Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22/05/2024, 03:46
General
-
Target
2024-05-22_29d8381dd394bae97612e5952247a9c2_goldeneye.exe
-
Size
408KB
-
MD5
29d8381dd394bae97612e5952247a9c2
-
SHA1
c901f5bfc226652591a8525578dd7c0086f29ecc
-
SHA256
cfd524b74cc4f3555c4e60b5d78955a4cc6ad58e18a772c2cc37e73cf300dda5
-
SHA512
ead7d8ff3dabd4f76ce7755f5ef8356fa16f9c3ce5ebdde0fb2064d3a9de8d301d558015f7949bc065f814a5553dbcfa01d563a65f6edf8c5eacaf4b660c3748
-
SSDEEP
3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGOldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_29d8381dd394bae97612e5952247a9c2_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_29d8381dd394bae97612e5952247a9c2_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6059B5BE-457D-4b34-B137-F98DC8534581}.exeC:\Windows\{6059B5BE-457D-4b34-B137-F98DC8534581}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C888BB14-CD06-4ee2-B1EB-9D324AAE007B}.exeC:\Windows\{C888BB14-CD06-4ee2-B1EB-9D324AAE007B}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F0DD7A8-1B58-4ed1-9FBC-ECD89B1032F3}.exeC:\Windows\{1F0DD7A8-1B58-4ed1-9FBC-ECD89B1032F3}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A04044F9-A871-40dd-BBBA-0B854743B3DA}.exeC:\Windows\{A04044F9-A871-40dd-BBBA-0B854743B3DA}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{735A2EDF-011F-4350-862D-A346D00B5B44}.exeC:\Windows\{735A2EDF-011F-4350-862D-A346D00B5B44}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BCEC633E-1B4B-4372-B5F3-07230B4ECC3D}.exeC:\Windows\{BCEC633E-1B4B-4372-B5F3-07230B4ECC3D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5DDD91B5-F45C-4610-A30D-4266780AD97F}.exeC:\Windows\{5DDD91B5-F45C-4610-A30D-4266780AD97F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBA6D3E0-8BB9-435c-BECE-A3E9DD9777D5}.exeC:\Windows\{BBA6D3E0-8BB9-435c-BECE-A3E9DD9777D5}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9339155-85EA-4abb-9478-17E3662EE025}.exeC:\Windows\{E9339155-85EA-4abb-9478-17E3662EE025}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4335905-CE0B-405c-8A64-778C7CBC9C91}.exeC:\Windows\{A4335905-CE0B-405c-8A64-778C7CBC9C91}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B071FDD-F3D4-47ba-8398-B61159EA7088}.exeC:\Windows\{1B071FDD-F3D4-47ba-8398-B61159EA7088}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8FA53895-CF6B-4d9f-83D9-801ED31432B1}.exeC:\Windows\{8FA53895-CF6B-4d9f-83D9-801ED31432B1}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B071~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4335~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9339~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBA6D~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5DDD9~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCEC6~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{735A2~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0404~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F0DD~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C888B~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6059B~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5270a2539b65a6493f7bd9aaadf9a272f
SHA1e26bd9528e22c74eb022bce5115d395820659cb5
SHA25677466fa3243fe606511efd2af4354e8e2d9259b910da8ca6311220ced3771bff
SHA5124d7a12bc4797b17cdd3fab2331f0a5c1b26f002f8566d671b5daf7d283a4899f57489543a92cf43f7933a1aadffca31236c6598b9be45853d5b53454da632062
