Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
24/04/2024, 03:51
General
-
Target
2024-04-24_ef696fb03edc89ff18c46e62ebd47797_goldeneye.exe
-
Size
168KB
-
MD5
ef696fb03edc89ff18c46e62ebd47797
-
SHA1
e6ffa917a454fe9d9f2300ee5f2ce600a1cc42d0
-
SHA256
751c1f905ce13fa682fec131efac1a10ad89469b02bdeb4ed24fc3942c971967
-
SHA512
43ecd9319a2feb08bccd0527015ce2a8bc3cc17c5159faa844d70006b081a076ef1aa35ff6619c71ed9770dffce13142a321689cdbad4465f48c8761d77c3efc
-
SSDEEP
1536:1EGh0oflq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oflqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_ef696fb03edc89ff18c46e62ebd47797_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_ef696fb03edc89ff18c46e62ebd47797_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5487EDD8-6C70-4f69-9513-B53227ED8877}.exeC:\Windows\{5487EDD8-6C70-4f69-9513-B53227ED8877}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8FE7B15-06A6-45da-970E-48B43F1E8351}.exeC:\Windows\{B8FE7B15-06A6-45da-970E-48B43F1E8351}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A13E17D-1B61-4478-8CCE-80A4F3399CB1}.exeC:\Windows\{0A13E17D-1B61-4478-8CCE-80A4F3399CB1}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4289F79B-8B5F-4558-8DCC-472B92935716}.exeC:\Windows\{4289F79B-8B5F-4558-8DCC-472B92935716}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{159F72D9-0F63-49f4-B63C-11FCE2320BD7}.exeC:\Windows\{159F72D9-0F63-49f4-B63C-11FCE2320BD7}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3406C40D-24E7-42f1-ADEC-C1ED6DDBDBA8}.exeC:\Windows\{3406C40D-24E7-42f1-ADEC-C1ED6DDBDBA8}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
-
C:\Windows\{042E4A2E-F37B-487b-B032-1537EC764881}.exeC:\Windows\{042E4A2E-F37B-487b-B032-1537EC764881}.exe8⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58D3B465-224D-4240-AEA4-A23614D7EA9B}.exeC:\Windows\{58D3B465-224D-4240-AEA4-A23614D7EA9B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D702858B-FC0E-4e0c-BCE1-188D7D4C8CEF}.exeC:\Windows\{D702858B-FC0E-4e0c-BCE1-188D7D4C8CEF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77C2DAEB-3820-44aa-B08F-474BFC8FE6EA}.exeC:\Windows\{77C2DAEB-3820-44aa-B08F-474BFC8FE6EA}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F69585D-79E4-49d0-A66C-37ED515648C1}.exeC:\Windows\{3F69585D-79E4-49d0-A66C-37ED515648C1}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87E49E4C-7E43-4ab0-80B0-ECE3B6FBC715}.exeC:\Windows\{87E49E4C-7E43-4ab0-80B0-ECE3B6FBC715}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F695~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77C2D~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7028~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58D3B~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{042E4~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3406C~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{159F7~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4289F~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A13E~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8FE7~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5487E~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3728 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD50cebfcfd3db64d99f773553bca58d741
SHA12e0ab35068eceba36e1c3d9e34edcbaf43b91d86
