Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
26/04/2024, 07:49
General
-
Target
2024-04-26_d18d30b76493ee5d1827d0eac5e2706f_goldeneye.exe
-
Size
344KB
-
MD5
d18d30b76493ee5d1827d0eac5e2706f
-
SHA1
c7148cc22484524ece7848c57ce2e240d5cbdaa8
-
SHA256
bac3dc51765d9c6b82315c5424934ed12354ce3c40b95b183778fd536953592e
-
SHA512
db0d19920f1f88520521f9a23500216ccb3de1d70ec5b529a0518958781431bc462666df94594d85a086e3414baf7b7314ce6294bd642e137d735076a9e3898b
-
SSDEEP
3072:mEGh0o/lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGBlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_d18d30b76493ee5d1827d0eac5e2706f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_d18d30b76493ee5d1827d0eac5e2706f_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C144617-1583-480a-9EDC-8591B5FCF679}.exeC:\Windows\{1C144617-1583-480a-9EDC-8591B5FCF679}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6060234C-8269-4607-B614-1A0650562838}.exeC:\Windows\{6060234C-8269-4607-B614-1A0650562838}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD2AB933-2AA9-48ea-94D2-A1A84D3B03D3}.exeC:\Windows\{DD2AB933-2AA9-48ea-94D2-A1A84D3B03D3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28687A77-43AB-4d8d-8C74-D63ED31B2967}.exeC:\Windows\{28687A77-43AB-4d8d-8C74-D63ED31B2967}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D795A3F1-BCEB-4431-903A-783503FCF247}.exeC:\Windows\{D795A3F1-BCEB-4431-903A-783503FCF247}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05678422-C1F2-4453-8889-113F3060BD4B}.exeC:\Windows\{05678422-C1F2-4453-8889-113F3060BD4B}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{176E47DB-0408-45c5-BFE2-AEFABA1B2E92}.exeC:\Windows\{176E47DB-0408-45c5-BFE2-AEFABA1B2E92}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1EBBFA6-43D7-4b41-99E9-916AA868FE65}.exeC:\Windows\{D1EBBFA6-43D7-4b41-99E9-916AA868FE65}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97A05672-8CCA-400e-ACFE-78902C24B598}.exeC:\Windows\{97A05672-8CCA-400e-ACFE-78902C24B598}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E50BF5E0-C775-4d0a-87CD-2C218BDB8160}.exeC:\Windows\{E50BF5E0-C775-4d0a-87CD-2C218BDB8160}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACEB6E1F-5E5C-40a6-932F-C6BEF99F3820}.exeC:\Windows\{ACEB6E1F-5E5C-40a6-932F-C6BEF99F3820}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{08FCB9C4-1030-41e9-98BB-3FE63E519C51}.exeC:\Windows\{08FCB9C4-1030-41e9-98BB-3FE63E519C51}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACEB6~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E50BF~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97A05~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1EBB~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{176E4~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05678~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D795A~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28687~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD2AB~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60602~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C144~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5f524b67f3d16c63dffa44a4845a8daa2
SHA159a662f1fd67933607bf5288888cd86d37e58a5f
SHA256dbced970410bef4d1c5a5484f7be37c941bc8455b4e64c501a789055d9364233
SHA51253edab658e7609021944132ab9f56002d56ebe4b648f164dfae47c099b230a80e577a4037b12ca0440038862380e7c265632fca46f2e39222dd9614f614e8ae6
