Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/05/2024, 01:45
General
-
Target
2024-05-20_ba35306ca555582e0af9679beb877cae_goldeneye.exe
-
Size
344KB
-
MD5
ba35306ca555582e0af9679beb877cae
-
SHA1
dc8e44ee00412be9474eb6bdbb4b45d8c96d4cf3
-
SHA256
d123adee4fb8542703a07c71c3f6c1b211a157ad2e21d2164ab988f753cece03
-
SHA512
2da0b38d6c361983f35d4de553bf3db3331b3ffbaf3b73d25ca098de94522ab7a81105e96eb26d440303742083bd5a6b2c6a83671dea3fa4623d8203392a869e
-
SSDEEP
3072:mEGh0oLlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGFlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_ba35306ca555582e0af9679beb877cae_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_ba35306ca555582e0af9679beb877cae_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{165E37EA-9813-4304-9F25-9F8AF51FAD0E}.exeC:\Windows\{165E37EA-9813-4304-9F25-9F8AF51FAD0E}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4A52BF0-9BE0-45ad-ACEB-B408CB20C6AE}.exeC:\Windows\{D4A52BF0-9BE0-45ad-ACEB-B408CB20C6AE}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29F9ED13-F9A3-4504-B5C7-AC98F2024F10}.exeC:\Windows\{29F9ED13-F9A3-4504-B5C7-AC98F2024F10}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4540A478-07CD-470a-BC20-1B266F66E49F}.exeC:\Windows\{4540A478-07CD-470a-BC20-1B266F66E49F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F30B85FC-B3C4-43d0-84F5-14D762131221}.exeC:\Windows\{F30B85FC-B3C4-43d0-84F5-14D762131221}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C7E5AF2-08AB-4f67-9990-ADEC6B134EA4}.exeC:\Windows\{6C7E5AF2-08AB-4f67-9990-ADEC6B134EA4}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6C48336-7599-4260-8905-1E9D6A7E488B}.exeC:\Windows\{F6C48336-7599-4260-8905-1E9D6A7E488B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACEBA3FB-2B55-45f6-A140-1B99DB469E70}.exeC:\Windows\{ACEBA3FB-2B55-45f6-A140-1B99DB469E70}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A2499D8-6F49-4fcf-B203-349D9782B134}.exeC:\Windows\{0A2499D8-6F49-4fcf-B203-349D9782B134}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBE8E52B-CD88-438e-A02F-0523A8708A8F}.exeC:\Windows\{DBE8E52B-CD88-438e-A02F-0523A8708A8F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EBED9CD-6804-44cc-B157-DF6CC46267A2}.exeC:\Windows\{2EBED9CD-6804-44cc-B157-DF6CC46267A2}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9CD9AB09-5EFC-42d7-B67E-008A14771126}.exeC:\Windows\{9CD9AB09-5EFC-42d7-B67E-008A14771126}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EBED~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBE8E~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A249~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACEBA~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6C48~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C7E5~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F30B8~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4540A~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29F9E~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4A52~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{165E3~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5238b3eb4fdfffd3d4280760d4feecdd1
SHA1665e85a83ca7a0cd9bfbd4837573421b536f0703
SHA256673dab12b831e7554412198867e95d0f3a943a3016418d28d517e6ead3ce7fc0
SHA512b9bb959969f5a4eb648156aab95ec60d0cd21aaab8bc7d39b95575b42bd2df0a0bb33e8218d50ac89407811cf06c0cd63996096f34ce0f23e91eba524da11d6d
