Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 06:47

General

  • Target

    2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe

  • Size

    372KB

  • MD5

    287de4024681a217040de9387e6431ec

  • SHA1

    b54539b660169ae332920d1a64279dc6a13b94e8

  • SHA256

    74a04d922b9ea02ac8deb5a75a98cbbac65cbe9d66e4b2a89ebaa0333373338c

  • SHA512

    aedc5b5a01e6ddf20d57c3492dc59865e0ba43298f8b80c0b58e3bf460d3b7d15cb0ee27b76e634b46d5b68aae0e49a745d46eb132dfdca577e5f0ac32daa5d5

  • SSDEEP

    3072:CEGh0oelMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGclkOe2MUVg3vTeKcAEciTBqr3

Score
9/10

Malware Config

Signatures

  • Auto-generated rule 12 IoCs
  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_287de4024681a217040de9387e6431ec_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Windows\{53FB3137-FA76-4287-A6E3-9DE241781D84}.exe
      C:\Windows\{53FB3137-FA76-4287-A6E3-9DE241781D84}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:424
      • C:\Windows\{AE1B0A0E-9A3D-421e-9BE4-792AA42CA441}.exe
        C:\Windows\{AE1B0A0E-9A3D-421e-9BE4-792AA42CA441}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\{6D1B99C0-B065-48c3-8F97-341FFF14D577}.exe
          C:\Windows\{6D1B99C0-B065-48c3-8F97-341FFF14D577}.exe
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3608
          • C:\Windows\{D9659753-D266-4b28-9130-0611AD429C47}.exe
            C:\Windows\{D9659753-D266-4b28-9130-0611AD429C47}.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Windows\{D7335FAF-4C58-4844-99AB-4D0A86650676}.exe
              C:\Windows\{D7335FAF-4C58-4844-99AB-4D0A86650676}.exe
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3528
              • C:\Windows\{5E77AD91-8F53-47ce-84D5-3019758003DE}.exe
                C:\Windows\{5E77AD91-8F53-47ce-84D5-3019758003DE}.exe
                7⤵
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3960
                • C:\Windows\{C4C2877F-D402-4ccb-81AD-FF1CCD14623D}.exe
                  C:\Windows\{C4C2877F-D402-4ccb-81AD-FF1CCD14623D}.exe
                  8⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2172
                  • C:\Windows\{3A50EDF8-EB12-48b9-A3B5-F60A2618D1DD}.exe
                    C:\Windows\{3A50EDF8-EB12-48b9-A3B5-F60A2618D1DD}.exe
                    9⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1920
                    • C:\Windows\{B9FC0512-DFCF-4fb8-836C-AE749355C733}.exe
                      C:\Windows\{B9FC0512-DFCF-4fb8-836C-AE749355C733}.exe
                      10⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4352
                      • C:\Windows\{672F37FE-C910-4875-82F1-B0F38919B4EF}.exe
                        C:\Windows\{672F37FE-C910-4875-82F1-B0F38919B4EF}.exe
                        11⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4612
                        • C:\Windows\{E53BFF60-81EF-4b4d-90FC-DF2202819181}.exe
                          C:\Windows\{E53BFF60-81EF-4b4d-90FC-DF2202819181}.exe
                          12⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2916
                          • C:\Windows\{986B9944-8AB9-4407-AE47-079679DB67AC}.exe
                            C:\Windows\{986B9944-8AB9-4407-AE47-079679DB67AC}.exe
                            13⤵
                            • Executes dropped EXE
                            PID:4248
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{E53BF~1.EXE > nul
                            13⤵
                              PID:4880
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{672F3~1.EXE > nul
                            12⤵
                              PID:2016
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{B9FC0~1.EXE > nul
                            11⤵
                              PID:1576
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{3A50E~1.EXE > nul
                            10⤵
                              PID:4536
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{C4C28~1.EXE > nul
                            9⤵
                              PID:588
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{5E77A~1.EXE > nul
                            8⤵
                              PID:396
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{D7335~1.EXE > nul
                            7⤵
                              PID:864
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{D9659~1.EXE > nul
                            6⤵
                              PID:4816
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{6D1B9~1.EXE > nul
                            5⤵
                              PID:2404
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{AE1B0~1.EXE > nul
                            4⤵
                              PID:4372
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{53FB3~1.EXE > nul
                            3⤵
                              PID:3308
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:2180

