Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 20:03
General
-
Target
2024-04-20_e7c8f53262da78b713698ed11e4403c6_goldeneye.exe
-
Size
204KB
-
MD5
e7c8f53262da78b713698ed11e4403c6
-
SHA1
89c4322d4d592e303243c0ceca1861c5aa8d2376
-
SHA256
85191e34335b692c38d5fc04abeaca72356354ed7a5f400decefad04dd2a897f
-
SHA512
754d9a72967b5ee9af16c103fe23f700d3098f772adef9e1f7dd1dd6be89e55ab92996f3e37a4a8a5ba98f6c2e87e4d137aee64db9e659ae86c5da0e50ecb2a9
-
SSDEEP
1536:1EGh0o0l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o0l1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_e7c8f53262da78b713698ed11e4403c6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_e7c8f53262da78b713698ed11e4403c6_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{860816EC-F298-474b-AEC9-8C665BFA2C9F}.exeC:\Windows\{860816EC-F298-474b-AEC9-8C665BFA2C9F}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C29AE142-BFA6-4dc7-8872-B29F64F42672}.exeC:\Windows\{C29AE142-BFA6-4dc7-8872-B29F64F42672}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D2BD4E71-A5D4-4e27-BC90-CC4F9A15C88B}.exeC:\Windows\{D2BD4E71-A5D4-4e27-BC90-CC4F9A15C88B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{280684AD-ACEC-46c1-AE5A-346B43DD73FA}.exeC:\Windows\{280684AD-ACEC-46c1-AE5A-346B43DD73FA}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F804196B-CFA2-43e8-A83B-DE81C4EBA559}.exeC:\Windows\{F804196B-CFA2-43e8-A83B-DE81C4EBA559}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54470464-BA24-4ecd-A19E-5D06EF759EBF}.exeC:\Windows\{54470464-BA24-4ecd-A19E-5D06EF759EBF}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F22360F-035E-4d6f-9AA9-6F0250128647}.exeC:\Windows\{9F22360F-035E-4d6f-9AA9-6F0250128647}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFE66556-E940-49f2-9713-4B714DFBC3B1}.exeC:\Windows\{AFE66556-E940-49f2-9713-4B714DFBC3B1}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B41FE9D4-121C-46ea-8F06-BA32CE1265AC}.exeC:\Windows\{B41FE9D4-121C-46ea-8F06-BA32CE1265AC}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C3082F9-1D10-4175-A662-04DA69A5BFDF}.exeC:\Windows\{3C3082F9-1D10-4175-A662-04DA69A5BFDF}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5AE552D1-DCCB-4bb0-B7B9-18E2DECA9C02}.exeC:\Windows\{5AE552D1-DCCB-4bb0-B7B9-18E2DECA9C02}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EBEF4180-5402-484c-9601-BB7B69AF4889}.exeC:\Windows\{EBEF4180-5402-484c-9601-BB7B69AF4889}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AE55~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C308~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B41FE~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFE66~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F223~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54470~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8041~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28068~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2BD4~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C29AE~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86081~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD568cbf112dc336368e848f2107c23bd94
SHA1e5677354792825b7c174476f9cab34b40045f831
SHA256f30939170f053aaf6ee9f2f77f8f566a83e9575e7e3396c1fdadef0bb26f4860
SHA512f05cf788481125d21649a140c1e85bad0b9449a93166ae4f03e2593c9fa751fe8141e676cb3e8a30a01868c1224b451b9dbcd2acfff6b24321b3df1fbc6ab995
