Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
03/05/2024, 05:44
General
-
Target
2024-05-03_8688031bfd82e7066eb671e98204f1bd_goldeneye.exe
-
Size
380KB
-
MD5
8688031bfd82e7066eb671e98204f1bd
-
SHA1
7ed38933891867e42fbd19e3df2dbefd2c7dd8ff
-
SHA256
9ca513d9cac3b635578fe370f25e495bfffb14b6c1d59d0d0d4821d5fb5b47d1
-
SHA512
32fa43aaf137a802a23ab7d1d2563cd36e047dfb0932b62ce1f4c6d28afb451de58d121c49cee06d85fdf0bf290d15312b6a7ba52957b5920ad60ce36699f9de
-
SSDEEP
3072:mEGh0omlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGgl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-03_8688031bfd82e7066eb671e98204f1bd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-03_8688031bfd82e7066eb671e98204f1bd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{327B76CC-A178-4653-BDA2-5A013BE85D5C}.exeC:\Windows\{327B76CC-A178-4653-BDA2-5A013BE85D5C}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97E63D1E-DCA5-438d-872B-0C911CB76A9B}.exeC:\Windows\{97E63D1E-DCA5-438d-872B-0C911CB76A9B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0195D66C-96B7-4566-B83F-A2EA80DE6AC3}.exeC:\Windows\{0195D66C-96B7-4566-B83F-A2EA80DE6AC3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B491DB11-0BA0-4706-AB77-9A8D864B6E85}.exeC:\Windows\{B491DB11-0BA0-4706-AB77-9A8D864B6E85}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6BB6B02F-BDFF-4d60-A38D-EBBD07885FC5}.exeC:\Windows\{6BB6B02F-BDFF-4d60-A38D-EBBD07885FC5}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87EA8685-CC52-4a8c-88EF-E0B06385295B}.exeC:\Windows\{87EA8685-CC52-4a8c-88EF-E0B06385295B}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DA1D4E1-2296-429a-92CE-EB1B96A97C31}.exeC:\Windows\{0DA1D4E1-2296-429a-92CE-EB1B96A97C31}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40B18048-7A3C-4db2-9708-1F87BF2BEAA5}.exeC:\Windows\{40B18048-7A3C-4db2-9708-1F87BF2BEAA5}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{873CF0A7-701C-4606-A77F-5DB000745524}.exeC:\Windows\{873CF0A7-701C-4606-A77F-5DB000745524}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD3BCE75-144B-4ef4-9E41-AA723347AC54}.exeC:\Windows\{AD3BCE75-144B-4ef4-9E41-AA723347AC54}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E325016-D169-4edc-95F2-E0C104247FFD}.exeC:\Windows\{6E325016-D169-4edc-95F2-E0C104247FFD}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{60526F2A-4C06-4287-83DD-7D28636E7319}.exeC:\Windows\{60526F2A-4C06-4287-83DD-7D28636E7319}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E325~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD3BC~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{873CF~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40B18~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0DA1D~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87EA8~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6BB6B~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B491D~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0195D~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97E63~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{327B7~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5c1b07fb4d03eb3c0c467c233d6aaee83
SHA12373965382da2174af0d93f24e870e5f77ecff4d
SHA256d47dca937bf147b4c9a5449267381cc37787d531d00a72aa878e4f191ee80ca6
SHA51243da3a5a09951f2cacebe2aadd88c6d66c5205229d2b73ffb568e8eddafe6c507fbae1f7f6a7efc4304851e893684af9af06661cb8c00a763b6246212fec2491
