Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/10/2024, 23:31

241017-3h5elssfqg 8

31/05/2024, 04:49

240531-ffsxgagf35 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 04:49

General

  • Target

    2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe

  • Size

    180KB

  • MD5

    325ad5cab02211ba043f6a1ec096bc26

  • SHA1

    50d54c83f2a838652bef7e12981a8576527d2113

  • SHA256

    c7f7a7ddc0c84f60366206b41c11ec34c73094fc8718a3c358dadec33ba5a837

  • SHA512

    e08b85acb7fcf1845d5b2194db1591c3ebf1c98fad8c174fa7e86807407a382dc8a876fe990eff7e35d762e6e69ab71d1c5604d0402934339a2678fddc816ab1

  • SSDEEP

    3072:jEGh0oPlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGVl5eKcAEc

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_325ad5cab02211ba043f6a1ec096bc26_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
      C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
        C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
          C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
            C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:400
            • C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
              C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1536
              • C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
                C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2664
                • C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
                  C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4308
                  • C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
                    C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3388
                    • C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
                      C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:5072
                      • C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
                        C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3152
                        • C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
                          C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4452
                          • C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe
                            C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:4856
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{33052~1.EXE > nul
                            13⤵
                              PID:4144
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{22733~1.EXE > nul
                            12⤵
                              PID:4432
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{409E5~1.EXE > nul
                            11⤵
                              PID:3232
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{9B15B~1.EXE > nul
                            10⤵
                              PID:5028
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{525E4~1.EXE > nul
                            9⤵
                              PID:3220
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{CE8B3~1.EXE > nul
                            8⤵
                              PID:1588
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{6C333~1.EXE > nul
                            7⤵
                              PID:2332
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{94A22~1.EXE > nul
                            6⤵
                              PID:2532
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{47022~1.EXE > nul
                            5⤵
                              PID:4620
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{B2F07~1.EXE > nul
                            4⤵
                              PID:3624
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{D4AF0~1.EXE > nul
                            3⤵
                              PID:4208
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:3476
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:2348

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Windows\{0C545106-F38C-4d32-96B1-2235E4953089}.exe

                              Filesize

                              180KB

                              MD5

                              39a9888ea7d625351497b110200d40e8

                              SHA1

                              0e2f3d444068688fe524cb5c69844c6c53f77111

                              SHA256

                              f93e5de1c85a56411f6209bbd91bfb8d9183574f29d7d3e559f73334b24d40f2

                              SHA512

                              def6c49abb95e7992878fc12f3e8f27cc9c5d0f9088d6ff0c1a712abfd2e0f36428ee7588510870ff987e5fc6d2274dc322cd6c1eae51b1f35a1087eaee5fcb8

                            • C:\Windows\{22733B27-4FDD-4f97-B060-FDB7D27811E5}.exe

                              Filesize

                              180KB

                              MD5

                              533ec6109a92dd2d9d91b38ea66227ea

                              SHA1

                              62209b8b1c91ab314587e9403a6dc0c479e92b1a

                              SHA256

                              7c6ff16c422d84c9b96b230dfee10ad096f69ed4ebcaba19abffc2816e3f12b0

                              SHA512

                              b9a7f71d56fa91ec602876091bef58b965f22fb6b95b33652a24ec8492cf01557a835de3e46688333eec87b8233871243526d372083a8cf6c824f3c0c2d3304e

                            • C:\Windows\{3305248C-2B82-4839-AA3D-9B68836D751F}.exe

                              Filesize

                              180KB

                              MD5

                              ac7041106f3e65c4dac328b123946e50

                              SHA1

                              9111cc017ce177aab4381771cdfbc84cef73a3c3

                              SHA256

                              c6999e3c429ddc27b5dc4eb6df4acc37c461d840291469968c4ebb73501ec5ec

                              SHA512

                              f17bf7a3ff9af22c6c095b58ecf27bfb42fbe2afb2b1bf4d0a266a01c7a7acedf7270776fbbbd2e07c21aa0cb2c8a969a1b78080f9074797c6d0868b03cf2486

                            • C:\Windows\{409E57DE-3362-4722-B0D7-8AC9FBD91320}.exe

                              Filesize

                              180KB

                              MD5

                              77ca970601bbaa9a23b6f49411cae72e

                              SHA1

                              ac2c7003e0fd8ec0f3de252dd3e30bdc9c766aba

                              SHA256

                              efc7b7651b38827bd8d25c39b874566ed54a60e0668bd5f1f93a2e3d55c0883e

                              SHA512

                              59221c24ad1af6cd155e1abb51d7ddf943606b55d2843507cafeb4d1ae1cf8e91f9d5c955877d05f3c484f94783cc4f7a82fc25e3b775ac4d696d46e4b7f08dc