-
Filesize
204KB
MD5311be7b447b33b697f5df318eaccf26f
SHA1e469cd894a52b0d9ac1419b56848a0f99ddbfe06
SHA256fdba99055dea6c2cbad86396b1027bdfde38cc2470dd7f10d1eae2fdf8692e7a
SHA51291177bd3e7940023d915d305c7367cc8fc65070b3446a6a99b90d9a40b973d05756820854d456e71d3d386e113c0d985e0ab3221729e2bcbb6b5474fa43c1283
-
Filesize
204KB
MD552afcc22bac243d0b1fc581bdfd79d28
SHA1a47ce6d998287d91e7fe07a0d16c145155ea711c
SHA256667de0743d9cd1bb0e0d50b83932cf2d55772cddd35efaf3232db8278c7f6d1e
SHA51290932cfb3ea5d0b30554348a9007e0d14108adbbfca4d876af3fced6c5197d41e56bcffad4d359c8938b41990bb475a315807bca675b57477b91d0ae284f6120
-
Filesize
204KB
MD50877b03ef150e486c9805bd7a4293da4
SHA1daab2f9c68d5ed113556216fdf716d301718ebea
SHA25662a67e9204bd597998b1864ac42d27ddeeed41f4c104b76d01191292070da34b
SHA512fece33a80b4357c91dd8f2d477352a666a06435f0d27142e65ceba75a871f78a104bf36f9075e6918d818f6f3d54efd4d8868420cd5fd6dce655548ae5166890
-
Filesize
204KB
MD5c0d8fb1857a06da960892134c246707c
SHA19761904632354e9120f672bab873c236ca483086
SHA2566968b66274b636953e297d92fa79f7e1f47c91fd91dea8eb14ec617501e9ae9a
SHA5121720d0f347d2eaa78edec5f517e5dba8458e08830f9fcfe97a0f4bad5ded98aaab0030f1d3dd8ddb49403419d2986c647e7b57b9c959049fe1686326a581d9b5
-
Filesize
204KB
MD5fb8eee6f9cd914873551b743dc4aeccb
SHA10a3b2ff901f78f434ad593ba80cad57069c28bbf
SHA2563c4900925022691a55ba23b511240d16277d8e9ff37150eab7784de4d105bbc8
SHA5129ac9c127479ab43027b08dca3ed00dd25e2d6809266216e2f02b1855a16ab5de2212980726c927bd40aedd5fb52faec07b0c8f9a6f3311ef4a0587b09abe066d
-
Filesize
204KB
MD5992f30cedc75cf3b5854cd35b70d2aa0
SHA18b8c689daef15dd07eef20fc56213133815edc78
SHA256c2835b611ab37ee39a093d458e7aa324eb96dfc015ad979b14ebd25b80151c65
SHA5126d154bfe181406fc8f583c244b6797b48968ee85ebe3d1bd737ab7542d9a13dcd6a0bc88fc03c0c5f6272de0cb8f9df16c1db46e1ca6bd9cb3688a95770ba17a
-
Filesize
204KB
MD58b51194f274f797a1d15aa42528a537f
SHA1f96e29f8ece6e72eed1b230f7276fb49f583b4b3
SHA256fd5c36fe5cfe507533603afded90881e5868e7c4f590de6637434f17ac255f48
SHA512bc682cb73ef7a80b5c492d6e9c581a3c7f9805dde5fed2689752f5a5e9669d84fcf272ab7c05cd87e8fdc467366a8644b4689afba2a3ec43ddf3b818f5a42408
-
Filesize
204KB
MD50da7ade653958533be162bf91e7affb6
SHA11e99678a2664e93c4ab6e01f6aaa0ea4cb2b226d
SHA2568ae004e5767fa69c5681682cc543a4efc35057fbf5a981665402a438b141c974
SHA512b7bb6435eb2df0ec85a11198464652b8566f451cf456cac106227b39b7241760fb742d9bc03cb4bda6d2ab62c7c41415228f48196b2a2fe12b508dfee6b8fc0d
-
Filesize
204KB
MD539862924ab3ece2769cc61ec59586bd1
SHA19bc6f99fbabe17251cbb78a407088e73ee538205
SHA2566660dd15ea77aa3bdf235c2b3b8cf100ee29347c4ef6e35eed80bedc624e35f7
SHA512ea10105054496a88f6c40d9ef752f95c57c036e533fb0e9a3e025bde03627c649964f6701a24d2f90300fd7133f1338bf31bd265bed2cd0d315cfac50aa9e3df
-
Filesize
204KB
MD5e5e0b16fd768d996594a32e9637f146a
SHA1e2c38c84b05d12448790fcc9aefd677f54e5d455
SHA256d8af870612ee48f115aea8d8899c1125645d0d701cb0446f0108629f16bebc0d
SHA5122c45b9359ca27ce2b5afe9f91fe2208d34bbc442266594d6e40ebe709496c296ff7d4b086eda592260b1369a506ef2d354d8f743cee9828d6d8e89c15bf963e8
-
Filesize
204KB
MD5a2f00d4352a5c96ce9683faed74d8250
SHA1061024e5f3c593c2868655350875892596eb9eb7
SHA256b6449da0e0baf7e82575779e316ac105ae7277724abcd38d12f10e09ce07c3d8
SHA5122470c2e88b6d3ab15fb3fe00a50d605478cf097e7097013ad5fac9552c83c2057d8be4352487288fb1db45060292cc7c0a90e267a9dce4486207f106a9cd0adc