Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Desktop Go...31.zip
windows7-x64
1Desktop Go...31.zip
windows10-2004-x64
1Desktop Go...mn.dll
windows7-x64
1Desktop Go...mn.dll
windows10-2004-x64
1Desktop Go...se.bat
windows7-x64
1Desktop Go...se.bat
windows10-2004-x64
1Desktop Go...od.dll
windows7-x64
1Desktop Go...od.dll
windows10-2004-x64
1Desktop Go...PI.dll
windows7-x64
1Desktop Go...PI.dll
windows10-2004-x64
1Desktop Go...od.dll
windows7-x64
1Desktop Go...od.dll
windows10-2004-x64
1Desktop Go...PI.dll
windows7-x64
1Desktop Go...PI.dll
windows10-2004-x64
1Desktop Go...PI.dll
windows7-x64
1Desktop Go...PI.dll
windows10-2004-x64
1Desktop Go...op.exe
windows7-x64
1Desktop Go...op.exe
windows10-2004-x64
1Desktop Go...PI.dll
windows7-x64
1Desktop Go...PI.dll
windows10-2004-x64
1Desktop Go...MQ.dll
windows7-x64
1Desktop Go...MQ.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 15:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
Desktop Goose v0.31.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Desktop Goose v0.31.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Desktop Goose v0.31/DesktopGoose v0.31/Assets/Mods/Autumn/Autumn.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Desktop Goose v0.31/DesktopGoose v0.31/Assets/Mods/Autumn/Autumn.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Desktop Goose v0.31/DesktopGoose v0.31/Close Goose.bat
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Desktop Goose v0.31/DesktopGoose v0.31/Close Goose.bat
Resource
win10v2004-20240220-en
Behavioral task
behavioral7
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/DefaultMod/bin/Release/DefaultMod.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/DefaultMod/bin/Release/DefaultMod.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/DefaultMod/bin/Release/GooseModdingAPI.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/DefaultMod/bin/Release/GooseModdingAPI.dll
Resource
win10v2004-20240220-en
Behavioral task
behavioral11
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/DefaultMod/obj/Release/DefaultMod.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/DefaultMod/obj/Release/DefaultMod.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/GooseModdingAPI/bin/Release/GooseModdingAPI.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/GooseModdingAPI/bin/Release/GooseModdingAPI.dll
Resource
win10v2004-20240220-en
Behavioral task
behavioral15
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/GooseModdingAPI/obj/Release/GooseModdingAPI.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Desktop Goose v0.31/DesktopGoose v0.31/FOR MOD-MAKERS/GooseMod_DefaultSolution/GooseModdingAPI/obj/Release/GooseModdingAPI.dll
Resource
win10v2004-20240220-en
Behavioral task
behavioral17
Sample
Desktop Goose v0.31/DesktopGoose v0.31/GooseDesktop.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Desktop Goose v0.31/DesktopGoose v0.31/GooseDesktop.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Desktop Goose v0.31/DesktopGoose v0.31/GooseModdingAPI.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Desktop Goose v0.31/DesktopGoose v0.31/GooseModdingAPI.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Desktop Goose v0.31/DesktopGoose v0.31/MMQ.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
Desktop Goose v0.31/DesktopGoose v0.31/MMQ.dll
Resource
win10v2004-20231215-en
General
-
Target
Desktop Goose v0.31/DesktopGoose v0.31/Close Goose.bat
-
Size
31B
-
MD5
1fdef6890e156b9aa7b662a4314dc712
-
SHA1
0c1e18150345fc43924c96844b8fd0fc53ec8855
-
SHA256
9d3b5a6370f076a57651fcf06fc4f3fbce8d9e5156642e22141a8f521f35ffdc
-
SHA512
474b7169f7a2deca1298391c42b0d5a8cb55b33853eaf1d79026c9b9b45d9a687582a0aa0d0ff639e5d9b40535cda3b3827546d26f1d35fa9169bcd73f050d29
Malware Config
Signatures
-
Kills process with taskkill 1 IoCs
pid Process 4860 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4860 taskkill.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3932 wrote to memory of 4860 3932 cmd.exe 86 PID 3932 wrote to memory of 4860 3932 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\Close Goose.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\system32\taskkill.exetaskkill /f /im goosedesktop.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=345753C138AC6B60382947EA398B6A20; domain=.bing.com; expires=Sun, 16-Mar-2025 15:50:56 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 933C926D3339442DAAF76CD1F4A31A04 Ref B: LON04EDGE0708 Ref C: 2024-02-20T15:50:56Z
date: Tue, 20 Feb 2024 15:50:56 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=345753C138AC6B60382947EA398B6A20
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=llI4D1aSZ2L0ew3XnZH49-JDH1XiXGKLqUzjot8GaPQ; domain=.bing.com; expires=Sun, 16-Mar-2025 15:50:56 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CE43BB64A6B945DFA6C818FB654E9452 Ref B: LON04EDGE0708 Ref C: 2024-02-20T15:50:56Z
date: Tue, 20 Feb 2024 15:50:56 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=345753C138AC6B60382947EA398B6A20; MSPTC=llI4D1aSZ2L0ew3XnZH49-JDH1XiXGKLqUzjot8GaPQ
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 233425BB13E64942807929D2C3BF1D45 Ref B: LON04EDGE0708 Ref C: 2024-02-20T15:50:57Z
date: Tue, 20 Feb 2024 15:50:56 GMT
-
Remote address:8.8.8.8:53Request83.177.190.20.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239338877209_1W0BYALNC7PUDJ3J3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:92.123.128.147:443RequestGET /th?id=OADD2.10239338877209_1W0BYALNC7PUDJ3J3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
cookie: MUID=345753C138AC6B60382947EA398B6A20; MSPTC=llI4D1aSZ2L0ew3XnZH49-JDH1XiXGKLqUzjot8GaPQ
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 457
date: Tue, 20 Feb 2024 15:50:57 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.93777b5c.1708444257.3abb4a80
-
Remote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request147.128.123.92.in-addr.arpaIN PTRResponse147.128.123.92.in-addr.arpaIN PTRa92-123-128-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request209.78.101.95.in-addr.arpaIN PTRResponse209.78.101.95.in-addr.arpaIN PTRa95-101-78-209deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=tls, http22.0kB 9.2kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ac5e25b09e34bcb9b6152ba47a6aec0&localId=w:20FE1886-F126-C67B-C1F7-0172F6B4D54C&deviceId=6755460716320780&anid=HTTP Response
204 -
92.123.128.147:443https://www.bing.com/th?id=OADD2.10239338877209_1W0BYALNC7PUDJ3J3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http21.5kB 5.8kB 16 14
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239338877209_1W0BYALNC7PUDJ3J3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 158 B 1 1
DNS Request
83.177.190.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
57.169.31.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
147.128.123.92.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
209.78.101.95.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-