fe5e1100b4079e48ee50d3376f59d30501c6c8b030e1c9d10977d9448b6ae3c63c6dab064f75298