-
Filesize
408KB
MD55c0ac8053c4e2667717cc51f48dfe5bd
SHA1e07ecab0af41fa3f2dc57f0e9f8cbd8b60f04bca
SHA256bd27dc4e3dde41af464c2c008788b31696c043385fd89ac277f7537f78f02535
SHA5122fc33998fd14370af5507b5030739abf252ed256b0d151eb339a48de26fa923565f9a0f462d7e53743c520ae744414fe0f198e74bcb035c6792ce6b6ca531e4d
-
Filesize
408KB
MD5d55879caa8cfe1f81102aedcc11ef5fe
SHA1e68fb237160a04f83ca6d4b6b7b847097ed4eee6
SHA2567d5b034ab1e7641703de4c46ffb4669dbac67fb5229bd89382835a8ee99b188b
SHA512b30ca09343d203d4eefab9a38a648146607ae84c7b34c3d1b1fd0e538781f292c5e66c6bdb7dac6d27a1dbf6a1da0e2aebafeafd12e643ab4fafba690fef49bd
-
Filesize
408KB
MD574b820d93f092a37fab738ac30f8ac6f
SHA11f55e049a51b03f0a617eed3e8aa7687a3977f92
SHA256ef30d070ce9200e9019d54b4f35202fd7b8f985c913a939cfa19908d8c733f83
SHA512e1ed5822c053f9aa72346d93b84347aa34e73681a5ffa117833f3e9adc89c5cf1b831876c6bbdde5b895134b998105a9323d1416910c5f6c1e0bf2511c9a4bf1
-
Filesize
408KB
MD5a8e8367ff56e59f1c3487c74f87f3de9
SHA1a40f2ea7d89b121b796f9c9a91050782704ab3ba
SHA2566056452ed0841580cdcfebea3b6c2d0900534ad84255287645473ee3193c9742
SHA5125be08053dcfbd0d67de5a3cd622b52d80e762145563d53165d653f2075de8b5831379016af21c955a59e8d5a517b8460d5cb5f5c5a56b3fcc7fa5d708d6266b8
-
Filesize
408KB
MD5423b58eb4048acac8ff4eb615f8bc079
SHA14ebd02c74ebfff08fca5a912745e026b19fe8e23
SHA2568c2e7d78f26832f11094ff12e2447891e74ac0508db087aefe81422deffcd76b
SHA5122372306699866d00592d87293826b6cfe2567a7f379ab678dac694ed4008b46dff119b470907f4bee14a05281134f63ac8aa0c93a6670712c605c82f0f2814c6
-
Filesize
408KB
MD53dd855b5cc0630adc21cb58b10f1ad5f
SHA1dda4c02e202d002acf19694d6f5cad63f4c2146b
SHA256a349406cac14918049505b812a9fe64b6dc8aaf198f511db27d4647d1bd2e130
SHA51252bf679eb91f6351f151feb61bac5d473686ef9351c774be64372c7e832c5654b987fb38f8d0348d365f1c79ce5676c03b9be94a4f25fd29c6c8b8dc8c2a2f12
-
Filesize
408KB
MD52e16c34cdf4d28951c7cc0671ad9c581
SHA11bf285d770ef019c4b2535cb070e44e64954bf14
SHA256c562a9f25887a825f2aada7c08975dbffa3867c2b73a643bea8d7eb62cef86d2
SHA512fbc1ffb3fb1a4bae03b649f75fdde4365e36047327792b84be65e91f9abe6359d27d540a64f2e53dce3fd68157596a5c7671539e520a630829feaf23517a6d23
-
Filesize
408KB
MD5ea49a990620fd7f39e4900e83bc0c9ca
SHA142c06d6e1852c2b474314a5fce6fc4115621cefe
SHA256033b1c14796b6437d02b1ebde0334fa16af63f2f4b4f6e2a931533bede1ea1c3
SHA512088ec49441f2fbdafde067a92b372759743c81a69ce4711253fc789ef43ce6b745a7ad1fa13a61f64ab96e393e0c52b628b6fbc55458351dcce1386417692e97
-
Filesize
408KB
MD58622c29e2443c33d3beff289fad7dd68
SHA1e05a2daca4be1b61177939811bf9a18d6af8d424
SHA256208af46cfc15f39f3fe2fafe5a845ca80113bfeccf2de349d826cb8a5cad1b4f
SHA5128d5148f9e055a9bd768d8923a62f500bfb1f290228c59656a21b714dd8b013ba31c561ac6bc0ec14d4c94db6ebb952c92559a55e7f24caa5fb31b2052cd64bc6
-
Filesize
408KB
MD57d071fc1645b9f13c69766516622c456
SHA1a1b6df786f644187c2212c7e306455bbda31c10d
SHA256dad9a98ae56c0763c1efd84bc18e1fc7699ed9be5b30497de0295b8743305d4e
SHA512780ea7df763462134b12bccc20a9bca4dbb201bcdf2af14dc8b4bc7738e24426d2899ca976a9e028e0ca902488de1408f9f2c8d3d540cd5deb4b820dfb72c870
-
Filesize
408KB
MD52b7e2592928b616f16b1a4f08bdc3c9e
SHA10c95469fa3a6136f73cde3e55ce6abf4ae0f8df2
SHA256b6b29010f192b87837d08ac72f6239f8f5f2342e4c31e4c5c71d28dc52d1ebbd
SHA5121477cf65e89fe7c43d0457fc22ce1d316ff7ea22def2b2eeb864f824084fda956140a74ba3a5c0984495a43312f8abe6bfccaa31458ea9614230ee3e545b5d3e