Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/05/2024, 15:09
General
-
Target
2024-05-20_acfa508c3acb9ee8e6ff23c9902563e0_goldeneye.exe
-
Size
344KB
-
MD5
acfa508c3acb9ee8e6ff23c9902563e0
-
SHA1
604e966f35234e1d4e48a82904ad4ad696c1f3b6
-
SHA256
cf7ae9d063e8bc17be1265b8e20e57e3af095194f479678813668dbb00f39dfa
-
SHA512
b6a251b2efe71906697928832ddfebabd66dac6a49186e790860891ad7df475ba283f5476f074834c7e23b9d97d5788df802210ca866383a14272245c20db52d
-
SSDEEP
3072:mEGh0o8lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGylqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_acfa508c3acb9ee8e6ff23c9902563e0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_acfa508c3acb9ee8e6ff23c9902563e0_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{846E176D-41F3-4e81-8E49-28B0478E1431}.exeC:\Windows\{846E176D-41F3-4e81-8E49-28B0478E1431}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8D4AA2A-5DFB-489d-8EFB-9945DD53D0C9}.exeC:\Windows\{D8D4AA2A-5DFB-489d-8EFB-9945DD53D0C9}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83BBFD09-5B9B-4fab-8138-7C1B38052FCA}.exeC:\Windows\{83BBFD09-5B9B-4fab-8138-7C1B38052FCA}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E3C25BB-CE74-4ffe-90AC-10C57B417C33}.exeC:\Windows\{6E3C25BB-CE74-4ffe-90AC-10C57B417C33}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDD644DC-F1A4-49bc-8763-89EC71597EF1}.exeC:\Windows\{BDD644DC-F1A4-49bc-8763-89EC71597EF1}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD6DD1DE-934C-4e7b-95F0-766B631C1A29}.exeC:\Windows\{FD6DD1DE-934C-4e7b-95F0-766B631C1A29}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D64BEBD0-0F79-4eb9-A537-49CF14C7B920}.exeC:\Windows\{D64BEBD0-0F79-4eb9-A537-49CF14C7B920}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6BA63E5-8A14-4b85-BD0B-1DD658738384}.exeC:\Windows\{D6BA63E5-8A14-4b85-BD0B-1DD658738384}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1FC1F08E-45B2-41ff-AFDF-9D43B91234EE}.exeC:\Windows\{1FC1F08E-45B2-41ff-AFDF-9D43B91234EE}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC42FC40-AB44-4cd8-9B51-B3820009E1FC}.exeC:\Windows\{EC42FC40-AB44-4cd8-9B51-B3820009E1FC}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AE2965C-CD83-412b-8C8E-5D6626BDE3E7}.exeC:\Windows\{3AE2965C-CD83-412b-8C8E-5D6626BDE3E7}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8B87F1E4-22DB-4493-ACC6-ECA197B2D909}.exeC:\Windows\{8B87F1E4-22DB-4493-ACC6-ECA197B2D909}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AE29~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC42F~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FC1F~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6BA6~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D64BE~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD6DD~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDD64~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E3C2~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83BBF~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8D4A~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{846E1~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5da462199434dc2d516a29dd713f8621d
SHA16a04c3c84648bff59fb91a4be9c8f3880195733b
SHA2561d9f5c9e7bb0a5534633430f32c12bbfb20bfab0364b263b8078769209cd4b04
SHA51282f6a26e164cfc8c770bdeb9243610917f36df285404e313381b5af9e6b27a8baca2133ceff0b291a69f9cb4d9f50a54451d077f65494b9f288ef159646844ae