SHA256762411c070b4e614753e40c3124e1dacfc69cb2acfcfaa9fa957f1b0c599c125
SHA5123a42f340690bb7b9c958b0c699ed119673b7ae23441a2b36e4c981206302e3404b60507b32c67241034f23159970175c9dd3ae1448b1ca0bde54940dec824112
-
Filesize
168KB
MD58af813111ff11ab987eb391c1425549f
SHA18c5b736b492319641006b8ede3f2798c86c79310
SHA25655ff7e47f52a766dd45ce0a5b80230e6758ff48472d7d13e954f8511ce481c93
SHA51275faecd57c32ffdcc63b76b08dac89d33f082f129f3dd3b98add2dea60408a5fe1b42ebc2fcd0523beb0bb5f04914c5f02707c8eb3f4c4c90d5a3bc26aef0099
-
Filesize
168KB
MD53f3739ccd0c06b8836747c23a9ba35f4
SHA192c83890df27f1e81704027c6695ae5141c663a7
SHA25669deb822a8bd5c5ea772da1ec77c4f22b40d43d840e288ff8e4a515435613723
SHA5122315aea3346e7b37bfe67659095040335ce627e833b06258888538263985f02d6eb46f9dfaff9730a64e9fe35ed8e1e3e9011d2634d31f07de4c4df8c12fbca9
-
Filesize
168KB
MD5920eb2ab988b0e653e2d3b44bc17d854
SHA16b666c99bd95d7d7384b4df712b8d7b9e9c73240
SHA256d42559e7e0c26b8767bf88c1e961250b96cc7531da5b9ce30f65972fad0f5641
SHA512371377223bf3a9e4dc83c59e1cab337ace35a0dcd1d117a6b69e4e8108a68c2a30195a74af4bf167d41254db41c59bd1b4605b8d61d36790d151649f160fb222
-
Filesize
168KB
MD5df38ad5c8db1a3f16eacf7867847a82b
SHA127eb42ac9695d6680b69363e6b93f4308f0d073e
SHA256599db300fefeab556e588571089ceeae3813b207c6e78b466dfb9680222a60e7
SHA51209e101c9cce66a37776fe8e25324ab2042d319a48bfbf19593c406e257b136dbe76df545871defeb19f94756773e8920347234f45be158c23d4270dae3779689
-
Filesize
168KB
MD522ec772c9538f98f098dd43aab27ee28
SHA1dabe20008e43a965bb18c63a5253dc1ec9bdcca8
SHA2560f79689b129d5adf05a0e5d49c2ada0b76467b52cff838ad5998e2d077b42061
SHA512273f440025e6e3ad8dbe2e9fcae2c45c29cb312a07b949547e51a8b18fc988967c0612a31b6a8dea87af5407b0b55fa29ded13baf8909d6154af4294e1e2610f
-
Filesize
168KB
MD5fbb37965f294d4b49426f3b06693e47e
SHA1a371124160e4e28f33a01a0c9e2f1dfddaef4ba6
SHA2566e5f4814d3b75c949e0ae8b1008af88ce4ccb924624140d98879151be470ee0e
SHA512a7aa08ec86850c0006567d67e3f8120b1333e9b99964142e694c370ef05d50a0ff12e5177cdcaabc2840d388425bbf9f6db7b651f8eb2d192fc5a5a4272d921a
-
Filesize
168KB
MD52db446e731528807c5d97d56c1d565d7
SHA1bf1faebb304704fad9305d3816bee7d6138a054c
SHA256b76fed390c0f8339a8eac79d652b53d639945e1ead7b171486e5b514caabdb62
SHA512ca6d56d8f8c8a61434a76626071a9f742cf5801ec34335628c49b2f56db190127f245c8273137565c0f246b5d2dcc079f279294865e9db6f30e7d980ae7ba025
-
Filesize
168KB
MD5a47ce9e30ece244c06c444831f30f701
SHA1af9fde6517ef17ad4c923aabef78079ec98d4b22
SHA2561b75006df1582c21e6649341f621d4a8a9da57afa5f8846b5d8b03d24c3dd1b5
SHA512852462adbef42afe81111170c3440a142c3c4e6c4e54581a69a04ce0859a4f9cfb4c8cd48b95eafd0312cf4bc8c8c60bddbcb16e577e281750f32e933acdeccd
-
Filesize
168KB
MD54fe2a42347aeddfb98eea8331e364517
SHA1495a5e3de3f9e97e90fa3fe99dc4a1eb0c89df40
SHA256b4693b597fbf62a2645d0e935cd0e6bac1a331fd8020276af0621c7e0ef6309a
SHA51279647cdd14c4b786227fcbb9072f085c4f4c280a719e42bc1b3432439cde842d724cf40a6f05a6a7e356e9ca785b8b565be072a2d49fb5ba39654b7f1cdb2d31
-
Filesize
168KB
MD593887d575ea0a7fef6fe0ed42e537406
SHA1a3b67ff56d32f489ddc910e1e212e96837f563b6
SHA256670e297f9fdf98fae93273727128e66efdfa56daf1a82f128504919546cd6a56
SHA512524cd0a0a4ec4b7bb8d3d2990c210f020a8509427579034bc875793a04ef677b0f4661d3788e90ad5dcce21c32805e6f1565746c823579a4e2e8e5356ca862cf
-
Filesize
876KB