-
Filesize
344KB
MD5b6361f62e3507ac6af886a32506e16fa
SHA144587aaea27173cc72d13cf2bd9144e6108e9700
SHA25607c2b356188a633e2c4571772849024d6e466a07805114125d6aa925faf18a9f
SHA5125a3cc0eb16ca4673c42582db0d90a8f8a44da8a86887ee340369b3f0964582546280167737d1fd9f8e8df487a74e363cda0700472cdf3479393999169f8b7ce1
-
Filesize
344KB
MD52981ec5415959e6807a191cc280af16a
SHA143be9d003177b3c467ddd7687d2d933c4a59db50
SHA2569785096d40ace12c124af4a81ea8fe362ab65715b5915649ca4a158d56eb48a9
SHA512738bbc78efeb23b086c97642e15954df50b1124af0924051a6dafff1ce22b3ee48668f12ebd1e0887cdec93f1a27d7778efafdff6d9aa99dd3d04cb87bb877b7
-
Filesize
344KB
MD583f1d8bd8cfc8c7142f52d4374ad6bb0
SHA1dc83902f09d67a06a488c2012ca2aab742d2d8a4
SHA256d7a9d49aaf46b748e6f24a9527a1e4bd5e2c894c32291d2f900cb75f6f9b771a
SHA5128f15decc62e8382fa7713df068d6fff0d4c6d2a36a76ddb8f93da1c1909ce8083b42594f8ae7b0b4f3563f35d6bb13c2d8c241d382aa2c84409cea289d783474
-
Filesize
344KB
MD52de42054450cda0c1a3386e54f026a0f
SHA15e0634c788ad81ed7b99d22a7ae2d265d456210c
SHA256c6c00a67a4805ca673a8aaf7f0bd0f691355dba537cf71d8c78ada8081550112
SHA512e3a1fe28523242e18bdae5764a084cf4c7b56964ea2926f9cc96fdc99deb0312609fc91cdcae4ec369236243fc4a43e53f2f69005f20c6ae93303b1ffcd3e9b4
-
Filesize
344KB
MD584a6a57b8f807e6816095f335e278821
SHA109f45c2fbff96e5b4be5e8f8715b2d6652f255f8
SHA25695939e05b78cc458f8f18cd311d1986dfa734f4c6a8203fca24f07a29fd908b2
SHA512fb5211e63900574bdb5ff98e6f5aa0c3a9fca5994cafa990d928435963560c0aaa54424d58ab88d0848bcf81fc07497d79bd3336b0b13f3fc93a3c3b6decb84d
-
Filesize
344KB
MD5588310d80d3aaebb4612a4342e40530c
SHA18d11985d159f0f6045b3794a67d5e4d797b5c4d5
SHA256fb3659cab41abd4abcf37ab475f0b9d1288396ba5bac83630e5a74a5ca782ede
SHA5126a34a001d50456b7abcc706c5e563cbabf1cf3aa22eea6375e12df29f615905dc2996273608ab144e4f88078473edf86ea07a455addc2ea19c58e6bd36371560
-
Filesize
344KB
MD538bc3198a5ccec15e30d8f990daf0cf0
SHA11aa1949ad4a4e9ba912675dcfa40ba250d1e8b74
SHA25633131e7eeb75c67e955d8eeb65104ab4767f7dff67e7fd73ec7d579b5368a81f
SHA5126e9916221518b53ee75d6ce637c5975de980d6f8310ab6a01e1d38d012d4c7363b32f542232ba3719e0613ee47f5462384609f9c88372e7af1eade569672b910
-
Filesize
344KB
MD5e4255cfc0a4a78feb1db5afc736c66e5
SHA1ee9aeb3437d4b390f3fb4ffb61fccfaaeda81114
SHA25603141718450a9a289ae10dd3ba9f00d25290002f6dde4d778746f85359d30c6d
SHA512aabc8be7b1ae4f98f89953693826aefcbccca6ba32f6365455fc5a204ff2793c5ac9b71d0f5a98ab0607b41ceacd6f2cd74237f3f44a846e637e21f9620e9616
-
Filesize
344KB
MD50b7e4f098e10481d6d2fa1229708355d
SHA1a86da3678a373cf9cfd465f7af75be84c3ca546c
SHA256d6c9c9af96eb8d372de1e1fb8083756a568718bf3f1b062113a2bc6638459bd1
SHA5120a065e08e55db6aa16ab1feae02ed96347fcee4390ee325ee9da71e07affdf219e4b58a2504b3b003f00618290032d4c6ce5fb38ee89694a28ba4efa40dc8284
-
Filesize
344KB
MD59f2ba7e5c828291f50b08bace488183c
SHA13ed8c9b4e36646b75043a4c177a2675d926c5a53
SHA2562277da53db0c57e8f086afc2fa3f79ffa8cde5cb8b7f2d29d7cc18aad324dc33
SHA51219954970a09108edac67e7018ffe68a40e07c5ec88b3be0c14176a1e0a97fd873a5ebd7ac8f2ccdf1918f04a5603996e9a4d284059121f60afed238cfa486f66
-
Filesize
344KB
MD5c1292e4b766e9a0223b56f6fe4951341
SHA1cecc0dfd8169407c28777206924a14b043c6068a
SHA2566e7bf27372a608a595bf26246a096b0344a4e27ef22ca41d0edc9869ee548c80
SHA512873812e81c8714e321ff35f3dbd828fe72d324d136a6bbda2cd88746b2978638921640c93d1a24cac79b947c2986cf65ed342f1c86d0f811e2471822714c54ca