Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25/06/2024, 10:06
General
-
Target
2024-06-25_cb0dca067253ba56502d1f95e5bc1c50_goldeneye.exe
-
Size
372KB
-
MD5
cb0dca067253ba56502d1f95e5bc1c50
-
SHA1
9d6d9a133eabcb5b69615bb2b8106e042c3edc84
-
SHA256
cea67938829e30a8f5a7ed3edf6ee027760b6627af5c79221e1d4f797df0f955
-
SHA512
2ecdbe7752c2c526d3df705517081217ec642593f125d37f1145001d95afec1ed9cf4a9150d56d58987748c32f94908a217e2a0727696957543c8771abe5df09
-
SSDEEP
3072:CEGh0oWlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG0lkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_cb0dca067253ba56502d1f95e5bc1c50_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_cb0dca067253ba56502d1f95e5bc1c50_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D7197BBF-DE0E-4120-B441-2091C68A69EE}.exeC:\Windows\{D7197BBF-DE0E-4120-B441-2091C68A69EE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D016533-71F6-4f10-ACAC-AE62A3AA53FA}.exeC:\Windows\{7D016533-71F6-4f10-ACAC-AE62A3AA53FA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA16A664-F39E-4fe8-81CC-C5CE82D173F7}.exeC:\Windows\{CA16A664-F39E-4fe8-81CC-C5CE82D173F7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2127006A-F496-44a6-8C2C-696E44D98A89}.exeC:\Windows\{2127006A-F496-44a6-8C2C-696E44D98A89}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C6969B7-AF9E-4750-ACAE-8F8BBB1D2F6A}.exeC:\Windows\{1C6969B7-AF9E-4750-ACAE-8F8BBB1D2F6A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6EA9F3F5-9787-4361-B855-5EC2DA35D278}.exeC:\Windows\{6EA9F3F5-9787-4361-B855-5EC2DA35D278}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68632B6D-A487-4b6b-B62D-A7BE977811F4}.exeC:\Windows\{68632B6D-A487-4b6b-B62D-A7BE977811F4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6292286E-38E8-4eeb-ADF3-843F6D1354B5}.exeC:\Windows\{6292286E-38E8-4eeb-ADF3-843F6D1354B5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AEF25FF-08D2-499b-B4C6-FB5123DB499A}.exeC:\Windows\{0AEF25FF-08D2-499b-B4C6-FB5123DB499A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4109F97A-C7AC-4c81-AB34-99CBECE2771C}.exeC:\Windows\{4109F97A-C7AC-4c81-AB34-99CBECE2771C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09E54FDE-470F-4579-8F4C-86792E2DC945}.exeC:\Windows\{09E54FDE-470F-4579-8F4C-86792E2DC945}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{60987436-F8B7-47fa-9B89-65BD5EF82AA1}.exeC:\Windows\{60987436-F8B7-47fa-9B89-65BD5EF82AA1}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09E54~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4109F~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AEF2~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62922~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68632~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EA9F~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C696~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21270~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA16A~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D016~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7197~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5a5f70c9f36c9cf1bb509d36e55ec16e0
SHA10f4a611c9b2fb063d9af5a863f8d2a468596ae7f
SHA2562a805fda9cdc3e79984fbdc1aa37ead28810db5d474e0530edec533796ef3975
SHA512b37f4ff548b40d9078d1d3e77663893ff0f3a435c1a9f55710cfabf8be80db2245d7637a1ff717783a8114e3cc52e2450e2c1aa49a363ef399cc4a400c226df6
