Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22/04/2024, 01:46
General
-
Target
2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe
-
Size
197KB
-
MD5
47db9e651bb826b9bd3956272695f716
-
SHA1
93903c448da057c528c5abbd8cd87061d160fc1e
-
SHA256
03a2a0051147cf96b113a0f1bd31e60b2889552059d108b93ad604136a1c753a
-
SHA512
720c4286e8a7fb5849347e4724380ec94b1f14f70e25daa6b4c8f6e8617ea21ef58ebe5896d11493349837202f23e4bf6abeed12c084ca94451a6aabcd0a7344
-
SSDEEP
3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGMlEeKcAEca
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_47db9e651bb826b9bd3956272695f716_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{939AF9A9-27A8-4988-92C0-2E340EE3CD85}.exeC:\Windows\{939AF9A9-27A8-4988-92C0-2E340EE3CD85}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCD54E4B-D0C8-46fe-8AE0-532AA29CCB6D}.exeC:\Windows\{DCD54E4B-D0C8-46fe-8AE0-532AA29CCB6D}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78C07254-30C3-4dba-B118-D11034EED73E}.exeC:\Windows\{78C07254-30C3-4dba-B118-D11034EED73E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1652FD6B-FFF6-47d1-A7E7-435FD46BCC28}.exeC:\Windows\{1652FD6B-FFF6-47d1-A7E7-435FD46BCC28}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D747F86-5484-4ce0-ABAC-43CE9532D7E3}.exeC:\Windows\{2D747F86-5484-4ce0-ABAC-43CE9532D7E3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61D42008-D0F1-4d53-B191-980F139DC375}.exeC:\Windows\{61D42008-D0F1-4d53-B191-980F139DC375}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFB2307D-2045-4c1d-84C0-B42579366DA2}.exeC:\Windows\{BFB2307D-2045-4c1d-84C0-B42579366DA2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{052823CF-F621-49e6-92D2-E853FBC6E649}.exeC:\Windows\{052823CF-F621-49e6-92D2-E853FBC6E649}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA7C3C75-93F6-4fc5-B65E-9DB78B484B33}.exeC:\Windows\{BA7C3C75-93F6-4fc5-B65E-9DB78B484B33}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB56FADF-58F3-4eb8-9EA9-AE0BD0660CD3}.exeC:\Windows\{AB56FADF-58F3-4eb8-9EA9-AE0BD0660CD3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36014A9A-94F8-40b6-90CE-8D74387E040E}.exeC:\Windows\{36014A9A-94F8-40b6-90CE-8D74387E040E}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6F729170-2C03-47cf-8710-5B0B82D876D3}.exeC:\Windows\{6F729170-2C03-47cf-8710-5B0B82D876D3}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36014~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB56F~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA7C3~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05282~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFB23~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61D42~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D747~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1652F~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78C07~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCD54~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{939AF~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5bf93a78ddaef8f281d8386c6141c16db
SHA1b794a0ebfbf43d96dd825bcdec3745f9aaefd130
SHA256325edbb70b5298d832002b69e2534f0d864b91974b1ab0b2e02bf51a7269c063
SHA5124cf10c27fcab37ac8cb314c75054d9cba70950f30392c70a92bb80ccd2306ea9f05873f92850fe4647ff691b4e1ec1b8d4cb51fda0104caa5b258a68a5fa8d6c
-
Filesize
197KB