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{3A50EDF8-EB12-48b9-A3B5-F60A2618D1DD}.exe

                            Filesize

                            372KB

                            MD5

                            a650276d881aa6dcd7bb5bc1a0f0fa6c

                            SHA1

                            82bcfcfb59d20dcd0feaa628d2bb3403c3952b10

                            SHA256

                            fd364be09c41591c67fe96a9dc83f93792c64064ec7cdac1a9cf53027ad2a71f

                            SHA512

                            51864b59eabecc56c781fbba63c67afc325889f8c9b1fe2169558ecf5715ce802b223dc1b71f5583916d012f2fbc6e797f994a451f7ad46d828b6ce1225a200f

                          • C:\Windows\{53FB3137-FA76-4287-A6E3-9DE241781D84}.exe

                            Filesize

                            372KB

                            MD5

                            6c190d248563c18434ac63805526e3dc

                            SHA1

                            6acd76775558f926710e39535d5554259c689983

                            SHA256

                            97865d134484aafb71d6902efb95e58a133984d6a3d8bbea8a42f2a035ec5d96

                            SHA512

                            df5a866a18f594e020672a2dd282916b59969e376d8df5c375951eb63a5c49700ad6119f3b5b221d8ed3bcb48db11ef6ab8c1e5e3da2bb92f30943c5997ef0e8

                          • C:\Windows\{5E77AD91-8F53-47ce-84D5-3019758003DE}.exe

                            Filesize

                            372KB

                            MD5

                            48234cbb5426d19201fa563f2fe04647

                            SHA1

                            64172646aaaed185ab25aa4c1a754383581430fb

                            SHA256

                            cdf64219a4bac72aa1d957baa61f676f682e3714fc6f3af5afd8fb55aae653ae

                            SHA512

                            4f3524bcbef41343b24c565248d77c1f7fc68602f1320dd9696a4ff2c9b1cdfb09546339a3daa324be27817a7099adef9c7c354cc3caffa3532754e87bab99e8

                          • C:\Windows\{672F37FE-C910-4875-82F1-B0F38919B4EF}.exe

                            Filesize

                            372KB

                            MD5

                            561f7c9932897f8143b098fc35482b80

                            SHA1

                            25fdfa8efca7325e49d377e80b232c02e5251c2f

                            SHA256

                            7a426382e084d79385446781bd63fd42e2f7f412b6e7504519f49ecdf293507d

                            SHA512

                            4ccdafee390efc83a86843a33910044232758852bb7b8d6ee07e1aebcd419350eef5db26127733eee397d95d88884d4b7ea46a08c45b7e0330cdcf7cc0a29ce4

                          • C:\Windows\{6D1B99C0-B065-48c3-8F97-341FFF14D577}.exe

                            Filesize

                            372KB

                            MD5

                            46bbff3e4d949ba3331f6605e3757fe6

                            SHA1

                            b5829ff33a9ec01e54595ea26c7a26775ce3aec4

                            SHA256

                            a6f829c298e1496dfccda88d8645a3d909eba35b58d39a309b1dd40f71f4cba3

                            SHA512

                            b86dc92454be9cb5d5e083412ed41a481e34b92a5e16eecb2b99e51dbbfcbea7e1566d0232a02b5f97652d44af0e58344c6457d1683e4b6809561ca1a1957071

                          • C:\Windows\{986B9944-8AB9-4407-AE47-079679DB67AC}.exe

                            Filesize

                            372KB

                            MD5

                            53a1cea7ef2041d77a4ec85058146dce

                            SHA1

                            af7e0cf7afc4fa64db3821a171608c5127892f35

                            SHA256

                            39202ceb17a4523b10a34d379a87108a302fdc77028ff44de6bcec2bddb3f6d7

                            SHA512

                            32284a65eac0be851d5d05e9c2614900a1cfdc115740f37baf70af692aaf937b88106f6b6dba305104e8d71c382e14fe8a1f99e690265bfe9d5c51b7c31fb5af