-
Filesize
372KB
MD544bb73a3b0ad64f14eaf189b4c81145c
SHA12d7cb91b6eabfe36dd75fb8716b3e5088c22ab04
SHA2563f233f870955ce63de2ec3322a1483a23f660c36054ef54566514d8402c369be
SHA51257835d30712dfc61a08b732338fea0e952afcec0142cf9655c7372612d5931ee715afa71d569eb1155ecc3e43a5c9ee3edfc740f1411481ddf840eada77e035a
-
Filesize
372KB
MD59064955b14992cae0c532ed06a67c808
SHA18904690494922d99b750c92379e5ed8918a0b4f3
SHA2562bd5d7b6a5a74ba4f9391d01b552cdf03d45fda4403c051d559677eb283c5680
SHA5123970376d7718970f28d1e4ba7073224231de4f12e62d53d35375de9f3b3049ff13f554ef36b438684ccfa837b10ea7a2bd56321638a75a629205df8ac4e7236a
-
Filesize
372KB
MD503c1557c4ed81e59f45f1c9d0e9c2e5e
SHA1f9b52a6f9b8056cd970574db2b4a0d2f4f6e3b2b
SHA2560e39a1c99ff75db8fe7a664e950cf7e5e7ba264eb808c41f095e677dbf7c9395
SHA512a5a236c54175796c234261f58f3caba7eb9178fe05bfbcfd9bc9b67d4007510575d6660d9e542264ffe7a334f275f190acf1d0021b34f0f98b77a9f06824f137
-
Filesize
372KB
MD543430b81f04b8eb6c1228125fc7bf6be
SHA1118a74c84896b9f0d9d6d34fbc03e2896fbfdfd9
SHA256d917742ceef13170fd85cfc04008809dc91efff9c59a4c9bec16b162a5e8478b
SHA512f00264a23b1e10da27b530c31118e96e023b10d6c10099311c3cb39250d59679f70df25b71511531623c079b82c0bfd8e696a72feed978816cb73152d777b2fd
-
Filesize
372KB
MD5b83fcf17e1f15cacda5beb6309b2c143
SHA141f965f8bf33fd5cb6108be172650534ac52bdd0
SHA256d183bd0a6cb7369c28006e4da125d9c0391c3492c04d22cca7bc7a5da56f926c
SHA5121561a1aa202c58909376bc934447cee8cf81a74179e308a31dab29401e9a777cb7c842f6c5676b72b8942e5056d389156f058c7978db41778629baf7917691e2
-
Filesize
372KB
MD55fbff1b7df5fbb72510463054afb4f9b
SHA1ccfe48ff8ba7997b6d23930b4a543c35b1810181
SHA256c6bdf0b2ef07cedded71ebfa77a493dde4f41d1dd4747d0f3eeb91371f86fc30
SHA512838e8b49ba5cb24a777b4dcc586cf6fd74305482f5b0be649d056e5eb860f8dd7f6cf24958efbfa1ee997694471cd21edb67bdfb22238620639f2acd4d3af698
-
Filesize
372KB
MD54e61f4ade1f50d24fdbfa83cb5f41372
SHA1a7b67a24f30b318a1bcacfc70da974563cb95071
SHA256ac80b5816396894db4880d284b1584525b19d149eb4d139bc8007ca5bc4b9ef0
SHA51207d36c072ea2d3a0c4bb62c6c2eb4324c88f6f255b13f04aa83a73f71967c83270ae5aaaeca977c2edbf06334cb78a1afb75509d118764efdbbab267efec4538
-
Filesize
372KB
MD5bea3ba197d94248e0231a6fdaf81254f
SHA138b902db83aa4e91bf88891c9ac7886e58047af5
SHA25690532adb29ffac77d3a6e4d27f9e5fa7da0cc2415638428aad4a8ca8770f48f6
SHA512ad1a59cdb9aee859f993afb4b22f97f753d28ae3561b4d93200aecac340011d4fe0df745177fe53f8a7be1b667f53b6641f714edb9bc63f0ea5cd72bf5d3602b
-
Filesize
372KB
MD52de516a58a5e67fa1aaffc82cf70f247
SHA1d060856abfe109c536eb80e502069d60021780d5
SHA256dda733e2dbfaa7ae0f57ee1b63664a83d660d3f1a4c588f6f54c182153e50981
SHA5125d5d7dd187a940d6ff325954f8c813170deceb45c31dc03e803fb93331fc311f56a1d859d110b51dbc72b45a6af16e5463813d4be3f230bfba498db358a717e2
-
Filesize
372KB
MD5ccba61911bff7e73ce8b055dd650f50f
SHA1fce75165d38017d9cb84436dadf3e1ad35f3d563
SHA2567aef2c8f417c05da37d4d1d672f0662f9f7dbde96b6644d43f5e5fc73f26d510
SHA512f75248bb6e28847de5682d6480bcd1d368087ec617cb8af119768cf9b3af90253529ed84a6f5067e4e11e6533e425fcf41c0ca68b53f1ae10edadb38b45a7103
-
Filesize
372KB
MD50b08d926101aedd60e4601d13e1ebb24
SHA1d5b1cf2dba2b4d59635114ef42c22480c51b9b13
SHA25655839a07f1d8aad3b3bcde6b4c57f9f21f5bb86b6c4c06f7e56c3668289ff015
SHA5124911729501135816e66be06218fdaa72a468df629f9ce347d302ab93b0972697bda3f1788368f558718412c5d6cb27d10066117531ec6e0275bea8be42504879