-
Filesize
344KB
MD5e8bc5c59c2407e32f3a912c4703227f6
SHA13b9a43e2d561696cd7a5a00fe621885c0b0c4485
SHA2563bb036f877c24782c0342a624a54b45fd81d59d05686462273cc5c2907bb8d0b
SHA512876ce0b4336bca0709c1fadbc64f637e98199efbec458d3e0d41ffe7e56753c4cb502cbb13a8543464b21247a9016cbaa5e4ac6e8615655c47aee6e1a4153849
-
Filesize
344KB
MD5e44775e99547385781b9d56b2dc96a14
SHA17694fa55807cddbbed5e6e779229fee0435daa8b
SHA2566de114428f77b30c270eb2f277761670bc00529bea3f8443e61adce9eff2222f
SHA5128d392465dd0dc9ba8e63ee410c751190f34dac9cd6bb23ec50d4e3342f1caf5eb7f2aef978a4a568fbfa917a82470b8dac65b804a53b878a9a1ec5c00b703c5f
-
Filesize
344KB
MD5ae3b8e34cc7407cee8e3d9cd71a01202
SHA13ea294fb2ed578abcc3af55623144d4c5d4748ac
SHA256ed06bc310a79a0d2a173285c919c595b4fde03fe253110b97e99c22c812ebd75
SHA5121ce82090f701769876af419ec3e4d476a34790475de70807dcad8ba8b4c407756bef23aa477d12d90ba20ba5d11014b1ca7e2d15a0d6a6bb109520447a3fbd94
-
Filesize
344KB
MD5c8bd1cfa916dce437dcf7bfdcd14272d
SHA1b8bc4f0a1f69d5c44720558882d6ede3c59c83a7
SHA2564852c30ba17a02c5c324ba9a0366766ee54006e3a1f31de95ecf7e1b5cb3b55d
SHA512120bef0c38e36ad9def54564552518cdc5399111f815ea998d8d39b2b94de2bca198e77507847f75c2b1bd731710b0560c82e6a24134c91cc0522a8d6ab9be43
-
Filesize
344KB
MD5d5a5fff1ef59aa6bd6c4744455af4123
SHA13986d3dce5f1b743b6729ff910f2b1cc966a7a23
SHA2562cbe163b6722cab000040a412c219fdcb2b19cd8fa278bffbbc44e373d0f8ca7
SHA512ccc3a63ac7fb76ea0981b86e9caa61fd1367ca29b8b3cf10e6aa2db6865dba285c6f8fc17115d04895164d0f225502a6c151acdfa533ace538e99e5a1d33a75c
-
Filesize
344KB
MD528100cc4c55131b96a4dbe1c9839d61b
SHA13efa488737f5f9da31202949280dada315e7f83f
SHA256c3a8196c58c6bb23c031e6092ce1a84802ec66497e0f0a0751a134ba36f79e6d
SHA51215b979c008bb180159b1e31cad349a5374a69b46f4815a084ae3d8b09f1bf848ed1a17941b1828b525368096cd872b5186c712f4bc8bf64f8371ab3763c608e5
-
Filesize
344KB
MD5256c5e923136eec5c3d100cc2446ada1
SHA19ed55a33e0bfb19990fdd823ef5ce618ce5847dc
SHA2568be13cc64bec209d0602e82fd211ee75e54bbdf639c8547c411915a95d9357e7
SHA512e46ba876dcff801d2ca733c3924bfeb332fd2efd2ae22dd76720f72d368d6cfe9f615034624590c8d3bc3adb6408606ea7399f754689971c4af3b2c85e1fd77d
-
Filesize
344KB
MD537e3d246e1b919db922b8f958258d4a4
SHA18a0ae1f25848273101df83740cc9653a2eb207de
SHA2567139cb3c846f76980a544a3a79e0a9b321f029ae46b9b6f35f2cf1ecd6867da3
SHA5127d4f8823d13961080a5945212fca37c5559f6ada6921216afbe3d5b3b686c2559ace60da6a684fbf08bac2a91a914ed3e1d3b548890542f898fd9b1fe3a38f24
-
Filesize
344KB
MD57b1d3f29e5e32a3ecce99a61ea9b93fd
SHA11ccfa3a9ebec15845462008e09ea2e3f0f4adfbb
SHA256e4a931a57506be3721bf702da3a4bf8f02b53344d5068980a550d3243a80aa72
SHA512aa93c46c34d90a0d2c446903720fc08cc079525735c4b57279f83d531ab965f1dd966f1cc258aec690bffac4768602e2336f5230d7bb5b1509b687d71db7dd32
-
Filesize
344KB
MD5197e978c3f77668e27ee6da201cd8be2
SHA1fdd0f8a053cc167d360cc5dab78c27b6a9f694b0
SHA256ca2a64ccdebc1e574e4408d82c044fbd98ff0eee104dc1b985c7da0284408bf2
SHA512e87e99a98f3d92b5709e5100dc612f4ac32419ec0ca7f0e4e34142fdbb007ec70e47248b020225ce7992bb5451f360d980d589e7d798a8a65575382e7fb2e146
-
Filesize
344KB
MD5237cde5032eb31a228514b46ddc9bb98
SHA1d524742f943e4dc5b75fabaf6fd7d130dc167243
SHA2565259e64504e2d5a9f694e006e596c6d161bd1abfbe2e73f938013289637d83a9
SHA5123fb1bac22de6f70d937ca404ffd47f6fa0099d6b9c55a0f5253d73aa5e726c325bcc20478a9f9e91ab912a06ee277647ac08322ca2c6b84bd8a395128e805cb8