                          • C:\Windows\{AE1B0A0E-9A3D-421e-9BE4-792AA42CA441}.exe

                            Filesize

                            372KB

                            MD5

                            194161e9ac793c7e12c5bb4585194f72

                            SHA1

                            da353dab9bd3a930e29be691aacf926a6d6f738b

                            SHA256

                            5d46a9a1b84c845719a2aa6b8879e85a98cf7cac42c360fe89bd86f8f3812702

                            SHA512

                            6f2839b3953e2846bb82e24e743daa292c93a18525200b021b49965337527699394a7ebdfdeb6a105683b248eb0489f1f5e4fe54127a4d4c744d2ab8f34b40b1

                          • C:\Windows\{B9FC0512-DFCF-4fb8-836C-AE749355C733}.exe

                            Filesize

                            372KB

                            MD5

                            6a8d5d0984e0f94ac8fb90e4742bf7aa

                            SHA1

                            1b544b1e5106c6c3e069359bdbc0ffe3ab961c5f

                            SHA256

                            406e94e00d05f8b179456cff3bcac6737381fb1635e3127e150ded5c68ecb05d

                            SHA512

                            dea0cf055bb62b4854f8b27b86cd2f7ca3b978fb2b4514fcc445d859c3625407d29cd115be7e542531c8bd9614388bef51e7cd3ff871d231d17f2e0515b31ca5

                          • C:\Windows\{C4C2877F-D402-4ccb-81AD-FF1CCD14623D}.exe

                            Filesize

                            372KB

                            MD5

                            b61ab20cf483645f21128a06d2baf5c5

                            SHA1

                            655723267115642ad3ee17939f7cda8a15ef7dfb

                            SHA256

                            a8945c33deaf6dc08d9373795c4f178969287cdd16b8a337213aa9ad0ad79b49

                            SHA512

                            5e81329c79efd23bfb8f44f8888e37a9e0c2542cbc65eaef643362341459e19a6c8527b1f37250ca83f4036cae6e84eb0b52dcf099ff29f2da6946d8df22c084

                          • C:\Windows\{D7335FAF-4C58-4844-99AB-4D0A86650676}.exe

                            Filesize

                            372KB

                            MD5

                            5076f7caf2dc0a0d46b751f3b5b9915a

                            SHA1

                            b7a38995d481422f09b9197b914000b6a2b07bb8

                            SHA256

                            ee019dc23b3f54031986ac33286ca718d01f5906ae4e65680dd442e2b0da17c5

                            SHA512

                            4535a335ec27e97d076ed186814e6c4e81082aa86d6fc27243fc52448cb70627f9abb93aa01c7c060246bab7784c2d119fde7d4a284196aad444ccd54291f608

                          • C:\Windows\{D9659753-D266-4b28-9130-0611AD429C47}.exe

                            Filesize

                            372KB

                            MD5

                            73717526dfe226cde9dea19f11187c7a

                            SHA1

                            1e3abec4c00e07dea1a1909b787ae71649580a2a

                            SHA256

                            39320fa83a18b4bfa3d3cc367497b1d1bccc4de2b885cf13f7417c436469232f

                            SHA512

                            2030a6ff6c3b6b2ea8fc83feb714f07d2554c09a337334d835b048acae7d80cae0af073d3fdefc07f60361c763bda62125b46e735850d91568c9ae15c1a53df1

                          • C:\Windows\{E53BFF60-81EF-4b4d-90FC-DF2202819181}.exe

                            Filesize

                            372KB

                            MD5

                            18e7c63834377f67086413a56b135095

                            SHA1

                            b7251e1cb6331093a712f30d48992e90e5db3024

                            SHA256

                            f843a2e3acbdefa7c147e60bb7c1a68fb84c883506c4cc84f7ec43cae2fb3c6a

                            SHA512

                            b3f6a8e47954b78d436b6d8bb074c732049d43ca772d18cfb684e53882382ecfee744aadb4d3cb067d1dcbc1397f9d43f097ab4a9051db585e728b85900adc9e