-
Filesize
380KB
MD57151aaaeceb2aae5130a96fea62efc25
SHA1fdca931f6c4e3b88ded3d9518cf34467046f7714
SHA256282156b4024a21bde767de83a0909900cf024b1995d86320582d59d32653d3f1
SHA51236d1ca9a8cab4ee1becb50a4b1ada3d297d8755e836a7051db8607d312b19754b1001614d5dd868d653d10ac4c3d41dc8cf54f8cbce6bf673ebfd1ae5340bcf3
-
Filesize
380KB
MD59297ad9e27333d48cc422e73672b7658
SHA1ff2cd09b93c34cfec44b39859fea233529407b11
SHA256490424731cd50ed519e843642d66fc3a5d7b5768c08b20cb0ed11727316e56ef
SHA512713c1d310992563cb4b955e0964780a2320f514659960ee53b50db36de52131d6b819a56882cbcc9d6e9c37c883c505a9e7c61fd6e5d3033516bbc604aeec948
-
Filesize
380KB
MD508ff832d4b932041e18921a4352366fe
SHA14ec809b29c4cee301d0da5c97f4a4c0b6459e3db
SHA2569c72ab9a8f1cd00dc483321f15bb311fe7a3745b7f5f97ea6a6e15009395e3a8
SHA512103e3416141b6a10c9a699738efbfcbccaf793e1fba574a782a7a249e60270f14aaeabecf4800cb0b66a5498cb8c6d9a5370d92b7aee19fa0b664a9e841e9b98
-
Filesize
380KB
MD5339f56dbc08ba26e175f0271e787974d
SHA1b2df79c34dfe94a91a86586d4d590f869f0ab550
SHA25629687088d1efec500792a3992028ae35160ebb4638ab97ee32c3397449834ed0
SHA5124507c21a42fa7c2358f316b06f462512affbacd3e6ef22fec5f3677cd3ed7309d39bcca87ab533651695cf79fe88820613ae2957ee30ddcea4c5198c27a138dd
-
Filesize
380KB
MD5a3655a3dcc7b0e3a6d2e00f59bf3d3b7
SHA1fba258f3805333ae2b5ab4a2acf9ebecc66b408e
SHA256d59682686f53063c7b0e6b6062c3948772cb31dac611eca7281404635e57f7a9
SHA51297e40c16b231423dd8d02ab104cd72cb35f5a4da12836842ad45c3b432620a1d34b2246cccb299cbcf0a32d86dd26923cecdd6e0742a9f2e1c0630e5d24518ef
-
Filesize
380KB
MD59e26320691a0d9439870f9bdc248c865
SHA1de9f79c8157307d32064f8d0ddc13eeefa1d3d04
SHA2569d8248a831fd5e39d244dbade0017262fae8256863ba7ea161ef748b60231677
SHA51239334865e52f728331c1f8316aa41848cd8d3e5fc8a2b2c0cb2ef2e953054d3a78ce575c2da601758fcf36da9dc064f1da36b50dbcb13fad2edfc75014dba4f0
-
Filesize
380KB
MD55ae3cacf87864f885dbe61e543045ba5
SHA1e4a534f5fe42eedce403cbbec76cd8b0e42196e6
SHA256bdd128c8aab9ac0ca79d415dbaaef68099c556fd16a11189063a89dc5850b72e
SHA512d2e591a35cf3747365c9f1c960e9e3503c2e018f7b02181952f2b00bb6fd483f315d4a3d2901f8c3d6e8fe47e4ab83043fb67f15fcc908efbb1532e99f159dd2
-
Filesize
380KB
MD5ef54a6b341cbff316a755a650bf125eb
SHA14bdd7c45400a79b36801070510ababd298d5092a
SHA256aa22e349c9151856f7a4adcb26eadddbfd3442fb906148f5de88417d992ba7d5
SHA512ca8e4323ab9030bceaccb49fbdffe1aa9d12c58804382490920b1573db60d06af9fd607a285ff8df908dce9dbb86b6f228feb8f7fe582de2b3dd8da6d53514b1
-
Filesize
380KB
MD5f88f9f011cd05d45c26623a8c8b63748
SHA137573a9ae782e82cc0b6282903dd7e443b1842e6
SHA2561fe917088153841a7cc73c67516cbfdf281e7359a1921b57a5de3aa0eb00e3e7
SHA512eb23d1c786ed6e4294e47d13eb693e467906b69e13d8298c92247e54cf42e754fa0ac23b88ef7704c58b89d2bf77a9b244ab7560b707447e2b95ebd8b710a1b3
-
Filesize
380KB
MD59350aa38c141f2697a5a8f5bbfcb24b4
SHA1d4fe9814f35b750b293d30f26120df418a5f717f
SHA256daf22328eafaefa50e24073498406cba25800c8f7d2a53d1f42d2f20d85f9127
SHA512c280103e98937065c0b86aa952228f04feb99d86e78d70a261b10e6e605cbbe9845f6d8b5dcfe81d45299ff0a5ff98e634dcca3fb04996372ad9ca7b1452a903
-
Filesize
380KB
MD57e6acba963589710f4c919f201781818
SHA17d87a0f103832f4f371762255e458588e244d5df
SHA25682881c68d4cf374397000d73b20199657b81e4d65f39bcc3caf24e86cc9e4a19
SHA51210fddf30846bace9a7fe16b9f91f3853f870240372756128fb175a0993c43a9a18bd0a7f32db98c77c88686a3d4adb7e23b50aae31d8c48ad67bedb09a628800