                            • C:\Windows\{470228ED-C373-4a6e-92A5-DDB5D1F20CE7}.exe

                              Filesize

                              180KB

                              MD5

                              352400cf5b738b7c46c4f9851e29a703

                              SHA1

                              379712375f6c3f7466c5d16b4f5d89d20af4ec44

                              SHA256

                              80342f731754278549fc7e3df27d10217d0a7fed380f7f437f88544f7300cefb

                              SHA512

                              02a90f07568afb3b6cbfbd1366f04c65983765c9515ec2c431577a11005fe9210a265433bb303efab30af95b8f31e54bedff37e9f5613449f176500b84bda751

                            • C:\Windows\{525E4A82-DC86-4c4a-8F00-F99791820440}.exe

                              Filesize

                              180KB

                              MD5

                              00d6ccb49e70a325959de7faffa4e58c

                              SHA1

                              51ef40ff84eeff7c5edfffddb9c4de211c060e72

                              SHA256

                              8b280e16d40d32ca947fa5fed9e8a3a60dff4e0431f780840625ff03c30b6118

                              SHA512

                              cbc9300b9b5622e5070f5ff689f5bc6f57b4bc81ba489e10d820760d46fdd20b2ce18cf8ceb547957853e77efca5eb81a0268783ba43a68955d6b7cf028ff340

                            • C:\Windows\{6C33332C-36DE-4e23-8B20-F5569518FE02}.exe

                              Filesize

                              180KB

                              MD5

                              9ee774934793940ba560f56dad0a0073

                              SHA1

                              1c72d67e6a1462a4e638a538159f06dcb3b1cc2f

                              SHA256

                              3adc267eb7eed91b15c39897367462f339152789d5aa76db53abc9359d07ed4e

                              SHA512

                              62098afd8c564a0aca13bb26bcd2155f4ced133f19318cdd9aae9af77385bd944196bbaecefe0c61ad202eeb07464093cd6033243b67637498e69b4f24fab3ea

                            • C:\Windows\{94A2287F-B5A0-4cb3-8D77-B2DEF40876B1}.exe

                              Filesize

                              180KB

                              MD5

                              ac69ba365bd7c3308cb049fac93562b0

                              SHA1

                              53d6e416f87aa08f9879f8538ac2d012a50af139

                              SHA256

                              1372f1552ee95cc4c35947e3233f33bf8a5128babf5da2c1f63dc1f68a0f7fda

                              SHA512

                              2f7c7c1bf3eb9c60c09319f81aa0d888f529266841f24169c9dba60ad1b3fba03af0af2f1bf0c52c18ebf8bed1733c23a3701246b833f4ea2041888806e575b0

                            • C:\Windows\{9B15B89B-748F-4bfa-97A0-220B326DD01F}.exe

                              Filesize

                              180KB

                              MD5

                              51f51449cc769d19208f15fb8bcaf34b

                              SHA1

                              d7c39a77c25c90c01cf3de0ec383fbc3ba5b5ce5

                              SHA256

                              e64f6290e726a2db87dcec2900aef3f059111a39fbb95015009e1d6a4030ddb7

                              SHA512

                              2d2b72c1ee9c70ddc9f6101c194547e1eb2cd7247680573c906ae45143fcb930fa81515f01d2b1ccdeb2182bdd522db0f48da847f9505f349b78068fb1e8e8a5

                            • C:\Windows\{B2F071F2-B353-4cb0-8036-9CF52260162D}.exe

                              Filesize

                              180KB

                              MD5

                              0a60aad11dcebb8bfa23633702a7d79a

                              SHA1

                              b360644da327803302daca4ebca48a324c895f3b

                              SHA256

                              ef342ab0e5fc33e47aeac3f00a8da0361931d335dea42e285db9eb6b0fc678e1

                              SHA512

                              a34b09862e9aee15afaefff013283000070ce0acb105099d5d7488fee0e8777572698b3054d959828b0ef9589e193c12848601a8ec982dbcd2093664bacddbbb

                            • C:\Windows\{CE8B3C5C-6AEC-4a05-B448-21D45AD171F0}.exe

                              Filesize

                              180KB

                              MD5

                              64ac67fe88ab4a59eacfeb51b96e3a3f

                              SHA1

                              63025829d17117a39af6d8a26b501a40fcbae654

                              SHA256

                              e3eb660d740b5c93b5de0a53fa48fa5f02d2a80e8be98cd4b7db5f5dae6ab0c1

                              SHA512

                              f706aa56bc5838710c87ecac48c8d8799d3db2eff5947555e8eea01e33bf7a31ffc47152afdafcd7e3886403a5fc99d4c2f9555b355722dbf3c95ac24332aa39

                            • C:\Windows\{D4AF0C60-CF29-449e-BD86-22D968EFDDCC}.exe

                              Filesize

                              180KB

                              MD5

                              479908d6f9e12826ed4e4577705da4bc

                              SHA1

                              62db8706e355428c95b6166f9ef8e5b2e77c6715

                              SHA256

                              818b7691ace8f1e3f6c83e54fd9d089ee82c90cf4ab1653643eec92d02e61278

                              SHA512

                              f453efb7d5ff7a8d0fb00ed7d2020a68e9a795234707c03462bb22fd233ec4a5a40f737a840104f3d615d7ad24bc13f36b0f42be785d74a66243ab1205482376