MD50734192ff0090cbc5a60e11fb79c2f32
SHA1d8981e4b2f1459ab6f64f00c11726e9bacf1ecea
SHA25689b21f54f90cdf3f0b743a7c4ba218139357196703b16d71e53ec9369fa6c15b
SHA51263a61caf4ca02844bd1ba39cf6e4ed08c4cb89cf9e726c8a39688c213bfa84176b96f74afc8e2fbe7db1349a307bd9b142de98e8fcfd03e51f0628e89664607d
-
Filesize
197KB
MD5f6b12f29ba5aec1f84f5d4520965b189
SHA1d4763a9a0cab6485d701dfa14d5aee1307560656
SHA256b156a42a85ec2bc7c890f25c11d59512d10840f4fa8928bd9d7bdeb9997cfa31
SHA5128515d9e4d4ac4656951c8428193f2211b93616dd52cdbb5b76e68c41e4755c1f4a0553ac1bd0880b8ea0aac70e1a8ca093e0013cb990888dc7263475dbc81ae0
-
Filesize
197KB
MD596ddc98910408c8971305963c8137986
SHA1267de1ca846dd5e2ed9df3c2e00f8b53dc2d4a81
SHA256062b39743a9ff597c6f8b368439c6194144094fbec5cebda9bdfb02d050b3217
SHA512326819e7704c1ec69aa5cf0972ad91833dffd849b8edf65864d7223ea145d1f0b25e193a15339faefb809661694d6606e45153f793cb04abef750a755d7d2228
-
Filesize
197KB
MD5c929d7a938105c2c5edccdb4fca8a1f9
SHA100d30006c9a96b0be4f73dffc82e584a75ff02a6
SHA256a2f293b0e9a3773637ae365e4840b31ea683b1680ec5a0072283d9d05674fca7
SHA512b8028fdd814f7eaa49ad667bf212ec7177cbb2b941c7d2322a404c2573ee35af5cfeb457fd22231f868325e8e473bdf1da3a0512ebb4b5a1ed185ad50875f2e5
-
Filesize
197KB
MD5846b204453164251848dab560bf49f3a
SHA10d42d68f197c7a9dcdb4bdd034e1291cb8800cf5
SHA256f080944f44f569da1d21e6ebcbff3ba623ad2942ee84b1d6bd9dc1a8beec31a7
SHA5121f26c356b4d6d9f49246b36c9c4aaeb6752265f17796e0090c8d9b2cc2f2679bb6ce9467d14191b288ab636cc6bfa8dec7c5601d996ecb554cd2a5195512ce5e
-
Filesize
197KB
MD553869ca0209a28e7e5a8108c706a5068
SHA141ab2a9d59b414d127ba374102da1160f79e845d
SHA256f61bd2efa9198763009b8538f3f16aa73daa9a4b544ca0f40014a0f345b97ec9
SHA5120a3ac09d5120e18b0687585f649a184e7a47311fc00e1f6fbaef57917caacc63e628e4529cb3dfba42e7875a8e07a564d261448a4ee13d28d3562a238bcac6a3
-
Filesize
197KB
MD577a2c21272805559b3f7110fa395e0c6
SHA17811641e66550cb21771dc6df2bfc1745b28c9f0
SHA256c5766c80b4bd2d722db77bb1fa38360de5e8dbb7d27ece751ea8c564201dab51
SHA51250bbdd7c342682ca82e9dfcaceda33d2dccc54b735ea178090bfba5b7bafa4083db1cbfefc5038eef9c3c20662b08f2ec88f65d6f3e58bdeaa491d484f2739d5
-
Filesize
197KB
MD5d9e9cfc70bf889a4890a275ee6f758e3
SHA122ffd1dec1ef81de7211a6ea1c41f8fb6122ac70
SHA25606c349c2f98496e0f2dc651e152ce91d66eb991afdb52e36f517a3a34f798cb5
SHA512c6351f890e143354f71e6fdc33244eb6273762272d802ba419926cbd7ec23d6b08ab21a3aa80ca7b35132a8a88220ac3a8828b1fed4147bc5f20ec58dbfed1e2
-
Filesize
197KB
MD5f0e6784a12fbf4ad02bb74d1960f6064
SHA18e3aeb0b5ec7afdbf7d6b7e9462c93507b7ef33d
SHA256b8d70fc547bf9aacc11ec1ce361a8a676097e4bfa8bdcf63f979435f5dfb0de5
SHA5129f3cb4c41d5616f7e21cc0224158ff382e65b85898c5882058a3c56faa86aad227f1e79ff35ded53b2a28a0762e426e2fe699225621d777354ab1199e31c2b12
-
Filesize
197KB
MD51a383df88b66c6ab7830f37100f9f5d2
SHA10e6f42411e9104213a75b430ae2864536502ae6c
SHA256003bbe77741eb0ab78d6bc515d653ffa4a004e803a138980ec55b7a89ecf6a1d
SHA512cda6e2edb63eb9c492e7eaa83e4cde58917b14d6f5d2768f5ea5010c326de7e8e624fabdef78464382e31b8eafaecbbc8b2b1889d212bf5766b3f1d3a766b1ee
-
Filesize
197KB
MD5ebbc12fc365a5366e01e151e8b16c6fd
SHA1d7fac09db6e480b78a3c7006ee11ce854d077d7e
SHA2566e90d12d84710c51fc16a9d3ef679afcb2c35d2428d7a55d999b3ed0fc50e60a
SHA512393f02bfbbae3c9ce633f46321ec07ca964f354e181e9ee183abb8bf7b79e673f872db348ff7fedbb40a20fe52c0d1e5e24313e113f9aa278ab38057859ae11c