-
Filesize
344KB
MD575854ebbd29dac905deb9b0ef846e6c3
SHA10f08f2573642abf2bb7516f71c0e254175a6f787
SHA2561fe803aeed0c0e55b807023e4ad8df9f4776a58ecf7050cb795776d0a3697af0
SHA5129ec3de7945a4461e369c55741f5c7d13dbf3ff25ac73b64ce586ff398c910f97d33e30861337b444ce18a9f6a515d86373f2eec3bc3df4b2b10bd23d1092c7e5
-
Filesize
344KB
MD5d0fa92e8d8202b07d9be53f7cdd96fdb
SHA104b472bbce65c087ad198141ed111be512945a72
SHA2569cd7dddf6f4731f2a0b89c4f758ca5322a476e7eb3ad1ec77e2d21f8e3c7b707
SHA512d23fafa5921cdd9ce5ea946a2e7c33d3e94125c63c163db9d983dbb4181f045c939c6865d405b0ac276b28f66b6dabcb19b75e2946642b20e93406871c797071
-
Filesize
344KB
MD5efcbf9a18e59c00487ed3120c986bcb5
SHA1e6a0248b32f8db5b0a39b54c06ba72c26b552fab
SHA256b8d5ab0effb62f36fc49d445e5864d5d338dd53eb218f6c0e465f9bbb67ddb26
SHA5120f26041c4b8dbdd5f54c04f3788bb73265c7fb5900f264c3411eafffe596889d514ece2d577d2d927bcd0c34493e414b4d4e5f1ff201b44afe523b01193f0b8a
-
Filesize
344KB
MD5bcd164a8fce6ce0196be829819dffc90
SHA16a5cf7b1e45de9b8f1630a22f1926212004920d2
SHA256ec17df119853dd5f343adbaa6dc50fe2c2f00e54e53f9c3877c56e221ab3e5ff
SHA512d4edcb80df1aa0b0356720687d8b60e905ebc543b00802b57193ac8d79c599b8f4aae6049caafe06bbc0229a5dde6c452cc548c50584125202758709b11d1c17
-
Filesize
344KB
MD57c04801526b5cb72220d639a16d74e6b
SHA109a8b2fa80477535e081459f349b7a6da35866ec
SHA2561380b673555e77d1a191f959090afca5eb081c12e61e0eaf19443f88d6b41a3e
SHA512bbcece461fb763f88d144b7a6410ed244be1ef245f1e615cb02592981aa676e9722c48015be060cd38b13f7163b091015f8a5ca2d76a61945790f68b2d7ea964
-
Filesize
344KB
MD5ddabaeb51a0c90389dae7f62e8278e8b
SHA1baa41a12d54989dd3b80ac4a16e5ae93ab1a58c7
SHA256ceaf0b25e55565f5534c40663d3cdc91cf99adaf66bdcef0f98c97df91786229
SHA5125e6d6800ba6e49de982ee62be00ddf18656a7480c6f07c3f42899fcd5c07f4a6e4fcb668489f5ebb532c3c44cb3784f3e53b6f0bb53c8f495cb3e6423ee61ef0
-
Filesize
344KB
MD511d1593583cc365366aa4d7757ab5e7a
SHA1b41cdd68cb3dd478596b12ac7ac797be92eae246
SHA2562ce06479414d83e33a1612dcdb7b5b2e16e1de88e5e6a483fc368efb85d73045
SHA512e3c086e9f8c8a12da5ce01aeb5a8cb3cb11a85e7bc63d65cafe40303a7777aea21b976d744bffb15046a6c6d36cbc5bd7c7c2e43bb2d5b08fed90ede4d61d429
-
Filesize
344KB
MD536cfd6eea18236cc648ce21c654d1480
SHA1199bbc878965c3ecb387db0e4558deb74ac7e4e5
SHA256ba552ac17e509a5acf1cac8954fdcbf9def17d9a2fc6b6626ecc4722317a0fda
SHA5125a8d95f502518e257a8e744d52ff36063f236af25b56515702f784fe5006b5b48aacb2171d4f115b14db86cd08c6f8155a90e48b8ead8cfbb57c92922410e7dc
-
Filesize
344KB
MD520a537bc756979a6119106cd02935065
SHA1c594a16049a42f18a2fbc8cc09ba0ee60b2b0781
SHA256a468b960de2d6e94580ced5df0b5d5fac9bad6c46e2ac0aa1e65652493b5cf3e
SHA512b4f07fcff6757bde3db87ce377b8b8397c0d3fc14a132d260e0f9ccf9b03ee22e8980c2ae762b90c2ff1115ae9977ff837e20ad5d0c402b4e8ffe125737e0a4f
-
Filesize
344KB
MD59a7961d0c67a93004fc02b7c015562a9
SHA1f66c4fed22f1d57481fb2f3e174a9d36601c460b
SHA25622b7e37c711b59b8fb7a6c420f662dd2c75a2302ceabdbf4aef815e9d987cdb0
SHA512c72ade719a1e4c653e435eea13922b44a71609123659d7b234707b859e9d581bed130fc98914e8187d34cbdca864af0c6153bec0332cef4452627482f6a47b42
-
Filesize
344KB
MD5c75748b848deb9ec3248c889aa1e1d6e
SHA1e52ebcec77fda9715b8841ffa1be6e1b71ac839a
SHA256164cf13cfc3da617d1afdc87469ee093dfd35e7ee62deef46dbb181926a26012
SHA51266e68a74fb6f45e32b3ff437ce3f594b52db08580697a3b67a3d02c96c91bce6a1c61c17492f920ae6afe9fc8eb150ed28d3e41e5f731dd6b2d3a69cf058c835